@kici-dev/shared 0.1.12 → 0.1.14

package/dist/cold-store/chunk-encoder.js

@@ -1,5 +1,5 @@
 import "../chunk-gOLHoazu.js";
-import { sha256 } from "../crypto.js";
+import { sha256 } from "@kici-dev/core";
 import { gzipSync } from "node:zlib";
 //#region src/cold-store/chunk-encoder.ts
 /**

package/dist/cold-store/chunk-id.js

@@ -1,5 +1,5 @@
 import "../chunk-gOLHoazu.js";
-import { sha256 } from "../crypto.js";
+import { sha256 } from "@kici-dev/core";
 //#region src/cold-store/chunk-id.ts
 /**
 * Deterministic chunk ID computation.

package/dist/cold-store/cold-store.js

@@ -1,5 +1,4 @@
 import "../chunk-gOLHoazu.js";
-import { sha256 } from "../crypto.js";
 import { createS3Client } from "../s3-client.js";
 import { chunkObjectKey, encodeKeySegment, tablePrefix, tenantDayPrefix } from "./key.js";
 import { coldDaysToBucket, isLongerColdRetention } from "./bucket.js";
@@ -7,6 +6,7 @@ import { computeChunkId } from "./chunk-id.js";
 import { decodeChunk, encodeChunk } from "./chunk-encoder.js";
 import { parseManifest, serializeManifest } from "./manifest.js";
 import { coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal } from "./metrics.js";
+import { sha256 } from "@kici-dev/core";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand } from "@aws-sdk/client-s3";
 //#region src/cold-store/cold-store.ts
 /**

package/dist/db-admin.d.ts

@@ -60,6 +60,16 @@ export interface EnsureDatabaseOpts {
      * grant is a no-op).
      */
     revokeConnectFromPublic?: boolean;
+    /**
+     * After creating (or finding) the database — and after the optional
+     * `REVOKE CONNECT … FROM PUBLIC` — `GRANT CONNECT ON DATABASE "<name>"
+     * TO "<role>"` for each role here. Pairs with `revokeConnectFromPublic`
+     * to re-grant CONNECT to the specific non-PUBLIC roles that legitimately
+     * need it once the default PUBLIC grant is revoked. Idempotent (GRANT on
+     * an already-present grant is a no-op). Each name is validated as a SQL
+     * identifier before interpolation.
+     */
+    grantConnectToRoles?: string[];
 }
 /**
  * CREATE DATABASE IF NOT EXISTS (idempotent). With no `opts`, the URL's

package/dist/db-admin.js

@@ -111,6 +111,10 @@ async function ensureDatabase(databaseUrl, opts = {}) {
 			outcome = "created";
 		}
 		if (opts.revokeConnectFromPublic) await pool.query(`REVOKE CONNECT ON DATABASE "${dbName}" FROM PUBLIC`);
+		for (const role of opts.grantConnectToRoles ?? []) {
+			assertValidIdentifier(role, "grant-connect role");
+			await pool.query(`GRANT CONNECT ON DATABASE "${dbName}" TO "${role}"`);
+		}
 		return outcome;
 	});
 }

package/dist/env/define-env.js

@@ -60,9 +60,11 @@ function extractDefault(field) {
 		const def = t.def;
 		if (!def) return void 0;
 		if (def.type === "default" && def.defaultValue !== void 0) {
-			const v = typeof def.defaultValue === "function" ? "<computed>" : def.defaultValue;
-			if (v === "" || v === void 0) return void 0;
-			return JSON.stringify(v);
+			const probe1 = def.defaultValue;
+			const probe2 = def.defaultValue;
+			if (typeof probe1 === "function" || probe1 !== probe2) return "\"<computed>\"";
+			if (probe1 === "" || probe1 === void 0) return void 0;
+			return JSON.stringify(probe1);
 		}
 		if (def.in) {
 			t = def.in;
@@ -80,7 +82,7 @@ function isOptional(field) {
 	for (let i = 0; i < 6; i++) {
 		const def = t.def;
 		if (!def) return false;
-		if (def.type === "optional" || def.type === "default") return true;
+		if (def.type === "optional" || def.type === "default" || def.type === "prefault") return true;
 		if (def.in) {
 			t = def.in;
 			continue;
@@ -93,6 +95,26 @@ function isOptional(field) {
 	}
 	return false;
 }
+/**
+* Walk through `.optional()` / `.default(...)` / `.prefault(...)` wrappers to
+* find a nested ZodObject's `.shape`. Returns undefined if `field` does not
+* (eventually) wrap a ZodObject. Mirrors the unwrap loop in
+* `extractDefault` / `isOptional` so that a nested object can be wrapped in
+* any of the common compositional modifiers and still be walked for docs.
+*/
+function findInnerShape(field) {
+	let t = field;
+	for (let i = 0; i < 8; i++) {
+		const node = t;
+		if (node.shape) return node.shape;
+		if (node.def?.shape) return node.def.shape;
+		if (node.def?.innerType) {
+			t = node.def.innerType;
+			continue;
+		}
+		return;
+	}
+}
 function describeFieldRecursive(shape, envMap, fieldPath, descriptions, out) {
 	for (const [name, field] of Object.entries(shape)) {
 		const path = fieldPath ? `${fieldPath}.${name}` : name;
@@ -113,8 +135,7 @@ function describeFieldRecursive(shape, envMap, fieldPath, descriptions, out) {
 				description: explicitDesc ?? zodDesc ?? def2?.description
 			});
 		} else {
-			const nested = field;
-			const innerShape = nested.shape ?? nested.def?.shape;
+			const innerShape = findInnerShape(field);
 			if (innerShape) describeFieldRecursive(innerShape, mapping, path, descriptions, out);
 		}
 	}

package/dist/env/logger-env.d.ts

@@ -20,9 +20,9 @@ export declare const LoggerEnvSchema: z.ZodObject<{
     KICI_LOG_MAX_SIZE: z.ZodDefault<z.ZodString>;
     KICI_LOG_RETENTION_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     KICI_LOG_FORMAT: z.ZodDefault<z.ZodEnum<{
-        plain: "plain";
         json: "json";
         auto: "auto";
+        plain: "plain";
     }>>;
     KICI_CLUSTER_INSTANCE_ID: z.ZodOptional<z.ZodString>;
     KICI_AGENT_ID: z.ZodOptional<z.ZodString>;

package/dist/graceful-shutdown.js

@@ -1,5 +1,5 @@
 import "./chunk-gOLHoazu.js";
-import { toErrorMessage } from "./error.js";
+import { toErrorMessage } from "@kici-dev/core";
 //#region src/graceful-shutdown.ts
 /**
 * Wire up SIGTERM / SIGINT (and optionally uncaughtException /

package/dist/idempotency.d.ts

@@ -1,68 +1,2 @@
-/**
- * Idempotent-step primitive: a check / prompt / apply runner that is
- * UI-agnostic and embeddable across the product.
- *
- * The pattern: every destructive operation on shared state (prod infra,
- * npm, git remotes, DNS, TF state, workflow step side effects) is wrapped
- * as an IdempotentStep whose check() returns a typed drift value or null.
- * Null means the system is already in the desired state — the runner
- * silently skips, optionally invoking whenInSync() to surface the
- * already-satisfied resource (e.g. an existing resource id). A non-null
- * drift means apply() would change state — the runner asks the caller's
- * confirm() before invoking apply(), unless yes or dryRun overrides are
- * set. apply() returns the typed result of the change for the caller.
- *
- * The runner has no UI dependency. CLI consumers pass an inquirer-backed
- * confirm; future SDK / agent consumers pass their own policy function.
- * See `.claude/rules/idempotency.md` for the full rule and adopters.
- */
-export interface IdempotentStep<TDrift, TInSync = void, TApplied = void> {
-    /** Human-readable name; appears in logs and the confirm prompt. */
-    name: string;
-    /** Read-only inspection. Returns drift value if apply() would change
-     *  state, or null if the system is already in the desired state. */
-    check: () => Promise<TDrift | null>;
-    /** Multi-line description of what apply() would do, given drift. */
-    summarize: (drift: TDrift) => string;
-    /** Destructive action that brings the system into the desired state.
-     *  Its return value is surfaced in StepResult.result on the 'applied'
-     *  outcome. */
-    apply: (drift: TDrift) => Promise<TApplied>;
-    /** Optional: runs when check() returns null. Use this to fetch the
-     *  already-satisfied resource (e.g. read the existing id when a
-     *  create-if-missing was already done). Return value is surfaced in
-     *  StepResult.result on the 'skipped' outcome. */
-    whenInSync?: () => Promise<TInSync>;
-}
-export type ConfirmFn = (message: string) => Promise<boolean>;
-export interface RunOptions {
-    /** Pluggable confirm. Required unless `yes` or `dryRun` is set. */
-    confirm?: ConfirmFn;
-    /** Breakglass: skip prompts, apply on drift. The CALLER prints any
-     *  loud "auto-confirm" banner before invoking the runner. */
-    yes?: boolean;
-    /** Report only; bypass confirm; never call apply(). */
-    dryRun?: boolean;
-    /** Sink for `name`-prefixed status lines. Defaults to console.log. */
-    log?: (line: string) => void;
-}
-export type StepOutcome = 'skipped' | 'applied' | 'declined' | 'dry-run';
-export type StepResult<TDrift, TInSync = void, TApplied = void> = {
-    outcome: 'skipped';
-    drift: null;
-    result: TInSync;
-} | {
-    outcome: 'applied';
-    drift: TDrift;
-    result: TApplied;
-} | {
-    outcome: 'declined';
-    drift: TDrift;
-    result: undefined;
-} | {
-    outcome: 'dry-run';
-    drift: TDrift;
-    result: undefined;
-};
-export declare function runIdempotentStep<TDrift, TInSync = void, TApplied = void>(step: IdempotentStep<TDrift, TInSync, TApplied>, opts?: RunOptions): Promise<StepResult<TDrift, TInSync, TApplied>>;
+export * from '@kici-dev/core/idempotency';
 //# sourceMappingURL=idempotency.d.ts.map

package/dist/idempotency.js

@@ -1,49 +1,3 @@
 import "./chunk-gOLHoazu.js";
-//#region src/idempotency.ts
-async function runIdempotentStep(step, opts = {}) {
-	const log = opts.log ?? ((line) => console.log(line));
-	const drift = await step.check();
-	if (drift === null) {
-		log(`✓ ${step.name} — in sync, skipping`);
-		return {
-			outcome: "skipped",
-			drift: null,
-			result: step.whenInSync ? await step.whenInSync() : void 0
-		};
-	}
-	log(`! ${step.name} — drift detected:`);
-	for (const line of step.summarize(drift).split("\n")) log(`    ${line}`);
-	if (opts.dryRun) {
-		log(`  (dry-run; would apply)`);
-		return {
-			outcome: "dry-run",
-			drift,
-			result: void 0
-		};
-	}
-	let approved;
-	if (opts.yes) approved = true;
-	else {
-		if (!opts.confirm) throw new Error(`runIdempotentStep(${step.name}): drift detected but no confirm callback provided and yes/dryRun not set. Pass opts.confirm, opts.yes, or opts.dryRun.`);
-		approved = await opts.confirm(`Apply ${step.name}?`);
-	}
-	if (!approved) {
-		log(`  declined; skipping`);
-		return {
-			outcome: "declined",
-			drift,
-			result: void 0
-		};
-	}
-	const appliedResult = await step.apply(drift);
-	log(`✓ ${step.name} — applied`);
-	return {
-		outcome: "applied",
-		drift,
-		result: appliedResult
-	};
-}
-//#endregion
-export { runIdempotentStep };
-
-//# sourceMappingURL=idempotency.js.map
+export * from "@kici-dev/core/idempotency";
+export {};

package/dist/index.d.ts

@@ -1,16 +1,10 @@
+export * from '@kici-dev/core';
 export { RingBuffer } from './ring-buffer.js';
-export { toErrorMessage, serializeError } from './error.js';
 export { createPool, createDb } from './db.js';
 export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, seedEnvironmentDirect, seedEnvironmentBindingDirect, setEnvironmentPolicyDirect, listEnvironmentsDirect, showEnvironmentDirect, createEnvironmentTemplateDirect, setEnvironmentSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, waitForExecutionRunStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedEnvironmentOpts, type SeedEnvironmentResult, type SeedEnvironmentBindingOpts, type SetEnvironmentPolicyOpts, type EnvironmentRow, type EnvironmentVariableRow, type EnvironmentBindingRow, type ShowEnvironmentResult, type CreateEnvironmentTemplateOpts, type SetEnvironmentSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
 export { createMetricsRoutes, type MetricsRoutesDeps } from './routes/metrics.js';
 export { createHealthRoutes, type HealthRoutesDeps } from './routes/health.js';
-export { initZx } from './zx.js';
-export { createLogger, guardStartup, logger, setServiceName, type LogLevel, type Logger, } from './logger.js';
-export { requestContext, getRequestContext, enrichRequestContext, type RequestContext, } from './request-context.js';
 export { getReconnectDelay } from './reconnect-delay.js';
-export { formatBytes } from './format-bytes.js';
-export { formatDuration, formatUptime } from './format-duration.js';
-export { sha256, sha256File, deriveSharedSecret, normalizeLineEndings } from './crypto.js';
 export { initTelemetry, getPrometheusExporter, collectRuntimeMetricNames, createMeter, type TelemetryConfig, } from './telemetry/index.js';
 export { setupGracefulShutdown, type ShutdownStep, type ShutdownLogger, type ShutdownHandle, type GracefulShutdownOptions, } from './graceful-shutdown.js';
 export { validateRequiredTools, type ToolRequirement } from './tool-check.js';

package/dist/index.js

@@ -1,17 +1,10 @@
 import "./chunk-gOLHoazu.js";
-import { deriveSharedSecret, normalizeLineEndings, sha256, sha256File } from "./crypto.js";
 import { createDb, createPool } from "./db.js";
 import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
-import { serializeError, toErrorMessage } from "./error.js";
-import { formatBytes } from "./format-bytes.js";
-import { formatDuration, formatUptime } from "./format-duration.js";
 import { setupGracefulShutdown } from "./graceful-shutdown.js";
 import { RingBuffer } from "./ring-buffer.js";
 import { createMetricsRoutes } from "./routes/metrics.js";
 import { createHealthRoutes } from "./routes/health.js";
-import { initZx } from "./zx.js";
-import { enrichRequestContext, getRequestContext, requestContext } from "./request-context.js";
-import { createLogger, guardStartup, logger, setServiceName } from "./logger.js";
 import { getReconnectDelay } from "./reconnect-delay.js";
 import { collectRuntimeMetricNames, getPrometheusExporter, initTelemetry } from "./telemetry/init.js";
 import { createMeter } from "./telemetry/metrics.js";
@@ -28,4 +21,5 @@ import { BaseColdStore } from "./cold-store/cold-store.js";
 import { ChunkLru } from "./cold-store/lru.js";
 import { DEFAULT_TABLE_CONFIG, resolveTableConfig } from "./cold-store/config.js";
 import "./cold-store/index.js";
-export { BaseColdStore, COLD_BUCKET_NAMES, ChunkLru, DEFAULT_TABLE_CONFIG, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createLogger, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveSharedSecret, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, enrichRequestContext, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, formatBytes, formatDuration, formatUptime, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getRequestContext, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, guardStartup, initTelemetry, initZx, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, logger, maskDatabaseUrl, normalizeLineEndings, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, requestContext, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeError, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setServiceName, setupGracefulShutdown, sha256, sha256File, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, toErrorMessage, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export * from "@kici-dev/core";
+export { BaseColdStore, COLD_BUCKET_NAMES, ChunkLru, DEFAULT_TABLE_CONFIG, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setupGracefulShutdown, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };

package/dist/package-manager-types.d.ts

@@ -1,22 +1,2 @@
-/**
- * Package-manager identity — the enum and pure helpers, with no filesystem
- * dependency. Kept separate from `package-manager.ts` (which reads the disk to
- * detect the manager) so browser-safe consumers — the engine protocol schemas
- * and lock-file types the dashboard transitively imports — can reference the
- * enum without pulling `node:fs` into a browser bundle.
- */
-/** Supported package managers. */
-export declare enum PackageManager {
-    Npm = "npm",
-    Pnpm = "pnpm",
-    Yarn = "yarn"
-}
-/** All package-manager identifiers, for flag/schema validation. */
-export declare const PACKAGE_MANAGERS: readonly PackageManager[];
-/**
- * Parse a raw string into a {@link PackageManager}, or `null` when it does not
- * name a supported manager. Accepts bare names (`pnpm`) used by the CLI flag
- * and the env-var / packageManager-field tiers.
- */
-export declare function parsePackageManager(value: string): PackageManager | null;
+export * from '@kici-dev/core/package-manager-types';
 //# sourceMappingURL=package-manager-types.d.ts.map

package/dist/package-manager-types.js

@@ -1,35 +1,3 @@
 import "./chunk-gOLHoazu.js";
-//#region src/package-manager-types.ts
-/**
-* Package-manager identity — the enum and pure helpers, with no filesystem
-* dependency. Kept separate from `package-manager.ts` (which reads the disk to
-* detect the manager) so browser-safe consumers — the engine protocol schemas
-* and lock-file types the dashboard transitively imports — can reference the
-* enum without pulling `node:fs` into a browser bundle.
-*/
-/** Supported package managers. */
-let PackageManager = /* @__PURE__ */ function(PackageManager) {
-	PackageManager["Npm"] = "npm";
-	PackageManager["Pnpm"] = "pnpm";
-	PackageManager["Yarn"] = "yarn";
-	return PackageManager;
-}({});
-/** All package-manager identifiers, for flag/schema validation. */
-const PACKAGE_MANAGERS = Object.values(PackageManager);
-/**
-* Parse a raw string into a {@link PackageManager}, or `null` when it does not
-* name a supported manager. Accepts bare names (`pnpm`) used by the CLI flag
-* and the env-var / packageManager-field tiers.
-*/
-function parsePackageManager(value) {
-	switch (value) {
-		case "npm": return "npm";
-		case "pnpm": return "pnpm";
-		case "yarn": return "yarn";
-		default: return null;
-	}
-}
-//#endregion
-export { PACKAGE_MANAGERS, PackageManager, parsePackageManager };
-
-//# sourceMappingURL=package-manager-types.js.map
+export * from "@kici-dev/core/package-manager-types";
+export {};

package/dist/package-manager.d.ts

@@ -1,52 +1,2 @@
-/**
- * Package-manager detection.
- *
- * Determines which package manager (npm / pnpm / yarn) a project relies on, so
- * dependency operations use the manager that matches the rest of the user's
- * repository instead of always assuming npm. Used by `kici init` (to generate a
- * lockfile that matches the user's repo) and by the agent (to install `.kici/`
- * dependencies with the manager that can resolve the repo's dependency graph,
- * including pnpm/yarn `workspace:` siblings).
- *
- * The {@link PackageManager} enum + pure helpers live in the node-free
- * `./package-manager-types.js` module and are re-exported here so existing
- * `@kici-dev/shared/package-manager` consumers keep one import site.
- */
-import { PackageManager } from './package-manager-types.js';
-export { PackageManager, PACKAGE_MANAGERS, parsePackageManager } from './package-manager-types.js';
-/** Map a detected manager to its install command argv (binary + args). */
-export declare function installCommand(pm: PackageManager): [string, 'install'];
-/**
- * Detect the package manager the user's project relies on.
- *
- * Priority order (first match wins):
- *   1. `packageManager` field in `<projectDir>/package.json` (Corepack
- *      convention, e.g. `"packageManager": "pnpm@9.x"`). Only the name before
- *      `@` is parsed; an unrecognized name falls through.
- *   2. A lockfile in the project root (`pnpm-lock.yaml` > `yarn.lock` >
- *      `package-lock.json`).
- *   3. The `npm_config_user_agent` env var (set by `pnpm dlx` / `yarn dlx` /
- *      `npx`); the leading `<name>/` segment names the manager.
- *   4. Default to npm when nothing matches, so we never guess wrong and emit a
- *      lockfile the user did not ask for.
- *
- * @param projectDir - The project root to inspect.
- */
-export declare function detectPackageManager(projectDir: string): Promise<PackageManager>;
-/**
- * Detect the package manager from a directory's **committed manifests only** —
- * tiers 1 (`packageManager` field) and 2 (lockfile). Returns `null` when the
- * directory carries no package-manager signal, so callers can distinguish
- * "explicitly npm" from "no signal".
- *
- * This deliberately excludes the `npm_config_user_agent` tier: a consumer
- * inspecting a cloned repository (the agent) must key off the repo's own files,
- * not the ambient env of the process that happens to be reading them.
- */
-export declare function detectPackageManagerFromManifests(projectDir: string): Promise<PackageManager | null>;
-/**
- * Synchronous {@link detectPackageManager}. Used by the compiler's lock-file
- * generation, which is synchronous; identical tiering and precedence.
- */
-export declare function detectPackageManagerSync(projectDir: string): PackageManager;
+export * from '@kici-dev/core/package-manager';
 //# sourceMappingURL=package-manager.d.ts.map

package/dist/package-manager.js

@@ -1,131 +1,3 @@
 import "./chunk-gOLHoazu.js";
-import { PACKAGE_MANAGERS, PackageManager, parsePackageManager } from "./package-manager-types.js";
-import { access, readFile } from "node:fs/promises";
-import { accessSync, readFileSync } from "node:fs";
-import path from "node:path";
-//#region src/package-manager.ts
-/**
-* Package-manager detection.
-*
-* Determines which package manager (npm / pnpm / yarn) a project relies on, so
-* dependency operations use the manager that matches the rest of the user's
-* repository instead of always assuming npm. Used by `kici init` (to generate a
-* lockfile that matches the user's repo) and by the agent (to install `.kici/`
-* dependencies with the manager that can resolve the repo's dependency graph,
-* including pnpm/yarn `workspace:` siblings).
-*
-* The {@link PackageManager} enum + pure helpers live in the node-free
-* `./package-manager-types.js` module and are re-exported here so existing
-* `@kici-dev/shared/package-manager` consumers keep one import site.
-*/
-/** Map a detected manager to its install command argv (binary + args). */
-function installCommand(pm) {
-	return [pm, "install"];
-}
-/** Lockfile basenames mapped to the manager that produces them, in priority order. */
-const LOCKFILES = [
-	["pnpm-lock.yaml", "pnpm"],
-	["yarn.lock", "yarn"],
-	["package-lock.json", "npm"]
-];
-/**
-* Detect the package manager the user's project relies on.
-*
-* Priority order (first match wins):
-*   1. `packageManager` field in `<projectDir>/package.json` (Corepack
-*      convention, e.g. `"packageManager": "pnpm@9.x"`). Only the name before
-*      `@` is parsed; an unrecognized name falls through.
-*   2. A lockfile in the project root (`pnpm-lock.yaml` > `yarn.lock` >
-*      `package-lock.json`).
-*   3. The `npm_config_user_agent` env var (set by `pnpm dlx` / `yarn dlx` /
-*      `npx`); the leading `<name>/` segment names the manager.
-*   4. Default to npm when nothing matches, so we never guess wrong and emit a
-*      lockfile the user did not ask for.
-*
-* @param projectDir - The project root to inspect.
-*/
-async function detectPackageManager(projectDir) {
-	const fromManifests = await detectPackageManagerFromManifests(projectDir);
-	if (fromManifests) return fromManifests;
-	const fromUserAgent = parseUserAgent(process.env.npm_config_user_agent);
-	if (fromUserAgent) return fromUserAgent;
-	return "npm";
-}
-/**
-* Detect the package manager from a directory's **committed manifests only** —
-* tiers 1 (`packageManager` field) and 2 (lockfile). Returns `null` when the
-* directory carries no package-manager signal, so callers can distinguish
-* "explicitly npm" from "no signal".
-*
-* This deliberately excludes the `npm_config_user_agent` tier: a consumer
-* inspecting a cloned repository (the agent) must key off the repo's own files,
-* not the ambient env of the process that happens to be reading them.
-*/
-async function detectPackageManagerFromManifests(projectDir) {
-	const fromField = parsePackageManagerField(await readPackageJson(projectDir));
-	if (fromField) return fromField;
-	for (const [file, pm] of LOCKFILES) if (await fileExists(path.join(projectDir, file))) return pm;
-	return null;
-}
-/**
-* Synchronous {@link detectPackageManager}. Used by the compiler's lock-file
-* generation, which is synchronous; identical tiering and precedence.
-*/
-function detectPackageManagerSync(projectDir) {
-	const fromField = parsePackageManagerField(readPackageJsonSync(projectDir));
-	if (fromField) return fromField;
-	for (const [file, pm] of LOCKFILES) if (fileExistsSync(path.join(projectDir, file))) return pm;
-	const fromUserAgent = parseUserAgent(process.env.npm_config_user_agent);
-	if (fromUserAgent) return fromUserAgent;
-	return "npm";
-}
-/** Tier 1: parse the Corepack `packageManager` field, if present. */
-function parsePackageManagerField(content) {
-	if (content === null) return null;
-	try {
-		const pkg = JSON.parse(content);
-		if (typeof pkg.packageManager !== "string") return null;
-		return parsePackageManager(pkg.packageManager.split("@", 1)[0]);
-	} catch {
-		return null;
-	}
-}
-/** Tier 3: the `npm_config_user_agent` env var, whose leading segment names the manager. */
-function parseUserAgent(userAgent) {
-	if (!userAgent) return null;
-	return parsePackageManager(userAgent.split("/", 1)[0]);
-}
-async function readPackageJson(projectDir) {
-	try {
-		return await readFile(path.join(projectDir, "package.json"), "utf-8");
-	} catch {
-		return null;
-	}
-}
-function readPackageJsonSync(projectDir) {
-	try {
-		return readFileSync(path.join(projectDir, "package.json"), "utf-8");
-	} catch {
-		return null;
-	}
-}
-async function fileExists(target) {
-	try {
-		await access(target);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function fileExistsSync(target) {
-	try {
-		accessSync(target);
-		return true;
-	} catch {
-		return false;
-	}
-}
-//#endregion
-export { PACKAGE_MANAGERS, PackageManager, detectPackageManager, detectPackageManagerFromManifests, detectPackageManagerSync, installCommand, parsePackageManager };
-
-//# sourceMappingURL=package-manager.js.map
+export * from "@kici-dev/core/package-manager";
+export {};

package/dist/ts-loader-hook.d.ts

@@ -1,26 +1,2 @@
-type ResolveContext = {
-    parentURL?: string;
-    conditions: string[];
-    importAttributes: Record<string, string>;
-};
-type ResolveResult = {
-    url: string;
-    shortCircuit?: boolean;
-    format?: string | null;
-};
-type NextResolve = (specifier: string, context?: ResolveContext) => ResolveResult | Promise<ResolveResult>;
-type LoadContext = {
-    format?: string | null;
-    importAttributes: Record<string, string>;
-    conditions: string[];
-};
-type LoadResult = {
-    format: string;
-    source?: string | ArrayBuffer | Uint8Array;
-    shortCircuit?: boolean;
-};
-type NextLoad = (url: string, context?: LoadContext) => LoadResult | Promise<LoadResult>;
-export declare function resolve(specifier: string, context: ResolveContext, nextResolve: NextResolve): ResolveResult | Promise<ResolveResult>;
-export declare function load(url: string, context: LoadContext, nextLoad: NextLoad): Promise<LoadResult>;
-export {};
+export * from '@kici-dev/core/ts-loader-hook';
 //# sourceMappingURL=ts-loader-hook.d.ts.map