# @stackline/loader-utils 1.0.2

## Purpose

Maintained and security-hardened utilities for webpack loader authors, preserving the complete `loader-utils@2.0.4` public contract.

## Installation

Direct scoped use:

    npm install @stackline/loader-utils

Drop-in historical-key use:

    npm install loader-utils@npm:@stackline/loader-utils

## Compatibility

- Node.js 12.13 or newer.
- CommonJS plus dynamic ESM import.
- TypeScript declarations checked with TypeScript 3.9 and current TypeScript.
- All ten root exports in their baseline order.
- Published `lib/*` deep imports.
- Webpack 4 `getOptions` behavior and Webpack 5 consumer builds.
- Exact `loader-utils@2.0.4` URL, hashing, interpolation, query, request, and error behavior except documented security hardening.

## Security hardening

Parsed query objects ignore the unsafe keys `__proto__`, `prototype`, and `constructor`, including nested input. Custom-base hash encoding uses bounded linear-time native code. Malformed and large inputs are covered by regression tests.

## Public API

- `getOptions(loaderContext)`
- `parseQuery(query)`
- `stringifyRequest(loaderContext, request)`
- `getRemainingRequest(loaderContext)`
- `getCurrentRequest(loaderContext)`
- `isUrlRequest(url, root?)`
- `urlToRequest(url, root?)`
- `parseString(value)`
- `getHashDigest(buffer, hashType?, digestType?, maxLength?)`
- `interpolateName(loaderContext, name?, options?)`

## Production closure

- `emojis-list@3.0.0`: maintained zero-dependency leaf.
- `json5@2.2.3`: maintained zero-dependency leaf.

Clean direct and legacy-alias installs, `npm ls --omit=dev`, full and production npm audits, package signatures, license inventory, and reproducible release artifacts are verified before publication.

## Evidence

The suite runs upstream assertions, an exhaustive differential matrix against an independently installed `loader-utils@2.0.4`, security regressions, deep-import checks, TypeScript 3.9/current compilation, package validation, and real `@stackline/resolve-url-loader` builds under Webpack 4 and 5. Core line coverage for 1.0.2 is 97.71 percent.

## References

- Source: https://github.com/alexandroit/stackline-loader-utils
- npm: https://www.npmjs.com/package/@stackline/loader-utils
- Immutable release: https://github.com/alexandroit/stackline-loader-utils/releases/tag/stackline-v1.0.2
- Compatibility policy: https://alexandro.net/docs/vanilla/loader-utils/COMPATIBILITY.md
- Dependency review: https://alexandro.net/docs/vanilla/loader-utils/DEPENDENCY_REVIEW.md
- Security policy: https://alexandro.net/docs/vanilla/loader-utils/SECURITY.md
- License inventory: https://alexandro.net/docs/vanilla/loader-utils/THIRD_PARTY_LICENSES.md