[kurtseifried]

Agent: Gemini (SecID governing agent)

Summary

Addresses the three resolver bugs in Group A:

1. lookup_table precedence over url template (CloudSecurityAlliance/SecID#177):

   • resolveChildUrl now checks child.data.lookup_table (Object.hasOwn(table, subpath)) before child.data.url, implementing the precedence documented in REGISTRY-JSON-FORMAT.md (lookup_table overrides url for keys in the table, and url serves as fallback for matching IDs not in lookup_table).
   • namespaceScopedSearch and typeScopedSearch also resolve URLs for lookup_table-only nodes via resolveChildUrl.
   • scripts/upload-registry-kv.ts and test/helpers/seed-kv.ts set has_url: !!(child.data?.url || child.data?.lookup_table) on child index entries.

2. known_values closing & open_pattern propagation (CloudSecurityAlliance/SecID#190):

   • Updated MatchNodeData.known_values to Record<string, string> | string[].
   • Updated nodeMatches so a non-empty string[] known_values array always closes the set (both unscoped and scoped, regardless of whether sentinel probing classifies the regex as open), and a non-empty Record<string, string> map closes the set when isNodeOpen(node) is true.
   • Added open?: boolean to ChildIndexEntry and updated crossSourceCandidates in src/kv-resolve.ts to check e.open ?? isOpenPattern(e.patterns) so open_pattern: true child nodes in TypeIndex.child_index are excluded from tight cross-source candidate selection.

3. Single-source-of-truth extractNameSlug (CloudSecurityAlliance/SecID#181):

   • Exported patternLiteral and extractNameSlug(node, matchedName?) from src/resolver.ts and imported it in scripts/upload-registry-kv.ts, test/helpers/seed-kv.ts, and test/resolver.test.ts (eliminating 3 duplicate copies).
   • Preserves escaped dots in literal patterns[0] via patternLiteral + /^[\w.-]+$/ while rejecting unescaped wildcard dots.
   • Echoes matchedName when patterns[0] is a regex template so canonical SecIDs round-trip cleanly.

Verification & Reviews

• npm run typecheck — clean
• npm test — 17 test files, 1,358 tests passed
• Reviews: Self-review (Gemini) + independent review by OpenAI Codex (codex review --base main; caught excess object literal properties weight/data in extractNameSlug unit test inputs, fixed in 5fa7c2e).

Refs: CloudSecurityAlliance/SecID#177
Refs: CloudSecurityAlliance/SecID#181
Refs: CloudSecurityAlliance/SecID#190