@voxgig/station 0.0.2 → 0.2.0

package/dist/src/profile.js

@@ -1,31 +1,112 @@
 "use strict";
-/* The FILE half of profile handling - finding and reading
- * station.json - and the scope rule that hangs off where it was found.
- * NODE-ONLY by construction (fs/os/path), which is the §2.2 / §17
- * Phase 1 split: the browser entry never imports this module, and
- * `Station` reaches it through the ConfigFileIO seam the node entry
- * registers. The pure half (selectProfile, refapi, resolveProfile)
- * lives in `profilecore.ts` and is re-exported here so every existing
- * import of `./profile` keeps working. */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.selectProfile = exports.resolveProfile = exports.refapi = void 0;
+exports.selectProfile = selectProfile;
+exports.refapi = refapi;
+exports.resolveProfile = resolveProfile;
 exports.findConfigFile = findConfigFile;
 exports.loadConfig = loadConfig;
 exports.configScope = configScope;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
+const sekreto_1 = require("@voxgig/sekreto");
+const descriptor_1 = require("./descriptor");
 const error_1 = require("./error");
-var profilecore_1 = require("./profilecore");
-Object.defineProperty(exports, "refapi", { enumerable: true, get: function () { return profilecore_1.refapi; } });
-Object.defineProperty(exports, "resolveProfile", { enumerable: true, get: function () { return profilecore_1.resolveProfile; } });
-Object.defineProperty(exports, "selectProfile", { enumerable: true, get: function () { return profilecore_1.selectProfile; } });
-// station.json lookup: cwd upward to the repo root, then
-// ~/.voxgig/station.json (design §3.5). A repo root is where .git lives;
-// with no repo the walk stops at the filesystem root.
+const shape_1 = require("./shape");
+function selectProfile(optProfile) {
+    if (null != optProfile && '' !== optProfile) {
+        return optProfile;
+    }
+    const env = process.env.VOXGIG_STATION_PROFILE;
+    if (null != env && '' !== env) {
+        return env;
+    }
+    return 'default';
+}
+function refapi(ref) {
+    const at = String(ref).indexOf('$');
+    return -1 === at ? String(ref) : String(ref).slice(0, at);
+}
+function shallow(...sources) {
+    const out = {};
+    for (const src of sources) {
+        if (null == src || 'object' !== typeof src || Array.isArray(src)) {
+            continue;
+        }
+        for (const k of Object.keys(src)) {
+            out[k] = src[k];
+        }
+    }
+    return out;
+}
+function resolveProfile(config, profileName) {
+    const profiles = config?.profiles || {};
+    const base = profiles['default'] || {};
+    const overlay = 'default' === profileName
+        ? {} : (profiles[profileName] || {});
+    const providers = overlay.secrets?.providers ?? base.secrets?.providers ??
+        [{ kind: 'env' }];
+    const api = {};
+    for (const slug of sortedkeys(base.api, overlay.api)) {
+        api[slug] = shallow(base.api?.[slug], overlay.api?.[slug]);
+    }
+    // An api block declares no instance, so the ref set comes from the
+    // two `sdk` maps alone.
+    const sdk = {};
+    for (const ref of sortedkeys(base.sdk, overlay.sdk)) {
+        const a = refapi(ref);
+        const merged = shallow(base.api?.[a], base.sdk?.[ref], overlay.api?.[a], overlay.sdk?.[ref]);
+        for (const k of Object.keys(shape_1.BLOCK_DEFAULTS)) {
+            if (undefined === merged[k]) {
+                merged[k] = shape_1.BLOCK_DEFAULTS[k]();
+            }
+        }
+        sdk[ref] = merged;
+    }
+    checksecrets(sdk, profileName);
+    return { name: profileName, providers, api, sdk };
+}
+function checksecrets(sdk, profileName) {
+    const refs = Object.keys(sdk).sort();
+    for (const ref of refs) {
+        const name = sdk[ref].secret;
+        if (null != name && !(0, sekreto_1.validname)(name)) {
+            throw new error_1.StationError('station_secret_name', 'profile "' + profileName + '" sdk "' + ref +
+                '": secret name rejected by sekreto: ' + JSON.stringify(name));
+        }
+    }
+    const seen = new Map();
+    for (const ref of refs) {
+        const written = sdk[ref].secret;
+        const derived = null == written || '' === written;
+        const name = derived ? (0, descriptor_1.secretnameDefault)(ref) : written;
+        const prior = seen.get(name);
+        if (undefined !== prior && (derived || prior.derived)) {
+            throw new error_1.StationError('station_secret_collision', 'profile "' + profileName + '": instances "' + prior.ref + '" and "' +
+                ref + '" both resolve to secret name "' + name +
+                '", so they would share one credential; name it explicitly on ' +
+                'each, or at the api level to share it deliberately (§5.1)');
+        }
+        if (undefined === prior) {
+            seen.set(name, { ref, derived });
+        }
+    }
+}
+function sortedkeys(...maps) {
+    const keys = new Set();
+    for (const m of maps) {
+        if (null == m || 'object' !== typeof m || Array.isArray(m)) {
+            continue;
+        }
+        for (const k of Object.keys(m)) {
+            keys.add(k);
+        }
+    }
+    return Array.from(keys).sort();
+}
 function findConfigFile(from) {
     let dir = node_path_1.default.resolve(from || process.cwd());
     for (;;) {
@@ -59,13 +140,6 @@ function loadConfig(from) {
         throw new error_1.StationError('station_config_invalid', 'station.json at ' + file + ' is not valid JSON: ' + err.message);
     }
 }
-// Which side of the review boundary the config came from (§6.3).
-//
-// `package` and `export` are honoured only from REPO-SCOPED config,
-// because a user-level file is outside the repo's review boundary and a
-// `package` key arriving from it names code to import. Everything else
-// in a user-level config still applies - this narrows one key rather
-// than distrusting the file.
 function configScope(from) {
     const file = findConfigFile(from);
     if (null == file) {

package/dist/src/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/profile.ts"],"names":[],"mappings":";AAAA;;;;;;;0CAO0C;;;;;;AAiB1C,wCAYC;AAED,gCAcC;AASD,kCAKC;AAzDD,sDAAwB;AACxB,sDAAwB;AACxB,0DAA4B;AAE5B,mCAAsC;AAGtC,6CAEsB;AADpB,qGAAA,MAAM,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,4GAAA,aAAa,OAAA;AAIvC,yDAAyD;AACzD,yEAAyE;AACzE,sDAAsD;AACtD,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7C,SAAU,CAAC;QACT,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAChD,IAAI,iBAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;QAClD,MAAM,UAAU,GAAG,iBAAE,CAAC,UAAU,CAAC,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,mBAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,UAAU,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAAC,MAAK;QAAC,CAAC;QAC3C,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,iBAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,SAAgB,UAAU,CAAC,IAAa;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1C,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,oBAAY,CAAC,wBAAwB,EAC7C,kBAAkB,GAAG,IAAI,GAAG,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,6BAA6B;AAC7B,SAAgB,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,MAAM,CAAA;IAAC,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/profile.ts"],"names":[],"mappings":";;;;;AAYA,sCAKC;AAED,wBAGC;AAoBD,wCAsCC;AA2CD,wCAYC;AAED,gCAcC;AAED,kCAKC;AA7JD,sDAAwB;AACxB,sDAAwB;AACxB,0DAA4B;AAE5B,6CAA2C;AAE3C,6CAAgD;AAChD,mCAAsC;AACtC,mCAAwC;AAGxC,SAAgB,aAAa,CAAC,UAAmB;IAC/C,IAAI,IAAI,IAAI,UAAU,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QAAC,OAAO,UAAU,CAAA;IAAC,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAAC,OAAO,GAAG,CAAA;IAAC,CAAC;IAC7C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAgB,MAAM,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC3D,CAAC;AAWD,SAAS,OAAO,CAAC,GAAG,OAAc;IAChC,MAAM,GAAG,GAAQ,EAAE,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,OAAO,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAgB,cAAc,CAC5B,MAA4B,EAAE,WAAmB;IAEjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvC,MAAM,IAAI,GAAQ,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAQ,SAAS,KAAK,WAAW;QAC5C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS;QACrE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEnB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,mEAAmE;IACnE,wBAAwB;IACxB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,MAAM,GAAG,OAAO,CACpB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EACb,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EACf,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAChB,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CACnB,CAAA;QAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAc,CAAC,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC,GAAG,sBAAc,CAAC,CAAC,CAAC,EAAE,CAAA;YAAC,CAAC;QAClE,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;IACnB,CAAC;IAED,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAE9B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AACnD,CAAC;AAED,SAAS,YAAY,CACnB,GAA6B,EAAE,WAAmB;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC5B,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAY,CAAC,qBAAqB,EAC1C,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,GAAG;gBAC3C,sCAAsC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6C,CAAA;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC/B,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,EAAE,KAAK,OAAO,CAAA;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAE,OAAkB,CAAA;QAEnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,SAAS,KAAK,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,oBAAY,CAAC,0BAA0B,EAC/C,WAAW,GAAG,WAAW,GAAG,gBAAgB,GAAG,KAAK,CAAC,GAAG,GAAG,SAAS;gBACpE,GAAG,GAAG,iCAAiC,GAAG,IAAI;gBAC9C,+DAA+D;gBAC/D,2DAA2D,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,IAAW;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;AAChC,CAAC;AAED,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7C,SAAU,CAAC;QACT,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAChD,IAAI,iBAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;QAClD,MAAM,UAAU,GAAG,iBAAE,CAAC,UAAU,CAAC,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,mBAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,UAAU,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAAC,MAAK;QAAC,CAAC;QAC3C,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,iBAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,SAAgB,UAAU,CAAC,IAAa;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1C,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,oBAAY,CAAC,wBAAwB,EAC7C,kBAAkB,GAAG,IAAI,GAAG,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,MAAM,CAAA;IAAC,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC"}

package/dist/src/secrets.d.ts

@@ -1,4 +1,9 @@
 export declare function placeholderFor(slug: string): string;
+export declare function encodeQueryValue(value: string): string;
+export declare function substitute(url: string, headers: Record<string, any> | null | undefined, placeholder: string, value: string): {
+    url: string;
+    headers: Record<string, any>;
+};
 export declare class SecretBroker {
     private sekreto;
     private overrides;

package/dist/src/secrets.js

@@ -2,18 +2,116 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecretBroker = void 0;
 exports.placeholderFor = placeholderFor;
+exports.encodeQueryValue = encodeQueryValue;
+exports.substitute = substitute;
 const sekreto_1 = require("@voxgig/sekreto");
+const plugins_1 = require("@voxgig/sekreto/plugins");
 const error_1 = require("./error");
 // The secret broker (design §5): sekreto resolves, station places. The
 // broker holds resolved values privately - they never enter options,
 // events, or captures; the SDK sees only the placeholder.
-// §7.2: keyed by INSTANCE. Two live instances of one api must have
-// distinct placeholders or the injection seam cannot tell which
-// credential a header wants. For an untagged instance this is the api
-// slug, so the single-instance case is unchanged.
 function placeholderFor(slug) {
     return '[station:' + slug + ']';
 }
+const UNRESERVED = /^[A-Za-z0-9\-._~]$/;
+const HEXPAIR = /^[0-9A-Fa-f]{2}$/;
+// Every UTF-8 byte outside RFC 3986's unreserved set becomes upper-case %XX.
+function encodeQueryValue(value) {
+    let out = '';
+    for (const byte of Buffer.from(value, 'utf8')) {
+        const ch = String.fromCharCode(byte);
+        out += byte < 0x80 && UNRESERVED.test(ch)
+            ? ch
+            : '%' + byte.toString(16).toUpperCase().padStart(2, '0');
+    }
+    return out;
+}
+function matchAt(text, at, end, placeholder) {
+    let i = at;
+    for (const ch of placeholder) {
+        if (i < end && text[i] === ch) {
+            i++;
+            continue;
+        }
+        const hex = text.substring(i + 1, i + 3);
+        if (i + 3 <= end && '%' === text[i] && HEXPAIR.test(hex) &&
+            parseInt(hex, 16) === ch.charCodeAt(0)) {
+            i += 3;
+            continue;
+        }
+        return -1;
+    }
+    return i - at;
+}
+// The placeholder becomes the value in header values and in the URL query,
+// where an SDK percent-encodes it (any hex case) and the value is encoded in
+// turn. The path and fragment are never touched; the headers are a copy.
+function substitute(url, headers, placeholder, value) {
+    const out = { ...(headers || {}) };
+    if ('' === placeholder) {
+        return { url, headers: out };
+    }
+    for (const h of Object.keys(out)) {
+        const v = out[h];
+        if ('string' === typeof v && v.includes(placeholder)) {
+            out[h] = v.split(placeholder).join(value);
+        }
+    }
+    const q = url.indexOf('?');
+    const hash = url.indexOf('#');
+    if (-1 === q || (-1 !== hash && hash < q)) {
+        return { url, headers: out };
+    }
+    const end = -1 === hash ? url.length : hash;
+    const encoded = encodeQueryValue(value);
+    let query = '';
+    for (let i = q + 1; i < end;) {
+        const n = matchAt(url, i, end, placeholder);
+        if (0 < n) {
+            query += encoded;
+            i += n;
+        }
+        else {
+            query += url[i];
+            i++;
+        }
+    }
+    return { url: url.substring(0, q + 1) + query + url.substring(end), headers: out };
+}
+// Every form of every value is matched against the original text and the
+// union of the matches redacted, so no replacement can hide another form.
+function redactValues(text, values) {
+    const forms = new Set();
+    for (const value of values) {
+        if ('' !== value) {
+            forms.add(value);
+            forms.add(encodeQueryValue(value));
+        }
+    }
+    const reach = (at) => {
+        let end = at;
+        for (const form of forms) {
+            if (at + form.length > end && text.startsWith(form, at)) {
+                end = at + form.length;
+            }
+        }
+        return end;
+    };
+    let out = '';
+    for (let i = 0; i < text.length;) {
+        let stop = reach(i);
+        if (stop === i) {
+            out += text[i++];
+            continue;
+        }
+        for (let j = i + 1; j < stop; j++) {
+            stop = Math.max(stop, reach(j));
+        }
+        out += '[redacted]';
+        i = stop;
+    }
+    return out;
+}
 class SecretBroker {
     constructor(providers) {
         // Values hoisted by adopt() from resident options.apikey (design §3.1).
@@ -21,27 +119,12 @@ class SecretBroker {
         this.cache = new Map();
         // Every value this broker ever held, for the exact-value scrub.
         this.held = [];
-        this.sekreto = new sekreto_1.Sekreto({ providers });
+        this.sekreto = new sekreto_1.Sekreto({ plugins: plugins_1.allplugins, providers });
     }
     hoist(slug, value) {
         this.overrides.set(slug, value);
         this.held.push(value);
     }
-    // Resolve the value for a plugin's secret name. Misses and store
-    // errors keep sekreto's distinction (design §5.2): a miss is
-    // station_secret_no_value, a store that could not answer is
-    // station_secret_error with sekreto's message intact - and never a
-    // retry against a weaker store (sekreto owns the chain).
-    // OVERRIDES ARE KEYED BY INSTANCE; THE RESOLUTION CACHE IS KEYED BY
-    // SECRET NAME (§5.3). A hoisted credential belongs to the one instance
-    // it was resident in, but a resolved VALUE belongs to the name it was
-    // resolved for - so several instances sharing one api-level `secret`
-    // cost one lookup rather than one each, and every client an
-    // auto-tagged `create()` produces shares the declared instance's entry
-    // instead of re-resolving per request.
-    //
-    // Keying the cache by instance instead is the defect this replaces: at
-    // 26 instances over 20 apis it turns one store round-trip into 26.
     async value(slug, name) {
         const override = this.overrides.get(slug);
         if (null != override) {
@@ -65,19 +148,10 @@ class SecretBroker {
         this.held.push(value);
         return value;
     }
-    // Exact-value scrub, deliberately WITHOUT sekreto's four-character
-    // readability floor (design §7 as revised): on boundaries where the
-    // promise is absolute, every held value is scrubbed whatever its
-    // length. sekreto's own redact() runs too, covering values resolved
-    // by the underlying instance that station never held.
+    // sekreto's redact runs second; run first, it could split an encoded form.
     scrub(text) {
-        let out = this.sekreto.redact(text);
-        for (const value of this.held) {
-            if ('' !== value) {
-                out = out.split(value).join('[redacted]');
-            }
-        }
-        return out;
+        const raw = 'string' === typeof text ? text : '';
+        return this.sekreto.redact(redactValues(raw, this.held));
     }
     // Drop caches so the next resolve asks the stores again (rotation
     // support rides on sekreto's refresh, design §5.3).

package/dist/src/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":";;;AAYA,wCAEC;AAdD,6CAAuD;AAEvD,mCAAsC;AAEtC,uEAAuE;AACvE,qEAAqE;AACrE,0DAA0D;AAE1D,mEAAmE;AACnE,gEAAgE;AAChE,sEAAsE;AACtE,kDAAkD;AAClD,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,WAAW,GAAG,IAAI,GAAG,GAAG,CAAA;AACjC,CAAC;AAED,MAAa,YAAY;IAQvB,YAAY,SAAgB;QAN5B,wEAAwE;QAChE,cAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;QACrC,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACzC,gEAAgE;QACxD,SAAI,GAAa,EAAE,CAAA;QAGzB,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,KAAa;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAED,iEAAiE;IACjE,6DAA6D;IAC7D,4DAA4D;IAC5D,mEAAmE;IACnE,yDAAyD;IACzD,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,4DAA4D;IAC5D,uEAAuE;IACvE,uCAAuC;IACvC,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAY;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAA;QAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAAC,OAAO,MAAM,CAAA;QAAC,CAAC;QAErC,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,sBAAY,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,oBAAY,CAAC,yBAAyB,EAC9C,gBAAgB,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,GAAG,GAAG,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,IAAI,oBAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,sDAAsD;IACtD,KAAK,CAAC,IAAY;QAChB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACjB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,kEAAkE;IAClE,oDAAoD;IACpD,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,UAAU,KAAK,OAAQ,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC;YAAC,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAA;QAClC,CAAC;IACH,CAAC;CACF;AA/ED,oCA+EC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":";;;AASA,wCAEC;AAMD,4CASC;AAoBD,gCA8BC;AA5ED,6CAAuD;AACvD,qDAAoD;AAEpD,mCAAsC;AAEtC,uEAAuE;AACvE,qEAAqE;AACrE,0DAA0D;AAE1D,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,WAAW,GAAG,IAAI,GAAG,GAAG,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAA;AACvC,MAAM,OAAO,GAAG,kBAAkB,CAAA;AAElC,6EAA6E;AAC7E,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACpC,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,EAAU,EAAE,GAAW,EAAE,WAAmB;IACzE,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,CAAC,CAAA;IACX,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,SAAgB,UAAU,CAAC,GAAW,EAAE,OAA+C,EACrF,WAAmB,EAAE,KAAa;IAClC,MAAM,GAAG,GAAwB,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAA;IACvD,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;QAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;IAAC,CAAC;IAExD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAChB,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;IAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,KAAK,IAAI,OAAO,CAAA;YAChB,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;aACI,CAAC;YACJ,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;YACf,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;AACpF,CAAC;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY,EAAE,MAAgB;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACjB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAChB,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE;QACnC,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;gBAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAA;YAAC,CAAC;QACrF,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;QACjC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA;YAChB,SAAQ;QACV,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,GAAG,IAAI,YAAY,CAAA;QACnB,CAAC,GAAG,IAAI,CAAA;IACV,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAa,YAAY;IAQvB,YAAY,SAAgB;QAN5B,wEAAwE;QAChE,cAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;QACrC,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACzC,gEAAgE;QACxD,SAAI,GAAa,EAAE,CAAA;QAGzB,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAO,CAAC,EAAE,OAAO,EAAE,oBAAU,EAAE,SAAS,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,KAAa;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAY;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAA;QAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAAC,OAAO,MAAM,CAAA;QAAC,CAAC;QAErC,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,sBAAY,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,oBAAY,CAAC,yBAAyB,EAC9C,gBAAgB,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,GAAG,GAAG,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,IAAI,oBAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,IAAY;QAChB,MAAM,GAAG,GAAG,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED,kEAAkE;IAClE,oDAAoD;IACpD,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,UAAU,KAAK,OAAQ,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC;YAAC,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAA;QAClC,CAAC;IACH,CAAC;CACF;AAvDD,oCAuDC"}

package/dist/src/shape.d.ts

@@ -3,15 +3,6 @@
 export declare const PROFILE_DEFAULTS: {
     [k: string]: () => any;
 };
-/** Block-level. `feature` is a container and safe early.
- *
- * `active` IS NOT, and that is the whole timing rule: a default
- * synthesized into an OVERLAY block overwrites the base's real value
- * and silently reactivates an integration the base deliberately barred
- * (§3.3). So the two consumers read this same table at different
- * moments - validateConfig before, to every block, because a block with
- * no present keys is an open map; the resolver AFTER, to the merged
- * instance, because an absent key must stay absent through the merge. */
 export declare const BLOCK_DEFAULTS: {
     [k: string]: () => any;
 };
@@ -19,12 +10,6 @@ export declare const BLOCK_DEFAULTS: {
  * inferred, so a reader does not have to work out which of the two it
  * is, and so a port can assert it. */
 export declare const MERGE_SENSITIVE: string[];
-/** Materialize every documented default, DEFENSIVELY: a node that is
- * not the kind it expects is left alone for validate to reject with a
- * proper message. Pure data-in/data-out, which is what makes it
- * portable to 22 languages and expressible in the corpus.
- *
- * THE NORMALIZED FORM IS AN INPUT TO VALIDATION AND TO NOTHING ELSE. */
 export declare function normalizeConfig(raw: any): any;
 /** `spec/config-shape.json`, §4.3 verbatim, through the shipped mirror.
  * Every validate gets a CLONE: struct's validate consumes the spec it
@@ -32,11 +17,4 @@ export declare function normalizeConfig(raw: any): any;
  * the module constant twice would validate the second config against a
  * spec the first had already eaten. */
 export declare function configShape(): any;
-/** Normalize, then validate (§4.2). Raises `station_config_invalid`
- * with EVERY struct error at once - an eighteen-instance config that
- * touches three of them must not die because the eighteenth has a
- * typo'd package name - then the §5.2 scans.
- *
- * Takes the NORMALIZED form. Handing it a raw config is the mistake
- * §4.2 exists to prevent, so callers go through open()/loadConfig. */
 export declare function validateConfig(normalized: any): any;

package/dist/src/shape.js

@@ -1,22 +1,4 @@
 "use strict";
-/* The config grammar, as data (design §4).
- *
- * TWO STEPS, AND THE FIRST IS WHAT MAKES THE SECOND HONEST.
- *
- * struct drops the unexpected-key check for a map whose spec node ends
- * up empty - "an empty spec object means the object can be open". An
- * optional key is `['$ONE','$NIL', spec]`, and when the data does not
- * carry that key the validator REMOVES it from the spec node. So a
- * block whose keys are all optional degenerates into an open map
- * exactly when the data has none of them, and `{"solar": {"bass": 1}}`
- * validates clean - the one property the whole exercise is for,
- * silently absent in the one case that matters.
- *
- * So: normalizeConfig materializes every documented default, and
- * validateConfig then runs a shape WITH NO OPTIONAL CONTAINERS AT ALL.
- * After normalization every container is present, so the shape can
- * require them, so unexpected-key detection is live at every level and
- * every error names its path. */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MERGE_SENSITIVE = exports.BLOCK_DEFAULTS = exports.PROFILE_DEFAULTS = void 0;
 exports.normalizeConfig = normalizeConfig;
@@ -27,9 +9,6 @@ const sekreto_1 = require("@voxgig/sekreto");
 const config_shape_1 = require("./config-shape");
 const error_1 = require("./error");
 const descriptor_1 = require("./descriptor");
-// ---------------------------------------------------------------------
-// The defaults table - ONE table, two callers
-// ---------------------------------------------------------------------
 /** Profile-level containers. Safe to materialize early either way:
  * they are containers, and a missing one merges as empty regardless. */
 exports.PROFILE_DEFAULTS = {
@@ -38,15 +17,6 @@ exports.PROFILE_DEFAULTS = {
     sdk: () => ({}),
     feature: () => ({}),
 };
-/** Block-level. `feature` is a container and safe early.
- *
- * `active` IS NOT, and that is the whole timing rule: a default
- * synthesized into an OVERLAY block overwrites the base's real value
- * and silently reactivates an integration the base deliberately barred
- * (§3.3). So the two consumers read this same table at different
- * moments - validateConfig before, to every block, because a block with
- * no present keys is an open map; the resolver AFTER, to the merged
- * instance, because an absent key must stay absent through the merge. */
 exports.BLOCK_DEFAULTS = {
     active: () => true,
     feature: () => ({}),
@@ -58,12 +28,6 @@ exports.MERGE_SENSITIVE = ['active'];
 // ---------------------------------------------------------------------
 // normalizeConfig
 // ---------------------------------------------------------------------
-/** Materialize every documented default, DEFENSIVELY: a node that is
- * not the kind it expects is left alone for validate to reject with a
- * proper message. Pure data-in/data-out, which is what makes it
- * portable to 22 languages and expressible in the corpus.
- *
- * THE NORMALIZED FORM IS AN INPUT TO VALIDATION AND TO NOTHING ELSE. */
 function normalizeConfig(raw) {
     if (!ismap(raw)) {
         return raw;
@@ -91,7 +55,6 @@ function normalizeConfig(raw) {
                 prof[k] = exports.PROFILE_DEFAULTS[k]();
             }
         }
-        // A `secrets` written without `providers` still gets the chain.
         if (ismap(prof.secrets) && undefined === prof.secrets.providers) {
             prof.secrets = { ...prof.secrets, providers: [{ kind: 'env' }] };
         }
@@ -123,16 +86,6 @@ function normalizeConfig(raw) {
     out.profiles = profiles;
     return out;
 }
-/** Per feature entry, at every level: `active` -> true.
- *
- * A FEATURE NAMED IN THE CONFIG IS ONE YOU ARE ASKING FOR. The SDK's
- * own default is `active: false` for all but `log`, and
- * `{"retry": {"retries": 3}}` plainly means "retry, with three
- * attempts". It also keeps the feature map closed, for the same reason
- * every other block needs one present key.
- *
- * Defensive like the rest: a non-map is returned untouched for validate
- * to reject by path. */
 function normfeatures(f) {
     if (!ismap(f)) {
         return f;
@@ -162,30 +115,9 @@ const CREDENTIAL_KEYS = [
     'apikey', 'auth', 'authorization', 'token',
     'secret', 'password', 'credential', 'bearer',
 ];
-/** The suffix rule catches `access_key`, `X-Api-Token` and friends in
- * one rule rather than a growing list of spellings. */
 const CREDENTIAL_SUFFIX = ['_KEY', '_TOKEN', '_SECRET', '_PASSWORD'];
-/** §5.2's backstop, and it is stated as one rather than as a grammar.
- * `validname()` is a NAME grammar, not a credential filter: it rejects
- * uppercase, hyphens, `+`, `/` and `=`, so it excludes most real
- * credential formats - but a lowercase hex token passes it cleanly. A
- * character class cannot tell a name from a secret.
- *
- * Derived names break on every separator (`voxgig_solardemo.apikey`
- * runs 6/9/6) and a hand-written name for a human to read does too; a
- * 24-character unbroken run is not a name anybody writes. Note this is
- * a RUN bound, not a length bound: `acme_internal_billing_service.apikey`
- * is 36 characters and passes, which is the false positive a naive
- * length bound would produce. */
 const RUN_BOUND = 24;
 const UNBROKEN_RUN = new RegExp('[A-Za-z0-9]{' + RUN_BOUND + ',}');
-/** Normalize, then validate (§4.2). Raises `station_config_invalid`
- * with EVERY struct error at once - an eighteen-instance config that
- * touches three of them must not die because the eighteenth has a
- * typo'd package name - then the §5.2 scans.
- *
- * Takes the NORMALIZED form. Handing it a raw config is the mistake
- * §4.2 exists to prevent, so callers go through open()/loadConfig. */
 function validateConfig(normalized) {
     const errs = [];
     (0, struct_1.validate)(normalized, configShape(), { errs });
@@ -195,11 +127,6 @@ function validateConfig(normalized) {
     scanConfig(normalized);
     return normalized;
 }
-/** `plugin` is REMOVED, not aliased (§3.4) - a deprecated alias would
- * be a second grammar for one concept in 17 ports. The shape already
- * rejects it as an unexpected key; this says what to rename, because
- * "unexpected key: plugin" alone does not, and the migration for a
- * single-instance project is exactly this one rename. */
 function renamehint(cfg) {
     const profiles = ismap(cfg) && ismap(cfg.profiles) ? cfg.profiles : {};
     const hit = Object.keys(profiles)
@@ -211,8 +138,6 @@ function renamehint(cfg) {
         hit.map((p) => 'profiles.' + p).join(', ') +
         ' - the keys are unchanged, an untagged ref IS an api slug (§3.4)';
 }
-/** The §5.2 scans, over the parts of the grammar that hold arbitrary
- * data. Everything else is closed by construction and needs no scan. */
 function scanConfig(cfg) {
     const secrets = [];
     const reserved = [];
@@ -241,14 +166,8 @@ function scanConfig(cfg) {
                 if (undefined !== block.secret) {
                     secretvalue(block.secret, bpath + '.secret', secrets);
                 }
-                // `options` is passthrough to a generated constructor, so it is
-                // the one place a value can hide.
                 scan(block.options, bpath + '.options', secrets, reserved);
                 checkfeatures(block.feature, bpath + '.feature', secrets, reserved, invalid);
-                // §4.4's explicit checks, applied where the shape cannot reach,
-                // raising the same code the shape would - and pinned in the
-                // corpus so each workaround is removed deliberately when struct
-                // is fixed rather than forgotten.
                 checkpolicy(block.policy, bpath + '.policy', invalid);
             }
         }
@@ -284,19 +203,6 @@ function checkfeatures(f, path, secrets, reserved, invalid) {
         scan(f[name], fpath, secrets, reserved);
     }
 }
-/** The policy block's §4.4 workarounds, in one place because they are
- * one class of gap: struct cannot check what its own defects hide.
- *
- * - `hosts`, `allow.op` and `allow.method` are `$CHILD` string lists,
- *   so element 0 escapes the shape (see firstelement below).
- * - `budget` is a map whose keys are ALL optional scalars, and struct
- *   removes an unsatisfied optional key from the spec node - so
- *   `budget: {rp: 1}` degenerates the spec into an open map and the
- *   typo passes. `allow` does not have this problem (its `$CHILD` keys
- *   stay in the spec whether or not the data carries them, keeping the
- *   map closed), and neither does `policy` itself (`hosts` anchors it);
- *   `budget` alone needs the explicit unexpected-key check, phrased as
- *   struct would phrase it. */
 const BUDGET_KEYS = ['concurrency', 'rps'];
 function checkpolicy(policy, path, invalid) {
     if (!ismap(policy)) {
@@ -318,19 +224,6 @@ function checkpolicy(policy, path, invalid) {
         }
     }
 }
-/** §4.4: `$CHILD` in list mode DOES NOT VALIDATE ELEMENT 0. Verified:
- * `["a", 1]` fails at index 1, `[1]` passes. validate_CHILD installs the
- * template across the data's indices, sets keyI = 0 and returns element
- * 0 as the slot value, and the injection loop resumes past it. An
- * upstream struct defect; filing it is a deliverable of this plan.
- *
- * It reaches EVERY string list in the shape. §4.4 says the only one left
- * is `policy.hosts` because the profile-level `order` list is gone - but
- * §8.4's per-feature `order` carries `before`/`after` string lists, so
- * the reach is three lists, not one, and §4.5 pins `order: [7]`
- * accordingly. Applied where the shape cannot reach, raising the same
- * code the shape would, and pinned in the corpus so the workaround is
- * removed deliberately when struct is fixed rather than forgotten. */
 function firstelement(list, path, invalid) {
     if (!Array.isArray(list) || 0 === list.length) {
         return;
@@ -360,8 +253,6 @@ function scan(node, path, secrets, reserved) {
     for (const key of Object.keys(node)) {
         const kpath = path + '.' + key;
         const val = node[key];
-        // §8.6: station owns feature composition, so an `options.feature`
-        // in a declarative config is a second, unreconciled ordering input.
         if ('feature' === key) {
             reserved.push(kpath + ' is reserved: configure features under the ' +
                 'block\'s own `feature` key, not through `options`');
@@ -387,10 +278,6 @@ function credentialkey(key) {
     const tok = (0, descriptor_1.envtoken)(key);
     return CREDENTIAL_SUFFIX.some((s) => tok.endsWith(s));
 }
-/** A `secret`-named key holds a NAME, and that exemption is not a
- * loophole - it is the whole design. Two checks, not one, and they live
- * in the same three lines precisely so a port cannot implement only the
- * first and inherit the gap the second exists to close. */
 function secretvalue(val, path, secrets) {
     if ('string' !== typeof val) {
         secrets.push(path + ' must be a secret name (a string), but found ' +