@astram/identity 0.10.0 → 0.11.0

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.FilesService = exports.IdentityFeatureModule = exports.buildIdentityAuthKeys = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.StoredFile = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
 /**
  * @astram/identity — the framework-owned identity + tenancy model.
  * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
@@ -27,6 +27,8 @@ var company_branch_object_js_1 = require("./company-branch.object.js");
 Object.defineProperty(exports, "CompanyBranch", { enumerable: true, get: function () { return company_branch_object_js_1.CompanyBranch; } });
 var service_account_object_js_1 = require("./service-account.object.js");
 Object.defineProperty(exports, "ServiceAccount", { enumerable: true, get: function () { return service_account_object_js_1.ServiceAccount; } });
+var stored_file_object_js_1 = require("./stored-file.object.js");
+Object.defineProperty(exports, "StoredFile", { enumerable: true, get: function () { return stored_file_object_js_1.StoredFile; } });
 var migrations_dir_js_1 = require("./migrations-dir.js");
 Object.defineProperty(exports, "identityMigrationsDir", { enumerable: true, get: function () { return migrations_dir_js_1.identityMigrationsDir; } });
 /**
@@ -46,6 +48,10 @@ Object.defineProperty(exports, "identityObjects", { enumerable: true, get: funct
 var auth_facts_keys_js_1 = require("./auth-facts-keys.js");
 Object.defineProperty(exports, "identityAuthActionKeys", { enumerable: true, get: function () { return auth_facts_keys_js_1.identityAuthActionKeys; } });
 Object.defineProperty(exports, "identityControlPlaneKeys", { enumerable: true, get: function () { return auth_facts_keys_js_1.identityControlPlaneKeys; } });
+/** KI #70: the same key universe with the consumer's `extraObjects` (pass the SAME list to
+ *  `IdentityFeatureModule.forRoot({ extraObjects })`). */
+var auth_facts_keys_js_2 = require("./auth-facts-keys.js");
+Object.defineProperty(exports, "buildIdentityAuthKeys", { enumerable: true, get: function () { return auth_facts_keys_js_2.buildIdentityAuthKeys; } });
 /**
  * The framework-owned identity FEATURE module (company/user/role CRUD). The consumer imports
  * `IdentityFeatureModule.forRoot()` in one line alongside `ShieldModule.forRoot(...)` (ADR-0026);
@@ -54,6 +60,12 @@ Object.defineProperty(exports, "identityControlPlaneKeys", { enumerable: true, g
  */
 var identity_feature_module_js_1 = require("./features/identity-feature.module.js");
 Object.defineProperty(exports, "IdentityFeatureModule", { enumerable: true, get: function () { return identity_feature_module_js_1.IdentityFeatureModule; } });
+/**
+ * Stored files (file-storage SPEC §5 I-K): `store` / `open` / `remove` on the engine pipe, provided
+ * and exported by `IdentityFeatureModule`. Apps call it from their own `@Classified` routes.
+ */
+var files_service_js_1 = require("./features/files/files.service.js");
+Object.defineProperty(exports, "FilesService", { enumerable: true, get: function () { return files_service_js_1.FilesService; } });
 /*
  * The record-tier authorization: since 0.7 (security hardening Phase 9 #7)
  * `IdentityFeatureModule.forRoot({ extraObjects })` builds it and provides it to `ShieldModule`

package/dist/objects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAetD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAcrD,CAAC"}
+{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAgBtD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAerD,CAAC"}

package/dist/objects.js

@@ -14,6 +14,7 @@ const cross_tenant_grant_object_js_1 = require("./cross-tenant-grant.object.js")
 const record_share_object_js_1 = require("./record-share.object.js");
 const shared_resource_object_js_1 = require("./shared-resource.object.js");
 const service_account_object_js_1 = require("./service-account.object.js");
+const stored_file_object_js_1 = require("./stored-file.object.js");
 /** All identity objects, registered with the engine at boot (same set + order as before). */
 exports.identityObjects = [
     company_object_js_1.Company,
@@ -29,4 +30,5 @@ exports.identityObjects = [
     record_share_object_js_1.RecordShare,
     shared_resource_object_js_1.SharedResource,
     service_account_object_js_1.ServiceAccount,
+    stored_file_object_js_1.StoredFile,
 ];

package/dist/record-share.object.d.ts

@@ -11,7 +11,7 @@
  * posture as `cross_tenant_grant`/`role`. `system: true` (never `owned`/`tenantScoped`) — the
  * table's own columns (`rs_tenant_uuid`, `rs_granted_by`) + the writer's owner-bound encode the
  * isolation; the pipe's owner/tenant baseline is not involved. Action vocabulary is NOT the CRUD
- * verbs — see `@astram/guard`'s `identity-actions.ts` `actionsFor('record_share')` →
+ * verbs: it opts out (`crudActions: false`, ADR-0038) and declares exactly `@astram/guard`'s
  * `RECORD_SHARE_ACTIONS` (`share`/`read`).
  *
  * Mirrors `cross-tenant-grant.object.ts`'s shape (system, PK only satisfies `validateAccess`).

package/dist/record-share.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-share.object.d.ts","sourceRoot":"","sources":["../src/record-share.object.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAOa,WAAW;IAEtB,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,UAAU,EAAG,MAAM,CAAC;CACrB"}
+{"version":3,"file":"record-share.object.d.ts","sourceRoot":"","sources":["../src/record-share.object.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;GAiBG;AACH,qBASa,WAAW;IAEtB,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,UAAU,EAAG,MAAM,CAAC;CACrB"}

package/dist/record-share.object.js

@@ -11,6 +11,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RecordShare = void 0;
 const engine_1 = require("@astram/engine");
+const guard_1 = require("@astram/guard");
 /** The physical schema `record_share` lives in (migration 1710000000014). */
 const SCHEMA = 'shield_authz';
 /**
@@ -26,7 +27,7 @@ const SCHEMA = 'shield_authz';
  * posture as `cross_tenant_grant`/`role`. `system: true` (never `owned`/`tenantScoped`) — the
  * table's own columns (`rs_tenant_uuid`, `rs_granted_by`) + the writer's owner-bound encode the
  * isolation; the pipe's owner/tenant baseline is not involved. Action vocabulary is NOT the CRUD
- * verbs — see `@astram/guard`'s `identity-actions.ts` `actionsFor('record_share')` →
+ * verbs: it opts out (`crudActions: false`, ADR-0038) and declares exactly `@astram/guard`'s
  * `RECORD_SHARE_ACTIONS` (`share`/`read`).
  *
  * Mirrors `cross-tenant-grant.object.ts`'s shape (system, PK only satisfies `validateAccess`).
@@ -55,6 +56,8 @@ exports.RecordShare = RecordShare = __decorate([
         table: 'record_share',
         schema: SCHEMA,
         access: { plane: 'control', system: true },
+        crudActions: false,
+        actions: guard_1.RECORD_SHARE_ACTIONS,
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'rs_uuid' })
 ], RecordShare);

package/dist/service-account.object.d.ts

@@ -18,8 +18,9 @@
  * is IN their reachable subtree (a cross-tenant id is invisible → 404, no existence leak). Root
  * spans all. This is the read/write wall that makes "own tenant only" structural, not handler-level.
  *
- * Action vocabulary is administration, not CRUD data ops — see `@astram/guard`'s
- * `identity-actions.ts` (`read`/`manage` for `service_account`).
+ * Action vocabulary (ADR-0038): the CRUD verbs administer the account row, plus the declared
+ * `manage_keys` (issue/rotate/revoke its `ask_…` keys), giving `read, create, update, delete,
+ * manage_keys` — the same set as `@astram/guard`'s `SERVICE_ACCOUNT_ACTIONS`.
  */
 export declare class ServiceAccount {
     id: string;

package/dist/service-account.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.object.d.ts","sourceRoot":"","sources":["../src/service-account.object.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAQa,cAAc;IAEzB,EAAE,EAAG,MAAM,CAAC;IAGZ,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,WAAW,EAAG,MAAM,CAAC;CACtB"}
+{"version":3,"file":"service-account.object.d.ts","sourceRoot":"","sources":["../src/service-account.object.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBASa,cAAc;IAEzB,EAAE,EAAG,MAAM,CAAC;IAGZ,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,WAAW,EAAG,MAAM,CAAC;CACtB"}

package/dist/service-account.object.js

@@ -32,8 +32,9 @@ const schema_1 = require("./schema");
  * is IN their reachable subtree (a cross-tenant id is invisible → 404, no existence leak). Root
  * spans all. This is the read/write wall that makes "own tenant only" structural, not handler-level.
  *
- * Action vocabulary is administration, not CRUD data ops — see `@astram/guard`'s
- * `identity-actions.ts` (`read`/`manage` for `service_account`).
+ * Action vocabulary (ADR-0038): the CRUD verbs administer the account row, plus the declared
+ * `manage_keys` (issue/rotate/revoke its `ask_…` keys), giving `read, create, update, delete,
+ * manage_keys` — the same set as `@astram/guard`'s `SERVICE_ACCOUNT_ACTIONS`.
  */
 let ServiceAccount = class ServiceAccount {
     id;
@@ -69,6 +70,7 @@ exports.ServiceAccount = ServiceAccount = __decorate([
         table: 'service_account',
         schema: schema_1.SCHEMA,
         access: { plane: 'control', system: true },
+        actions: ['manage_keys'],
         readScope: { kind: 'nodeColumn', column: 'sa_tenant_id' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'sa_id' })

package/dist/stored-file.object.d.ts

@@ -0,0 +1,35 @@
+/**
+ * stored_file — the metadata record of one uploaded file (file-storage SPEC §4).
+ *
+ * The bytes live in the object store under `storageKey` (`t/<tenantId>/<uuid>`, built by the
+ * server); this row is what the engine gates, audits and lists. Table DDL:
+ * `migrations/1710000000022-CreateStoredFile.cjs` (columns mirror the fields below exactly).
+ *
+ * ACCESS: `{ tenantScoped: true, owned: true, plane: 'data' }` — tenant business content, owned by
+ * the uploader. `plane: 'data'` keeps the capped root out by construction.
+ *
+ * SERVER-STAMPED: `tenantId` (`trusted: 'tenantId'`) and `ownerId` (`trusted: 'actorId'`) are
+ * overwritten from the session on create and never re-stamped on update; client input is ignored.
+ *
+ * CREATE-ONLY: the five content fields are `immutable` — a patch can never re-point a record at
+ * other bytes or change what the bytes claim to be.
+ */
+export declare class StoredFile {
+    uuid: string;
+    /** Server-stamped tenant boundary (engine overwrites from the session; never client). */
+    tenantId: string;
+    /** Server-stamped uploader (the owner; engine overwrites from the session; never client). */
+    ownerId: string;
+    /** `t/<tenantId>/<uuid>`, server-built; never returned to the client. */
+    storageKey: string;
+    /** Lower-case hex sha256 of the stored bytes. */
+    sha256: string;
+    /** Canonical type from the intake allowlist, never the client header. */
+    contentType: string;
+    sizeBytes: number;
+    /** Sanitized display name. */
+    originalName: string;
+    /** UTC epoch ms, set by the service. */
+    createdAt: number;
+}
+//# sourceMappingURL=stored-file.object.d.ts.map

package/dist/stored-file.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-file.object.d.ts","sourceRoot":"","sources":["../src/stored-file.object.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AACH,qBAOa,UAAU;IAErB,IAAI,EAAG,MAAM,CAAC;IAEd,yFAAyF;IAEzF,QAAQ,EAAG,MAAM,CAAC;IAElB,6FAA6F;IAE7F,OAAO,EAAG,MAAM,CAAC;IAEjB,yEAAyE;IAEzE,UAAU,EAAG,MAAM,CAAC;IAEpB,iDAAiD;IAEjD,MAAM,EAAG,MAAM,CAAC;IAEhB,yEAAyE;IAEzE,WAAW,EAAG,MAAM,CAAC;IAGrB,SAAS,EAAG,MAAM,CAAC;IAEnB,8BAA8B;IAE9B,YAAY,EAAG,MAAM,CAAC;IAEtB,wCAAwC;IAExC,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/stored-file.object.js

@@ -0,0 +1,94 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StoredFile = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/**
+ * stored_file — the metadata record of one uploaded file (file-storage SPEC §4).
+ *
+ * The bytes live in the object store under `storageKey` (`t/<tenantId>/<uuid>`, built by the
+ * server); this row is what the engine gates, audits and lists. Table DDL:
+ * `migrations/1710000000022-CreateStoredFile.cjs` (columns mirror the fields below exactly).
+ *
+ * ACCESS: `{ tenantScoped: true, owned: true, plane: 'data' }` — tenant business content, owned by
+ * the uploader. `plane: 'data'` keeps the capped root out by construction.
+ *
+ * SERVER-STAMPED: `tenantId` (`trusted: 'tenantId'`) and `ownerId` (`trusted: 'actorId'`) are
+ * overwritten from the session on create and never re-stamped on update; client input is ignored.
+ *
+ * CREATE-ONLY: the five content fields are `immutable` — a patch can never re-point a record at
+ * other bytes or change what the bytes claim to be.
+ */
+let StoredFile = class StoredFile {
+    uuid;
+    /** Server-stamped tenant boundary (engine overwrites from the session; never client). */
+    tenantId;
+    /** Server-stamped uploader (the owner; engine overwrites from the session; never client). */
+    ownerId;
+    /** `t/<tenantId>/<uuid>`, server-built; never returned to the client. */
+    storageKey;
+    /** Lower-case hex sha256 of the stored bytes. */
+    sha256;
+    /** Canonical type from the intake allowlist, never the client header. */
+    contentType;
+    sizeBytes;
+    /** Sanitized display name. */
+    originalName;
+    /** UTC epoch ms, set by the service. */
+    createdAt;
+};
+exports.StoredFile = StoredFile;
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_uuid', type: 'uuid', role: 'primaryKey' }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "uuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_tenant_id', type: 'uuid', trusted: 'tenantId' }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "tenantId", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_owner_id', type: 'uuid', trusted: 'actorId' }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "ownerId", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_storage_key', type: 'string', required: true, immutable: true }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "storageKey", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_sha256', type: 'string', required: true, immutable: true }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "sha256", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_content_type', type: 'string', required: true, immutable: true }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "contentType", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_size_bytes', type: 'number', required: true, immutable: true }),
+    __metadata("design:type", Number)
+], StoredFile.prototype, "sizeBytes", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_original_name', type: 'string', required: true, immutable: true }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "originalName", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_created_at', type: 'number', required: true }),
+    __metadata("design:type", Number)
+], StoredFile.prototype, "createdAt", void 0);
+exports.StoredFile = StoredFile = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'stored_file',
+        table: 'stored_file',
+        schema: schema_1.SCHEMA,
+        access: { tenantScoped: true, owned: true, plane: 'data' },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'sf_uuid' })
+], StoredFile);

package/migrations/1710000000022-CreateStoredFile.cjs

@@ -0,0 +1,43 @@
+/**
+ * Framework identity migration — the `shield_app`.`stored_file` table (file-storage SPEC §4).
+ *
+ * One row = the metadata of one uploaded file whose bytes live in the object store under
+ * `sf_storage_key` (`t/<tenantId>/<uuid>`, server-built). The row is the record the engine gates;
+ * the bytes are never in the database.
+ *
+ * Columns EXACTLY mirror the `StoredFile` @ObjectType's @Field columns (`src/stored-file.object.ts`):
+ * `sf_tenant_id` (trusted:'tenantId') and `sf_owner_id` (trusted:'actorId') are stamped from the
+ * session, never client input; the five content columns are create-only (`immutable`).
+ * `sf_sha256` is indexed with the tenant first so an app can detect a repeat upload (no dedup).
+ * No FK to an app record: the link from an app record to a file is the app's own column.
+ *
+ * The `shield_app` schema already exists (created by 1710000000001); this migration owns only the
+ * table. Idempotent (CREATE TABLE IF NOT EXISTS); `down` drops the table (DROP TABLE IF EXISTS).
+ * No seed, no hard-coded ids.
+ */
+
+const SCHEMA = 'shield_app';
+
+async function up({ query }) {
+  await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`stored_file\` (
+    sf_uuid          VARCHAR(36)     NOT NULL,
+    sf_tenant_id     VARCHAR(36)     NOT NULL,
+    sf_owner_id      VARCHAR(36)     NOT NULL,
+    sf_storage_key   VARCHAR(255)    NOT NULL,
+    sf_sha256        CHAR(64)        NOT NULL,
+    sf_content_type  VARCHAR(127)    NOT NULL,
+    sf_size_bytes    BIGINT UNSIGNED NOT NULL,
+    sf_original_name VARCHAR(255)    NOT NULL,
+    sf_created_at    BIGINT          NOT NULL,
+    PRIMARY KEY (sf_uuid),
+    UNIQUE KEY uq_sf_storage_key (sf_storage_key),
+    INDEX idx_sf_tenant (sf_tenant_id),
+    INDEX idx_sf_tenant_sha (sf_tenant_id, sf_sha256)
+  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`);
+}
+
+async function down({ query }) {
+  await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`stored_file\``);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -36,9 +36,9 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
-    "@astram/core": "1.5.0",
-    "@astram/engine": "0.6.0",
-    "@astram/guard": "0.13.0"
+    "@astram/core": "1.6.0",
+    "@astram/guard": "0.14.0",
+    "@astram/engine": "0.7.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",
@@ -47,12 +47,16 @@
     "rxjs": "^7"
   },
   "devDependencies": {
+    "@aws-sdk/client-s3": "3.1142.0",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
+    "@nestjs/platform-express": "^11.0.0",
     "@nestjs/testing": "^11.0.0",
     "@types/node": "^22.0.0",
+    "@types/supertest": "^6.0.2",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1",
+    "supertest": "^7.0.0",
     "typescript": "^5.7.0",
     "unplugin-swc": "^1.5.1",
     "vitest": "^2.1.8"