@exortek/apikey 1.1.1 → 1.1.3

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @exortek/apikey
 
+## 1.1.3
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
+## 1.1.2
+
+### Patch Changes
+
+- b9e0647: Publish only the package-root README, CHANGELOG and LICENSE.
+
+  The `files` list matched those names at any depth rather than just the root, so a nested document was published
+  alongside them — `@exortek/oauth2` shipped its `examples/README.md`. The entries are now anchored to the package root.
+
+- 0a94f13: Smaller bundles — the internal argument-guard helpers are now tree-shakeable.
+
+  Each package bundles the guard helpers it uses. They were previously built as one object holding all fourteen, which a
+  bundler cannot take apart, so every package shipped all of them regardless of how many it called. They are now
+  individually importable, and each package pulls in only what it uses.
+
+  No API change: the errors, codes and messages raised by argument validation are identical. Published bundles shrink by
+  roughly 7-18% depending on the package.
+
 ## 1.1.1
 
 ### Patch Changes

package/README.md

@@ -3,11 +3,11 @@
 > Stripe-style prefixed API keys for Node.js 22+ — 3-segment tokens (`sk_live_<id>_<secret>`), HMAC-SHA256 storage hash with optional pepper rotation, scope allowlists, memory + Redis stores, Express + Fastify middleware. Zero non-`@exortek/*` runtime dependencies.
 
 [![npm](https://img.shields.io/npm/v/@exortek/apikey.svg?color=cb3837)](https://www.npmjs.com/package/@exortek/apikey)
-[![tests](https://img.shields.io/badge/tests-passing-brightgreen)](https://github.com/ExorTek/auth/actions/workflows/ci.yml)
+[![tests](https://github.com/ExorTek/auth/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/ExorTek/auth/actions/workflows/ci.yml)
 [![node](https://img.shields.io/node/v/@exortek/apikey.svg?color=339933)](https://nodejs.org)
 [![install size](https://packagephobia.com/badge?p=@exortek/apikey)](https://packagephobia.com/result?p=@exortek/apikey)
 [![types](https://img.shields.io/badge/types-included-3178C6)](./dist/index.d.ts)
-[![license](https://img.shields.io/npm/l/@exortek/apikey.svg?color=blue)](./LICENSE)
+[![license](https://img.shields.io/npm/l/@exortek/apikey.svg?color=blue)](https://github.com/ExorTek/auth/blob/master/LICENSE)
 
 📖 **Docs:** [**auth.memet.dev/apikey**](https://auth.memet.dev/apikey)
 
@@ -325,4 +325,4 @@ Expected verify failures do NOT throw — they surface as `{ valid: false, reaso
 
 ## License
 
-MIT © ExorTek — see [LICENSE](./LICENSE).
+MIT © ExorTek — see [LICENSE](https://github.com/ExorTek/auth/blob/master/LICENSE).

package/dist/index.cjs

@@ -351,20 +351,33 @@ class ApiKeyError extends BaseError {
  * `@exortek/shared/validate`: **schema** for whole options objects,
  * **asserts** for one-liner argument guards at the call site.
  *
- * The consumer surface is {@link defineGuards} (or the raw
- * {@link bindAsserts} for full control). Each package binds the assert
- * set to its own typed error class once (in `internal/guards.js`), so
- * every argument failure throws that package's class —
- * `err instanceof CryptoError` holds and users see at a glance which
- * package raised the error. The bound `parse` bridges
- * `@exortek/shared/validate` schemas to the same error class.
+ * Every guard is exported as a `make…` **factory** taking the binding
+ * package's `wrap` and returning the guard itself. A package binds the
+ * guards it calls once, in its `internal/guards.js`, so every argument
+ * failure throws that package's error class — `err instanceof
+ * CryptoError` holds, and users see at a glance which package raised it.
+ *
+ *   // packages/<pkg>/src/internal/guards.js
+ *   import { makeAssertString, makeInvalidArgument } from '@exortek/shared/asserts';
+ *   import { CryptoError, ErrorCode } from '../errors.js';
+ *
+ *   const wrap = (message, extra) => new CryptoError(ErrorCode.INVALID_ARGUMENT, message, extra);
+ *
+ *   export const assertString = makeAssertString(wrap);
+ *   export const invalidArgument = makeInvalidArgument(wrap);
+ *
+ * Importing each factory by name is what makes the module
+ * tree-shakeable. An earlier version handed back one object carrying
+ * every guard, so all of them shipped in every package's bundle no
+ * matter how few were used — `assertBoolean` reached fifteen published
+ * packages without a single call site. Import what you call.
  *
  * **Path naming convention** (used as the `name` argument):
  *
  *   `<publicFunction>[.options|.config][.<field>]`
  *
- *   - `assertString(name, 'createUser.name')`          — top-level arg
- *   - `assertPositiveInt(n, 'scrypt.options.r')`       — nested option
+ *   - `assertString(name, 'createUser.name')`            — top-level arg
+ *   - `assertPositiveInt(n, 'scrypt.options.r')`         — nested option
  *   - `assertBytesOrString(pwd, 'pepper.wrap.password')` — method arg
  *
  * Keep the path short: the emitted error is `"<name> must be <desc>"`,
@@ -373,301 +386,34 @@ class ApiKeyError extends BaseError {
  * encryptSymmetric()"), not for restating the field.
  */
 
-/**
- * @typedef {{ cause?: unknown }} WrapExtra
- *   Extra options forwarded to the wrap function, so `invalidArgument`
- *   sites that catch an underlying error can preserve the `cause` chain
- *   without falling back to a raw `new PackageError(...)`.
- *
- * @typedef {(message: string, extra?: WrapExtra) => Error} WrapFn
- *   Constructs (never throws) the binding package's error, e.g.
- *   `(m, { cause } = {}) => new CryptoError(ErrorCode.INVALID_ARGUMENT, m, { cause })`.
- *
- * @typedef {{ hint?: string }} AssertOptions
- *   `hint` is appended to the message after an em-dash — use it for
- *   actionable guidance ("pass the exact bytes returned by …").
- *
- * @typedef {{ safeParse: (input: unknown, path?: string) => { ok: true, value: unknown } | { ok: false, errors: string[] } }} ParseableSchema
- */
 
 /**
- * Build the failure message. `description` completes the sentence
- * `"<name> must be <description>"`; `hint` (optional) follows an
- * em-dash.
+ * Construct (not throw) the bound error with a free-form message — for
+ * `throw invalidArgument('…')` sites that don't fit the `X must be Y`
+ * shape (canonicalisation errors, cross-field constraint failures). Pass
+ * `{ cause }` when the failure was triggered by an underlying throw whose
+ * chain matters (e.g. `JSON.stringify` on a bigint).
  *
- * @param {string} name
- * @param {string} description
- * @param {string} [hint]
- * @returns {string}
+ * @type {(wrap: WrapFn) => (msg: string, extra?: WrapExtra) => Error}
  */
-function message(name, description, hint) {
-  return `${name} must be ${description}${hint ? ` — ${hint}` : ''}`;
-}
-
-const ENCODINGS = new Set(['hex', 'base64', 'base64url']);
+const makeInvalidArgument = wrap => (msg, extra) => wrap(msg, extra);
 
 /**
- * Bind the assert set to a package's error class. Call once per
- * package (conventionally in `internal/guards.js`) and import the
- * bound object everywhere:
- *
- *   import { bindAsserts } from '@exortek/shared/asserts';
- *   import { CryptoError, ErrorCode } from '../errors.js';
- *   export const g = bindAsserts((m) => new CryptoError(ErrorCode.INVALID_ARGUMENT, m));
- *
- *   // call sites:
- *   g.assertPositiveInt(options.iterations, 'options.iterations');
- *   const cfg = g.parse(OptionsSchema, options, 'options');
- *
- * @param {WrapFn} wrap
+ * Argument guards bound to `ApiKeyError` — the package-wide binding of
+ * `@exortek/shared/asserts`. Import guards from here, never from the
+ * shared module directly.
  */
-function bindAsserts(wrap) {
-  /**
-   * @param {string} name
-   * @param {string} description
-   * @param {AssertOptions} [opts]
-   * @returns {never}
-   */
-  function fail(name, description, opts) {
-    throw wrap(message(name, description, opts?.hint));
-  }
 
-  /**
-   * Assert that `value` is a plain object (not `null`, not an array,
-   * not a primitive).
-   * @param {unknown} value
-   * @param {string}  name
-   * @param {AssertOptions} [opts]
-   */
-  function assertObject(value, name, opts) {
-    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-      fail(name, 'an object', opts);
-    }
-  }
-
-  return {
-    /**
-     * Construct (not throw) the bound error with a free-form message —
-     * for `throw g.invalidArgument('…')` sites that don't fit the
-     * `X must be Y` shape (canonicalisation errors, cross-field
-     * constraint failures). Pass `{ cause }` when the argument-shape
-     * failure was triggered by an underlying throw whose chain matters
-     * (e.g. `JSON.stringify` on a bigint).
-     *
-     * @param {string} msg
-     * @param {WrapExtra} [extra]
-     * @returns {Error}
-     */
-    invalidArgument(msg, extra) {
-      return wrap(msg, extra);
-    },
-
-    /**
-     * Validate `input` against a `@exortek/shared/validate` schema;
-     * failures throw the bound error carrying every collected message.
-     * The bridge that keeps schema validation on the package's own
-     * error surface.
-     *
-     * @param {ParseableSchema} schema
-     * @param {unknown} input
-     * @param {string} [path='options']
-     * @returns {unknown} the parsed (possibly defaulted) value
-     */
-    parse(schema, input, path = 'options') {
-      const r = schema.safeParse(input, path);
-      if (!r.ok) {
-        throw wrap(r.errors.join('; '));
-      }
-      return r.value;
-    },
-
-    /**
-     * Assert that `value` is a non-negative safe integer (`0, 1, 2, …`).
-     * @param {unknown} value
-     * @param {string}  name  Argument name to include in the error message.
-     * @param {AssertOptions} [opts]
-     */
-    assertNonNegativeInt(value, name, opts) {
-      if (!Number.isSafeInteger(value) || /** @type {number} */ (value) < 0) {
-        fail(name, 'a non-negative safe integer', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a strictly positive safe integer (`1, 2, 3, …`).
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertPositiveInt(value, name, opts) {
-      if (!Number.isSafeInteger(value) || /** @type {number} */ (value) <= 0) {
-        fail(name, 'a positive integer', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` fits in a 48-bit unsigned integer (`0 … 2^48 − 1`).
-     * Used for Unix millisecond timestamps in UUID v7 / ULID.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertUint48(value, name, opts) {
-      if (
-        !Number.isSafeInteger(value) ||
-        /** @type {number} */ (value) < 0 ||
-        /** @type {number} */ (value) > 0xffffffffffff
-      ) {
-        fail(name, 'a non-negative safe integer ≤ 2^48 − 1 (Unix ms since epoch)', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a string (may be empty).
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertString(value, name, opts) {
-      if (typeof value !== 'string') {
-        fail(name, 'a string', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a non-empty string.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertNonEmptyString(value, name, opts) {
-      if (typeof value !== 'string' || value.length === 0) {
-        fail(name, 'a non-empty string', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a boolean.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertBoolean(value, name, opts) {
-      if (typeof value !== 'boolean') {
-        fail(name, 'a boolean', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a function.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertFunction(value, name, opts) {
-      if (typeof value !== 'function') {
-        fail(name, 'a function', opts);
-      }
-    },
-
-    assertObject,
-
-    /**
-     * Assert that `value` is either `undefined` or a plain object —
-     * the "optional options object" pattern.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertOptionalObject(value, name, opts) {
-      if (value === undefined) {
-        return;
-      }
-      assertObject(value, name, opts);
-    },
-
-    /**
-     * Assert that `value` is a byte buffer (`Buffer` or `Uint8Array`) —
-     * strings are NOT accepted. For already-encoded material where a
-     * string would be ambiguous (ciphertext, signatures, raw key bytes).
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertBytes(value, name, opts) {
-      if (!Buffer.isBuffer(value) && !(value instanceof Uint8Array)) {
-        fail(name, 'a Buffer or Uint8Array', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is either a string or a byte buffer (`Buffer`
-     * or `Uint8Array`).
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertBytesOrString(value, name, opts) {
-      if (typeof value !== 'string' && !Buffer.isBuffer(value) && !(value instanceof Uint8Array)) {
-        fail(name, 'a string or Buffer', opts);
-      }
-    },
-
-    /**
-     * Assert that `encoding` is one of the accepted output/input
-     * encodings. Pass `allowBuffer: false` where a `Buffer` output makes
-     * no sense (verifying a string signature, decoding a token payload).
-     *
-     * @param {unknown} encoding
-     * @param {string}  name
-     * @param {AssertOptions & { allowBuffer?: boolean }} [opts]
-     */
-    assertEncoding(encoding, name, opts) {
-      const allowBuffer = opts?.allowBuffer !== false;
-      const valid = (typeof encoding === 'string' && ENCODINGS.has(encoding)) || (allowBuffer && encoding === 'buffer');
-      if (!valid) {
-        const list = allowBuffer ? "'hex', 'base64', 'base64url', or 'buffer'" : "'hex', 'base64', or 'base64url'";
-        fail(name, list, opts);
-      }
-    },
-  };
-}
 
 /**
- * One-line sugar over {@link bindAsserts} — the overwhelmingly common
- * pattern where a package binds every argument-shape failure to its
- * own error class + `INVALID_ARGUMENT` code. Emits the standard
- * `new ErrorClass(code, message, { cause })` shape, so the underlying
- * `BaseError` `{ cause, status, details }` options object is respected.
- *
- *   // packages/<pkg>/src/internal/guards.js
- *   import { defineGuards } from '@exortek/shared/asserts';
- *   import { PasswordError, ErrorCode } from '../errors.js';
+ * Bind every guard this package calls to ApiKeyError, so an argument-shape
+ * failure anywhere carries one class and one code to branch on.
  *
- *   export const { assertString, invalidArgument, parse } =
- *     defineGuards(PasswordError, ErrorCode.INVALID_ARGUMENT);
- *
- * Reach for the raw {@link bindAsserts} when you need a different
- * mapping (an alt code, a decorated message) — it stays available.
- *
- * @param {new (code: string, message: string, options?: { cause?: unknown }) => Error} ErrorClass
- * @param {string} code
- */
-function defineGuards(ErrorClass, code) {
-  return bindAsserts((message, extra) => new ErrorClass(code, message, extra));
-}
-
-/**
- * Argument guards bound to `ApiKeyError` — the package-wide binding of
- * `@exortek/shared/asserts`. Import guards from here, never from the
- * shared module directly.
+ * @type {import('@exortek/shared/asserts').WrapFn}
  */
+const wrap = (message, extra) => new ApiKeyError(ErrorCode.INVALID_ARGUMENT, message, extra);
 
-
-const { invalidArgument} = defineGuards(
-  ApiKeyError,
-  ErrorCode.INVALID_ARGUMENT,
-);
+const invalidArgument = makeInvalidArgument(wrap);
 
 /**
  * Scope match helpers.

package/dist/index.d.ts

@@ -1,3 +1,131 @@
+/**
+ * Parse a raw key without verifying it. Returns the segments, or
+ * `null` when the shape is wrong. Never throws.
+ *
+ * Callers can use `parseApiKey(key).prefix` to route by key family
+ * in a middleware before hitting the store — but the parse result
+ * MUST NOT be trusted as authenticated. Only `verifyApiKey` proves
+ * the holder possesses the real secret.
+ *
+ * @param {string} key
+ * @returns {{ prefix: string, id: string, secret: string } | null}
+ */
+declare function parseApiKey(key: string): {
+    prefix: string;
+    id: string;
+    secret: string;
+} | null;
+/**
+ * Log-safe display for a key. Returns `<prefix>_<first-N-of-id>…<last-M-of-secret>`
+ * so the value is recognisable in an audit log without disclosing the
+ * secret. The default masks all but the first 6 chars of the id and
+ * the last 4 chars of the secret.
+ *
+ * @param {string} key
+ * @returns {string}
+ */
+declare function mask(key: string): string;
+
+/**
+ * Shared base error class — the single error structure behind every
+ * `@exortek/*` package's `errors.js`.
+ *
+ * Every package keeps its own class identity with a one-liner subclass;
+ * codes stay per-package frozen maps, status mapping is declared as a
+ * static field:
+ *
+ *   import { BaseError } from '@exortek/shared/errors';
+ *
+ *   export const ErrorCode = Object.freeze({
+ *     INVALID_ARGUMENT: 'INVALID_ARGUMENT',
+ *     INVALID_TOKEN: 'INVALID_TOKEN',
+ *   });
+ *
+ *   export class JwtError extends BaseError {
+ *     static statuses = { INVALID_ARGUMENT: 400, INVALID_TOKEN: 401 };
+ *     static defaultStatus = 500;
+ *   }
+ *
+ * Instances carry a stable machine-readable `code` (branch on this,
+ * never on the message), an optional HTTP `status`, an optional
+ * `details` object, and the standard `cause` chain.
+ */
+declare class BaseError extends Error {
+    /**
+     * Optional `code → HTTP status` map declared on the subclass. When
+     * absent the instance carries no `status` at all — for HTTP-agnostic
+     * packages like `@exortek/crypto`.
+     *
+     * @type {Record<string, number> | undefined}
+     */
+    static statuses: Record<string, number> | undefined;
+    /**
+     * Fallback status for codes missing from `statuses`.
+     *
+     * @type {number}
+     */
+    static defaultStatus: number;
+    /**
+     * @param {string} code    Stable machine-readable code; branch on this.
+     * @param {string} message Human-readable diagnostic. Free-form; may
+     *                         change across versions.
+     * @param {{ cause?: unknown, status?: number, details?: Record<string, unknown> }} [options]
+     */
+    constructor(code: string, message: string, options?: {
+        cause?: unknown;
+        status?: number;
+        details?: Record<string, unknown>;
+    });
+    /** @type {string} */
+    code: string;
+    /** @type {number | undefined} */
+    status: number | undefined;
+    /** @type {Record<string, unknown> | undefined} */
+    details: Record<string, unknown> | undefined;
+}
+
+declare const ErrorCode: Readonly<{
+    INVALID_ARGUMENT: "INVALID_ARGUMENT";
+    INVALID_PREFIX: "INVALID_PREFIX";
+    INVALID_PEPPER: "INVALID_PEPPER";
+    STORE_ERROR: "STORE_ERROR";
+}>;
+/**
+ * Every recoverable failure raised by this package. Carries a stable
+ * `code` (from {@link ErrorCode}) and a `status` — the HTTP response
+ * status a middleware layer would use when translating the error.
+ */
+declare class ApiKeyError extends BaseError {
+    static statuses: {
+        INVALID_ARGUMENT: number;
+        INVALID_PREFIX: number;
+        INVALID_PEPPER: number;
+        STORE_ERROR: number;
+    };
+}
+
+/**
+ * Does `granted` cover a single `required` scope?
+ * @param {string[]} granted
+ * @param {string} required
+ * @returns {boolean}
+ */
+declare function covers(granted: string[], required: string): boolean;
+/**
+ * All required scopes must be covered by granted.
+ * @param {string[]} granted
+ * @param {string[]} required
+ * @returns {boolean}
+ */
+declare function hasAll(granted: string[], required: string[]): boolean;
+/**
+ * At least one required scope must be covered.
+ * @param {string[]} granted
+ * @param {string[]} required
+ * @returns {boolean}
+ */
+declare function hasAny(granted: string[], required: string[]): boolean;
+
 /**
  * @typedef {object} ApiKeyRecord
  * @property {string} id                      Plaintext lookup key (128-bit b64u).
@@ -80,7 +208,7 @@
  * @param {CreateApiKeyOptions} options
  * @returns {Promise<CreateApiKeyResult>}
  */
-export function createApiKey(options: CreateApiKeyOptions): Promise<CreateApiKeyResult>;
+declare function createApiKey(options: CreateApiKeyOptions): Promise<CreateApiKeyResult>;
 /**
  * Verify a raw API key. Returns `{ valid: true, ... }` on success, or
  * `{ valid: false, reason }` on any expected failure. Never throws on
@@ -96,7 +224,7 @@ export function createApiKey(options: CreateApiKeyOptions): Promise<CreateApiKey
  * @param {VerifyApiKeyOptions} options
  * @returns {Promise<VerifyApiKeyResult>}
  */
-export function verifyApiKey(rawKey: string, options: VerifyApiKeyOptions): Promise<VerifyApiKeyResult>;
+declare function verifyApiKey(rawKey: string, options: VerifyApiKeyOptions): Promise<VerifyApiKeyResult>;
 /**
  * Revoke an API key by id or by the raw wire key. Returns `true` if
  * a record was actually revoked, `false` if the id was unknown or
@@ -106,7 +234,7 @@ export function verifyApiKey(rawKey: string, options: VerifyApiKeyOptions): Prom
  * @param {{ store: ApiKeyStore, reason?: string }} options
  * @returns {Promise<boolean>}
  */
-export function revokeApiKey(keyOrId: string, options: {
+declare function revokeApiKey(keyOrId: string, options: {
     store: ApiKeyStore;
     reason?: string;
 }): Promise<boolean>;
@@ -119,7 +247,7 @@ export function revokeApiKey(keyOrId: string, options: {
  * @param {{ store: ApiKeyStore, reason?: string }} options
  * @returns {Promise<number>}
  */
-export function revokeAllForUser(userId: string, options: {
+declare function revokeAllForUser(userId: string, options: {
     store: ApiKeyStore;
     reason?: string;
 }): Promise<number>;
@@ -133,7 +261,7 @@ export function revokeAllForUser(userId: string, options: {
  * @param {{ store: ApiKeyStore }} options
  * @returns {Promise<ApiKeyRecord[]>}
  */
-export function listApiKeys(userId: string, options: {
+declare function listApiKeys(userId: string, options: {
     store: ApiKeyStore;
 }): Promise<ApiKeyRecord[]>;
 /**
@@ -146,12 +274,12 @@ export function listApiKeys(userId: string, options: {
  * @param {{ store: ApiKeyStore, peppers: (Buffer | Uint8Array | string)[] }} options
  * @returns {Promise<boolean>}
  */
-export function rehashApiKey(rawKey: string, options: {
+declare function rehashApiKey(rawKey: string, options: {
     store: ApiKeyStore;
     peppers: (Buffer | Uint8Array | string)[];
 }): Promise<boolean>;
-export { maskKey as maskApiKey };
-export type ApiKeyRecord = {
+
+type ApiKeyRecord = {
     /**
      * Plaintext lookup key (128-bit b64u).
      */
@@ -197,7 +325,7 @@ export type ApiKeyRecord = {
      */
     pepperVersion?: number | undefined;
 };
-export type ApiKeyStore = {
+type ApiKeyStore = {
     put: (record: ApiKeyRecord) => Promise<void>;
     getById: (id: string) => Promise<ApiKeyRecord | null>;
     update: (id: string, patch: Partial<ApiKeyRecord>) => Promise<ApiKeyRecord | null>;
@@ -205,7 +333,7 @@ export type ApiKeyStore = {
     revokeAllForUser: (userId: string, reason?: string) => Promise<number>;
     listByUser: (userId: string) => Promise<ApiKeyRecord[]>;
 };
-export type CreateApiKeyOptions = {
+type CreateApiKeyOptions = {
     /**
      * Stripe-style; `sk_live`, `pk_test`, `svc_prod_v2`.
      */
@@ -229,7 +357,7 @@ export type CreateApiKeyOptions = {
      */
     now?: number | undefined;
 };
-export type CreateApiKeyResult = {
+type CreateApiKeyResult = {
     /**
      * Wire token — show ONCE to the caller and never again.
      */
@@ -243,7 +371,7 @@ export type CreateApiKeyResult = {
      */
     record: ApiKeyRecord;
 };
-export type VerifyApiKeyOptions = {
+type VerifyApiKeyOptions = {
     store: ApiKeyStore;
     peppers?: any[] | undefined;
     requiredScopes?: string[] | undefined;
@@ -257,8 +385,8 @@ export type VerifyApiKeyOptions = {
     updateLastUsed?: boolean | undefined;
     now?: number | undefined;
 };
-export type VerifyApiKeyFailureReason = "malformed" | "not_found" | "expired" | "revoked" | "bad_secret" | "prefix_mismatch" | "missing_scope" | "store_unavailable";
-export type VerifyApiKeyResult = {
+type VerifyApiKeyFailureReason = "malformed" | "not_found" | "expired" | "revoked" | "bad_secret" | "prefix_mismatch" | "missing_scope" | "store_unavailable";
+type VerifyApiKeyResult = {
     valid: true;
     id: string;
     userId: string;
@@ -272,7 +400,6 @@ export type VerifyApiKeyResult = {
     valid: false;
     reason: VerifyApiKeyFailureReason;
 };
-import { mask as maskKey } from './token.js';
-export { ApiKeyError, ErrorCode } from "./errors.js";
-export { covers, hasAll, hasAny } from "./scopes.js";
-export { parseApiKey, mask } from "./token.js";
+
+export { ApiKeyError, ErrorCode, covers, createApiKey, hasAll, hasAny, listApiKeys, mask, mask as maskApiKey, parseApiKey, rehashApiKey, revokeAllForUser, revokeApiKey, verifyApiKey };
+export type { ApiKeyRecord, ApiKeyStore, CreateApiKeyOptions, CreateApiKeyResult, VerifyApiKeyFailureReason, VerifyApiKeyOptions, VerifyApiKeyResult };