@astralarium/repo-auth 0.0.0-stage → 0.2.0

package/dist/testkit/oidc.d.ts

@@ -0,0 +1,35 @@
+/** An OpenID Connect provider as a `fetch` stand-in: discovery, JWKS, a
+ *  token endpoint issuing RS256 ID tokens for the codes `authorize`
+ *  grants, and userinfo. */
+/** `fakeOidcProvider` setup. */
+export interface FakeOidcProviderOptions {
+    /** Issuer URL; discovery at `<issuer>/.well-known/openid-configuration`. */
+    issuer: string;
+    /** The relying party's client id: the ID token audience. */
+    clientId: string;
+    /** ID token claims of every account, beside its own. */
+    claims?: Record<string, unknown>;
+    /** Space-separated grant of every account; empty omits it. Default
+     *  `openid`. */
+    scope?: string;
+}
+/** An account approving an authorization. */
+export interface FakeOidcAccount {
+    /** Account id: the ID token `sub`. */
+    sub: string;
+    /** ID token and userinfo claims beside `sub`, over the provider's. */
+    claims?: Record<string, unknown>;
+    /** Space-separated grant; empty omits it. Default the provider's. */
+    scope?: string;
+    /** ID token `nonce`. Default the authorization request's. */
+    nonce?: string;
+}
+/**
+ * The provider for client `clientId` at `issuer`. `fetch` serves its
+ * endpoints, 404 elsewhere; PKCE (S256) and the redirect URI bind each
+ * code, used once. `authorize` approves an authorization URL.
+ */
+export declare function fakeOidcProvider({ issuer, clientId, claims: providerClaims, scope: providerScope, }: FakeOidcProviderOptions): Promise<{
+    fetch: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+    authorize: (authorizationUrl: string | URL, account: FakeOidcAccount) => URLSearchParams;
+}>;

package/dist/testkit/oidc.js

@@ -0,0 +1,154 @@
+/** An OpenID Connect provider as a `fetch` stand-in: discovery, JWKS, a
+ *  token endpoint issuing RS256 ID tokens for the codes `authorize`
+ *  grants, and userinfo. */
+/** Key id of the signing key in JWKS and ID token headers. */
+const KEY_ID = "fake-oidc-key";
+/** Unpadded base64url of `data`. */
+function base64url(data) {
+  const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+  return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+/** S256 PKCE challenge of `text`. */
+async function sha256(text) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+  return base64url(new Uint8Array(digest));
+}
+/**
+ * The provider for client `clientId` at `issuer`. `fetch` serves its
+ * endpoints, 404 elsewhere; PKCE (S256) and the redirect URI bind each
+ * code, used once. `authorize` approves an authorization URL.
+ */
+export async function fakeOidcProvider({
+  issuer,
+  clientId,
+  claims: providerClaims = {},
+  scope: providerScope = "openid"
+}) {
+  const endpoints = {
+    discovery: `${issuer}/.well-known/openid-configuration`,
+    authorization: `${issuer}/authorize`,
+    token: `${issuer}/token`,
+    userinfo: `${issuer}/userinfo`,
+    jwks: `${issuer}/jwks`
+  };
+  const keys = await crypto.subtle.generateKey({
+    name: "RSASSA-PKCS1-v1_5",
+    modulusLength: 2048,
+    publicExponent: new Uint8Array([1, 0, 1]),
+    hash: "SHA-256"
+  }, true, ["sign", "verify"]);
+  const publicJwk = {
+    ...(await crypto.subtle.exportKey("jwk", keys.publicKey)),
+    kid: KEY_ID,
+    alg: "RS256",
+    use: "sig"
+  };
+  const grants = new Map();
+  /** Userinfo claims by access token. */
+  const userinfo = new Map();
+  /** RS256 ID token of `grant`. */
+  async function idToken({
+    claims,
+    nonce
+  }) {
+    const now = Math.floor(Date.now() / 1000);
+    const input = [base64url(JSON.stringify({
+      alg: "RS256",
+      kid: KEY_ID,
+      typ: "JWT"
+    })), base64url(JSON.stringify({
+      ...claims,
+      iss: issuer,
+      aud: clientId,
+      nonce,
+      iat: now,
+      exp: now + 3600
+    }))].join(".");
+    const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", keys.privateKey, new TextEncoder().encode(input));
+    return `${input}.${base64url(new Uint8Array(signature))}`;
+  }
+  /** Token endpoint: redeems a code once, checking client, redirect URI and
+   *  PKCE verifier. */
+  async function exchange(body) {
+    const code = body.get("code") ?? "";
+    const grant = grants.get(code);
+    grants.delete(code);
+    if (!grant || body.get("client_id") !== clientId || body.get("redirect_uri") !== grant.redirectUri || (await sha256(body.get("code_verifier") ?? "")) !== grant.codeChallenge) return Response.json({
+      error: "invalid_grant"
+    }, {
+      status: 400
+    });
+    const accessToken = crypto.randomUUID();
+    userinfo.set(accessToken, grant.claims);
+    return Response.json({
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: 3600,
+      ...(grant.scope && {
+        scope: grant.scope
+      }),
+      id_token: await idToken(grant)
+    });
+  }
+  /** Serves the provider's endpoints; other URLs answer 404. */
+  async function fetch(input, init) {
+    const request = new Request(input, init);
+    const {
+      origin,
+      pathname
+    } = new URL(request.url);
+    const url = `${origin}${pathname}`;
+    if (url === endpoints.discovery) return Response.json({
+      issuer,
+      authorization_endpoint: endpoints.authorization,
+      token_endpoint: endpoints.token,
+      userinfo_endpoint: endpoints.userinfo,
+      jwks_uri: endpoints.jwks,
+      response_types_supported: ["code"],
+      subject_types_supported: ["public"],
+      id_token_signing_alg_values_supported: ["RS256"],
+      code_challenge_methods_supported: ["S256"]
+    });
+    if (url === endpoints.jwks) return Response.json({
+      keys: [publicJwk]
+    });
+    if (url === endpoints.token && request.method === "POST") return exchange(new URLSearchParams(await request.text()));
+    if (url === endpoints.userinfo) {
+      const token = request.headers.get("authorization")?.replace(/^Bearer /i, "");
+      const claims = token && userinfo.get(token);
+      return claims ? Response.json(claims) : Response.json({
+        error: "invalid_token"
+      }, {
+        status: 401
+      });
+    }
+    return new Response("Not Found", {
+      status: 404
+    });
+  }
+  /** Approves `authorizationUrl` as `account`: the callback query
+   *  (`code`, `state`). */
+  function authorize(authorizationUrl, account) {
+    const params = new URL(authorizationUrl).searchParams;
+    const code = crypto.randomUUID();
+    grants.set(code, {
+      claims: {
+        ...providerClaims,
+        ...account.claims,
+        sub: account.sub
+      },
+      scope: account.scope ?? providerScope,
+      nonce: account.nonce ?? params.get("nonce") ?? "",
+      codeChallenge: params.get("code_challenge") ?? "",
+      redirectUri: params.get("redirect_uri") ?? ""
+    });
+    return new URLSearchParams({
+      code,
+      state: params.get("state") ?? ""
+    });
+  }
+  return {
+    fetch,
+    authorize
+  };
+}

package/dist/testkit/suites.d.ts

@@ -0,0 +1,126 @@
+import type { BetterAuthPlugin } from "better-auth";
+import { type AdditionalFields, type ShellAuthApp } from "../index.server.ts";
+import type { AuthProviderCredentials } from "../providers/provider.ts";
+import type { SessionLike } from "../types.ts";
+import { type JsonRequester } from "./index.ts";
+/** A client of the app under test, as `appRequester`: its answer to
+ *  `init` at `path`, redirects answered as responses. */
+export type AppRequester = (path: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    status: number;
+    headers: {
+        get(name: string): string | null;
+        getSetCookie(): string[];
+    };
+    text(): Promise<string>;
+    body: {
+        cancel(): Promise<void>;
+    } | null;
+}>;
+/** A signed-in session for a suite: `start` resolves to its `cookie`
+ *  header; `end` removes what `start` created. */
+export interface SessionSource {
+    start(): Promise<string>;
+    end(): Promise<void>;
+}
+/** Dev sign-in through the app at `origin` as `accountId`
+ *  (`ShellAuthApp.devSignIn`): its answer. */
+export declare function devSignIn(request: AppRequester, origin: string, accountId: string): Promise<{
+    status: number;
+    headers: {
+        get(name: string): string | null;
+        getSetCookie(): string[];
+    };
+    text(): Promise<string>;
+    body: {
+        cancel(): Promise<void>;
+    } | null;
+}>;
+/** A session `devSignInAs` signed in. */
+export interface DevSignedIn {
+    /** The session's user. */
+    userId: string;
+    /** `cookie` header of the response's cookies. */
+    cookie: string;
+    /** The response's `Set-Cookie` values. */
+    setCookies: string[];
+}
+/** Signs in through the app's dev sign-in at `origin` as `accountId`;
+ *  rejects naming any answer other than 200. */
+export declare function devSignInAs(request: AppRequester, origin: string, accountId: string): Promise<DevSignedIn>;
+/** The session and user ids `cookie` carries, read past the cookie
+ *  cache. */
+export declare function sessionOf(request: AppRequester, cookie: string): Promise<{
+    session: {
+        id: string;
+    };
+    user: {
+        id: string;
+    };
+}>;
+/** A session signed in through the app's dev sign-in at `origin` as a
+ *  fresh `devAccountId()` (apps with `devSignIn`); its new user is deleted
+ *  from `db` at `end`. */
+export declare function devSignInSession(request: AppRequester, { origin, db, devAccountId, }: Pick<DevAuthSuite, "origin" | "db" | "devAccountId">): SessionSource;
+/** What `testDevAuth` runs against. */
+export interface DevAuthSuite {
+    /** The signed-in visitor. */
+    session: SessionSource;
+    /** The app's origin; dev sign-in posts from it. */
+    origin: string;
+    /** A fresh account id of the app's `devSignIn` provider: unheld by any
+     *  account, its `newUser` email by any user. The suite deletes each user
+     *  dev sign-in answers for one. */
+    devAccountId: () => string;
+    /** Connection string of the app's database. */
+    db: string;
+    /** Postgres role the app queries as. */
+    role: string;
+    /** Public page URLs, served alike to every visitor. */
+    publicPages: readonly string[];
+    /** Provider id whose sign-in starts on each local origin. */
+    provider: string;
+    /** Clients of the app at each local origin, by transport name
+     *  (`HTTP/1.1`, `HTTP/2`). */
+    localOrigins: readonly {
+        origin: string;
+        requesters: Readonly<Record<string, JsonRequester>>;
+    }[];
+    /** The app's auth rate limit: requests per window from one client. */
+    rateLimit: number;
+}
+/**
+ * Tests of `request`'s dev app serving auth over its Postgres: the database
+ * role, public pages independent of the viewer, dev sign-in, provider
+ * callbacks on each local origin, and the rate limit, last: it exhausts
+ * the client's budget for the window. Users dev sign-in creates are
+ * deleted from `db` after.
+ */
+export declare function testDevAuth(request: AppRequester, { session, origin, devAccountId, db, role, publicPages, provider, localOrigins, rateLimit, }: DevAuthSuite): void;
+/** What `testProductionAuth` runs against. */
+export interface ProductionAuthSuite<Fields extends AdditionalFields, Projected extends SessionLike> {
+    /** The app's public origin. */
+    origin: string;
+    /** The app's declaration; its `errorURL` page answers 200. */
+    app: ShellAuthApp<Fields, Projected>;
+    /** The auth secret. */
+    secret: string;
+    /** Provider credentials the production worker holds; the suite signs
+     *  in through each declared provider they enable. */
+    credentials: AuthProviderCredentials;
+    /** better-auth plugins the served instance adds. */
+    plugins?: BetterAuthPlugin[];
+    /** Connection string of the app's database. */
+    db: string;
+}
+/**
+ * Tests of `request`'s production app serving auth, against `app` built for
+ * production (`devSignIn` off): its schema, 404s outside the served
+ * endpoints and at dev sign-in, ID-token refusal, the anonymous session, a failed provider
+ * callback landing on the error page, and each provider's sign-in with its
+ * runtime client and callback.
+ */
+export declare function testProductionAuth<Fields extends AdditionalFields, Projected extends SessionLike>(request: AppRequester, { origin, app, secret, credentials, plugins, db, }: ProductionAuthSuite<Fields, Projected>): void;

package/dist/testkit/suites.js

@@ -0,0 +1,255 @@
+/** Test suites of an app's served auth: its dev build over the app's
+ *  Postgres, and its production build; dev sign-in through the app. */
+import { expectViewerIndependent } from "@astralarium/repo-config-vitest/pages";
+import { withSql } from "@astralarium/repo-postgres/sql";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { z } from "zod";
+import { DEV_SIGN_IN_ENDPOINT } from "../dev-sign-in/endpoint.js";
+import { shellAuth } from "../index.server.js";
+import { AUTH_BASE_PATH } from "../request.js";
+import { authorizePaths, cookieHeader, cookiePairs, expectAnonymousSession, expectAuthRateLimited, idTokenAuthorization, socialSignIn, unservedAuthPaths, verifyAuthSchema, withBlockedSessionRead } from "./index.js";
+import { jsonPost } from "./json-post.js";
+/** Dev sign-in through the app at `origin` as `accountId`
+ *  (`ShellAuthApp.devSignIn`): its answer. */
+export function devSignIn(request, origin, accountId) {
+  return request(`${AUTH_BASE_PATH}${DEV_SIGN_IN_ENDPOINT}`, {
+    method: "POST",
+    headers: {
+      origin,
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      accountId
+    }).toString()
+  });
+}
+/** Signs in through the app's dev sign-in at `origin` as `accountId`;
+ *  rejects naming any answer other than 200. */
+export async function devSignInAs(request, origin, accountId) {
+  const response = await devSignIn(request, origin, accountId);
+  const body = await response.text();
+  if (response.status !== 200) throw new Error(`dev sign-in as ${accountId}: HTTP ${response.status} ${body}`);
+  const {
+    user
+  } = z.object({
+    user: z.object({
+      id: z.string()
+    })
+  }).parse(JSON.parse(body));
+  const setCookies = response.headers.getSetCookie();
+  return {
+    userId: user.id,
+    cookie: cookieHeader(cookiePairs(setCookies)),
+    setCookies
+  };
+}
+/** The session and user ids `cookie` carries, read past the cookie
+ *  cache. */
+export async function sessionOf(request, cookie) {
+  const response = await request(`${AUTH_BASE_PATH}/get-session?disableCookieCache=true`, {
+    headers: {
+      cookie
+    }
+  });
+  return z.object({
+    session: z.object({
+      id: z.string()
+    }),
+    user: z.object({
+      id: z.string()
+    })
+  }).parse(JSON.parse(await response.text()));
+}
+/** A session signed in through the app's dev sign-in at `origin` as a
+ *  fresh `devAccountId()` (apps with `devSignIn`); its new user is deleted
+ *  from `db` at `end`. */
+export function devSignInSession(request, {
+  origin,
+  db,
+  devAccountId
+}) {
+  let userId;
+  return {
+    async start() {
+      const signedIn = await devSignInAs(request, origin, devAccountId());
+      userId = signedIn.userId;
+      return signedIn.cookie;
+    },
+    async end() {
+      if (!userId) return;
+      const id = userId;
+      await withSql(db, async sql => {
+        await sql`DELETE FROM auth.users WHERE id = ${id}`;
+      });
+    }
+  };
+}
+/**
+ * Tests of `request`'s dev app serving auth over its Postgres: the database
+ * role, public pages independent of the viewer, dev sign-in, provider
+ * callbacks on each local origin, and the rate limit, last: it exhausts
+ * the client's budget for the window. Users dev sign-in creates are
+ * deleted from `db` after.
+ */
+export function testDevAuth(request, {
+  session,
+  origin,
+  devAccountId,
+  db,
+  role,
+  publicPages,
+  provider,
+  localOrigins,
+  rateLimit
+}) {
+  describe("dev auth", {
+    concurrent: false
+  }, () => {
+    let cookie = "";
+    /** Users dev sign-in created. */
+    const devUsers = new Set();
+    beforeAll(async () => {
+      cookie = await session.start();
+    });
+    afterAll(async () => {
+      await session.end();
+      await withSql(db, async sql => {
+        await sql`DELETE FROM auth.users WHERE id = ANY(${[...devUsers]}::uuid[])`;
+      });
+    });
+    /** Signs in as `accountId`: the session's user id and the response's
+     *  `Set-Cookie` values. */
+    async function signInAs(accountId) {
+      const signedIn = await devSignInAs(request, origin, accountId);
+      devUsers.add(signedIn.userId);
+      return signedIn;
+    }
+    test(`the app queries Postgres as ${role}, a non-superuser`, async () => {
+      const blocked = await withBlockedSessionRead(db, () => request(`${AUTH_BASE_PATH}/get-session?disableCookieCache=true`, {
+        headers: {
+          cookie
+        }
+      }), blocked => blocked);
+      expect(blocked).toMatchObject({
+        role,
+        superuser: false
+      });
+      expect((await blocked.response).status).toBe(200);
+    }, 15_000);
+    test.each(publicPages)("the public page %s serves a signed-in visitor the anonymous visitor's document", url => expectViewerIndependent(request, url, cookie));
+    test(`dev sign-in signs in as a new ${provider} account's user with better-auth's session cookies and a signed marker naming the session`, async () => {
+      const signedIn = await signInAs(devAccountId());
+      const fresh = await sessionOf(request, signedIn.cookie);
+      expect(fresh.user.id).toBe(signedIn.userId);
+      expect(signedIn.setCookies).toContainEqual(expect.stringMatching(new RegExp(`\\.dev_sign_in=${fresh.session.id}\\.[^;]+;.*HttpOnly`, "i")));
+    });
+    test(`dev sign-in as an existing ${provider} account signs in as its user`, async () => {
+      const accountId = devAccountId();
+      const first = await signInAs(accountId);
+      const second = await signInAs(accountId);
+      expect(second.userId).toBe(first.userId);
+      expect((await sessionOf(request, second.cookie)).user.id).toBe(first.userId);
+    });
+    test("dev sign-in refuses a cross-origin request", async () => {
+      const response = await devSignIn(request, "https://elsewhere.invalid", devAccountId());
+      expect(response.status).toBe(403);
+      await response.body?.cancel();
+    });
+    test.each(localOrigins.flatMap(({
+      origin,
+      requesters
+    }) => Object.entries(requesters).map(([transport, requester]) => ({
+      origin,
+      transport,
+      requester
+    }))))(`the ${provider} callback stays on $origin over $transport`, async ({
+      origin,
+      requester
+    }) => {
+      const url = await socialSignIn(requester, {
+        origin,
+        provider
+      });
+      expect(url.searchParams.get("redirect_uri")).toBe(`${origin}${AUTH_BASE_PATH}/callback/${provider}`);
+    });
+    test("the app throttles repeated auth requests from one client", async () => {
+      await expectAuthRateLimited(request, `${AUTH_BASE_PATH}/get-session`, rateLimit);
+    }, 15_000);
+  });
+}
+/**
+ * Tests of `request`'s production app serving auth, against `app` built for
+ * production (`devSignIn` off): its schema, 404s outside the served
+ * endpoints and at dev sign-in, ID-token refusal, the anonymous session, a failed provider
+ * callback landing on the error page, and each provider's sign-in with its
+ * runtime client and callback.
+ */
+export function testProductionAuth(request, {
+  origin,
+  app,
+  secret,
+  credentials,
+  plugins,
+  db
+}) {
+  const production = {
+    ...app,
+    devSignIn: undefined
+  };
+  const auth = shellAuth(() => ({
+    ...production,
+    baseURL: origin,
+    secret,
+    credentials,
+    plugins
+  }))({});
+  const ids = app.providers?.enabled(credentials) ?? [];
+  const clients = ids.map(provider => ({
+    provider,
+    clientId: credentials[provider].clientId
+  }));
+  const provider = clients[0]?.provider ?? "";
+  describe("production auth", () => {
+    test("the auth database schema holds every field the auth configuration maps", () => verifyAuthSchema(db, auth));
+    test.each(unservedAuthPaths(auth, production))("the production app returns not found for unused auth path %s", async path => {
+      const response = await request(path, jsonPost(origin, {}));
+      expect(response.status).toBe(404);
+      expect(await response.text()).toBe("Not Found");
+    });
+    test("the production app returns not found for dev sign-in", async () => {
+      const response = await devSignIn(request, origin, "1");
+      expect(response.status).toBe(404);
+      await response.body?.cancel();
+    });
+    test.each(authorizePaths(production))("the production app refuses ID-token authorization at %s", async path => {
+      const response = await request(path, idTokenAuthorization({
+        origin,
+        provider
+      }));
+      expect(response.status).toBe(400);
+      await response.body?.cancel();
+    });
+    test("the production app serves no session to an anonymous request", () => expectAnonymousSession(request));
+    test.skipIf(!provider)("the production app lands a failed provider callback on its error page", async () => {
+      const callback = await request(`${AUTH_BASE_PATH}/callback/${provider}?error=access_denied`);
+      expect(callback.status).toBe(302);
+      await callback.body?.cancel();
+      const location = new URL(callback.headers.get("location") ?? "", origin);
+      expect(location.pathname).toBe(new URL(app.errorURL, origin).pathname);
+      const page = await request(`${location.pathname}${location.search}`);
+      expect(page.status).toBe(200);
+      await page.body?.cancel();
+    });
+    test.each(clients)("the production app signs in through $provider with runtime OAuth credentials and its configured callback origin", async ({
+      provider,
+      clientId
+    }) => {
+      const url = await socialSignIn(request, {
+        origin,
+        provider
+      });
+      expect(url.searchParams.get("redirect_uri")).toBe(`${origin}${AUTH_BASE_PATH}/callback/${provider}`);
+      expect(url.searchParams.get("client_id")).toBe(clientId);
+    });
+  });
+}

package/dist/types.d.ts

@@ -0,0 +1,7 @@
+/** Projected session shape every consumer relies on. */
+export interface SessionLike {
+    session: object;
+    user: {
+        id: string;
+    };
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,89 @@
 {
   "name": "@astralarium/repo-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "license": "MIT",
+  "homepage": "https://github.com/astralarium/repo/tree/main/packages/repo-auth#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/astralarium/repo.git",
+    "directory": "packages/repo-auth"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "sql"
+  ],
+  "exports": {
+    ".": "./dist/index.server.js",
+    "./client": "./dist/client.js",
+    "./dev-sign-in": "./dist/dev-sign-in/index.js",
+    "./dev-sign-in/client": "./dist/dev-sign-in/client.js",
+    "./providers": "./dist/providers/index.js",
+    "./request": "./dist/request.js",
+    "./schema": "./dist/schema.js",
+    "./start": "./dist/start/index.js",
+    "./start/server": "./dist/start/index.server.js",
+    "./testkit": "./dist/testkit/index.js",
+    "./testkit/suites": "./dist/testkit/suites.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "kysely": "^0.29.5",
+    "pg": "^8.20.0",
+    "zod": "^4.6.7",
+    "@astralarium/repo-package-files": "^0.1.0",
+    "@astralarium/repo-telemetry": "^0.2.0",
+    "@astralarium/repo-postgres": "^0.2.0",
+    "@astralarium/repo-env": "^0.2.0"
+  },
+  "devDependencies": {
+    "@tanstack/query-core": "^5.107.1",
+    "@tanstack/react-start": "^1.169.4",
+    "@types/node": "^24.2.0",
+    "@types/pg": "^8.20.0",
+    "@types/react": "19.2.14",
+    "better-auth": "^1.7.7",
+    "eslint": "^10.2.1",
+    "postgres": "^3.4.9",
+    "react": "19.2.5",
+    "typescript": "^6.0.3",
+    "vite": "^8.3.4",
+    "vitest": "^5.0.3",
+    "@astralarium/repo-config-typescript": "^0.1.0",
+    "@astralarium/repo-config-vitest": "^0.2.0",
+    "@astralarium/repo-config-eslint": "^0.3.0",
+    "@astralarium/repo-package-build": "^0.1.0"
+  },
+  "peerDependencies": {
+    "@tanstack/react-start": "^1.169.4",
+    "better-auth": "^1.7.7",
+    "react": "^19.2.0",
+    "vitest": "^5.0.3",
+    "@astralarium/repo-config-vitest": "^0.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@astralarium/repo-config-vitest": {
+      "optional": true
+    },
+    "@tanstack/react-start": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "vitest": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=24.2"
+  },
+  "scripts": {
+    "check-types": "tsc --noEmit && tsc -p tsconfig.build.json --noEmit",
+    "lint": "eslint",
+    "test": "vitest"
+  }
 }