@karmaniverous/jeeves-server-core 0.1.1 → 0.1.3

package/dist/src/crypto.d.ts

@@ -34,4 +34,3 @@ export declare function computeDeepShareKey(seed: string, urlPath: string, param
  * Timing-safe string comparison
  */
 export declare function timingSafeEqual(a: string, b: string): boolean;
-//# sourceMappingURL=crypto.d.ts.map

package/dist/src/crypto.js

@@ -1,13 +1,14 @@
+import crypto from 'node:crypto';
+
 /**
  * Cryptographic utilities for HMAC key computation and verification.
  *
  * @packageDocumentation
  */
-import crypto from 'node:crypto';
 /**
  * Compute path-specific key: HMAC-SHA256(apiKey, normalizedPath)
  */
-export function computePathKey(apiKey, urlPath) {
+function computePathKey(apiKey, urlPath) {
     const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
     const hash = crypto
         .createHmac('sha256', apiKey)
@@ -19,7 +20,7 @@ export function computePathKey(apiKey, urlPath) {
  * Compute insider key: HMAC-SHA256(apiKey, "insider")
  * Works for any path, grants full navigation
  */
-export function computeInsiderKey(apiKey) {
+function computeInsiderKey(apiKey) {
     const hash = crypto
         .createHmac('sha256', apiKey)
         .update('insider')
@@ -29,7 +30,7 @@ export function computeInsiderKey(apiKey) {
 /**
  * Compute outsider key with expiry: HMAC-SHA256(apiKey, path + "|" + expiry)
  */
-export function computeOutsiderKeyWithExpiry(apiKey, urlPath, expiry) {
+function computeOutsiderKeyWithExpiry(apiKey, urlPath, expiry) {
     const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
     const data = `${normalized}|${String(expiry)}`;
     const hash = crypto.createHmac('sha256', apiKey).update(data).digest('hex');
@@ -39,7 +40,7 @@ export function computeOutsiderKeyWithExpiry(apiKey, urlPath, expiry) {
  * Compute deep share key: HMAC-SHA256(seed, path + "|" + d + "|" + dirs + "|" + stack + "|" + exp)
  * Used for share links with depth \> 0 or dirs enabled.
  */
-export function computeDeepShareKey(seed, urlPath, params) {
+function computeDeepShareKey(seed, urlPath, params) {
     const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
     const data = `${normalized}|${String(params.depth)}|${params.dirs ? '1' : '0'}|${params.stack}|${params.exp ?? ''}`;
     const hash = crypto.createHmac('sha256', seed).update(data).digest('hex');
@@ -48,7 +49,7 @@ export function computeDeepShareKey(seed, urlPath, params) {
 /**
  * Timing-safe string comparison
  */
-export function timingSafeEqual(a, b) {
+function timingSafeEqual(a, b) {
     try {
         return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
     }
@@ -56,3 +57,5 @@ export function timingSafeEqual(a, b) {
         return false;
     }
 }
+
+export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, timingSafeEqual };

package/dist/src/index.d.ts

@@ -4,5 +4,5 @@
  * @packageDocumentation
  */
 export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, type DeepShareParams, timingSafeEqual, } from './crypto.js';
+export { type AuthMode, authModeSchema, authSchema, DEPRECATED_CONFIG_PROPS, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, type JeevesConfig, jeevesConfigSchema, keyEntrySchema, oauthProviderSchema, oauthSchema, scopesObjectSchema, scopesSchema, } from './schema.js';
 export type { AuthStatusResponse, DriveEntry, ExportCacheClearResponse, ExportLink, FileMutationAction, LinkInfoResponse, OAuthStartRequest, OAuthStartResponse, RotateKeyResponse, ShareForRequest, ShareForResponse, ShareRequest, ShareResponse, } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/src/index.js

@@ -1,6 +1,2 @@
-/**
- * Shared utilities and types for jeeves-server packages.
- *
- * @packageDocumentation
- */
-export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, timingSafeEqual, } from './crypto.js';
+export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, timingSafeEqual } from './crypto.js';
+export { DEPRECATED_CONFIG_PROPS, authModeSchema, authSchema, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, jeevesConfigSchema, keyEntrySchema, oauthProviderSchema, oauthSchema, scopesObjectSchema, scopesSchema } from './schema.js';

package/dist/src/schema.d.ts

@@ -0,0 +1,168 @@
+import { z } from 'zod';
+/** Config properties deprecated in v3.6.0 (now resolved via core services). */
+export declare const DEPRECATED_CONFIG_PROPS: readonly ["host", "runnerUrl", "watcherUrl", "metaUrl"];
+/** Supported authentication methods */
+export declare const authModeSchema: z.ZodEnum<{
+    google: "google";
+    keys: "keys";
+}>;
+/** Google OAuth configuration */
+export declare const googleAuthSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+}, z.core.$strip>;
+/** Auth configuration */
+export declare const authSchema: z.ZodObject<{
+    modes: z.ZodArray<z.ZodEnum<{
+        google: "google";
+        keys: "keys";
+    }>>;
+    google: z.ZodOptional<z.ZodObject<{
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+    }, z.core.$strip>>;
+    sessionSecret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Event webhook configuration */
+export declare const eventConfigSchema: z.ZodObject<{
+    schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    cmd: z.ZodString;
+    map: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * Scopes configuration — controls which paths a user/key can access.
+ *
+ * Three forms:
+ * - `string` — single allow pattern (e.g. '/d/*')
+ * - `string[]` — array of allow patterns (shorthand for \{ allow: [...] \})
+ * - `\{ allow?: string[], deny?: string[] \}` — explicit allow/deny rules
+ *
+ * Semantics:
+ * - Path must match at least one allow rule AND NOT match any deny rule
+ * - Omitting `allow` = implicit ['/*'] (allow everything)
+ * - Omitting `deny` = no exclusions
+ * - Omitting scopes entirely = unrestricted access
+ */
+export declare const scopesObjectSchema: z.ZodObject<{
+    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const scopesSchema: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>]>;
+/** Insider entry (identity + scopes + optional persisted seed) */
+export declare const insiderEntrySchema: z.ZodObject<{
+    scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>]>>;
+    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    seed: z.ZodOptional<z.ZodString>;
+    keyCreatedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Key entry — plain string (seed, no scopes) or object with key + optional scopes */
+export declare const keyEntrySchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+    key: z.ZodString;
+    scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>]>>;
+    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>]>;
+/** Check if a string is a named scope identifier (not a path glob). */
+export declare function isScopeName(v: string): boolean;
+/** OAuth provider configuration */
+export declare const oauthProviderSchema: z.ZodObject<{
+    authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+    tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+    pkce: z.ZodDefault<z.ZodBoolean>;
+    defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** OAuth configuration */
+export declare const oauthSchema: z.ZodObject<{
+    credentialDir: z.ZodString;
+    providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+        tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/** Top-level Jeeves Server configuration */
+export declare const jeevesConfigSchema: z.ZodObject<{
+    port: z.ZodDefault<z.ZodNumber>;
+    chromePath: z.ZodString;
+    auth: z.ZodObject<{
+        modes: z.ZodArray<z.ZodEnum<{
+            google: "google";
+            keys: "keys";
+        }>>;
+        google: z.ZodOptional<z.ZodObject<{
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+        }, z.core.$strip>>;
+        sessionSecret: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    scopes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    insiders: z.ZodDefault<z.ZodRecord<z.ZodEmail, z.ZodObject<{
+        scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+            allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>]>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        seed: z.ZodOptional<z.ZodString>;
+        keyCreatedAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    keys: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        key: z.ZodString;
+        scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+            allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>]>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>]>>>;
+    events: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        cmd: z.ZodString;
+        map: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+    eventTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    eventLogPurgeMs: z.ZodDefault<z.ZodNumber>;
+    maxZipSizeMb: z.ZodDefault<z.ZodNumber>;
+    roots: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    mermaidCliPath: z.ZodOptional<z.ZodString>;
+    plantuml: z.ZodOptional<z.ZodObject<{
+        jarPath: z.ZodOptional<z.ZodString>;
+        javaPath: z.ZodOptional<z.ZodString>;
+        servers: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+    }, z.core.$strip>>;
+    diagramCachePath: z.ZodOptional<z.ZodString>;
+    outsiderPolicy: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>]>>;
+    oauth: z.ZodOptional<z.ZodObject<{
+        credentialDir: z.ZodString;
+        providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+            authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+            tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+            pkce: z.ZodDefault<z.ZodBoolean>;
+            defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    go: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+/** Inferred config type */
+export type JeevesConfig = z.infer<typeof jeevesConfigSchema>;
+/** Auth mode type */
+export type AuthMode = z.infer<typeof authModeSchema>;

package/dist/src/schema.js

@@ -0,0 +1,252 @@
+import { SERVER_PORT } from '@karmaniverous/jeeves';
+import { z } from 'zod';
+
+/** Config properties deprecated in v3.6.0 (now resolved via core services). */
+const DEPRECATED_CONFIG_PROPS = [
+    'host',
+    'runnerUrl',
+    'watcherUrl',
+    'metaUrl',
+];
+/** Supported authentication methods */
+const authModeSchema = z.enum(['google', 'keys']);
+/** Google OAuth configuration */
+const googleAuthSchema = z.object({
+    clientId: z.string().min(1),
+    clientSecret: z.string().min(1),
+});
+/** Auth configuration */
+const authSchema = z.object({
+    /** Active authentication methods. Order determines priority. */
+    modes: z
+        .array(authModeSchema)
+        .min(1, { message: 'At least one auth mode is required' }),
+    /** Google OAuth config. Required if modes includes "google". */
+    google: googleAuthSchema.optional(),
+    /** Session cookie signing secret. Required if modes includes "google". */
+    sessionSecret: z.string().min(1).optional(),
+});
+/** Event webhook configuration */
+const eventConfigSchema = z.object({
+    schema: z.record(z.string(), z.unknown()),
+    cmd: z.string(),
+    map: z.record(z.string(), z.unknown()).optional(),
+    timeoutMs: z.number().positive().optional(),
+});
+/**
+ * Scopes configuration — controls which paths a user/key can access.
+ *
+ * Three forms:
+ * - `string` — single allow pattern (e.g. '/d/*')
+ * - `string[]` — array of allow patterns (shorthand for \{ allow: [...] \})
+ * - `\{ allow?: string[], deny?: string[] \}` — explicit allow/deny rules
+ *
+ * Semantics:
+ * - Path must match at least one allow rule AND NOT match any deny rule
+ * - Omitting `allow` = implicit ['/*'] (allow everything)
+ * - Omitting `deny` = no exclusions
+ * - Omitting scopes entirely = unrestricted access
+ */
+const scopesObjectSchema = z.object({
+    allow: z.array(z.string()).optional(),
+    deny: z.array(z.string()).optional(),
+});
+const scopesSchema = z.union([
+    z.string(),
+    z.array(z.string()),
+    scopesObjectSchema,
+]);
+/** Insider entry (identity + scopes + optional persisted seed) */
+const insiderEntrySchema = z.object({
+    scopes: scopesSchema.optional(),
+    /** Extra allow patterns merged on top of named scope references */
+    allow: z.array(z.string()).optional(),
+    /** Extra deny patterns merged on top of named scope references */
+    deny: z.array(z.string()).optional(),
+    /** Auto-generated insider seed, persisted in config.json */
+    seed: z.string().min(1).optional(),
+    /** ISO timestamp of when the seed was created */
+    keyCreatedAt: z.string().optional(),
+});
+/** Key entry — plain string (seed, no scopes) or object with key + optional scopes */
+const keyEntrySchema = z.union([
+    z.string().min(1),
+    z.object({
+        key: z.string().min(1),
+        scopes: scopesSchema.optional(),
+        /** Extra allow patterns merged on top of named scope references */
+        allow: z.array(z.string()).optional(),
+        /** Extra deny patterns merged on top of named scope references */
+        deny: z.array(z.string()).optional(),
+    }),
+]);
+/** Check if a string is a named scope identifier (not a path glob). */
+function isScopeName(v) {
+    return /^[A-Za-z0-9_-]+$/.test(v);
+}
+/** Helper: collect named scope references from a scopes field value.
+ *
+ * Backward-compat note: `scopes` has historically accepted path globs like "/**" or ["/a","/b"].
+ * We only treat values as *named scope references* if they look like identifiers
+ * (e.g. "restricted", "no-vc") rather than path globs.
+ */
+function getScopeRefs(scopes) {
+    if (typeof scopes === 'string')
+        return isScopeName(scopes) ? [scopes] : [];
+    if (Array.isArray(scopes) && scopes.length > 0) {
+        const strs = scopes.filter((v) => typeof v === 'string');
+        if (strs.length !== scopes.length)
+            return [];
+        return strs.filter((v) => isScopeName(v));
+    }
+    return [];
+}
+/** OAuth provider configuration */
+const oauthProviderSchema = z.object({
+    authUrl: z.string().pipe(z.url()),
+    tokenUrl: z.string().pipe(z.url()),
+    pkce: z.boolean().default(false),
+    defaultScopes: z.array(z.string()).default([]),
+});
+/** OAuth configuration */
+const oauthSchema = z.object({
+    credentialDir: z.string(),
+    providers: z.record(z.string(), oauthProviderSchema).default({}),
+});
+/** Top-level Jeeves Server configuration */
+const jeevesConfigSchema = z
+    .object({
+    port: z.number().int().positive().default(SERVER_PORT),
+    chromePath: z.string().min(1),
+    auth: authSchema,
+    /** Named scope definitions, referenced by insiders/keys/outsiderPolicy */
+    scopes: z.record(z.string(), scopesObjectSchema).default({}),
+    insiders: z.record(z.email(), insiderEntrySchema).default({}),
+    keys: z.record(z.string(), keyEntrySchema).default({}),
+    events: z.record(z.string(), eventConfigSchema).default({}),
+    eventTimeoutMs: z.number().positive().default(30_000),
+    eventLogPurgeMs: z.number().positive().default(2_592_000_000),
+    /** Maximum directory size in MB for ZIP export. Directories exceeding this are refused. */
+    maxZipSizeMb: z.number().positive().default(100),
+    /**
+     * Filesystem roots for the file browser (Linux only).
+     * Map of id → filesystem path. On Windows this is ignored (drives are auto-discovered).
+     * Example: \{ home: '/home/user', projects: '/opt/projects' \}
+     * Default: \{ root: '/' \}
+     */
+    roots: z.record(z.string(), z.string()).optional(),
+    /** @deprecated Mermaid is now bundled. This field is ignored but kept for backward compatibility. */
+    mermaidCliPath: z.string().optional(),
+    /**
+     * PlantUML rendering configuration.
+     * - jarPath: local PlantUML jar (requires Java). Tried first — supports !include.
+     * - servers: fallback PlantUML server URLs, tried in order.
+     *   The public community server (https://www.plantuml.com/plantuml) is always
+     *   appended as the last resort unless explicitly listed.
+     * If omitted entirely, only the community server is used.
+     */
+    plantuml: z
+        .object({
+        jarPath: z.string().optional(),
+        javaPath: z.string().optional(),
+        servers: z.array(z.url()).optional(),
+    })
+        .optional(),
+    /**
+     * Directory for cached rendered diagrams (content-addressed by source hash).
+     * Defaults to `.diagram-cache` in the server working directory.
+     */
+    diagramCachePath: z.string().optional(),
+    /**
+     * Global outsider policy — constrains which paths are eligible for outsider sharing.
+     * Uses the same allow/deny model as insider scopes.
+     * If omitted, all paths are shareable with outsiders.
+     */
+    outsiderPolicy: scopesSchema.optional(),
+    /** OAuth2 credential management configuration */
+    oauth: oauthSchema.optional(),
+    /**
+     * Shortlink redirects. Keys are slug identifiers (`[a-zA-Z0-9_-]+`),
+     * values are redirect targets — either relative paths (e.g. `/browse/...`)
+     * or absolute URLs (e.g. `https://example.com`).
+     *
+     * Accessible at `GET /go/:slug` without authentication.
+     */
+    go: z
+        .record(z.string().regex(/^[a-zA-Z0-9_-]+$/), z
+        .string()
+        .min(1)
+        .refine((v) => v.startsWith('/') || /^[a-z]+:\/\//i.test(v), {
+        message: 'Target must be a relative path starting with / or an absolute URL',
+    }))
+        .default({}),
+})
+    .superRefine((config, ctx) => {
+    // Google auth mode requires google config + sessionSecret
+    if (config.auth.modes.includes('google')) {
+        if (!config.auth.google) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'auth.google is required when auth.modes includes "google"',
+                path: ['auth', 'google'],
+            });
+        }
+        if (!config.auth.sessionSecret) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'auth.sessionSecret is required when auth.modes includes "google"',
+                path: ['auth', 'sessionSecret'],
+            });
+        }
+    }
+    // Keys auth mode requires at least one key
+    if (config.auth.modes.includes('keys') &&
+        Object.keys(config.keys).length === 0) {
+        ctx.addIssue({
+            code: 'custom',
+            message: 'At least one key is required when auth.modes includes "keys"',
+            path: ['keys'],
+        });
+    }
+    // _internal and _plugin keys must not have scopes
+    for (const reserved of ['_internal', '_plugin']) {
+        const key = config.keys[reserved];
+        if (key && typeof key === 'object' && 'scopes' in key && key.scopes) {
+            ctx.addIssue({
+                code: 'custom',
+                message: `${reserved} key must not have scopes (it is always unscoped)`,
+                path: ['keys', reserved],
+            });
+        }
+    }
+    // Validate all scope name references resolve to the top-level scopes map
+    const scopeNames = new Set(Object.keys(config.scopes));
+    const validateRefs = (refs, refPath) => {
+        for (const ref of refs) {
+            if (!scopeNames.has(ref)) {
+                ctx.addIssue({
+                    code: 'custom',
+                    message: `Scope "${ref}" is not defined in the top-level scopes map`,
+                    path: refPath,
+                });
+            }
+        }
+    };
+    for (const [email, entry] of Object.entries(config.insiders)) {
+        const refs = getScopeRefs(entry.scopes);
+        if (refs.length > 0)
+            validateRefs(refs, ['insiders', email, 'scopes']);
+    }
+    for (const [name, entry] of Object.entries(config.keys)) {
+        if (typeof entry === 'object') {
+            const refs = getScopeRefs(entry.scopes);
+            if (refs.length > 0)
+                validateRefs(refs, ['keys', name, 'scopes']);
+        }
+    }
+    const outsiderRefs = getScopeRefs(config.outsiderPolicy);
+    if (outsiderRefs.length > 0)
+        validateRefs(outsiderRefs, ['outsiderPolicy']);
+});
+
+export { DEPRECATED_CONFIG_PROPS, authModeSchema, authSchema, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, jeevesConfigSchema, keyEntrySchema, oauthProviderSchema, oauthSchema, scopesObjectSchema, scopesSchema };

package/dist/src/types.d.ts

@@ -88,4 +88,3 @@ export interface DriveEntry {
     letter: string;
     label: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,7 +1,15 @@
 {
   "name": "@karmaniverous/jeeves-server-core",
-  "version": "0.1.1",
+  "version": "0.1.3",
+  "author": "Jeeves",
+  "description": "Shared cryptographic utilities and API types for jeeves-server packages.",
+  "license": "MIT",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/karmaniverous/jeeves-server.git",
+    "directory": "packages/core"
+  },
   "files": [
     "dist"
   ],
@@ -10,14 +18,15 @@
   },
   "scripts": {
     "prebuild": "npx rimraf dist",
-    "build": "tsc",
+    "build": "cross-env NO_COLOR=1 rollup --config rollup.config.ts --configPlugin @rollup/plugin-typescript",
     "lint": "eslint .",
     "lint:fix": "eslint --fix .",
     "test": "vitest run --passWithNoTests",
     "typecheck": "tsc --noEmit",
     "changelog": "git-cliff -o CHANGELOG.md",
     "release": "dotenvx run -f .env.local -- release-it",
-    "release:pre": "dotenvx run -f .env.local -- release-it --no-git.requireBranch --github.prerelease --preRelease"
+    "release:pre": "dotenvx run -f .env.local -- release-it --no-git.requireBranch --github.prerelease --preRelease",
+    "postbuild": "npx rimraf dist/rollup.config.d.ts dist/rollup.config.d.ts.map"
   },
   "exports": {
     ".": {
@@ -28,10 +37,21 @@
     }
   },
   "types": "dist/src/index.d.ts",
+  "dependencies": {
+    "@karmaniverous/jeeves": "^0.5.11",
+    "zod": "^4.4.3"
+  },
   "devDependencies": {
-    "vitest": "^4.1.2",
+    "@dotenvx/dotenvx": "^1.69.1",
+    "@rollup/plugin-commonjs": "^29.0.2",
+    "@rollup/plugin-json": "^6.1.0",
+    "@rollup/plugin-node-resolve": "^16.0.3",
+    "@rollup/plugin-typescript": "^12.3.0",
+    "cross-env": "^10.1.0",
     "release-it": "^19.2.4",
-    "@dotenvx/dotenvx": "^1.59.1"
+    "rollup": "^4.60.4",
+    "tslib": "^2.8.1",
+    "vitest": "^4.1.7"
   },
   "engines": {
     "node": ">=22"

package/dist/src/crypto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAOtE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,MAAM,CAKR;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,MAAM,CAKR;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAM7D"}

package/dist/src/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,KAAK,eAAe,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,UAAU,EACV,wBAAwB,EACxB,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,YAAY,CAAC"}

package/dist/src/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oCAAoC;AACpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,gCAAgC;AAChC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,SAAS,GAAG,gBAAgB,GAAG,SAAS,GAAG,eAAe,CAAC;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,6CAA6C;AAC7C,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,kCAAkC;AAClC,MAAM,MAAM,kBAAkB,GAC1B,YAAY,GACZ,cAAc,GACd,cAAc,GACd,WAAW,GACX,iBAAiB,CAAC;AAEtB,qCAAqC;AACrC,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf"}

package/dist/src/types.js

@@ -1,6 +0,0 @@
-/**
- * Shared API request/response types between service and plugin.
- *
- * @packageDocumentation
- */
-export {};