@voxgig/station 0.0.1

package/dist/src/loader.js

@@ -0,0 +1,181 @@
+"use strict";
+/* The loader (design §6.3), where the language allows it.
+ *
+ * In ts, js, py, rb, php, perl, lua, elixir and clojure a module can be
+ * imported by name at runtime, so `api.<slug>.package` closes the loop:
+ * station imports the package (which triggers self-registration, §6.2
+ * path 1) and then looks up the factory.
+ *
+ * `sdk()` IS SYNCHRONOUS, AND IN TS/JS THAT BOUNDS WHAT THE LOADER CAN
+ * IMPORT. A CommonJS package loads synchronously through `require`; an
+ * ESM-only package only loads through `import()`, which is a promise.
+ * Making `sdk()` async to cover that would put an `await` in front of
+ * every call site in every language for a cost only two of them pay.
+ * So the rule is explicit rather than discovered at runtime:
+ *
+ *  - the synchronous loader handles CommonJS, which is every SDK sdkgen
+ *    generates (the ts target is `"type": "commonjs"`);
+ *  - ESM packages load through an explicit `await station.load()`
+ *    preload, after which `sdk()` is synchronous again for everything —
+ *    one `await` at startup rather than one per call site;
+ *  - a package only `import()` can load, reached through `sdk()`
+ *    without a preload, is `station_sdk_load` WITH THE REMEDY IN THE
+ *    MESSAGE. Never a silent half-loaded client.
+ *
+ * THIS IS A CODE-LOADING SURFACE DRIVEN BY A CONFIG FILE, so it has
+ * rules, and they are enforced here rather than documented and hoped
+ * for. See `checkPackage` and the `repoScoped` argument. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeImport = exports.DEFAULT_EXPORT = void 0;
+exports.camelify = camelify;
+exports.checkPackage = checkPackage;
+exports.factoryFromModule = factoryFromModule;
+exports.loadSync = loadSync;
+exports.loadAsync = loadAsync;
+const error_1 = require("./error");
+const factory_1 = require("./factory");
+/** The fixed alias every generated package exports.
+ *
+ * `export` defaults to this rather than to a derived class name because
+ * it is the same identifier in every generated package, where
+ * `camelify(slug) + 'SDK'` is a rule that has to be recomputed and can
+ * be wrong. The derived name is the SECOND attempt and an explicit
+ * `export` the third. */
+exports.DEFAULT_EXPORT = 'SDK';
+/** `stripe-eu` -> `StripeEu`, for the second-attempt export name. */
+function camelify(slug) {
+    return String(slug).split(/[^A-Za-z0-9]+/).filter((s) => '' !== s)
+        .map((s) => s[0].toUpperCase() + s.slice(1))
+        .join('');
+}
+/** Only MODULE NAMES, resolved by the host language's ordinary
+ * resolution from the application root. Never a filesystem path, never
+ * a URL, never anything relative — a config file naming a path is a
+ * config file reaching outside the dependency graph it is allowed to
+ * name. */
+function checkPackage(api, pkg) {
+    const p = String(pkg);
+    // A TRAVERSAL SEGMENT IS NOT A LEADING MARKER, and checking only the
+    // first character missed it: `pkg/../../escape` starts with neither
+    // `.` nor `/`, so it passed — and node resolves it through
+    // `node_modules/pkg/../../escape`, importing application-local code
+    // from outside the named dependency. The whole point of this function
+    // is that a configured package stays inside the dependency graph a
+    // reviewer can see.
+    const seg = p.split('/').some((x) => '.' === x || '..' === x);
+    const bad = '' === p ||
+        p.startsWith('.') ||
+        p.startsWith('/') ||
+        p.startsWith('~') ||
+        seg ||
+        -1 !== p.indexOf('://') ||
+        -1 !== p.indexOf('\\');
+    if (bad) {
+        throw new error_1.StationError('station_sdk_load', 'api "' + api + '": `package` must be a module name resolved from ' +
+            'the application root, not a path or URL: ' + JSON.stringify(pkg));
+    }
+    return p;
+}
+/** Build a `{construct, config}` pair from a module that self-registered
+ * nothing — the retrofit path for a package whose SDK predates the
+ * station feature. It is not descriptor-blind: a generated main module
+ * exports its constructor AND the `config` singleton beside it. */
+function factoryFromModule(api, mod, exportName) {
+    const tried = [];
+    const pick = (n) => {
+        tried.push(n);
+        return null == mod ? undefined : mod[n];
+    };
+    let ctor = null == exportName || '' === exportName
+        ? undefined : pick(exportName);
+    if (null == ctor) {
+        ctor = pick(exports.DEFAULT_EXPORT);
+    }
+    if (null == ctor) {
+        ctor = pick(camelify(api) + 'SDK');
+    }
+    if ('function' !== typeof ctor) {
+        throw new error_1.StationError('station_sdk_load', 'api "' + api + '": no SDK constructor found on the module; tried [' +
+            tried.join(', ') + ']. Set `export` to the exported name.');
+    }
+    const config = mod.config ?? mod.CONFIG;
+    if (null == config) {
+        throw new error_1.StationError('station_sdk_load', 'api "' + api + '": the module exports a constructor but no `config` ' +
+            'singleton, so its feature schema and transport roles cannot be read ' +
+            'before construction (§6.2)');
+    }
+    const construct = (options) => new ctor(options);
+    return { construct, config };
+}
+/** Synchronous load, for CommonJS. Returns true when the api has a
+ * factory afterwards — either because importing the package triggered
+ * self-registration, or because one was built from its exports. */
+function loadSync(api, pkg, exportName) {
+    checkPackage(api, pkg);
+    if (null != (0, factory_1.factoryFor)(api)) {
+        return true;
+    }
+    let mod;
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        mod = require(pkg);
+    }
+    catch (e) {
+        // ERR_REQUIRE_ESM is the case the preload exists for, and the
+        // message has to name the remedy rather than the symptom.
+        const code = String(e?.code || '');
+        if ('ERR_REQUIRE_ESM' === code) {
+            throw new error_1.StationError('station_sdk_load', 'api "' + api + '": package "' + pkg + '" is ESM-only and cannot be ' +
+                'loaded synchronously; `await station.load()` at startup, then ' +
+                'sdk() is synchronous again for everything (§6.3)');
+        }
+        throw new error_1.StationError('station_sdk_load', 'api "' + api + '": package "' + pkg + '" could not be imported: ' +
+            String(e?.message || e));
+    }
+    // Path 1: the module self-registered while being imported.
+    if (null != (0, factory_1.factoryFor)(api)) {
+        return true;
+    }
+    (0, factory_1.provide)(api, factoryFromModule(api, mod, exportName));
+    return true;
+}
+/** The ESM preload behind `await station.load()`. Imports the package
+ * and fills the SAME table the synchronous path fills. */
+/** A dynamic `import()` that SURVIVES THE COMMONJS EMIT.
+ *
+ * This package compiles with `module: "commonjs"`, and TypeScript
+ * rewrites a literal `import(pkg)` into a promise around `require(pkg)`
+ * — so `await station.load()` threw `ERR_REQUIRE_ESM` for exactly the
+ * ESM-only packages it exists to preload, leaving no working path to
+ * those SDKs at all. Verified against the emitted `dist/src/loader.js`,
+ * which read `mod = require(pkg)`.
+ *
+ * `new Function` is the seam the compiler does not look inside. It is
+ * deliberately the only one in this file, and it takes no caller input:
+ * `pkg` has already been through `checkPackage`, and the body is a
+ * constant. Changing the package to `module: "node16"` would fix it
+ * more cleanly and is a whole-package decision rather than a defect
+ * fix. */
+exports.nativeImport = new Function('p', 'return import(p)');
+async function loadAsync(api, pkg, exportName) {
+    checkPackage(api, pkg);
+    if (null != (0, factory_1.factoryFor)(api)) {
+        return true;
+    }
+    let mod;
+    try {
+        mod = await (0, exports.nativeImport)(pkg);
+    }
+    catch (e) {
+        throw new error_1.StationError('station_sdk_load', 'api "' + api + '": package "' + pkg + '" could not be imported: ' +
+            String(e?.message || e));
+    }
+    if (null != (0, factory_1.factoryFor)(api)) {
+        return true;
+    }
+    // An ESM namespace puts a CommonJS module's exports under `default`.
+    const flat = null != mod?.default && null == mod?.config ? mod.default : mod;
+    (0, factory_1.provide)(api, factoryFromModule(api, flat, exportName));
+    return true;
+}
+//# sourceMappingURL=loader.js.map

package/dist/src/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/loader.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;4DAyB4D;;;AAe5D,4BAIC;AAOD,oCAwBC;AAMD,8CA8BC;AAKD,4BA6BC;AAsBD,8BAoBC;AAhKD,mCAAsC;AACtC,uCAAwD;AAExD;;;;;;yBAMyB;AACZ,QAAA,cAAc,GAAG,KAAK,CAAA;AAEnC,qEAAqE;AACrE,SAAgB,QAAQ,CAAC,IAAY;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;SAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED;;;;WAIW;AACX,SAAgB,YAAY,CAAC,GAAW,EAAE,GAAW;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,qEAAqE;IACrE,oEAAoE;IACpE,2DAA2D;IAC3D,oEAAoE;IACpE,sEAAsE;IACtE,mEAAmE;IACnE,oBAAoB;IACpB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAA;IAC7D,MAAM,GAAG,GACP,EAAE,KAAK,CAAC;QACR,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACjB,GAAG;QACH,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,oBAAY,CAAC,kBAAkB,EACvC,OAAO,GAAG,GAAG,GAAG,mDAAmD;YACnE,2CAA2C,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;mEAGmE;AACnE,SAAgB,iBAAiB,CAC/B,GAAW,EAAE,GAAQ,EAAE,UAAmB;IAE1C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAO,EAAE;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACzC,CAAC,CAAA;IAED,IAAI,IAAI,GAAG,IAAI,IAAI,UAAU,IAAI,EAAE,KAAK,UAAU;QAChD,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,sBAAc,CAAC,CAAA;IAAC,CAAC;IACjD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;IAAC,CAAC;IAExD,IAAI,UAAU,KAAK,OAAO,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAY,CAAC,kBAAkB,EACvC,OAAO,GAAG,GAAG,GAAG,oDAAoD;YACpE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,uCAAuC,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAA;IACvC,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,oBAAY,CAAC,kBAAkB,EACvC,OAAO,GAAG,GAAG,GAAG,sDAAsD;YACtE,sEAAsE;YACtE,4BAA4B,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,OAAY,EAAE,EAAE,CAAC,IAAK,IAAY,CAAC,OAAO,CAAC,CAAA;IAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AAC9B,CAAC;AAED;;mEAEmE;AACnE,SAAgB,QAAQ,CAAC,GAAW,EAAE,GAAW,EAAE,UAAmB;IACpE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACtB,IAAI,IAAI,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAE5C,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,8DAA8D;QAC9D,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC;IACD,OAAO,CAAM,EAAE,CAAC;QACd,8DAA8D;QAC9D,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QAClC,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,oBAAY,CAAC,kBAAkB,EACvC,OAAO,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,8BAA8B;gBACrE,gEAAgE;gBAChE,kDAAkD,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,IAAI,oBAAY,CAAC,kBAAkB,EACvC,OAAO,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,2BAA2B;YAClE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,CAAC;IAED,2DAA2D;IAC3D,IAAI,IAAI,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAE5C,IAAA,iBAAO,EAAC,GAAG,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;IACrD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;0DAC0D;AAC1D;;;;;;;;;;;;;;UAcU;AACG,QAAA,YAAY,GACvB,IAAI,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAQ,CAAA;AAEvC,KAAK,UAAU,SAAS,CAC7B,GAAW,EAAE,GAAW,EAAE,UAAmB;IAE7C,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACtB,IAAI,IAAI,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAE5C,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,IAAA,oBAAY,EAAC,GAAG,CAAC,CAAA;IAAC,CAAC;IACrC,OAAO,CAAM,EAAE,CAAC;QACd,MAAM,IAAI,oBAAY,CAAC,kBAAkB,EACvC,OAAO,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,GAAG,2BAA2B;YAClE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,CAAC;IAED,IAAI,IAAI,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAE5C,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,IAAI,GAAG,EAAE,OAAO,IAAI,IAAI,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5E,IAAA,iBAAO,EAAC,GAAG,EAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;IACtD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/src/profile.d.ts

@@ -0,0 +1,6 @@
+import { StationConfig } from './types';
+export { refapi, resolveProfile, selectProfile, } from './profilecore';
+export type { ResolvedProfile } from './profilecore';
+export declare function findConfigFile(from?: string): string | null;
+export declare function loadConfig(from?: string): StationConfig | null;
+export declare function configScope(from?: string): 'repo' | 'user' | 'none';

package/dist/src/profile.js

@@ -0,0 +1,77 @@
+"use strict";
+/* The FILE half of profile handling - finding and reading
+ * station.json - and the scope rule that hangs off where it was found.
+ * NODE-ONLY by construction (fs/os/path), which is the §2.2 / §17
+ * Phase 1 split: the browser entry never imports this module, and
+ * `Station` reaches it through the ConfigFileIO seam the node entry
+ * registers. The pure half (selectProfile, refapi, resolveProfile)
+ * lives in `profilecore.ts` and is re-exported here so every existing
+ * import of `./profile` keeps working. */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectProfile = exports.resolveProfile = exports.refapi = void 0;
+exports.findConfigFile = findConfigFile;
+exports.loadConfig = loadConfig;
+exports.configScope = configScope;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const error_1 = require("./error");
+var profilecore_1 = require("./profilecore");
+Object.defineProperty(exports, "refapi", { enumerable: true, get: function () { return profilecore_1.refapi; } });
+Object.defineProperty(exports, "resolveProfile", { enumerable: true, get: function () { return profilecore_1.resolveProfile; } });
+Object.defineProperty(exports, "selectProfile", { enumerable: true, get: function () { return profilecore_1.selectProfile; } });
+// station.json lookup: cwd upward to the repo root, then
+// ~/.voxgig/station.json (design §3.5). A repo root is where .git lives;
+// with no repo the walk stops at the filesystem root.
+function findConfigFile(from) {
+    let dir = node_path_1.default.resolve(from || process.cwd());
+    for (;;) {
+        const candidate = node_path_1.default.join(dir, 'station.json');
+        if (node_fs_1.default.existsSync(candidate)) {
+            return candidate;
+        }
+        const atRepoRoot = node_fs_1.default.existsSync(node_path_1.default.join(dir, '.git'));
+        const parent = node_path_1.default.dirname(dir);
+        if (atRepoRoot || parent === dir) {
+            break;
+        }
+        dir = parent;
+    }
+    const home = node_path_1.default.join(node_os_1.default.homedir(), '.voxgig', 'station.json');
+    return node_fs_1.default.existsSync(home) ? home : null;
+}
+function loadConfig(from) {
+    const file = findConfigFile(from);
+    if (null == file) {
+        return null;
+    }
+    const text = node_fs_1.default.readFileSync(file, 'utf8');
+    // A file that is not JSON is a config error, not a raw SyntaxError
+    // escaping open(): the reader found station.json and could not use
+    // it, which is exactly what station_config_invalid exists to say.
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        throw new error_1.StationError('station_config_invalid', 'station.json at ' + file + ' is not valid JSON: ' + err.message);
+    }
+}
+// Which side of the review boundary the config came from (§6.3).
+//
+// `package` and `export` are honoured only from REPO-SCOPED config,
+// because a user-level file is outside the repo's review boundary and a
+// `package` key arriving from it names code to import. Everything else
+// in a user-level config still applies - this narrows one key rather
+// than distrusting the file.
+function configScope(from) {
+    const file = findConfigFile(from);
+    if (null == file) {
+        return 'none';
+    }
+    const home = node_path_1.default.join(node_os_1.default.homedir(), '.voxgig', 'station.json');
+    return file === home ? 'user' : 'repo';
+}
+//# sourceMappingURL=profile.js.map

package/dist/src/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/profile.ts"],"names":[],"mappings":";AAAA;;;;;;;0CAO0C;;;;;;AAiB1C,wCAYC;AAED,gCAcC;AASD,kCAKC;AAzDD,sDAAwB;AACxB,sDAAwB;AACxB,0DAA4B;AAE5B,mCAAsC;AAGtC,6CAEsB;AADpB,qGAAA,MAAM,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,4GAAA,aAAa,OAAA;AAIvC,yDAAyD;AACzD,yEAAyE;AACzE,sDAAsD;AACtD,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7C,SAAU,CAAC;QACT,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAChD,IAAI,iBAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;QAClD,MAAM,UAAU,GAAG,iBAAE,CAAC,UAAU,CAAC,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,mBAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,UAAU,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAAC,MAAK;QAAC,CAAC;QAC3C,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,iBAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,SAAgB,UAAU,CAAC,IAAa;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1C,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,oBAAY,CAAC,wBAAwB,EAC7C,kBAAkB,GAAG,IAAI,GAAG,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,6BAA6B;AAC7B,SAAgB,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,MAAM,CAAA;IAAC,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC"}

package/dist/src/profilecore.d.ts

@@ -0,0 +1,10 @@
+import { StationConfig, SdkBlock } from './types';
+export declare function selectProfile(optProfile?: string): string;
+export declare function refapi(ref: string): string;
+export type ResolvedProfile = {
+    name: string;
+    providers: any[];
+    api: Record<string, SdkBlock>;
+    sdk: Record<string, SdkBlock>;
+};
+export declare function resolveProfile(config: StationConfig | null, profileName: string): ResolvedProfile;

package/dist/src/profilecore.js

@@ -0,0 +1,180 @@
+"use strict";
+/* The pure half of profile handling: selection, the ref grammar, and
+ * the §3.3 merge. Split from `profile.ts` so the BROWSER ENTRY can
+ * reach it (§2.2, §17 Phase 1): everything here is data-in/data-out,
+ * while the file half (findConfigFile/loadConfig/configScope) is
+ * node-only and stays in `profile.ts`, imported by the node entry
+ * alone. `profile.ts` re-exports these, so every existing import path
+ * is unchanged. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectProfile = selectProfile;
+exports.refapi = refapi;
+exports.resolveProfile = resolveProfile;
+const sekreto_1 = require("@voxgig/sekreto");
+const descriptor_1 = require("./descriptor");
+const error_1 = require("./error");
+const shape_1 = require("./shape");
+// Profile selection: VOXGIG_STATION_PROFILE, else the open() option,
+// else 'default' (design §3.5 - env vars rank above station.json but
+// below open() opts; profile NAME selection follows the same order with
+// open() opts winning).
+//
+// `process` is reached through a typeof guard rather than an import:
+// in the browser there is no process and no environment, so the answer
+// is simply the option or the default - which is the same degradation
+// "no env var set" already means.
+function selectProfile(optProfile) {
+    if (null != optProfile && '' !== optProfile) {
+        return optProfile;
+    }
+    const env = 'undefined' !== typeof process
+        ? process.env.VOXGIG_STATION_PROFILE : undefined;
+    if (null != env && '' !== env) {
+        return env;
+    }
+    return 'default';
+}
+// The api half of a ref is the substring before the first `$`, and an
+// untagged ref IS an api slug (design §3.4) - which is why the whole
+// `plugin` -> `sdk` migration is a key rename and nothing else.
+//
+// LEXICAL, and that is the point: under the old free-form identity
+// which api an instance used was itself a merged value, so the merge
+// could not be a flat pass over both maps and a port that got the
+// phasing wrong silently picked another api's defaults (§3.3).
+function refapi(ref) {
+    const at = String(ref).indexOf('$');
+    return -1 === at ? String(ref) : String(ref).slice(0, at);
+}
+// Shallow merge, per key, left to right - each source over the one
+// before it. Declared rather than assumed: plugin's library default is
+// a deep map merge, and an allowlist that widens because two precedence
+// levels merged is the failure this rule exists to prevent
+// (station-and-plugin.md §2.5). The visible consequence: an overlay's
+// `policy` REPLACES the base's entirely rather than merging `hosts`
+// into it. That is also the safer reading for an allowlist.
+function shallow(...sources) {
+    const out = {};
+    for (const src of sources) {
+        if (null == src || 'object' !== typeof src || Array.isArray(src)) {
+            continue;
+        }
+        for (const k of Object.keys(src)) {
+            out[k] = src[k];
+        }
+    }
+    return out;
+}
+// Merge the base profile ('default') with the selected overlay.
+//
+// §3.3's total order, for the two block levels - lowest precedence
+// first:
+//
+//   base.api[<api>] ⊕ base.sdk[<ref>] ⊕ overlay.api[<api>] ⊕ overlay.sdk[<ref>]
+//
+// PROFILE SPECIFICITY OUTRANKS BLOCK SPECIFICITY. A `prod` api-level
+// `base` beats a `default` instance-level `base`, because that is what
+// an environment overlay is for; within one profile the instance beats
+// the api default, because that is what an instance is for.
+//
+// THIS IS ONE FLAT LEFT-TO-RIGHT MERGE AND MUST NOT BE REORGANIZED INTO
+// "collapse each namespace, then put instance over api". Collapsing
+// first computes (base.api ⊕ overlay.api) and (base.sdk ⊕ overlay.sdk)
+// and then lets EVERY instance value beat EVERY api value - the exact
+// opposite. A production `api.stripe.policy` would then fail to
+// override a default profile's `sdk.stripe$test.policy`, silently
+// keeping the wider allowlist in production.
+//
+// `secrets.providers` replaces wholesale, never merges (§3.5, §5.2):
+// chain order decides which store wins, so a positional merge would be
+// actively dangerous.
+function resolveProfile(config, profileName) {
+    const profiles = config?.profiles || {};
+    const base = profiles['default'] || {};
+    const overlay = 'default' === profileName
+        ? {} : (profiles[profileName] || {});
+    const providers = overlay.secrets?.providers ?? base.secrets?.providers ??
+        [{ kind: 'env' }];
+    const api = {};
+    for (const slug of sortedkeys(base.api, overlay.api)) {
+        api[slug] = shallow(base.api?.[slug], overlay.api?.[slug]);
+    }
+    // An api block declares no instance, so the ref set comes from the
+    // two `sdk` maps alone.
+    const sdk = {};
+    for (const ref of sortedkeys(base.sdk, overlay.sdk)) {
+        const a = refapi(ref);
+        const merged = shallow(base.api?.[a], base.sdk?.[ref], overlay.api?.[a], overlay.sdk?.[ref]);
+        // Defaults are applied ONCE, to the fully merged instance, and this
+        // is the rule §4.2's normalization must not be confused with. Had
+        // the overlay block carried a synthesized `active: true` into the
+        // merge, a one-key environment override would silently re-enable an
+        // integration the base declared `active: false` - live in
+        // production despite being declared inactive. The `instance` corpus
+        // section carries exactly this case.
+        for (const k of Object.keys(shape_1.BLOCK_DEFAULTS)) {
+            if (undefined === merged[k]) {
+                merged[k] = shape_1.BLOCK_DEFAULTS[k]();
+            }
+        }
+        sdk[ref] = merged;
+    }
+    checksecrets(sdk, profileName);
+    return { name: profileName, providers, api, sdk };
+}
+// A configured secret name sekreto would reject is caught at profile
+// load, not first request (§14 station_secret_name) - and then the
+// derived names are checked for uniqueness, because envtoken is LOSSY.
+//
+// It collapses any run of non-alphanumerics to `_`, so `$` and `-` are
+// indistinguishable downstream: the ref `stripe$test` and an untagged
+// instance of an api slugged `stripe-test` both derive
+// `stripe_test.apikey`. That pairing is the realistic one rather than a
+// contrived one, because api slugs are hyphenated by construction - so
+// a fleet with both a `stripe-test` api and a `test` instance of
+// `stripe` collides by default. Since the resolution cache is keyed by
+// secret name (§5.3), the second instance would silently receive the
+// first's value.
+//
+// Two instances that EXPLICITLY name the same secret are not a
+// collision - that is the shared-key case the api-level `secret` exists
+// for, and saying so out loud is how you ask for it.
+function checksecrets(sdk, profileName) {
+    const refs = Object.keys(sdk).sort();
+    for (const ref of refs) {
+        const name = sdk[ref].secret;
+        if (null != name && !(0, sekreto_1.validname)(name)) {
+            throw new error_1.StationError('station_secret_name', 'profile "' + profileName + '" sdk "' + ref +
+                '": secret name rejected by sekreto: ' + JSON.stringify(name));
+        }
+    }
+    const seen = new Map();
+    for (const ref of refs) {
+        const written = sdk[ref].secret;
+        const derived = null == written || '' === written;
+        const name = derived ? (0, descriptor_1.secretnameDefault)(ref) : written;
+        const prior = seen.get(name);
+        if (undefined !== prior && (derived || prior.derived)) {
+            throw new error_1.StationError('station_secret_collision', 'profile "' + profileName + '": instances "' + prior.ref + '" and "' +
+                ref + '" both resolve to secret name "' + name +
+                '", so they would share one credential; name it explicitly on ' +
+                'each, or at the api level to share it deliberately (§5.1)');
+        }
+        if (undefined === prior) {
+            seen.set(name, { ref, derived });
+        }
+    }
+}
+function sortedkeys(...maps) {
+    const keys = new Set();
+    for (const m of maps) {
+        if (null == m || 'object' !== typeof m || Array.isArray(m)) {
+            continue;
+        }
+        for (const k of Object.keys(m)) {
+            keys.add(k);
+        }
+    }
+    return Array.from(keys).sort();
+}
+//# sourceMappingURL=profilecore.js.map

package/dist/src/profilecore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profilecore.js","sourceRoot":"","sources":["../../src/profilecore.ts"],"names":[],"mappings":";AAAA;;;;;;mBAMmB;;AAkBnB,sCAMC;AAUD,wBAGC;AAsDD,wCA6CC;AAtID,6CAA2C;AAE3C,6CAAgD;AAChD,mCAAsC;AACtC,mCAAwC;AAGxC,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,wBAAwB;AACxB,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,kCAAkC;AAClC,SAAgB,aAAa,CAAC,UAAmB;IAC/C,IAAI,IAAI,IAAI,UAAU,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QAAC,OAAO,UAAU,CAAA;IAAC,CAAC;IAClE,MAAM,GAAG,GAAG,WAAW,KAAK,OAAO,OAAO;QACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAA;IAClD,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAAC,OAAO,GAAG,CAAA;IAAC,CAAC;IAC7C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,sEAAsE;AACtE,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,+DAA+D;AAC/D,SAAgB,MAAM,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC3D,CAAC;AAeD,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,2DAA2D;AAC3D,sEAAsE;AACtE,oEAAoE;AACpE,4DAA4D;AAC5D,SAAS,OAAO,CAAC,GAAG,OAAc;IAChC,MAAM,GAAG,GAAQ,EAAE,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,OAAO,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,SAAS;AACT,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,kEAAkE;AAClE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sBAAsB;AACtB,SAAgB,cAAc,CAC5B,MAA4B,EAAE,WAAmB;IAEjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvC,MAAM,IAAI,GAAQ,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAQ,SAAS,KAAK,WAAW;QAC5C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS;QACrE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEnB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,mEAAmE;IACnE,wBAAwB;IACxB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,MAAM,GAAG,OAAO,CACpB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EACb,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EACf,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAChB,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CACnB,CAAA;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,0DAA0D;QAC1D,oEAAoE;QACpE,qCAAqC;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAc,CAAC,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC,GAAG,sBAAc,CAAC,CAAC,CAAC,EAAE,CAAA;YAAC,CAAC;QAClE,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;IACnB,CAAC;IAED,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAE9B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AACnD,CAAC;AAED,qEAAqE;AACrE,mEAAmE;AACnE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,uDAAuD;AACvD,wEAAwE;AACxE,uEAAuE;AACvE,iEAAiE;AACjE,uEAAuE;AACvE,qEAAqE;AACrE,iBAAiB;AACjB,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,qDAAqD;AACrD,SAAS,YAAY,CACnB,GAA6B,EAAE,WAAmB;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC5B,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAY,CAAC,qBAAqB,EAC1C,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,GAAG;gBAC3C,sCAAsC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6C,CAAA;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC/B,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,EAAE,KAAK,OAAO,CAAA;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAE,OAAkB,CAAA;QAEnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,SAAS,KAAK,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,oBAAY,CAAC,0BAA0B,EAC/C,WAAW,GAAG,WAAW,GAAG,gBAAgB,GAAG,KAAK,CAAC,GAAG,GAAG,SAAS;gBACpE,GAAG,GAAG,iCAAiC,GAAG,IAAI;gBAC9C,+DAA+D;gBAC/D,2DAA2D,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,IAAW;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;AAChC,CAAC"}

package/dist/src/secrets.d.ts

@@ -0,0 +1,12 @@
+export declare function placeholderFor(slug: string): string;
+export declare class SecretBroker {
+    private sekreto;
+    private overrides;
+    private cache;
+    private held;
+    constructor(providers: any[]);
+    hoist(slug: string, value: string): void;
+    value(slug: string, name: string): Promise<string>;
+    scrub(text: string): string;
+    refresh(): void;
+}

package/dist/src/secrets.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretBroker = void 0;
+exports.placeholderFor = placeholderFor;
+const sekreto_1 = require("@voxgig/sekreto");
+const error_1 = require("./error");
+// The secret broker (design §5): sekreto resolves, station places. The
+// broker holds resolved values privately - they never enter options,
+// events, or captures; the SDK sees only the placeholder.
+// §7.2: keyed by INSTANCE. Two live instances of one api must have
+// distinct placeholders or the injection seam cannot tell which
+// credential a header wants. For an untagged instance this is the api
+// slug, so the single-instance case is unchanged.
+function placeholderFor(slug) {
+    return '[station:' + slug + ']';
+}
+class SecretBroker {
+    constructor(providers) {
+        // Values hoisted by adopt() from resident options.apikey (design §3.1).
+        this.overrides = new Map();
+        this.cache = new Map();
+        // Every value this broker ever held, for the exact-value scrub.
+        this.held = [];
+        this.sekreto = new sekreto_1.Sekreto({ providers });
+    }
+    hoist(slug, value) {
+        this.overrides.set(slug, value);
+        this.held.push(value);
+    }
+    // Resolve the value for a plugin's secret name. Misses and store
+    // errors keep sekreto's distinction (design §5.2): a miss is
+    // station_secret_no_value, a store that could not answer is
+    // station_secret_error with sekreto's message intact - and never a
+    // retry against a weaker store (sekreto owns the chain).
+    // OVERRIDES ARE KEYED BY INSTANCE; THE RESOLUTION CACHE IS KEYED BY
+    // SECRET NAME (§5.3). A hoisted credential belongs to the one instance
+    // it was resident in, but a resolved VALUE belongs to the name it was
+    // resolved for - so several instances sharing one api-level `secret`
+    // cost one lookup rather than one each, and every client an
+    // auto-tagged `create()` produces shares the declared instance's entry
+    // instead of re-resolving per request.
+    //
+    // Keying the cache by instance instead is the defect this replaces: at
+    // 26 instances over 20 apis it turns one store round-trip into 26.
+    async value(slug, name) {
+        const override = this.overrides.get(slug);
+        if (null != override) {
+            return override;
+        }
+        const cached = this.cache.get(name);
+        if (null != cached) {
+            return cached;
+        }
+        let value;
+        try {
+            value = await this.sekreto.get(name);
+        }
+        catch (e) {
+            if (e instanceof sekreto_1.SekretoError && e.message.includes('unknown secret')) {
+                throw new error_1.StationError('station_secret_no_value', 'no store had "' + name + '" for plugin "' + slug + '"');
+            }
+            throw new error_1.StationError('station_secret_error', String(e?.message || e));
+        }
+        this.cache.set(name, value);
+        this.held.push(value);
+        return value;
+    }
+    // Exact-value scrub, deliberately WITHOUT sekreto's four-character
+    // readability floor (design §7 as revised): on boundaries where the
+    // promise is absolute, every held value is scrubbed whatever its
+    // length. sekreto's own redact() runs too, covering values resolved
+    // by the underlying instance that station never held.
+    scrub(text) {
+        let out = this.sekreto.redact(text);
+        for (const value of this.held) {
+            if ('' !== value) {
+                out = out.split(value).join('[redacted]');
+            }
+        }
+        return out;
+    }
+    // Drop caches so the next resolve asks the stores again (rotation
+    // support rides on sekreto's refresh, design §5.3).
+    refresh() {
+        this.cache.clear();
+        if ('function' === typeof this.sekreto.refresh) {
+            ;
+            this.sekreto.refresh();
+        }
+    }
+}
+exports.SecretBroker = SecretBroker;
+//# sourceMappingURL=secrets.js.map

package/dist/src/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":";;;AAYA,wCAEC;AAdD,6CAAuD;AAEvD,mCAAsC;AAEtC,uEAAuE;AACvE,qEAAqE;AACrE,0DAA0D;AAE1D,mEAAmE;AACnE,gEAAgE;AAChE,sEAAsE;AACtE,kDAAkD;AAClD,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,WAAW,GAAG,IAAI,GAAG,GAAG,CAAA;AACjC,CAAC;AAED,MAAa,YAAY;IAQvB,YAAY,SAAgB;QAN5B,wEAAwE;QAChE,cAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;QACrC,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACzC,gEAAgE;QACxD,SAAI,GAAa,EAAE,CAAA;QAGzB,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,KAAa;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAED,iEAAiE;IACjE,6DAA6D;IAC7D,4DAA4D;IAC5D,mEAAmE;IACnE,yDAAyD;IACzD,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,4DAA4D;IAC5D,uEAAuE;IACvE,uCAAuC;IACvC,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAY;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAA;QAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAAC,OAAO,MAAM,CAAA;QAAC,CAAC;QAErC,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,sBAAY,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,oBAAY,CAAC,yBAAyB,EAC9C,gBAAgB,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,GAAG,GAAG,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,IAAI,oBAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,sDAAsD;IACtD,KAAK,CAAC,IAAY;QAChB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACjB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,kEAAkE;IAClE,oDAAoD;IACpD,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,UAAU,KAAK,OAAQ,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC;YAAC,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAA;QAClC,CAAC;IACH,CAAC;CACF;AA/ED,oCA+EC"}

package/dist/src/shape.d.ts

@@ -0,0 +1,42 @@
+/** Profile-level containers. Safe to materialize early either way:
+ * they are containers, and a missing one merges as empty regardless. */
+export declare const PROFILE_DEFAULTS: {
+    [k: string]: () => any;
+};
+/** Block-level. `feature` is a container and safe early.
+ *
+ * `active` IS NOT, and that is the whole timing rule: a default
+ * synthesized into an OVERLAY block overwrites the base's real value
+ * and silently reactivates an integration the base deliberately barred
+ * (§3.3). So the two consumers read this same table at different
+ * moments - validateConfig before, to every block, because a block with
+ * no present keys is an open map; the resolver AFTER, to the merged
+ * instance, because an absent key must stay absent through the merge. */
+export declare const BLOCK_DEFAULTS: {
+    [k: string]: () => any;
+};
+/** The one block key carrying the timing rule. Named rather than
+ * inferred, so a reader does not have to work out which of the two it
+ * is, and so a port can assert it. */
+export declare const MERGE_SENSITIVE: string[];
+/** Materialize every documented default, DEFENSIVELY: a node that is
+ * not the kind it expects is left alone for validate to reject with a
+ * proper message. Pure data-in/data-out, which is what makes it
+ * portable to 22 languages and expressible in the corpus.
+ *
+ * THE NORMALIZED FORM IS AN INPUT TO VALIDATION AND TO NOTHING ELSE. */
+export declare function normalizeConfig(raw: any): any;
+/** `spec/config-shape.json`, §4.3 verbatim, through the shipped mirror.
+ * Every validate gets a CLONE: struct's validate consumes the spec it
+ * walks (it deletes satisfied `$ONE` branches as it goes), so handing it
+ * the module constant twice would validate the second config against a
+ * spec the first had already eaten. */
+export declare function configShape(): any;
+/** Normalize, then validate (§4.2). Raises `station_config_invalid`
+ * with EVERY struct error at once - an eighteen-instance config that
+ * touches three of them must not die because the eighteenth has a
+ * typo'd package name - then the §5.2 scans.
+ *
+ * Takes the NORMALIZED form. Handing it a raw config is the mistake
+ * §4.2 exists to prevent, so callers go through open()/loadConfig. */
+export declare function validateConfig(normalized: any): any;