(janitor/dedupe): consolidate base64url encode/decode helpers in worker-utils

[kilo-code-bot]

Summary

Deduplicate the bytesToBase64url / base64urlToBytes helpers, which were defined verbatim in both packages/worker-utils/src/sandbox-id.ts and packages/worker-utils/src/hostname-label.ts.

Change

• Extract the shared base64url encode/decode into packages/worker-utils/src/base64url.ts.
• Add a ./base64url subpath export.
• sandbox-id.ts imports the shared helpers directly.
• hostname-label.ts imports the shared helpers and keeps its roundtrip-validating, null-returning wrapper (base64urlToBytesOrNull) local, since that validation is hostname-label-specific behavior.
• Add a focused base64url.test.ts.

Scope notes

The same helper also exists in apps/web/src/lib/kiloclaw/sandbox-id.ts and is re-exported from services/kiloclaw/src/auth/*. Those are intentional, documented duplicates: apps/web inlines it because Next.js moduleResolution cannot resolve the worker-utils subpath export, and services/kiloclaw already re-exports the canonical worker-utils module. Left as-is to avoid cross-runtime coupling.

Verification

• pnpm --filter @kilocode/worker-utils test — 743 passed
• pnpm --filter @kilocode/worker-utils typecheck — clean
• pnpm --filter @kilocode/worker-utils lint — 0 warnings/errors

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Verified the base64url helper extraction preserves encode/decode semantics in sandbox-id.ts and hostname-label.ts, including the hostname-label roundtrip-validation wrapper, with adequate test coverage.

Files Reviewed (5 files)

• packages/worker-utils/package.json
• packages/worker-utils/src/base64url.ts
• packages/worker-utils/src/base64url.test.ts
• packages/worker-utils/src/hostname-label.ts
• packages/worker-utils/src/sandbox-id.ts

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}