@voxgig/station 0.0.1 → 0.1.0

package/dist/src/profile.js

@@ -1,28 +1,193 @@
 "use strict";
-/* The FILE half of profile handling - finding and reading
- * station.json - and the scope rule that hangs off where it was found.
- * NODE-ONLY by construction (fs/os/path), which is the §2.2 / §17
- * Phase 1 split: the browser entry never imports this module, and
- * `Station` reaches it through the ConfigFileIO seam the node entry
- * registers. The pure half (selectProfile, refapi, resolveProfile)
- * lives in `profilecore.ts` and is re-exported here so every existing
- * import of `./profile` keeps working. */
+/* Profile handling, whole: the pure half - selection, the ref grammar
+ * and the §3.3 merge - and the file half that finds and reads
+ * station.json plus the scope rule hanging off where it was found.
+ *
+ * These were two modules. `profilecore.ts` held the pure half so the
+ * BROWSER ENTRY could reach it without pulling `node:fs`, and `Station`
+ * reached the file half through a `ConfigFileIO` seam the node entry
+ * registered. Station is server-side only, so the split, the seam and
+ * the second entry are all gone and this is one module again. Every
+ * import of `./profile` is unchanged - that path always re-exported the
+ * pure half. */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.selectProfile = exports.resolveProfile = exports.refapi = void 0;
+exports.selectProfile = selectProfile;
+exports.refapi = refapi;
+exports.resolveProfile = resolveProfile;
 exports.findConfigFile = findConfigFile;
 exports.loadConfig = loadConfig;
 exports.configScope = configScope;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
+const sekreto_1 = require("@voxgig/sekreto");
+const descriptor_1 = require("./descriptor");
 const error_1 = require("./error");
-var profilecore_1 = require("./profilecore");
-Object.defineProperty(exports, "refapi", { enumerable: true, get: function () { return profilecore_1.refapi; } });
-Object.defineProperty(exports, "resolveProfile", { enumerable: true, get: function () { return profilecore_1.resolveProfile; } });
-Object.defineProperty(exports, "selectProfile", { enumerable: true, get: function () { return profilecore_1.selectProfile; } });
+const shape_1 = require("./shape");
+// Profile selection: VOXGIG_STATION_PROFILE, else the open() option,
+// else 'default' (design §3.5 - env vars rank above station.json but
+// below open() opts; profile NAME selection follows the same order with
+// open() opts winning).
+//
+// `process` is read directly. It used to go through a `typeof` guard
+// because the browser entry reached this code and has no `process`;
+// station is server-side only, so the guard guarded nothing.
+function selectProfile(optProfile) {
+    if (null != optProfile && '' !== optProfile) {
+        return optProfile;
+    }
+    const env = process.env.VOXGIG_STATION_PROFILE;
+    if (null != env && '' !== env) {
+        return env;
+    }
+    return 'default';
+}
+// The api half of a ref is the substring before the first `$`, and an
+// untagged ref IS an api slug (design §3.4) - which is why the whole
+// `plugin` -> `sdk` migration is a key rename and nothing else.
+//
+// LEXICAL, and that is the point: under the old free-form identity
+// which api an instance used was itself a merged value, so the merge
+// could not be a flat pass over both maps and a port that got the
+// phasing wrong silently picked another api's defaults (§3.3).
+function refapi(ref) {
+    const at = String(ref).indexOf('$');
+    return -1 === at ? String(ref) : String(ref).slice(0, at);
+}
+// Shallow merge, per key, left to right - each source over the one
+// before it. Declared rather than assumed: plugin's library default is
+// a deep map merge, and an allowlist that widens because two precedence
+// levels merged is the failure this rule exists to prevent
+// (station-and-plugin.md §2.5). The visible consequence: an overlay's
+// `policy` REPLACES the base's entirely rather than merging `hosts`
+// into it. That is also the safer reading for an allowlist.
+function shallow(...sources) {
+    const out = {};
+    for (const src of sources) {
+        if (null == src || 'object' !== typeof src || Array.isArray(src)) {
+            continue;
+        }
+        for (const k of Object.keys(src)) {
+            out[k] = src[k];
+        }
+    }
+    return out;
+}
+// Merge the base profile ('default') with the selected overlay.
+//
+// §3.3's total order, for the two block levels - lowest precedence
+// first:
+//
+//   base.api[<api>] ⊕ base.sdk[<ref>] ⊕ overlay.api[<api>] ⊕ overlay.sdk[<ref>]
+//
+// PROFILE SPECIFICITY OUTRANKS BLOCK SPECIFICITY. A `prod` api-level
+// `base` beats a `default` instance-level `base`, because that is what
+// an environment overlay is for; within one profile the instance beats
+// the api default, because that is what an instance is for.
+//
+// THIS IS ONE FLAT LEFT-TO-RIGHT MERGE AND MUST NOT BE REORGANIZED INTO
+// "collapse each namespace, then put instance over api". Collapsing
+// first computes (base.api ⊕ overlay.api) and (base.sdk ⊕ overlay.sdk)
+// and then lets EVERY instance value beat EVERY api value - the exact
+// opposite. A production `api.stripe.policy` would then fail to
+// override a default profile's `sdk.stripe$test.policy`, silently
+// keeping the wider allowlist in production.
+//
+// `secrets.providers` replaces wholesale, never merges (§3.5, §5.2):
+// chain order decides which store wins, so a positional merge would be
+// actively dangerous.
+function resolveProfile(config, profileName) {
+    const profiles = config?.profiles || {};
+    const base = profiles['default'] || {};
+    const overlay = 'default' === profileName
+        ? {} : (profiles[profileName] || {});
+    const providers = overlay.secrets?.providers ?? base.secrets?.providers ??
+        [{ kind: 'env' }];
+    const api = {};
+    for (const slug of sortedkeys(base.api, overlay.api)) {
+        api[slug] = shallow(base.api?.[slug], overlay.api?.[slug]);
+    }
+    // An api block declares no instance, so the ref set comes from the
+    // two `sdk` maps alone.
+    const sdk = {};
+    for (const ref of sortedkeys(base.sdk, overlay.sdk)) {
+        const a = refapi(ref);
+        const merged = shallow(base.api?.[a], base.sdk?.[ref], overlay.api?.[a], overlay.sdk?.[ref]);
+        // Defaults are applied ONCE, to the fully merged instance, and this
+        // is the rule §4.2's normalization must not be confused with. Had
+        // the overlay block carried a synthesized `active: true` into the
+        // merge, a one-key environment override would silently re-enable an
+        // integration the base declared `active: false` - live in
+        // production despite being declared inactive. The `instance` corpus
+        // section carries exactly this case.
+        for (const k of Object.keys(shape_1.BLOCK_DEFAULTS)) {
+            if (undefined === merged[k]) {
+                merged[k] = shape_1.BLOCK_DEFAULTS[k]();
+            }
+        }
+        sdk[ref] = merged;
+    }
+    checksecrets(sdk, profileName);
+    return { name: profileName, providers, api, sdk };
+}
+// A configured secret name sekreto would reject is caught at profile
+// load, not first request (§14 station_secret_name) - and then the
+// derived names are checked for uniqueness, because envtoken is LOSSY.
+//
+// It collapses any run of non-alphanumerics to `_`, so `$` and `-` are
+// indistinguishable downstream: the ref `stripe$test` and an untagged
+// instance of an api slugged `stripe-test` both derive
+// `stripe_test.apikey`. That pairing is the realistic one rather than a
+// contrived one, because api slugs are hyphenated by construction - so
+// a fleet with both a `stripe-test` api and a `test` instance of
+// `stripe` collides by default. Since the resolution cache is keyed by
+// secret name (§5.3), the second instance would silently receive the
+// first's value.
+//
+// Two instances that EXPLICITLY name the same secret are not a
+// collision - that is the shared-key case the api-level `secret` exists
+// for, and saying so out loud is how you ask for it.
+function checksecrets(sdk, profileName) {
+    const refs = Object.keys(sdk).sort();
+    for (const ref of refs) {
+        const name = sdk[ref].secret;
+        if (null != name && !(0, sekreto_1.validname)(name)) {
+            throw new error_1.StationError('station_secret_name', 'profile "' + profileName + '" sdk "' + ref +
+                '": secret name rejected by sekreto: ' + JSON.stringify(name));
+        }
+    }
+    const seen = new Map();
+    for (const ref of refs) {
+        const written = sdk[ref].secret;
+        const derived = null == written || '' === written;
+        const name = derived ? (0, descriptor_1.secretnameDefault)(ref) : written;
+        const prior = seen.get(name);
+        if (undefined !== prior && (derived || prior.derived)) {
+            throw new error_1.StationError('station_secret_collision', 'profile "' + profileName + '": instances "' + prior.ref + '" and "' +
+                ref + '" both resolve to secret name "' + name +
+                '", so they would share one credential; name it explicitly on ' +
+                'each, or at the api level to share it deliberately (§5.1)');
+        }
+        if (undefined === prior) {
+            seen.set(name, { ref, derived });
+        }
+    }
+}
+function sortedkeys(...maps) {
+    const keys = new Set();
+    for (const m of maps) {
+        if (null == m || 'object' !== typeof m || Array.isArray(m)) {
+            continue;
+        }
+        for (const k of Object.keys(m)) {
+            keys.add(k);
+        }
+    }
+    return Array.from(keys).sort();
+}
 // station.json lookup: cwd upward to the repo root, then
 // ~/.voxgig/station.json (design §3.5). A repo root is where .git lives;
 // with no repo the walk stops at the filesystem root.

package/dist/src/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/profile.ts"],"names":[],"mappings":";AAAA;;;;;;;0CAO0C;;;;;;AAiB1C,wCAYC;AAED,gCAcC;AASD,kCAKC;AAzDD,sDAAwB;AACxB,sDAAwB;AACxB,0DAA4B;AAE5B,mCAAsC;AAGtC,6CAEsB;AADpB,qGAAA,MAAM,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,4GAAA,aAAa,OAAA;AAIvC,yDAAyD;AACzD,yEAAyE;AACzE,sDAAsD;AACtD,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7C,SAAU,CAAC;QACT,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAChD,IAAI,iBAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;QAClD,MAAM,UAAU,GAAG,iBAAE,CAAC,UAAU,CAAC,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,mBAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,UAAU,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAAC,MAAK;QAAC,CAAC;QAC3C,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,iBAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,SAAgB,UAAU,CAAC,IAAa;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1C,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,oBAAY,CAAC,wBAAwB,EAC7C,kBAAkB,GAAG,IAAI,GAAG,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,6BAA6B;AAC7B,SAAgB,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,MAAM,CAAA;IAAC,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/profile.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;gBAUgB;;;;;AAqBhB,sCAKC;AAUD,wBAGC;AAsDD,wCA6CC;AA+DD,wCAYC;AAED,gCAcC;AASD,kCAKC;AAjPD,sDAAwB;AACxB,sDAAwB;AACxB,0DAA4B;AAE5B,6CAA2C;AAE3C,6CAAgD;AAChD,mCAAsC;AACtC,mCAAwC;AAGxC,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,wBAAwB;AACxB,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,6DAA6D;AAC7D,SAAgB,aAAa,CAAC,UAAmB;IAC/C,IAAI,IAAI,IAAI,UAAU,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QAAC,OAAO,UAAU,CAAA;IAAC,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAAC,OAAO,GAAG,CAAA;IAAC,CAAC;IAC7C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,sEAAsE;AACtE,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,+DAA+D;AAC/D,SAAgB,MAAM,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC3D,CAAC;AAeD,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,2DAA2D;AAC3D,sEAAsE;AACtE,oEAAoE;AACpE,4DAA4D;AAC5D,SAAS,OAAO,CAAC,GAAG,OAAc;IAChC,MAAM,GAAG,GAAQ,EAAE,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,OAAO,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,SAAS;AACT,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,kEAAkE;AAClE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sBAAsB;AACtB,SAAgB,cAAc,CAC5B,MAA4B,EAAE,WAAmB;IAEjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvC,MAAM,IAAI,GAAQ,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAQ,SAAS,KAAK,WAAW;QAC5C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS;QACrE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEnB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,mEAAmE;IACnE,wBAAwB;IACxB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,MAAM,GAAG,OAAO,CACpB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EACb,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EACf,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAChB,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CACnB,CAAA;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,0DAA0D;QAC1D,oEAAoE;QACpE,qCAAqC;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAc,CAAC,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC,GAAG,sBAAc,CAAC,CAAC,CAAC,EAAE,CAAA;YAAC,CAAC;QAClE,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;IACnB,CAAC;IAED,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAE9B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AACnD,CAAC;AAED,qEAAqE;AACrE,mEAAmE;AACnE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,uDAAuD;AACvD,wEAAwE;AACxE,uEAAuE;AACvE,iEAAiE;AACjE,uEAAuE;AACvE,qEAAqE;AACrE,iBAAiB;AACjB,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,qDAAqD;AACrD,SAAS,YAAY,CACnB,GAA6B,EAAE,WAAmB;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC5B,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAY,CAAC,qBAAqB,EAC1C,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,GAAG;gBAC3C,sCAAsC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6C,CAAA;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC/B,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,EAAE,KAAK,OAAO,CAAA;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAE,OAAkB,CAAA;QAEnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,SAAS,KAAK,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,oBAAY,CAAC,0BAA0B,EAC/C,WAAW,GAAG,WAAW,GAAG,gBAAgB,GAAG,KAAK,CAAC,GAAG,GAAG,SAAS;gBACpE,GAAG,GAAG,iCAAiC,GAAG,IAAI;gBAC9C,+DAA+D;gBAC/D,2DAA2D,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,IAAW;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;AAChC,CAAC;AAED,yDAAyD;AACzD,yEAAyE;AACzE,sDAAsD;AACtD,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7C,SAAU,CAAC;QACT,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAChD,IAAI,iBAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;QAClD,MAAM,UAAU,GAAG,iBAAE,CAAC,UAAU,CAAC,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,mBAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,UAAU,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAAC,MAAK;QAAC,CAAC;QAC3C,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,iBAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,SAAgB,UAAU,CAAC,IAAa;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1C,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,oBAAY,CAAC,wBAAwB,EAC7C,kBAAkB,GAAG,IAAI,GAAG,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,6BAA6B;AAC7B,SAAgB,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,MAAM,CAAA;IAAC,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voxgig/station",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "description": "station: one control surface for outbound integrations (TypeScript, canonical)",
   "main": "dist/src/index.js",
   "type": "commonjs",
@@ -8,7 +8,6 @@
   "exports": {
     ".": {
       "types": "./dist/src/index.d.ts",
-      "browser": "./dist/src/index.browser.js",
       "default": "./dist/src/index.js"
     },
     "./package.json": "./package.json"

package/src/Station.ts

@@ -3,8 +3,8 @@ import { StationError } from './error'
 import { EventBuffer } from './events'
 import { canonicalSerialize, normalizeDescriptor, secretnameDefault } from './descriptor'
 import {
-  refapi, resolveProfile, selectProfile, ResolvedProfile,
-} from './profilecore'
+  configScope, loadConfig, refapi, resolveProfile, selectProfile, ResolvedProfile,
+} from './profile'
 import { FactoryEntry, factoryFor, provide } from './factory'
 import { loadAsync, loadSync } from './loader'
 import {
@@ -23,27 +23,6 @@ import {
 // deferred amplifier - `require` therefore fails on the operation path
 // (design §2.1/§14), and `auto` degrades to solo with one warning event.
 
-/** The FILE half of config loading, behind a seam so this module never
- * imports it (§2.2, §17 Phase 1: no top-level `node:` imports reachable
- * from the browser entry). The NODE entry (`index.ts`) registers
- * `profile.ts`'s loadConfig/configScope at module load; the browser
- * entry registers nothing, so a browser `open()` with no explicit
- * `config` behaves exactly as node does when no station.json exists -
- * null config, repo-scoped - rather than inventing a third state.
- * Passing `config` (the documented browser spelling, §2.2) skips the
- * seam entirely on both entries, which is the pre-existing
- * explicit-config path unchanged. */
-export type ConfigFileIO = {
-  loadConfig: (from?: string) => any
-  configScope: (from?: string) => 'repo' | 'user' | 'none'
-}
-
-let configfileio: ConfigFileIO | null = null
-
-export function setConfigFileIO(io: ConfigFileIO): void {
-  configfileio = io
-}
-
 /** §6.1: `as` IS A TAG, NOT A FREE NAME.
  *
  * The api comes from the SDK being passed, so the resulting ref is
@@ -225,7 +204,7 @@ export class Station {
 
     const config = undefined !== this.opts.config
       ? this.opts.config
-      : (null != configfileio ? configfileio.loadConfig(this.opts.folder) : null)
+      : loadConfig(this.opts.folder)
 
     // §6.3: an in-code config is repo-scoped by construction - the
     // application wrote it. A file is repo-scoped unless it came from
@@ -238,8 +217,7 @@ export class Station {
     this.repoScoped = this.opts.repoScoped
       ?? (undefined !== this.opts.config
         ? true
-        : (null == configfileio ||
-          'user' !== configfileio.configScope(this.opts.folder)))
+        : 'user' !== configScope(this.opts.folder))
 
     // Normalize, then validate (design §4.2). A malformed station.json
     // fails open() with EVERY error at once - an eighteen-instance

package/src/descriptor.ts

@@ -142,9 +142,11 @@ export function normalizeDescriptor(config: any, activeFeatures?: Record<string,
 //
 // The bytewise sort compares UTF-8 BYTE SEQUENCES, not UTF-16 code
 // units, through TextEncoder rather than Buffer: TextEncoder is a
-// standard global in Node and every browser, so this module stays on
-// the browser entry's import graph (§2.2, §17 Phase 1) with no node:
-// dependency. Uint8Array elements are unsigned bytes, so plain numeric
+// standard global, so this module carries no node: dependency. (That
+// last point used to matter because a browser entry had to reach this
+// module; station is server-side only now. TextEncoder stays because
+// the behaviour below is what the corpus pins, not because of where it
+// runs.) Uint8Array elements are unsigned bytes, so plain numeric
 // comparison IS the bytewise order Buffer.compare gave - the corpus'
 // non-ASCII sort case pins the equivalence.
 const UTF8 = new TextEncoder()

package/src/index.ts

@@ -1,18 +1,12 @@
 // @voxgig/station - one control surface for outbound integrations.
 //
-// THE NODE ENTRY. `index.browser.ts` is the browser condition's entry
-// (§2.2, §17 Phase 1): same surface MINUS the file-loading half
-// (loadConfig/findConfigFile/configScope) and this registration, which
-// is what hands Station the node-only file half without Station itself
-// importing a `node:` module.
+// THE ONLY ENTRY. There was a second, `index.browser.ts`, selected by a
+// `browser` condition: the same surface minus the file-loading half, so
+// no `node:` builtin was reachable from it. Station is server-side only,
+// so that entry, the `ConfigFileIO` seam it needed and the graph-walk
+// test that guarded it are all gone.
 
-import { configScope, loadConfig } from './profile'
-import { setConfigFileIO } from './Station'
-
-setConfigFileIO({ loadConfig, configScope })
-
-export { Station, instanceRef, setConfigFileIO } from './Station'
-export type { ConfigFileIO } from './Station'
+export { Station, instanceRef } from './Station'
 export { provide, factoryFor, provided, resetFactories } from './factory'
 export type { Factory, FactoryEntry } from './factory'
 export {

package/src/profile.ts

@@ -1,23 +1,210 @@
-/* The FILE half of profile handling - finding and reading
- * station.json - and the scope rule that hangs off where it was found.
- * NODE-ONLY by construction (fs/os/path), which is the §2.2 / §17
- * Phase 1 split: the browser entry never imports this module, and
- * `Station` reaches it through the ConfigFileIO seam the node entry
- * registers. The pure half (selectProfile, refapi, resolveProfile)
- * lives in `profilecore.ts` and is re-exported here so every existing
- * import of `./profile` keeps working. */
+/* Profile handling, whole: the pure half - selection, the ref grammar
+ * and the §3.3 merge - and the file half that finds and reads
+ * station.json plus the scope rule hanging off where it was found.
+ *
+ * These were two modules. `profilecore.ts` held the pure half so the
+ * BROWSER ENTRY could reach it without pulling `node:fs`, and `Station`
+ * reached the file half through a `ConfigFileIO` seam the node entry
+ * registered. Station is server-side only, so the split, the seam and
+ * the second entry are all gone and this is one module again. Every
+ * import of `./profile` is unchanged - that path always re-exported the
+ * pure half. */
 
 import Fs from 'node:fs'
 import Os from 'node:os'
 import Path from 'node:path'
 
+import { validname } from '@voxgig/sekreto'
+
+import { secretnameDefault } from './descriptor'
 import { StationError } from './error'
-import { StationConfig } from './types'
+import { BLOCK_DEFAULTS } from './shape'
+import { StationConfig, SdkBlock } from './types'
+
+// Profile selection: VOXGIG_STATION_PROFILE, else the open() option,
+// else 'default' (design §3.5 - env vars rank above station.json but
+// below open() opts; profile NAME selection follows the same order with
+// open() opts winning).
+//
+// `process` is read directly. It used to go through a `typeof` guard
+// because the browser entry reached this code and has no `process`;
+// station is server-side only, so the guard guarded nothing.
+export function selectProfile(optProfile?: string): string {
+  if (null != optProfile && '' !== optProfile) { return optProfile }
+  const env = process.env.VOXGIG_STATION_PROFILE
+  if (null != env && '' !== env) { return env }
+  return 'default'
+}
+
+// The api half of a ref is the substring before the first `$`, and an
+// untagged ref IS an api slug (design §3.4) - which is why the whole
+// `plugin` -> `sdk` migration is a key rename and nothing else.
+//
+// LEXICAL, and that is the point: under the old free-form identity
+// which api an instance used was itself a merged value, so the merge
+// could not be a flat pass over both maps and a port that got the
+// phasing wrong silently picked another api's defaults (§3.3).
+export function refapi(ref: string): string {
+  const at = String(ref).indexOf('$')
+  return -1 === at ? String(ref) : String(ref).slice(0, at)
+}
+
+export type ResolvedProfile = {
+  name: string
+  providers: any[]
+  // The api-level defaults in effect for this profile, base ⊕ overlay
+  // per api slug. A REPORT, not an input to the instance merge below -
+  // collapsing each namespace first and composing at the end is the
+  // exact algorithm §3.3 forbids.
+  api: Record<string, SdkBlock>
+  // Instances, keyed by ref. An `api` block declares no instance of its
+  // own (§3.1), so it never creates an entry here.
+  sdk: Record<string, SdkBlock>
+}
+
+// Shallow merge, per key, left to right - each source over the one
+// before it. Declared rather than assumed: plugin's library default is
+// a deep map merge, and an allowlist that widens because two precedence
+// levels merged is the failure this rule exists to prevent
+// (station-and-plugin.md §2.5). The visible consequence: an overlay's
+// `policy` REPLACES the base's entirely rather than merging `hosts`
+// into it. That is also the safer reading for an allowlist.
+function shallow(...sources: any[]): any {
+  const out: any = {}
+  for (const src of sources) {
+    if (null == src || 'object' !== typeof src || Array.isArray(src)) { continue }
+    for (const k of Object.keys(src)) { out[k] = src[k] }
+  }
+  return out
+}
+
+// Merge the base profile ('default') with the selected overlay.
+//
+// §3.3's total order, for the two block levels - lowest precedence
+// first:
+//
+//   base.api[<api>] ⊕ base.sdk[<ref>] ⊕ overlay.api[<api>] ⊕ overlay.sdk[<ref>]
+//
+// PROFILE SPECIFICITY OUTRANKS BLOCK SPECIFICITY. A `prod` api-level
+// `base` beats a `default` instance-level `base`, because that is what
+// an environment overlay is for; within one profile the instance beats
+// the api default, because that is what an instance is for.
+//
+// THIS IS ONE FLAT LEFT-TO-RIGHT MERGE AND MUST NOT BE REORGANIZED INTO
+// "collapse each namespace, then put instance over api". Collapsing
+// first computes (base.api ⊕ overlay.api) and (base.sdk ⊕ overlay.sdk)
+// and then lets EVERY instance value beat EVERY api value - the exact
+// opposite. A production `api.stripe.policy` would then fail to
+// override a default profile's `sdk.stripe$test.policy`, silently
+// keeping the wider allowlist in production.
+//
+// `secrets.providers` replaces wholesale, never merges (§3.5, §5.2):
+// chain order decides which store wins, so a positional merge would be
+// actively dangerous.
+export function resolveProfile(
+  config: StationConfig | null, profileName: string
+): ResolvedProfile {
+  const profiles = config?.profiles || {}
+  const base: any = profiles['default'] || {}
+  const overlay: any = 'default' === profileName
+    ? {} : (profiles[profileName] || {})
 
-export {
-  refapi, resolveProfile, selectProfile,
-} from './profilecore'
-export type { ResolvedProfile } from './profilecore'
+  const providers = overlay.secrets?.providers ?? base.secrets?.providers ??
+    [{ kind: 'env' }]
+
+  const api: Record<string, SdkBlock> = {}
+  for (const slug of sortedkeys(base.api, overlay.api)) {
+    api[slug] = shallow(base.api?.[slug], overlay.api?.[slug])
+  }
+
+  // An api block declares no instance, so the ref set comes from the
+  // two `sdk` maps alone.
+  const sdk: Record<string, SdkBlock> = {}
+  for (const ref of sortedkeys(base.sdk, overlay.sdk)) {
+    const a = refapi(ref)
+    const merged = shallow(
+      base.api?.[a],
+      base.sdk?.[ref],
+      overlay.api?.[a],
+      overlay.sdk?.[ref],
+    )
+
+    // Defaults are applied ONCE, to the fully merged instance, and this
+    // is the rule §4.2's normalization must not be confused with. Had
+    // the overlay block carried a synthesized `active: true` into the
+    // merge, a one-key environment override would silently re-enable an
+    // integration the base declared `active: false` - live in
+    // production despite being declared inactive. The `instance` corpus
+    // section carries exactly this case.
+    for (const k of Object.keys(BLOCK_DEFAULTS)) {
+      if (undefined === merged[k]) { merged[k] = BLOCK_DEFAULTS[k]() }
+    }
+
+    sdk[ref] = merged
+  }
+
+  checksecrets(sdk, profileName)
+
+  return { name: profileName, providers, api, sdk }
+}
+
+// A configured secret name sekreto would reject is caught at profile
+// load, not first request (§14 station_secret_name) - and then the
+// derived names are checked for uniqueness, because envtoken is LOSSY.
+//
+// It collapses any run of non-alphanumerics to `_`, so `$` and `-` are
+// indistinguishable downstream: the ref `stripe$test` and an untagged
+// instance of an api slugged `stripe-test` both derive
+// `stripe_test.apikey`. That pairing is the realistic one rather than a
+// contrived one, because api slugs are hyphenated by construction - so
+// a fleet with both a `stripe-test` api and a `test` instance of
+// `stripe` collides by default. Since the resolution cache is keyed by
+// secret name (§5.3), the second instance would silently receive the
+// first's value.
+//
+// Two instances that EXPLICITLY name the same secret are not a
+// collision - that is the shared-key case the api-level `secret` exists
+// for, and saying so out loud is how you ask for it.
+function checksecrets(
+  sdk: Record<string, SdkBlock>, profileName: string
+): void {
+  const refs = Object.keys(sdk).sort()
+
+  for (const ref of refs) {
+    const name = sdk[ref].secret
+    if (null != name && !validname(name)) {
+      throw new StationError('station_secret_name',
+        'profile "' + profileName + '" sdk "' + ref +
+        '": secret name rejected by sekreto: ' + JSON.stringify(name))
+    }
+  }
+
+  const seen = new Map<string, { ref: string, derived: boolean }>()
+  for (const ref of refs) {
+    const written = sdk[ref].secret
+    const derived = null == written || '' === written
+    const name = derived ? secretnameDefault(ref) : (written as string)
+
+    const prior = seen.get(name)
+    if (undefined !== prior && (derived || prior.derived)) {
+      throw new StationError('station_secret_collision',
+        'profile "' + profileName + '": instances "' + prior.ref + '" and "' +
+        ref + '" both resolve to secret name "' + name +
+        '", so they would share one credential; name it explicitly on ' +
+        'each, or at the api level to share it deliberately (§5.1)')
+    }
+    if (undefined === prior) { seen.set(name, { ref, derived }) }
+  }
+}
+
+function sortedkeys(...maps: any[]): string[] {
+  const keys = new Set<string>()
+  for (const m of maps) {
+    if (null == m || 'object' !== typeof m || Array.isArray(m)) { continue }
+    for (const k of Object.keys(m)) { keys.add(k) }
+  }
+  return Array.from(keys).sort()
+}
 
 // station.json lookup: cwd upward to the repo root, then
 // ~/.voxgig/station.json (design §3.5). A repo root is where .git lives;

package/dist/src/index.browser.d.ts

@@ -1,14 +0,0 @@
-export { Station, instanceRef, setConfigFileIO } from './Station';
-export type { ConfigFileIO } from './Station';
-export { provide, factoryFor, provided, resetFactories } from './factory';
-export type { Factory, FactoryEntry } from './factory';
-export { DEFAULT_EXPORT, camelify, checkPackage, factoryFromModule, loadAsync, loadSync, } from './loader';
-export { adapterFeature, featureBinding } from './adapter';
-export type { FeatureBinding } from './adapter';
-export { StationError } from './error';
-export { canonicalSerialize, envtoken, normalizeDescriptor, secretnameDefault, } from './descriptor';
-export { placeholderFor } from './secrets';
-export { refapi, resolveProfile, selectProfile } from './profilecore';
-export type { ResolvedProfile } from './profilecore';
-export { BLOCK_DEFAULTS, MERGE_SENSITIVE, PROFILE_DEFAULTS, configShape, normalizeConfig, validateConfig, } from './shape';
-export type { Binding, Descriptor, PolicyBlock, Profile, ResolvedInstance, SdkBlock, StationConfig, StationEvent, StationOptions, } from './types';