@every-app/sdk 0.2.0 → 0.3.0-rc.2

package/dist/server/tools.js

@@ -0,0 +1,347 @@
+/**
+ * `defineTools()` — agent tools an app offers to MCP clients through the
+ * Every App gateway.
+ *
+ *   export const tools = defineTools(
+ *     {
+ *       list_todos: {
+ *         description: "List the user's todos.",
+ *         risk: "read",
+ *         input: z.object({}).strict(),
+ *         handler: async (_input, { user }) => listTodos(user.id),
+ *       },
+ *     },
+ *     { instructions: "Never guess todo ids; call list_todos first." },
+ *   );
+ *   export default everyApp(handler, { tools });
+ *
+ * Apps never speak MCP. The gateway snapshots this catalog at deploy, serves
+ * MCP clients from the snapshot, and calls a tool over the internal tools
+ * contract (../internal/tools.ts) with a verified `chan: "mcp"` identity.
+ *
+ * `input` and `output` accept any validator implementing Standard Schema and
+ * Standard JSON Schema (zod >= 4.2 does both), or a plain
+ * `{ jsonSchema, validate }` pair. The SDK itself takes no dependency.
+ */
+import { TOOL_NAME_PATTERN, catalogHash, isToolRisk, } from "../internal/index.js";
+/** Reported with every catalog; must match package.json. */
+export const SDK_VERSION = "0.3.0";
+const JSON_SCHEMA_TARGET = "draft-2020-12";
+const DRAFT_2020_12 = "https://json-schema.org/draft/2020-12/schema";
+// The 2026-07-28 MCP revision lets a schema property ask clients to mirror an
+// argument into an HTTP header. Apps never route on headers, and the gateway
+// fronts many apps, so the hint is never passed on.
+const MCP_HEADER_KEYWORD = "x-mcp-header";
+/**
+ * Throw from a tool handler to return an error the model can read and act on
+ * ("No todo with that id"). Any other error is logged here and reaches the
+ * client only as "Internal error in <app> (ref <call id>)".
+ */
+export class ToolError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ToolError";
+    }
+}
+const TOOL_RESULT = Symbol.for("everyapp.toolResult");
+/**
+ * Return a written result and the same result as data. The model reads
+ * `text` (a summary, a table); clients also get `structured`, checked
+ * against the tool's `output` schema. Without this, a tool with an `output`
+ * schema sends its value as JSON text.
+ */
+export function toolResult(result) {
+    return {
+        [TOOL_RESULT]: true,
+        text: result.text,
+        structured: result.structured,
+    };
+}
+function isToolResult(value) {
+    return (isRecord(value) && value[TOOL_RESULT] === true);
+}
+const internals = new WeakMap();
+/** @internal The everyApp() side of a tool set. */
+export function toolSetInternals(toolSet) {
+    const found = internals.get(toolSet);
+    if (!found) {
+        throw new TypeError("tools must be the value returned by defineTools()");
+    }
+    return found;
+}
+/**
+ * Define an app's agent tools. Names are lowercase snake_case (at most 48
+ * characters); the gateway prefixes them with the app id where several apps
+ * share one MCP endpoint. Handler inputs are typed from each `input` schema.
+ */
+export function defineTools(tools, options = {}) {
+    const definitions = new Map();
+    for (const name of Object.keys(tools).sort()) {
+        const definition = tools[name];
+        assertToolDefinition(name, definition);
+        definitions.set(name, definition);
+    }
+    if (options.instructions !== undefined &&
+        typeof options.instructions !== "string") {
+        throw new TypeError("defineTools: instructions must be a string");
+    }
+    let catalog;
+    const toolSet = Object.freeze({
+        names: Object.freeze([...definitions.keys()]),
+    });
+    internals.set(toolSet, {
+        tool: (name) => definitions.get(name),
+        catalog: () => {
+            catalog ??= buildCatalog(definitions, options.instructions).catch((error) => {
+                catalog = undefined;
+                throw error;
+            });
+            return catalog;
+        },
+    });
+    return toolSet;
+}
+function assertToolDefinition(name, definition) {
+    const problem = (message) => new TypeError(`defineTools: tool "${name}" ${message}`);
+    if (!TOOL_NAME_PATTERN.test(name)) {
+        throw problem("must be named in lowercase snake_case: a letter, then letters, digits or _ (at most 48 characters)");
+    }
+    if (!definition || typeof definition !== "object") {
+        throw problem("must be an object");
+    }
+    if (typeof definition.description !== "string" ||
+        !definition.description.trim()) {
+        throw problem("needs a description");
+    }
+    if (!isToolRisk(definition.risk)) {
+        throw problem('needs a risk: "read", "write" or "destructive"');
+    }
+    if (!isToolSchema(definition.input)) {
+        throw problem("input must be a Standard Schema with JSON Schema support (zod >= 4.2) or { jsonSchema, validate }");
+    }
+    if (definition.output !== undefined && !isToolSchema(definition.output)) {
+        throw problem("output must be a Standard Schema with JSON Schema support (zod >= 4.2) or { jsonSchema, validate }");
+    }
+    if (typeof definition.handler !== "function") {
+        throw problem("needs a handler function");
+    }
+    if (definition.title !== undefined && typeof definition.title !== "string") {
+        throw problem("title must be a string");
+    }
+    for (const flag of ["idempotent", "openWorld"]) {
+        if (definition[flag] !== undefined &&
+            typeof definition[flag] !== "boolean") {
+            throw problem(`${flag} must be a boolean`);
+        }
+    }
+}
+function isRecord(value) {
+    return ((typeof value === "object" || typeof value === "function") && value !== null);
+}
+function isPlainToolSchema(value) {
+    return (isRecord(value) &&
+        !("~standard" in value) &&
+        isRecord(value.jsonSchema) &&
+        typeof value.validate === "function");
+}
+function isStandardWithJson(value) {
+    if (!isRecord(value))
+        return false;
+    const standard = value["~standard"];
+    if (!isRecord(standard) || typeof standard.validate !== "function") {
+        return false;
+    }
+    const converter = standard.jsonSchema;
+    return (isRecord(converter) &&
+        typeof converter.input === "function" &&
+        typeof converter.output === "function");
+}
+function isToolSchema(value) {
+    return isStandardWithJson(value) || isPlainToolSchema(value);
+}
+/**
+ * Describe every tool that can be described. A tool whose schema has no
+ * object JSON Schema form is left out with a warning (logged here, and
+ * reported to the gateway so the deploy prints it) instead of taking the
+ * app's other tools down with it.
+ */
+async function buildCatalog(definitions, instructions) {
+    const tools = [];
+    const warnings = [];
+    for (const [name, definition] of definitions) {
+        const described = describeTool(name, definition);
+        if (typeof described === "string") {
+            warnings.push(`${name}: skipped, ${described}`);
+            console.warn(`[everyapp] defineTools: tool "${name}" ${described}`);
+        }
+        else {
+            tools.push(described);
+        }
+    }
+    return {
+        ...(instructions !== undefined ? { instructions } : {}),
+        tools,
+        hash: await catalogHash({ instructions, tools }),
+        warnings,
+    };
+}
+/** A tool's descriptor, or why it can't be described. */
+function describeTool(name, definition) {
+    const inputSchema = objectJsonSchema(definition.input, "input");
+    if (typeof inputSchema === "string")
+        return inputSchema;
+    const outputSchema = definition.output
+        ? objectJsonSchema(definition.output, "output")
+        : undefined;
+    if (typeof outputSchema === "string")
+        return outputSchema;
+    const annotations = {
+        ...(definition.idempotent !== undefined
+            ? { idempotentHint: definition.idempotent }
+            : {}),
+        ...(definition.openWorld !== undefined
+            ? { openWorldHint: definition.openWorld }
+            : {}),
+    };
+    return {
+        name,
+        ...(definition.title ? { title: definition.title } : {}),
+        description: definition.description,
+        risk: definition.risk,
+        inputSchema,
+        ...(outputSchema ? { outputSchema } : {}),
+        ...(Object.keys(annotations).length > 0 ? { annotations } : {}),
+    };
+}
+/**
+ * The JSON Schema for one side of a tool: the arguments a client sends
+ * (`input`) or the result it receives (`output`), or why there is none.
+ *
+ * Both sides must describe objects. Unions of objects (zod's `union` and
+ * `discriminatedUnion`) come out as a root `anyOf`/`oneOf` without a `type`,
+ * so like the MCP SDK this adds `type: "object"` to a typeless input root
+ * (MCP arguments are always an object) and to a typeless output root whose
+ * every branch is an object.
+ */
+function objectJsonSchema(schema, side) {
+    let raw;
+    try {
+        raw = isPlainToolSchema(schema)
+            ? schema.jsonSchema
+            : schema["~standard"].jsonSchema[side]({ target: JSON_SCHEMA_TARGET });
+        // A JSON round trip copies the schema and drops anything JSON can't carry.
+        raw = JSON.parse(JSON.stringify(raw));
+    }
+    catch (error) {
+        return `${side} has no JSON Schema form: ${error.message}`;
+    }
+    if (!isRecord(raw) || Array.isArray(raw)) {
+        return `${side} has no JSON Schema form`;
+    }
+    const copy = withoutMcpHeaders(raw);
+    if (copy.$schema === DRAFT_2020_12)
+        delete copy.$schema;
+    if (copy.type === undefined &&
+        (side === "input" || isProvablyObjectShaped(copy))) {
+        return { type: "object", ...copy };
+    }
+    if (copy.type !== "object") {
+        return `${side} must describe an object (JSON Schema type "object")`;
+    }
+    return copy;
+}
+/**
+ * A typeless schema that can only match objects: it has object keywords, or
+ * every branch of its `oneOf`/`anyOf`/`allOf` is an object. `$ref` is not
+ * followed.
+ */
+function isProvablyObjectShaped(schema) {
+    if ([
+        "properties",
+        "patternProperties",
+        "additionalProperties",
+        "required",
+    ].some((keyword) => keyword in schema)) {
+        return true;
+    }
+    for (const keyword of ["oneOf", "anyOf", "allOf"]) {
+        const branches = schema[keyword];
+        if (Array.isArray(branches) && branches.length > 0) {
+            return branches.every((branch) => isRecord(branch) &&
+                (branch.type === "object" || isProvablyObjectShaped(branch)));
+        }
+    }
+    return false;
+}
+function withoutMcpHeaders(value) {
+    if (Array.isArray(value))
+        return value.map(withoutMcpHeaders);
+    if (!isRecord(value))
+        return value;
+    const out = {};
+    for (const [key, member] of Object.entries(value)) {
+        if (key !== MCP_HEADER_KEYWORD)
+            out[key] = withoutMcpHeaders(member);
+    }
+    return out;
+}
+/** Run a tool schema's validator. */
+export async function validateWithSchema(schema, value) {
+    const result = isPlainToolSchema(schema)
+        ? await schema.validate(value)
+        : await schema["~standard"].validate(value);
+    if (result.issues) {
+        return { ok: false, issues: result.issues.map(toIssue) };
+    }
+    return { ok: true, value: result.value };
+}
+function toIssue(issue) {
+    const path = (issue.path ?? [])
+        .map((segment) => typeof segment === "object" && segment !== null ? segment.key : segment)
+        .filter((key) => typeof key === "string" || typeof key === "number");
+    return {
+        message: String(issue.message),
+        ...(path.length > 0 ? { path } : {}),
+    };
+}
+/**
+ * Turn a handler's return value into a tool result. With an output schema,
+ * the value must validate and is sent as structured content as well as text.
+ */
+export async function toToolResult(definition, value) {
+    if (isToolResult(value)) {
+        const structured = definition.output
+            ? (await toToolResult(definition, value.structured)).structuredContent
+            : value.structured;
+        if (!isRecord(structured) || Array.isArray(structured)) {
+            throw new Error("structured results must be JSON objects");
+        }
+        return {
+            content: [{ type: "text", text: value.text }],
+            structuredContent: structured,
+        };
+    }
+    if (definition.output) {
+        const checked = await validateWithSchema(definition.output, value);
+        if (!checked.ok) {
+            throw new Error(`result does not match the output schema: ${checked.issues
+                .map((issue) => issue.message)
+                .join("; ")}`);
+        }
+        if (!isRecord(checked.value) ||
+            Array.isArray(checked.value) ||
+            typeof checked.value === "function") {
+            throw new Error("structured results must be JSON objects");
+        }
+        return {
+            content: [{ type: "text", text: JSON.stringify(checked.value) }],
+            structuredContent: checked.value,
+        };
+    }
+    if (typeof value === "string") {
+        return { content: [{ type: "text", text: value }] };
+    }
+    if (value === undefined)
+        return { content: [] };
+    return { content: [{ type: "text", text: JSON.stringify(value) }] };
+}

package/dist/server/toolsEndpoint.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The app side of the internal tools contract (../internal/tools.ts).
+ *
+ * `everyApp()` answers the two reserved paths here, before any app code runs
+ * and whether or not the app defines tools:
+ *
+ *  - `/__everyapp/tools/list` needs the gateway's system token for this app
+ *    (purpose "tools.list"). It describes tools; it never runs them.
+ *  - `/__everyapp/tools/call` needs an identity token minted for this exact
+ *    call: `chan: "mcp"` plus a `tc` claim naming the tool and call id. The
+ *    token's scopes must include the scope the tool's risk requires; `*` does
+ *    not count, because the ToolBus only ever mints explicit scopes.
+ *
+ * The perimeter also refuses these paths from outside and strips inbound
+ * `x-everyapp-*` headers, so only the gateway's ToolBus ever reaches them.
+ */
+import { type RequestIdentityOptions } from "../internal/index.js";
+import type { ExecutionContextLike } from "./everyApp.js";
+import { type ToolSet } from "./tools.js";
+export interface ToolsEndpointOptions {
+    toolSet?: ToolSet;
+    /** This app's id, for the masked-error label. */
+    appId: string;
+    /** How to verify gateway-minted tokens (keys, issuer, dev opt-in). */
+    identity: RequestIdentityOptions;
+}
+/**
+ * Answer a request to the reserved tools paths, or return null for any other
+ * path so the app's own handler runs.
+ */
+export declare function handleToolsRequest(request: Request, env: unknown, ctx: ExecutionContextLike, options: ToolsEndpointOptions): Promise<Response | null>;
+//# sourceMappingURL=toolsEndpoint.d.ts.map

package/dist/server/toolsEndpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolsEndpoint.d.ts","sourceRoot":"","sources":["../../src/server/toolsEndpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAcL,KAAK,sBAAsB,EAO5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAoFD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyB1B"}

package/dist/server/toolsEndpoint.js

@@ -0,0 +1,231 @@
+/**
+ * The app side of the internal tools contract (../internal/tools.ts).
+ *
+ * `everyApp()` answers the two reserved paths here, before any app code runs
+ * and whether or not the app defines tools:
+ *
+ *  - `/__everyapp/tools/list` needs the gateway's system token for this app
+ *    (purpose "tools.list"). It describes tools; it never runs them.
+ *  - `/__everyapp/tools/call` needs an identity token minted for this exact
+ *    call: `chan: "mcp"` plus a `tc` claim naming the tool and call id. The
+ *    token's scopes must include the scope the tool's risk requires; `*` does
+ *    not count, because the ToolBus only ever mints explicit scopes.
+ *
+ * The perimeter also refuses these paths from outside and strips inbound
+ * `x-everyapp-*` headers, so only the gateway's ToolBus ever reaches them.
+ */
+import { ConfigurationError, IDENTITY_HEADER, IdentityError, SYSTEM_HEADER, TOOLS_CALL_PATH, TOOLS_LIST_PATH, TOOLS_PROTOCOL_VERSION, catalogHash, requiredScopeForRisk, resolveVerifyOptions, verifyIdentityJwt, verifySystemJwt, } from "../internal/index.js";
+import { SDK_VERSION, ToolError, toToolResult, toolSetInternals, validateWithSchema, } from "./tools.js";
+function toolsJson(status, body, headers = {}) {
+    return Response.json(body, {
+        status,
+        headers: { "cache-control": "no-store", ...headers },
+    });
+}
+function toolsError(status, code, message, extra = {}) {
+    return toolsJson(status, {
+        v: TOOLS_PROTOCOL_VERSION,
+        error: {
+            code,
+            message,
+            ...(extra.issues ? { issues: extra.issues } : {}),
+        },
+    }, extra.headers);
+}
+async function readJsonBody(request) {
+    try {
+        return await request.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+function isPlainObject(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.getPrototypeOf(value) === Object.prototype);
+}
+let emptyCatalog;
+/**
+ * The app's catalog, or the contract's "misconfigured" answer when it can't
+ * be built at all, so the deploy shows the developer what to fix. (A single
+ * tool that can't be described is left out of the catalog with a warning.)
+ */
+async function catalogOrError(toolSet) {
+    try {
+        return await catalogFor(toolSet);
+    }
+    catch (error) {
+        console.error(error);
+        return toolsError(500, "misconfigured", error instanceof Error ? error.message : String(error));
+    }
+}
+function catalogFor(toolSet) {
+    if (toolSet)
+        return toolSetInternals(toolSet).catalog();
+    // An app without tools still answers the contract, with an empty catalog,
+    // so the gateway can tell "no tools" from "no contract".
+    emptyCatalog ??= catalogHash({ tools: [] }).then((hash) => ({
+        tools: [],
+        hash,
+        warnings: [],
+    }));
+    return emptyCatalog;
+}
+/**
+ * Answer a request to the reserved tools paths, or return null for any other
+ * path so the app's own handler runs.
+ */
+export async function handleToolsRequest(request, env, ctx, options) {
+    const { pathname } = new URL(request.url);
+    if (pathname !== TOOLS_LIST_PATH && pathname !== TOOLS_CALL_PATH) {
+        return null;
+    }
+    if (request.method !== "POST") {
+        return toolsError(405, "method_not_allowed", "Use POST.", {
+            headers: { allow: "POST" },
+        });
+    }
+    let verify;
+    try {
+        verify = resolveVerifyOptions(options.identity);
+    }
+    catch (error) {
+        if (error instanceof ConfigurationError) {
+            console.error(error);
+            return toolsError(500, "misconfigured", error.message);
+        }
+        throw error;
+    }
+    return pathname === TOOLS_LIST_PATH
+        ? listTools(request, verify, options)
+        : callTool(request, env, ctx, verify, options);
+}
+async function listTools(request, verify, options) {
+    try {
+        await verifySystemJwt(request.headers.get(SYSTEM_HEADER) ?? "", {
+            ...verify,
+            purpose: "tools.list",
+        });
+    }
+    catch (error) {
+        if (error instanceof IdentityError) {
+            return toolsError(401, "unauthenticated", error.message);
+        }
+        throw error;
+    }
+    const body = await readJsonBody(request);
+    if (!isPlainObject(body) || body.v !== TOOLS_PROTOCOL_VERSION) {
+        return toolsError(400, "invalid_request", `Expected {"v":${TOOLS_PROTOCOL_VERSION}}.`);
+    }
+    const catalog = await catalogOrError(options.toolSet);
+    if (catalog instanceof Response)
+        return catalog;
+    const response = {
+        v: TOOLS_PROTOCOL_VERSION,
+        sdk: SDK_VERSION,
+        hash: catalog.hash,
+        ...(catalog.instructions !== undefined
+            ? { instructions: catalog.instructions }
+            : {}),
+        tools: catalog.tools,
+        ...(catalog.warnings.length > 0 ? { warnings: catalog.warnings } : {}),
+    };
+    return toolsJson(200, response);
+}
+function parseCallRequest(body) {
+    if (!isPlainObject(body) || body.v !== TOOLS_PROTOCOL_VERSION)
+        return null;
+    const { name, callId } = body;
+    const args = body.arguments ?? {};
+    if (typeof name !== "string" || !name)
+        return null;
+    if (typeof callId !== "string" || !callId)
+        return null;
+    if (!isPlainObject(args))
+        return null;
+    return { v: TOOLS_PROTOCOL_VERSION, name, arguments: args, callId };
+}
+async function callTool(request, env, ctx, verify, options) {
+    let user;
+    try {
+        user = await verifyIdentityJwt(request.headers.get(IDENTITY_HEADER) ?? "", verify);
+    }
+    catch (error) {
+        if (error instanceof IdentityError) {
+            return toolsError(401, "unauthenticated", error.message);
+        }
+        throw error;
+    }
+    if (user.channel !== "mcp" || !user.toolCall) {
+        return toolsError(403, "forbidden", "Tool calls need an identity the gateway minted for this call.");
+    }
+    const call = parseCallRequest(await readJsonBody(request));
+    if (!call) {
+        return toolsError(400, "invalid_request", `Expected {"v":${TOOLS_PROTOCOL_VERSION},"name","arguments","callId"}.`);
+    }
+    if (call.name !== user.toolCall.name || call.callId !== user.toolCall.id) {
+        return toolsError(403, "forbidden", "The identity was minted for a different tool call.");
+    }
+    const tool = options.toolSet
+        ? toolSetInternals(options.toolSet).tool(call.name)
+        : undefined;
+    if (!tool) {
+        return toolsError(404, "unknown_tool", `Unknown tool: ${call.name}`);
+    }
+    const scope = requiredScopeForRisk(tool.risk);
+    if (!user.scopes.includes(scope)) {
+        return toolsError(403, "forbidden", `Calling ${call.name} needs the ${scope} scope.`);
+    }
+    const input = await validateWithSchema(tool.input, call.arguments);
+    if (!input.ok) {
+        return toolsError(400, "invalid_arguments", `Invalid arguments for ${call.name}: ${input.issues
+            .map((issue) => issue.path?.length
+            ? `${issue.path.join(".")}: ${issue.message}`
+            : issue.message)
+            .join("; ")}`, { issues: input.issues });
+    }
+    // The hash only lets the gateway notice a newer catalog: a catalog that
+    // can't be built is logged here, and doesn't stop this tool from running.
+    const hash = await catalogFor(options.toolSet).then((catalog) => catalog.hash, (error) => {
+        console.error(error);
+        return "";
+    });
+    let result;
+    try {
+        const value = await tool.handler(input.value, {
+            user,
+            env: env,
+            ctx,
+            request,
+            callId: call.callId,
+        });
+        result = await toToolResult(tool, value);
+    }
+    catch (error) {
+        if (error instanceof ToolError) {
+            result = {
+                content: [{ type: "text", text: error.message }],
+                isError: true,
+            };
+        }
+        else {
+            console.error(`[everyapp] tool "${call.name}" failed (ref ${call.callId}):`, error);
+            result = {
+                content: [
+                    {
+                        type: "text",
+                        text: `Internal error in ${options.appId} (ref ${call.callId})`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    }
+    return toolsJson(200, {
+        v: TOOLS_PROTOCOL_VERSION,
+        catalogHash: hash,
+        result,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@every-app/sdk",
-  "version": "0.2.0",
+  "version": "0.3.0-rc.2",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -11,29 +11,42 @@
     "./internal": {
       "types": "./dist/internal/index.d.ts",
       "default": "./dist/internal/index.js"
-    }
+    },
+    "./cloudflare": {
+      "types": "./dist/cloudflare/index.d.ts",
+      "default": "./dist/cloudflare/index.js"
+    },
+    "./cloudflare/sentinel": {
+      "types": "./dist/cloudflare/sentinel.d.ts",
+      "default": "./dist/cloudflare/sentinel.js"
+    },
+    "./dev": {
+      "types": "./dist/dev/index.d.ts",
+      "default": "./dist/dev/index.js"
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist",
     "README.md"
   ],
   "peerDependencies": {
-    "jose": "^6.0.0"
+    "jose": "^6.2.5"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20251014.0",
     "@types/node": "^22.18.13",
-    "jose": "^6.0.12",
+    "jose": "^6.2.12",
     "prettier": "^3.6.2",
     "typescript": "^5.9.3",
     "vite": "^7.1.2",
     "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^3.2.4"
+    "vitest": "^3.2.6",
+    "zod": "^4.2.0"
   },
   "scripts": {
     "prebuild": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
     "build": "tsc -p tsconfig.build.json",
-    "build:prepublish": "pnpm install --ignore-scripts && npm run types:check && npm run build",
     "types:check": "tsc --noEmit",
     "format:check": "prettier --check .",
     "format:write": "prettier . --write",