@blamejs/blamejs-shop 0.4.85 → 0.4.86

package/lib/vendor/blamejs/test/layer-0-primitives/session-device-binding-ipv6-canonical-and-no-store.test.js

@@ -0,0 +1,202 @@
+"use strict";
+/**
+ * b.sessionDeviceBinding — two regressions:
+ *
+ *   (A) IPv6 prefix masking masked the client IP by textual ':'-group slicing
+ *       with no canonical normalization, so a `::`-shorthand address and its
+ *       fully-expanded equivalent (2001:db8::1 vs 2001:db8:0:0:0:0:0:1), or a
+ *       leading-zero-folded group, hashed to DIFFERENT device fingerprints.
+ *       A roaming user whose proxy reports the address in a different textual
+ *       form on the next request was logged out on a FALSE drift.
+ *
+ *   (B) #330 — create() refused to construct without a store, so the stateless,
+ *       store-free fingerprint() (the soft device-binding building block for
+ *       self-validating tokens) was unreachable through create(). The static
+ *       b.sessionDeviceBinding.fingerprint(req, opts) and a no-store instance
+ *       whose fingerprint() works (while bind/verify throw a clear "no store")
+ *       both make it reachable.
+ *
+ * Run standalone:
+ *   node test/layer-0-primitives/session-device-binding-ipv6-canonical-and-no-store.test.js
+ * Or via smoke:
+ *   node test/smoke.js
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _memoryStore() {
+  var data = new Map();
+  return {
+    data: data,
+    get:  function (k) { return Promise.resolve(data.get(k)); },
+    set:  function (k, v) { data.set(k, v); return Promise.resolve(); },
+    del:  function (k) { data.delete(k); return Promise.resolve(); },
+  };
+}
+
+function _req(remoteAddress) {
+  return {
+    url: "/x",
+    method: "GET",
+    headers: {
+      "user-agent":      "Mozilla/5.0 (Macintosh; Intel)",
+      "accept-language": "en-US,en;q=0.9",
+      "accept-encoding": "gzip, br",
+    },
+    socket: { remoteAddress: remoteAddress },
+  };
+}
+
+// Two textually-different but semantically-IDENTICAL IPv6 forms of the same
+// address. A canonical masker must collapse them to one fingerprint bucket.
+var IPV6_SHORTHAND = "2001:db8::1";
+var IPV6_EXPANDED  = "2001:db8:0:0:0:0:0:1";
+// Leading-zero fold: 2001:0db8 vs 2001:db8 are the same group value.
+var IPV6_LEADING_ZEROS = "2001:0db8::1";
+
+// (A) Static fingerprint — equivalent IPv6 forms must hash identically.
+function testStaticFingerprintCanonicalIpv6() {
+  var fpShort    = b.sessionDeviceBinding.fingerprint(_req(IPV6_SHORTHAND));
+  var fpExpanded = b.sessionDeviceBinding.fingerprint(_req(IPV6_EXPANDED));
+  var fpLeading  = b.sessionDeviceBinding.fingerprint(_req(IPV6_LEADING_ZEROS));
+  check("(A) static fp: :: shorthand == fully expanded",
+    fpShort.equals(fpExpanded));
+  check("(A) static fp: :: shorthand == leading-zero form",
+    fpShort.equals(fpLeading));
+  // Sanity: a genuinely different /64 still diverges (the mask still binds).
+  var fpOther = b.sessionDeviceBinding.fingerprint(_req("2001:db9::1"));
+  check("(A) static fp: different /64 still diverges", !fpShort.equals(fpOther));
+}
+
+// (A) Real consumer path — bind() with one textual form, verify() with the
+// equivalent form, on the shipped instance API. Must NOT drift.
+async function testVerifyCanonicalIpv6AcrossForms() {
+  var binding = b.sessionDeviceBinding.create({ bindingStore: _memoryStore() });
+  var token = "tok_v6";
+  await binding.bind(token, _req(IPV6_SHORTHAND));
+
+  var verdict = await binding.verify(token, _req(IPV6_EXPANDED));
+  check("(A) verify ok: bind(::) then verify(expanded)", verdict.ok === true);
+
+  var verdict2 = await binding.verify(token, _req(IPV6_LEADING_ZEROS));
+  check("(A) verify ok: bind(::) then verify(leading-zeros)", verdict2.ok === true);
+
+  // A different /64 IPv6 still drifts (the prefix check is alive, not disabled).
+  var drift = await binding.verify(token, _req("2001:db9::1"));
+  check("(A) verify drift: bind(2001:db8::) then verify(2001:db9::)",
+    drift.ok === false && drift.reason === "drift");
+}
+
+// (A) The documented `ipPrefixBits: { v4: 0, v6: 0 }` skip-the-IP escape hatch
+// must still skip masking entirely (so a mobile client that switches networks
+// is not logged out).
+async function testIpPrefixBitsZeroSkipsIp() {
+  var binding = b.sessionDeviceBinding.create({
+    bindingStore: _memoryStore(),
+    ipPrefixBits: { v4: 0, v6: 0 },
+  });
+  var token = "tok_skip";
+  await binding.bind(token, _req("2001:db8::1"));
+  var across = await binding.verify(token, _req("2001:dead:beef::99"));
+  check("(A) ipPrefixBits 0/0: unrelated IPv6 still ok (IP skipped)",
+    across.ok === true);
+  var binding4 = b.sessionDeviceBinding.create({
+    bindingStore: _memoryStore(),
+    ipPrefixBits: { v4: 0, v6: 0 },
+  });
+  await binding4.bind("t4", _req("198.51.100.1"));
+  var across4 = await binding4.verify("t4", _req("203.0.113.200"));
+  check("(A) ipPrefixBits 0/0: unrelated IPv4 still ok (IP skipped)",
+    across4.ok === true);
+}
+
+// (B) #330 — a no-store create() returns an instance whose fingerprint() is
+// usable (pure, no store), while bind/verify/unbind throw a clear "no store
+// configured" error. No fabricated no-op store.
+async function testNoStoreInstanceFingerprintReachable() {
+  var binding = b.sessionDeviceBinding.create({});  // no store, no storeInSession
+  check("(B) no-store create() returns an object", binding && typeof binding === "object");
+
+  var fp = binding.fingerprint(_req("2001:db8::1"));
+  check("(B) no-store instance fingerprint() returns a 32-byte Buffer",
+    Buffer.isBuffer(fp) && fp.length === 32);
+
+  // It must match the static stateless digest for the same shape (one algorithm).
+  var staticFp = b.sessionDeviceBinding.fingerprint(_req("2001:db8::1"));
+  check("(B) no-store instance fingerprint() == static fingerprint()",
+    fp.equals(staticFp));
+
+  var bindThrew = false;
+  try { await binding.bind("t", _req("2001:db8::1")); }
+  catch (e) { bindThrew = e && e.code === "session-device-binding/no-store"; }
+  check("(B) no-store bind() throws no-store error", bindThrew);
+
+  var verifyThrew = false;
+  try { await binding.verify("t", _req("2001:db8::1")); }
+  catch (e) { verifyThrew = e && e.code === "session-device-binding/no-store"; }
+  check("(B) no-store verify() throws no-store error", verifyThrew);
+
+  var unbindThrew = false;
+  try { await binding.unbind("t"); }
+  catch (e) { unbindThrew = e && e.code === "session-device-binding/no-store"; }
+  check("(B) no-store unbind() throws no-store error", unbindThrew);
+}
+
+// (B) #330 — the static stateless entry point works with no create() at all.
+function testStaticFingerprintNoStore() {
+  check("(B) b.sessionDeviceBinding.fingerprint is a function",
+    typeof b.sessionDeviceBinding.fingerprint === "function");
+  var fp = b.sessionDeviceBinding.fingerprint(_req("203.0.113.7"));
+  check("(B) static fingerprint() returns a 32-byte Buffer with no store",
+    Buffer.isBuffer(fp) && fp.length === 32);
+}
+
+// Codex P2 (#362): routing the IP mask through requestHelpers.ipPrefix must
+// PRESERVE the configured prefix width, not silently force the helper's bare
+// /24 + /64 default. The device-binding IPv6 default is /48; a client roaming
+// within its /48 allocation but across a different /64 must NOT drift. (RED
+// when ipPrefix ignores the width and buckets at /64.)
+async function testConfiguredV6PrefixWidthPreserved() {
+  // Default instance (v6 = /48): same /48, DIFFERENT /64 -> same fingerprint.
+  var inst = b.sessionDeviceBinding.create({ bindingStore: _memoryStore() });
+  var fpA = inst.fingerprint(_req("2001:db8:0:1::5"));
+  var fpB = inst.fingerprint(_req("2001:db8:0:2::9"));     // same /48, different /64
+  check("(P2) default v6=/48: same /48 different /64 -> same fp (not /64)", fpA.equals(fpB));
+  var fpC = inst.fingerprint(_req("2001:db8:1::5"));        // different /48
+  check("(P2) default v6=/48: different /48 still diverges", !fpA.equals(fpC));
+
+  // Configured wider bucket (v6 = /32): same /32, different /48 -> same fp.
+  var wide = b.sessionDeviceBinding.create({ bindingStore: _memoryStore(), ipPrefixBits: { v6: 32 } });
+  var wA = wide.fingerprint(_req("2001:db8:1::1"));
+  var wB = wide.fingerprint(_req("2001:db8:99::1"));        // same /32, different /48
+  check("(P2) configured v6=/32: same /32 different /48 -> same fp (width honored)", wA.equals(wB));
+
+  // Configured tighter bucket (v6 = /64): same /48 different /64 -> DIVERGES.
+  var tight = b.sessionDeviceBinding.create({ bindingStore: _memoryStore(), ipPrefixBits: { v6: 64 } });
+  var tA = tight.fingerprint(_req("2001:db8:0:1::5"));
+  var tB = tight.fingerprint(_req("2001:db8:0:2::9"));      // same /48, different /64
+  check("(P2) configured v6=/64: same /48 different /64 -> diverges (width honored)", !tA.equals(tB));
+}
+
+async function run() {
+  testStaticFingerprintCanonicalIpv6();
+  await testVerifyCanonicalIpv6AcrossForms();
+  await testIpPrefixBitsZeroSkipsIp();
+  await testConfiguredV6PrefixWidthPreserved();
+  await testNoStoreInstanceFingerprintReachable();
+  testStaticFingerprintNoStore();
+}
+
+if (require.main === module) {
+  run().then(function () {
+    console.log("OK session-device-binding-ipv6-canonical-and-no-store — "
+      + helpers.getChecks() + " checks");
+  }).catch(function (e) {
+    console.error("FAIL:", e && e.stack || e);
+    process.exit(1);
+  });
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/session-device-binding.test.js

@@ -59,16 +59,25 @@ function testSurface() {
         typeof b.sessionDeviceBinding.SessionDeviceBindingError === "function");
 }
 
-function testCreateRejectsBadOpts() {
+async function testCreateRejectsBadOpts() {
   var threw;
 
-  threw = false;
-  try { b.sessionDeviceBinding.create(); } catch (_e) { threw = true; }
-  check("create() rejects empty opts", threw);
-
-  threw = false;
-  try { b.sessionDeviceBinding.create({}); } catch (_e) { threw = true; }
-  check("create() requires bindingStore or storeInSession", threw);
+  // #330 — a no-store create() (no opts, or {} with neither bindingStore nor
+  // storeInSession) now returns an INSTANCE whose stateless fingerprint() works
+  // (the soft device-binding building block for self-validating tokens), while
+  // the persisted bind()/verify()/unbind() lifecycle throws a clear
+  // "no store configured" — instead of refusing to construct at all.
+  var noStore = b.sessionDeviceBinding.create();
+  check("create() with no opts returns a no-store instance", noStore && typeof noStore.fingerprint === "function");
+  var noStoreFp = noStore.fingerprint(_mockReq());
+  check("no-store instance fingerprint(req) returns a digest", Buffer.isBuffer(noStoreFp) && noStoreFp.length > 0);
+  var noStore2 = b.sessionDeviceBinding.create({});
+  check("create({}) returns a no-store instance", noStore2 && typeof noStore2.fingerprint === "function");
+  // bind() is async, so the no-store guard surfaces as a rejection.
+  var bindErr = null;
+  try { await noStore2.bind("tok_x", _mockReq()); } catch (e) { bindErr = e; }
+  check("no-store bind() fails closed with session-device-binding/no-store",
+        bindErr && bindErr.code === "session-device-binding/no-store");
 
   threw = false;
   try {
@@ -242,7 +251,7 @@ function testNamespaceFingerprint() {
 async function run() {
   testSurface();
   testNamespaceFingerprint();
-  testCreateRejectsBadOpts();
+  await testCreateRejectsBadOpts();
   await testBindAndVerifyHappyPath();
   await testVerifyDriftRefuses();
   await testVerifyMissingBindRefuses();

package/lib/vendor/blamejs/test/layer-0-primitives/webhook-verify-nonce-atomic.test.js

@@ -0,0 +1,169 @@
+"use strict";
+/**
+ * b.webhook.verify — replay nonceStore is atomic, not check-then-set (#328).
+ *
+ * The Stripe-shape inbound verifier must consult its replay store via the
+ * atomic { checkAndInsert(nonce, expireAt) → bool } contract — the SAME
+ * contract b.nonceStore.create exposes and b.webhook.verifier already uses.
+ * A non-atomic check-then-set ({ has, set }) races two concurrent
+ * redeliveries of the same event: both observe "unseen", both proceed
+ * (CWE-367 TOCTOU). These tests drive the real b.webhook.verify consumer
+ * path with the framework's own b.nonceStore.create so the store drops in
+ * with no adapter, and assert that of two byte-identical concurrent
+ * deliveries exactly one is accepted.
+ *
+ * RED proof (old buggy non-atomic await-has → if-seen-throw → await-set):
+ * two concurrent verifies of the same signature BOTH observe "unseen" and
+ * BOTH resolve ok — "concurrent: exactly one accepted" would fail (2 ok,
+ * 0 replay). The atomic checkAndInsert collapses that to 1 ok / 1 replay.
+ *
+ * Run standalone: `node test/layer-0-primitives/webhook-verify-nonce-atomic.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+var STRIPE_ALG = "hmac-sha256-stripe";
+
+// Build a valid Stripe-Signature header for (body, secret, ts) through the
+// public round-trip companion — no dependence on another test file's helper.
+function _header(body, secret, ts) {
+  return b.webhook.sign({ alg: STRIPE_ALG, secret: secret, body: body, timestamp: ts });
+}
+
+// The framework's own replay store satisfies the verifier's contract with
+// no adapter: a first delivery is accepted, a second (sequential) replay of
+// the same signature is refused with the stable webhook/replay code.
+async function testFrameworkStoreDropsIn() {
+  var body   = '{"event":"checkout.completed","id":"evt_drop_in"}';
+  var secret = "whsec_drop_in_secret";
+  var ts     = Math.floor(Date.now() / 1000);
+  var header = _header(body, secret, ts);
+  var ns     = b.nonceStore.create({ backend: "memory" });
+
+  var r1 = await b.webhook.verify({
+    alg: STRIPE_ALG, secret: secret, header: header, body: body, nonceStore: ns,
+  });
+  check("framework store: first delivery accepted", r1.ok === true);
+  check("framework store: scheme v1",               r1.scheme === "v1");
+  check("framework store: timestamp echoed",        r1.timestamp === ts);
+
+  var replayed = false;
+  try {
+    await b.webhook.verify({
+      alg: STRIPE_ALG, secret: secret, header: header, body: body, nonceStore: ns,
+    });
+  } catch (e) {
+    replayed = true;
+    check("framework store: replay → webhook/replay", e.code === "webhook/replay");
+  }
+  check("framework store: sequential replay refused", replayed);
+
+  if (ns.close) await ns.close();
+}
+
+// The core of #328: of two concurrent verifies of the SAME signature with a
+// SHARED framework store, exactly one is accepted and the other is refused as
+// a replay. A non-atomic check-then-set would let both through (the TOCTOU
+// the atomic checkAndInsert closes).
+async function testConcurrentExactlyOneAccepted() {
+  var body   = '{"event":"invoice.paid","id":"evt_concurrent"}';
+  var secret = "whsec_concurrent_secret";
+  var ts     = Math.floor(Date.now() / 1000);
+  var header = _header(body, secret, ts);
+  var ns     = b.nonceStore.create({ backend: "memory" });
+
+  var settled = await Promise.allSettled([
+    b.webhook.verify({ alg: STRIPE_ALG, secret: secret, header: header, body: body, nonceStore: ns }),
+    b.webhook.verify({ alg: STRIPE_ALG, secret: secret, header: header, body: body, nonceStore: ns }),
+  ]);
+
+  var accepted = settled.filter(function (s) {
+    return s.status === "fulfilled" && s.value && s.value.ok === true;
+  }).length;
+  var replays = settled.filter(function (s) {
+    return s.status === "rejected" && s.reason && s.reason.code === "webhook/replay";
+  }).length;
+
+  check("concurrent: exactly one accepted", accepted === 1);
+  check("concurrent: exactly one replay",   replays === 1);
+
+  if (ns.close) await ns.close();
+}
+
+// A higher-concurrency fan-out hardens the assertion: N byte-identical
+// deliveries land at once and STILL exactly one is accepted — the atomic
+// gate admits a single winner regardless of contention depth.
+async function testConcurrentFanoutSingleWinner() {
+  var body   = '{"event":"charge.refunded","id":"evt_fanout"}';
+  var secret = "whsec_fanout_secret";
+  var ts     = Math.floor(Date.now() / 1000);
+  var header = _header(body, secret, ts);
+  var ns     = b.nonceStore.create({ backend: "memory" });
+
+  var N = 8;
+  var calls = [];
+  for (var i = 0; i < N; i += 1) {
+    calls.push(b.webhook.verify({
+      alg: STRIPE_ALG, secret: secret, header: header, body: body, nonceStore: ns,
+    }));
+  }
+  var settled = await Promise.allSettled(calls);
+  var accepted = settled.filter(function (s) {
+    return s.status === "fulfilled" && s.value && s.value.ok === true;
+  }).length;
+  var replays = settled.filter(function (s) {
+    return s.status === "rejected" && s.reason && s.reason.code === "webhook/replay";
+  }).length;
+
+  check("fanout: exactly one accepted of " + N,    accepted === 1);
+  check("fanout: remaining N-1 refused as replay", replays === N - 1);
+
+  if (ns.close) await ns.close();
+}
+
+// The contract migration: a store exposing only the legacy racy { has, set }
+// shape (no checkAndInsert) is refused — the verifier fails closed on a
+// store that cannot give it an atomic gate, rather than silently falling
+// back to a check-then-set race.
+async function testLegacyHasSetShapeRefused() {
+  var body   = '{"event":"x","id":"evt_legacy"}';
+  var secret = "whsec_legacy_shape";
+  var ts     = Math.floor(Date.now() / 1000);
+  var header = _header(body, secret, ts);
+  var legacyStore = {
+    has: function () { return Promise.resolve(false); },
+    set: function () { return Promise.resolve(); },
+  };
+
+  var refused = false;
+  try {
+    await b.webhook.verify({
+      alg: STRIPE_ALG, secret: secret, header: header, body: body, nonceStore: legacyStore,
+    });
+  } catch (e) {
+    refused = true;
+    check("legacy { has, set }: webhook/bad-nonce-store code", e.code === "webhook/bad-nonce-store");
+  }
+  check("legacy { has, set } store refused (no checkAndInsert)", refused);
+}
+
+async function run() {
+  check("b.webhook.verify is a function",       typeof b.webhook.verify === "function");
+  check("b.nonceStore.create is a function",    typeof b.nonceStore.create === "function");
+  await testFrameworkStoreDropsIn();
+  await testConcurrentExactlyOneAccepted();
+  await testConcurrentFanoutSingleWinner();
+  await testLegacyHasSetShapeRefused();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.message); process.exit(1); }
+  );
+}

package/lib/webhooks.js

@@ -96,6 +96,14 @@ var SECRET_BYTES = 32;
 var BACKOFF_SCHEDULE_S = Object.freeze([60, 300, 1800, 14400, 86400]); // allow:raw-time-literal — seconds values; C.TIME returns ms
 var MAX_ATTEMPTS       = 5;
 
+// processRetries claims each due delivery by pushing its next_retry_at out by
+// this lease before attempting it, so a second tick that overlaps a slow pass
+// skips the in-flight row instead of double-attempting it. _attempt overwrites
+// next_retry_at with the real backoff (or stamps delivered_at), so the lease
+// only persists if the process dies mid-attempt — in which case the row is
+// retried after the lease expires. Comfortably longer than a bounded pass.
+var RETRY_CLAIM_LEASE_MS = C.TIME.minutes(5);
+
 // Window used by the per-endpoint rate-limit sliding count. One
 // minute is short enough that a wedged receiver doesn't permanently
 // brick its own delivery feed (the window naturally slides forward),
@@ -539,15 +547,17 @@ function create(opts) {
       return await _deliver(endpoint, row.event_type, row.payload_json);
     },
 
-    // Polled scheduler entry point — picks deliveries whose
-    // next_retry_at has come due and re-attempts each. Operators
-    // wire this to a cron / Durable Object alarm / queue worker.
-    // Returns the list of deliveries the call attempted.
+    // Polled scheduler entry point — picks deliveries whose next_retry_at has
+    // come due and re-attempts each. The worker's scheduled() handler drives
+    // this once a minute via the container's /_/webhook-retry-tick route.
+    // Returns the list of deliveries the call actually attempted (the ones it
+    // won the claim on).
     //
-    // No claim/lock here — the framework's single-writer assumption
-    // for the deliveries table holds (the worker is the only writer).
-    // A multi-writer deployment composes external locking before
-    // calling processRetries.
+    // Each row is claimed with an atomic conditional UPDATE before it is
+    // attempted, so two overlapping ticks (a slow pass still running when the
+    // next minute fires) can never double-attempt the same delivery — the
+    // claim moves next_retry_at out of the due window, and only the tick whose
+    // UPDATE matched (rowCount === 1) calls _attempt.
     processRetries: async function (procOpts) {
       var now = (procOpts && typeof procOpts.now === "number") ? procOpts.now : nowFn();
       var max = (procOpts && Number.isInteger(procOpts.max) && procOpts.max > 0) ? procOpts.max : 100;
@@ -561,8 +571,27 @@ function create(opts) {
       var attempted = [];
       for (var i = 0; i < r.rows.length; i += 1) {
         var row = r.rows[i];
+        // Skip a delivery whose endpoint has been deleted or PAUSED. Normal
+        // fan-out only sends to active endpoints, so the automatic cron must
+        // not keep POSTing to one an operator explicitly disabled. Checked
+        // BEFORE the claim, so a paused endpoint's pending retries keep their
+        // schedule position (next_retry_at untouched) and resume when it is
+        // re-enabled, rather than the lease churning forward every tick. A
+        // manual admin retry remains an explicit operator override.
         var endpoint = await _getEndpoint(row.endpoint_id);
-        if (!endpoint) continue;
+        if (!endpoint || !(endpoint.active === 1 || endpoint.active === true)) continue;
+        // Atomic claim: push next_retry_at out by the lease so a concurrent
+        // tick's identical WHERE no longer matches this row. Only the winner
+        // (rowCount === 1) attempts; _attempt then overwrites next_retry_at
+        // with the real backoff or stamps delivered_at.
+        var claim = await query(
+          "UPDATE webhook_deliveries SET next_retry_at = ?1 " +
+          "WHERE id = ?2 AND next_retry_at IS NOT NULL AND next_retry_at <= ?3 AND delivered_at IS NULL",
+          [now + RETRY_CLAIM_LEASE_MS, row.id, now],
+        );
+        var claimed = claim && (claim.rowCount != null ? claim.rowCount
+          : (claim.meta && claim.meta.changes != null ? claim.meta.changes : claim.changes));
+        if (Number(claimed || 0) !== 1) continue;   // lost the claim to a concurrent tick
         var d = await _attempt(row.id, endpoint, row.event_type, row.payload_json);
         attempted.push(d);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.85",
+  "version": "0.4.86",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {