@voxgig/station 0.1.0 → 0.2.0

package/dist/src/profile.js

@@ -1,15 +1,4 @@
 "use strict";
-/* Profile handling, whole: the pure half - selection, the ref grammar
- * and the §3.3 merge - and the file half that finds and reads
- * station.json plus the scope rule hanging off where it was found.
- *
- * These were two modules. `profilecore.ts` held the pure half so the
- * BROWSER ENTRY could reach it without pulling `node:fs`, and `Station`
- * reached the file half through a `ConfigFileIO` seam the node entry
- * registered. Station is server-side only, so the split, the seam and
- * the second entry are all gone and this is one module again. Every
- * import of `./profile` is unchanged - that path always re-exported the
- * pure half. */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -27,14 +16,6 @@ const sekreto_1 = require("@voxgig/sekreto");
 const descriptor_1 = require("./descriptor");
 const error_1 = require("./error");
 const shape_1 = require("./shape");
-// Profile selection: VOXGIG_STATION_PROFILE, else the open() option,
-// else 'default' (design §3.5 - env vars rank above station.json but
-// below open() opts; profile NAME selection follows the same order with
-// open() opts winning).
-//
-// `process` is read directly. It used to go through a `typeof` guard
-// because the browser entry reached this code and has no `process`;
-// station is server-side only, so the guard guarded nothing.
 function selectProfile(optProfile) {
     if (null != optProfile && '' !== optProfile) {
         return optProfile;
@@ -45,25 +26,10 @@ function selectProfile(optProfile) {
     }
     return 'default';
 }
-// The api half of a ref is the substring before the first `$`, and an
-// untagged ref IS an api slug (design §3.4) - which is why the whole
-// `plugin` -> `sdk` migration is a key rename and nothing else.
-//
-// LEXICAL, and that is the point: under the old free-form identity
-// which api an instance used was itself a merged value, so the merge
-// could not be a flat pass over both maps and a port that got the
-// phasing wrong silently picked another api's defaults (§3.3).
 function refapi(ref) {
     const at = String(ref).indexOf('$');
     return -1 === at ? String(ref) : String(ref).slice(0, at);
 }
-// Shallow merge, per key, left to right - each source over the one
-// before it. Declared rather than assumed: plugin's library default is
-// a deep map merge, and an allowlist that widens because two precedence
-// levels merged is the failure this rule exists to prevent
-// (station-and-plugin.md §2.5). The visible consequence: an overlay's
-// `policy` REPLACES the base's entirely rather than merging `hosts`
-// into it. That is also the safer reading for an allowlist.
 function shallow(...sources) {
     const out = {};
     for (const src of sources) {
@@ -76,29 +42,6 @@ function shallow(...sources) {
     }
     return out;
 }
-// Merge the base profile ('default') with the selected overlay.
-//
-// §3.3's total order, for the two block levels - lowest precedence
-// first:
-//
-//   base.api[<api>] ⊕ base.sdk[<ref>] ⊕ overlay.api[<api>] ⊕ overlay.sdk[<ref>]
-//
-// PROFILE SPECIFICITY OUTRANKS BLOCK SPECIFICITY. A `prod` api-level
-// `base` beats a `default` instance-level `base`, because that is what
-// an environment overlay is for; within one profile the instance beats
-// the api default, because that is what an instance is for.
-//
-// THIS IS ONE FLAT LEFT-TO-RIGHT MERGE AND MUST NOT BE REORGANIZED INTO
-// "collapse each namespace, then put instance over api". Collapsing
-// first computes (base.api ⊕ overlay.api) and (base.sdk ⊕ overlay.sdk)
-// and then lets EVERY instance value beat EVERY api value - the exact
-// opposite. A production `api.stripe.policy` would then fail to
-// override a default profile's `sdk.stripe$test.policy`, silently
-// keeping the wider allowlist in production.
-//
-// `secrets.providers` replaces wholesale, never merges (§3.5, §5.2):
-// chain order decides which store wins, so a positional merge would be
-// actively dangerous.
 function resolveProfile(config, profileName) {
     const profiles = config?.profiles || {};
     const base = profiles['default'] || {};
@@ -116,13 +59,6 @@ function resolveProfile(config, profileName) {
     for (const ref of sortedkeys(base.sdk, overlay.sdk)) {
         const a = refapi(ref);
         const merged = shallow(base.api?.[a], base.sdk?.[ref], overlay.api?.[a], overlay.sdk?.[ref]);
-        // Defaults are applied ONCE, to the fully merged instance, and this
-        // is the rule §4.2's normalization must not be confused with. Had
-        // the overlay block carried a synthesized `active: true` into the
-        // merge, a one-key environment override would silently re-enable an
-        // integration the base declared `active: false` - live in
-        // production despite being declared inactive. The `instance` corpus
-        // section carries exactly this case.
         for (const k of Object.keys(shape_1.BLOCK_DEFAULTS)) {
             if (undefined === merged[k]) {
                 merged[k] = shape_1.BLOCK_DEFAULTS[k]();
@@ -133,23 +69,6 @@ function resolveProfile(config, profileName) {
     checksecrets(sdk, profileName);
     return { name: profileName, providers, api, sdk };
 }
-// A configured secret name sekreto would reject is caught at profile
-// load, not first request (§14 station_secret_name) - and then the
-// derived names are checked for uniqueness, because envtoken is LOSSY.
-//
-// It collapses any run of non-alphanumerics to `_`, so `$` and `-` are
-// indistinguishable downstream: the ref `stripe$test` and an untagged
-// instance of an api slugged `stripe-test` both derive
-// `stripe_test.apikey`. That pairing is the realistic one rather than a
-// contrived one, because api slugs are hyphenated by construction - so
-// a fleet with both a `stripe-test` api and a `test` instance of
-// `stripe` collides by default. Since the resolution cache is keyed by
-// secret name (§5.3), the second instance would silently receive the
-// first's value.
-//
-// Two instances that EXPLICITLY name the same secret are not a
-// collision - that is the shared-key case the api-level `secret` exists
-// for, and saying so out loud is how you ask for it.
 function checksecrets(sdk, profileName) {
     const refs = Object.keys(sdk).sort();
     for (const ref of refs) {
@@ -188,9 +107,6 @@ function sortedkeys(...maps) {
     }
     return Array.from(keys).sort();
 }
-// station.json lookup: cwd upward to the repo root, then
-// ~/.voxgig/station.json (design §3.5). A repo root is where .git lives;
-// with no repo the walk stops at the filesystem root.
 function findConfigFile(from) {
     let dir = node_path_1.default.resolve(from || process.cwd());
     for (;;) {
@@ -224,13 +140,6 @@ function loadConfig(from) {
         throw new error_1.StationError('station_config_invalid', 'station.json at ' + file + ' is not valid JSON: ' + err.message);
     }
 }
-// Which side of the review boundary the config came from (§6.3).
-//
-// `package` and `export` are honoured only from REPO-SCOPED config,
-// because a user-level file is outside the repo's review boundary and a
-// `package` key arriving from it names code to import. Everything else
-// in a user-level config still applies - this narrows one key rather
-// than distrusting the file.
 function configScope(from) {
     const file = findConfigFile(from);
     if (null == file) {

package/dist/src/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/profile.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;gBAUgB;;;;;AAqBhB,sCAKC;AAUD,wBAGC;AAsDD,wCA6CC;AA+DD,wCAYC;AAED,gCAcC;AASD,kCAKC;AAjPD,sDAAwB;AACxB,sDAAwB;AACxB,0DAA4B;AAE5B,6CAA2C;AAE3C,6CAAgD;AAChD,mCAAsC;AACtC,mCAAwC;AAGxC,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,wBAAwB;AACxB,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,6DAA6D;AAC7D,SAAgB,aAAa,CAAC,UAAmB;IAC/C,IAAI,IAAI,IAAI,UAAU,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QAAC,OAAO,UAAU,CAAA;IAAC,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAAC,OAAO,GAAG,CAAA;IAAC,CAAC;IAC7C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,sEAAsE;AACtE,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,+DAA+D;AAC/D,SAAgB,MAAM,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC3D,CAAC;AAeD,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,2DAA2D;AAC3D,sEAAsE;AACtE,oEAAoE;AACpE,4DAA4D;AAC5D,SAAS,OAAO,CAAC,GAAG,OAAc;IAChC,MAAM,GAAG,GAAQ,EAAE,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,OAAO,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,SAAS;AACT,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,kEAAkE;AAClE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sBAAsB;AACtB,SAAgB,cAAc,CAC5B,MAA4B,EAAE,WAAmB;IAEjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvC,MAAM,IAAI,GAAQ,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAQ,SAAS,KAAK,WAAW;QAC5C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS;QACrE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEnB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,mEAAmE;IACnE,wBAAwB;IACxB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,MAAM,GAAG,OAAO,CACpB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EACb,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EACf,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAChB,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CACnB,CAAA;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,0DAA0D;QAC1D,oEAAoE;QACpE,qCAAqC;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAc,CAAC,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC,GAAG,sBAAc,CAAC,CAAC,CAAC,EAAE,CAAA;YAAC,CAAC;QAClE,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;IACnB,CAAC;IAED,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAE9B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AACnD,CAAC;AAED,qEAAqE;AACrE,mEAAmE;AACnE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,uDAAuD;AACvD,wEAAwE;AACxE,uEAAuE;AACvE,iEAAiE;AACjE,uEAAuE;AACvE,qEAAqE;AACrE,iBAAiB;AACjB,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,qDAAqD;AACrD,SAAS,YAAY,CACnB,GAA6B,EAAE,WAAmB;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC5B,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAY,CAAC,qBAAqB,EAC1C,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,GAAG;gBAC3C,sCAAsC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6C,CAAA;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC/B,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,EAAE,KAAK,OAAO,CAAA;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAE,OAAkB,CAAA;QAEnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,SAAS,KAAK,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,oBAAY,CAAC,0BAA0B,EAC/C,WAAW,GAAG,WAAW,GAAG,gBAAgB,GAAG,KAAK,CAAC,GAAG,GAAG,SAAS;gBACpE,GAAG,GAAG,iCAAiC,GAAG,IAAI;gBAC9C,+DAA+D;gBAC/D,2DAA2D,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,IAAW;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;AAChC,CAAC;AAED,yDAAyD;AACzD,yEAAyE;AACzE,sDAAsD;AACtD,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7C,SAAU,CAAC;QACT,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAChD,IAAI,iBAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;QAClD,MAAM,UAAU,GAAG,iBAAE,CAAC,UAAU,CAAC,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,mBAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,UAAU,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAAC,MAAK;QAAC,CAAC;QAC3C,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,iBAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,SAAgB,UAAU,CAAC,IAAa;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1C,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,oBAAY,CAAC,wBAAwB,EAC7C,kBAAkB,GAAG,IAAI,GAAG,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,6BAA6B;AAC7B,SAAgB,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,MAAM,CAAA;IAAC,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/profile.ts"],"names":[],"mappings":";;;;;AAYA,sCAKC;AAED,wBAGC;AAoBD,wCAsCC;AA2CD,wCAYC;AAED,gCAcC;AAED,kCAKC;AA7JD,sDAAwB;AACxB,sDAAwB;AACxB,0DAA4B;AAE5B,6CAA2C;AAE3C,6CAAgD;AAChD,mCAAsC;AACtC,mCAAwC;AAGxC,SAAgB,aAAa,CAAC,UAAmB;IAC/C,IAAI,IAAI,IAAI,UAAU,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QAAC,OAAO,UAAU,CAAA;IAAC,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAAC,OAAO,GAAG,CAAA;IAAC,CAAC;IAC7C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAgB,MAAM,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC3D,CAAC;AAWD,SAAS,OAAO,CAAC,GAAG,OAAc;IAChC,MAAM,GAAG,GAAQ,EAAE,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,OAAO,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAgB,cAAc,CAC5B,MAA4B,EAAE,WAAmB;IAEjD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvC,MAAM,IAAI,GAAQ,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAQ,SAAS,KAAK,WAAW;QAC5C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS;QACrE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEnB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,mEAAmE;IACnE,wBAAwB;IACxB,MAAM,GAAG,GAA6B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,MAAM,GAAG,OAAO,CACpB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EACb,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EACf,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAChB,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CACnB,CAAA;QAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAc,CAAC,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC,GAAG,sBAAc,CAAC,CAAC,CAAC,EAAE,CAAA;YAAC,CAAC;QAClE,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;IACnB,CAAC;IAED,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAE9B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AACnD,CAAC;AAED,SAAS,YAAY,CACnB,GAA6B,EAAE,WAAmB;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC5B,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAY,CAAC,qBAAqB,EAC1C,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,GAAG;gBAC3C,sCAAsC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6C,CAAA;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QAC/B,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,EAAE,KAAK,OAAO,CAAA;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAE,OAAkB,CAAA;QAEnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,SAAS,KAAK,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,oBAAY,CAAC,0BAA0B,EAC/C,WAAW,GAAG,WAAW,GAAG,gBAAgB,GAAG,KAAK,CAAC,GAAG,GAAG,SAAS;gBACpE,GAAG,GAAG,iCAAiC,GAAG,IAAI;gBAC9C,+DAA+D;gBAC/D,2DAA2D,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,IAAW;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;AAChC,CAAC;AAED,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7C,SAAU,CAAC;QACT,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAChD,IAAI,iBAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;QAClD,MAAM,UAAU,GAAG,iBAAE,CAAC,UAAU,CAAC,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,mBAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,UAAU,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAAC,MAAK;QAAC,CAAC;QAC3C,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,iBAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,SAAgB,UAAU,CAAC,IAAa;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1C,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,oBAAY,CAAC,wBAAwB,EAC7C,kBAAkB,GAAG,IAAI,GAAG,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAAC,OAAO,MAAM,CAAA;IAAC,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC/D,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC"}

package/dist/src/secrets.d.ts

@@ -1,4 +1,9 @@
 export declare function placeholderFor(slug: string): string;
+export declare function encodeQueryValue(value: string): string;
+export declare function substitute(url: string, headers: Record<string, any> | null | undefined, placeholder: string, value: string): {
+    url: string;
+    headers: Record<string, any>;
+};
 export declare class SecretBroker {
     private sekreto;
     private overrides;

package/dist/src/secrets.js

@@ -2,18 +2,116 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecretBroker = void 0;
 exports.placeholderFor = placeholderFor;
+exports.encodeQueryValue = encodeQueryValue;
+exports.substitute = substitute;
 const sekreto_1 = require("@voxgig/sekreto");
+const plugins_1 = require("@voxgig/sekreto/plugins");
 const error_1 = require("./error");
 // The secret broker (design §5): sekreto resolves, station places. The
 // broker holds resolved values privately - they never enter options,
 // events, or captures; the SDK sees only the placeholder.
-// §7.2: keyed by INSTANCE. Two live instances of one api must have
-// distinct placeholders or the injection seam cannot tell which
-// credential a header wants. For an untagged instance this is the api
-// slug, so the single-instance case is unchanged.
 function placeholderFor(slug) {
     return '[station:' + slug + ']';
 }
+const UNRESERVED = /^[A-Za-z0-9\-._~]$/;
+const HEXPAIR = /^[0-9A-Fa-f]{2}$/;
+// Every UTF-8 byte outside RFC 3986's unreserved set becomes upper-case %XX.
+function encodeQueryValue(value) {
+    let out = '';
+    for (const byte of Buffer.from(value, 'utf8')) {
+        const ch = String.fromCharCode(byte);
+        out += byte < 0x80 && UNRESERVED.test(ch)
+            ? ch
+            : '%' + byte.toString(16).toUpperCase().padStart(2, '0');
+    }
+    return out;
+}
+function matchAt(text, at, end, placeholder) {
+    let i = at;
+    for (const ch of placeholder) {
+        if (i < end && text[i] === ch) {
+            i++;
+            continue;
+        }
+        const hex = text.substring(i + 1, i + 3);
+        if (i + 3 <= end && '%' === text[i] && HEXPAIR.test(hex) &&
+            parseInt(hex, 16) === ch.charCodeAt(0)) {
+            i += 3;
+            continue;
+        }
+        return -1;
+    }
+    return i - at;
+}
+// The placeholder becomes the value in header values and in the URL query,
+// where an SDK percent-encodes it (any hex case) and the value is encoded in
+// turn. The path and fragment are never touched; the headers are a copy.
+function substitute(url, headers, placeholder, value) {
+    const out = { ...(headers || {}) };
+    if ('' === placeholder) {
+        return { url, headers: out };
+    }
+    for (const h of Object.keys(out)) {
+        const v = out[h];
+        if ('string' === typeof v && v.includes(placeholder)) {
+            out[h] = v.split(placeholder).join(value);
+        }
+    }
+    const q = url.indexOf('?');
+    const hash = url.indexOf('#');
+    if (-1 === q || (-1 !== hash && hash < q)) {
+        return { url, headers: out };
+    }
+    const end = -1 === hash ? url.length : hash;
+    const encoded = encodeQueryValue(value);
+    let query = '';
+    for (let i = q + 1; i < end;) {
+        const n = matchAt(url, i, end, placeholder);
+        if (0 < n) {
+            query += encoded;
+            i += n;
+        }
+        else {
+            query += url[i];
+            i++;
+        }
+    }
+    return { url: url.substring(0, q + 1) + query + url.substring(end), headers: out };
+}
+// Every form of every value is matched against the original text and the
+// union of the matches redacted, so no replacement can hide another form.
+function redactValues(text, values) {
+    const forms = new Set();
+    for (const value of values) {
+        if ('' !== value) {
+            forms.add(value);
+            forms.add(encodeQueryValue(value));
+        }
+    }
+    const reach = (at) => {
+        let end = at;
+        for (const form of forms) {
+            if (at + form.length > end && text.startsWith(form, at)) {
+                end = at + form.length;
+            }
+        }
+        return end;
+    };
+    let out = '';
+    for (let i = 0; i < text.length;) {
+        let stop = reach(i);
+        if (stop === i) {
+            out += text[i++];
+            continue;
+        }
+        for (let j = i + 1; j < stop; j++) {
+            stop = Math.max(stop, reach(j));
+        }
+        out += '[redacted]';
+        i = stop;
+    }
+    return out;
+}
 class SecretBroker {
     constructor(providers) {
         // Values hoisted by adopt() from resident options.apikey (design §3.1).
@@ -21,27 +119,12 @@ class SecretBroker {
         this.cache = new Map();
         // Every value this broker ever held, for the exact-value scrub.
         this.held = [];
-        this.sekreto = new sekreto_1.Sekreto({ providers });
+        this.sekreto = new sekreto_1.Sekreto({ plugins: plugins_1.allplugins, providers });
     }
     hoist(slug, value) {
         this.overrides.set(slug, value);
         this.held.push(value);
     }
-    // Resolve the value for a plugin's secret name. Misses and store
-    // errors keep sekreto's distinction (design §5.2): a miss is
-    // station_secret_no_value, a store that could not answer is
-    // station_secret_error with sekreto's message intact - and never a
-    // retry against a weaker store (sekreto owns the chain).
-    // OVERRIDES ARE KEYED BY INSTANCE; THE RESOLUTION CACHE IS KEYED BY
-    // SECRET NAME (§5.3). A hoisted credential belongs to the one instance
-    // it was resident in, but a resolved VALUE belongs to the name it was
-    // resolved for - so several instances sharing one api-level `secret`
-    // cost one lookup rather than one each, and every client an
-    // auto-tagged `create()` produces shares the declared instance's entry
-    // instead of re-resolving per request.
-    //
-    // Keying the cache by instance instead is the defect this replaces: at
-    // 26 instances over 20 apis it turns one store round-trip into 26.
     async value(slug, name) {
         const override = this.overrides.get(slug);
         if (null != override) {
@@ -65,19 +148,10 @@ class SecretBroker {
         this.held.push(value);
         return value;
     }
-    // Exact-value scrub, deliberately WITHOUT sekreto's four-character
-    // readability floor (design §7 as revised): on boundaries where the
-    // promise is absolute, every held value is scrubbed whatever its
-    // length. sekreto's own redact() runs too, covering values resolved
-    // by the underlying instance that station never held.
+    // sekreto's redact runs second; run first, it could split an encoded form.
     scrub(text) {
-        let out = this.sekreto.redact(text);
-        for (const value of this.held) {
-            if ('' !== value) {
-                out = out.split(value).join('[redacted]');
-            }
-        }
-        return out;
+        const raw = 'string' === typeof text ? text : '';
+        return this.sekreto.redact(redactValues(raw, this.held));
     }
     // Drop caches so the next resolve asks the stores again (rotation
     // support rides on sekreto's refresh, design §5.3).

package/dist/src/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":";;;AAYA,wCAEC;AAdD,6CAAuD;AAEvD,mCAAsC;AAEtC,uEAAuE;AACvE,qEAAqE;AACrE,0DAA0D;AAE1D,mEAAmE;AACnE,gEAAgE;AAChE,sEAAsE;AACtE,kDAAkD;AAClD,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,WAAW,GAAG,IAAI,GAAG,GAAG,CAAA;AACjC,CAAC;AAED,MAAa,YAAY;IAQvB,YAAY,SAAgB;QAN5B,wEAAwE;QAChE,cAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;QACrC,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACzC,gEAAgE;QACxD,SAAI,GAAa,EAAE,CAAA;QAGzB,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,KAAa;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAED,iEAAiE;IACjE,6DAA6D;IAC7D,4DAA4D;IAC5D,mEAAmE;IACnE,yDAAyD;IACzD,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,4DAA4D;IAC5D,uEAAuE;IACvE,uCAAuC;IACvC,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAY;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAA;QAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAAC,OAAO,MAAM,CAAA;QAAC,CAAC;QAErC,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,sBAAY,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,oBAAY,CAAC,yBAAyB,EAC9C,gBAAgB,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,GAAG,GAAG,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,IAAI,oBAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,sDAAsD;IACtD,KAAK,CAAC,IAAY;QAChB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACjB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,kEAAkE;IAClE,oDAAoD;IACpD,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,UAAU,KAAK,OAAQ,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC;YAAC,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAA;QAClC,CAAC;IACH,CAAC;CACF;AA/ED,oCA+EC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":";;;AASA,wCAEC;AAMD,4CASC;AAoBD,gCA8BC;AA5ED,6CAAuD;AACvD,qDAAoD;AAEpD,mCAAsC;AAEtC,uEAAuE;AACvE,qEAAqE;AACrE,0DAA0D;AAE1D,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,WAAW,GAAG,IAAI,GAAG,GAAG,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAA;AACvC,MAAM,OAAO,GAAG,kBAAkB,CAAA;AAElC,6EAA6E;AAC7E,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACpC,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,EAAU,EAAE,GAAW,EAAE,WAAmB;IACzE,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,CAAC,CAAA;IACX,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,SAAgB,UAAU,CAAC,GAAW,EAAE,OAA+C,EACrF,WAAmB,EAAE,KAAa;IAClC,MAAM,GAAG,GAAwB,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAA;IACvD,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;QAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;IAAC,CAAC;IAExD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAChB,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;IAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,KAAK,IAAI,OAAO,CAAA;YAChB,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;aACI,CAAC;YACJ,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;YACf,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;AACpF,CAAC;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY,EAAE,MAAgB;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACjB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAChB,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE;QACnC,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;gBAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAA;YAAC,CAAC;QACrF,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;QACjC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA;YAChB,SAAQ;QACV,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,GAAG,IAAI,YAAY,CAAA;QACnB,CAAC,GAAG,IAAI,CAAA;IACV,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAa,YAAY;IAQvB,YAAY,SAAgB;QAN5B,wEAAwE;QAChE,cAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;QACrC,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;QACzC,gEAAgE;QACxD,SAAI,GAAa,EAAE,CAAA;QAGzB,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAO,CAAC,EAAE,OAAO,EAAE,oBAAU,EAAE,SAAS,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,KAAa;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAY;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAA;QAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAAC,OAAO,MAAM,CAAA;QAAC,CAAC;QAErC,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,sBAAY,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,oBAAY,CAAC,yBAAyB,EAC9C,gBAAgB,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,GAAG,GAAG,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,IAAI,oBAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,IAAY;QAChB,MAAM,GAAG,GAAG,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED,kEAAkE;IAClE,oDAAoD;IACpD,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,UAAU,KAAK,OAAQ,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC;YAAC,IAAI,CAAC,OAAe,CAAC,OAAO,EAAE,CAAA;QAClC,CAAC;IACH,CAAC;CACF;AAvDD,oCAuDC"}

package/dist/src/shape.d.ts

@@ -3,15 +3,6 @@
 export declare const PROFILE_DEFAULTS: {
     [k: string]: () => any;
 };
-/** Block-level. `feature` is a container and safe early.
- *
- * `active` IS NOT, and that is the whole timing rule: a default
- * synthesized into an OVERLAY block overwrites the base's real value
- * and silently reactivates an integration the base deliberately barred
- * (§3.3). So the two consumers read this same table at different
- * moments - validateConfig before, to every block, because a block with
- * no present keys is an open map; the resolver AFTER, to the merged
- * instance, because an absent key must stay absent through the merge. */
 export declare const BLOCK_DEFAULTS: {
     [k: string]: () => any;
 };
@@ -19,12 +10,6 @@ export declare const BLOCK_DEFAULTS: {
  * inferred, so a reader does not have to work out which of the two it
  * is, and so a port can assert it. */
 export declare const MERGE_SENSITIVE: string[];
-/** Materialize every documented default, DEFENSIVELY: a node that is
- * not the kind it expects is left alone for validate to reject with a
- * proper message. Pure data-in/data-out, which is what makes it
- * portable to 22 languages and expressible in the corpus.
- *
- * THE NORMALIZED FORM IS AN INPUT TO VALIDATION AND TO NOTHING ELSE. */
 export declare function normalizeConfig(raw: any): any;
 /** `spec/config-shape.json`, §4.3 verbatim, through the shipped mirror.
  * Every validate gets a CLONE: struct's validate consumes the spec it
@@ -32,11 +17,4 @@ export declare function normalizeConfig(raw: any): any;
  * the module constant twice would validate the second config against a
  * spec the first had already eaten. */
 export declare function configShape(): any;
-/** Normalize, then validate (§4.2). Raises `station_config_invalid`
- * with EVERY struct error at once - an eighteen-instance config that
- * touches three of them must not die because the eighteenth has a
- * typo'd package name - then the §5.2 scans.
- *
- * Takes the NORMALIZED form. Handing it a raw config is the mistake
- * §4.2 exists to prevent, so callers go through open()/loadConfig. */
 export declare function validateConfig(normalized: any): any;

package/dist/src/shape.js

@@ -1,22 +1,4 @@
 "use strict";
-/* The config grammar, as data (design §4).
- *
- * TWO STEPS, AND THE FIRST IS WHAT MAKES THE SECOND HONEST.
- *
- * struct drops the unexpected-key check for a map whose spec node ends
- * up empty - "an empty spec object means the object can be open". An
- * optional key is `['$ONE','$NIL', spec]`, and when the data does not
- * carry that key the validator REMOVES it from the spec node. So a
- * block whose keys are all optional degenerates into an open map
- * exactly when the data has none of them, and `{"solar": {"bass": 1}}`
- * validates clean - the one property the whole exercise is for,
- * silently absent in the one case that matters.
- *
- * So: normalizeConfig materializes every documented default, and
- * validateConfig then runs a shape WITH NO OPTIONAL CONTAINERS AT ALL.
- * After normalization every container is present, so the shape can
- * require them, so unexpected-key detection is live at every level and
- * every error names its path. */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MERGE_SENSITIVE = exports.BLOCK_DEFAULTS = exports.PROFILE_DEFAULTS = void 0;
 exports.normalizeConfig = normalizeConfig;
@@ -27,9 +9,6 @@ const sekreto_1 = require("@voxgig/sekreto");
 const config_shape_1 = require("./config-shape");
 const error_1 = require("./error");
 const descriptor_1 = require("./descriptor");
-// ---------------------------------------------------------------------
-// The defaults table - ONE table, two callers
-// ---------------------------------------------------------------------
 /** Profile-level containers. Safe to materialize early either way:
  * they are containers, and a missing one merges as empty regardless. */
 exports.PROFILE_DEFAULTS = {
@@ -38,15 +17,6 @@ exports.PROFILE_DEFAULTS = {
     sdk: () => ({}),
     feature: () => ({}),
 };
-/** Block-level. `feature` is a container and safe early.
- *
- * `active` IS NOT, and that is the whole timing rule: a default
- * synthesized into an OVERLAY block overwrites the base's real value
- * and silently reactivates an integration the base deliberately barred
- * (§3.3). So the two consumers read this same table at different
- * moments - validateConfig before, to every block, because a block with
- * no present keys is an open map; the resolver AFTER, to the merged
- * instance, because an absent key must stay absent through the merge. */
 exports.BLOCK_DEFAULTS = {
     active: () => true,
     feature: () => ({}),
@@ -58,12 +28,6 @@ exports.MERGE_SENSITIVE = ['active'];
 // ---------------------------------------------------------------------
 // normalizeConfig
 // ---------------------------------------------------------------------
-/** Materialize every documented default, DEFENSIVELY: a node that is
- * not the kind it expects is left alone for validate to reject with a
- * proper message. Pure data-in/data-out, which is what makes it
- * portable to 22 languages and expressible in the corpus.
- *
- * THE NORMALIZED FORM IS AN INPUT TO VALIDATION AND TO NOTHING ELSE. */
 function normalizeConfig(raw) {
     if (!ismap(raw)) {
         return raw;
@@ -91,7 +55,6 @@ function normalizeConfig(raw) {
                 prof[k] = exports.PROFILE_DEFAULTS[k]();
             }
         }
-        // A `secrets` written without `providers` still gets the chain.
         if (ismap(prof.secrets) && undefined === prof.secrets.providers) {
             prof.secrets = { ...prof.secrets, providers: [{ kind: 'env' }] };
         }
@@ -123,16 +86,6 @@ function normalizeConfig(raw) {
     out.profiles = profiles;
     return out;
 }
-/** Per feature entry, at every level: `active` -> true.
- *
- * A FEATURE NAMED IN THE CONFIG IS ONE YOU ARE ASKING FOR. The SDK's
- * own default is `active: false` for all but `log`, and
- * `{"retry": {"retries": 3}}` plainly means "retry, with three
- * attempts". It also keeps the feature map closed, for the same reason
- * every other block needs one present key.
- *
- * Defensive like the rest: a non-map is returned untouched for validate
- * to reject by path. */
 function normfeatures(f) {
     if (!ismap(f)) {
         return f;
@@ -162,30 +115,9 @@ const CREDENTIAL_KEYS = [
     'apikey', 'auth', 'authorization', 'token',
     'secret', 'password', 'credential', 'bearer',
 ];
-/** The suffix rule catches `access_key`, `X-Api-Token` and friends in
- * one rule rather than a growing list of spellings. */
 const CREDENTIAL_SUFFIX = ['_KEY', '_TOKEN', '_SECRET', '_PASSWORD'];
-/** §5.2's backstop, and it is stated as one rather than as a grammar.
- * `validname()` is a NAME grammar, not a credential filter: it rejects
- * uppercase, hyphens, `+`, `/` and `=`, so it excludes most real
- * credential formats - but a lowercase hex token passes it cleanly. A
- * character class cannot tell a name from a secret.
- *
- * Derived names break on every separator (`voxgig_solardemo.apikey`
- * runs 6/9/6) and a hand-written name for a human to read does too; a
- * 24-character unbroken run is not a name anybody writes. Note this is
- * a RUN bound, not a length bound: `acme_internal_billing_service.apikey`
- * is 36 characters and passes, which is the false positive a naive
- * length bound would produce. */
 const RUN_BOUND = 24;
 const UNBROKEN_RUN = new RegExp('[A-Za-z0-9]{' + RUN_BOUND + ',}');
-/** Normalize, then validate (§4.2). Raises `station_config_invalid`
- * with EVERY struct error at once - an eighteen-instance config that
- * touches three of them must not die because the eighteenth has a
- * typo'd package name - then the §5.2 scans.
- *
- * Takes the NORMALIZED form. Handing it a raw config is the mistake
- * §4.2 exists to prevent, so callers go through open()/loadConfig. */
 function validateConfig(normalized) {
     const errs = [];
     (0, struct_1.validate)(normalized, configShape(), { errs });
@@ -195,11 +127,6 @@ function validateConfig(normalized) {
     scanConfig(normalized);
     return normalized;
 }
-/** `plugin` is REMOVED, not aliased (§3.4) - a deprecated alias would
- * be a second grammar for one concept in 17 ports. The shape already
- * rejects it as an unexpected key; this says what to rename, because
- * "unexpected key: plugin" alone does not, and the migration for a
- * single-instance project is exactly this one rename. */
 function renamehint(cfg) {
     const profiles = ismap(cfg) && ismap(cfg.profiles) ? cfg.profiles : {};
     const hit = Object.keys(profiles)
@@ -211,8 +138,6 @@ function renamehint(cfg) {
         hit.map((p) => 'profiles.' + p).join(', ') +
         ' - the keys are unchanged, an untagged ref IS an api slug (§3.4)';
 }
-/** The §5.2 scans, over the parts of the grammar that hold arbitrary
- * data. Everything else is closed by construction and needs no scan. */
 function scanConfig(cfg) {
     const secrets = [];
     const reserved = [];
@@ -241,14 +166,8 @@ function scanConfig(cfg) {
                 if (undefined !== block.secret) {
                     secretvalue(block.secret, bpath + '.secret', secrets);
                 }
-                // `options` is passthrough to a generated constructor, so it is
-                // the one place a value can hide.
                 scan(block.options, bpath + '.options', secrets, reserved);
                 checkfeatures(block.feature, bpath + '.feature', secrets, reserved, invalid);
-                // §4.4's explicit checks, applied where the shape cannot reach,
-                // raising the same code the shape would - and pinned in the
-                // corpus so each workaround is removed deliberately when struct
-                // is fixed rather than forgotten.
                 checkpolicy(block.policy, bpath + '.policy', invalid);
             }
         }
@@ -284,19 +203,6 @@ function checkfeatures(f, path, secrets, reserved, invalid) {
         scan(f[name], fpath, secrets, reserved);
     }
 }
-/** The policy block's §4.4 workarounds, in one place because they are
- * one class of gap: struct cannot check what its own defects hide.
- *
- * - `hosts`, `allow.op` and `allow.method` are `$CHILD` string lists,
- *   so element 0 escapes the shape (see firstelement below).
- * - `budget` is a map whose keys are ALL optional scalars, and struct
- *   removes an unsatisfied optional key from the spec node - so
- *   `budget: {rp: 1}` degenerates the spec into an open map and the
- *   typo passes. `allow` does not have this problem (its `$CHILD` keys
- *   stay in the spec whether or not the data carries them, keeping the
- *   map closed), and neither does `policy` itself (`hosts` anchors it);
- *   `budget` alone needs the explicit unexpected-key check, phrased as
- *   struct would phrase it. */
 const BUDGET_KEYS = ['concurrency', 'rps'];
 function checkpolicy(policy, path, invalid) {
     if (!ismap(policy)) {
@@ -318,19 +224,6 @@ function checkpolicy(policy, path, invalid) {
         }
     }
 }
-/** §4.4: `$CHILD` in list mode DOES NOT VALIDATE ELEMENT 0. Verified:
- * `["a", 1]` fails at index 1, `[1]` passes. validate_CHILD installs the
- * template across the data's indices, sets keyI = 0 and returns element
- * 0 as the slot value, and the injection loop resumes past it. An
- * upstream struct defect; filing it is a deliverable of this plan.
- *
- * It reaches EVERY string list in the shape. §4.4 says the only one left
- * is `policy.hosts` because the profile-level `order` list is gone - but
- * §8.4's per-feature `order` carries `before`/`after` string lists, so
- * the reach is three lists, not one, and §4.5 pins `order: [7]`
- * accordingly. Applied where the shape cannot reach, raising the same
- * code the shape would, and pinned in the corpus so the workaround is
- * removed deliberately when struct is fixed rather than forgotten. */
 function firstelement(list, path, invalid) {
     if (!Array.isArray(list) || 0 === list.length) {
         return;
@@ -360,8 +253,6 @@ function scan(node, path, secrets, reserved) {
     for (const key of Object.keys(node)) {
         const kpath = path + '.' + key;
         const val = node[key];
-        // §8.6: station owns feature composition, so an `options.feature`
-        // in a declarative config is a second, unreconciled ordering input.
         if ('feature' === key) {
             reserved.push(kpath + ' is reserved: configure features under the ' +
                 'block\'s own `feature` key, not through `options`');
@@ -387,10 +278,6 @@ function credentialkey(key) {
     const tok = (0, descriptor_1.envtoken)(key);
     return CREDENTIAL_SUFFIX.some((s) => tok.endsWith(s));
 }
-/** A `secret`-named key holds a NAME, and that exemption is not a
- * loophole - it is the whole design. Two checks, not one, and they live
- * in the same three lines precisely so a port cannot implement only the
- * first and inherit the gap the second exists to close. */
 function secretvalue(val, path, secrets) {
     if ('string' !== typeof val) {
         secrets.push(path + ' must be a secret name (a string), but found ' +