@crewhaus/tool-onchain 0.7.0

package/dist/lib/multicall.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Where Multicall3 is deployed on most chains, via a deterministic deploy.
+ *
+ * It is a DEFAULT, never a constant baked into the calldata path: the deploy
+ * is only canonical where somebody ran it, and a chain that predates it, an
+ * L2 with its own deployment, or a local fork can all have it elsewhere.
+ * Every entry point here takes the address as an argument.
+ */
+export declare const MULTICALL3_ADDRESS = "0xcA11bde05977b3631167028862bE2a173976CA11";
+/** The canonical signature, which is what the selector is hashed over. */
+export declare const AGGREGATE3_SIGNATURE = "aggregate3((address,bool,bytes)[])";
+/** `0x82ad56cb` — the four bytes a block explorer shows for a Multicall3 batch. */
+export declare const AGGREGATE3_SELECTOR = "0x82ad56cb";
+/** What `aggregate3` returns: one `(bool success, bytes returnData)` per call. */
+export declare const AGGREGATE3_RETURN_TYPE = "(bool,bytes)[]";
+/** `Error(string)` — a `revert("...")` or a failed `require` with a message. */
+export declare const ERROR_STRING_SELECTOR = "0x08c379a0";
+/** `Panic(uint256)` — a failed `assert`, an overflow, a bad index. */
+export declare const PANIC_SELECTOR = "0x4e487b71";
+/**
+ * The panic codes Solidity documents. A code outside this table decodes to a
+ * code with no reason attached rather than to a guess.
+ */
+export declare const PANIC_REASONS: Readonly<Record<string, string>>;
+/** One call in a batch. */
+export type Call3 = {
+    /** The contract to call. */
+    readonly target: string;
+    /** Its calldata, 0x hex. `0x` is legal and reaches the fallback. */
+    readonly callData: string;
+    /**
+     * Whether this call reverting is allowed to be data.
+     *
+     * Omitted means TRUE, which is the point of `aggregate3`: the batch still
+     * succeeds and this entry carries `success: false` with its revert bytes.
+     * Set it false only when this call failing should take the whole batch
+     * down with it — then there are no partial results to read at all.
+     */
+    readonly allowFailure?: boolean;
+};
+/** A packed batch: what to send, and where. */
+export type Aggregate3Request = {
+    /** The Multicall3 address the calldata is meant for, EIP-55 checksummed. */
+    readonly to: string;
+    /** The calldata, 0x hex. */
+    readonly data: string;
+    readonly selector: string;
+    /** How many results the answer must hold. Decoding checks it. */
+    readonly callCount: number;
+};
+/** What a sub-call's revert bytes turned out to say. */
+export type RevertKind = "none" | "string" | "panic" | "unknown";
+export type RevertReason = {
+    readonly kind: RevertKind;
+    /** The decoded reason, or null when the bytes do not carry one. Never invented. */
+    readonly reason: string | null;
+    /** The four-byte error selector, when the data is long enough to have one. */
+    readonly selector: string | null;
+    /** The panic code as hex, e.g. `0x11`. Panics only. */
+    readonly panicCode: string | null;
+    /** The raw bytes, always, so an unrecognised custom error is still actionable. */
+    readonly data: string;
+};
+/** One call's answer, at the position of the call that produced it. */
+export type Aggregate3Result = {
+    /** The index of the call in the batch that was sent. */
+    readonly index: number;
+    readonly success: boolean;
+    /** Return data on success, revert data on failure. Both are 0x hex. */
+    readonly returnData: string;
+    /** The revert, decoded, when this call failed. Null when it succeeded. */
+    readonly revert: RevertReason | null;
+};
+/**
+ * Pack a batch into `aggregate3` calldata.
+ *
+ * `multicall3Address` defaults to {@link MULTICALL3_ADDRESS} and is returned
+ * as `to`; pass a chain's own deployment when it has one. An empty batch is
+ * legal and encodes to an empty array — a caller assembling a batch from a
+ * filtered list should not have to special-case the day the filter matches
+ * nothing.
+ */
+export declare function encodeAggregate3(calls: ReadonlyArray<Call3>, multicall3Address?: string): Aggregate3Request;
+/**
+ * Decode `(bool,bytes)[]` back into per-call results, in the order sent.
+ *
+ * `expectedCalls` is the length of the batch that produced this blob, and a
+ * mismatch throws: the results carry no identity of their own, so pairing a
+ * short answer with the calls that were sent silently attributes each result
+ * to the wrong call.
+ *
+ * A sub-call that reverted is NOT an exception — it is a row with
+ * `success: false`. What throws is the batch's own answer being unreadable,
+ * which is a different event with a different fix.
+ */
+export declare function decodeAggregate3(returnData: string, expectedCalls: number): ReadonlyArray<Aggregate3Result>;
+/**
+ * Read revert bytes as the reason they carry.
+ *
+ * `Error(string)` and `Panic(uint256)` have known selectors and decode to
+ * something a human can act on. Anything else — a custom error, four bytes
+ * of nothing in particular — keeps its hex and gets no message: a guess at
+ * what an unknown selector means is worse than the hex, because the hex is
+ * at least searchable.
+ */
+export declare function decodeRevertData(revertData: string): RevertReason;

package/dist/lib/multicall.js

@@ -0,0 +1,207 @@
+/**
+ * Multicall3 request packing and result unpacking.
+ *
+ * One `eth_call` against Multicall3 answers a hundred questions at one block
+ * height, which is the only way to read a hundred balances that are
+ * consistent with each other. The packing is where it goes wrong: the
+ * argument is an array of dynamic tuples, so every element leaves an offset
+ * behind — relative to the start of the array's DATA, not to the call — and
+ * a wrong offset produces calldata a node accepts and the contract misreads.
+ *
+ * Two things this is careful about, because both are how a batch read turns
+ * into a wrong number rather than an error:
+ *
+ *   1. **A failed sub-call is data.** With `allowFailure` set, the batch
+ *      succeeds and the failed entry carries `success: false` and its revert
+ *      bytes. That is different from the batch itself failing, and the two
+ *      must not arrive at a caller looking the same: a sub-call revert comes
+ *      back as a row, a blob this cannot read is thrown.
+ *   2. **Results are matched by POSITION.** Nothing in the return blob names
+ *      the call it answers. A blob holding a different number of results than
+ *      the batch sent is therefore refused rather than zipped up to the
+ *      shorter of the two, because a balance read against the wrong token is
+ *      worse than no balance at all.
+ *
+ * Pure, like the rest of this package: this builds the bytes of a read and
+ * reads the bytes back. It does not dial anything, and nothing here composes
+ * or submits a transaction.
+ */
+import { decodeData, encodeCall } from "./abi";
+import { validateAddress } from "./address";
+/**
+ * Where Multicall3 is deployed on most chains, via a deterministic deploy.
+ *
+ * It is a DEFAULT, never a constant baked into the calldata path: the deploy
+ * is only canonical where somebody ran it, and a chain that predates it, an
+ * L2 with its own deployment, or a local fork can all have it elsewhere.
+ * Every entry point here takes the address as an argument.
+ */
+export const MULTICALL3_ADDRESS = "0xcA11bde05977b3631167028862bE2a173976CA11";
+/** The canonical signature, which is what the selector is hashed over. */
+export const AGGREGATE3_SIGNATURE = "aggregate3((address,bool,bytes)[])";
+/** `0x82ad56cb` — the four bytes a block explorer shows for a Multicall3 batch. */
+export const AGGREGATE3_SELECTOR = "0x82ad56cb";
+/** What `aggregate3` returns: one `(bool success, bytes returnData)` per call. */
+export const AGGREGATE3_RETURN_TYPE = "(bool,bytes)[]";
+/** `Error(string)` — a `revert("...")` or a failed `require` with a message. */
+export const ERROR_STRING_SELECTOR = "0x08c379a0";
+/** `Panic(uint256)` — a failed `assert`, an overflow, a bad index. */
+export const PANIC_SELECTOR = "0x4e487b71";
+/**
+ * The panic codes Solidity documents. A code outside this table decodes to a
+ * code with no reason attached rather than to a guess.
+ */
+export const PANIC_REASONS = Object.freeze({
+    "0x00": "a generic compiler-inserted panic",
+    "0x01": "an assert argument evaluated to false",
+    "0x11": "arithmetic overflowed or underflowed outside an unchecked block",
+    "0x12": "division or modulo by zero",
+    "0x21": "a value was converted into an enum that has no such member",
+    "0x22": "a storage byte array is incorrectly encoded",
+    "0x31": "pop() on an empty array",
+    "0x32": "an array index is out of bounds or negative",
+    "0x41": "too much memory was allocated, or an array was created too large",
+    "0x51": "a zero-initialised variable of internal function type was called",
+});
+function checkedAddress(raw, what) {
+    const result = validateAddress(raw);
+    if (!result.valid)
+        throw new Error(`${what}: ${result.reason}`);
+    return result.checksummed;
+}
+function checkedBytes(raw, what) {
+    const text = raw.trim();
+    // An odd number of hex digits is a truncated paste, and the ABI coder would
+    // otherwise report it as an argument problem several frames from here.
+    if (!/^0x([0-9a-fA-F]{2})*$/.test(text)) {
+        throw new Error(`${what}: expected 0x followed by an even number of hex digits, got "${raw}"`);
+    }
+    return text.toLowerCase();
+}
+/**
+ * Pack a batch into `aggregate3` calldata.
+ *
+ * `multicall3Address` defaults to {@link MULTICALL3_ADDRESS} and is returned
+ * as `to`; pass a chain's own deployment when it has one. An empty batch is
+ * legal and encodes to an empty array — a caller assembling a batch from a
+ * filtered list should not have to special-case the day the filter matches
+ * nothing.
+ */
+export function encodeAggregate3(calls, multicall3Address = MULTICALL3_ADDRESS) {
+    const to = checkedAddress(multicall3Address, "the Multicall3 address");
+    const tuples = calls.map((call, i) => [
+        checkedAddress(call.target, `call[${i}].target`),
+        call.allowFailure ?? true,
+        checkedBytes(call.callData, `call[${i}].callData`),
+    ]);
+    return {
+        to,
+        data: encodeCall(AGGREGATE3_SIGNATURE, [tuples]),
+        selector: AGGREGATE3_SELECTOR,
+        callCount: calls.length,
+    };
+}
+/**
+ * Decode `(bool,bytes)[]` back into per-call results, in the order sent.
+ *
+ * `expectedCalls` is the length of the batch that produced this blob, and a
+ * mismatch throws: the results carry no identity of their own, so pairing a
+ * short answer with the calls that were sent silently attributes each result
+ * to the wrong call.
+ *
+ * A sub-call that reverted is NOT an exception — it is a row with
+ * `success: false`. What throws is the batch's own answer being unreadable,
+ * which is a different event with a different fix.
+ */
+export function decodeAggregate3(returnData, expectedCalls) {
+    if (!Number.isInteger(expectedCalls) || expectedCalls < 0) {
+        throw new Error(`expectedCalls must be a non-negative integer, got ${expectedCalls}`);
+    }
+    let rows;
+    try {
+        [rows] = decodeData([AGGREGATE3_RETURN_TYPE], returnData);
+    }
+    catch (err) {
+        // Said as a batch-level failure on purpose: an unreadable blob means the
+        // aggregate call itself did not return what Multicall3 returns — a wrong
+        // address, a reverted batch, an empty answer from an address with no code
+        // — and none of those are a sub-call reverting.
+        throw new Error(`the batch's own return data is not ${AGGREGATE3_RETURN_TYPE}, so no sub-call result can be read from it: ${err.message}`);
+    }
+    if (!Array.isArray(rows)) {
+        throw new Error("the batch's own return data did not decode to an array of results");
+    }
+    if (rows.length !== expectedCalls) {
+        throw new Error(`the batch returned ${rows.length} result(s) for ${expectedCalls} call(s) — refusing to pair them up, because results are matched by position and nothing in them names the call they answer`);
+    }
+    return rows.map((row, index) => {
+        const [success, bytes] = Array.isArray(row) ? row : [];
+        if (typeof success !== "boolean" || typeof bytes !== "string") {
+            throw new Error(`result ${index} is not a (bool, bytes) pair`);
+        }
+        return {
+            index,
+            success,
+            returnData: bytes,
+            revert: success ? null : decodeRevertData(bytes),
+        };
+    });
+}
+/**
+ * Read revert bytes as the reason they carry.
+ *
+ * `Error(string)` and `Panic(uint256)` have known selectors and decode to
+ * something a human can act on. Anything else — a custom error, four bytes
+ * of nothing in particular — keeps its hex and gets no message: a guess at
+ * what an unknown selector means is worse than the hex, because the hex is
+ * at least searchable.
+ */
+export function decodeRevertData(revertData) {
+    const data = checkedBytes(revertData, "revert data");
+    const byteLength = (data.length - 2) / 2;
+    const plain = { reason: null, selector: null, panicCode: null, data };
+    // A bare `revert()`, a failed transfer to an address with no code, or a
+    // call that ran out of gas all come back empty. There is no message to be
+    // had, and "reverted" is not one.
+    if (byteLength === 0)
+        return { kind: "none", ...plain };
+    if (byteLength < 4)
+        return { kind: "unknown", ...plain };
+    const selector = data.slice(0, 10);
+    const payload = `0x${data.slice(10)}`;
+    const unknown = { kind: "unknown", reason: null, selector, panicCode: null, data };
+    if (selector === ERROR_STRING_SELECTOR) {
+        try {
+            const [message] = decodeData(["string"], payload);
+            if (typeof message === "string") {
+                return { kind: "string", reason: message, selector, panicCode: null, data };
+            }
+        }
+        catch {
+            // A payload that does not decode falls through to the hex. Throwing
+            // here would lose the other results in the same batch over one
+            // contract's malformed revert.
+        }
+        return unknown;
+    }
+    if (selector === PANIC_SELECTOR) {
+        try {
+            const [code] = decodeData(["uint256"], payload);
+            if (typeof code === "string") {
+                const panicCode = `0x${BigInt(code).toString(16).padStart(2, "0")}`;
+                return {
+                    kind: "panic",
+                    reason: PANIC_REASONS[panicCode] ?? null,
+                    selector,
+                    panicCode,
+                    data,
+                };
+            }
+        }
+        catch {
+            // As above: unreadable bytes stay bytes.
+        }
+        return unknown;
+    }
+    return unknown;
+}

package/dist/lib/typed.d.ts

@@ -0,0 +1,46 @@
+export type TypedField = {
+    readonly name: string;
+    readonly type: string;
+};
+export type TypedTypes = Readonly<Record<string, ReadonlyArray<TypedField>>>;
+/**
+ * `encodeType`: the primary struct first, then every referenced struct in
+ * alphabetical order. The order is part of the standard — a different order
+ * gives a different type hash and therefore a signature no verifier accepts.
+ */
+export declare function encodeType(primary: string, types: TypedTypes): string;
+export declare function typeHash(primary: string, types: TypedTypes): Uint8Array;
+export declare function hashStruct(primary: string, data: Record<string, unknown>, types: TypedTypes): Uint8Array;
+export type Domain = {
+    readonly name?: string;
+    readonly version?: string;
+    readonly chainId?: number | string;
+    readonly verifyingContract?: string;
+    readonly salt?: string;
+};
+/**
+ * The domain separator.
+ *
+ * Only the fields actually present are included, in the standard's order.
+ * Including an absent field, or reordering them, changes the separator and
+ * therefore binds the signature to a domain nobody will verify against.
+ */
+export declare function domainSeparator(domain: Domain): Uint8Array;
+export type TypedDataResult = {
+    readonly digest: string;
+    readonly domainSeparator: string;
+    readonly messageHash: string;
+    readonly typeHash: string;
+    readonly encodedType: string;
+    readonly primaryType: string;
+};
+/** The EIP-712 digest: keccak256(0x1901 then domainSeparator then hashStruct). */
+export declare function typedDataDigest(domain: Domain, types: TypedTypes, primaryType: string, message: Record<string, unknown>): TypedDataResult;
+/**
+ * EIP-191 `personal_sign`.
+ *
+ * The prefix is what stops a signed message from being replayable as a
+ * transaction. The length is the BYTE length, not the character count, so
+ * any non-ASCII character hashes differently if that is got wrong.
+ */
+export declare function personalSignHash(message: string): string;

package/dist/lib/typed.js

@@ -0,0 +1,171 @@
+/**
+ * EIP-712 typed-data hashing and EIP-191 message hashing.
+ *
+ * This computes the digest a wallet signs. It does NOT sign: no private key
+ * is accepted, read or handled anywhere in this package. Producing the
+ * digest is arithmetic over a schema and can be checked; holding a key is a
+ * different job with different consequences.
+ *
+ * The value of computing it separately is that a signature request can be
+ * checked BEFORE it is approved — a digest computed from the message a human
+ * was actually shown, compared against the one the dapp asked for.
+ */
+import { keccak256, toHex } from "@crewhaus/tool-encode";
+import { encodeTuple, parseType } from "./abi";
+const encoder = new TextEncoder();
+const hash = (bytes) => keccak256(bytes);
+const concat = (parts) => {
+    const out = new Uint8Array(parts.reduce((s, p) => s + p.length, 0));
+    let at = 0;
+    for (const p of parts) {
+        out.set(p, at);
+        at += p.length;
+    }
+    return out;
+};
+/** The struct types `primary` refers to, transitively. */
+function referencedTypes(primary, types, seen = new Set()) {
+    if (seen.has(primary))
+        return seen;
+    const fields = types[primary];
+    if (!fields)
+        return seen;
+    seen.add(primary);
+    for (const field of fields) {
+        const base = field.type.replace(/(\[\d*\])+$/, "");
+        if (types[base])
+            referencedTypes(base, types, seen);
+    }
+    return seen;
+}
+/**
+ * `encodeType`: the primary struct first, then every referenced struct in
+ * alphabetical order. The order is part of the standard — a different order
+ * gives a different type hash and therefore a signature no verifier accepts.
+ */
+export function encodeType(primary, types) {
+    const referenced = [...referencedTypes(primary, types)].filter((t) => t !== primary).sort();
+    return [primary, ...referenced]
+        .map((name) => {
+        const fields = types[name];
+        if (!fields)
+            throw new Error(`the type "${name}" is referenced but not defined`);
+        return `${name}(${fields.map((f) => `${f.type} ${f.name}`).join(",")})`;
+    })
+        .join("");
+}
+export function typeHash(primary, types) {
+    return hash(encoder.encode(encodeType(primary, types)));
+}
+/** One field, as the 32 bytes it contributes to a struct's encoding. */
+function encodeField(type, value, types, what) {
+    const arrayMatch = /^(.*)\[(\d*)\]$/.exec(type);
+    if (arrayMatch) {
+        if (!Array.isArray(value))
+            throw new Error(`${what}: expected an array`);
+        const inner = arrayMatch[1];
+        const expected = arrayMatch[2];
+        if (expected !== undefined &&
+            expected !== "" &&
+            value.length !== Number.parseInt(expected, 10)) {
+            throw new Error(`${what}: expected ${expected} items, got ${value.length}`);
+        }
+        // An array contributes the hash of its members' encodings.
+        return hash(concat(value.map((item, i) => encodeField(inner, item, types, `${what}[${i}]`))));
+    }
+    if (types[type])
+        return hashStruct(type, value, types);
+    if (type === "string")
+        return hash(encoder.encode(String(value)));
+    if (type === "bytes") {
+        const text = String(value).replace(/^0x/i, "");
+        if (!/^[0-9a-fA-F]*$/.test(text))
+            throw new Error(`${what}: bytes must be hex`);
+        const bytes = new Uint8Array(text.length / 2);
+        for (let i = 0; i < bytes.length; i++) {
+            bytes[i] = Number.parseInt(text.slice(i * 2, i * 2 + 2), 16);
+        }
+        return hash(bytes);
+    }
+    // Everything else must be an atomic ABI type. When it is not, the likely
+    // mistake is a struct named in a field and left out of `types`, so say
+    // both possibilities rather than only "not an ABI type".
+    try {
+        return encodeTuple([parseType(type)], [value], what);
+    }
+    catch (err) {
+        throw new Error(`${what}: "${type}" is neither a struct defined in types nor an ABI type (${err.message})`);
+    }
+}
+export function hashStruct(primary, data, types) {
+    const fields = types[primary];
+    if (!fields)
+        throw new Error(`the type "${primary}" is not defined`);
+    const parts = [typeHash(primary, types)];
+    for (const field of fields) {
+        if (!(field.name in data)) {
+            throw new Error(`"${primary}" requires the field "${field.name}", which the message does not have`);
+        }
+        parts.push(encodeField(field.type, data[field.name], types, `${primary}.${field.name}`));
+    }
+    return hash(concat(parts));
+}
+/**
+ * The domain separator.
+ *
+ * Only the fields actually present are included, in the standard's order.
+ * Including an absent field, or reordering them, changes the separator and
+ * therefore binds the signature to a domain nobody will verify against.
+ */
+export function domainSeparator(domain) {
+    const order = [
+        ["name", "string"],
+        ["version", "string"],
+        ["chainId", "uint256"],
+        ["verifyingContract", "address"],
+        ["salt", "bytes32"],
+    ];
+    const present = order.filter(([key]) => domain[key] !== undefined);
+    const types = {
+        EIP712Domain: present.map(([name, type]) => ({ name: name, type })),
+    };
+    return hashStruct("EIP712Domain", domain, types);
+}
+/** The EIP-712 digest: keccak256(0x1901 then domainSeparator then hashStruct). */
+export function typedDataDigest(domain, types, primaryType, message) {
+    // A caller may pass the full JSON payload, EIP712Domain included; it is
+    // defined by the standard and must not take part in encodeType.
+    const withoutDomain = Object.fromEntries(Object.entries(types).filter(([name]) => name !== "EIP712Domain"));
+    const separator = domainSeparator(domain);
+    const structHash = hashStruct(primaryType, message, withoutDomain);
+    const digest = hash(concat([new Uint8Array([0x19, 0x01]), separator, structHash]));
+    return {
+        digest: `0x${toHex(digest)}`,
+        domainSeparator: `0x${toHex(separator)}`,
+        messageHash: `0x${toHex(structHash)}`,
+        typeHash: `0x${toHex(typeHash(primaryType, withoutDomain))}`,
+        encodedType: encodeType(primaryType, withoutDomain),
+        primaryType,
+    };
+}
+/**
+ * The 0x19 byte that begins every EIP-191 signed payload.
+ *
+ * Built from its code point rather than written as an escape: a formatter
+ * that rewrites the escape into the raw byte would put a control character
+ * into this file, and a file carrying one is not parsed identically by every
+ * engine. The same rewrite once broke this repository's CI.
+ */
+const EIP191_PREFIX = String.fromCharCode(0x19);
+/**
+ * EIP-191 `personal_sign`.
+ *
+ * The prefix is what stops a signed message from being replayable as a
+ * transaction. The length is the BYTE length, not the character count, so
+ * any non-ASCII character hashes differently if that is got wrong.
+ */
+export function personalSignHash(message) {
+    const bytes = encoder.encode(message);
+    const prefix = encoder.encode(`${EIP191_PREFIX}Ethereum Signed Message:\n${bytes.length}`);
+    return `0x${toHex(hash(concat([prefix, bytes])))}`;
+}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@crewhaus/tool-onchain",
+  "version": "0.7.0",
+  "type": "module",
+  "description": "Deterministic onchain tools: ABI encoding and decoding, EIP-55 address checksums, EIP-712 and EIP-191 hashing, unit conversion and fixed-point DeFi maths",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "test": "bun test src"
+  },
+  "dependencies": {
+    "@crewhaus/errors": "0.7.0",
+    "@crewhaus/tool-builder": "0.7.0",
+    "@crewhaus/tool-catalog": "0.7.0",
+    "@crewhaus/tool-encode": "0.7.0",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@crewhaus/tool-executor": "workspace:*"
+  },
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Max Meier",
+    "email": "max@crewhaus.ai",
+    "url": "https://crewhaus.ai"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crewhaus/factory.git",
+    "directory": "packages/tool-onchain"
+  },
+  "homepage": "https://github.com/crewhaus/factory/tree/main/packages/tool-onchain#readme",
+  "bugs": {
+    "url": "https://github.com/crewhaus/factory/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
+}