@voxgig/station 0.0.2 → 0.1.0

package/dist/src/index.browser.js

@@ -1,64 +0,0 @@
-"use strict";
-// @voxgig/station - one control surface for outbound integrations.
-//
-// THE BROWSER ENTRY (§2.2, §17 Phase 1), selected by the `browser`
-// condition in package.json `exports`. The same surface as `index.ts`
-// MINUS the file-loading half - `loadConfig`, `findConfigFile` and
-// `configScope` are node-only (`profile.ts`, the one module in this
-// package with top-level `node:` imports) and are simply not here, so
-// this entry's module graph pulls no `node:` builtin
-// (`test/browser.test.ts` walks the compiled graph and asserts it).
-//
-// `Station.open()` on this entry takes `config` as an OBJECT - the
-// pre-existing explicit-config path, which skips file loading entirely.
-// With no `config` at all it behaves exactly as node does when no
-// station.json exists: null config, repo-scoped. The ConfigFileIO seam
-// stays unregistered here; a host that genuinely has a config store can
-// register its own through `setConfigFileIO`.
-//
-// §2.2's honesty note stands: in the browser R1/R2 isolation does not
-// exist - an injected credential is readable by page code and DevTools
-// - so browser station is observability-only with app-held credentials
-// until a same-origin proxy endpoint exists.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateConfig = exports.normalizeConfig = exports.configShape = exports.PROFILE_DEFAULTS = exports.MERGE_SENSITIVE = exports.BLOCK_DEFAULTS = exports.selectProfile = exports.resolveProfile = exports.refapi = exports.placeholderFor = exports.secretnameDefault = exports.normalizeDescriptor = exports.envtoken = exports.canonicalSerialize = exports.StationError = exports.featureBinding = exports.adapterFeature = exports.loadSync = exports.loadAsync = exports.factoryFromModule = exports.checkPackage = exports.camelify = exports.DEFAULT_EXPORT = exports.resetFactories = exports.provided = exports.factoryFor = exports.provide = exports.setConfigFileIO = exports.instanceRef = exports.Station = void 0;
-var Station_1 = require("./Station");
-Object.defineProperty(exports, "Station", { enumerable: true, get: function () { return Station_1.Station; } });
-Object.defineProperty(exports, "instanceRef", { enumerable: true, get: function () { return Station_1.instanceRef; } });
-Object.defineProperty(exports, "setConfigFileIO", { enumerable: true, get: function () { return Station_1.setConfigFileIO; } });
-var factory_1 = require("./factory");
-Object.defineProperty(exports, "provide", { enumerable: true, get: function () { return factory_1.provide; } });
-Object.defineProperty(exports, "factoryFor", { enumerable: true, get: function () { return factory_1.factoryFor; } });
-Object.defineProperty(exports, "provided", { enumerable: true, get: function () { return factory_1.provided; } });
-Object.defineProperty(exports, "resetFactories", { enumerable: true, get: function () { return factory_1.resetFactories; } });
-var loader_1 = require("./loader");
-Object.defineProperty(exports, "DEFAULT_EXPORT", { enumerable: true, get: function () { return loader_1.DEFAULT_EXPORT; } });
-Object.defineProperty(exports, "camelify", { enumerable: true, get: function () { return loader_1.camelify; } });
-Object.defineProperty(exports, "checkPackage", { enumerable: true, get: function () { return loader_1.checkPackage; } });
-Object.defineProperty(exports, "factoryFromModule", { enumerable: true, get: function () { return loader_1.factoryFromModule; } });
-Object.defineProperty(exports, "loadAsync", { enumerable: true, get: function () { return loader_1.loadAsync; } });
-Object.defineProperty(exports, "loadSync", { enumerable: true, get: function () { return loader_1.loadSync; } });
-var adapter_1 = require("./adapter");
-Object.defineProperty(exports, "adapterFeature", { enumerable: true, get: function () { return adapter_1.adapterFeature; } });
-Object.defineProperty(exports, "featureBinding", { enumerable: true, get: function () { return adapter_1.featureBinding; } });
-var error_1 = require("./error");
-Object.defineProperty(exports, "StationError", { enumerable: true, get: function () { return error_1.StationError; } });
-var descriptor_1 = require("./descriptor");
-Object.defineProperty(exports, "canonicalSerialize", { enumerable: true, get: function () { return descriptor_1.canonicalSerialize; } });
-Object.defineProperty(exports, "envtoken", { enumerable: true, get: function () { return descriptor_1.envtoken; } });
-Object.defineProperty(exports, "normalizeDescriptor", { enumerable: true, get: function () { return descriptor_1.normalizeDescriptor; } });
-Object.defineProperty(exports, "secretnameDefault", { enumerable: true, get: function () { return descriptor_1.secretnameDefault; } });
-var secrets_1 = require("./secrets");
-Object.defineProperty(exports, "placeholderFor", { enumerable: true, get: function () { return secrets_1.placeholderFor; } });
-var profilecore_1 = require("./profilecore");
-Object.defineProperty(exports, "refapi", { enumerable: true, get: function () { return profilecore_1.refapi; } });
-Object.defineProperty(exports, "resolveProfile", { enumerable: true, get: function () { return profilecore_1.resolveProfile; } });
-Object.defineProperty(exports, "selectProfile", { enumerable: true, get: function () { return profilecore_1.selectProfile; } });
-var shape_1 = require("./shape");
-Object.defineProperty(exports, "BLOCK_DEFAULTS", { enumerable: true, get: function () { return shape_1.BLOCK_DEFAULTS; } });
-Object.defineProperty(exports, "MERGE_SENSITIVE", { enumerable: true, get: function () { return shape_1.MERGE_SENSITIVE; } });
-Object.defineProperty(exports, "PROFILE_DEFAULTS", { enumerable: true, get: function () { return shape_1.PROFILE_DEFAULTS; } });
-Object.defineProperty(exports, "configShape", { enumerable: true, get: function () { return shape_1.configShape; } });
-Object.defineProperty(exports, "normalizeConfig", { enumerable: true, get: function () { return shape_1.normalizeConfig; } });
-Object.defineProperty(exports, "validateConfig", { enumerable: true, get: function () { return shape_1.validateConfig; } });
-//# sourceMappingURL=index.browser.js.map

package/dist/src/index.browser.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../../src/index.browser.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,mEAAmE;AACnE,oEAAoE;AACpE,sEAAsE;AACtE,qDAAqD;AACrD,oEAAoE;AACpE,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,kEAAkE;AAClE,uEAAuE;AACvE,wEAAwE;AACxE,8CAA8C;AAC9C,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,6CAA6C;;;AAE7C,qCAAiE;AAAxD,kGAAA,OAAO,OAAA;AAAE,sGAAA,WAAW,OAAA;AAAE,0GAAA,eAAe,OAAA;AAE9C,qCAAyE;AAAhE,kGAAA,OAAO,OAAA;AAAE,qGAAA,UAAU,OAAA;AAAE,mGAAA,QAAQ,OAAA;AAAE,yGAAA,cAAc,OAAA;AAEtD,mCAEiB;AADf,wGAAA,cAAc,OAAA;AAAE,kGAAA,QAAQ,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAAE,mGAAA,SAAS,OAAA;AAAE,kGAAA,QAAQ,OAAA;AAEhF,qCAA0D;AAAjD,yGAAA,cAAc,OAAA;AAAE,yGAAA,cAAc,OAAA;AAEvC,iCAAsC;AAA7B,qGAAA,YAAY,OAAA;AACrB,2CAKqB;AAJnB,gHAAA,kBAAkB,OAAA;AAClB,sGAAA,QAAQ,OAAA;AACR,iHAAA,mBAAmB,OAAA;AACnB,+GAAA,iBAAiB,OAAA;AAEnB,qCAA0C;AAAjC,yGAAA,cAAc,OAAA;AACvB,6CAAqE;AAA5D,qGAAA,MAAM,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,4GAAA,aAAa,OAAA;AAE9C,iCAGgB;AAFd,uGAAA,cAAc,OAAA;AAAE,wGAAA,eAAe,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AACjD,oGAAA,WAAW,OAAA;AAAE,wGAAA,eAAe,OAAA;AAAE,uGAAA,cAAc,OAAA"}

package/dist/src/profilecore.d.ts

@@ -1,10 +0,0 @@
-import { StationConfig, SdkBlock } from './types';
-export declare function selectProfile(optProfile?: string): string;
-export declare function refapi(ref: string): string;
-export type ResolvedProfile = {
-    name: string;
-    providers: any[];
-    api: Record<string, SdkBlock>;
-    sdk: Record<string, SdkBlock>;
-};
-export declare function resolveProfile(config: StationConfig | null, profileName: string): ResolvedProfile;

package/dist/src/profilecore.js

@@ -1,180 +0,0 @@
-"use strict";
-/* The pure half of profile handling: selection, the ref grammar, and
- * the §3.3 merge. Split from `profile.ts` so the BROWSER ENTRY can
- * reach it (§2.2, §17 Phase 1): everything here is data-in/data-out,
- * while the file half (findConfigFile/loadConfig/configScope) is
- * node-only and stays in `profile.ts`, imported by the node entry
- * alone. `profile.ts` re-exports these, so every existing import path
- * is unchanged. */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.selectProfile = selectProfile;
-exports.refapi = refapi;
-exports.resolveProfile = resolveProfile;
-const sekreto_1 = require("@voxgig/sekreto");
-const descriptor_1 = require("./descriptor");
-const error_1 = require("./error");
-const shape_1 = require("./shape");
-// Profile selection: VOXGIG_STATION_PROFILE, else the open() option,
-// else 'default' (design §3.5 - env vars rank above station.json but
-// below open() opts; profile NAME selection follows the same order with
-// open() opts winning).
-//
-// `process` is reached through a typeof guard rather than an import:
-// in the browser there is no process and no environment, so the answer
-// is simply the option or the default - which is the same degradation
-// "no env var set" already means.
-function selectProfile(optProfile) {
-    if (null != optProfile && '' !== optProfile) {
-        return optProfile;
-    }
-    const env = 'undefined' !== typeof process
-        ? process.env.VOXGIG_STATION_PROFILE : undefined;
-    if (null != env && '' !== env) {
-        return env;
-    }
-    return 'default';
-}
-// The api half of a ref is the substring before the first `$`, and an
-// untagged ref IS an api slug (design §3.4) - which is why the whole
-// `plugin` -> `sdk` migration is a key rename and nothing else.
-//
-// LEXICAL, and that is the point: under the old free-form identity
-// which api an instance used was itself a merged value, so the merge
-// could not be a flat pass over both maps and a port that got the
-// phasing wrong silently picked another api's defaults (§3.3).
-function refapi(ref) {
-    const at = String(ref).indexOf('$');
-    return -1 === at ? String(ref) : String(ref).slice(0, at);
-}
-// Shallow merge, per key, left to right - each source over the one
-// before it. Declared rather than assumed: plugin's library default is
-// a deep map merge, and an allowlist that widens because two precedence
-// levels merged is the failure this rule exists to prevent
-// (station-and-plugin.md §2.5). The visible consequence: an overlay's
-// `policy` REPLACES the base's entirely rather than merging `hosts`
-// into it. That is also the safer reading for an allowlist.
-function shallow(...sources) {
-    const out = {};
-    for (const src of sources) {
-        if (null == src || 'object' !== typeof src || Array.isArray(src)) {
-            continue;
-        }
-        for (const k of Object.keys(src)) {
-            out[k] = src[k];
-        }
-    }
-    return out;
-}
-// Merge the base profile ('default') with the selected overlay.
-//
-// §3.3's total order, for the two block levels - lowest precedence
-// first:
-//
-//   base.api[<api>] ⊕ base.sdk[<ref>] ⊕ overlay.api[<api>] ⊕ overlay.sdk[<ref>]
-//
-// PROFILE SPECIFICITY OUTRANKS BLOCK SPECIFICITY. A `prod` api-level
-// `base` beats a `default` instance-level `base`, because that is what
-// an environment overlay is for; within one profile the instance beats
-// the api default, because that is what an instance is for.
-//
-// THIS IS ONE FLAT LEFT-TO-RIGHT MERGE AND MUST NOT BE REORGANIZED INTO
-// "collapse each namespace, then put instance over api". Collapsing
-// first computes (base.api ⊕ overlay.api) and (base.sdk ⊕ overlay.sdk)
-// and then lets EVERY instance value beat EVERY api value - the exact
-// opposite. A production `api.stripe.policy` would then fail to
-// override a default profile's `sdk.stripe$test.policy`, silently
-// keeping the wider allowlist in production.
-//
-// `secrets.providers` replaces wholesale, never merges (§3.5, §5.2):
-// chain order decides which store wins, so a positional merge would be
-// actively dangerous.
-function resolveProfile(config, profileName) {
-    const profiles = config?.profiles || {};
-    const base = profiles['default'] || {};
-    const overlay = 'default' === profileName
-        ? {} : (profiles[profileName] || {});
-    const providers = overlay.secrets?.providers ?? base.secrets?.providers ??
-        [{ kind: 'env' }];
-    const api = {};
-    for (const slug of sortedkeys(base.api, overlay.api)) {
-        api[slug] = shallow(base.api?.[slug], overlay.api?.[slug]);
-    }
-    // An api block declares no instance, so the ref set comes from the
-    // two `sdk` maps alone.
-    const sdk = {};
-    for (const ref of sortedkeys(base.sdk, overlay.sdk)) {
-        const a = refapi(ref);
-        const merged = shallow(base.api?.[a], base.sdk?.[ref], overlay.api?.[a], overlay.sdk?.[ref]);
-        // Defaults are applied ONCE, to the fully merged instance, and this
-        // is the rule §4.2's normalization must not be confused with. Had
-        // the overlay block carried a synthesized `active: true` into the
-        // merge, a one-key environment override would silently re-enable an
-        // integration the base declared `active: false` - live in
-        // production despite being declared inactive. The `instance` corpus
-        // section carries exactly this case.
-        for (const k of Object.keys(shape_1.BLOCK_DEFAULTS)) {
-            if (undefined === merged[k]) {
-                merged[k] = shape_1.BLOCK_DEFAULTS[k]();
-            }
-        }
-        sdk[ref] = merged;
-    }
-    checksecrets(sdk, profileName);
-    return { name: profileName, providers, api, sdk };
-}
-// A configured secret name sekreto would reject is caught at profile
-// load, not first request (§14 station_secret_name) - and then the
-// derived names are checked for uniqueness, because envtoken is LOSSY.
-//
-// It collapses any run of non-alphanumerics to `_`, so `$` and `-` are
-// indistinguishable downstream: the ref `stripe$test` and an untagged
-// instance of an api slugged `stripe-test` both derive
-// `stripe_test.apikey`. That pairing is the realistic one rather than a
-// contrived one, because api slugs are hyphenated by construction - so
-// a fleet with both a `stripe-test` api and a `test` instance of
-// `stripe` collides by default. Since the resolution cache is keyed by
-// secret name (§5.3), the second instance would silently receive the
-// first's value.
-//
-// Two instances that EXPLICITLY name the same secret are not a
-// collision - that is the shared-key case the api-level `secret` exists
-// for, and saying so out loud is how you ask for it.
-function checksecrets(sdk, profileName) {
-    const refs = Object.keys(sdk).sort();
-    for (const ref of refs) {
-        const name = sdk[ref].secret;
-        if (null != name && !(0, sekreto_1.validname)(name)) {
-            throw new error_1.StationError('station_secret_name', 'profile "' + profileName + '" sdk "' + ref +
-                '": secret name rejected by sekreto: ' + JSON.stringify(name));
-        }
-    }
-    const seen = new Map();
-    for (const ref of refs) {
-        const written = sdk[ref].secret;
-        const derived = null == written || '' === written;
-        const name = derived ? (0, descriptor_1.secretnameDefault)(ref) : written;
-        const prior = seen.get(name);
-        if (undefined !== prior && (derived || prior.derived)) {
-            throw new error_1.StationError('station_secret_collision', 'profile "' + profileName + '": instances "' + prior.ref + '" and "' +
-                ref + '" both resolve to secret name "' + name +
-                '", so they would share one credential; name it explicitly on ' +
-                'each, or at the api level to share it deliberately (§5.1)');
-        }
-        if (undefined === prior) {
-            seen.set(name, { ref, derived });
-        }
-    }
-}
-function sortedkeys(...maps) {
-    const keys = new Set();
-    for (const m of maps) {
-        if (null == m || 'object' !== typeof m || Array.isArray(m)) {
-            continue;
-        }
-        for (const k of Object.keys(m)) {
-            keys.add(k);
-        }
-    }
-    return Array.from(keys).sort();
-}
-//# sourceMappingURL=profilecore.js.map

package/dist/src/profilecore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"profilecore.js","sourceRoot":"","sources":["../../src/profilecore.ts"],"names":[],"mappings":";AAAA;;;;;;mBAMmB;;AAkBnB,sCAMC;AAUD,wBAGC;AAsDD,wCA6CC;AAtID,6CAA2C;AAE3C,6CAAgD;AAChD,mCAAsC;AACtC,mCAAwC;AAGxC,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,wBAAwB;AACxB,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,kCAAkC;AAClC,SAAgB,aAAa,CAAC,UAAmB;IAC/C,IAAI,IAAI,IAAI,UAAU,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QAAC,OAAO,UAAU,CAAA;IAAC,CAAC;IAClE,MAAM,GAAG,GAAG,WAAW,KAAK,OAAO,OAAO;QACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAA;IAClD,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAAC,OAAO,GAAG,CAAA;IAAC,CAAC;IAC7C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,sEAAsE;AACtE,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,+DAA+D;AAC/D,SAAgB,MAAM,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC3D,CAAC;AAeD,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,2DAA2D;AAC3D,sEAAsE;AACtE,oEAAoE;AACpE,4DAA4D;AAC5D,SAAS,OAAO,CAAC,GAAG,OAAc;IAChC,MAAM,GAAG,GAAQ,EAAE,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,OAAO,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,SAAS;AACT,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,kEAAkE;AAClE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sBAAsB;AACtB,SAAgB,cAAc,CAC5B,MAA4B,EAAE,WAAmB;IAEjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvC,MAAM,IAAI,GAAQ,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAQ,SAAS,KAAK,WAAW;QAC5C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS;QACrE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEnB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,mEAAmE;IACnE,wBAAwB;IACxB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,MAAM,GAAG,OAAO,CACpB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EACb,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EACf,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAChB,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CACnB,CAAA;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,0DAA0D;QAC1D,oEAAoE;QACpE,qCAAqC;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAc,CAAC,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC,GAAG,sBAAc,CAAC,CAAC,CAAC,EAAE,CAAA;YAAC,CAAC;QAClE,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;IACnB,CAAC;IAED,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAE9B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AACnD,CAAC;AAED,qEAAqE;AACrE,mEAAmE;AACnE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,uDAAuD;AACvD,wEAAwE;AACxE,uEAAuE;AACvE,iEAAiE;AACjE,uEAAuE;AACvE,qEAAqE;AACrE,iBAAiB;AACjB,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,qDAAqD;AACrD,SAAS,YAAY,CACnB,GAA6B,EAAE,WAAmB;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC5B,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAY,CAAC,qBAAqB,EAC1C,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,GAAG;gBAC3C,sCAAsC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6C,CAAA;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC/B,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,EAAE,KAAK,OAAO,CAAA;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAE,OAAkB,CAAA;QAEnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,SAAS,KAAK,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,oBAAY,CAAC,0BAA0B,EAC/C,WAAW,GAAG,WAAW,GAAG,gBAAgB,GAAG,KAAK,CAAC,GAAG,GAAG,SAAS;gBACpE,GAAG,GAAG,iCAAiC,GAAG,IAAI;gBAC9C,+DAA+D;gBAC/D,2DAA2D,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,IAAW;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;AAChC,CAAC"}

package/src/index.browser.ts

@@ -1,56 +0,0 @@
-// @voxgig/station - one control surface for outbound integrations.
-//
-// THE BROWSER ENTRY (§2.2, §17 Phase 1), selected by the `browser`
-// condition in package.json `exports`. The same surface as `index.ts`
-// MINUS the file-loading half - `loadConfig`, `findConfigFile` and
-// `configScope` are node-only (`profile.ts`, the one module in this
-// package with top-level `node:` imports) and are simply not here, so
-// this entry's module graph pulls no `node:` builtin
-// (`test/browser.test.ts` walks the compiled graph and asserts it).
-//
-// `Station.open()` on this entry takes `config` as an OBJECT - the
-// pre-existing explicit-config path, which skips file loading entirely.
-// With no `config` at all it behaves exactly as node does when no
-// station.json exists: null config, repo-scoped. The ConfigFileIO seam
-// stays unregistered here; a host that genuinely has a config store can
-// register its own through `setConfigFileIO`.
-//
-// §2.2's honesty note stands: in the browser R1/R2 isolation does not
-// exist - an injected credential is readable by page code and DevTools
-// - so browser station is observability-only with app-held credentials
-// until a same-origin proxy endpoint exists.
-
-export { Station, instanceRef, setConfigFileIO } from './Station'
-export type { ConfigFileIO } from './Station'
-export { provide, factoryFor, provided, resetFactories } from './factory'
-export type { Factory, FactoryEntry } from './factory'
-export {
-  DEFAULT_EXPORT, camelify, checkPackage, factoryFromModule, loadAsync, loadSync,
-} from './loader'
-export { adapterFeature, featureBinding } from './adapter'
-export type { FeatureBinding } from './adapter'
-export { StationError } from './error'
-export {
-  canonicalSerialize,
-  envtoken,
-  normalizeDescriptor,
-  secretnameDefault,
-} from './descriptor'
-export { placeholderFor } from './secrets'
-export { refapi, resolveProfile, selectProfile } from './profilecore'
-export type { ResolvedProfile } from './profilecore'
-export {
-  BLOCK_DEFAULTS, MERGE_SENSITIVE, PROFILE_DEFAULTS,
-  configShape, normalizeConfig, validateConfig,
-} from './shape'
-export type {
-  Binding,
-  Descriptor,
-  PolicyBlock,
-  Profile,
-  ResolvedInstance,
-  SdkBlock,
-  StationConfig,
-  StationEvent,
-  StationOptions,
-} from './types'

package/src/profilecore.ts

@@ -1,201 +0,0 @@
-/* The pure half of profile handling: selection, the ref grammar, and
- * the §3.3 merge. Split from `profile.ts` so the BROWSER ENTRY can
- * reach it (§2.2, §17 Phase 1): everything here is data-in/data-out,
- * while the file half (findConfigFile/loadConfig/configScope) is
- * node-only and stays in `profile.ts`, imported by the node entry
- * alone. `profile.ts` re-exports these, so every existing import path
- * is unchanged. */
-
-import { validname } from '@voxgig/sekreto'
-
-import { secretnameDefault } from './descriptor'
-import { StationError } from './error'
-import { BLOCK_DEFAULTS } from './shape'
-import { StationConfig, SdkBlock } from './types'
-
-// Profile selection: VOXGIG_STATION_PROFILE, else the open() option,
-// else 'default' (design §3.5 - env vars rank above station.json but
-// below open() opts; profile NAME selection follows the same order with
-// open() opts winning).
-//
-// `process` is reached through a typeof guard rather than an import:
-// in the browser there is no process and no environment, so the answer
-// is simply the option or the default - which is the same degradation
-// "no env var set" already means.
-export function selectProfile(optProfile?: string): string {
-  if (null != optProfile && '' !== optProfile) { return optProfile }
-  const env = 'undefined' !== typeof process
-    ? process.env.VOXGIG_STATION_PROFILE : undefined
-  if (null != env && '' !== env) { return env }
-  return 'default'
-}
-
-// The api half of a ref is the substring before the first `$`, and an
-// untagged ref IS an api slug (design §3.4) - which is why the whole
-// `plugin` -> `sdk` migration is a key rename and nothing else.
-//
-// LEXICAL, and that is the point: under the old free-form identity
-// which api an instance used was itself a merged value, so the merge
-// could not be a flat pass over both maps and a port that got the
-// phasing wrong silently picked another api's defaults (§3.3).
-export function refapi(ref: string): string {
-  const at = String(ref).indexOf('$')
-  return -1 === at ? String(ref) : String(ref).slice(0, at)
-}
-
-export type ResolvedProfile = {
-  name: string
-  providers: any[]
-  // The api-level defaults in effect for this profile, base ⊕ overlay
-  // per api slug. A REPORT, not an input to the instance merge below -
-  // collapsing each namespace first and composing at the end is the
-  // exact algorithm §3.3 forbids.
-  api: Record<string, SdkBlock>
-  // Instances, keyed by ref. An `api` block declares no instance of its
-  // own (§3.1), so it never creates an entry here.
-  sdk: Record<string, SdkBlock>
-}
-
-// Shallow merge, per key, left to right - each source over the one
-// before it. Declared rather than assumed: plugin's library default is
-// a deep map merge, and an allowlist that widens because two precedence
-// levels merged is the failure this rule exists to prevent
-// (station-and-plugin.md §2.5). The visible consequence: an overlay's
-// `policy` REPLACES the base's entirely rather than merging `hosts`
-// into it. That is also the safer reading for an allowlist.
-function shallow(...sources: any[]): any {
-  const out: any = {}
-  for (const src of sources) {
-    if (null == src || 'object' !== typeof src || Array.isArray(src)) { continue }
-    for (const k of Object.keys(src)) { out[k] = src[k] }
-  }
-  return out
-}
-
-// Merge the base profile ('default') with the selected overlay.
-//
-// §3.3's total order, for the two block levels - lowest precedence
-// first:
-//
-//   base.api[<api>] ⊕ base.sdk[<ref>] ⊕ overlay.api[<api>] ⊕ overlay.sdk[<ref>]
-//
-// PROFILE SPECIFICITY OUTRANKS BLOCK SPECIFICITY. A `prod` api-level
-// `base` beats a `default` instance-level `base`, because that is what
-// an environment overlay is for; within one profile the instance beats
-// the api default, because that is what an instance is for.
-//
-// THIS IS ONE FLAT LEFT-TO-RIGHT MERGE AND MUST NOT BE REORGANIZED INTO
-// "collapse each namespace, then put instance over api". Collapsing
-// first computes (base.api ⊕ overlay.api) and (base.sdk ⊕ overlay.sdk)
-// and then lets EVERY instance value beat EVERY api value - the exact
-// opposite. A production `api.stripe.policy` would then fail to
-// override a default profile's `sdk.stripe$test.policy`, silently
-// keeping the wider allowlist in production.
-//
-// `secrets.providers` replaces wholesale, never merges (§3.5, §5.2):
-// chain order decides which store wins, so a positional merge would be
-// actively dangerous.
-export function resolveProfile(
-  config: StationConfig | null, profileName: string
-): ResolvedProfile {
-  const profiles = config?.profiles || {}
-  const base: any = profiles['default'] || {}
-  const overlay: any = 'default' === profileName
-    ? {} : (profiles[profileName] || {})
-
-  const providers = overlay.secrets?.providers ?? base.secrets?.providers ??
-    [{ kind: 'env' }]
-
-  const api: Record<string, SdkBlock> = {}
-  for (const slug of sortedkeys(base.api, overlay.api)) {
-    api[slug] = shallow(base.api?.[slug], overlay.api?.[slug])
-  }
-
-  // An api block declares no instance, so the ref set comes from the
-  // two `sdk` maps alone.
-  const sdk: Record<string, SdkBlock> = {}
-  for (const ref of sortedkeys(base.sdk, overlay.sdk)) {
-    const a = refapi(ref)
-    const merged = shallow(
-      base.api?.[a],
-      base.sdk?.[ref],
-      overlay.api?.[a],
-      overlay.sdk?.[ref],
-    )
-
-    // Defaults are applied ONCE, to the fully merged instance, and this
-    // is the rule §4.2's normalization must not be confused with. Had
-    // the overlay block carried a synthesized `active: true` into the
-    // merge, a one-key environment override would silently re-enable an
-    // integration the base declared `active: false` - live in
-    // production despite being declared inactive. The `instance` corpus
-    // section carries exactly this case.
-    for (const k of Object.keys(BLOCK_DEFAULTS)) {
-      if (undefined === merged[k]) { merged[k] = BLOCK_DEFAULTS[k]() }
-    }
-
-    sdk[ref] = merged
-  }
-
-  checksecrets(sdk, profileName)
-
-  return { name: profileName, providers, api, sdk }
-}
-
-// A configured secret name sekreto would reject is caught at profile
-// load, not first request (§14 station_secret_name) - and then the
-// derived names are checked for uniqueness, because envtoken is LOSSY.
-//
-// It collapses any run of non-alphanumerics to `_`, so `$` and `-` are
-// indistinguishable downstream: the ref `stripe$test` and an untagged
-// instance of an api slugged `stripe-test` both derive
-// `stripe_test.apikey`. That pairing is the realistic one rather than a
-// contrived one, because api slugs are hyphenated by construction - so
-// a fleet with both a `stripe-test` api and a `test` instance of
-// `stripe` collides by default. Since the resolution cache is keyed by
-// secret name (§5.3), the second instance would silently receive the
-// first's value.
-//
-// Two instances that EXPLICITLY name the same secret are not a
-// collision - that is the shared-key case the api-level `secret` exists
-// for, and saying so out loud is how you ask for it.
-function checksecrets(
-  sdk: Record<string, SdkBlock>, profileName: string
-): void {
-  const refs = Object.keys(sdk).sort()
-
-  for (const ref of refs) {
-    const name = sdk[ref].secret
-    if (null != name && !validname(name)) {
-      throw new StationError('station_secret_name',
-        'profile "' + profileName + '" sdk "' + ref +
-        '": secret name rejected by sekreto: ' + JSON.stringify(name))
-    }
-  }
-
-  const seen = new Map<string, { ref: string, derived: boolean }>()
-  for (const ref of refs) {
-    const written = sdk[ref].secret
-    const derived = null == written || '' === written
-    const name = derived ? secretnameDefault(ref) : (written as string)
-
-    const prior = seen.get(name)
-    if (undefined !== prior && (derived || prior.derived)) {
-      throw new StationError('station_secret_collision',
-        'profile "' + profileName + '": instances "' + prior.ref + '" and "' +
-        ref + '" both resolve to secret name "' + name +
-        '", so they would share one credential; name it explicitly on ' +
-        'each, or at the api level to share it deliberately (§5.1)')
-    }
-    if (undefined === prior) { seen.set(name, { ref, derived }) }
-  }
-}
-
-function sortedkeys(...maps: any[]): string[] {
-  const keys = new Set<string>()
-  for (const m of maps) {
-    if (null == m || 'object' !== typeof m || Array.isArray(m)) { continue }
-    for (const k of Object.keys(m)) { keys.add(k) }
-  }
-  return Array.from(keys).sort()
-}