@homurajs/auth 26.10.14 → 26.10.15

package/dist/tables.js

@@ -1,17 +1,27 @@
 import { pgCol, pgTable, sqliteCol, sqliteTable } from "@homurajs/db/schema-helpers";
-import { index } from "drizzle-orm/pg-core";
-import { index as index$1 } from "drizzle-orm/sqlite-core";
+import { index, uniqueIndex } from "drizzle-orm/pg-core";
+import { index as index$1, uniqueIndex as uniqueIndex$1 } from "drizzle-orm/sqlite-core";
 //#region src/tables.ts
 /**
 * 双方言 auth 表定义：App 把 pgAuthTables/sqliteAuthTables spread 进
-* 自己的 schema 参与迁移（refresh_tokens 表）。
+* 自己的 schema 参与迁移。
 *
-* ⚠ 列名显式 snake_case，必须与 session/store.ts 的原生 SQL 严格对齐
-*   （token_hash/family_id/sid/sub/expires_at/used_at/profile）。
+* 包含五张表：
+* - `refresh_tokens`：session refresh token（rotate + family 吊销）
+* - `users`：本地身份锚点（密码/WebAuthn/OAuth2 共享）
+* - `passwords`：密码凭证（1:1 users）
+* - `oauth2_identity_links`：OAuth2 身份关联（1:N users）
+* - `webauthn_credentials`：WebAuthn 凭证（1:N users）
+*
+* ⚠ 列名显式 snake_case，必须与各 store 的原生 SQL / PostgREST 列名严格对齐。
 *   parity 测试只比对 pg↔sqlite 两侧一致，测不出与原生 SQL 的偏差——
-*   改列名务必同步 store.ts，并以 drizzle-kit generate 的产物为准复核。
+*   改列名务必同步 store 实现，并以 drizzle-kit generate 的产物为准复核。
 */
-const pgAuthTables = { refreshTokens: pgTable("refresh_tokens", {
+const USERS_TABLE = "users";
+const PASSWORDS_TABLE = "passwords";
+const OAUTH2_IDENTITY_LINKS_TABLE = "oauth2_identity_links";
+const WEBAUTHN_CREDENTIALS_TABLE = "webauthn_credentials";
+const pgRefreshTokens = pgTable("refresh_tokens", {
 	tokenHash: pgCol.text("token_hash").primaryKey(),
 	familyId: pgCol.text("family_id").notNull(),
 	sid: pgCol.text("sid").notNull(),
@@ -19,8 +29,8 @@ const pgAuthTables = { refreshTokens: pgTable("refresh_tokens", {
 	expiresAt: pgCol.epochMs("expires_at").notNull(),
 	usedAt: pgCol.epochMs("used_at"),
 	profile: pgCol.text("profile")
-}, (t) => [index("refresh_tokens_family_idx").on(t.familyId), index("refresh_tokens_sub_idx").on(t.sub)]) };
-const sqliteAuthTables = { refreshTokens: sqliteTable("refresh_tokens", {
+}, (t) => [index("refresh_tokens_family_idx").on(t.familyId), index("refresh_tokens_sub_idx").on(t.sub)]);
+const sqliteRefreshTokens = sqliteTable("refresh_tokens", {
 	tokenHash: sqliteCol.text("token_hash").primaryKey(),
 	familyId: sqliteCol.text("family_id").notNull(),
 	sid: sqliteCol.text("sid").notNull(),
@@ -28,6 +38,86 @@ const sqliteAuthTables = { refreshTokens: sqliteTable("refresh_tokens", {
 	expiresAt: sqliteCol.epochMs("expires_at").notNull(),
 	usedAt: sqliteCol.epochMs("used_at"),
 	profile: sqliteCol.text("profile")
-}, (t) => [index$1("refresh_tokens_family_idx").on(t.familyId), index$1("refresh_tokens_sub_idx").on(t.sub)]) };
+}, (t) => [index$1("refresh_tokens_family_idx").on(t.familyId), index$1("refresh_tokens_sub_idx").on(t.sub)]);
+const pgUsers = pgTable(USERS_TABLE, {
+	id: pgCol.id("id"),
+	username: pgCol.text("username"),
+	nickname: pgCol.text("nickname"),
+	avatarUrl: pgCol.text("avatar_url"),
+	createdAt: pgCol.epochMs("created_at").notNull(),
+	updatedAt: pgCol.epochMs("updated_at").notNull()
+}, (t) => [uniqueIndex("users_username_uidx").on(t.username)]);
+const sqliteUsers = sqliteTable(USERS_TABLE, {
+	id: sqliteCol.id("id"),
+	username: sqliteCol.text("username"),
+	nickname: sqliteCol.text("nickname"),
+	avatarUrl: sqliteCol.text("avatar_url"),
+	createdAt: sqliteCol.epochMs("created_at").notNull(),
+	updatedAt: sqliteCol.epochMs("updated_at").notNull()
+}, (t) => [uniqueIndex$1("users_username_uidx").on(t.username)]);
+const pgPasswords = pgTable(PASSWORDS_TABLE, {
+	userId: pgCol.text("user_id").primaryKey(),
+	passwordHash: pgCol.text("password_hash").notNull(),
+	createdAt: pgCol.epochMs("created_at").notNull(),
+	updatedAt: pgCol.epochMs("updated_at").notNull()
+});
+const sqlitePasswords = sqliteTable(PASSWORDS_TABLE, {
+	userId: sqliteCol.text("user_id").primaryKey(),
+	passwordHash: sqliteCol.text("password_hash").notNull(),
+	createdAt: sqliteCol.epochMs("created_at").notNull(),
+	updatedAt: sqliteCol.epochMs("updated_at").notNull()
+});
+const pgOAuth2IdentityLinks = pgTable(OAUTH2_IDENTITY_LINKS_TABLE, {
+	id: pgCol.id("id"),
+	userId: pgCol.text("user_id").notNull(),
+	provider: pgCol.text("provider").notNull(),
+	providerSub: pgCol.text("provider_sub").notNull(),
+	rawProfile: pgCol.text("raw_profile"),
+	createdAt: pgCol.epochMs("created_at").notNull()
+}, (t) => [index("oauth2_links_user_idx").on(t.userId), uniqueIndex("oauth2_links_provider_sub_uidx").on(t.provider, t.providerSub)]);
+const sqliteOAuth2IdentityLinks = sqliteTable(OAUTH2_IDENTITY_LINKS_TABLE, {
+	id: sqliteCol.id("id"),
+	userId: sqliteCol.text("user_id").notNull(),
+	provider: sqliteCol.text("provider").notNull(),
+	providerSub: sqliteCol.text("provider_sub").notNull(),
+	rawProfile: sqliteCol.text("raw_profile"),
+	createdAt: sqliteCol.epochMs("created_at").notNull()
+}, (t) => [index$1("oauth2_links_user_idx").on(t.userId), uniqueIndex$1("oauth2_links_provider_sub_uidx").on(t.provider, t.providerSub)]);
+const pgWebauthnCredentials = pgTable(WEBAUTHN_CREDENTIALS_TABLE, {
+	id: pgCol.text("id").primaryKey(),
+	userId: pgCol.text("user_id").notNull(),
+	publicKey: pgCol.text("public_key").notNull(),
+	counter: pgCol.int("counter").notNull(),
+	deviceType: pgCol.text("device_type").notNull(),
+	backedUp: pgCol.int("backed_up").notNull(),
+	transports: pgCol.text("transports"),
+	displayName: pgCol.text("display_name"),
+	createdAt: pgCol.epochMs("created_at").notNull()
+}, (t) => [index("webauthn_creds_user_idx").on(t.userId)]);
+const sqliteWebauthnCredentials = sqliteTable(WEBAUTHN_CREDENTIALS_TABLE, {
+	id: sqliteCol.text("id").primaryKey(),
+	userId: sqliteCol.text("user_id").notNull(),
+	publicKey: sqliteCol.text("public_key").notNull(),
+	counter: sqliteCol.int("counter").notNull(),
+	deviceType: sqliteCol.text("device_type").notNull(),
+	backedUp: sqliteCol.int("backed_up").notNull(),
+	transports: sqliteCol.text("transports"),
+	displayName: sqliteCol.text("display_name"),
+	createdAt: sqliteCol.epochMs("created_at").notNull()
+}, (t) => [index$1("webauthn_creds_user_idx").on(t.userId)]);
+const pgAuthTables = {
+	refreshTokens: pgRefreshTokens,
+	users: pgUsers,
+	passwords: pgPasswords,
+	oauth2IdentityLinks: pgOAuth2IdentityLinks,
+	webauthnCredentials: pgWebauthnCredentials
+};
+const sqliteAuthTables = {
+	refreshTokens: sqliteRefreshTokens,
+	users: sqliteUsers,
+	passwords: sqlitePasswords,
+	oauth2IdentityLinks: sqliteOAuth2IdentityLinks,
+	webauthnCredentials: sqliteWebauthnCredentials
+};
 //#endregion
-export { pgAuthTables, sqliteAuthTables };
+export { OAUTH2_IDENTITY_LINKS_TABLE, PASSWORDS_TABLE, USERS_TABLE, WEBAUTHN_CREDENTIALS_TABLE, pgAuthTables, sqliteAuthTables };

package/dist/{manager-_5q5sluE.d.ts → types-C-SlEMFJ.d.ts}

@@ -1,4 +1,3 @@
-import { TtlKv } from "@homurajs/core";
 import { NodeSQLiteDatabase } from "drizzle-orm/node-sqlite";
 import { PostgresJsDatabase } from "drizzle-orm/postgres-js";
 //#region src/types.d.ts
@@ -30,53 +29,6 @@ interface TokenResponse {
   expires_in?: number;
 }
 //#endregion
-//#region src/oauth2/client.d.ts
-interface OAuth2ClientConfig {
-  clientId: string;
-  clientSecret: string;
-  redirectUri: string;
-  scopes?: string[];
-  endpoints: OAuth2Endpoints;
-  /** 上游原始 userinfo → 规范身份（预设来自 @homurajs/3p/*） */
-  mapUser: (raw: unknown) => AuthUser;
-  /** state 存储（core 的内存或 db 实现），TTL 5min 一次性消费 */
-  stateKv: TtlKv;
-  /** 测试注入口；全程不 mock 全局 fetch */
-  fetchImpl?: typeof fetch;
-  authorizeExtraParams?: Record<string, string>;
-  /** dev 显式 opt-in 才允许无 state（修复 Suzuran 的 Redis 缺失放行后门） */
-  allowNoState?: boolean;
-  /** state TTL（默认 5min） */
-  stateTtlMs?: number;
-}
-/**
- * 通用标准 OAuth2 (Authorization Code Flow) 客户端。
- * 服务端（如 ../oauth2-dingtalk）由 3p 预设注入，本类不感知具体 IdP。
- */
-declare class OAuth2Client {
-  private config;
-  private fetchImpl;
-  private stateTtl;
-  constructor(config: OAuth2ClientConfig);
-  /** 生成 authorize URL（state 入 kv），returnTo 编码进 state 关联存储 */
-  authorizeUrl(returnTo?: string): Promise<string>;
-  /**
-   * 回调：state 一次性消费校验 → code 换 token → 拉 userinfo → mapUser
-   * 返回 { user, returnTo }，供 hono 路由建 session 后跳转
-   */
-  callback(params: {
-    code: string;
-    state?: string;
-  }): Promise<{
-    user: AuthUser;
-    returnTo: string;
-  }>;
-  /** 内部：code 换 token（POST tokenUrl，form 编码） */
-  protected exchangeToken(code: string): Promise<TokenResponse>;
-  /** 内部：Bearer 拉 userinfo */
-  protected fetchUserinfo(accessToken: string): Promise<unknown>;
-}
-//#endregion
 //#region src/session/record.d.ts
 /** refresh_tokens 表记录（store 实现与迁移共用）；时间用 epoch 毫秒（原生 SQL 双方言一致） */
 interface RefreshTokenRecord {
@@ -173,4 +125,89 @@ declare class SessionManager {
   private issueRefresh;
 }
 //#endregion
-export { RefreshTokenStore as a, RefreshTokenRecord as c, AuthUser as d, OAuth2Endpoints as f, SessionTokens as i, OAuth2Client as l, SessionManager as n, createDrizzleSessionStore as o, TokenResponse as p, SessionManagerConfig as r, ConsumedToken as s, SessionClaims as t, OAuth2ClientConfig as u };
+//#region src/identity/types.d.ts
+/**
+ * 本地身份模型核心类型。
+ *
+ * - `users` 表是身份锚点：三类凭证（TextPassword / WebAuthn / OAuth2 identity link）
+ *   都指向它，session 的 sub 也是 local user.id（不再是 IdP subject）。
+ * - OAuth2-only 用户的 username 可为 null（没有密码登录能力）。
+ */
+/** 本地用户（users 表行） */
+interface LocalUser {
+  id: string;
+  username: string | null;
+  nickname: string | null;
+  avatarUrl: string | null;
+  createdAt: number;
+  updatedAt: number;
+}
+/** OAuth2 身份关联（oauth2_identity_links 表行） */
+interface IdentityLink {
+  id: string;
+  userId: string;
+  provider: string;
+  providerSub: string;
+  rawProfile: string | null;
+  createdAt: number;
+}
+/** WebAuthn 凭证（webauthn_credentials 表行） */
+interface WebauthnCredentialRecord {
+  id: string;
+  userId: string;
+  publicKey: string;
+  counter: number;
+  deviceType: string;
+  backedUp: number;
+  transports: string | null;
+  displayName: string | null;
+  createdAt: number;
+}
+/**
+ * 用户仓储：三类凭证 + identity resolver 共用。
+ * Drizzle 双方言与 PostgREST 两版实现共享此接口。
+ */
+interface UserStore {
+  /** 按 id 查用户；不存在返回 null */
+  findById(id: string): Promise<LocalUser | null>;
+  /** 按 username 查用户（精确匹配）；不存在返回 null */
+  findByUsername(username: string): Promise<LocalUser | null>;
+  /** 创建用户；username 重复抛唯一约束冲突 */
+  create(input: {
+    username?: string | null;
+    nickname?: string | null;
+    avatarUrl?: string | null;
+  }): Promise<LocalUser>;
+  /** 更新 nickname/avatarUrl（部分更新，不传字段不动） */
+  update(id: string, patch: {
+    nickname?: string;
+    avatarUrl?: string;
+  }): Promise<LocalUser>;
+  /**
+   * 删除用户（按 id）。用于注册失败时清理孤儿 user（见 PasswordProvider.register）。
+   * ⚠ 不级联删除凭证记录（passwords/oauth2_identity_links/webauthn_credentials）——
+   *   调用方自行保证只在「刚建、尚无凭证」的 user 上调用，或先清凭证再删 user。
+   */
+  delete(id: string): Promise<void>;
+}
+/**
+ * OAuth2 身份关联仓储。
+ * 用于 identity resolver 在 callback 时查 link → 找 user，或 JIT 建户时创建 link。
+ */
+interface OAuth2LinkStore {
+  /** 按 (provider, providerSub) 查关联；不存在返回 null */
+  findByProvider(provider: string, providerSub: string): Promise<IdentityLink | null>;
+  /** 按 userId 查所有关联 */
+  findByUserId(userId: string): Promise<IdentityLink[]>;
+  /** 创建关联；(provider, providerSub) 唯一约束冲突抛错 */
+  create(input: {
+    userId: string;
+    provider: string;
+    providerSub: string;
+    rawProfile?: string | null;
+  }): Promise<IdentityLink>;
+  /** 删除关联 */
+  delete(id: string): Promise<void>;
+}
+//#endregion
+export { TokenResponse as _, WebauthnCredentialRecord as a, SessionManagerConfig as c, RefreshTokenStore as d, createDrizzleSessionStore as f, OAuth2Endpoints as g, AuthUser as h, UserStore as i, SessionTokens as l, RefreshTokenRecord as m, LocalUser as n, SessionClaims as o, ConsumedToken as p, OAuth2LinkStore as r, SessionManager as s, IdentityLink as t, DrizzleDb as u };

package/dist/webauthn.d.ts

@@ -0,0 +1,21 @@
+import { s as SessionManager } from "./types-C-SlEMFJ.js";
+import { a as WebAuthProvider, c as WEBAUTHN_CREDENTIALS_TABLE, d as WebauthnCredentialStore, i as RegistrationResponse, l as createRestWebauthnCredentialStore, n as AuthenticationResponse, o as WebAuthProviderConfig, r as RegistrationOptions, s as RestWebauthnCredentialStoreOptions, t as AuthenticationOptions, u as createDrizzleWebauthnCredentialStore } from "./provider-Bf7d5mkl.js";
+import { Hono } from "hono";
+//#region src/webauthn/routes.d.ts
+interface WebAuthnPaths {
+  registerOptions?: string;
+  registerVerify?: string;
+  authOptions?: string;
+  authVerify?: string;
+  listCredentials?: string;
+  deleteCredential?: string;
+}
+interface WebAuthnRoutesOptions {
+  webauthn: WebAuthProvider;
+  sessions: SessionManager;
+  paths?: WebAuthnPaths;
+  secure?: boolean;
+}
+export declare function createWebAuthnRoutes(opts: WebAuthnRoutesOptions): Hono;
+//#endregion
+export { type AuthenticationOptions, type AuthenticationResponse, type RegistrationOptions, type RegistrationResponse, type RestWebauthnCredentialStoreOptions, WEBAUTHN_CREDENTIALS_TABLE, WebAuthProvider, type WebAuthProviderConfig, type WebAuthnPaths, type WebAuthnRoutesOptions, type WebauthnCredentialStore, createDrizzleWebauthnCredentialStore, createRestWebauthnCredentialStore };

package/dist/webauthn.js

@@ -0,0 +1,164 @@
+import { i as createDrizzleWebauthnCredentialStore, n as WEBAUTHN_CREDENTIALS_TABLE, r as createRestWebauthnCredentialStore, t as WebAuthProvider } from "./provider-zTWN9myS.js";
+import { Hono } from "hono";
+import { setCookie } from "hono/cookie";
+//#region src/webauthn/routes.ts
+/**
+* WebAuthn 路由（JSON API，不渲染页面）。
+*
+* POST /auth/webauthn/register/options  → 已登录用户 → registration options JSON
+* POST /auth/webauthn/register/verify   → 验证 attestation → 存储凭证 → 200 JSON
+* POST /auth/webauthn/auth/options      → authentication options JSON
+* POST /auth/webauthn/auth/verify       → 验证 assertion → session cookies + 200 JSON
+* GET  /auth/webauthn/credentials       → 已登录用户 → 凭证列表
+* POST /auth/webauthn/credentials/delete → 已登录用户 → 删除指定凭证
+*
+* 独立子路径，消费者从 @homurajs/auth/webauthn 取 createWebAuthnRoutes 自行挂载。
+*/
+function createWebAuthnRoutes(opts) {
+	const { webauthn, sessions } = opts;
+	const paths = {
+		registerOptions: opts.paths?.registerOptions ?? "/auth/webauthn/register/options",
+		registerVerify: opts.paths?.registerVerify ?? "/auth/webauthn/register/verify",
+		authOptions: opts.paths?.authOptions ?? "/auth/webauthn/auth/options",
+		authVerify: opts.paths?.authVerify ?? "/auth/webauthn/auth/verify",
+		listCredentials: opts.paths?.listCredentials ?? "/auth/webauthn/credentials",
+		deleteCredential: opts.paths?.deleteCredential ?? "/auth/webauthn/credentials/delete"
+	};
+	const secure = opts.secure ?? false;
+	const names = sessions.cookies;
+	const app = new Hono();
+	app.post(paths.registerOptions, async (c) => {
+		const claims = c.get("auth");
+		if (!claims) return c.json({ error: "unauthorized" }, 401);
+		try {
+			const options = await webauthn.generateRegistrationOptions(claims.sub);
+			return c.json(options);
+		} catch (e) {
+			return c.json({
+				error: "options_failed",
+				message: e.message
+			}, 400);
+		}
+	});
+	app.post(paths.registerVerify, async (c) => {
+		const claims = c.get("auth");
+		if (!claims) return c.json({ error: "unauthorized" }, 401);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid_body" }, 400);
+		}
+		if (!body.response) return c.json({ error: "missing_response" }, 400);
+		try {
+			const result = await webauthn.verifyRegistration(claims.sub, body.response, body.displayName);
+			return c.json({
+				ok: true,
+				credentialId: result.id
+			});
+		} catch (e) {
+			return c.json({
+				error: "verify_failed",
+				message: e.message
+			}, 400);
+		}
+	});
+	app.post(paths.authOptions, async (c) => {
+		let body = {};
+		try {
+			body = await c.req.json().catch(() => ({}));
+		} catch {}
+		try {
+			const { options, challengeKey } = await webauthn.generateAuthenticationOptions(body.userId);
+			return c.json({
+				...options,
+				challengeKey
+			});
+		} catch (e) {
+			return c.json({
+				error: "options_failed",
+				message: e.message
+			}, 400);
+		}
+	});
+	app.post(paths.authVerify, async (c) => {
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid_body" }, 400);
+		}
+		if (!body.response) return c.json({ error: "missing_response" }, 400);
+		try {
+			const user = await webauthn.verifyAuthentication(body.response, body.challengeKey);
+			const authUser = {
+				sub: user.id,
+				nickname: user.nickname ?? void 0,
+				avatarUrl: user.avatarUrl ?? void 0
+			};
+			const tokens = await sessions.createSession(authUser);
+			setCookie(c, names.access, tokens.accessToken, {
+				httpOnly: true,
+				sameSite: "Lax",
+				secure,
+				path: "/",
+				maxAge: sessions.accessTokenTtlSec
+			});
+			setCookie(c, names.refresh, tokens.refreshToken, {
+				httpOnly: true,
+				sameSite: "Lax",
+				secure,
+				path: "/",
+				maxAge: sessions.refreshTokenTtlSec
+			});
+			return c.json({
+				ok: true,
+				user: {
+					id: user.id,
+					username: user.username,
+					nickname: user.nickname
+				}
+			});
+		} catch (e) {
+			return c.json({
+				error: "verify_failed",
+				message: e.message
+			}, 401);
+		}
+	});
+	app.get(paths.listCredentials, async (c) => {
+		const claims = c.get("auth");
+		if (!claims) return c.json({ error: "unauthorized" }, 401);
+		const creds = await webauthn.listCredentials(claims.sub);
+		return c.json({ credentials: creds.map((c) => ({
+			id: c.id,
+			displayName: c.displayName,
+			deviceType: c.deviceType,
+			backedUp: c.backedUp === 1,
+			createdAt: c.createdAt
+		})) });
+	});
+	app.post(paths.deleteCredential, async (c) => {
+		const claims = c.get("auth");
+		if (!claims) return c.json({ error: "unauthorized" }, 401);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid_body" }, 400);
+		}
+		if (!body.credentialId) return c.json({ error: "missing_credential_id" }, 400);
+		try {
+			await webauthn.deleteCredential(claims.sub, body.credentialId);
+			return c.json({ ok: true });
+		} catch (e) {
+			return c.json({
+				error: "delete_failed",
+				message: e.message
+			}, 400);
+		}
+	});
+	return app;
+}
+//#endregion
+export { WEBAUTHN_CREDENTIALS_TABLE, WebAuthProvider, createDrizzleWebauthnCredentialStore, createRestWebauthnCredentialStore, createWebAuthnRoutes };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homurajs/auth",
-  "version": "26.10.14",
+  "version": "26.10.15",
   "type": "module",
   "description": "homura 认证：通用标准 OAuth2 (Authorization Code Flow) 客户端 + 自管 session（HS256 短 JWT + opaque refresh rotate）",
   "engines": {
@@ -21,6 +21,10 @@
     "./tables": {
       "types": "./dist/tables.d.ts",
       "import": "./dist/tables.js"
+    },
+    "./webauthn": {
+      "types": "./dist/webauthn.d.ts",
+      "import": "./dist/webauthn.js"
     }
   },
   "publishConfig": {
@@ -28,15 +32,19 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@homurajs/core": "26.10.14",
-    "@homurajs/db": "26.10.14",
+    "@homurajs/core": "26.10.15",
+    "@homurajs/db": "26.10.15",
     "jose": "^6.0.0"
   },
   "peerDependencies": {
+    "@simplewebauthn/server": "^11.0.0",
     "drizzle-orm": "1.0.0-rc.4",
     "hono": "^4.0.0"
   },
   "peerDependenciesMeta": {
+    "@simplewebauthn/server": {
+      "optional": true
+    },
     "drizzle-orm": {
       "optional": true
     },