Answer prose round 1: 0 🔴, 3 🟡 (0 misread); comments shortened, README file map lists link-header

README.md

@@ -1777,7 +1777,7 @@ src/                 The app — strict tsc, no build step. *.test.ts sit beside
   auth/              Identity + the session-JWT hot path: jwt · jwt-middleware · jwks · gen-jwks (CLI) ·
                      login · guards · csrf · denylist · flow-view · oauth-login · oauth-consent ·
                      routes · bootstrap, and the Ory REST clients (kratos-public/admin, keto, hydra,
-                     fetch-timeout)
+                     link-header, fetch-timeout)
   i18n/              catalog (parity rules) · locale (resolution) · translate · load · runtime ·
                      english · view-locals · locales/ (the core en-US + sv-SE catalogs)
   plugin-host/       plugin.ts (the contract) · plugin-api.ts (the `@plainpages/plugin-api` barrel) · system.ts

examples/plugins/auth-admin/admin-shared.ts

@@ -1,6 +1,4 @@
-// Shared plumbing for the admin example plugin: the section nav fragment, the screen gate, the
+// Shared plumbing for the admin example plugin's screens.
-// CSRF-guarded form reader, the destructive-confirm model builder, the form-field type, the Keto
-// paging loop, and small RouteResult helpers.
 // Everything imports the host only through the @plainpages/plugin-api barrel.
 
 import { can, CSRF_FIELD, englishTranslator, GuardError, type KetoClient, type NavNode, readFormBody, type RelationQuery, type RelationTuple, type RequestContext, requireSession, type RouteResult, type Translate, type User } from "@plainpages/plugin-api";

src/auth/link-header.ts

@@ -1,6 +1,5 @@
-// Kratos and Hydra both paginate with an RFC 8288 `Link` header. Returns the `page_token` of its
+// The `page_token` of a `Link` header's `rel="next"` entry (Kratos and Hydra paginate with it), or
-// `rel="next"` entry, or null on the last page. The href is a relative path, so it is resolved
+// null when there is none. The href is relative, so it is resolved against a throwaway base.
-// against a throwaway base just to read the query parameter.
 export function nextPageToken(link: string | null): string | null {
   const href = link?.match(/<([^>]+)>\s*;\s*rel="next"/)?.[1];
   return href ? new URL(href, "http://link-header.invalid").searchParams.get("page_token") : null;