[kurtseifried]

Agent: Gemini (SecID governing agent)

Summary

Fixes qualifier filtering (?parsability=, ?content_type=, ?lang=) across all resolution paths and REST API query parameters:

1. typeScopedSearch and namespaceScopedSearch (src/resolver.ts):
   • Applies applyQualifierFilters(results, parsed.qualifiers) and returns qualifierNotFoundResponse when qualifiers filter out all results (e.g., secid:advisory/CVE-2026-0019?parsability=structured).
   • Validates child.data.lang against parsed.qualifiers.lang, sets res.lang on child matches, and surfaces buildLangNotFoundMessage when an identifier matched children whose available languages exclude the requested language.
2. applyQualifierFilters (src/resolver.ts):
   • Filters out URL-less RegistryResult guidance notes (!("url" in r)) when ?parsability= or ?content_type= is requested, and signals not_found when filtered.length === 0 && results.length > 0.
3. qualifierNotFoundResponse (src/resolver.ts):
   • Reports available parsability values when ?parsability= removes all results, and reports combined qualifier mismatches when each qualifier value exists on different results.
4. Top-level REST query parameters (src/api.ts):
   • Merges top-level &parsability=, &content_type=, and &lang= query parameters on /api/v1/resolve into the query when not already present inside secid=, matching the documented examples in API-RESPONSE-FORMAT.md and handling unencoded & after a SecID qualifier.
5. Bare identifier & type-only qualifiers (src/kv-resolve.ts, src/parser.ts):
   • Strips and forwards ?qualifiers on bare identifier searches (e.g., CVE-2026-0019?parsability=structured) in searchBareIdentifier, and strips inline ?qualifiers from type-only SecID strings (e.g., secid:control?country=DE) in extractSecIDType and parseSecID.

Verification

• npm run typecheck (0 errors)
• npm test (all 17 test files / 899 tests pass)

Closes #55
Closes #10

[kurtseifried]

Agent: Gemini (SecID governing agent)

Independent Two-Review Summary

Review 1: Self-Review (Gemini)

• Verified that ?parsability=, ?content_type=, and ?lang= qualifiers are applied across subpath resolution, namespace-scoped search, type-scoped cross-source search, bare identifier search, and top-level /api/v1/resolve HTTP query parameters.
• Confirmed URL-less RegistryResult notes are excluded when parsability or content_type filters are active, and qualifierNotFoundResponse surfaces available parsability values and combined qualifier mismatches.

Review 2: Fresh-Context Cross-Vendor Review (OpenAI Codex gpt-6-astra)

Codex ran 24 in-memory assertions against the snapshot-seeded KV harness and identified 4 P2 issues in the initial commit (82397d1):

1. Top-level filters corrupted subpaths when qualifiers preceded # (src/api.ts): string-appending &lang=de when ? appeared before # produced #art-32&lang=de.
2. Inline qualifier precedence could be bypassed (src/api.ts): qualifierFromSecID did not split on # or normalize uppercase keys (?PARSABILITY=structured).
3. Decoded parameter values allowed qualifier injection (src/api.ts): a top-level content_type=text/html%26parsability%3Dscraped interpolated &parsability=scraped into the SecID string.
4. Type-only queries misinterpreted MIME-type slashes as path separators (src/parser.ts): secid:advisory?content_type=application/json split on the / inside application/json before stripping ? qualifiers.

Resolution (2344311)

• Updated src/api.ts and src/kv-resolve.ts to pass top-level HTTP query qualifiers structurally via capture.qualifiers (mergeQualifiers(parsed.qualifiers, capture?.qualifiers)), eliminating string splicing and parameter pollution while guaranteeing inline qualifier precedence.
• Updated src/parser.ts (extractSecIDType and parseSecID) to strip source-level ?qualifiers from head before splitting on /.
• Updated qualifierFromSecID in src/api.ts to respect # boundaries and case-insensitive keys.
• Added 4 regression tests in test/api.test.ts covering each finding (all 649 tests across 4 files pass).