@karmaniverous/jeeves-server-core 0.4.0 → 0.5.0

package/dist/src/configFeatureSchemas.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Config schemas for optional features: logging, OAuth credential
+ * management and branding.
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+/** Logging configuration. Not hot-reloadable — changes require service restart. */
+export declare const loggingConfigSchema: z.ZodObject<{
+    level: z.ZodOptional<z.ZodString>;
+    file: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Inferred logging config type. */
+export type LoggingConfig = z.infer<typeof loggingConfigSchema>;
+/** OAuth provider configuration */
+export declare const oauthProviderSchema: z.ZodObject<{
+    authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+    tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+    pkce: z.ZodDefault<z.ZodBoolean>;
+    defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** OAuth configuration */
+export declare const oauthSchema: z.ZodObject<{
+    credentialDir: z.ZodString;
+    providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+        tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/** Theme overrides for light and dark modes */
+export declare const themeOverridesSchema: z.ZodRecord<z.ZodString, z.ZodString>;
+/** Instance branding configuration */
+export declare const brandingSchema: z.ZodObject<{
+    name: z.ZodDefault<z.ZodString>;
+    emoji: z.ZodDefault<z.ZodString>;
+    theme: z.ZodOptional<z.ZodObject<{
+        light: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        dark: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    emailTemplate: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;

package/dist/src/configFeatureSchemas.js

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+
+/**
+ * Config schemas for optional features: logging, OAuth credential
+ * management and branding.
+ *
+ * @packageDocumentation
+ */
+/** Logging configuration. Not hot-reloadable — changes require service restart. */
+const loggingConfigSchema = z.object({
+    /** Log level. */
+    level: z
+        .string()
+        .optional()
+        .describe('Logging level (trace, debug, info, warn, error, fatal).'),
+    /** Log file path. */
+    file: z
+        .string()
+        .optional()
+        .describe('Path to log file (logs to stdout if omitted).'),
+});
+/** OAuth provider configuration */
+const oauthProviderSchema = z.object({
+    authUrl: z.string().pipe(z.url()),
+    tokenUrl: z.string().pipe(z.url()),
+    pkce: z.boolean().default(false),
+    defaultScopes: z.array(z.string()).default([]),
+});
+/** OAuth configuration */
+const oauthSchema = z.object({
+    credentialDir: z.string(),
+    providers: z.record(z.string(), oauthProviderSchema).default({}),
+});
+/** Theme overrides for light and dark modes */
+const themeOverridesSchema = z.record(z.string(), z.string());
+/** Instance branding configuration */
+const brandingSchema = z.object({
+    /** Instance display name (used in page title, navbar, emails) */
+    name: z.string().default('Jeeves Server'),
+    /** Instance emoji (used as home icon in navbar) */
+    emoji: z.string().default('🎩'),
+    /** CSS variable overrides grouped by theme mode */
+    theme: z
+        .object({
+        light: themeOverridesSchema.optional(),
+        dark: themeOverridesSchema.optional(),
+    })
+        .optional(),
+    /** Handlebars template for magic link emails. Supports \{\{magicLink\}\}, \{\{branding.name\}\}, \{\{branding.emoji\}\} */
+    emailTemplate: z.string().optional(),
+});
+
+export { brandingSchema, loggingConfigSchema, oauthProviderSchema, oauthSchema, themeOverridesSchema };

package/dist/src/configPrintStyles.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Config schemas for named PDF print styles (`printStyles`, #316) and the
+ * absolute-path check they share with other path settings.
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+/**
+ * Whether a path is absolute on POSIX (`/…`), Windows (`C:\…`, `C:/…`) or
+ * UNC (`\\server\…`), whatever platform validates the config.
+ *
+ * @param p - The path.
+ * @returns `true` when absolute.
+ */
+export declare const isAbsolutePath: (p: string) => boolean;
+/**
+ * An absolute file system path.
+ *
+ * @param label - What the path is, for the error message.
+ * @returns The schema.
+ */
+export declare const absolutePathSchema: (label: string) => z.ZodString;
+/** Paper formats Chromium's `page.pdf()` accepts (any case). */
+export declare const PRINT_PAPER_FORMATS: readonly ["letter", "legal", "tabloid", "ledger", "a0", "a1", "a2", "a3", "a4", "a5", "a6"];
+/** Page size and margins of a print style. */
+export declare const printPageSchema: z.ZodObject<{
+    format: z.ZodOptional<z.ZodString>;
+    width: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    height: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    margin: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** One print style: a stylesheet, with optional page options and templates. */
+export declare const printStyleSchema: z.ZodObject<{
+    css: z.ZodString;
+    page: z.ZodOptional<z.ZodObject<{
+        format: z.ZodOptional<z.ZodString>;
+        width: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        height: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        margin: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    headerTemplate: z.ZodOptional<z.ZodString>;
+    footerTemplate: z.ZodOptional<z.ZodString>;
+    assets: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Print style name: lower-case letters, digits and hyphens. */
+export declare const PRINT_STYLE_NAME: RegExp;
+/** Named print styles, chosen by documents with `jeeves: { print: <name> }`. */
+export declare const printStylesSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    css: z.ZodString;
+    page: z.ZodOptional<z.ZodObject<{
+        format: z.ZodOptional<z.ZodString>;
+        width: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        height: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        margin: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    headerTemplate: z.ZodOptional<z.ZodString>;
+    footerTemplate: z.ZodOptional<z.ZodString>;
+    assets: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+/** A configured print style. */
+export type PrintStyleConfig = z.infer<typeof printStyleSchema>;
+/** A print style's page options. */
+export type PrintPageConfig = z.infer<typeof printPageSchema>;

package/dist/src/configPrintStyles.js

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+
+/**
+ * Config schemas for named PDF print styles (`printStyles`, #316) and the
+ * absolute-path check they share with other path settings.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Whether a path is absolute on POSIX (`/…`), Windows (`C:\…`, `C:/…`) or
+ * UNC (`\\server\…`), whatever platform validates the config.
+ *
+ * @param p - The path.
+ * @returns `true` when absolute.
+ */
+const isAbsolutePath = (p) => p.startsWith('/') || /^[A-Za-z]:[\\/]/.test(p) || p.startsWith('\\\\');
+/**
+ * An absolute file system path.
+ *
+ * @param label - What the path is, for the error message.
+ * @returns The schema.
+ */
+const absolutePathSchema = (label) => z
+    .string()
+    .min(1)
+    .refine(isAbsolutePath, { message: `${label} must be an absolute path` });
+/** Paper formats Chromium's `page.pdf()` accepts (any case). */
+const PRINT_PAPER_FORMATS = [
+    'letter',
+    'legal',
+    'tabloid',
+    'ledger',
+    'a0',
+    'a1',
+    'a2',
+    'a3',
+    'a4',
+    'a5',
+    'a6',
+];
+/** A page dimension: a CSS length string (`210mm`) or pixels. */
+const pageLengthSchema = z.union([z.string().min(1), z.number().positive()]);
+/** Page size and margins of a print style. */
+const printPageSchema = z
+    .object({
+    /** Paper format (`Letter`, `A4`, …); exclusive with width/height. */
+    format: z
+        .string()
+        .refine((f) => PRINT_PAPER_FORMATS.includes(f.toLowerCase()), { message: `format must be one of ${PRINT_PAPER_FORMATS.join(', ')}` })
+        .optional(),
+    /** Page width; requires height. */
+    width: pageLengthSchema.optional(),
+    /** Page height; requires width. */
+    height: pageLengthSchema.optional(),
+    /** CSS margin shorthand: one to four lengths (`14mm 14mm 16mm 14mm`). */
+    margin: z
+        .string()
+        .regex(/^\s*\S+(?:\s+\S+){0,3}\s*$/, {
+        message: 'margin must be one to four CSS lengths',
+    })
+        .optional(),
+})
+    .superRefine((page, ctx) => {
+    const sized = page.width !== undefined || page.height !== undefined;
+    if (page.format !== undefined && sized)
+        ctx.addIssue({
+            code: 'custom',
+            message: 'Use format or width and height, not both',
+            path: ['format'],
+        });
+    if (sized && (page.width === undefined || page.height === undefined))
+        ctx.addIssue({
+            code: 'custom',
+            message: 'width and height must be given together',
+            path: [page.width === undefined ? 'width' : 'height'],
+        });
+});
+/** One print style: a stylesheet, with optional page options and templates. */
+const printStyleSchema = z.object({
+    /** Stylesheet injected after the default print CSS. */
+    css: absolutePathSchema('css'),
+    /** Page size and margins for `page.pdf()`. */
+    page: printPageSchema.optional(),
+    /** Chromium header template (HTML). */
+    headerTemplate: absolutePathSchema('headerTemplate').optional(),
+    /** Chromium footer template (HTML). */
+    footerTemplate: absolutePathSchema('footerTemplate').optional(),
+    /** Directory whose files the CSS and templates may inline. */
+    assets: absolutePathSchema('assets').optional(),
+});
+/** Print style name: lower-case letters, digits and hyphens. */
+const PRINT_STYLE_NAME = /^[a-z0-9][a-z0-9-]*$/;
+/** Named print styles, chosen by documents with `jeeves: { print: <name> }`. */
+const printStylesSchema = z.record(z.string().regex(PRINT_STYLE_NAME, {
+    message: 'Print style names are lower-case letters, digits and hyphens, starting with a letter or digit',
+}), printStyleSchema);
+
+export { PRINT_PAPER_FORMATS, PRINT_STYLE_NAME, absolutePathSchema, isAbsolutePath, printPageSchema, printStyleSchema, printStylesSchema };

package/dist/src/configPrintStyles.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/crypto.d.ts

@@ -1,21 +1,14 @@
 /**
  * Cryptographic utilities for HMAC key computation and verification.
  *
+ * The link-key functions (`computeInsiderKey`, `computeOutsiderKeyWithExpiry`,
+ * `computePathKey`) are re-exported from `@karmaniverous/jeeves`, which holds
+ * the one implementation (#307). The deep-share key and the timing-safe
+ * comparison stay here: jeeves has no equivalent.
+ *
  * @packageDocumentation
  */
-/**
- * Compute path-specific key: HMAC-SHA256(apiKey, normalizedPath)
- */
-export declare function computePathKey(apiKey: string, urlPath: string): string;
-/**
- * Compute insider key: HMAC-SHA256(apiKey, "insider")
- * Works for any path, grants full navigation
- */
-export declare function computeInsiderKey(apiKey: string): string;
-/**
- * Compute outsider key with expiry: HMAC-SHA256(apiKey, path + "|" + expiry)
- */
-export declare function computeOutsiderKeyWithExpiry(apiKey: string, urlPath: string, expiry: string | number): string;
+export { computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, } from '@karmaniverous/jeeves';
 /**
  * Deep share key parameters
  */

package/dist/src/crypto.js

@@ -1,41 +1,16 @@
 import crypto from 'node:crypto';
+export { computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey } from '@karmaniverous/jeeves';
 
 /**
  * Cryptographic utilities for HMAC key computation and verification.
  *
+ * The link-key functions (`computeInsiderKey`, `computeOutsiderKeyWithExpiry`,
+ * `computePathKey`) are re-exported from `@karmaniverous/jeeves`, which holds
+ * the one implementation (#307). The deep-share key and the timing-safe
+ * comparison stay here: jeeves has no equivalent.
+ *
  * @packageDocumentation
  */
-/**
- * Compute path-specific key: HMAC-SHA256(apiKey, normalizedPath)
- */
-function computePathKey(apiKey, urlPath) {
-    const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
-    const hash = crypto
-        .createHmac('sha256', apiKey)
-        .update(normalized)
-        .digest('hex');
-    return hash.substring(0, 32);
-}
-/**
- * Compute insider key: HMAC-SHA256(apiKey, "insider")
- * Works for any path, grants full navigation
- */
-function computeInsiderKey(apiKey) {
-    const hash = crypto
-        .createHmac('sha256', apiKey)
-        .update('insider')
-        .digest('hex');
-    return hash.substring(0, 32);
-}
-/**
- * Compute outsider key with expiry: HMAC-SHA256(apiKey, path + "|" + expiry)
- */
-function computeOutsiderKeyWithExpiry(apiKey, urlPath, expiry) {
-    const normalized = urlPath.toLowerCase().replace(/^\/+|\/+$/g, '');
-    const data = `${normalized}|${String(expiry)}`;
-    const hash = crypto.createHmac('sha256', apiKey).update(data).digest('hex');
-    return hash.substring(0, 32);
-}
 /**
  * Compute deep share key: HMAC-SHA256(seed, path + "|" + d + "|" + dirs + "|" + stack + "|" + exp)
  * Used for share links with depth \> 0 or dirs enabled.
@@ -58,4 +33,4 @@ function timingSafeEqual(a, b) {
     }
 }
 
-export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, timingSafeEqual };
+export { computeDeepShareKey, timingSafeEqual };

package/dist/src/crypto.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Known-vector tests for the link-key functions core re-exports from
+ * `@karmaniverous/jeeves` (#307). Every vector was computed with core's own
+ * implementation before it was deleted (branch base f0b1417): equal output
+ * here means links signed before and after the switch stay valid.
+ */
+export {};

package/dist/src/errors.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The client's half of the server error contract (#315): every `SERVER_*` code an error body can carry (`SERVER_ERROR_CODES`) and the HTTP status each is sent with (`SERVER_ERROR_STATUS`). The body is Fastify's standard error body (`errorBodySchema` from `@karmaniverous/jeeves/catalog`). Pure data.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Every `SERVER_*` code a non-2xx jeeves-server response can carry. The body
+ * is `{ statusCode, code?, error, message }`; other codes come from jeeves
+ * (`JEEVES_*`) and Fastify (`FST_ERR_*`), and an unexpected failure is a
+ * masked 500 with no `code`. The status of each is in
+ * {@link SERVER_ERROR_STATUS}.
+ *
+ * - `SERVER_UNAUTHORIZED` (401): no valid credential for the route.
+ * - `SERVER_FORBIDDEN` (403): an admin route called by an identity with
+ *   scopes.
+ * - `SERVER_OUT_OF_SCOPE` (403): a path outside the caller's scopes.
+ * - `SERVER_INSIDER_REQUIRED` (403): a share credential on a route that
+ *   needs an insider.
+ * - `SERVER_INVALID_PATH` (400): a path that is empty, has a `..` segment or
+ *   is not absolute where an absolute path is required.
+ * - `SERVER_NOT_FOUND` (404): no file, directory, page, route or credential
+ *   there (a path under no configured root included).
+ * - `SERVER_NOT_A_FILE` (400): a file route addressed a directory.
+ * - `SERVER_NOT_A_DIRECTORY` (400): a directory route addressed a file.
+ * - `SERVER_EXPORT_UNSUPPORTED` (400): no export in that format for that
+ *   path.
+ * - `SERVER_EXPORT_FAILED` (502): the document did not render.
+ * - `SERVER_ARCHIVE_TOO_LARGE` (413): the directory exceeds `maxZipSizeMb`.
+ * - `SERVER_CHROME_UNAVAILABLE` (503): no usable Chrome for the export.
+ * - `SERVER_WATCHER_UNAVAILABLE` (502): jeeves-watcher failed or can't be
+ *   reached.
+ * - `SERVER_RUNNER_UNAVAILABLE` (503): jeeves-runner can't be reached.
+ * - `SERVER_MACHINE_KEY_NOT_ROTATABLE` (403): `rotateKey` with a machine
+ *   key (machine seeds rotate through config).
+ * - `SERVER_EMAIL_UNAVAILABLE` (500): the sign-in email could not be sent.
+ * - `SERVER_INTERNAL_KEY_MISSING` (500): no `_internal` key is configured.
+ * - `SERVER_CONFLICT` (409): a block edit raced another change.
+ * - `SERVER_SIGN_IN_REJECTED` (403): sign-in refused for that account.
+ * - `SERVER_INVALID_REQUEST` (400): a request field is missing or invalid in
+ *   a way the route checks itself (a line range, an action's fields, an
+ *   OAuth origin).
+ * - `SERVER_NOT_CONFIGURED` (501): the feature the route serves is not
+ *   configured on this server (OAuth).
+ * - `SERVER_OAUTH_REFRESH_FAILED` (401): a stored OAuth credential expired
+ *   and could not be refreshed; the account must be authorized again.
+ */
+export declare const SERVER_ERROR_CODES: readonly ["SERVER_UNAUTHORIZED", "SERVER_FORBIDDEN", "SERVER_OUT_OF_SCOPE", "SERVER_INSIDER_REQUIRED", "SERVER_INVALID_PATH", "SERVER_NOT_FOUND", "SERVER_NOT_A_FILE", "SERVER_NOT_A_DIRECTORY", "SERVER_EXPORT_UNSUPPORTED", "SERVER_EXPORT_FAILED", "SERVER_ARCHIVE_TOO_LARGE", "SERVER_CHROME_UNAVAILABLE", "SERVER_WATCHER_UNAVAILABLE", "SERVER_RUNNER_UNAVAILABLE", "SERVER_MACHINE_KEY_NOT_ROTATABLE", "SERVER_EMAIL_UNAVAILABLE", "SERVER_INTERNAL_KEY_MISSING", "SERVER_CONFLICT", "SERVER_SIGN_IN_REJECTED", "SERVER_INVALID_REQUEST", "SERVER_NOT_CONFIGURED", "SERVER_OAUTH_REFRESH_FAILED"];
+/** A `SERVER_*` error code. */
+export type ServerErrorCode = (typeof SERVER_ERROR_CODES)[number];
+/** The HTTP status each `SERVER_*` code is sent with (one per code). */
+export declare const SERVER_ERROR_STATUS: Readonly<Record<ServerErrorCode, number>>;

package/dist/src/errors.js

@@ -0,0 +1,97 @@
+/**
+ * The client's half of the server error contract (#315): every `SERVER_*` code an error body can carry (`SERVER_ERROR_CODES`) and the HTTP status each is sent with (`SERVER_ERROR_STATUS`). The body is Fastify's standard error body (`errorBodySchema` from `@karmaniverous/jeeves/catalog`). Pure data.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Every `SERVER_*` code a non-2xx jeeves-server response can carry. The body
+ * is `{ statusCode, code?, error, message }`; other codes come from jeeves
+ * (`JEEVES_*`) and Fastify (`FST_ERR_*`), and an unexpected failure is a
+ * masked 500 with no `code`. The status of each is in
+ * {@link SERVER_ERROR_STATUS}.
+ *
+ * - `SERVER_UNAUTHORIZED` (401): no valid credential for the route.
+ * - `SERVER_FORBIDDEN` (403): an admin route called by an identity with
+ *   scopes.
+ * - `SERVER_OUT_OF_SCOPE` (403): a path outside the caller's scopes.
+ * - `SERVER_INSIDER_REQUIRED` (403): a share credential on a route that
+ *   needs an insider.
+ * - `SERVER_INVALID_PATH` (400): a path that is empty, has a `..` segment or
+ *   is not absolute where an absolute path is required.
+ * - `SERVER_NOT_FOUND` (404): no file, directory, page, route or credential
+ *   there (a path under no configured root included).
+ * - `SERVER_NOT_A_FILE` (400): a file route addressed a directory.
+ * - `SERVER_NOT_A_DIRECTORY` (400): a directory route addressed a file.
+ * - `SERVER_EXPORT_UNSUPPORTED` (400): no export in that format for that
+ *   path.
+ * - `SERVER_EXPORT_FAILED` (502): the document did not render.
+ * - `SERVER_ARCHIVE_TOO_LARGE` (413): the directory exceeds `maxZipSizeMb`.
+ * - `SERVER_CHROME_UNAVAILABLE` (503): no usable Chrome for the export.
+ * - `SERVER_WATCHER_UNAVAILABLE` (502): jeeves-watcher failed or can't be
+ *   reached.
+ * - `SERVER_RUNNER_UNAVAILABLE` (503): jeeves-runner can't be reached.
+ * - `SERVER_MACHINE_KEY_NOT_ROTATABLE` (403): `rotateKey` with a machine
+ *   key (machine seeds rotate through config).
+ * - `SERVER_EMAIL_UNAVAILABLE` (500): the sign-in email could not be sent.
+ * - `SERVER_INTERNAL_KEY_MISSING` (500): no `_internal` key is configured.
+ * - `SERVER_CONFLICT` (409): a block edit raced another change.
+ * - `SERVER_SIGN_IN_REJECTED` (403): sign-in refused for that account.
+ * - `SERVER_INVALID_REQUEST` (400): a request field is missing or invalid in
+ *   a way the route checks itself (a line range, an action's fields, an
+ *   OAuth origin).
+ * - `SERVER_NOT_CONFIGURED` (501): the feature the route serves is not
+ *   configured on this server (OAuth).
+ * - `SERVER_OAUTH_REFRESH_FAILED` (401): a stored OAuth credential expired
+ *   and could not be refreshed; the account must be authorized again.
+ */
+const SERVER_ERROR_CODES = [
+    'SERVER_UNAUTHORIZED',
+    'SERVER_FORBIDDEN',
+    'SERVER_OUT_OF_SCOPE',
+    'SERVER_INSIDER_REQUIRED',
+    'SERVER_INVALID_PATH',
+    'SERVER_NOT_FOUND',
+    'SERVER_NOT_A_FILE',
+    'SERVER_NOT_A_DIRECTORY',
+    'SERVER_EXPORT_UNSUPPORTED',
+    'SERVER_EXPORT_FAILED',
+    'SERVER_ARCHIVE_TOO_LARGE',
+    'SERVER_CHROME_UNAVAILABLE',
+    'SERVER_WATCHER_UNAVAILABLE',
+    'SERVER_RUNNER_UNAVAILABLE',
+    'SERVER_MACHINE_KEY_NOT_ROTATABLE',
+    'SERVER_EMAIL_UNAVAILABLE',
+    'SERVER_INTERNAL_KEY_MISSING',
+    'SERVER_CONFLICT',
+    'SERVER_SIGN_IN_REJECTED',
+    'SERVER_INVALID_REQUEST',
+    'SERVER_NOT_CONFIGURED',
+    'SERVER_OAUTH_REFRESH_FAILED',
+];
+/** The HTTP status each `SERVER_*` code is sent with (one per code). */
+const SERVER_ERROR_STATUS = {
+    SERVER_UNAUTHORIZED: 401,
+    SERVER_FORBIDDEN: 403,
+    SERVER_OUT_OF_SCOPE: 403,
+    SERVER_INSIDER_REQUIRED: 403,
+    SERVER_INVALID_PATH: 400,
+    SERVER_NOT_FOUND: 404,
+    SERVER_NOT_A_FILE: 400,
+    SERVER_NOT_A_DIRECTORY: 400,
+    SERVER_EXPORT_UNSUPPORTED: 400,
+    SERVER_EXPORT_FAILED: 502,
+    SERVER_ARCHIVE_TOO_LARGE: 413,
+    SERVER_CHROME_UNAVAILABLE: 503,
+    SERVER_WATCHER_UNAVAILABLE: 502,
+    SERVER_RUNNER_UNAVAILABLE: 503,
+    SERVER_MACHINE_KEY_NOT_ROTATABLE: 403,
+    SERVER_EMAIL_UNAVAILABLE: 500,
+    SERVER_INTERNAL_KEY_MISSING: 500,
+    SERVER_CONFLICT: 409,
+    SERVER_SIGN_IN_REJECTED: 403,
+    SERVER_INVALID_REQUEST: 400,
+    SERVER_NOT_CONFIGURED: 501,
+    SERVER_OAUTH_REFRESH_FAILED: 401,
+};
+
+export { SERVER_ERROR_CODES, SERVER_ERROR_STATUS };

package/dist/src/errors.test.d.ts

@@ -0,0 +1,4 @@
+/**
+ * `SERVER_ERROR_CODES` / `SERVER_ERROR_STATUS` (next-api-catalog.md, Errors): the code list with one status per code.
+ */
+export {};

package/dist/src/index.d.ts

@@ -1,10 +1,12 @@
 /**
- * Shared utilities and types for jeeves-server packages.
+ * jeeves-server-core's main entry: the endpoint catalog with its schemas and error codes (also on the browser-safe `./catalog` sub-path), the OpenAPI document, the config schema, URL-key helpers and the Node-only link-key functions.
  *
  * @packageDocumentation
  */
+export * from './catalog/index.js';
+export { absolutePathSchema, isAbsolutePath, PRINT_PAPER_FORMATS, PRINT_STYLE_NAME, type PrintPageConfig, printPageSchema, type PrintStyleConfig, printStyleSchema, printStylesSchema, } from './configPrintStyles.js';
 export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, type DeepShareParams, timingSafeEqual, } from './crypto.js';
-export { type EndpointEntry, serverEndpoints } from './endpoints.js';
+export { SERVER_OPENAPI_DOCUMENT } from './openapi.js';
 export { type AuthMode, authModeSchema, authSchema, type Branding, brandingSchema, DEFAULT_BRANDING, DEPRECATED_CONFIG_PROPS, emailAuthSchema, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, type JeevesConfig, jeevesConfigSchema, keyEntrySchema, type LoggingConfig, loggingConfigSchema, oauthProviderSchema, oauthSchema, scopesObjectSchema, scopesSchema, themeOverridesSchema, } from './schema.js';
 export type { AuthStatusResponse, DriveEntry, ExportCacheClearResponse, ExportLink, FileMutationAction, LinkInfoResponse, OAuthStartRequest, OAuthStartResponse, RotateKeyResponse, ShareForRequest, ShareForResponse, ShareRequest, ShareResponse, } from './types.js';
 export { getUrlKey, LEGACY_URL_KEY_PARAM, URL_KEY_PARAM } from './urlKey.js';

package/dist/src/index.js

@@ -1,4 +1,18 @@
-export { computeDeepShareKey, computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey, timingSafeEqual } from './crypto.js';
-export { serverEndpoints } from './endpoints.js';
-export { DEFAULT_BRANDING, DEPRECATED_CONFIG_PROPS, authModeSchema, authSchema, brandingSchema, emailAuthSchema, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, jeevesConfigSchema, keyEntrySchema, loggingConfigSchema, oauthProviderSchema, oauthSchema, scopesObjectSchema, scopesSchema, themeOverridesSchema } from './schema.js';
+export { SERVER_ERROR_CODES, SERVER_ERROR_STATUS } from './errors.js';
+export { breadcrumbSchema, browseResponseSchema, directoryEntrySchema, directoryListingSchema, driveSchema, drivesResponseSchema, exportCacheClearResponseSchema, exportLinkSchema, fileContentQuerySchema, fileContentResponseSchema, fileMetadataSchema, fileWriteBodySchema, fileWriteResponseSchema, headingSchema, linkInfoResponseSchema, okResponseSchema } from './catalog/contentSchemas.js';
+export { eventLogEntrySchema, receiveEventResponseSchema } from './catalog/eventEntries.js';
+export { FILE_MUTATION_ACTIONS, FILE_MUTATION_REQUIRED_FIELDS, fileMutateBodySchema } from './catalog/fileMutateSchema.js';
+export { oauthCredentialQuerySchema, oauthStartBodySchema, oauthStartResponseSchema, oauthStatusResponseSchema, oauthTokenResponseSchema } from './catalog/oauthEntries.js';
+export { shareQuerySchema } from './catalog/route.js';
+export { SERVER_CATALOG } from './catalog/serverCatalog.js';
+export { linkResponseSchema, resolvePathResponseSchema, rotateKeyResponseSchema, shareBodySchema, shareForBodySchema, shareForResponseSchema, shareResponseSchema } from './catalog/sharingEntries.js';
+export { eventQueueHealthSchema, serverHealthSchema, serviceProbeSchema } from './catalog/statusSchemas.js';
+export { authStatusQuerySchema, authStatusResponseSchema, healthResponseSchema, insiderKeyResponseSchema, pathKeyResponseSchema, searchBodySchema, searchResponseSchema, searchResultSchema, sendMagicLinkBodySchema, sendMagicLinkResponseSchema } from './catalog/utilitySchemas.js';
+export { PRINT_PAPER_FORMATS, PRINT_STYLE_NAME, absolutePathSchema, isAbsolutePath, printPageSchema, printStyleSchema, printStylesSchema } from './configPrintStyles.js';
+export { computeDeepShareKey, timingSafeEqual } from './crypto.js';
+export { SERVER_OPENAPI_DOCUMENT } from './openapi.js';
+export { DEFAULT_BRANDING, DEPRECATED_CONFIG_PROPS, jeevesConfigSchema } from './schema.js';
 export { LEGACY_URL_KEY_PARAM, URL_KEY_PARAM, getUrlKey } from './urlKey.js';
+export { authModeSchema, authSchema, emailAuthSchema, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, keyEntrySchema, scopesObjectSchema, scopesSchema } from './configAuthSchema.js';
+export { brandingSchema, loggingConfigSchema, oauthProviderSchema, oauthSchema, themeOverridesSchema } from './configFeatureSchemas.js';
+export { computeInsiderKey, computeOutsiderKeyWithExpiry, computePathKey } from '@karmaniverous/jeeves';

package/dist/src/openapi.d.ts

@@ -0,0 +1,13 @@
+/**
+ * jeeves-server-core's committed OpenAPI 3.1 document for `SERVER_CATALOG`, bundled as `SERVER_OPENAPI_DOCUMENT` (the service serves it at `GET /openapi.json`). Also published as the `@karmaniverous/jeeves-server-core/openapi.json` sub-path for out-of-repo generators. Pure.
+ *
+ * @packageDocumentation
+ */
+/**
+ * The OpenAPI document generated from `SERVER_CATALOG` (`npm run openapi`).
+ *
+ * @remarks
+ * Typed loosely so core's declarations don't depend on OpenAPI type
+ * packages.
+ */
+export declare const SERVER_OPENAPI_DOCUMENT: Readonly<Record<string, unknown>>;

package/dist/src/openapi.js

@@ -0,0 +1,17 @@
+import document from '../openapi.json.js';
+
+/**
+ * jeeves-server-core's committed OpenAPI 3.1 document for `SERVER_CATALOG`, bundled as `SERVER_OPENAPI_DOCUMENT` (the service serves it at `GET /openapi.json`). Also published as the `@karmaniverous/jeeves-server-core/openapi.json` sub-path for out-of-repo generators. Pure.
+ *
+ * @packageDocumentation
+ */
+/**
+ * The OpenAPI document generated from `SERVER_CATALOG` (`npm run openapi`).
+ *
+ * @remarks
+ * Typed loosely so core's declarations don't depend on OpenAPI type
+ * packages.
+ */
+const SERVER_OPENAPI_DOCUMENT = document;
+
+export { SERVER_OPENAPI_DOCUMENT };

package/dist/src/openapi.test.d.ts

@@ -0,0 +1,4 @@
+/**
+ * The committed OpenAPI document: in step with `SERVER_CATALOG` (drift; run `npm run openapi`), a valid OpenAPI 3.1 document with one operation per entry, security per access class and the core version, exported and published as a sub-path, regenerated after a release bump.
+ */
+export {};