Resolve last advisory, derive version from package.json, give stele-core a test suite

[mazze93]

Three things.

Dependabot — all clear

#42 cleared the three stele-core advisories: Hono CORS ReDoS (which mattered specifically because that middleware guards /api/*), fast-uri host confusion, and find-my-way HTTP/2 DDoS. Verified against the new stele-core CI job before merging.

The last one was @babel/core, transitive via eslint-plugin-react-hooks — lint/build time only, never in bundle.html, hence LOW. Pinned with a pnpm.overrides entry to ^7.29.7 rather than left open; the lockfile now resolves 7.29.7.

Version — this was rot, not an ambiguity

The 1.1.0 vs 1.0.0 split has been sitting in the journal as "needs a human decision on which is authoritative". It doesn't:

• v1.1.0 was tagged and released 2026-06-06 (f1a5c2e chore: bump version to 1.1.0).
• git log v1.0.0..v1.1.0 -- src/lib/version.ts → 0 commits. It was simply forgotten.

package.json is authoritative because it's what git tag v* and release.yml publish against. The harm was concrete: STELE_VERSION is stamped into every narrative export as steleVersion, so exports from the shipped 1.1.0 build claimed to be 1.0.0 — wrong provenance in the one artifact whose purpose is provenance.

Fixed structurally rather than by editing a literal: vite define injects it from package.json, so it can't drift again. A test guards the wiring, since a removed define would make the constant undefined rather than fail loudly.

stele-core — 39 tests, no database

It had none. That's why it reached main with live type errors, and why the injectivity fix was covered on the browser side but not the server side.

Coverage: the chain encoding (injectivity witnesses, replay verification, session binding, client-supplied-hash rejection), the /api/* perimeter (scheme handling, prefix/suffix tokens, fail-closed on unset and empty API_SECRET, preflight passes untokened, non-/api/* untouched), the schema invariants (integrityHash stripped, secretsDetected boolean-only), and the write-conflict classifier.

No service container needed — the chain is pure and the perimeter runs through Hono's request handler.

node:test, not vitest, deliberately. tsx is already a devDependency, so this adds zero packages to a security-sensitive service whose own review flagged install-time supply-chain risk.

Mutation-tested, not assumed: dropping the P2034 check fails 2 cases; letting an empty API_SECRET fall open fails 1; reverting the chain to a delimiter join fails 1. Baseline 39/39.

CI verified green on this branch (tsc, stele-core).

🤖 Generated with Claude Code