@hasna/tenants 0.1.0

package/dist/generated/storage-kit/tls.d.ts

@@ -0,0 +1,25 @@
+/** The `ssl` field shape accepted by `pg.Pool` / `pg.Client`. */
+export type PgSslConfig = boolean | {
+    rejectUnauthorized: boolean;
+    ca?: string;
+};
+export interface TlsResolveOptions {
+    /** Inline CA bundle (PEM). Wins over every other CA source. */
+    ca?: string;
+    /** Path to a CA bundle PEM file, e.g. the Amazon RDS global bundle. */
+    caCertPath?: string;
+    /** Environment used to discover PGSSLROOTCERT / NODE_EXTRA_CA_CERTS. */
+    env?: Record<string, string | undefined>;
+}
+export type SslMode = "disable" | "prefer" | "require" | "verify-ca" | "verify-full";
+/**
+ * Extract the effective `sslmode` from a Postgres connection string. Honors the
+ * `sslmode` query param and the legacy `ssl=true` boolean. Returns `disable`
+ * when TLS is not requested.
+ */
+export declare function sslModeFromConnectionString(connectionString: string): SslMode;
+/**
+ * Resolve the `pg` ssl config for a connection string. See the module header
+ * for the full mode table. Returns `undefined` when TLS should be off.
+ */
+export declare function resolveTlsConfig(connectionString: string, options?: TlsResolveOptions): PgSslConfig | undefined;

package/dist/idp/backfill.d.ts

@@ -0,0 +1,12 @@
+import type { TypedQueryClient } from "../generated/storage-kit/index.js";
+export interface BackfillResult {
+    tenantsSeeded: number;
+    apiKeysBackfilled: number;
+    usersGrandfatheredVerified: number;
+}
+/**
+ * Seed tenants + ensure a signing key + stamp legacy api_keys to the root tenant.
+ * @param client       live cloud Postgres client
+ * @param apiKeysTable the api_keys table name (from @hasna/contracts auth kit)
+ */
+export declare function seedAndBackfill(client: TypedQueryClient, apiKeysTable: string): Promise<BackfillResult>;

package/dist/idp/ids.d.ts

@@ -0,0 +1,24 @@
+/** RFC 4122 v5 (SHA-1) UUID from a name under a 16-byte namespace. */
+export declare function uuidv5(name: string, namespace: Buffer): string;
+/** Namespace for all hasna tenant ids: uuidv5(DNS, "hasna.xyz"). */
+export declare const HASNA_TENANT_NAMESPACE: string;
+/** Derive a stable tenant UUID from `tenant:<slug>:<kind>`. */
+export declare function deriveTenantId(slug: string, kind: string): string;
+/**
+ * The FIXED canonical root-tenant UUID (slug `hasna`, kind `root`) from the
+ * fleet auth/tenancy standard v2. Every app backfills pre-existing rows to this
+ * exact UUID. Verified in tests to equal the derived value.
+ */
+export declare const ROOT_TENANT_ID = "adfd95c7-ee8b-52cb-ae47-4ae65dae3313";
+export declare const ROOT_TENANT_SLUG = "hasna";
+export interface SeedTenant {
+    id: string;
+    slug: string;
+    name: string;
+    kind: string;
+    parentId: string | null;
+}
+/** The root tenant + its brand children, all with fixed derived UUIDs. */
+export declare const SEED_TENANTS: SeedTenant[];
+/** Fresh random v4 id (users, sessions, service principals, key ids). */
+export declare function newId(): string;

package/dist/idp/mailer.d.ts

@@ -0,0 +1,58 @@
+export interface ConfirmationEmail {
+    to: string;
+    code: string;
+    /** Fully-formed confirmation link (GET) for one-click confirm. */
+    link: string;
+    /** Minutes until the code/link expires (for the copy). */
+    expiresMinutes: number;
+    /** Why the code was issued (drives the subject/copy). Default `signup`. */
+    purpose?: "signup" | "login";
+}
+export interface SendResult {
+    messageId?: string;
+    skipped?: boolean;
+    reason?: string;
+}
+export interface Mailer {
+    sendConfirmation(input: ConfirmationEmail): Promise<SendResult>;
+}
+/** No-op mailer: used when email is disabled (local/dev). Never throws. */
+export declare class NoopMailer implements Mailer {
+    sendConfirmation(_input: ConfirmationEmail): Promise<SendResult>;
+}
+interface AwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+export interface SesMailerOptions {
+    region: string;
+    /** Envelope From, e.g. `Hasna Tenants <auth@tenants.hasna.xyz>`. */
+    from: string;
+    /** Cross-account identity ARN authorizing this sender. */
+    fromArn?: string;
+    /** Explicit credentials (else resolved from the AWS chain at send time). */
+    credentials?: AwsCredentials;
+}
+/** SES (SESv2) sender using raw SigV4 — zero third-party dependencies. */
+export declare class SesMailer implements Mailer {
+    private readonly options;
+    constructor(options: SesMailerOptions);
+    sendConfirmation(input: ConfirmationEmail): Promise<SendResult>;
+}
+export declare const MAIL_FROM_ENV = "HASNA_TENANTS_MAIL_FROM";
+export declare const MAIL_ENABLED_ENV = "HASNA_TENANTS_EMAIL_ENABLED";
+export declare const SES_REGION_ENV = "HASNA_TENANTS_SES_REGION";
+export declare const SES_FROM_ARN_ENV = "HASNA_TENANTS_SES_FROM_ARN";
+export declare const CONFIRM_URL_BASE_ENV = "HASNA_TENANTS_CONFIRM_URL_BASE";
+export declare const DEFAULT_MAIL_FROM = "Hasna Tenants <auth@tenants.hasna.xyz>";
+export declare const DEFAULT_CONFIRM_URL_BASE = "https://tenants.hasna.xyz";
+/** The public base URL used to build one-click confirmation links. */
+export declare function confirmUrlBaseFromEnv(env?: NodeJS.ProcessEnv): string;
+/**
+ * Build a mailer from the environment. Returns a NoopMailer unless
+ * `HASNA_TENANTS_EMAIL_ENABLED=1`, so email stays inert in local/dev until
+ * explicitly turned on in the deployed service.
+ */
+export declare function createMailerFromEnv(env?: NodeJS.ProcessEnv): Mailer;
+export {};

package/dist/idp/migrations.d.ts

@@ -0,0 +1,10 @@
+import { type Migration } from "../generated/storage-kit/index.js";
+export declare const TENANTS_TABLE = "tenants";
+export declare const USERS_TABLE = "users";
+export declare const SERVICE_PRINCIPALS_TABLE = "service_principals";
+export declare const MEMBERSHIPS_TABLE = "memberships";
+export declare const SESSIONS_TABLE = "sessions";
+export declare const AUTH_CHALLENGES_TABLE = "auth_challenges";
+export declare const JWT_SIGNING_KEYS_TABLE = "jwt_signing_keys";
+/** Ordered, additive tenancy/IdP migrations. */
+export declare function idpMigrations(apiKeysTable: string): Migration[];

package/dist/idp/passwords.d.ts

@@ -0,0 +1,4 @@
+export declare function hashPassword(password: string): string;
+export declare function verifyPassword(password: string, stored: string): boolean;
+/** sha256 hex — used for OTP codes and opaque session tokens at rest. */
+export declare function sha256(value: string): string;

package/dist/idp/policy.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Built-in default allowlist: the hasna-branded apex domains from the live
+ * domains portfolio (ACTIVE `hasna.<tld>`, snapshot 2026-07-13). `hasna.xyz` is
+ * guaranteed present. Refreshable from the domains API; overridable via env.
+ */
+export declare const DEFAULT_ALLOWED_EMAIL_DOMAINS: readonly string[];
+export declare const ALLOWED_EMAIL_DOMAINS_ENV = "HASNA_TENANTS_ALLOWED_EMAIL_DOMAINS";
+/** Extract the lowercased domain part of an email, or null when malformed. */
+export declare function emailDomain(email: string): string | null;
+export interface EmailPolicy {
+    /**
+     * Exact-match allowlist of permitted email domains. `null` DISABLES the check
+     * (allow any) — used only by tests/local; production always sets a Set.
+     */
+    allowedDomains: Set<string> | null;
+    /** Require email confirmation before a session/token is minted. */
+    requireConfirmation: boolean;
+}
+/**
+ * Build the email policy from the environment.
+ * - `HASNA_TENANTS_ALLOWED_EMAIL_DOMAINS` (comma list) overrides the default.
+ * - `HASNA_TENANTS_DISABLE_EMAIL_ALLOWLIST=1` fully disables it (escape hatch).
+ * - `HASNA_TENANTS_REQUIRE_EMAIL_CONFIRMATION=0` disables confirmation gating.
+ */
+export declare function emailPolicyFromEnv(env?: NodeJS.ProcessEnv): EmailPolicy;
+/** True when `email`'s domain is permitted by the policy (or the policy is off). */
+export declare function isEmailDomainAllowed(email: string, policy: EmailPolicy): boolean;

package/dist/idp/service.d.ts

@@ -0,0 +1,103 @@
+import { type ApiKeyStore } from "@hasna/contracts/auth";
+import type { IdpStoreApi } from "./store.js";
+import { type JwksDocument } from "./tokens.js";
+import { type EmailPolicy } from "./policy.js";
+import { type Mailer } from "./mailer.js";
+export declare const SESSION_TTL_SECONDS: number;
+export declare const OTP_TTL_SECONDS: number;
+export declare const OTP_MAX_ATTEMPTS = 5;
+/**
+ * App slugs the IdP will mint fleet tokens for. `tenants` is this service's own
+ * app; the rest are the fleet apps that accept tenants-issued EdDSA tokens
+ * (verified offline via the published JWKS). `identities` (the SEPARATE agent
+ * registry) is listed as a token AUDIENCE only — this is a cross-service token
+ * grant, not a code dependency on that package.
+ */
+export declare const FLEET_APPS: string[];
+/** This service's own app slug (the only app whose HMAC secret it holds). */
+export declare const SELF_APP = "tenants";
+export declare class AuthError extends Error {
+    status: number;
+    code?: string | undefined;
+    details?: Record<string, unknown> | undefined;
+    constructor(status: number, message: string, code?: string | undefined, details?: Record<string, unknown> | undefined);
+}
+export interface AuthServiceOptions {
+    store: IdpStoreApi;
+    /** This service's own HMAC signing secret (mints self-app v1 keys only). */
+    signingSecret: string;
+    apiKeysTable: string;
+    /** Persists issued v1 HMAC keys (for the self-app token path). */
+    apiKeys?: ApiKeyStore;
+    /** Echo OTP codes in responses (DEV ONLY; never in prod). */
+    otpEcho?: boolean;
+    /** Login front-door policy (email allowlist + confirmation gate). */
+    emailPolicy?: EmailPolicy;
+    /** Sends confirmation / login codes (SES). Defaults to a no-op. */
+    mailer?: Mailer;
+    /** Public base URL for one-click confirmation links. */
+    confirmUrlBase?: string;
+    nowMs?: () => number;
+}
+export interface PrincipalSummary {
+    user_id: string;
+    kind: string;
+    email: string | null;
+    display_name: string | null;
+}
+export interface TenantMembershipSummary {
+    tenant_id: string;
+    role: string;
+}
+export declare class AuthService {
+    private readonly store;
+    private readonly signingSecret;
+    private readonly apiKeysTable;
+    private readonly apiKeys;
+    private readonly otpEcho;
+    private readonly emailPolicy;
+    private readonly mailer;
+    private readonly confirmUrlBase;
+    private readonly now;
+    constructor(options: AuthServiceOptions);
+    /** Reject any email whose domain is not on the (config-driven) allowlist. */
+    private assertEmailAllowed;
+    jwks(): Promise<JwksDocument>;
+    signup(input: {
+        email?: string;
+        name?: string;
+        kind?: string;
+        org_name?: string;
+        password?: string;
+        ip?: string | null;
+        userAgent?: string | null;
+    }): Promise<Record<string, unknown>>;
+    login(input: {
+        email?: string;
+        password?: string;
+        ip?: string | null;
+        userAgent?: string | null;
+    }): Promise<Record<string, unknown>>;
+    resend(input: {
+        email?: string;
+    }): Promise<Record<string, unknown>>;
+    verify(input: {
+        email?: string;
+        code?: string;
+        ip?: string | null;
+        userAgent?: string | null;
+    }): Promise<Record<string, unknown>>;
+    token(input: {
+        sessionToken: string;
+        app?: string;
+        scopes?: string[];
+        tenant_id?: string;
+        ttlSeconds?: number;
+    }): Promise<Record<string, unknown>>;
+    whoami(sessionToken: string): Promise<Record<string, unknown>>;
+    introspect(kid: string): Promise<Record<string, unknown>>;
+    private principalSummary;
+    private startChallenge;
+    private issueSession;
+    private resolveSession;
+}

package/dist/idp/store.d.ts

@@ -0,0 +1,205 @@
+import type { TypedQueryClient } from "../generated/storage-kit/index.js";
+import { type JwkPublic, type SigningKey } from "./tokens.js";
+export declare const JWT_SIGNING_KEY_ENV = "HASNA_TENANTS_JWT_SIGNING_KEY";
+export declare const JWT_KID_ENV = "HASNA_TENANTS_JWT_KID";
+export interface TenantRow {
+    id: string;
+    slug: string;
+    name: string;
+    kind: string;
+    parent_id: string | null;
+    status: string;
+    identity_id: string | null;
+}
+export interface UserRow {
+    id: string;
+    kind: string;
+    email: string | null;
+    display_name: string | null;
+    identity_id: string | null;
+    home_tenant_id: string | null;
+    auth_method: string | null;
+    password_hash: string | null;
+    status: string;
+    email_verified_at: string | null;
+}
+export interface MembershipRow {
+    id: string;
+    tenant_id: string;
+    principal_id: string;
+    principal_type: string;
+    role: string;
+    scopes: unknown;
+    status: string;
+}
+export interface SessionRow {
+    id: string;
+    user_id: string | null;
+    tenant_id: string | null;
+    token_hash: string;
+    method: string | null;
+    issued_at: string;
+    expires_at: string | null;
+    revoked_at: string | null;
+}
+export interface SigningKeyRow {
+    kid: string;
+    alg: string;
+    public_jwk: unknown;
+    private_jwk: unknown;
+    status: string;
+}
+/** The subset of IdpStore the AuthService depends on (enables fakes in tests). */
+export interface IdpStoreApi {
+    listPublicJwks(): Promise<JwkPublic[]>;
+    getSigningKeyForMinting(): Promise<SigningKey>;
+    getTenantBySlug(slug: string): Promise<TenantRow | null>;
+    createTenant(input: {
+        slug: string;
+        name: string;
+        kind?: string;
+        parentId?: string | null;
+    }): Promise<TenantRow>;
+    getUserByEmail(email: string): Promise<UserRow | null>;
+    getUserById(id: string): Promise<UserRow | null>;
+    markEmailVerified(userId: string): Promise<void>;
+    createUser(input: {
+        kind: string;
+        email?: string | null;
+        displayName?: string | null;
+        identityId?: string | null;
+        homeTenantId: string;
+        authMethod?: string | null;
+        passwordHash?: string | null;
+    }): Promise<UserRow>;
+    createMembership(input: {
+        tenantId: string;
+        principalId: string;
+        principalType: "user" | "service";
+        role: string;
+        scopes?: string[];
+    }): Promise<void>;
+    listMembershipsForPrincipal(principalId: string, principalType: "user" | "service"): Promise<MembershipRow[]>;
+    createSession(input: {
+        userId: string;
+        tenantId: string;
+        tokenHash: string;
+        method?: string;
+        expiresAt: Date;
+        ip?: string | null;
+        userAgent?: string | null;
+    }): Promise<string>;
+    getSessionByTokenHash(tokenHash: string): Promise<SessionRow | null>;
+    createChallenge(input: {
+        email: string;
+        codeHash: string;
+        purpose: string;
+        expiresAt: Date;
+    }): Promise<string>;
+    findActiveChallenge(email: string, purpose: string): Promise<{
+        id: string;
+        code_hash: string;
+        attempts: number;
+    } | null>;
+    consumeChallenge(id: string): Promise<void>;
+    bumpChallengeAttempts(id: string): Promise<void>;
+    recordApiKeyBinding(apiKeysTable: string, input: {
+        kid: string;
+        tenantId: string;
+        userId: string | null;
+        principalType: "user" | "service";
+    }): Promise<void>;
+    lookupApiKeyBinding(apiKeysTable: string, kid: string): Promise<{
+        tenant_id: string | null;
+        user_id: string | null;
+        principal_type: string | null;
+    } | null>;
+}
+export declare class IdpStore implements IdpStoreApi {
+    private readonly client;
+    constructor(client: TypedQueryClient);
+    /** Env-injected signing key (Secrets Manager path), or null. */
+    loadEnvSigningKey(env?: NodeJS.ProcessEnv): SigningKey | null;
+    /** The active DB signing key, generating + persisting one if none exists. */
+    getOrCreateActiveDbKey(): Promise<SigningKey>;
+    /** The key used to MINT new tokens (env wins, else the active DB key). */
+    getSigningKeyForMinting(): Promise<SigningKey>;
+    /** All public JWKs to publish/verify against (env + every active DB key). */
+    listPublicJwks(): Promise<JwkPublic[]>;
+    /** Idempotently seed the root tenant + brand children (fixed UUIDs). */
+    seedTenants(): Promise<void>;
+    getTenantById(id: string): Promise<TenantRow | null>;
+    getTenantBySlug(slug: string): Promise<TenantRow | null>;
+    createTenant(input: {
+        slug: string;
+        name: string;
+        kind?: string;
+        parentId?: string | null;
+    }): Promise<TenantRow>;
+    getUserByEmail(email: string): Promise<UserRow | null>;
+    getUserById(id: string): Promise<UserRow | null>;
+    /** Mark a user's email confirmed (idempotent; only stamps the first time). */
+    markEmailVerified(userId: string): Promise<void>;
+    createUser(input: {
+        kind: string;
+        email?: string | null;
+        displayName?: string | null;
+        identityId?: string | null;
+        homeTenantId: string;
+        authMethod?: string | null;
+        passwordHash?: string | null;
+    }): Promise<UserRow>;
+    setUserPassword(id: string, passwordHash: string): Promise<void>;
+    createMembership(input: {
+        tenantId: string;
+        principalId: string;
+        principalType: "user" | "service";
+        role: string;
+        scopes?: string[];
+    }): Promise<void>;
+    listMembershipsForPrincipal(principalId: string, principalType: "user" | "service"): Promise<MembershipRow[]>;
+    createServicePrincipal(input: {
+        id?: string;
+        tenantId: string;
+        kind?: string;
+        displayName?: string | null;
+        identityId?: string | null;
+    }): Promise<string>;
+    createSession(input: {
+        userId: string;
+        tenantId: string;
+        tokenHash: string;
+        method?: string;
+        expiresAt: Date;
+        ip?: string | null;
+        userAgent?: string | null;
+    }): Promise<string>;
+    getSessionByTokenHash(tokenHash: string): Promise<SessionRow | null>;
+    revokeSession(tokenHash: string): Promise<void>;
+    createChallenge(input: {
+        email: string;
+        codeHash: string;
+        purpose: string;
+        expiresAt: Date;
+    }): Promise<string>;
+    findActiveChallenge(email: string, purpose: string): Promise<{
+        id: string;
+        code_hash: string;
+        attempts: number;
+    } | null>;
+    consumeChallenge(id: string): Promise<void>;
+    bumpChallengeAttempts(id: string): Promise<void>;
+    /** Record an issued v1 HMAC key's tenant/user/principal binding at mint time. */
+    recordApiKeyBinding(apiKeysTable: string, input: {
+        kid: string;
+        tenantId: string;
+        userId: string | null;
+        principalType: "user" | "service";
+    }): Promise<void>;
+    /** Resolve a kid to its tenant binding (bridge lookup for v1 tokens). */
+    lookupApiKeyBinding(apiKeysTable: string, kid: string): Promise<{
+        tenant_id: string | null;
+        user_id: string | null;
+        principal_type: string | null;
+    } | null>;
+}

package/dist/idp/tokens.d.ts

@@ -0,0 +1,89 @@
+import { type KeyObject } from "node:crypto";
+export declare const TOKEN_TYPE = "at+jwt";
+export declare const TOKEN_ALG = "EdDSA";
+/**
+ * Fixed fleet issuer string embedded in every access token's `iss` claim and
+ * enforced on verify. This is a cross-fleet WIRE CONTRACT value pinned by all
+ * verifying apps — not a dependency on the @hasna/identities agent registry.
+ * Changing it requires a coordinated fleet-wide rollout.
+ */
+export declare const TOKEN_ISSUER = "identities";
+/** Default access-token TTL (24h) per standard §1.3 (v2 access tokens ≤24h). */
+export declare const DEFAULT_ACCESS_TOKEN_TTL_SECONDS: number;
+export interface AccessTokenClaims {
+    /** Issuer — the fixed fleet issuer string (see TOKEN_ISSUER). */
+    iss: string;
+    /** Audience — the app slug the token is for. */
+    aud: string;
+    /** Subject — principal id (users.id or service_principals.id). */
+    sub: string;
+    /** Tenant UUID (the isolation boundary). */
+    tid: string;
+    /** Principal type: user | service. */
+    pt: "user" | "service";
+    /** Granted scopes (`<app>:<action>` / `<app>:*` / `*`). */
+    scope: string[];
+    /** Issued-at, epoch seconds. */
+    iat: number;
+    /** Expiry, epoch seconds. */
+    exp: number;
+    /** Token id (revocation / audit). */
+    jti: string;
+}
+export interface JwkPublic {
+    kty: "OKP";
+    crv: "Ed25519";
+    x: string;
+    kid: string;
+    use: "sig";
+    alg: "EdDSA";
+}
+export interface JwksDocument {
+    keys: JwkPublic[];
+}
+/** A resolved signing key: private KeyObject + published public JWK + kid. */
+export interface SigningKey {
+    kid: string;
+    privateKey: KeyObject;
+    publicJwk: JwkPublic;
+}
+/** Build a SigningKey from a private Ed25519 JWK (as stored / injected). */
+export declare function signingKeyFromPrivateJwk(kid: string, privateJwk: Record<string, unknown>): SigningKey;
+/** Assemble a JWKS document from one or more public JWKs. */
+export declare function buildJwks(publicJwks: JwkPublic[]): JwksDocument;
+export interface SignAccessTokenInput {
+    aud: string;
+    sub: string;
+    tid: string;
+    pt: "user" | "service";
+    scope: string[];
+    ttlSeconds?: number;
+    jti: string;
+    nowMs?: number;
+}
+/** Mint a signed EdDSA access token. */
+export declare function signAccessToken(key: SigningKey, input: SignAccessTokenInput): {
+    token: string;
+    claims: AccessTokenClaims;
+};
+export type VerifyAccessTokenResult = {
+    ok: true;
+    claims: AccessTokenClaims;
+    kid: string;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface VerifyAccessTokenOptions {
+    /** Public JWKs to verify against (from a JWKS fetch / local key set). */
+    jwks: JwkPublic[];
+    /** Expected audience (this app slug). Enforced when set. */
+    expectedAudience?: string;
+    /** Clock-skew leeway in seconds. Default 0. */
+    leewaySeconds?: number;
+    nowMs?: number;
+}
+/** Fully verify an EdDSA access token: signature, issuer, audience, expiry. */
+export declare function verifyAccessToken(token: string, options: VerifyAccessTokenOptions): VerifyAccessTokenResult;
+/** Structural parse (no signature check) — used to route v1 HMAC vs v2 JWS. */
+export declare function looksLikeAccessToken(token: string): boolean;

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+export * from "./idp/service.js";
+export * from "./idp/store.js";
+export * from "./idp/tokens.js";
+export * from "./idp/ids.js";
+export * from "./idp/passwords.js";
+export * from "./idp/policy.js";
+export * from "./idp/mailer.js";
+export * from "./idp/backfill.js";
+export * from "./idp/migrations.js";
+export { API_KEYS_TABLE, tenantsMigrations } from "./migrations.js";
+export { TENANTS_APP_NAME, createCloudClient, runTenantsMigrations, cloudHealth, cloudReady, } from "./db.js";
+export type { TenantsCloud } from "./db.js";
+export type { TypedQueryClient, PoolQueryClient } from "./generated/storage-kit/index.js";
+export { buildOpenApiDocument } from "./server/openapi.js";
+export type { TenantsOpenApiDocument } from "./server/openapi.js";
+export { TENANTS_SERVE_APP, buildHandler, createFetchHandler, startServer, } from "./server/serve.js";
+export type { ServeOptions, RunningServer } from "./server/serve.js";
+export { getPackageVersion } from "./version.js";