feat(estate-safety-kit): canonical vendored source for cross-repo safety helpers

[mdheller]

What this is

This session (2026-08-03) independently fixed the same three defect shapes in
three separate repos, with no code sharing between the fixes:

1. isSafeHttp — URL scheme allowlist against click-XSS. Written once in
   socioprophet-web/app-vue/src/services/url-safe.ts
   (socioprophet#477),
   then copy-pasted (not imported) into
   socioprophet-web/client-vue/src/utils/urlSafe.ts
   (socioprophet#550)
   because the two Vue packages don't share a workspace.
2. mintId — CSPRNG id minting, replacing hash-of-own-inputs id schemes
   that collide same-millisecond under load. Written in
   apps/health-twin/src/ids.ts
   (prophet-platform#1070);
   the same PATTERN (not the code) had to be independently re-derived for
   bootProofRecord in socioprophet's server contracts
   (socioprophet#484).
3. Bounded-int / bounded-payload validation — the exhaust-guard int-cap
   pattern from compute-gateway's engine.py
   (prophet-platform#1067 →
   #1071 →
   #1118),
   never generalized even to the sibling app nugget-extractor in the same
   repo.

That's real technical debt: the same bug fixed multiple times instead of
once. This PR adds estate-safety-kit/ as the canonical, single source for
all three, plus a vendoring contract so future consumers copy from one place
instead of re-deriving the fix again.

Why vendoring, not a package registry

The estate already has a proven pattern for cross-repo shared, trust-sensitive
content: SHA-pinned vendoring with a provenance record — not a package
registry. See prophet-platform/tools/revendor_engine.py +
tools/assert_vendored_engine_marker.py (the hellgraph engine tarball), and
apps/compute-gateway/src/compute_gateway/schemas/PROVENANCE.md (vendored
zero-trust kernel schemas). A private npm/PyPI registry for three files would
be a new supply-chain surface, a publish pipeline, and a versioning burden
this estate has explicitly avoided elsewhere. estate-safety-kit/PROVENANCE.md
in this PR is the full contract: consumers copy the file verbatim, record a
PROVENANCE.txt with the source commit SHA, and run
tools/check_vendored_safety_kit.py (byte-identity proof against the pinned
commit — fetched from raw.githubusercontent.com or a local --source-root
checkout) instead of trusting a comment that says "kept in sync."

What's in it

• js/urlSafe.ts + js/urlSafe.test.ts — merged from both existing copies
  (they'd converged to identical logic already; kept the more complete
  comment). 53 tests, node --test (zero dependencies), all passing.
• js/mintId.ts + js/mintId.test.ts — generalizes health-twin's ids.ts:
  default 128-bit width, with a bytes parameter so a caller with a
  stricter ratchet (health-twin's own 64-hex-everywhere invariant) can ask
  for 256 bits from the same helper instead of forking it. 12 tests, all
  passing.
• py/bounded_int.py + py/test_bounded_int.py — generalizes
  _bad_nonneg_int/_MAX_NONNEG_INT from compute-gateway's exhaust guard,
  plus a bounded-string and aggregate-size-backstop sibling for the rest of
  the same defect class. 20 tests, pytest, all passing.
• tools/check_vendored_safety_kit.py — the checker consumers run in CI.

Status

New shared-infrastructure pattern — held for human review of the vendoring
convention, not just the code. None of the three defects this closes are
newly discovered; every site listed above already has its own independent
fix merged. This PR's only effect once its consumer PR lands is that two
already-fixed files become vendored copies of one source instead of two
hand-maintained ones.

A consumer PR in SocioProphet/socioprophet re-points app-vue's and
client-vue's isSafeHttp to vendor from this kit — it references this PR
by number since it can't pin a merge commit that doesn't exist yet. Not
blocking merge order on that PR; noting the dependency explicitly.

Not requesting admin-merge on this one — asking for a human look at the
vendoring shape itself before anything estate-wide starts depending on it.

---

Update: the two consumer PRs in SocioProphet/socioprophet are open:

• socioprophet#551 —
  app-vue/src/services/url-safe.ts re-pointed to a vendored copy.
• socioprophet#550 —
  client-vue/src/utils/urlSafe.ts re-pointed to a vendored copy (on the
  branch that originally introduced it).

Both carry a provisional PROVENANCE.txt pin at this PR's branch head
(78f5cf6) rather than a merge commit, since this PR isn't merged yet —
each notes it needs re-pinning to the actual main commit once this lands.
Both packages' full existing test suites pass unchanged against the
vendored copy (app-vue 65/65, client-vue 739/739).