@kici-dev/shared 0.1.13 → 0.1.15

package/dist/index.d.ts

@@ -1,16 +1,10 @@
+export * from '@kici-dev/core';
 export { RingBuffer } from './ring-buffer.js';
-export { toErrorMessage, serializeError } from './error.js';
-export { createPool, createDb } from './db.js';
-export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, seedEnvironmentDirect, seedEnvironmentBindingDirect, setEnvironmentPolicyDirect, listEnvironmentsDirect, showEnvironmentDirect, createEnvironmentTemplateDirect, setEnvironmentSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, waitForExecutionRunStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedEnvironmentOpts, type SeedEnvironmentResult, type SeedEnvironmentBindingOpts, type SetEnvironmentPolicyOpts, type EnvironmentRow, type EnvironmentVariableRow, type EnvironmentBindingRow, type ShowEnvironmentResult, type CreateEnvironmentTemplateOpts, type SetEnvironmentSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
+export { createPool, createDb, type CreatePoolOptions, type PgPoolErrorSource } from './db.js';
+export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, seedEnvironmentDirect, deleteEnvironmentDirect, seedEnvironmentBindingDirect, setEnvironmentPolicyDirect, listEnvironmentsDirect, showEnvironmentDirect, createEnvironmentTemplateDirect, setEnvironmentSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, waitForExecutionRunStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedEnvironmentOpts, type SeedEnvironmentResult, type SeedEnvironmentBindingOpts, type SetEnvironmentPolicyOpts, type EnvironmentRow, type EnvironmentVariableRow, type EnvironmentBindingRow, type ShowEnvironmentResult, type CreateEnvironmentTemplateOpts, type SetEnvironmentSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
 export { createMetricsRoutes, type MetricsRoutesDeps } from './routes/metrics.js';
 export { createHealthRoutes, type HealthRoutesDeps } from './routes/health.js';
-export { initZx } from './zx.js';
-export { createLogger, guardStartup, logger, setServiceName, type LogLevel, type Logger, } from './logger.js';
-export { requestContext, getRequestContext, enrichRequestContext, type RequestContext, } from './request-context.js';
 export { getReconnectDelay } from './reconnect-delay.js';
-export { formatBytes } from './format-bytes.js';
-export { formatDuration, formatUptime } from './format-duration.js';
-export { sha256, sha256File, deriveSharedSecret, normalizeLineEndings } from './crypto.js';
 export { initTelemetry, getPrometheusExporter, collectRuntimeMetricNames, createMeter, type TelemetryConfig, } from './telemetry/index.js';
 export { setupGracefulShutdown, type ShutdownStep, type ShutdownLogger, type ShutdownHandle, type GracefulShutdownOptions, } from './graceful-shutdown.js';
 export { validateRequiredTools, type ToolRequirement } from './tool-check.js';

package/dist/index.js

@@ -1,17 +1,10 @@
 import "./chunk-gOLHoazu.js";
-import { deriveSharedSecret, normalizeLineEndings, sha256, sha256File } from "./crypto.js";
 import { createDb, createPool } from "./db.js";
-import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
-import { serializeError, toErrorMessage } from "./error.js";
-import { formatBytes } from "./format-bytes.js";
-import { formatDuration, formatUptime } from "./format-duration.js";
+import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
 import { setupGracefulShutdown } from "./graceful-shutdown.js";
 import { RingBuffer } from "./ring-buffer.js";
 import { createMetricsRoutes } from "./routes/metrics.js";
 import { createHealthRoutes } from "./routes/health.js";
-import { initZx } from "./zx.js";
-import { enrichRequestContext, getRequestContext, requestContext } from "./request-context.js";
-import { createLogger, guardStartup, logger, setServiceName } from "./logger.js";
 import { getReconnectDelay } from "./reconnect-delay.js";
 import { collectRuntimeMetricNames, getPrometheusExporter, initTelemetry } from "./telemetry/init.js";
 import { createMeter } from "./telemetry/metrics.js";
@@ -28,4 +21,5 @@ import { BaseColdStore } from "./cold-store/cold-store.js";
 import { ChunkLru } from "./cold-store/lru.js";
 import { DEFAULT_TABLE_CONFIG, resolveTableConfig } from "./cold-store/config.js";
 import "./cold-store/index.js";
-export { BaseColdStore, COLD_BUCKET_NAMES, ChunkLru, DEFAULT_TABLE_CONFIG, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createLogger, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveSharedSecret, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, enrichRequestContext, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, formatBytes, formatDuration, formatUptime, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getRequestContext, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, guardStartup, initTelemetry, initZx, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, logger, maskDatabaseUrl, normalizeLineEndings, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, requestContext, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeError, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setServiceName, setupGracefulShutdown, sha256, sha256File, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, toErrorMessage, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export * from "@kici-dev/core";
+export { BaseColdStore, COLD_BUCKET_NAMES, ChunkLru, DEFAULT_TABLE_CONFIG, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setupGracefulShutdown, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };

package/dist/package-manager-types.d.ts

@@ -1,22 +1,2 @@
-/**
- * Package-manager identity — the enum and pure helpers, with no filesystem
- * dependency. Kept separate from `package-manager.ts` (which reads the disk to
- * detect the manager) so browser-safe consumers — the engine protocol schemas
- * and lock-file types the dashboard transitively imports — can reference the
- * enum without pulling `node:fs` into a browser bundle.
- */
-/** Supported package managers. */
-export declare enum PackageManager {
-    Npm = "npm",
-    Pnpm = "pnpm",
-    Yarn = "yarn"
-}
-/** All package-manager identifiers, for flag/schema validation. */
-export declare const PACKAGE_MANAGERS: readonly PackageManager[];
-/**
- * Parse a raw string into a {@link PackageManager}, or `null` when it does not
- * name a supported manager. Accepts bare names (`pnpm`) used by the CLI flag
- * and the env-var / packageManager-field tiers.
- */
-export declare function parsePackageManager(value: string): PackageManager | null;
+export * from '@kici-dev/core/package-manager-types';
 //# sourceMappingURL=package-manager-types.d.ts.map

package/dist/package-manager-types.js

@@ -1,35 +1,3 @@
 import "./chunk-gOLHoazu.js";
-//#region src/package-manager-types.ts
-/**
-* Package-manager identity — the enum and pure helpers, with no filesystem
-* dependency. Kept separate from `package-manager.ts` (which reads the disk to
-* detect the manager) so browser-safe consumers — the engine protocol schemas
-* and lock-file types the dashboard transitively imports — can reference the
-* enum without pulling `node:fs` into a browser bundle.
-*/
-/** Supported package managers. */
-let PackageManager = /* @__PURE__ */ function(PackageManager) {
-	PackageManager["Npm"] = "npm";
-	PackageManager["Pnpm"] = "pnpm";
-	PackageManager["Yarn"] = "yarn";
-	return PackageManager;
-}({});
-/** All package-manager identifiers, for flag/schema validation. */
-const PACKAGE_MANAGERS = Object.values(PackageManager);
-/**
-* Parse a raw string into a {@link PackageManager}, or `null` when it does not
-* name a supported manager. Accepts bare names (`pnpm`) used by the CLI flag
-* and the env-var / packageManager-field tiers.
-*/
-function parsePackageManager(value) {
-	switch (value) {
-		case "npm": return "npm";
-		case "pnpm": return "pnpm";
-		case "yarn": return "yarn";
-		default: return null;
-	}
-}
-//#endregion
-export { PACKAGE_MANAGERS, PackageManager, parsePackageManager };
-
-//# sourceMappingURL=package-manager-types.js.map
+export * from "@kici-dev/core/package-manager-types";
+export {};

package/dist/package-manager.d.ts

@@ -1,52 +1,2 @@
-/**
- * Package-manager detection.
- *
- * Determines which package manager (npm / pnpm / yarn) a project relies on, so
- * dependency operations use the manager that matches the rest of the user's
- * repository instead of always assuming npm. Used by `kici init` (to generate a
- * lockfile that matches the user's repo) and by the agent (to install `.kici/`
- * dependencies with the manager that can resolve the repo's dependency graph,
- * including pnpm/yarn `workspace:` siblings).
- *
- * The {@link PackageManager} enum + pure helpers live in the node-free
- * `./package-manager-types.js` module and are re-exported here so existing
- * `@kici-dev/shared/package-manager` consumers keep one import site.
- */
-import { PackageManager } from './package-manager-types.js';
-export { PackageManager, PACKAGE_MANAGERS, parsePackageManager } from './package-manager-types.js';
-/** Map a detected manager to its install command argv (binary + args). */
-export declare function installCommand(pm: PackageManager): [string, 'install'];
-/**
- * Detect the package manager the user's project relies on.
- *
- * Priority order (first match wins):
- *   1. `packageManager` field in `<projectDir>/package.json` (Corepack
- *      convention, e.g. `"packageManager": "pnpm@9.x"`). Only the name before
- *      `@` is parsed; an unrecognized name falls through.
- *   2. A lockfile in the project root (`pnpm-lock.yaml` > `yarn.lock` >
- *      `package-lock.json`).
- *   3. The `npm_config_user_agent` env var (set by `pnpm dlx` / `yarn dlx` /
- *      `npx`); the leading `<name>/` segment names the manager.
- *   4. Default to npm when nothing matches, so we never guess wrong and emit a
- *      lockfile the user did not ask for.
- *
- * @param projectDir - The project root to inspect.
- */
-export declare function detectPackageManager(projectDir: string): Promise<PackageManager>;
-/**
- * Detect the package manager from a directory's **committed manifests only** —
- * tiers 1 (`packageManager` field) and 2 (lockfile). Returns `null` when the
- * directory carries no package-manager signal, so callers can distinguish
- * "explicitly npm" from "no signal".
- *
- * This deliberately excludes the `npm_config_user_agent` tier: a consumer
- * inspecting a cloned repository (the agent) must key off the repo's own files,
- * not the ambient env of the process that happens to be reading them.
- */
-export declare function detectPackageManagerFromManifests(projectDir: string): Promise<PackageManager | null>;
-/**
- * Synchronous {@link detectPackageManager}. Used by the compiler's lock-file
- * generation, which is synchronous; identical tiering and precedence.
- */
-export declare function detectPackageManagerSync(projectDir: string): PackageManager;
+export * from '@kici-dev/core/package-manager';
 //# sourceMappingURL=package-manager.d.ts.map

package/dist/package-manager.js

@@ -1,131 +1,3 @@
 import "./chunk-gOLHoazu.js";
-import { PACKAGE_MANAGERS, PackageManager, parsePackageManager } from "./package-manager-types.js";
-import { access, readFile } from "node:fs/promises";
-import { accessSync, readFileSync } from "node:fs";
-import path from "node:path";
-//#region src/package-manager.ts
-/**
-* Package-manager detection.
-*
-* Determines which package manager (npm / pnpm / yarn) a project relies on, so
-* dependency operations use the manager that matches the rest of the user's
-* repository instead of always assuming npm. Used by `kici init` (to generate a
-* lockfile that matches the user's repo) and by the agent (to install `.kici/`
-* dependencies with the manager that can resolve the repo's dependency graph,
-* including pnpm/yarn `workspace:` siblings).
-*
-* The {@link PackageManager} enum + pure helpers live in the node-free
-* `./package-manager-types.js` module and are re-exported here so existing
-* `@kici-dev/shared/package-manager` consumers keep one import site.
-*/
-/** Map a detected manager to its install command argv (binary + args). */
-function installCommand(pm) {
-	return [pm, "install"];
-}
-/** Lockfile basenames mapped to the manager that produces them, in priority order. */
-const LOCKFILES = [
-	["pnpm-lock.yaml", "pnpm"],
-	["yarn.lock", "yarn"],
-	["package-lock.json", "npm"]
-];
-/**
-* Detect the package manager the user's project relies on.
-*
-* Priority order (first match wins):
-*   1. `packageManager` field in `<projectDir>/package.json` (Corepack
-*      convention, e.g. `"packageManager": "pnpm@9.x"`). Only the name before
-*      `@` is parsed; an unrecognized name falls through.
-*   2. A lockfile in the project root (`pnpm-lock.yaml` > `yarn.lock` >
-*      `package-lock.json`).
-*   3. The `npm_config_user_agent` env var (set by `pnpm dlx` / `yarn dlx` /
-*      `npx`); the leading `<name>/` segment names the manager.
-*   4. Default to npm when nothing matches, so we never guess wrong and emit a
-*      lockfile the user did not ask for.
-*
-* @param projectDir - The project root to inspect.
-*/
-async function detectPackageManager(projectDir) {
-	const fromManifests = await detectPackageManagerFromManifests(projectDir);
-	if (fromManifests) return fromManifests;
-	const fromUserAgent = parseUserAgent(process.env.npm_config_user_agent);
-	if (fromUserAgent) return fromUserAgent;
-	return "npm";
-}
-/**
-* Detect the package manager from a directory's **committed manifests only** —
-* tiers 1 (`packageManager` field) and 2 (lockfile). Returns `null` when the
-* directory carries no package-manager signal, so callers can distinguish
-* "explicitly npm" from "no signal".
-*
-* This deliberately excludes the `npm_config_user_agent` tier: a consumer
-* inspecting a cloned repository (the agent) must key off the repo's own files,
-* not the ambient env of the process that happens to be reading them.
-*/
-async function detectPackageManagerFromManifests(projectDir) {
-	const fromField = parsePackageManagerField(await readPackageJson(projectDir));
-	if (fromField) return fromField;
-	for (const [file, pm] of LOCKFILES) if (await fileExists(path.join(projectDir, file))) return pm;
-	return null;
-}
-/**
-* Synchronous {@link detectPackageManager}. Used by the compiler's lock-file
-* generation, which is synchronous; identical tiering and precedence.
-*/
-function detectPackageManagerSync(projectDir) {
-	const fromField = parsePackageManagerField(readPackageJsonSync(projectDir));
-	if (fromField) return fromField;
-	for (const [file, pm] of LOCKFILES) if (fileExistsSync(path.join(projectDir, file))) return pm;
-	const fromUserAgent = parseUserAgent(process.env.npm_config_user_agent);
-	if (fromUserAgent) return fromUserAgent;
-	return "npm";
-}
-/** Tier 1: parse the Corepack `packageManager` field, if present. */
-function parsePackageManagerField(content) {
-	if (content === null) return null;
-	try {
-		const pkg = JSON.parse(content);
-		if (typeof pkg.packageManager !== "string") return null;
-		return parsePackageManager(pkg.packageManager.split("@", 1)[0]);
-	} catch {
-		return null;
-	}
-}
-/** Tier 3: the `npm_config_user_agent` env var, whose leading segment names the manager. */
-function parseUserAgent(userAgent) {
-	if (!userAgent) return null;
-	return parsePackageManager(userAgent.split("/", 1)[0]);
-}
-async function readPackageJson(projectDir) {
-	try {
-		return await readFile(path.join(projectDir, "package.json"), "utf-8");
-	} catch {
-		return null;
-	}
-}
-function readPackageJsonSync(projectDir) {
-	try {
-		return readFileSync(path.join(projectDir, "package.json"), "utf-8");
-	} catch {
-		return null;
-	}
-}
-async function fileExists(target) {
-	try {
-		await access(target);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function fileExistsSync(target) {
-	try {
-		accessSync(target);
-		return true;
-	} catch {
-		return false;
-	}
-}
-//#endregion
-export { PACKAGE_MANAGERS, PackageManager, detectPackageManager, detectPackageManagerFromManifests, detectPackageManagerSync, installCommand, parsePackageManager };
-
-//# sourceMappingURL=package-manager.js.map
+export * from "@kici-dev/core/package-manager";
+export {};

package/dist/s3-client.js

@@ -13,7 +13,10 @@ import { S3Client } from "@aws-sdk/client-s3";
 * for cache-storage variants).
 */
 function createS3Client(options) {
-	const config = {};
+	const config = {
+		requestChecksumCalculation: "WHEN_REQUIRED",
+		responseChecksumValidation: "WHEN_REQUIRED"
+	};
 	if (options.region) config.region = options.region;
 	if (options.endpoint) config.endpoint = options.endpoint;
 	if (options.forcePathStyle !== void 0) config.forcePathStyle = options.forcePathStyle;

package/dist/s3-client.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=s3-client.test.d.ts.map

package/dist/ts-loader-hook.d.ts

@@ -1,26 +1,2 @@
-type ResolveContext = {
-    parentURL?: string;
-    conditions: string[];
-    importAttributes: Record<string, string>;
-};
-type ResolveResult = {
-    url: string;
-    shortCircuit?: boolean;
-    format?: string | null;
-};
-type NextResolve = (specifier: string, context?: ResolveContext) => ResolveResult | Promise<ResolveResult>;
-type LoadContext = {
-    format?: string | null;
-    importAttributes: Record<string, string>;
-    conditions: string[];
-};
-type LoadResult = {
-    format: string;
-    source?: string | ArrayBuffer | Uint8Array;
-    shortCircuit?: boolean;
-};
-type NextLoad = (url: string, context?: LoadContext) => LoadResult | Promise<LoadResult>;
-export declare function resolve(specifier: string, context: ResolveContext, nextResolve: NextResolve): ResolveResult | Promise<ResolveResult>;
-export declare function load(url: string, context: LoadContext, nextLoad: NextLoad): Promise<LoadResult>;
-export {};
+export * from '@kici-dev/core/ts-loader-hook';
 //# sourceMappingURL=ts-loader-hook.d.ts.map

package/dist/ts-loader-hook.js

@@ -1,48 +1,3 @@
 import "./chunk-gOLHoazu.js";
-import { readFile } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { transformSync } from "oxc-transform";
-//#region src/ts-loader-hook.ts
-function resolve(specifier, context, nextResolve) {
-	if (specifier.endsWith(".js") && (specifier.startsWith("./") || specifier.startsWith("../"))) try {
-		if (context.parentURL) {
-			if (!existsSync(fileURLToPath(new URL(specifier, context.parentURL)))) {
-				const tsSpecifier = specifier.slice(0, -3) + ".ts";
-				if (existsSync(fileURLToPath(new URL(tsSpecifier, context.parentURL)))) return nextResolve(tsSpecifier, context);
-			}
-		}
-	} catch {}
-	return nextResolve(specifier, context);
-}
-async function load(url, context, nextLoad) {
-	if (!url.startsWith("file:")) return nextLoad(url, context);
-	const bareUrl = url.split("?")[0].split("#")[0];
-	const isTs = bareUrl.endsWith(".ts");
-	const isTsx = bareUrl.endsWith(".tsx");
-	if (!isTs && !isTsx) return nextLoad(url, context);
-	const filePath = fileURLToPath(bareUrl);
-	const result = transformSync(filePath, await readFile(filePath, "utf8"), {
-		lang: isTsx ? "tsx" : "ts",
-		sourcemap: true,
-		typescript: { allowNamespaces: true }
-	});
-	if (result.errors.length) {
-		const msg = result.errors.map((e) => e.message).join("\n");
-		throw new Error(`oxc-transform failed for ${filePath}:\n${msg}`);
-	}
-	let code = result.code;
-	if (result.map) {
-		const b64 = Buffer.from(JSON.stringify(result.map)).toString("base64");
-		code += `\n//# sourceMappingURL=data:application/json;base64,${b64}\n`;
-	}
-	return {
-		format: "module",
-		source: code,
-		shortCircuit: true
-	};
-}
-//#endregion
-export { load, resolve };
-
-//# sourceMappingURL=ts-loader-hook.js.map
+export * from "@kici-dev/core/ts-loader-hook";
+export {};

package/package.json

@@ -1,17 +1,21 @@
 {
   "name": "@kici-dev/shared",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
   "keywords": [
-    "kici",
     "ci",
-    "cd",
-    "ci-cd",
+    "cicd",
+    "continuous-integration",
     "typescript",
-    "workflows",
-    "devops",
+    "workflow",
     "utilities"
   ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kici-dev/kici-public.git",
+    "directory": "packages/shared"
+  },
+  "bugs": "https://github.com/kici-dev/kici-public/issues",
   "homepage": "https://kici.dev",
   "author": {
     "name": "KiCI",
@@ -95,7 +99,8 @@
     "winston-daily-rotate-file": "^5.0.0",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "zx": "^8.8.5"
+    "zx": "^8.8.5",
+    "@kici-dev/core": "0.1.15"
   },
   "devDependencies": {
     "@opentelemetry/sdk-trace-base": "^2.7.0",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/shared@0.1.13",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fshared/0.1.13/3de29b01-3471-40bf-a600-aea4e6277238",
+  "name": "@kici-dev/shared@0.1.15",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fshared/0.1.15/16314d47-0e1a-4be8-bddc-5605b523d24d",
   "creationInfo": {
-    "created": "2026-05-28T10:37:30Z",
+    "created": "2026-06-11T03:03:13Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -944,10 +944,30 @@
       "description": "javascript standard data structure library which benchmark against C++ STL",
       "homepage": "https://js-sdsl.org"
     },
+    {
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "name": "@kici-dev/core",
+      "versionInfo": "0.1.15",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "Apache-2.0",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.15"
+        }
+      ],
+      "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
+      "homepage": "https://kici.dev"
+    },
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.13",
+      "versionInfo": "0.1.15",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -958,7 +978,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.13"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.15"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -6421,11 +6441,46 @@
       "relatedSpdxElement": "SPDXRef-Package-yargs-17.7.2",
       "relationshipType": "DEPENDS_ON"
     },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
+      "relationshipType": "DEPENDS_ON"
+    },
     {
       "spdxElementId": "SPDXRef-RootPackage",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1038.0",
       "relationshipType": "DEPENDS_ON"
     },
+    {
+      "spdxElementId": "SPDXRef-RootPackage",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "relationshipType": "DEPENDS_ON"
+    },
     {
       "spdxElementId": "SPDXRef-RootPackage",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",

package/dist/crypto.d.ts

@@ -1,33 +0,0 @@
-/** Compute SHA-256 hex digest of a string or Buffer. */
-export declare function sha256(input: string | Buffer): string;
-/** Compute SHA-256 hex digest of a file's contents. */
-export declare function sha256File(filePath: string): Promise<string>;
-/**
- * Normalize line endings to LF so hashes computed on different platforms agree.
- *
- * Git for Windows ships with `core.autocrlf=true` in the system gitconfig, so a
- * `git clone` of a Linux-authored repo on a Windows host checks out text files
- * with CRLF in the working tree. The compiler hashed the LF source on Linux,
- * but the agent on Windows reads CRLF and computes a different hash — every
- * dispatch fails with a "lock file is out of date" error even though the
- * semantic content is identical.
- *
- * Applied at the boundaries where source / asset content enters the hash:
- *   - raw workflow source (`.kici/workflows/*.ts`) at hash time, in both the
- *     compiler (lockfile generation) and the agent (drift verification).
- *   - file content portions of the asset digest (`hashFiles` resolution) on
- *     both sides.
- *
- * Standalone `\r` is also collapsed to `\n` for safety against legacy
- * Mac-style endings, though TypeScript source files essentially never carry
- * those in practice.
- */
-export declare function normalizeLineEndings(input: string): string;
-/**
- * Derive an AES-256 key from an X25519 ECDH shared secret using HKDF.
- *
- * Used by the compiler (encrypt) and agent (decrypt) for tarball uploads.
- * Keys must be DER-encoded (PKCS8 for private, SPKI for public).
- */
-export declare function deriveSharedSecret(ourPrivateKey: Buffer, theirPublicKey: Buffer): Buffer;
-//# sourceMappingURL=crypto.d.ts.map