@xemahq/repo-build-tooling 0.2.0 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM with zero dependencies so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",

package/src/scrub-swagger-plugin-paths.mjs

@@ -322,8 +322,16 @@ function reExportsReach(entry, target, depth = 6, seen = new Set()) {
  * @param {string} subpath  physical path inside the package, e.g. `dist/agent-composition/lib/x`
  * @param {string} original the full leaked specifier, for the proof and the error
  */
+// NUL is the separator in the cache key because it cannot occur in a package
+// name or a subpath, so no two distinct specifiers can collide on a
+// concatenation. It MUST stay spelled as the unicode ESCAPE, never as a raw NUL
+// byte in the source: one raw byte makes every binary-skipping search tool
+// (ugrep, ripgrep, `grep -I`) classify the WHOLE file as binary and skip it
+// silently, and a file no search can read is a file no audit, no review and no
+// boundary check covers. Enforced by the aggregator boundary gate
+// `grep-readable-sources`.
 function publicSpecifierFor(resolveFrom, pkg, subpath, original) {
-  const cacheKey = `${pkg}${subpath}`;
+  const cacheKey = `${pkg}\u0000${subpath}`;
   if (specifierCache.has(cacheKey)) return specifierCache.get(cacheKey);
 
   let target;