@driggsby/sdk 0.0.1 → 0.2.1

package/LICENSE

@@ -0,0 +1,117 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, "control" means (i) the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work.
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works
+shall not include works that remain separable from, or merely link (or bind by
+name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version
+of the Work and any modifications or additions to that Work or Derivative Works
+thereof, that is intentionally submitted to Licensor for inclusion in the Work
+by the copyright owner or by an individual or Legal Entity authorized to submit
+on behalf of the copyright owner. For the purposes of this definition,
+"submitted" means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems, and
+issue tracking systems that are managed by, or on behalf of, the Licensor for
+the purpose of discussing and improving the Work, but excluding communication
+that is conspicuously marked or otherwise designated in writing by the copyright
+owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License,
+each Contributor hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable patent license to make, have made, use,
+offer to sell, sell, import, and otherwise transfer the Work.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy of
+this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any part
+of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then
+any Derivative Works that You distribute must include a readable copy of the
+attribution notices contained within such NOTICE file.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied, including, without limitation,
+any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or
+FITNESS FOR A PARTICULAR PURPOSE.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law or agreed to in writing, shall any Contributor be liable to You
+for damages, including any direct, indirect, special, incidental, or
+consequential damages arising as a result of this License or out of the use or
+inability to use the Work.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or
+Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations.
+However, in accepting such obligations, You may act only on Your own behalf and
+on Your sole responsibility.

package/README.md

@@ -1,4 +1,42 @@
 # @driggsby/sdk
 
-This version is a name reservation. The real package arrives with the next
-release, published via npm trusted publishing with provenance.
+The browser SDK for [Driggsby](https://driggsby.com) apps — small static
+web apps, each served at its own `driggsby.dev` address, that show live
+financial data.
+
+Most apps never install this package. Driggsby serves the SDK to every
+deployed app on the app's own origin, so one tag is the entire setup:
+
+```html
+<script type="module" src="/-/driggsby-sdk.js"></script>
+```
+
+and reading live data is one call:
+
+```js
+driggsby.watch("list_accounts", {}, (result) => render(result));
+```
+
+Every `watch` is a live subscription: when the underlying data changes,
+the callback runs again with fresh data. It returns an unsubscribe
+function. Identical results are deduped, so unchanged data never
+re-renders.
+
+This package exists for two narrower uses:
+
+- `driggsby dev` serves the same runtime locally from this package's
+  bundled copy, so an app under development behaves exactly like a
+  deployed one.
+- Bundler users can `import type` the SDK surface, or import `SdkCore`
+  to embed the protocol runtime in their own tooling.
+
+```ts
+import { PROTOCOL, SdkCore } from "@driggsby/sdk";
+```
+
+The SDK speaks the frozen `driggsby-sdk/1` postMessage protocol with the
+embedding Driggsby host page. Security properties worth knowing: the SDK
+only ever talks to its parent window, only after the host proves itself
+from an allowed origin (the Driggsby console, or a loopback host page
+during local development), and it pins the first valid host origin for
+the life of the page.

package/dist/driggsby-sdk.js

@@ -0,0 +1,173 @@
+// src/sdk-core.ts
+var PROTOCOL = "driggsby-sdk/1";
+var MAX_WATCHES = 32;
+var EXACT_ALLOWED_HOST_ORIGINS = /* @__PURE__ */ new Set(["https://app.driggsby.com"]);
+var LOCAL_HOST_ORIGIN_PATTERN = /^http:\/\/(localhost|127\.0\.0\.1)(:\d{1,5})?$/;
+var LOCAL_APP_HOSTNAME_PATTERN = /^(localhost|127\.0\.0\.1|.+\.localhost)$/;
+function isLocalAppHostname(hostname) {
+  return LOCAL_APP_HOSTNAME_PATTERN.test(hostname);
+}
+function isAllowedHostOrigin(origin, allowLocalHostOrigins) {
+  if (EXACT_ALLOWED_HOST_ORIGINS.has(origin)) return true;
+  return allowLocalHostOrigins && LOCAL_HOST_ORIGIN_PATTERN.test(origin);
+}
+function parseProtocolMessage(data) {
+  if (typeof data !== "object" || data === null) return null;
+  const record = data;
+  if (record.protocol !== PROTOCOL) return null;
+  const type = record.type;
+  if (typeof type !== "string") return null;
+  let errorMessage = null;
+  const error = record.error;
+  if (typeof error === "object" && error !== null) {
+    const message = error.message;
+    errorMessage = typeof message === "string" ? message : "Something went wrong running this tool.";
+  }
+  return {
+    type,
+    id: typeof record.id === "string" ? record.id : null,
+    result: record.result,
+    errorMessage
+  };
+}
+var SdkCore = class {
+  // Wired by the page entry: remove the standalone note, log tool errors,
+  // reload on a new deployed version.
+  onHostReady = null;
+  onToolError = null;
+  onNewVersion = null;
+  post;
+  allowLocalHostOrigins;
+  hostOrigin = null;
+  watches = /* @__PURE__ */ new Map();
+  sequence = 0;
+  constructor(post, options = {}) {
+    this.post = post;
+    this.allowLocalHostOrigins = options.allowLocalHostOrigins ?? false;
+  }
+  get hostReady() {
+    return this.hostOrigin !== null;
+  }
+  // params is typed loose on purpose: app authors call this from untyped
+  // JavaScript, and a null/omitted params should mean "no params", not a
+  // crash.
+  watch(tool, params, callback) {
+    if (this.watches.size >= MAX_WATCHES) {
+      this.onToolError?.(tool, `Watch limit reached (${String(MAX_WATCHES)}); this watch will not receive data. Unsubscribe watches you no longer need.`);
+      return () => void 0;
+    }
+    this.sequence += 1;
+    const id = `w${this.sequence}`;
+    this.watches.set(id, { tool, params: params ?? {}, callback, lastDeliveredJson: null });
+    this.requestWatch(id);
+    return () => {
+      this.watches.delete(id);
+    };
+  }
+  // fromParent must be the caller's verification that the browser event's
+  // source is the actual parent window (event.source === window.parent) —
+  // origin alone is not enough, because a sibling frame on an allowed
+  // origin could otherwise speak for the host.
+  handleMessage(origin, fromParent, data) {
+    if (!fromParent) return;
+    const message = parseProtocolMessage(data);
+    if (message === null) return;
+    if (message.type === "hello") {
+      this.handleHello(origin);
+      return;
+    }
+    if (this.hostOrigin === null || origin !== this.hostOrigin) return;
+    if (message.type === "result") {
+      this.handleResult(message);
+    } else if (message.type === "data-changed") {
+      this.requestAllWatches();
+    } else if (message.type === "new-version") {
+      this.onNewVersion?.();
+    }
+  }
+  handleHello(origin) {
+    if (this.hostOrigin !== null) return;
+    if (!isAllowedHostOrigin(origin, this.allowLocalHostOrigins)) return;
+    this.hostOrigin = origin;
+    this.onHostReady?.();
+    this.requestAllWatches();
+  }
+  handleResult(message) {
+    const entry = message.id === null ? void 0 : this.watches.get(message.id);
+    if (entry === void 0) return;
+    if (message.errorMessage !== null) {
+      const json2 = JSON.stringify({ error: message.errorMessage });
+      if (json2 === entry.lastDeliveredJson) return;
+      entry.lastDeliveredJson = json2;
+      this.onToolError?.(entry.tool, message.errorMessage);
+      return;
+    }
+    const json = JSON.stringify({ result: message.result });
+    if (json === entry.lastDeliveredJson) return;
+    entry.lastDeliveredJson = json;
+    entry.callback(message.result);
+  }
+  requestAllWatches() {
+    for (const id of this.watches.keys()) this.requestWatch(id);
+  }
+  requestWatch(id) {
+    if (this.hostOrigin === null) return;
+    const entry = this.watches.get(id);
+    if (entry === void 0) return;
+    this.post(
+      { protocol: PROTOCOL, type: "call", id, tool: entry.tool, params: entry.params },
+      this.hostOrigin
+    );
+  }
+};
+
+// src/entrypoint.ts
+var STANDALONE_NOTE_ATTRIBUTE = "data-driggsby-standalone-note";
+var STANDALONE_NOTE_DELAY_MS = 800;
+function showStandaloneNote() {
+  if (document.querySelector(`[${STANDALONE_NOTE_ATTRIBUTE}]`) !== null) return;
+  const note = document.createElement("div");
+  note.setAttribute(STANDALONE_NOTE_ATTRIBUTE, "");
+  note.style.cssText = "position:fixed;left:16px;right:16px;bottom:16px;max-width:480px;margin:0 auto;padding:14px 18px;border-radius:12px;background:#1c1c1e;color:#f2f2f4;font:14px/1.5 system-ui,sans-serif;box-shadow:0 8px 30px rgba(0,0,0,0.35);z-index:2147483647";
+  note.textContent = "This dashboard shows your data when you open it from Driggsby. Head to your Driggsby console and open it from the Dashboards page.";
+  document.body.appendChild(note);
+}
+function removeStandaloneNote() {
+  document.querySelector(`[${STANDALONE_NOTE_ATTRIBUTE}]`)?.remove();
+}
+function whenBodyReady(callback) {
+  if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", callback, { once: true });
+    return;
+  }
+  callback();
+}
+var core = new SdkCore((message, targetOrigin) => {
+  window.parent.postMessage(message, targetOrigin);
+}, {
+  // A localhost host origin is only ever legitimate when this app is
+  // itself served from a local runtime; the production bundle pins to
+  // exactly the Driggsby console origin.
+  allowLocalHostOrigins: isLocalAppHostname(window.location.hostname)
+});
+core.onHostReady = removeStandaloneNote;
+core.onNewVersion = () => {
+  window.location.reload();
+};
+core.onToolError = (tool, message) => {
+  console.error(`Driggsby: the ${tool} call didn't work \u2014 ${message}`);
+};
+window.addEventListener("message", (event) => {
+  core.handleMessage(event.origin, event.source === window.parent, event.data);
+});
+window.driggsby = {
+  watch: (tool, params, callback) => core.watch(tool, params, callback)
+};
+if (window.parent === window) {
+  whenBodyReady(showStandaloneNote);
+} else {
+  window.parent.postMessage({ protocol: PROTOCOL, type: "ready" }, "*");
+  window.setTimeout(() => {
+    if (!core.hostReady) whenBodyReady(showStandaloneNote);
+  }, STANDALONE_NOTE_DELAY_MS);
+}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { MAX_WATCHES, PROTOCOL, SdkCore, isAllowedHostOrigin, isLocalAppHostname, type PostFunction, type WatchCallback, } from "./sdk-core.ts";

package/dist/index.js

@@ -0,0 +1,9 @@
+// Public exports of @driggsby/sdk for bundler users and for the driggsby
+// CLI's local dev host. Browser apps normally don't import this package at
+// all — they load the runtime with one tag:
+//
+//   <script type="module" src="/-/driggsby-sdk.js"></script>
+//
+// which Driggsby serves on the app's own origin (and `driggsby dev` serves
+// locally from this package's bundled copy at dist/driggsby-sdk.js).
+export { MAX_WATCHES, PROTOCOL, SdkCore, isAllowedHostOrigin, isLocalAppHostname, } from "./sdk-core.js";

package/dist/sdk-core.d.ts

@@ -0,0 +1,26 @@
+export declare const PROTOCOL = "driggsby-sdk/1";
+export declare const MAX_WATCHES = 32;
+export declare function isLocalAppHostname(hostname: string): boolean;
+export declare function isAllowedHostOrigin(origin: string, allowLocalHostOrigins: boolean): boolean;
+export type WatchCallback = (result: unknown) => void;
+export type PostFunction = (message: Record<string, unknown>, targetOrigin: string) => void;
+export declare class SdkCore {
+    onHostReady: (() => void) | null;
+    onToolError: ((tool: string, message: string) => void) | null;
+    onNewVersion: (() => void) | null;
+    private readonly post;
+    private readonly allowLocalHostOrigins;
+    private hostOrigin;
+    private readonly watches;
+    private sequence;
+    constructor(post: PostFunction, options?: {
+        allowLocalHostOrigins?: boolean;
+    });
+    get hostReady(): boolean;
+    watch(tool: string, params: Record<string, unknown> | null | undefined, callback: WatchCallback): () => void;
+    handleMessage(origin: string, fromParent: boolean, data: unknown): void;
+    private handleHello;
+    private handleResult;
+    private requestAllWatches;
+    private requestWatch;
+}

package/dist/sdk-core.js

@@ -0,0 +1,172 @@
+// The Driggsby SDK protocol core. A Driggsby app loads the SDK on its own
+// origin and talks to the embedding Driggsby host page over postMessage,
+// speaking the frozen driggsby-sdk/1 protocol. This module is pure protocol
+// state — no DOM, no window — so `node --test` can exercise the
+// security-sensitive parts directly: the host-origin allowlist, the
+// first-valid-hello pin, and the parent-source requirement.
+//
+// The whole public surface an app sees is:
+//   driggsby.watch(tool, params, callback) -> unsubscribe()
+// Every read is a live subscription: the host announces "data-changed" and
+// each watch re-runs; results are deduped by JSON identity so unchanged
+// data never re-renders.
+//
+// The production copy of this runtime is the one Driggsby serves to every
+// deployed app at /-/driggsby-sdk.js on the app's own origin; that copy is
+// canonical. This package carries the same runtime so `driggsby dev` can
+// serve it locally, and so bundler users can import the types. Protocol v1
+// is frozen — the contract tests beside this file pin the exact wire
+// messages, and the protocol version string is the drift tripwire.
+export const PROTOCOL = "driggsby-sdk/1";
+// Generous ceiling on concurrent subscriptions per app; a real dashboard
+// uses a handful.
+export const MAX_WATCHES = 32;
+// The only hosts allowed to drive an embedded app: the Driggsby console,
+// or — ONLY when the SDK itself is being served from a local runtime — a
+// local-dev host page. Never learned from the first message — a hello from
+// anywhere else is ignored. The local branch is gated on the app's own
+// hostname so the production bundle pins to exactly one possible host
+// origin.
+const EXACT_ALLOWED_HOST_ORIGINS = new Set(["https://app.driggsby.com"]);
+const LOCAL_HOST_ORIGIN_PATTERN = /^http:\/\/(localhost|127\.0\.0\.1)(:\d{1,5})?$/;
+const LOCAL_APP_HOSTNAME_PATTERN = /^(localhost|127\.0\.0\.1|.+\.localhost)$/;
+export function isLocalAppHostname(hostname) {
+    return LOCAL_APP_HOSTNAME_PATTERN.test(hostname);
+}
+export function isAllowedHostOrigin(origin, allowLocalHostOrigins) {
+    if (EXACT_ALLOWED_HOST_ORIGINS.has(origin))
+        return true;
+    return allowLocalHostOrigins && LOCAL_HOST_ORIGIN_PATTERN.test(origin);
+}
+// Untrusted wire data -> a normalized message, or null when it is not ours.
+function parseProtocolMessage(data) {
+    if (typeof data !== "object" || data === null)
+        return null;
+    const record = data;
+    if (record.protocol !== PROTOCOL)
+        return null;
+    const type = record.type;
+    if (typeof type !== "string")
+        return null;
+    let errorMessage = null;
+    const error = record.error;
+    if (typeof error === "object" && error !== null) {
+        const message = error.message;
+        errorMessage = typeof message === "string" ? message : "Something went wrong running this tool.";
+    }
+    return {
+        type,
+        id: typeof record.id === "string" ? record.id : null,
+        result: record.result,
+        errorMessage,
+    };
+}
+export class SdkCore {
+    // Wired by the page entry: remove the standalone note, log tool errors,
+    // reload on a new deployed version.
+    onHostReady = null;
+    onToolError = null;
+    onNewVersion = null;
+    post;
+    allowLocalHostOrigins;
+    hostOrigin = null;
+    watches = new Map();
+    sequence = 0;
+    constructor(post, options = {}) {
+        this.post = post;
+        this.allowLocalHostOrigins = options.allowLocalHostOrigins ?? false;
+    }
+    get hostReady() {
+        return this.hostOrigin !== null;
+    }
+    // params is typed loose on purpose: app authors call this from untyped
+    // JavaScript, and a null/omitted params should mean "no params", not a
+    // crash.
+    watch(tool, params, callback) {
+        // Watches are registered by arbitrary app code; a watch() call that
+        // leaked into a render loop would otherwise grow forever and turn
+        // every data-changed into an unbounded fan-out of real tool calls.
+        // Past the cap: report it and hand back a no-op unsubscribe.
+        if (this.watches.size >= MAX_WATCHES) {
+            this.onToolError?.(tool, `Watch limit reached (${String(MAX_WATCHES)}); this watch will not receive data. Unsubscribe watches you no longer need.`);
+            return () => undefined;
+        }
+        this.sequence += 1;
+        const id = `w${this.sequence}`;
+        this.watches.set(id, { tool, params: params ?? {}, callback, lastDeliveredJson: null });
+        // Before the host pins, requestWatch posts nothing; the pinning hello
+        // fires every registered watch, so pre-hello watches are simply held.
+        this.requestWatch(id);
+        return () => {
+            this.watches.delete(id);
+        };
+    }
+    // fromParent must be the caller's verification that the browser event's
+    // source is the actual parent window (event.source === window.parent) —
+    // origin alone is not enough, because a sibling frame on an allowed
+    // origin could otherwise speak for the host.
+    handleMessage(origin, fromParent, data) {
+        if (!fromParent)
+            return;
+        const message = parseProtocolMessage(data);
+        if (message === null)
+            return;
+        if (message.type === "hello") {
+            this.handleHello(origin);
+            return;
+        }
+        // Everything after the handshake must come from the pinned host origin.
+        if (this.hostOrigin === null || origin !== this.hostOrigin)
+            return;
+        if (message.type === "result") {
+            this.handleResult(message);
+        }
+        else if (message.type === "data-changed") {
+            this.requestAllWatches();
+        }
+        else if (message.type === "new-version") {
+            this.onNewVersion?.();
+        }
+    }
+    handleHello(origin) {
+        if (this.hostOrigin !== null)
+            return; // pinned; later hellos are ignored
+        if (!isAllowedHostOrigin(origin, this.allowLocalHostOrigins))
+            return;
+        this.hostOrigin = origin;
+        this.onHostReady?.();
+        this.requestAllWatches();
+    }
+    handleResult(message) {
+        const entry = message.id === null ? undefined : this.watches.get(message.id);
+        if (entry === undefined)
+            return;
+        if (message.errorMessage !== null) {
+            const json = JSON.stringify({ error: message.errorMessage });
+            if (json === entry.lastDeliveredJson)
+                return;
+            entry.lastDeliveredJson = json;
+            this.onToolError?.(entry.tool, message.errorMessage);
+            return;
+        }
+        // Wrapping in an object keeps stringify total: even `result: undefined`
+        // serializes (to '{}') instead of returning undefined.
+        const json = JSON.stringify({ result: message.result });
+        if (json === entry.lastDeliveredJson)
+            return;
+        entry.lastDeliveredJson = json;
+        entry.callback(message.result);
+    }
+    requestAllWatches() {
+        for (const id of this.watches.keys())
+            this.requestWatch(id);
+    }
+    requestWatch(id) {
+        if (this.hostOrigin === null)
+            return;
+        const entry = this.watches.get(id);
+        if (entry === undefined)
+            return;
+        this.post({ protocol: PROTOCOL, type: "call", id, tool: entry.tool, params: entry.params }, this.hostOrigin);
+    }
+}

package/package.json

@@ -1,10 +1,34 @@
 {
   "name": "@driggsby/sdk",
-  "version": "0.0.1",
-  "description": "The in-page runtime for Driggsby-hosted apps. This version is a name reservation; the real package arrives with the next release.",
-  "license": "MIT",
+  "version": "0.2.1",
+  "description": "The browser SDK for Driggsby apps: live financial data through driggsby.watch().",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/driggsby/driggsby.git"
+  },
+  "homepage": "https://driggsby.com",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./driggsby-sdk.js": "./dist/driggsby-sdk.js"
+  },
+  "files": [
+    "dist",
+    "!dist/.tsbuildinfo",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && esbuild src/entrypoint.ts --bundle --format=esm --target=es2022 --outfile=dist/driggsby-sdk.js --log-level=warning",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "pretest": "npm run build",
+    "test": "node --test \"src/**/*.test.ts\""
+  },
+  "engines": {
+    "node": ">=18"
   }
 }