@kici-dev/shared 0.1.23 → 0.1.25

package/dist/cold-store/bucket.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/cold-store/bucket.ts
 /**
 * Map a `ColdRetention` to a stable S3 prefix segment. Rounds

package/dist/cold-store/chunk-encoder.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { sha256 } from "@kici-dev/core";
 import { gzipSync } from "node:zlib";
 //#region src/cold-store/chunk-encoder.ts

package/dist/cold-store/chunk-id.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { sha256 } from "@kici-dev/core";
 //#region src/cold-store/chunk-id.ts
 /**

package/dist/cold-store/cold-store.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { createS3Client } from "../s3-client.js";
 import { chunkObjectKey, encodeKeySegment, tablePrefix, tenantDayPrefix } from "./key.js";
 import { coldDaysToBucket, isLongerColdRetention } from "./bucket.js";

package/dist/cold-store/config.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/cold-store/config.ts
 /**
 * Reasonable defaults — matches the design doc's section 5 table.

package/dist/cold-store/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { chunkObjectKey, encodeKeySegment, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix } from "./key.js";
 import { COLD_BUCKET_NAMES, coldDaysToBucket, isLongerColdRetention } from "./bucket.js";
 import { computeChunkId } from "./chunk-id.js";

package/dist/cold-store/key.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/cold-store/key.ts
 /**
 * Key helpers for S3 object layouts.

package/dist/cold-store/lru.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/cold-store/lru.ts
 var ChunkLru = class {
 	maxBytes;

package/dist/cold-store/manifest.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/cold-store/manifest.ts
 /**
 * Required fields shared by v1 and v2 manifests. Order is the on-disk

package/dist/cold-store/metrics.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { createMeter } from "../telemetry/metrics.js";
 //#region src/cold-store/metrics.ts
 let _meter;

package/dist/cold-store/table-adapter.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/cold-store/types.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/db-admin.d.ts

@@ -177,6 +177,22 @@ export declare function purgeStaleSourcesDirect(databaseUrl: string, routingKey:
 export declare function purgeScopedSecretsDirect(databaseUrl: string, orgId?: string): Promise<{
     deleted: number;
 }>;
+/**
+ * Bulk-delete `environments` (and their FK-dependent rows) for an org, or for
+ * every org when `orgId` is omitted. `environment_bindings` /
+ * `environment_variables` / `environment_source_overrides` cascade
+ * automatically (ON DELETE CASCADE). `held_runs` and `execution_runs` reference
+ * `environments(id)` with ON DELETE SET NULL, so deleting environments alone
+ * would leave orphaned `held_runs` rows carrying a null environment reference;
+ * this helper deletes the org's `held_runs` too so a warm-start reset gets a
+ * clean slate. Runs in a transaction so both deletes commit atomically. Used by
+ * the E2E warm-start reset (so seeded environments don't leak between
+ * categories) and exposed via `kici-admin environment purge`.
+ */
+export declare function purgeEnvironmentsDirect(databaseUrl: string, orgId?: string): Promise<{
+    environmentsDeleted: number;
+    heldRunsDeleted: number;
+}>;
 export interface SeedEnvironmentOpts {
     orgId: string;
     name: string;
@@ -403,6 +419,8 @@ export interface ExecutionJobRow {
     duration_ms: number | null;
     created_at: string;
     error_message: string | null;
+    /** Ordered bound deployment-environment names (JSON-encoded `string[]`), or null. */
+    environments: string | null;
 }
 export interface ListExecutionRunsOpts {
     routingKey?: string;
@@ -1004,6 +1022,41 @@ export declare function deleteKiciEventsDirect(databaseUrl: string, opts: {
 }): Promise<{
     deleted: number;
 }>;
+/**
+ * INSERT a kici_events row with an explicit created_at. Lets a test place
+ * many events on the exact same timestamp so the catch-up keyset cursor's
+ * same-created_at tie handling is genuinely exercised (the default-NOW insert
+ * path cannot force ties deterministically). Returns the inserted id.
+ */
+export declare function insertKiciEventAtDirect(databaseUrl: string, opts: {
+    eventName: string;
+    createdAt: Date;
+    payload?: Record<string, unknown>;
+    chainDepth?: number;
+    sourceRoutingKey?: string | null;
+    expiresIn?: string;
+}): Promise<{
+    id: string;
+}>;
+/**
+ * Page through unprocessed, non-DLQ kici_events for a given event_name using
+ * the same composite `(created_at, id)` keyset cursor + `ORDER BY created_at
+ * ASC, id ASC` that EventStore.getUnprocessedSince runs. Keep this SQL in sync
+ * with `packages/orchestrator/src/events/event-store.ts`.
+ *
+ * Returns every id seen across all pages in traversal order (with duplicates
+ * preserved so the caller can assert none occur) plus the page count. This is
+ * the real-Postgres guard that the keyset cursor pages the entire backlog —
+ * including same-created_at ties across a page boundary — with no skip and no
+ * duplicate.
+ */
+export declare function paginateUnprocessedEventsKeysetDirect(databaseUrl: string, opts: {
+    eventName: string;
+    batchSize?: number;
+}): Promise<{
+    ids: string[];
+    pages: number;
+}>;
 /**
  * Simulate a NOTIFY on `kici_event_channel` and verify a LISTEN client
  * receives it. Used by event-routing e2e to prove the infrastructure

package/dist/db-admin.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { createPool } from "./db.js";
 import { createHash } from "node:crypto";
 import pg from "pg";
@@ -341,11 +341,45 @@ async function purgeScopedSecretsDirect(databaseUrl, orgId) {
 	}
 }
 /**
+* Bulk-delete `environments` (and their FK-dependent rows) for an org, or for
+* every org when `orgId` is omitted. `environment_bindings` /
+* `environment_variables` / `environment_source_overrides` cascade
+* automatically (ON DELETE CASCADE). `held_runs` and `execution_runs` reference
+* `environments(id)` with ON DELETE SET NULL, so deleting environments alone
+* would leave orphaned `held_runs` rows carrying a null environment reference;
+* this helper deletes the org's `held_runs` too so a warm-start reset gets a
+* clean slate. Runs in a transaction so both deletes commit atomically. Used by
+* the E2E warm-start reset (so seeded environments don't leak between
+* categories) and exposed via `kici-admin environment purge`.
+*/
+async function purgeEnvironmentsDirect(databaseUrl, orgId) {
+	const pool = createPool(databaseUrl);
+	const client = await pool.connect();
+	try {
+		await client.query("BEGIN");
+		const where = orgId ? "WHERE org_id = $1" : "";
+		const params = orgId ? [orgId] : [];
+		const held = await client.query(`DELETE FROM held_runs ${where}`, params);
+		const envs = await client.query(`DELETE FROM environments ${where}`, params);
+		await client.query("COMMIT");
+		return {
+			environmentsDeleted: envs.rowCount ?? 0,
+			heldRunsDeleted: held.rowCount ?? 0
+		};
+	} catch (err) {
+		await client.query("ROLLBACK").catch(() => void 0);
+		throw err;
+	} finally {
+		client.release();
+		await pool.end();
+	}
+}
+/**
 * Allowed policy field names for `setEnvironmentPolicyDirect`. Kept as an
 * explicit allowlist so the column-name interpolation in the UPDATE string
 * can never be driven by unsanitised caller input.
 */
-const ENV_POLICY_COLUMNS = new Set([
+const ENV_POLICY_COLUMNS = /* @__PURE__ */ new Set([
 	"branch_restrictions",
 	"required_reviewers",
 	"wait_timer_seconds",
@@ -782,7 +816,7 @@ async function showExecutionRunDirect(databaseUrl, opts) {
 		return {
 			run,
 			jobs: (await pool.query(`SELECT id, run_id, job_id, job_name, status, agent_id,
-              started_at, completed_at, duration_ms, created_at, error_message
+              started_at, completed_at, duration_ms, created_at, error_message, environments
          FROM execution_jobs
         WHERE run_id = $1
         ORDER BY created_at ASC`, [run.run_id])).rows
@@ -799,7 +833,8 @@ async function listExecutionJobsDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
 	try {
 		return { jobs: (await pool.query(`SELECT j.id, j.run_id, j.job_id, j.job_name, j.status, j.agent_id,
-              j.started_at, j.completed_at, j.duration_ms, j.created_at, j.error_message
+              j.started_at, j.completed_at, j.duration_ms, j.created_at, j.error_message,
+              j.environments
          FROM execution_jobs j
          INNER JOIN execution_runs r ON r.run_id = j.run_id
         WHERE r.run_id::text = $1 OR r.id::text = $1
@@ -889,7 +924,7 @@ async function showRegistrationDirect(databaseUrl, opts) {
 * Duplicated here intentionally so the helper has no runtime dependency on
 * the engine package.
 */
-const REGISTERABLE_TRIGGER_TYPES = new Set([
+const REGISTERABLE_TRIGGER_TYPES = /* @__PURE__ */ new Set([
 	"push",
 	"pr",
 	"pull_request",
@@ -1848,6 +1883,79 @@ async function deleteKiciEventsDirect(databaseUrl, opts) {
 	}
 }
 /**
+* INSERT a kici_events row with an explicit created_at. Lets a test place
+* many events on the exact same timestamp so the catch-up keyset cursor's
+* same-created_at tie handling is genuinely exercised (the default-NOW insert
+* path cannot force ties deterministically). Returns the inserted id.
+*/
+async function insertKiciEventAtDirect(databaseUrl, opts) {
+	const expiresIn = opts.expiresIn ?? "7 days";
+	const pool = createPool(databaseUrl);
+	try {
+		return { id: (await pool.query(`INSERT INTO kici_events
+         (event_name, payload, source_routing_key, chain_depth, processed, created_at, expires_at)
+       VALUES ($1, $2::jsonb, $3, $4, false, $5::timestamptz, NOW() + ($6)::interval)
+       RETURNING id`, [
+			opts.eventName,
+			JSON.stringify(opts.payload ?? {}),
+			opts.sourceRoutingKey ?? null,
+			opts.chainDepth ?? 0,
+			opts.createdAt.toISOString(),
+			expiresIn
+		])).rows[0].id };
+	} finally {
+		await pool.end();
+	}
+}
+/**
+* Page through unprocessed, non-DLQ kici_events for a given event_name using
+* the same composite `(created_at, id)` keyset cursor + `ORDER BY created_at
+* ASC, id ASC` that EventStore.getUnprocessedSince runs. Keep this SQL in sync
+* with `packages/orchestrator/src/events/event-store.ts`.
+*
+* Returns every id seen across all pages in traversal order (with duplicates
+* preserved so the caller can assert none occur) plus the page count. This is
+* the real-Postgres guard that the keyset cursor pages the entire backlog —
+* including same-created_at ties across a page boundary — with no skip and no
+* duplicate.
+*/
+async function paginateUnprocessedEventsKeysetDirect(databaseUrl, opts) {
+	const batchSize = Math.max(1, Math.min(1e4, opts.batchSize ?? 100));
+	const pool = createPool(databaseUrl);
+	try {
+		const ids = [];
+		let cursor = null;
+		let pages = 0;
+		for (;;) {
+			const params = [opts.eventName];
+			let cursorClause = "";
+			if (cursor) {
+				cursorClause = `AND (created_at, id) > ($2::timestamptz, $3::uuid)`;
+				params.push(cursor.createdAt, cursor.id);
+			}
+			const { rows } = await pool.query(`SELECT id, created_at FROM kici_events
+          WHERE event_name = $1 AND processed = false AND dlq_at IS NULL ${cursorClause}
+          ORDER BY created_at ASC, id ASC
+          LIMIT ${batchSize}`, params);
+			if (rows.length === 0) break;
+			pages += 1;
+			for (const r of rows) ids.push(r.id);
+			const last = rows[rows.length - 1];
+			cursor = {
+				createdAt: new Date(last.created_at).toISOString(),
+				id: last.id
+			};
+			if (rows.length < batchSize) break;
+		}
+		return {
+			ids,
+			pages
+		};
+	} finally {
+		await pool.end();
+	}
+}
+/**
 * Simulate a NOTIFY on `kici_event_channel` and verify a LISTEN client
 * receives it. Used by event-routing e2e to prove the infrastructure
 * the EventRouter uses for real-time delivery is functional. Owns the
@@ -2646,6 +2754,6 @@ async function terminateIdleDbBackendsDirect(databaseUrl) {
 	}
 }
 //#endregion
-export { MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeEnvironmentsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
 
 //# sourceMappingURL=db-admin.js.map

package/dist/db-collation.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import pg from "pg";
 //#region src/db-collation.ts
 /**

package/dist/db.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import pg from "pg";
 import { Kysely, PostgresDialect } from "kysely";
 import { createLogger } from "@kici-dev/core";

package/dist/diagnostics/bundle-archive.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 //#region src/diagnostics/bundle-archive.ts
@@ -16,7 +16,7 @@ const MAX_LOG_BYTES = 50 * 1024 * 1024;
 * Config field names that are safe to include unredacted.
 * Everything else gets replaced with "****".
 */
-const SAFE_CONFIG_KEYS = new Set([
+const SAFE_CONFIG_KEYS = /* @__PURE__ */ new Set([
 	"mode",
 	"host",
 	"port",

package/dist/diagnostics/bundle-chunks.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/diagnostics/bundle-chunks.ts
 /**
 * Channel-agnostic chunked transfer for fleet bundle ZIPs.

package/dist/env/allowlist.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/env/allowlist.ts
 /**
 * Source of truth for the env-var allowlist.

package/dist/env/define-env.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/env/define-env.ts
 /** Read an env value following the alias precedence (first non-undefined wins). */
 function readEnv(envMap, env) {
@@ -284,7 +284,7 @@ const RESERVED_NON_SCHEMA_KICI_SUFFIXES = ["_ENV_PROBE"];
 * `warnOnly: true`) to downgrade to a warning during local development.
 */
 function validateUnknownKiciVars(known, options = {}, env = process.env) {
-	const knownSet = new Set([
+	const knownSet = /* @__PURE__ */ new Set([
 		...known,
 		...options.extraKnown ?? [],
 		...RESERVED_NON_SCHEMA_KICI_VARS

package/dist/env/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { RESERVED_NON_SCHEMA_KICI_PREFIXES, RESERVED_NON_SCHEMA_KICI_VARS, defineEnv, validateUnknownKiciVars } from "./define-env.js";
 import { LOGGER_ENV_FIELD_SPECS, LOGGER_ENV_VARS, LoggerEnvSchema } from "./logger-env.js";
 export { LOGGER_ENV_FIELD_SPECS, LOGGER_ENV_VARS, LoggerEnvSchema, RESERVED_NON_SCHEMA_KICI_PREFIXES, RESERVED_NON_SCHEMA_KICI_VARS, defineEnv, validateUnknownKiciVars };

package/dist/env/logger-env.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/env/logger-env.ts
 /**

package/dist/graceful-shutdown.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/graceful-shutdown.ts
 /**

package/dist/idempotency-env-diff.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 //#region src/idempotency-env-diff.ts
 /**
 * Env-file semantic diff for the idempotent-step preview path.
@@ -60,7 +60,7 @@ function diffEnvFiles(local, remote) {
 	const localMap = parseEnvLines(local);
 	const remoteMap = parseEnvLines(remote);
 	const entries = [];
-	const keys = new Set([...localMap.keys(), ...remoteMap.keys()]);
+	const keys = /* @__PURE__ */ new Set([...localMap.keys(), ...remoteMap.keys()]);
 	for (const key of keys) {
 		const inLocal = localMap.has(key);
 		const inRemote = remoteMap.has(key);

package/dist/idempotency-files.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { diffEnvFiles, renderEnvDiff } from "./idempotency-env-diff.js";
 import { createTwoFilesPatch } from "diff";
 //#region src/idempotency-files.ts

package/dist/idempotency-yaml-diff.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { setYamlDiffRenderer } from "./idempotency-files.js";
 import { parse } from "yaml";
 //#region src/idempotency-yaml-diff.ts
@@ -89,7 +89,7 @@ function walkDiff(path, local, remote, out) {
 	if (lObj && rObj) {
 		const lRec = local;
 		const rRec = remote;
-		const keys = new Set([...Object.keys(lRec), ...Object.keys(rRec)]);
+		const keys = /* @__PURE__ */ new Set([...Object.keys(lRec), ...Object.keys(rRec)]);
 		for (const key of keys) walkDiff(path === "" ? key : `${path}.${key}`, lRec[key], rRec[key], out);
 		return;
 	}

package/dist/idempotency.js

@@ -1,3 +1,3 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 export * from "@kici-dev/core/idempotency";
 export {};

package/dist/index.d.ts

@@ -1,9 +1,11 @@
 export * from '@kici-dev/core';
+export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue, } from './secret-crypto.js';
 export { RingBuffer } from './ring-buffer.js';
 export { redactConfig, addLogsToArchive, MAX_LOG_BYTES } from './diagnostics/bundle-archive.js';
 export { chunkBuffer, BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, type BundleChunkFrame, } from './diagnostics/bundle-chunks.js';
 export { createPool, createDb, type CreatePoolOptions, type PgPoolErrorSource } from './db.js';
-export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, seedEnvironmentDirect, deleteEnvironmentDirect, seedEnvironmentBindingDirect, setEnvironmentPolicyDirect, listEnvironmentsDirect, showEnvironmentDirect, createEnvironmentTemplateDirect, setEnvironmentSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, waitForExecutionRunStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedEnvironmentOpts, type SeedEnvironmentResult, type SeedEnvironmentBindingOpts, type SetEnvironmentPolicyOpts, type EnvironmentRow, type EnvironmentVariableRow, type EnvironmentBindingRow, type ShowEnvironmentResult, type CreateEnvironmentTemplateOpts, type SetEnvironmentSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
+export { isPgUniqueViolation } from './pg-errors.js';
+export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, purgeEnvironmentsDirect, seedEnvironmentDirect, deleteEnvironmentDirect, seedEnvironmentBindingDirect, setEnvironmentPolicyDirect, listEnvironmentsDirect, showEnvironmentDirect, createEnvironmentTemplateDirect, setEnvironmentSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, waitForExecutionRunStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, insertKiciEventAtDirect, paginateUnprocessedEventsKeysetDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedEnvironmentOpts, type SeedEnvironmentResult, type SeedEnvironmentBindingOpts, type SetEnvironmentPolicyOpts, type EnvironmentRow, type EnvironmentVariableRow, type EnvironmentBindingRow, type ShowEnvironmentResult, type CreateEnvironmentTemplateOpts, type SetEnvironmentSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
 export { createMetricsRoutes, type MetricsRoutesDeps } from './routes/metrics.js';
 export { createHealthRoutes, type HealthRoutesDeps } from './routes/health.js';
 export { getReconnectDelay } from './reconnect-delay.js';

package/dist/index.js

@@ -1,10 +1,12 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { createDb, createPool } from "./db.js";
-import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
+import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeEnvironmentsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
 import { setupGracefulShutdown } from "./graceful-shutdown.js";
+import { decrypt, deriveKey, encrypt, generateMasterKey } from "./secret-crypto.js";
 import { RingBuffer } from "./ring-buffer.js";
 import { MAX_LOG_BYTES, addLogsToArchive, redactConfig } from "./diagnostics/bundle-archive.js";
 import { BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, chunkBuffer } from "./diagnostics/bundle-chunks.js";
+import { isPgUniqueViolation } from "./pg-errors.js";
 import { createMetricsRoutes } from "./routes/metrics.js";
 import { createHealthRoutes } from "./routes/health.js";
 import { getReconnectDelay } from "./reconnect-delay.js";
@@ -24,4 +26,4 @@ import { ChunkLru } from "./cold-store/lru.js";
 import { DEFAULT_TABLE_CONFIG, resolveTableConfig } from "./cold-store/config.js";
 import "./cold-store/index.js";
 export * from "@kici-dev/core";
-export { BaseColdStore, BundleChunkAssembler, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setupGracefulShutdown, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { BaseColdStore, BundleChunkAssembler, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveKey, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, generateMasterKey, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isPgUniqueViolation, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeEnvironmentsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setupGracefulShutdown, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };

package/dist/package-manager-types.js

@@ -1,3 +1,3 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 export * from "@kici-dev/core/package-manager-types";
 export {};

package/dist/package-manager.js

@@ -1,3 +1,3 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 export * from "@kici-dev/core/package-manager";
 export {};

package/dist/pg-errors.d.ts

@@ -0,0 +1,8 @@
+/**
+ * True iff `err` is a Postgres unique-violation, optionally scoped to a named
+ * constraint. Pure guard over `unknown` — no `pg` import — so callers in the
+ * data layer can translate a raw driver error into a domain error, and it can
+ * be unit-tested without a live database.
+ */
+export declare function isPgUniqueViolation(err: unknown, constraint?: string): boolean;
+//# sourceMappingURL=pg-errors.d.ts.map

package/dist/pg-errors.js

@@ -0,0 +1,21 @@
+import "./rolldown-runtime-ClRpJifh.js";
+//#region src/pg-errors.ts
+/** Postgres SQLSTATE for a unique-violation. */
+const PG_UNIQUE_VIOLATION = "23505";
+/**
+* True iff `err` is a Postgres unique-violation, optionally scoped to a named
+* constraint. Pure guard over `unknown` — no `pg` import — so callers in the
+* data layer can translate a raw driver error into a domain error, and it can
+* be unit-tested without a live database.
+*/
+function isPgUniqueViolation(err, constraint) {
+	if (typeof err !== "object" || err === null) return false;
+	const e = err;
+	if (e.code !== PG_UNIQUE_VIOLATION) return false;
+	if (constraint !== void 0 && e.constraint !== constraint) return false;
+	return true;
+}
+//#endregion
+export { isPgUniqueViolation };
+
+//# sourceMappingURL=pg-errors.js.map

package/dist/pg-errors.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pg-errors.test.d.ts.map

package/dist/reconnect-delay.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 //#region src/reconnect-delay.ts
 /**
 * Calculate reconnection delay with exponential backoff and jitter.

package/dist/ring-buffer.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 //#region src/ring-buffer.ts
 /**
 * Generic ring buffer with a configurable maximum size.

package/dist/{chunk-BTugEXQM.js → rolldown-runtime-ClRpJifh.js}

@@ -1,4 +1,3 @@
 import "node:module";
-import.meta.url;
 //#endregion
 export {};

package/dist/routes/health.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { Hono } from "hono";
 //#region src/routes/health.ts
 /**

package/dist/routes/metrics.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { Hono } from "hono";
 //#region src/routes/metrics.ts
 /**

package/dist/s3-client.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { S3Client } from "@aws-sdk/client-s3";
 //#region src/s3-client.ts
 /**

package/dist/secret-crypto.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Encrypted value with key version tracking.
+ * The data field contains base64-encoded IV || AuthTag || Ciphertext.
+ */
+export interface EncryptedValue {
+    /** Base64-encoded IV + auth tag + ciphertext. */
+    data: string;
+    /** Version of the encryption key used. */
+    keyVersion: number;
+}
+/**
+ * Encrypt a plaintext string using AES-256-GCM with AAD.
+ *
+ * @param plaintext - The string to encrypt
+ * @param key - 32-byte encryption key
+ * @param keyVersion - Version number for key rotation tracking
+ * @param aad - Additional authenticated data (e.g., "contextId:keyName")
+ * @returns Encrypted value with key version
+ */
+export declare function encrypt(plaintext: string, key: Buffer, keyVersion: number, aad: string): EncryptedValue;
+/**
+ * Decrypt an encrypted value using AES-256-GCM with AAD verification.
+ *
+ * @param encrypted - The encrypted value to decrypt
+ * @param key - 32-byte encryption key (must match the key used for encryption)
+ * @param aad - Additional authenticated data (must match the AAD used for encryption)
+ * @returns Decrypted plaintext string
+ * @throws If decryption fails (wrong key, wrong AAD, tampered data)
+ */
+export declare function decrypt(encrypted: EncryptedValue, key: Buffer, aad: string): string;
+/**
+ * Derive a 32-byte encryption key from a string input.
+ *
+ * Accepts two formats:
+ * - 64-character hex string (e.g., from generateMasterKey())
+ * - Base64-encoded 32-byte key
+ *
+ * @param input - Hex or base64 encoded key material
+ * @returns 32-byte Buffer suitable for use with encrypt/decrypt
+ * @throws If the derived key is not exactly 32 bytes
+ */
+export declare function deriveKey(input: string): Buffer;
+/**
+ * Generate a new random 32-byte master key as a hex string.
+ *
+ * @returns 64-character hex string suitable for KICI_SECRET_KEY env var
+ */
+export declare function generateMasterKey(): string;
+//# sourceMappingURL=secret-crypto.d.ts.map

package/dist/secret-crypto.js

@@ -0,0 +1,92 @@
+import "./rolldown-runtime-ClRpJifh.js";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+//#region src/secret-crypto.ts
+/**
+* AES-256-GCM encryption layer for secrets management.
+*
+* Provides authenticated encryption with additional data (AAD)
+* to prevent cross-context secret swaps. The AAD is typically
+* "contextId:keyName" binding the ciphertext to its location.
+*
+* Wire format (base64 encoded): IV (12 bytes) || AuthTag (16 bytes) || Ciphertext
+*/
+/** Length of the initialization vector in bytes. */
+const IV_LENGTH = 12;
+/** Length of the GCM authentication tag in bytes. */
+const TAG_LENGTH = 16;
+/** Algorithm identifier for Node.js crypto. */
+const ALGO = "aes-256-gcm";
+/**
+* Encrypt a plaintext string using AES-256-GCM with AAD.
+*
+* @param plaintext - The string to encrypt
+* @param key - 32-byte encryption key
+* @param keyVersion - Version number for key rotation tracking
+* @param aad - Additional authenticated data (e.g., "contextId:keyName")
+* @returns Encrypted value with key version
+*/
+function encrypt(plaintext, key, keyVersion, aad) {
+	const iv = randomBytes(IV_LENGTH);
+	const cipher = createCipheriv(ALGO, key, iv, { authTagLength: TAG_LENGTH });
+	cipher.setAAD(Buffer.from(aad, "utf-8"));
+	const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+	const authTag = cipher.getAuthTag();
+	return {
+		data: Buffer.concat([
+			iv,
+			authTag,
+			encrypted
+		]).toString("base64"),
+		keyVersion
+	};
+}
+/**
+* Decrypt an encrypted value using AES-256-GCM with AAD verification.
+*
+* @param encrypted - The encrypted value to decrypt
+* @param key - 32-byte encryption key (must match the key used for encryption)
+* @param aad - Additional authenticated data (must match the AAD used for encryption)
+* @returns Decrypted plaintext string
+* @throws If decryption fails (wrong key, wrong AAD, tampered data)
+*/
+function decrypt(encrypted, key, aad) {
+	const packed = Buffer.from(encrypted.data, "base64");
+	if (packed.length < 28) throw new Error("Invalid encrypted data: too short");
+	const iv = packed.subarray(0, IV_LENGTH);
+	const authTag = packed.subarray(IV_LENGTH, 28);
+	const ciphertext = packed.subarray(28);
+	const decipher = createDecipheriv(ALGO, key, iv, { authTagLength: TAG_LENGTH });
+	decipher.setAuthTag(authTag);
+	decipher.setAAD(Buffer.from(aad, "utf-8"));
+	return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf-8");
+}
+/**
+* Derive a 32-byte encryption key from a string input.
+*
+* Accepts two formats:
+* - 64-character hex string (e.g., from generateMasterKey())
+* - Base64-encoded 32-byte key
+*
+* @param input - Hex or base64 encoded key material
+* @returns 32-byte Buffer suitable for use with encrypt/decrypt
+* @throws If the derived key is not exactly 32 bytes
+*/
+function deriveKey(input) {
+	let key;
+	if (/^[0-9a-fA-F]{64}$/.test(input)) key = Buffer.from(input, "hex");
+	else key = Buffer.from(input, "base64");
+	if (key.length !== 32) throw new Error(`Encryption key must be exactly 32 bytes, got ${key.length} bytes. Provide a 64-character hex string or a base64-encoded 32-byte value.`);
+	return key;
+}
+/**
+* Generate a new random 32-byte master key as a hex string.
+*
+* @returns 64-character hex string suitable for KICI_SECRET_KEY env var
+*/
+function generateMasterKey() {
+	return randomBytes(32).toString("hex");
+}
+//#endregion
+export { decrypt, deriveKey, encrypt, generateMasterKey };
+
+//# sourceMappingURL=secret-crypto.js.map

package/dist/secret-crypto.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-crypto.test.d.ts.map

package/dist/telemetry/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { collectRuntimeMetricNames, getPrometheusExporter, initTelemetry } from "./init.js";
 import { createMeter } from "./metrics.js";
 export { collectRuntimeMetricNames, createMeter, getPrometheusExporter, initTelemetry };

package/dist/telemetry/init.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { NodeSDK } from "@opentelemetry/sdk-node";
 import { PrometheusExporter } from "@opentelemetry/exporter-prometheus";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";

package/dist/telemetry/metrics.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { metrics } from "@opentelemetry/api";
 //#region src/telemetry/metrics.ts
 /**

package/dist/tool-check.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { accessSync, constants } from "node:fs";
 import { delimiter, join } from "node:path";
 //#region src/tool-check.ts

package/dist/ts-loader-hook.js

@@ -1,3 +1,3 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 export * from "@kici-dev/core/ts-loader-hook";
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/shared",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
   "keywords": [
     "ci",
@@ -70,6 +70,10 @@
       "import": "./dist/db-collation.js",
       "types": "./dist/db-collation.d.ts"
     },
+    "./secret-crypto": {
+      "import": "./dist/secret-crypto.js",
+      "types": "./dist/secret-crypto.d.ts"
+    },
     "./package-manager": {
       "import": "./dist/package-manager.js",
       "types": "./dist/package-manager.d.ts"
@@ -101,7 +105,7 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.23"
+    "@kici-dev/core": "0.1.25"
   },
   "devDependencies": {
     "@opentelemetry/sdk-trace-base": "^2.7.1",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/shared@0.1.23",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fshared/0.1.23/1a6722a5-09a5-4867-83e3-89789b97e947",
+  "name": "@kici-dev/shared@0.1.25",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fshared/0.1.25/5f799c39-e3ad-4f51-a630-3901745fc4f4",
   "creationInfo": {
-    "created": "2026-06-25T11:12:36Z",
+    "created": "2026-07-05T08:32:19Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -696,9 +696,9 @@
       "homepage": "https://js-sdsl.org"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.25",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.25",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -709,7 +709,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.25"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
@@ -718,7 +718,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.25",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -729,7 +729,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.25"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -5202,32 +5202,32 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.25",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.25",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.25",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.25",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.25",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.25",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
@@ -5238,7 +5238,7 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.25",
       "relationshipType": "DEPENDS_ON"
     },
     {