@deepseek-ai/dsh-host-webserver 0.0.1-rc.1

package/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, DeepSeek
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/host/webserver/README.md
+README.md: c41001fba3a69bfd7c00550d0be602e3fc2e0474
+README.zh.md: 061bed977e456ba6c3cd38f5ad3d30fe0c9354ab

package/README.md

@@ -0,0 +1,22 @@
+# @deepseek-ai/dsh-host-webserver
+
+English | [中文](README.zh.md)
+
+Web HTTP and upgrade-route registration plugin (default-exported `HttpServerService`, config `{host, port}`): a `node:http` server that listens on activation and provides `ctx.httpServer`. `register(route)` adds a named `exact`/`prefix` HTTP route; `registerUpgrade(route)` adds an upgrade route for an exact pathname. A duplicate path within either table throws because route patterns are a composition-level contract and a collision is a misconfiguration; both methods return a disposer that removes the registration. `registerFallback(handler)` registers the one handler for requests that match no named route. A second registration throws; the SPA dist server [`dsh-frontend-static`](../frontend-static/README.md) is the shipped owner, and the server returns 404 while none is registered. `tapIndex(transform)` adds an index.html transform, and `applyIndexTaps(html)` runs a body through the registered transforms in order; the fallback handler calls it on every index response. `port` reads the listening port (the OS-assigned value when `port` is 0), and `host` reads the configured bind host (composition-time facts other plugins adapt to, e.g. the directory-picker chooser). HTTP match order is fixed: exact over the whole table, then longest prefix, then the fallback handler. Upgrades match exactly and unmatched connections are closed; registration order carries no request-facing semantics.
+
+The package knows no harness concepts and serves no files: the `/api` HTTP bridge and downlink WebSockets are routes owned by the connection plugin, plugin bundles and the HMR event stream are routes owned by the modules/hmr plugins, and dist serving belongs to the fallback owner. The upgrade handler owns the protocol handshake and connection contents; the webserver only delivers the raw socket and request. `host` accepts only `127.0.0.1` (default posture) and `0.0.0.0` (deliberate network exposure). This server serves browsers only; Electron loads dist over `file://` and carries fetch over an IPC bridge. This package never prints; the URL line belongs to the shell.
+
+A listen failure (EADDRINUSE…) throws out of activation and rejects Loader composition with the bind diagnostic; the failed candidate fiber is disposed. An HTTP request whose handling throws (a fallback owner's `decodeURIComponent` on a malformed %-escape, a client dropping mid-body) is answered 400 — or the socket destroyed when headers are already out — and logged as a warning; it never exits the process. An upgrade-handler exception or upgraded-socket transport error is logged as a warning and destroys its socket. Disposal starts `close()` and `closeAllConnections()`, destroys every tracked upgraded socket, and returns only after the HTTP server and those sockets have closed.
+
+## Model Experience
+
+None, as the package is a Web carrier between the browser and the HTTP/upgrade routes other plugins register; nothing here reaches a model request.
+
+#### KV Cache effect
+
+None; this package neither assembles nor sends a provider request.
+
+## Known Limitations and Deferred Work
+
+- **No TLS, auth, or origin policy** — binding a non-loopback address exposes the server to that network; deployment hardening (or fronting it with a real reverse proxy) is deliberately out of scope for the dev-facing v1.
+- **Socket options are fixed** — config selects the bind host and port, while backlog and other socket settings remain internal until a deployment needs them.

package/README.zh.md

@@ -0,0 +1,22 @@
+# @deepseek-ai/dsh-host-webserver
+
+[English](README.md) | 中文
+
+Web HTTP 与 upgrade route 注册插件（默认导出 `HttpServerService`，配置为 `{host, port}`）：一个在激活时开始监听的 `node:http` 服务器，提供 `ctx.httpServer`。`register(route)` 添加具名的 `exact`／`prefix` HTTP route；`registerUpgrade(route)` 添加精确 pathname 的 upgrade route；同一张表内的重复路径会抛错，因为 route 模式是组合层约定，冲突即配置错误；两者返回的 disposer 都会移除注册。`registerFallback(handler)` 注册一个 handler，处理所有未被具名 route 命中的请求。第二次注册会抛错；随附的 SPA dist 服务器 [`dsh-frontend-static`](../frontend-static/README.md) 是该 handler 的所有者，没有注册 handler 时服务器返回 404。`tapIndex(transform)` 添加一个 index.html 转换，`applyIndexTaps(html)` 按注册顺序对一段响应体运行已注册的转换；fallback handler 在每次 index 响应时调用它。`port` 读取正在监听的端口（当 `port` 为 0 时读取 OS 分配的值），`host` 读取配置的绑定宿主（这些是其他插件据以自适应的组合期事实，例如 directory-picker 选择器）。HTTP 匹配顺序固定不变：先在整张表中匹配精确 route，再匹配最长前缀，最后交给 fallback handler。upgrade 只做精确匹配，未命中连接直接关闭；注册顺序不影响请求处理。
+
+该包不了解任何 harness 概念，也不提供任何文件服务：`/api` HTTP 桥接与下行 WebSocket 是 connection 插件的 route，插件 bundle 与 HMR（热模块替换）事件流是 modules／hmr 插件的 route，dist 服务则属于 fallback 持有者。upgrade handler 拥有协议握手与连接内容；webserver 只交付原始 socket 与 request。`host` 只接受 `127.0.0.1`（默认值）和 `0.0.0.0`（有意向网络开放）。该服务器只服务浏览器；Electron 通过 `file://` 加载 dist，并经 IPC 桥接承载 fetch。该包从不打印内容；URL 行属于 shell。
+
+监听失败（EADDRINUSE……）会从激活过程抛出，以 bind 诊断使 Loader 组合 reject；失败的候选 fiber 会被 dispose（资源释放）。处理 HTTP 请求时抛错（例如 fallback 持有者的 `decodeURIComponent` 收到格式错误的百分号转义，或客户端在请求体传输中途断开）时，服务器会响应 400；若响应头已经发出，则销毁 socket，并记录 warning，但绝不会退出进程。upgrade handler 抛错或升级 socket 出现传输错误时，会记录 warning 并销毁对应 socket。资源释放会启动 `close()` 与 `closeAllConnections()`，销毁所有受跟踪的升级 socket，并仅在 HTTP server 与这些 socket 均已关闭后返回。
+
+## 模型体验
+
+无。该包只是浏览器与其他插件所注册 HTTP／upgrade route 之间的 Web 载体，其中没有任何内容会进入模型请求。
+
+#### KV 缓存影响
+
+无；该包既不组装也不发送提供方请求。
+
+## 已知限制与延期工作
+
+- **不提供 TLS、认证或来源策略**：绑定非回环地址会向对应网络公开服务器；面向部署的加固措施（或在前方放置真正的反向代理）有意不纳入面向开发环境的 v1。
+- **Socket 选项固定不变**：配置只选择绑定宿主与端口；在具体部署产生需求前，backlog 和其他 socket 设置仍保持内部实现。

package/lib/index.js

@@ -0,0 +1,217 @@
+import { createServer } from "node:http";
+import { Service } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+//#region lib/types/index.js
+/**
+* @deepseek-ai/dsh-host-webserver — Web route-registration plugin: a node:http
+* server plus the `httpServer` service (HTTP and upgrade route registries,
+* index transform taps, and the single fallback seat for everything no route
+* claims). Knows no harness concepts and serves no files; the composing
+* application's frontend plugin owns dist serving through the fallback hook.
+* Web shape only — Electron loads dist over file:// and carries fetch over an
+* IPC bridge. This package never prints: the URL line belongs to the shell.
+*/
+/**
+* The browser HTTP carrier service. Activation listens immediately. Route
+* registration order does not affect requests because configured named routes
+* must be distinct, and the fallback handler answers anything not yet claimed
+* during startup with 404 until its owner registers. A listen failure rejects
+* initialization, and the boot process reports the failed fiber.
+*/
+var HttpServerService = class extends Service {
+	config;
+	static Config = z.object({
+		host: z.union([z.const("127.0.0.1"), z.const("0.0.0.0")]).required(),
+		port: z.natural().max(65535).required()
+	});
+	exact = /* @__PURE__ */ new Map();
+	prefixes = /* @__PURE__ */ new Map();
+	upgrades = /* @__PURE__ */ new Map();
+	upgradedSockets = /* @__PURE__ */ new Set();
+	indexTaps = [];
+	fallback;
+	server;
+	listenedPort;
+	constructor(ctx, config) {
+		super(ctx, "httpServer");
+		this.config = config;
+	}
+	/** The listening port (the OS-assigned value when config.port is 0). */
+	get port() {
+		return this.listenedPort;
+	}
+	/** The configured bind host (the loopback or all-interfaces literal). */
+	get host() {
+		return this.config.host;
+	}
+	/**
+	* Register a named route. Duplicate (kind, path) throws — route patterns are
+	* a composition-level contract, so a collision is a misconfiguration.
+	* @param route - kind, path, and the owning handler.
+	* @returns the disposer removing the route.
+	*/
+	register(route) {
+		const table = route.kind === "exact" ? this.exact : this.prefixes;
+		if (table.has(route.path)) throw new Error(`webserver: duplicate ${route.kind} route "${route.path}"`);
+		table.set(route.path, route);
+		return () => {
+			table.delete(route.path);
+		};
+	}
+	/**
+	* Register an exact-path HTTP upgrade route. Duplicate paths throw because
+	* one socket can have only one protocol owner.
+	* @param route - pathname and handler owning negotiation plus socket use.
+	* @returns the disposer removing the route.
+	*/
+	registerUpgrade(route) {
+		if (this.upgrades.has(route.path)) throw new Error(`webserver: duplicate upgrade route "${route.path}"`);
+		this.upgrades.set(route.path, route);
+		return () => {
+			this.upgrades.delete(route.path);
+		};
+	}
+	/**
+	* Claim the fallback seat: the handler answering every request no named
+	* route matches (the SPA dist server in the shipped Web composition). One
+	* owner only — a second registration throws, because two fallbacks cannot
+	* compose.
+	* @param handler - owns the full response lifecycle of unmatched requests.
+	* @returns the disposer releasing the seat.
+	*/
+	registerFallback(handler) {
+		if (this.fallback !== void 0) throw new Error("webserver: fallback already registered");
+		this.fallback = handler;
+		return () => {
+			this.fallback = void 0;
+		};
+	}
+	/**
+	* Register an index.html transform, applied by the fallback owner to every
+	* index response ({@link applyIndexTaps}) in registration order.
+	* @param transform - pure html-to-html function.
+	* @returns the disposer removing the transform.
+	*/
+	tapIndex(transform) {
+		this.indexTaps.push(transform);
+		return () => {
+			const at = this.indexTaps.indexOf(transform);
+			if (at !== -1) this.indexTaps.splice(at, 1);
+		};
+	}
+	/** Listen; resolves once the socket is bound (rejection = FAILED fiber). */
+	async [Service.init]() {
+		const handle = async (req, res) => {
+			/* v8 ignore next -- `?? '/'` arm: node:http always sets url on server
+			requests; the field is only optional on the client-side IncomingMessage type */
+			const rawPath = new URL(req.url ?? "/", "http://x").pathname;
+			const route = this.match(rawPath);
+			if (route !== void 0) {
+				await route.handler(req, res);
+				return;
+			}
+			const fallback = this.fallback;
+			if (fallback === void 0) {
+				res.writeHead(404);
+				res.end();
+				return;
+			}
+			await fallback(req, res);
+		};
+		this.server = createServer((req, res) => {
+			handle(req, res).catch((err) => {
+				this.ctx.logger.warn(err instanceof Error ? err : new Error(String(err)));
+				if (res.headersSent) {
+					res.destroy();
+					return;
+				}
+				res.writeHead(400);
+				res.end();
+			});
+		});
+		this.server.on("upgrade", (req, socket, head) => {
+			const onError = (error) => {
+				this.ctx.logger.warn(error);
+				socket.destroy();
+			};
+			socket.on("error", onError);
+			socket.once("close", () => {
+				socket.off("error", onError);
+				this.upgradedSockets.delete(socket);
+			});
+			let route;
+			try {
+				/* v8 ignore next -- node:http always sets url on server requests. */
+				route = this.upgrades.get(new URL(req.url ?? "/", "http://x").pathname);
+			} catch (error) {
+				this.ctx.logger.warn(error instanceof Error ? error : new Error(String(error)));
+				socket.destroy();
+				return;
+			}
+			if (route === void 0) {
+				socket.destroy();
+				return;
+			}
+			this.upgradedSockets.add(socket);
+			try {
+				Promise.resolve(route.handler(req, socket, head)).catch((error) => {
+					this.ctx.logger.warn(error instanceof Error ? error : new Error(String(error)));
+					socket.destroy();
+				});
+			} catch (error) {
+				this.ctx.logger.warn(error instanceof Error ? error : new Error(String(error)));
+				socket.destroy();
+			}
+		});
+		await new Promise((resolve, reject) => {
+			this.server.once("error", reject);
+			this.server.listen(this.config.port, this.config.host, () => {
+				this.server.off("error", reject);
+				this.server.on("error", (err) => {
+					this.ctx.logger.error(err);
+				});
+				this.listenedPort = this.server.address().port;
+				resolve();
+			});
+		});
+		this.ctx.effect(() => async () => {
+			const serverClosed = new Promise((resolve) => {
+				this.server.close(() => {
+					resolve();
+				});
+			});
+			this.server.closeAllConnections();
+			const upgradedClosed = [...this.upgradedSockets].map((socket) => new Promise((resolve) => {
+				socket.once("close", () => {
+					resolve();
+				});
+				socket.destroy();
+			}));
+			await Promise.all([serverClosed, ...upgradedClosed]);
+		}, "httpServer.listen");
+	}
+	/** Longest-prefix-wins over the prefix table after an exact-table miss. */
+	match(pathname) {
+		const exact = this.exact.get(pathname);
+		if (exact !== void 0) return exact;
+		let best;
+		for (const [prefix, route] of this.prefixes) {
+			if (pathname !== prefix && !pathname.startsWith(`${prefix}/`)) continue;
+			if (best === void 0 || prefix.length > best.path.length) best = route;
+		}
+		return best;
+	}
+	/**
+	* Run an index.html body through the registered taps in registration order
+	* — called by the fallback owner on every index response it renders.
+	* @param html - the raw index.html body.
+	* @returns the transformed body.
+	*/
+	applyIndexTaps(html) {
+		let out = html;
+		for (const transform of this.indexTaps) out = transform(out);
+		return out;
+	}
+};
+//#endregion
+export { HttpServerService, HttpServerService as default };

package/lib/invariant.js

@@ -0,0 +1,50 @@
+//#region lib/types/invariant.js
+/**
+* Package-owned invariant companion for `@deepseek-ai/dsh-host-webserver`.
+* @module @deepseek-ai/dsh-host-webserver/invariant
+*/
+const PACKAGE_NAME = "@deepseek-ai/dsh-host-webserver";
+/** Cordis companion plugin name. */
+const name = "host-webserver-invariant";
+/** Service required before the companion can register. */
+const inject = ["invariants"];
+/**
+* Owned relation: HTTP and upgrade route registrations and their disposers must stay
+* symmetric — after the owning fiber of a registered route unloads, the
+* route table must no longer answer for its path (a stale route would keep
+* serving a disposed plugin's handler). Checked on every fiber teardown
+* (cordis 'internal/plugin'): the service's own registry state is compared
+* against the set of live fibers' registrations indirectly, by probing that
+* dispose really removed the entry — the register() disposer contract.
+*/
+const install = (ctx, fail) => {
+	ctx.on("internal/plugin", () => {
+		const server = ctx.get("httpServer");
+		if (server === void 0) return;
+		const probe = {
+			kind: "exact",
+			path: "/__dsh_invariant_probe__",
+			handler: () => {}
+		};
+		try {
+			server.register(probe)();
+			server.register(probe)();
+			const upgradeProbe = {
+				path: "/__dsh_invariant_upgrade_probe__",
+				handler: () => {}
+			};
+			server.registerUpgrade(upgradeProbe)();
+			server.registerUpgrade(upgradeProbe)();
+		} catch {
+			fail("httpServer route disposer left a route registered — route tables and fiber lifecycles diverged");
+		}
+	}, { global: true });
+};
+/**
+* Register this package's invariant companion.
+* @param ctx - Cordis context carrying the invariant service.
+* @returns the installed registration's disposer after setup succeeds.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/index.d.ts

@@ -0,0 +1,109 @@
+/**
+ * @deepseek-ai/dsh-host-webserver — Web route-registration plugin: a node:http
+ * server plus the `httpServer` service (HTTP and upgrade route registries,
+ * index transform taps, and the single fallback seat for everything no route
+ * claims). Knows no harness concepts and serves no files; the composing
+ * application's frontend plugin owns dist serving through the fallback hook.
+ * Web shape only — Electron loads dist over file:// and carries fetch over an
+ * IPC bridge. This package never prints: the URL line belongs to the shell.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Duplex } from 'node:stream';
+import { Context, Service } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        httpServer: HttpServerService;
+    }
+}
+/** Route match kind: 'exact' matches the pathname verbatim; 'prefix' p matches p and p/<anything>. */
+export type WebRouteKind = 'exact' | 'prefix';
+/** One named route registration. */
+export interface WebRoute {
+    kind: WebRouteKind;
+    /** Absolute pathname, no trailing slash. */
+    path: string;
+    /** Owns the full response lifecycle (may hold the response open, e.g. SSE). */
+    handler: (req: IncomingMessage, res: ServerResponse) => void | Promise<void>;
+}
+/** One exact-path HTTP upgrade registration. */
+export interface WebUpgradeRoute {
+    /** Absolute pathname, no trailing slash. */
+    path: string;
+    /** Owns protocol negotiation and the upgraded socket after dispatch. */
+    handler: (req: IncomingMessage, socket: Duplex, head: Buffer) => void | Promise<void>;
+}
+/** Gateway config: the listen address. */
+export interface Config {
+    /** Listen host; the two supported values are loopback and all-interfaces. */
+    host: '127.0.0.1' | '0.0.0.0';
+    /** Listen port; zero requests an OS-assigned port. */
+    port: number;
+}
+/**
+ * The browser HTTP carrier service. Activation listens immediately. Route
+ * registration order does not affect requests because configured named routes
+ * must be distinct, and the fallback handler answers anything not yet claimed
+ * during startup with 404 until its owner registers. A listen failure rejects
+ * initialization, and the boot process reports the failed fiber.
+ */
+export declare class HttpServerService extends Service {
+    private config;
+    static Config: z<Config>;
+    private readonly exact;
+    private readonly prefixes;
+    private readonly upgrades;
+    private readonly upgradedSockets;
+    private readonly indexTaps;
+    private fallback;
+    private server;
+    private listenedPort;
+    constructor(ctx: Context, config: Config);
+    /** The listening port (the OS-assigned value when config.port is 0). */
+    get port(): number;
+    /** The configured bind host (the loopback or all-interfaces literal). */
+    get host(): Config['host'];
+    /**
+     * Register a named route. Duplicate (kind, path) throws — route patterns are
+     * a composition-level contract, so a collision is a misconfiguration.
+     * @param route - kind, path, and the owning handler.
+     * @returns the disposer removing the route.
+     */
+    register(route: WebRoute): () => void;
+    /**
+     * Register an exact-path HTTP upgrade route. Duplicate paths throw because
+     * one socket can have only one protocol owner.
+     * @param route - pathname and handler owning negotiation plus socket use.
+     * @returns the disposer removing the route.
+     */
+    registerUpgrade(route: WebUpgradeRoute): () => void;
+    /**
+     * Claim the fallback seat: the handler answering every request no named
+     * route matches (the SPA dist server in the shipped Web composition). One
+     * owner only — a second registration throws, because two fallbacks cannot
+     * compose.
+     * @param handler - owns the full response lifecycle of unmatched requests.
+     * @returns the disposer releasing the seat.
+     */
+    registerFallback(handler: WebRoute['handler']): () => void;
+    /**
+     * Register an index.html transform, applied by the fallback owner to every
+     * index response ({@link applyIndexTaps}) in registration order.
+     * @param transform - pure html-to-html function.
+     * @returns the disposer removing the transform.
+     */
+    tapIndex(transform: (html: string) => string): () => void;
+    /** Listen; resolves once the socket is bound (rejection = FAILED fiber). */
+    [Service.init](): Promise<void>;
+    /** Longest-prefix-wins over the prefix table after an exact-table miss. */
+    private match;
+    /**
+     * Run an index.html body through the registered taps in registration order
+     * — called by the fallback owner on every index response it renders.
+     * @param html - the raw index.html body.
+     * @returns the transformed body.
+     */
+    applyIndexTaps(html: string): string;
+}
+export default HttpServerService;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Package-owned invariant companion for `@deepseek-ai/dsh-host-webserver`.
+ * @module @deepseek-ai/dsh-host-webserver/invariant
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "host-webserver-invariant";
+/** Service required before the companion can register. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@deepseek-ai/dsh-host-webserver",
+  "description": "Web route-registration plugin: HTTP and upgrade routes, index transform taps, and static dist fallback; knows no harness concepts",
+  "version": "0.0.1-rc.1",
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/host/webserver"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "BSD-3-Clause",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.1"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1-rc.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.1"
+  }
+}