@karmaniverous/jeeves-server-core 0.1.0 → 0.1.2

package/dist/src/crypto.d.ts

@@ -34,4 +34,3 @@ export declare function computeDeepShareKey(seed: string, urlPath: string, param
  * Timing-safe string comparison
  */
 export declare function timingSafeEqual(a: string, b: string): boolean;
-//# sourceMappingURL=crypto.d.ts.map

package/dist/src/crypto.js

@@ -1,13 +1,14 @@
+import crypto from 'node:crypto';
+
 /**
  * Cryptographic utilities for HMAC key computation and verification.
  *
  * @packageDocumentation
  */
-import crypto from 'node:crypto';
 /**
  * Compute path-specific key: HMAC-SHA256(apiKey, normalizedPath)
  */
-export function computePathKey(apiKey, urlPath) {
+function computePathKey(apiKey, urlPath) {
     const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
     const hash = crypto
         .createHmac('sha256', apiKey)
@@ -19,7 +20,7 @@ export function computePathKey(apiKey, urlPath) {
  * Compute insider key: HMAC-SHA256(apiKey, "insider")
  * Works for any path, grants full navigation
  */
-export function computeInsiderKey(apiKey) {
+function computeInsiderKey(apiKey) {
     const hash = crypto
         .createHmac('sha256', apiKey)
         .update('insider')
@@ -29,7 +30,7 @@ export function computeInsiderKey(apiKey) {
 /**
  * Compute outsider key with expiry: HMAC-SHA256(apiKey, path + "|" + expiry)
  */
-export function computeOutsiderKeyWithExpiry(apiKey, urlPath, expiry) {
+function computeOutsiderKeyWithExpiry(apiKey, urlPath, expiry) {
     const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
     const data = `${normalized}|${String(expiry)}`;
     const hash = crypto.createHmac('sha256', apiKey).update(data).digest('hex');
@@ -39,7 +40,7 @@ export function computeOutsiderKeyWithExpiry(apiKey, urlPath, expiry) {
  * Compute deep share key: HMAC-SHA256(seed, path + "|" + d + "|" + dirs + "|" + stack + "|" + exp)
  * Used for share links with depth \> 0 or dirs enabled.
  */
-export function computeDeepShareKey(seed, urlPath, params) {
+function computeDeepShareKey(seed, urlPath, params) {
     const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
     const data = `${normalized}|${String(params.depth)}|${params.dirs ? '1' : '0'}|${params.stack}|${params.exp ?? ''}`;
     const hash = crypto.createHmac('sha256', seed).update(data).digest('hex');
@@ -48,7 +49,7 @@ export function computeDeepShareKey(seed, urlPath, params) {
 /**
  * Timing-safe string comparison
  */
-export function timingSafeEqual(a, b) {
+function timingSafeEqual(a, b) {
     try {
         return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
     }
@@ -56,3 +57,5 @@ export function timingSafeEqual(a, b) {
         return false;
     }
 }
+
+export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, timingSafeEqual };

package/dist/src/index.d.ts

@@ -4,5 +4,5 @@
  * @packageDocumentation
  */
 export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, type DeepShareParams, timingSafeEqual, } from './crypto.js';
+export { type AuthMode, authModeSchema, authSchema, DEPRECATED_CONFIG_PROPS, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, type JeevesConfig, jeevesConfigSchema, keyEntrySchema, oauthProviderSchema, oauthSchema, scopesObjectSchema, scopesSchema, } from './schema.js';
 export type { AuthStatusResponse, DriveEntry, ExportCacheClearResponse, ExportLink, FileMutationAction, LinkInfoResponse, OAuthStartRequest, OAuthStartResponse, RotateKeyResponse, ShareForRequest, ShareForResponse, ShareRequest, ShareResponse, } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/src/index.js

@@ -1,6 +1,2 @@
-/**
- * Shared utilities and types for jeeves-server packages.
- *
- * @packageDocumentation
- */
-export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, timingSafeEqual, } from './crypto.js';
+export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, timingSafeEqual } from './crypto.js';
+export { DEPRECATED_CONFIG_PROPS, authModeSchema, authSchema, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, jeevesConfigSchema, keyEntrySchema, oauthProviderSchema, oauthSchema, scopesObjectSchema, scopesSchema } from './schema.js';

package/dist/src/schema.d.ts

@@ -0,0 +1,168 @@
+import { z } from 'zod';
+/** Config properties deprecated in v3.6.0 (now resolved via core services). */
+export declare const DEPRECATED_CONFIG_PROPS: readonly ["host", "runnerUrl", "watcherUrl", "metaUrl"];
+/** Supported authentication methods */
+export declare const authModeSchema: z.ZodEnum<{
+    google: "google";
+    keys: "keys";
+}>;
+/** Google OAuth configuration */
+export declare const googleAuthSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+}, z.core.$strip>;
+/** Auth configuration */
+export declare const authSchema: z.ZodObject<{
+    modes: z.ZodArray<z.ZodEnum<{
+        google: "google";
+        keys: "keys";
+    }>>;
+    google: z.ZodOptional<z.ZodObject<{
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+    }, z.core.$strip>>;
+    sessionSecret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Event webhook configuration */
+export declare const eventConfigSchema: z.ZodObject<{
+    schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    cmd: z.ZodString;
+    map: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * Scopes configuration — controls which paths a user/key can access.
+ *
+ * Three forms:
+ * - `string` — single allow pattern (e.g. '/d/*')
+ * - `string[]` — array of allow patterns (shorthand for \{ allow: [...] \})
+ * - `\{ allow?: string[], deny?: string[] \}` — explicit allow/deny rules
+ *
+ * Semantics:
+ * - Path must match at least one allow rule AND NOT match any deny rule
+ * - Omitting `allow` = implicit ['/*'] (allow everything)
+ * - Omitting `deny` = no exclusions
+ * - Omitting scopes entirely = unrestricted access
+ */
+export declare const scopesObjectSchema: z.ZodObject<{
+    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const scopesSchema: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>]>;
+/** Insider entry (identity + scopes + optional persisted seed) */
+export declare const insiderEntrySchema: z.ZodObject<{
+    scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>]>>;
+    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    seed: z.ZodOptional<z.ZodString>;
+    keyCreatedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Key entry — plain string (seed, no scopes) or object with key + optional scopes */
+export declare const keyEntrySchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+    key: z.ZodString;
+    scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>]>>;
+    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>]>;
+/** Check if a string is a named scope identifier (not a path glob). */
+export declare function isScopeName(v: string): boolean;
+/** OAuth provider configuration */
+export declare const oauthProviderSchema: z.ZodObject<{
+    authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+    tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+    pkce: z.ZodDefault<z.ZodBoolean>;
+    defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** OAuth configuration */
+export declare const oauthSchema: z.ZodObject<{
+    credentialDir: z.ZodString;
+    providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+        tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/** Top-level Jeeves Server configuration */
+export declare const jeevesConfigSchema: z.ZodObject<{
+    port: z.ZodDefault<z.ZodNumber>;
+    chromePath: z.ZodString;
+    auth: z.ZodObject<{
+        modes: z.ZodArray<z.ZodEnum<{
+            google: "google";
+            keys: "keys";
+        }>>;
+        google: z.ZodOptional<z.ZodObject<{
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+        }, z.core.$strip>>;
+        sessionSecret: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    scopes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    insiders: z.ZodDefault<z.ZodRecord<z.ZodEmail, z.ZodObject<{
+        scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+            allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>]>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        seed: z.ZodOptional<z.ZodString>;
+        keyCreatedAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    keys: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        key: z.ZodString;
+        scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+            allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>]>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>]>>>;
+    events: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        cmd: z.ZodString;
+        map: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+    eventTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    eventLogPurgeMs: z.ZodDefault<z.ZodNumber>;
+    maxZipSizeMb: z.ZodDefault<z.ZodNumber>;
+    roots: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    mermaidCliPath: z.ZodOptional<z.ZodString>;
+    plantuml: z.ZodOptional<z.ZodObject<{
+        jarPath: z.ZodOptional<z.ZodString>;
+        javaPath: z.ZodOptional<z.ZodString>;
+        servers: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+    }, z.core.$strip>>;
+    diagramCachePath: z.ZodOptional<z.ZodString>;
+    outsiderPolicy: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>]>>;
+    oauth: z.ZodOptional<z.ZodObject<{
+        credentialDir: z.ZodString;
+        providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+            authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+            tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+            pkce: z.ZodDefault<z.ZodBoolean>;
+            defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    go: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+/** Inferred config type */
+export type JeevesConfig = z.infer<typeof jeevesConfigSchema>;
+/** Auth mode type */
+export type AuthMode = z.infer<typeof authModeSchema>;

package/dist/src/schema.js

@@ -0,0 +1,252 @@
+import { SERVER_PORT } from '@karmaniverous/jeeves';
+import { z } from 'zod';
+
+/** Config properties deprecated in v3.6.0 (now resolved via core services). */
+const DEPRECATED_CONFIG_PROPS = [
+    'host',
+    'runnerUrl',
+    'watcherUrl',
+    'metaUrl',
+];
+/** Supported authentication methods */
+const authModeSchema = z.enum(['google', 'keys']);
+/** Google OAuth configuration */
+const googleAuthSchema = z.object({
+    clientId: z.string().min(1),
+    clientSecret: z.string().min(1),
+});
+/** Auth configuration */
+const authSchema = z.object({
+    /** Active authentication methods. Order determines priority. */
+    modes: z
+        .array(authModeSchema)
+        .min(1, { message: 'At least one auth mode is required' }),
+    /** Google OAuth config. Required if modes includes "google". */
+    google: googleAuthSchema.optional(),
+    /** Session cookie signing secret. Required if modes includes "google". */
+    sessionSecret: z.string().min(1).optional(),
+});
+/** Event webhook configuration */
+const eventConfigSchema = z.object({
+    schema: z.record(z.string(), z.unknown()),
+    cmd: z.string(),
+    map: z.record(z.string(), z.unknown()).optional(),
+    timeoutMs: z.number().positive().optional(),
+});
+/**
+ * Scopes configuration — controls which paths a user/key can access.
+ *
+ * Three forms:
+ * - `string` — single allow pattern (e.g. '/d/*')
+ * - `string[]` — array of allow patterns (shorthand for \{ allow: [...] \})
+ * - `\{ allow?: string[], deny?: string[] \}` — explicit allow/deny rules
+ *
+ * Semantics:
+ * - Path must match at least one allow rule AND NOT match any deny rule
+ * - Omitting `allow` = implicit ['/*'] (allow everything)
+ * - Omitting `deny` = no exclusions
+ * - Omitting scopes entirely = unrestricted access
+ */
+const scopesObjectSchema = z.object({
+    allow: z.array(z.string()).optional(),
+    deny: z.array(z.string()).optional(),
+});
+const scopesSchema = z.union([
+    z.string(),
+    z.array(z.string()),
+    scopesObjectSchema,
+]);
+/** Insider entry (identity + scopes + optional persisted seed) */
+const insiderEntrySchema = z.object({
+    scopes: scopesSchema.optional(),
+    /** Extra allow patterns merged on top of named scope references */
+    allow: z.array(z.string()).optional(),
+    /** Extra deny patterns merged on top of named scope references */
+    deny: z.array(z.string()).optional(),
+    /** Auto-generated insider seed, persisted in config.json */
+    seed: z.string().min(1).optional(),
+    /** ISO timestamp of when the seed was created */
+    keyCreatedAt: z.string().optional(),
+});
+/** Key entry — plain string (seed, no scopes) or object with key + optional scopes */
+const keyEntrySchema = z.union([
+    z.string().min(1),
+    z.object({
+        key: z.string().min(1),
+        scopes: scopesSchema.optional(),
+        /** Extra allow patterns merged on top of named scope references */
+        allow: z.array(z.string()).optional(),
+        /** Extra deny patterns merged on top of named scope references */
+        deny: z.array(z.string()).optional(),
+    }),
+]);
+/** Check if a string is a named scope identifier (not a path glob). */
+function isScopeName(v) {
+    return /^[A-Za-z0-9_-]+$/.test(v);
+}
+/** Helper: collect named scope references from a scopes field value.
+ *
+ * Backward-compat note: `scopes` has historically accepted path globs like "/**" or ["/a","/b"].
+ * We only treat values as *named scope references* if they look like identifiers
+ * (e.g. "restricted", "no-vc") rather than path globs.
+ */
+function getScopeRefs(scopes) {
+    if (typeof scopes === 'string')
+        return isScopeName(scopes) ? [scopes] : [];
+    if (Array.isArray(scopes) && scopes.length > 0) {
+        const strs = scopes.filter((v) => typeof v === 'string');
+        if (strs.length !== scopes.length)
+            return [];
+        return strs.filter((v) => isScopeName(v));
+    }
+    return [];
+}
+/** OAuth provider configuration */
+const oauthProviderSchema = z.object({
+    authUrl: z.string().pipe(z.url()),
+    tokenUrl: z.string().pipe(z.url()),
+    pkce: z.boolean().default(false),
+    defaultScopes: z.array(z.string()).default([]),
+});
+/** OAuth configuration */
+const oauthSchema = z.object({
+    credentialDir: z.string(),
+    providers: z.record(z.string(), oauthProviderSchema).default({}),
+});
+/** Top-level Jeeves Server configuration */
+const jeevesConfigSchema = z
+    .object({
+    port: z.number().int().positive().default(SERVER_PORT),
+    chromePath: z.string().min(1),
+    auth: authSchema,
+    /** Named scope definitions, referenced by insiders/keys/outsiderPolicy */
+    scopes: z.record(z.string(), scopesObjectSchema).default({}),
+    insiders: z.record(z.email(), insiderEntrySchema).default({}),
+    keys: z.record(z.string(), keyEntrySchema).default({}),
+    events: z.record(z.string(), eventConfigSchema).default({}),
+    eventTimeoutMs: z.number().positive().default(30_000),
+    eventLogPurgeMs: z.number().positive().default(2_592_000_000),
+    /** Maximum directory size in MB for ZIP export. Directories exceeding this are refused. */
+    maxZipSizeMb: z.number().positive().default(100),
+    /**
+     * Filesystem roots for the file browser (Linux only).
+     * Map of id → filesystem path. On Windows this is ignored (drives are auto-discovered).
+     * Example: \{ home: '/home/user', projects: '/opt/projects' \}
+     * Default: \{ root: '/' \}
+     */
+    roots: z.record(z.string(), z.string()).optional(),
+    /** @deprecated Mermaid is now bundled. This field is ignored but kept for backward compatibility. */
+    mermaidCliPath: z.string().optional(),
+    /**
+     * PlantUML rendering configuration.
+     * - jarPath: local PlantUML jar (requires Java). Tried first — supports !include.
+     * - servers: fallback PlantUML server URLs, tried in order.
+     *   The public community server (https://www.plantuml.com/plantuml) is always
+     *   appended as the last resort unless explicitly listed.
+     * If omitted entirely, only the community server is used.
+     */
+    plantuml: z
+        .object({
+        jarPath: z.string().optional(),
+        javaPath: z.string().optional(),
+        servers: z.array(z.url()).optional(),
+    })
+        .optional(),
+    /**
+     * Directory for cached rendered diagrams (content-addressed by source hash).
+     * Defaults to `.diagram-cache` in the server working directory.
+     */
+    diagramCachePath: z.string().optional(),
+    /**
+     * Global outsider policy — constrains which paths are eligible for outsider sharing.
+     * Uses the same allow/deny model as insider scopes.
+     * If omitted, all paths are shareable with outsiders.
+     */
+    outsiderPolicy: scopesSchema.optional(),
+    /** OAuth2 credential management configuration */
+    oauth: oauthSchema.optional(),
+    /**
+     * Shortlink redirects. Keys are slug identifiers (`[a-zA-Z0-9_-]+`),
+     * values are redirect targets — either relative paths (e.g. `/browse/...`)
+     * or absolute URLs (e.g. `https://example.com`).
+     *
+     * Accessible at `GET /go/:slug` without authentication.
+     */
+    go: z
+        .record(z.string().regex(/^[a-zA-Z0-9_-]+$/), z
+        .string()
+        .min(1)
+        .refine((v) => v.startsWith('/') || /^[a-z]+:\/\//i.test(v), {
+        message: 'Target must be a relative path starting with / or an absolute URL',
+    }))
+        .default({}),
+})
+    .superRefine((config, ctx) => {
+    // Google auth mode requires google config + sessionSecret
+    if (config.auth.modes.includes('google')) {
+        if (!config.auth.google) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'auth.google is required when auth.modes includes "google"',
+                path: ['auth', 'google'],
+            });
+        }
+        if (!config.auth.sessionSecret) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'auth.sessionSecret is required when auth.modes includes "google"',
+                path: ['auth', 'sessionSecret'],
+            });
+        }
+    }
+    // Keys auth mode requires at least one key
+    if (config.auth.modes.includes('keys') &&
+        Object.keys(config.keys).length === 0) {
+        ctx.addIssue({
+            code: 'custom',
+            message: 'At least one key is required when auth.modes includes "keys"',
+            path: ['keys'],
+        });
+    }
+    // _internal and _plugin keys must not have scopes
+    for (const reserved of ['_internal', '_plugin']) {
+        const key = config.keys[reserved];
+        if (key && typeof key === 'object' && 'scopes' in key && key.scopes) {
+            ctx.addIssue({
+                code: 'custom',
+                message: `${reserved} key must not have scopes (it is always unscoped)`,
+                path: ['keys', reserved],
+            });
+        }
+    }
+    // Validate all scope name references resolve to the top-level scopes map
+    const scopeNames = new Set(Object.keys(config.scopes));
+    const validateRefs = (refs, refPath) => {
+        for (const ref of refs) {
+            if (!scopeNames.has(ref)) {
+                ctx.addIssue({
+                    code: 'custom',
+                    message: `Scope "${ref}" is not defined in the top-level scopes map`,
+                    path: refPath,
+                });
+            }
+        }
+    };
+    for (const [email, entry] of Object.entries(config.insiders)) {
+        const refs = getScopeRefs(entry.scopes);
+        if (refs.length > 0)
+            validateRefs(refs, ['insiders', email, 'scopes']);
+    }
+    for (const [name, entry] of Object.entries(config.keys)) {
+        if (typeof entry === 'object') {
+            const refs = getScopeRefs(entry.scopes);
+            if (refs.length > 0)
+                validateRefs(refs, ['keys', name, 'scopes']);
+        }
+    }
+    const outsiderRefs = getScopeRefs(config.outsiderPolicy);
+    if (outsiderRefs.length > 0)
+        validateRefs(outsiderRefs, ['outsiderPolicy']);
+});
+
+export { DEPRECATED_CONFIG_PROPS, authModeSchema, authSchema, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, jeevesConfigSchema, keyEntrySchema, oauthProviderSchema, oauthSchema, scopesObjectSchema, scopesSchema };

package/dist/src/types.d.ts

@@ -88,4 +88,3 @@ export interface DriveEntry {
     letter: string;
     label: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,19 +1,32 @@
 {
   "name": "@karmaniverous/jeeves-server-core",
-  "version": "0.1.0",
+  "version": "0.1.2",
+  "author": "Jeeves",
+  "description": "Shared cryptographic utilities and API types for jeeves-server packages.",
+  "license": "MIT",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/karmaniverous/jeeves-server.git",
+    "directory": "packages/core"
+  },
+  "files": [
+    "dist"
+  ],
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
     "prebuild": "npx rimraf dist",
-    "build": "tsc",
+    "build": "cross-env NO_COLOR=1 rollup --config rollup.config.ts --configPlugin @rollup/plugin-typescript",
     "lint": "eslint .",
     "lint:fix": "eslint --fix .",
     "test": "vitest run --passWithNoTests",
     "typecheck": "tsc --noEmit",
+    "changelog": "git-cliff -o CHANGELOG.md",
     "release": "dotenvx run -f .env.local -- release-it",
-    "release:pre": "dotenvx run -f .env.local -- release-it --no-git.requireBranch --github.prerelease --preRelease"
+    "release:pre": "dotenvx run -f .env.local -- release-it --no-git.requireBranch --github.prerelease --preRelease",
+    "postbuild": "npx rimraf dist/rollup.config.d.ts dist/rollup.config.d.ts.map"
   },
   "exports": {
     ".": {
@@ -24,18 +37,28 @@
     }
   },
   "types": "dist/src/index.d.ts",
+  "dependencies": {
+    "@karmaniverous/jeeves": "^0.5.10",
+    "zod": "^4.4.3"
+  },
   "devDependencies": {
-    "vitest": "^4.1.2",
+    "@dotenvx/dotenvx": "^1.65.0",
+    "@rollup/plugin-commonjs": "^29.0.2",
+    "@rollup/plugin-json": "^6.1.0",
+    "@rollup/plugin-node-resolve": "^16.0.3",
+    "@rollup/plugin-typescript": "^12.3.0",
+    "cross-env": "^10.1.0",
     "release-it": "^19.2.4",
-    "auto-changelog": "^2.5.0",
-    "@dotenvx/dotenvx": "^1.59.1"
+    "rollup": "^4.60.3",
+    "tslib": "^2.8.1",
+    "vitest": "^4.1.6"
   },
   "engines": {
     "node": ">=22"
   },
   "release-it": {
     "git": {
-      "changelog": "npx auto-changelog --unreleased-only --stdout --template https://raw.githubusercontent.com/release-it/release-it/main/templates/changelog-compact.hbs",
+      "changelog": "npx git-cliff --unreleased --strip header",
       "commitMessage": "chore: release @karmaniverous/jeeves-server-core v${version}",
       "tagName": "core/${version}",
       "requireBranch": "main"
@@ -51,7 +74,7 @@
         "npm run build"
       ],
       "before:npm:release": [
-        "npx auto-changelog -p",
+        "npx git-cliff -o CHANGELOG.md",
         "git add -A"
       ],
       "after:release": [

package/.env.local

@@ -1,13 +0,0 @@
-# This file is a template for the .env.local. Add your Personal Access Token 
-# below to streamline the release process from your desktop! Just follow these 
-# steps: 
-# 
-# 1. Make a copy of this file and rename it to .env.local.
-#
-# 2. Create a Personal Access Token at https://github.com/settings/tokens and 
-#    enter it below.
-#
-# .env.local is gitignored and will NOT be persisted to your repo, but don't 
-# put any secrets in this template!
-
-GITHUB_TOKEN=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

package/.env.local.template

@@ -1,13 +0,0 @@
-# This file is a template for the .env.local. Add your Personal Access Token 
-# below to streamline the release process from your desktop! Just follow these 
-# steps: 
-# 
-# 1. Make a copy of this file and rename it to .env.local.
-#
-# 2. Create a Personal Access Token at https://github.com/settings/tokens and 
-#    enter it below.
-#
-# .env.local is gitignored and will NOT be persisted to your repo, but don't 
-# put any secrets in this template!
-
-GITHUB_TOKEN=

package/CHANGELOG.md

@@ -1,354 +0,0 @@
-### Changelog
-
-All notable changes to this project will be documented in this file. Dates are displayed in UTC.
-
-Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
-
-#### [v0.1.0](https://github.com/karmaniverous/jeeves-server/compare/v2.9.3...v0.1.0)
-
-- fix: rename shared to core, add release-it, upgrade client eslint [`#197`](https://github.com/karmaniverous/jeeves-server/pull/197)
-- fix: upgrade client eslint to v10, fix lint errors from stricter rules [`#196`](https://github.com/karmaniverous/jeeves-server/pull/196)
-- feat: create shared package, add missing plugin tools, DRY types (#194) [`#195`](https://github.com/karmaniverous/jeeves-server/pull/195)
-- feat: create shared package, add missing plugin tools, DRY types [`#194`](https://github.com/karmaniverous/jeeves-server/pull/194)
-- fix: remove state.json and dead keyRotatedAt code (#192) [`#193`](https://github.com/karmaniverous/jeeves-server/pull/193)
-- fix: remove state.json and dead keyRotatedAt code [`#192`](https://github.com/karmaniverous/jeeves-server/pull/192)
-- fix: resolve state.json from state root instead of package directory (#185) [`#186`](https://github.com/karmaniverous/jeeves-server/pull/186)
-- feat: add copy button to table cell hover controls (#188) [`#189`](https://github.com/karmaniverous/jeeves-server/pull/189)
-- fix: add /api prefix to OAuth API routes (#190) [`#191`](https://github.com/karmaniverous/jeeves-server/pull/191)
-- fix: add /api prefix to OAuth API routes [`#190`](https://github.com/karmaniverous/jeeves-server/pull/190)
-- feat: add copy button to table cell hover controls [`#188`](https://github.com/karmaniverous/jeeves-server/pull/188)
-- fix: store insider seeds in config.json instead of state.json (#185) [`#187`](https://github.com/karmaniverous/jeeves-server/pull/187)
-- fix: store insider seeds in config.json instead of state.json [`#185`](https://github.com/karmaniverous/jeeves-server/pull/185)
-- fix: resolve state.json from state root instead of package directory [`#185`](https://github.com/karmaniverous/jeeves-server/pull/185)
-- fix: authenticate embedded images for all outsider shares (#183) [`#184`](https://github.com/karmaniverous/jeeves-server/pull/184)
-- feat: /go/:slug shortlink redirects (#180) [`#182`](https://github.com/karmaniverous/jeeves-server/pull/182)
-- fix: resolve serverRoot via package.json discovery (#178) [`#179`](https://github.com/karmaniverous/jeeves-server/pull/179)
-- fix: edit popup scrollbar and word wrap [`#173`](https://github.com/karmaniverous/jeeves-server/pull/173)
-- fix: dev server white screen — serve built client under tsx [`#171`](https://github.com/karmaniverous/jeeves-server/pull/171)
-- fix: constrain edit popup height to prevent overflow [`#169`](https://github.com/karmaniverous/jeeves-server/pull/169)
-- feat: markdown-it migration, inline block editing, OAuth2 flow (#162, #163) [`#165`](https://github.com/karmaniverous/jeeves-server/pull/165)
-- fix: make clear-cache visible to outsiders in download menu [`#161`](https://github.com/karmaniverous/jeeves-server/pull/161)
-- refactor: simplify checkbox toggle to fire-and-forget [`#160`](https://github.com/karmaniverous/jeeves-server/pull/160)
-- fix: checkbox indexing for loose list items [`#159`](https://github.com/karmaniverous/jeeves-server/pull/159)
-- fix: post-merge checkbox toggle, Gemini review, CI wildcard [`#158`](https://github.com/karmaniverous/jeeves-server/pull/158)
-- feat: v3.7.0 / v0.8.0 — shareable URLs, insider checkbox toggles, events route fix [`#157`](https://github.com/karmaniverous/jeeves-server/pull/157)
-- [V3-7] feat: wire MarkdownView checkbox toggling [`#154`](https://github.com/karmaniverous/jeeves-server/pull/154)
-- [V3-7] feat: add POST /api/file/*/toggle-checkbox endpoint [`#154`](https://github.com/karmaniverous/jeeves-server/pull/154)
-- [V3-7] feat: add checkbox indexing and mtime to markdown pipeline [`#154`](https://github.com/karmaniverous/jeeves-server/pull/154)
-- [V3-7] feat: update TOOLS guidance to note automatic URL rewriting [`#152`](https://github.com/karmaniverous/jeeves-server/pull/152)
-- [V3-7] feat: add publicUrl config for shareable URL rewriting [`#145`](https://github.com/karmaniverous/jeeves-server/pull/145)
-- [V3-7] fix: correct /events route path to /api/events [`#156`](https://github.com/karmaniverous/jeeves-server/pull/156)
-- fix: consume core importMetaUrl for plugin install (#150, #147) [`#151`](https://github.com/karmaniverous/jeeves-server/pull/151)
-- [150] fix: consume core importMetaUrl for plugin install [`#150`](https://github.com/karmaniverous/jeeves-server/pull/150)
-- chore: dependency updates — jeeves ^0.5.3, jsonmap ^2.1.1, @types/node ^25.5.2, and minor/patch bumps [`#149`](https://github.com/karmaniverous/jeeves-server/pull/149)
-- feat: v3.6.0 core v0.5.1 adoption + core service alignment + UX improvements [`#146`](https://github.com/karmaniverous/jeeves-server/pull/146)
-- [53] Fix pre-existing lint + knip errors (Commander type resolution) [`#140`](https://github.com/karmaniverous/jeeves-server/pull/140)
-- [53] Integrate core v0.4.6: init() before descriptor.run() + knip fixes [`#139`](https://github.com/karmaniverous/jeeves-server/pull/139)
-- [51] Integrate descriptor.run from core v0.4.5 [`#137`](https://github.com/karmaniverous/jeeves-server/pull/137)
-- Fix config validate test assertion [`#136`](https://github.com/karmaniverous/jeeves-server/pull/136)
-- [35] Component SDK adoption (core v0.4.4) + plugin/CLI factories [`#134`](https://github.com/karmaniverous/jeeves-server/pull/134)
-- [35] refactor: replace hand-rolled package.json walk with packageDirectorySync [`#96`](https://github.com/karmaniverous/jeeves-server/pull/96)
-- [35] fix: show user-friendly search error messages [`#98`](https://github.com/karmaniverous/jeeves-server/pull/98)
-- [35] fix: decode HTML entities in TOC heading text [`#102`](https://github.com/karmaniverous/jeeves-server/pull/102)
-- Remove /health proxy, rename /stats to /status, align client types [`#122`](https://github.com/karmaniverous/jeeves-server/pull/122)
-- Fix runner proxy routes calling wrong endpoints [`#121`](https://github.com/karmaniverous/jeeves-server/pull/121)
-- Bump core to v0.3.0 and consolidate status endpoint [`#119`](https://github.com/karmaniverous/jeeves-server/pull/119)
-- Add configurable host bind + metaUrl service probe [`#114`](https://github.com/karmaniverous/jeeves-server/pull/114)
-- feat: core v0.2.0 SDK adoption [`#111`](https://github.com/karmaniverous/jeeves-server/pull/111)
-- feat(openclaw): adopt jeeves core component writer [`#105`](https://github.com/karmaniverous/jeeves-server/pull/105)
-- docs: document scope override precedence in OpenClaw skill [`#95`](https://github.com/karmaniverous/jeeves-server/pull/95)
-- feat: explicit scope overrides take precedence over named scopes [`#94`](https://github.com/karmaniverous/jeeves-server/pull/94)
-- fix: parse inline tokens in heading renderer [`#93`](https://github.com/karmaniverous/jeeves-server/pull/93)
-- fix: prevent full data reload on tab switch [`#91`](https://github.com/karmaniverous/jeeves-server/pull/91)
-- fix: Rendered tab persists when switching to Raw on watcher-rendered files [`#90`](https://github.com/karmaniverous/jeeves-server/pull/90)
-- feat: extend /api/status with ?events=N for recent event log [`#89`](https://github.com/karmaniverous/jeeves-server/pull/89)
-- fix: server_share sends POST with JSON body instead of GET [`#87`](https://github.com/karmaniverous/jeeves-server/pull/87)
-- docs: guide index content + typedoc jsonl highlight [`#86`](https://github.com/karmaniverous/jeeves-server/pull/86)
-- docs: refresh README + guides for v3 [`#85`](https://github.com/karmaniverous/jeeves-server/pull/85)
-- feat: named access scopes [`#84`](https://github.com/karmaniverous/jeeves-server/pull/84)
-- fix: plugin auth chain, status endpoint improvements [`#83`](https://github.com/karmaniverous/jeeves-server/pull/83)
-- fix: resetConfig should reload, not clear [`#82`](https://github.com/karmaniverous/jeeves-server/pull/82)
-- chore: integrate client as npm workspace member [`#81`](https://github.com/karmaniverous/jeeves-server/pull/81)
-- fix: force white background in panzoom fullscreen (dark mode) [`#80`](https://github.com/karmaniverous/jeeves-server/pull/80)
-- chore: make both packages releasable [`#79`](https://github.com/karmaniverous/jeeves-server/pull/79)
-- fix: address Gemini code review feedback (PRs #65-#76) [`#78`](https://github.com/karmaniverous/jeeves-server/pull/78)
-- chore: fix all gap analysis findings (10 items) [`#77`](https://github.com/karmaniverous/jeeves-server/pull/77)
-- Phase 4, Steps 16-18: Document rendering pipeline [`#76`](https://github.com/karmaniverous/jeeves-server/pull/76)
-- Phase 3, Steps 11-15: OpenClaw plugin [`#75`](https://github.com/karmaniverous/jeeves-server/pull/75)
-- Phase 2, Steps 9-10: Search facets proxy + filter UI [`#74`](https://github.com/karmaniverous/jeeves-server/pull/74)
-- Phase 2, Step 8: Scroll anchoring [`#73`](https://github.com/karmaniverous/jeeves-server/pull/73)
-- chore: SOLID/DRY/coverage audit pass 2 [`#72`](https://github.com/karmaniverous/jeeves-server/pull/72)
-- Phase 2, Step 7: Link availability endpoint [`#71`](https://github.com/karmaniverous/jeeves-server/pull/71)
-- Phase 1, Step 6: Port migration [`#70`](https://github.com/karmaniverous/jeeves-server/pull/70)
-- Phase 1, Step 5: Diagram dependency internalization [`#69`](https://github.com/karmaniverous/jeeves-server/pull/69)
-- Phase 1, Step 4: Server Status API [`#68`](https://github.com/karmaniverous/jeeves-server/pull/68)
-- Phase 1, Step 3: CLI commands [`#67`](https://github.com/karmaniverous/jeeves-server/pull/67)
-- Phase 1, Step 2: Config migration (jiti → cosmiconfig) [`#66`](https://github.com/karmaniverous/jeeves-server/pull/66)
-- Phase 1: Monorepo & Config (v3.0.0) [`#65`](https://github.com/karmaniverous/jeeves-server/pull/65)
-- feat: align search browse filter with watcher domains convention [`#64`](https://github.com/karmaniverous/jeeves-server/pull/64)
-- fix: exit edit mode after save [`#63`](https://github.com/karmaniverous/jeeves-server/pull/63)
-- chore: add default port 1934 [`#62`](https://github.com/karmaniverous/jeeves-server/pull/62)
-- chore: add default port 1934 [`#61`](https://github.com/karmaniverous/jeeves-server/pull/61)
-- [150] fix: consume core importMetaUrl for plugin install (#150) [`#150`](https://github.com/karmaniverous/jeeves-server/issues/150) [`#147`](https://github.com/karmaniverous/jeeves-server/issues/147)
-- [360] feat: Phase 3 — UX improvements (CSV tables, directory item counts, collapsible frontmatter, collapsible TOC) [`#48`](https://github.com/karmaniverous/jeeves-server/issues/48)
-- [360] feat: Phase 1 — core service adoption (getServiceUrl, getBindAddress, Node 22 fast-fail) [`#135`](https://github.com/karmaniverous/jeeves-server/issues/135)
-- [35] refactor: remove Connected Services from TOOLS.md writer (closes #128) [`#128`](https://github.com/karmaniverous/jeeves-server/issues/128)
-- fix: parse inline tokens in heading renderer (code spans, bold, italic) [`#92`](https://github.com/karmaniverous/jeeves-server/issues/92)
-- [35] chore: update deps (peer-safe) [`c87c3a1`](https://github.com/karmaniverous/jeeves-server/commit/c87c3a1d10a15654ceac04c493d90abd65fe05d6)
-- chore: add docs workflow, gitignore generated docs [`10bffb8`](https://github.com/karmaniverous/jeeves-server/commit/10bffb8b6ce9c45c31e88b07e26c4657cfba0776)
-- fix: regenerate lockfile with npm 11.11.0 for Linux CI compatibility [`05c0014`](https://github.com/karmaniverous/jeeves-server/commit/05c00141c9d1df2f2763e535dfca315a3ac29ea8)
-
-#### [v2.9.3](https://github.com/karmaniverous/jeeves-server/compare/v2.9.2...v2.9.3)
-
-> 26 February 2026
-
-- feat: render YAML frontmatter as code block [`#60`](https://github.com/karmaniverous/jeeves-server/pull/60)
-- feat: render YAML frontmatter as code block in markdown view [`3045a94`](https://github.com/karmaniverous/jeeves-server/commit/3045a94a2364455cdeac6f36f3446fc561d37737)
-- chore: release v2.9.3 [`1475596`](https://github.com/karmaniverous/jeeves-server/commit/1475596bcb2dd22f2c5f1621b670fc50898a11d7)
-
-#### [v2.9.2](https://github.com/karmaniverous/jeeves-server/compare/v2.9.1...v2.9.2)
-
-> 24 February 2026
-
-- feat: sortable columns on runner dashboard [`023a473`](https://github.com/karmaniverous/jeeves-server/commit/023a473b53b1469b52eccda5dff76f4da2d8989f)
-- chore: release v2.9.2 [`d3db011`](https://github.com/karmaniverous/jeeves-server/commit/d3db011a3d395de57537b7054e7ad06be160d698)
-
-#### [v2.9.1](https://github.com/karmaniverous/jeeves-server/compare/v2.9.0...v2.9.1)
-
-> 24 February 2026
-
-- fix: dark mode status pills via custom-variant [`30454de`](https://github.com/karmaniverous/jeeves-server/commit/30454dec84984573214abdff5d9fcbe12d3b4e9a)
-- chore: release v2.9.1 [`d34fd62`](https://github.com/karmaniverous/jeeves-server/commit/d34fd6205e87bd9ec7f5941ba498d3493a87f6ea)
-- chore: release v2.9.0 [`7cdc030`](https://github.com/karmaniverous/jeeves-server/commit/7cdc03037b0bc4c25b69e849bed7f7be0f47be93)
-
-#### [v2.9.0](https://github.com/karmaniverous/jeeves-server/compare/v2.8.0...v2.9.0)
-
-> 24 February 2026
-
--  feat: add runner dashboard [`#59`](https://github.com/karmaniverous/jeeves-server/pull/59)
-- fix: event queue byte/char cursor mismatch + postbuild client [`#52`](https://github.com/karmaniverous/jeeves-server/pull/52)
-- fix: client TS errors + picomatch dot matching [`#51`](https://github.com/karmaniverous/jeeves-server/pull/51)
-- gitignores [`601737f`](https://github.com/karmaniverous/jeeves-server/commit/601737f2218dcd87c6979176541df4795279aa39)
-- chore: release v2.9.0 [`7813907`](https://github.com/karmaniverous/jeeves-server/commit/78139078c7c5339e963db21940a7e70b1d4a78c1)
-
-#### [v2.8.0](https://github.com/karmaniverous/jeeves-server/compare/v2.7.5...v2.8.0)
-
-> 23 February 2026
-
-- [GH-46] Semantic search UI [`#47`](https://github.com/karmaniverous/jeeves-server/pull/47)
-- [GH-46] GH-46: Semantic search — backend proxy + frontend modal [`80383d1`](https://github.com/karmaniverous/jeeves-server/commit/80383d1ac18b3e7ad3278f384d6d7a533fac10dd)
-- [GH-46] GH-46: Date range filtering (relative + absolute) [`e775502`](https://github.com/karmaniverous/jeeves-server/commit/e775502c4c26576bc7d38f2cd2c9dd1b1cf639c0)
-- [GH-46] GH-46: Accordion chunks with scrollable container [`d9462e0`](https://github.com/karmaniverous/jeeves-server/commit/d9462e05b6958484f3ded9baf12d48b435818bc2)
-
-#### [v2.7.5](https://github.com/karmaniverous/jeeves-server/compare/v2.7.4...v2.7.5)
-
-> 22 February 2026
-
-- [GH-44] Cache exports + Clear Cache control [`#45`](https://github.com/karmaniverous/jeeves-server/pull/45)
-- [GH-44] GH-44: Add export cache + Clear Cache endpoint and UI [`bf41cd0`](https://github.com/karmaniverous/jeeves-server/commit/bf41cd00ac2d56c6f42d763115feb9ae88e1f5aa)
-- [GH-44] Clear cache covers standalone diagram files (mmd/puml) [`63ba5c8`](https://github.com/karmaniverous/jeeves-server/commit/63ba5c823ca0be448bebe5c691819d8dd039c79d)
-- [GH-44] Add .export-cache/ to gitignore [`80ade63`](https://github.com/karmaniverous/jeeves-server/commit/80ade63660b02ebecede3f08f73cd281bf1fc69e)
-
-#### [v2.7.4](https://github.com/karmaniverous/jeeves-server/compare/v2.7.3...v2.7.4)
-
-> 22 February 2026
-
-- GH-42: Unify raw view on CodeMirror 6 with code folding [`#43`](https://github.com/karmaniverous/jeeves-server/pull/43)
-- [GH-42] Replace highlight.js raw view with CodeMirror 6 read-only viewer [`547315c`](https://github.com/karmaniverous/jeeves-server/commit/547315ca640b352d54c6ab58f4dad0c83383a6e8)
-- [GH-42] Remove highlight.js — CM6 handles all syntax highlighting [`52415ae`](https://github.com/karmaniverous/jeeves-server/commit/52415aed229b25ad2bb75473b7e1eb0cb28cd769)
-- [GH-42] Fix DOCX code block rendering — per-line paragraphs with NBSP indent [`61db677`](https://github.com/karmaniverous/jeeves-server/commit/61db677ca130fa04e3ffba475ed1c11a2676cd2c)
-
-#### [v2.7.3](https://github.com/karmaniverous/jeeves-server/compare/v2.7.2...v2.7.3)
-
-> 22 February 2026
-
-- GH-40: Retry button for failed inline diagram renders [`#41`](https://github.com/karmaniverous/jeeves-server/pull/41)
-- [GH-40] Add retry button to failed inline diagram renders [`1fe10bd`](https://github.com/karmaniverous/jeeves-server/commit/1fe10bd731f9429c1cf691317a283d71b6a9592b)
-- [GH-40] Improve error message and add reload hint on retry failure [`b0c02c8`](https://github.com/karmaniverous/jeeves-server/commit/b0c02c88cfa5b67f73de5f64dff47d87779e0999)
-
-#### [v2.7.2](https://github.com/karmaniverous/jeeves-server/compare/v2.7.1...v2.7.2)
-
-> 22 February 2026
-
-- GH-38: Terms of Service, Privacy Policy & search engine blocking [`#39`](https://github.com/karmaniverous/jeeves-server/pull/39)
-
-#### [v2.7.1](https://github.com/karmaniverous/jeeves-server/compare/v2.7.0...v2.7.1)
-
-> 21 February 2026
-
-- SOLID/DRY codebase audit — comprehensive refactor [`#37`](https://github.com/karmaniverous/jeeves-server/pull/37)
-
-#### [v2.7.0](https://github.com/karmaniverous/jeeves-server/compare/v2.6.0...v2.7.0)
-
-> 21 February 2026
-
-- GH-32 + GH-33: Diagram cache + lazy-load embedded diagrams [`74b68be`](https://github.com/karmaniverous/jeeves-server/commit/74b68be594735260dbd9645e565f04a73ba76d5e)
-
-#### [v2.6.0](https://github.com/karmaniverous/jeeves-server/compare/v2.5.0...v2.6.0)
-
-> 20 February 2026
-
-- feat: in-browser text editing (GH-30) [`#31`](https://github.com/karmaniverous/jeeves-server/pull/31)
-- chore: bump version to 2.6.0 [`7d54aa3`](https://github.com/karmaniverous/jeeves-server/commit/7d54aa3be4c4ae0093ed86bd16d98e57ed3bdf77)
-
-#### [v2.5.0](https://github.com/karmaniverous/jeeves-server/compare/v2.4.0...v2.5.0)
-
-> 20 February 2026
-
-- feat: Render embedded Mermaid/PlantUML code blocks (GH-23) [`#27`](https://github.com/karmaniverous/jeeves-server/pull/27)
-- chore: bump version to 2.5.0 [`2c42e14`](https://github.com/karmaniverous/jeeves-server/commit/2c42e14aa5e6324b67c5ef0dc615cece50cf1992)
-
-#### [v2.4.0](https://github.com/karmaniverous/jeeves-server/compare/v2.3.5...v2.4.0)
-
-> 20 February 2026
-
-- feat: Native PlantUML support (GH-22) [`#25`](https://github.com/karmaniverous/jeeves-server/pull/25)
-- chore: bump version to 2.4.0 [`ddf9d87`](https://github.com/karmaniverous/jeeves-server/commit/ddf9d87cf8b42420d0bc3e24b46489bbec04aff8)
-
-#### [v2.3.5](https://github.com/karmaniverous/jeeves-server/compare/v2.3.4...v2.3.5)
-
-> 20 February 2026
-
-- fix: case-insensitive email comparison for insider matching [`#24`](https://github.com/karmaniverous/jeeves-server/pull/24)
-
-#### [v2.3.4](https://github.com/karmaniverous/jeeves-server/compare/v2.3.3...v2.3.4)
-
-> 19 February 2026
-
-- refactor: Copy Raw Link builds /api/raw/ URL directly, remove raw=1 redirect [`#21`](https://github.com/karmaniverous/jeeves-server/pull/21)
-
-#### [v2.3.3](https://github.com/karmaniverous/jeeves-server/compare/v2.3.2...v2.3.3)
-
-> 19 February 2026
-
-- feat: raw=1 on /browse/* redirects to /api/raw/* for raw file delivery [`#20`](https://github.com/karmaniverous/jeeves-server/pull/20)
-
-#### [v2.3.2](https://github.com/karmaniverous/jeeves-server/compare/v2.3.1...v2.3.2)
-
-> 19 February 2026
-
-- fix: forward auth params on downloads, show error popup on failure [`#19`](https://github.com/karmaniverous/jeeves-server/pull/19)
-
-#### [v2.3.1](https://github.com/karmaniverous/jeeves-server/compare/v2.3.0...v2.3.1)
-
-> 18 February 2026
-
-- refactor: replace hand-rolled glob matching with picomatch [`#18`](https://github.com/karmaniverous/jeeves-server/pull/18)
-
-#### [v2.3.0](https://github.com/karmaniverous/jeeves-server/compare/v2.2.1...v2.3.0)
-
-> 18 February 2026
-
-- [GH-16] feat(GH-16): utility share-for endpoint + outsider policy [`#17`](https://github.com/karmaniverous/jeeves-server/pull/17)
-
-#### [v2.2.1](https://github.com/karmaniverous/jeeves-server/compare/v2.2.0...v2.2.1)
-
-> 18 February 2026
-
-- Allow/deny scopes for insiders and keys [`#15`](https://github.com/karmaniverous/jeeves-server/pull/15)
-- chore: update repo description and add keywords to package.json [`5130698`](https://github.com/karmaniverous/jeeves-server/commit/51306983c3bcf6e8f8af8d49316512437c1cc1ff)
-
-#### [v2.2.0](https://github.com/karmaniverous/jeeves-server/compare/v2.1.0...v2.2.0)
-
-> 17 February 2026
-
-- GH-13: Linux compatibility [`#14`](https://github.com/karmaniverous/jeeves-server/pull/14)
-
-#### [v2.1.0](https://github.com/karmaniverous/jeeves-server/compare/v2.0.1...v2.1.0)
-
-> 17 February 2026
-
-- [GH-11] Deep share links with depth and directory controls [`#12`](https://github.com/karmaniverous/jeeves-server/pull/12)
-- docs: add platform support section, sync requirements with GH-11 implementation, call out Linux as next-up [`261ff4d`](https://github.com/karmaniverous/jeeves-server/commit/261ff4d69de26ef7fdc83295c7ea9e255ce9214e)
-- fix: header button hover in light mode - use white/10 overlay instead of accent bg [`eeb370c`](https://github.com/karmaniverous/jeeves-server/commit/eeb370c1dfaa79ba03f4685fddd664874f2b3e7a)
-
-#### [v2.0.1](https://github.com/karmaniverous/jeeves-server/compare/v2.0.0...v2.0.1)
-
-> 17 February 2026
-
-- Fix PDF/DOCX export rendering [`#10`](https://github.com/karmaniverous/jeeves-server/pull/10)
-- Decommission path routes [`#8`](https://github.com/karmaniverous/jeeves-server/pull/8)
-- [GH-9] fix DOCX SVG export — render SVGs in clean isolated pages [`#9`](https://github.com/karmaniverous/jeeves-server/issues/9)
-- [GH-9] fix DOCX SVG screenshot offset — use element.screenshot() instead of clip [`#9`](https://github.com/karmaniverous/jeeves-server/issues/9)
-- [GH-9] fix SVG rendering in SPA and PDF/DOCX export issues [`#9`](https://github.com/karmaniverous/jeeves-server/issues/9)
-- [GH-9] fix PDF/DOCX exports rendering panzoom container chrome [`#9`](https://github.com/karmaniverous/jeeves-server/issues/9)
-- [GH-7] decommission /path routes — migrate to /api/raw, /api/export, /browse redirect [`#7`](https://github.com/karmaniverous/jeeves-server/issues/7)
-- [GH-7] remove legacy server.js — replaced by src/server.ts [`6a701e6`](https://github.com/karmaniverous/jeeves-server/commit/6a701e6eb9325c39b20799673f5aee58877538ee)
-- [GH-7] remove server-rendered about page, templates, and test PDFs [`bad31ca`](https://github.com/karmaniverous/jeeves-server/commit/bad31ca3c4da5eb00ea9183c0b5a1dbb9442a0cf)
-- [GH-9] render DOCX SVGs at full page width (1152px) [`dbb5bae`](https://github.com/karmaniverous/jeeves-server/commit/dbb5bae948f762b65da047980fdcdf44c1999727)
-
-### [v2.0.0](https://github.com/karmaniverous/jeeves-server/compare/v1.2.1...v2.0.0)
-
-> 16 February 2026
-
-- v2.0.0: React SPA migration [`#6`](https://github.com/karmaniverous/jeeves-server/pull/6)
-- [GH-5] merge: resolve conflicts with main (keep feature branch for frozen server pages) [`2c57b6f`](https://github.com/karmaniverous/jeeves-server/commit/2c57b6f11a0293c22da9c74c1b80b229b01f0fe0)
-- [GH-5] feat: React + Vite scaffold with file browser, API endpoints, and SPA serving (GH-5) [`6a8ffb5`](https://github.com/karmaniverous/jeeves-server/commit/6a8ffb5e932e648a44311ac9a686e5cb1b31c104)
-- [GH-5] Dropdown menus, TS config, state separation, local static assets [`16f40b4`](https://github.com/karmaniverous/jeeves-server/commit/16f40b4607037c8b5992a7a3bbf1d586d697cce8)
-
-#### [v1.2.1](https://github.com/karmaniverous/jeeves-server/compare/v1.2.0...v1.2.1)
-
-> 15 February 2026
-
-- fix: wrap entire startup in try/catch, surface errors instead of silent exit [`1913fe1`](https://github.com/karmaniverous/jeeves-server/commit/1913fe13af0bc992df7d49fc2d3a953fb4b1b538)
-- fix: mobile header — hide redundant share UI on directories, allow header wrapping (GH-4) [`6306f27`](https://github.com/karmaniverous/jeeves-server/commit/6306f27da93700757a328de83f34c5179b89bfc5)
-- fix: header stretches to full content width when zoomed out [`bbebeec`](https://github.com/karmaniverous/jeeves-server/commit/bbebeec052f1d76a1e1b14a7574bf35ffd1a3dc5)
-
-#### [v1.2.0](https://github.com/karmaniverous/jeeves-server/compare/v1.1.0...v1.2.0)
-
-> 15 February 2026
-
-- Merge feature/GH-4-google-oauth: Google OAuth + per-row share icons [`4706828`](https://github.com/karmaniverous/jeeves-server/commit/470682852b610da5a262501a216feaf71c035d34)
-- [GH-4] feat: add Google OAuth and cookie sessions (GH-4) [`89b6d72`](https://github.com/karmaniverous/jeeves-server/commit/89b6d729edc6e9a360aa1d8c745de0cdcd8d573f)
-- [GH-4] feat: directory outsider links, new share UI, per-insider key age (GH-4) [`4cbc001`](https://github.com/karmaniverous/jeeves-server/commit/4cbc001b1ed163b6735ff1667c70008d20729b43)
-
-#### [v1.1.0](https://github.com/karmaniverous/jeeves-server/compare/v1.0.3...v1.1.0)
-
-> 15 February 2026
-
-- v1.1.0: TypeScript/Fastify refactor, event gateway, named keys with scopes [`f3711f8`](https://github.com/karmaniverous/jeeves-server/commit/f3711f82ed0f30156c7980440ad55dec336be0df)
-- Merge feature/GH-3-ts-refactor: TypeScript/Fastify refactor with event gateway and named keys [`a920a99`](https://github.com/karmaniverous/jeeves-server/commit/a920a99e9975215c653a29decad2e9e578b438de)
-- [GH-3] TypeScript refactor scaffolding and core modules [`8dd0b92`](https://github.com/karmaniverous/jeeves-server/commit/8dd0b927e70eb89af416ce9708dcbc8de05a41da)
-
-#### [v1.0.3](https://github.com/karmaniverous/jeeves-server/compare/v1.0.2...v1.0.3)
-
-> 8 February 2026
-
-- Reduce PDF/DOCX font sizes to 10pt base [`2617ac9`](https://github.com/karmaniverous/jeeves-server/commit/2617ac969c6dc3d503fdb63760d8d8f68cdae0c7)
-- Fix PDF font size - add 10pt to PDF-specific styles [`18b3505`](https://github.com/karmaniverous/jeeves-server/commit/18b35059f3eef267cdcb01e51dd49e1d8a9fb173)
-
-#### [v1.0.2](https://github.com/karmaniverous/jeeves-server/compare/v1.0.1...v1.0.2)
-
-> 7 February 2026
-
-- Fix raw download for markdown files [`25952cd`](https://github.com/karmaniverous/jeeves-server/commit/25952cd0362a47ebdaf4958fc86436a96c1f8c1f)
-- Add top hat branding to outsider pages, improve filename display [`cacbb60`](https://github.com/karmaniverous/jeeves-server/commit/cacbb605b58064002aba3911009c5fb3788990ff)
-- Add 'Jeeves Server' tooltip to top hat in all modes [`26902d4`](https://github.com/karmaniverous/jeeves-server/commit/26902d45d74aea615f706700ebdf2068c4f95bd7)
-
-### [v1.0.1](https://github.com/karmaniverous/jeeves-server/compare/v0.1.2...v1.0.1)
-
-> 7 February 2026
-
-#### [v0.1.2](https://github.com/karmaniverous/jeeves-server/compare/v0.1.1...v0.1.2)
-
-> 7 February 2026
-
-- Add HTML wrapper for SVG files with proper constraints [`edf794b`](https://github.com/karmaniverous/jeeves-server/commit/edf794beb8e1c81d4c4d698d4fc7ecef2412d66c)
-- Allow clickthrough on binary files, block only dangerous executables [`be338eb`](https://github.com/karmaniverous/jeeves-server/commit/be338ebdb7872b60682836ddd761f4e1a215ef5e)
-- Fix panzoom overlay sizing for tall SVGs - strip inline styles, size based on aspect ratio [`1fabf75`](https://github.com/karmaniverous/jeeves-server/commit/1fabf753cd0f22531cce2861e2fe80727dc00635)
-
-#### [v0.1.1](https://github.com/karmaniverous/jeeves-server/compare/v0.1.0...v0.1.1)
-
-> 7 February 2026
-
-- Fix DOCX image sizing: preserve aspect ratio within max bounds [`9755b15`](https://github.com/karmaniverous/jeeves-server/commit/9755b15d20e82c78c452e48c220214f1fb238293)
-- docs: add integration guide for other projects [`4512d9b`](https://github.com/karmaniverous/jeeves-server/commit/4512d9b881fd3de20f8c9c68fe3097fd4e97b7e7)
-- feat: detect text files by content (null bytes) instead of extension whitelist [`cf8c99a`](https://github.com/karmaniverous/jeeves-server/commit/cf8c99a911b268df9761da9efdde7526c4004e2b)
-
-#### v0.1.0
-
-> 7 February 2026
-
-- feat: track key rotation timestamp, display relative time, DRY up header components [`993023e`](https://github.com/karmaniverous/jeeves-server/commit/993023e240174cc420f43ca93187b69d9b49812f)
-- Add heading anchors, TOC, and Windows path linking [`f49962d`](https://github.com/karmaniverous/jeeves-server/commit/f49962da01488d244898aaceef4c5d0cecf72915)
-- Initial commit: Express server with webhook receiver, file server, and path-key auth [`31c83ca`](https://github.com/karmaniverous/jeeves-server/commit/31c83ca0593a09bfcece5501920dad7f8c78a74f)

package/dist/src/crypto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAOtE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,MAAM,CAKR;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,MAAM,CAKR;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAM7D"}

package/dist/src/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,KAAK,eAAe,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,UAAU,EACV,wBAAwB,EACxB,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,YAAY,CAAC"}

package/dist/src/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oCAAoC;AACpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,gCAAgC;AAChC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,SAAS,GAAG,gBAAgB,GAAG,SAAS,GAAG,eAAe,CAAC;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,6CAA6C;AAC7C,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,kCAAkC;AAClC,MAAM,MAAM,kBAAkB,GAC1B,YAAY,GACZ,cAAc,GACd,cAAc,GACd,WAAW,GACX,iBAAiB,CAAC;AAEtB,qCAAqC;AACrC,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf"}

package/dist/src/types.js

@@ -1,6 +0,0 @@
-/**
- * Shared API request/response types between service and plugin.
- *
- * @packageDocumentation
- */
-export {};

package/src/crypto.ts

@@ -1,81 +0,0 @@
-/**
- * Cryptographic utilities for HMAC key computation and verification.
- *
- * @packageDocumentation
- */
-
-import crypto from 'node:crypto';
-
-/**
- * Compute path-specific key: HMAC-SHA256(apiKey, normalizedPath)
- */
-export function computePathKey(apiKey: string, urlPath: string): string {
-  const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
-  const hash = crypto
-    .createHmac('sha256', apiKey)
-    .update(normalized)
-    .digest('hex');
-  return hash.substring(0, 32);
-}
-
-/**
- * Compute insider key: HMAC-SHA256(apiKey, "insider")
- * Works for any path, grants full navigation
- */
-export function computeInsiderKey(apiKey: string): string {
-  const hash = crypto
-    .createHmac('sha256', apiKey)
-    .update('insider')
-    .digest('hex');
-  return hash.substring(0, 32);
-}
-
-/**
- * Compute outsider key with expiry: HMAC-SHA256(apiKey, path + "|" + expiry)
- */
-export function computeOutsiderKeyWithExpiry(
-  apiKey: string,
-  urlPath: string,
-  expiry: string | number,
-): string {
-  const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
-  const data = `${normalized}|${String(expiry)}`;
-  const hash = crypto.createHmac('sha256', apiKey).update(data).digest('hex');
-  return hash.substring(0, 32);
-}
-
-/**
- * Deep share key parameters
- */
-export interface DeepShareParams {
-  depth: number;
-  dirs: boolean;
-  stack: string; // lz-string compressToEncodedURIComponent'd path stack
-  exp?: string;
-}
-
-/**
- * Compute deep share key: HMAC-SHA256(seed, path + "|" + d + "|" + dirs + "|" + stack + "|" + exp)
- * Used for share links with depth \> 0 or dirs enabled.
- */
-export function computeDeepShareKey(
-  seed: string,
-  urlPath: string,
-  params: DeepShareParams,
-): string {
-  const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
-  const data = `${normalized}|${String(params.depth)}|${params.dirs ? '1' : '0'}|${params.stack}|${params.exp ?? ''}`;
-  const hash = crypto.createHmac('sha256', seed).update(data).digest('hex');
-  return hash.substring(0, 32);
-}
-
-/**
- * Timing-safe string comparison
- */
-export function timingSafeEqual(a: string, b: string): boolean {
-  try {
-    return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-  } catch {
-    return false;
-  }
-}

package/src/index.ts

@@ -1,29 +0,0 @@
-/**
- * Shared utilities and types for jeeves-server packages.
- *
- * @packageDocumentation
- */
-
-export {
-  computeDeepShareKey,
-  computeInsiderKey,
-  computeOutsiderKeyWithExpiry,
-  computePathKey,
-  type DeepShareParams,
-  timingSafeEqual,
-} from './crypto.js';
-export type {
-  AuthStatusResponse,
-  DriveEntry,
-  ExportCacheClearResponse,
-  ExportLink,
-  FileMutationAction,
-  LinkInfoResponse,
-  OAuthStartRequest,
-  OAuthStartResponse,
-  RotateKeyResponse,
-  ShareForRequest,
-  ShareForResponse,
-  ShareRequest,
-  ShareResponse,
-} from './types.js';

package/src/types.ts

@@ -1,108 +0,0 @@
-/**
- * Shared API request/response types between service and plugin.
- *
- * @packageDocumentation
- */
-
-/** POST /api/share request body. */
-export interface ShareRequest {
-  path: string;
-  expiry?: string;
-  depth?: number;
-  dirs?: boolean;
-}
-
-/** POST /api/share response. */
-export interface ShareResponse {
-  url: string;
-  path: string;
-  exp: string | null;
-  depth?: number;
-  dirs?: boolean;
-}
-
-/** POST /api/util/share-for request body. */
-export interface ShareForRequest {
-  path: string;
-  insiders: string[];
-  depth?: number;
-  dirs?: boolean;
-  enforceOutsiderPolicy?: boolean;
-}
-
-/** POST /api/util/share-for response. */
-export interface ShareForResponse {
-  url: string | null;
-  type: 'insider' | 'outsider-share' | 'blocked' | 'policy-denied';
-  reason?: string;
-  blocked?: string[];
-  warning?: string;
-}
-
-/** POST /api/oauth/start request body. */
-export interface OAuthStartRequest {
-  provider: string;
-  account: string;
-  clientId: string;
-  clientSecret: string;
-  scopes?: string[];
-  origin?: string;
-}
-
-/** POST /api/oauth/start response. */
-export interface OAuthStartResponse {
-  authUrl?: string;
-}
-
-/** GET /api/link-info response. */
-export interface LinkInfoResponse {
-  exists: boolean;
-  isDirectory?: boolean;
-  pageUrl?: string;
-  rawUrl?: string | null;
-  exportLinks?: ExportLink[];
-}
-
-/** Export link entry in link-info response. */
-export interface ExportLink {
-  format: string;
-  url: string;
-}
-
-/** GET /api/export-cache DELETE response. */
-export interface ExportCacheClearResponse {
-  cleared: {
-    exports: number;
-    diagrams: number;
-  };
-}
-
-/** File mutation action types. */
-export type FileMutationAction =
-  | 'edit-block'
-  | 'delete-block'
-  | 'insert-block'
-  | 'edit-cell'
-  | 'toggle-checkbox';
-
-/** POST /api/rotate-key response. */
-export interface RotateKeyResponse {
-  ok: boolean;
-  keyCreatedAt: string;
-}
-
-/** GET /api/auth/status response. */
-export interface AuthStatusResponse {
-  authenticated: boolean;
-  email?: string;
-  picture?: string;
-  isInsider: boolean;
-  keyCreatedAt?: string | null;
-  searchEnabled?: boolean;
-}
-
-/** GET /api/drives response entry. */
-export interface DriveEntry {
-  letter: string;
-  label: string;
-}

package/tsconfig.json

@@ -1,21 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": ".",
-    "noEmit": false,
-    "declaration": true,
-    "declarationMap": true,
-    "types": [
-      "node",
-      "vitest/globals"
-    ]
-  },
-  "include": [
-    "src/**/*"
-  ],
-  "exclude": [
-    "dist",
-    "node_modules"
-  ]
-}