@jwilleke/ngdpbase-types 0.0.0 → 5.18.0

package/lib/src/utils/shareLockbox.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Lockboxes for links to encrypted vaults (#1388).
+ *
+ * A link to an encrypted vault is `/share/{token}#{key}`. The part after `#`
+ * is the link's private key; browsers never send it, so the server never sees
+ * it. The key pair is made in the owner's browser, which sends the server
+ * only the public half (`LinkPublicKey`).
+ *
+ * The server prepares each covered page, and the files it uses, and locks
+ * them for that public key: a {@link Lockbox}. It can lock, never open. The
+ * recipient's browser opens each lockbox with the private key from the link.
+ *
+ * The algorithm is WebCrypto's own, so the server (Node's `crypto.webcrypto`)
+ * and the browser (`window.crypto.subtle`, public/js/share-viewer.js) run the
+ * same steps: ECDH on P-256 between a fresh ephemeral key and the link's key,
+ * HKDF-SHA-256 over the shared secret, AES-256-GCM over the content.
+ */
+/** The public half of a link's key pair: a P-256 point, as WebCrypto exports it in JWK. */
+export interface LinkPublicKey {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+/** One locked item, as stored and as served. */
+export interface Lockbox {
+    v: 1;
+    /** The ephemeral public key the content was locked with. */
+    epk: LinkPublicKey;
+    /** AES-GCM IV, base64url. */
+    iv: string;
+    /** AES-GCM ciphertext with its tag, base64url. */
+    ct: string;
+}
+/**
+ * The public key a browser sent, checked strictly: a P-256 point and nothing
+ * else. Anything malformed is refused rather than stored.
+ */
+export declare function parseLinkPublicKey(value: unknown): LinkPublicKey | null;
+/** Lock `plaintext` for the link whose public key is `linkKey`. Only that link's private key opens it. */
+export declare function sealForLink(linkKey: LinkPublicKey, plaintext: Uint8Array): Promise<Lockbox>;
+/**
+ * The key part of a link, `{d}.{x}.{y}` in base64url: the private key the
+ * owner's browser made. The server never holds one; this is for the tests,
+ * and mirrors what the viewer does.
+ */
+export declare function linkKeyFromParts(jwk: {
+    d: string;
+    x: string;
+    y: string;
+}): string;
+/**
+ * Make a key pair on the server. A link's pair is made in the owner's browser,
+ * so for links this is the tests' stand-in; a person's own key pair for proxy
+ * access (#1762 slice 5, `privateStoreCrypto.newPersonKey`) is made here.
+ */
+export declare function newLinkKeyPair(): Promise<{
+    publicKey: LinkPublicKey;
+    linkKey: string;
+}>;
+/** Open a lockbox with a link's key, as the recipient's browser does. */
+export declare function openLockbox(linkKey: string, box: Lockbox): Promise<Uint8Array>;
+/** True when `value` has the shape of a stored lockbox. */
+export declare function isLockbox(value: unknown): value is Lockbox;

package/lib/src/utils/sigstoreTrustedRoot.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The Sigstore trusted root, fetched through the guarded client (#1830).
+ *
+ * The trusted root (Fulcio certificate authorities, Rekor and CT log keys,
+ * timestamp authorities) is distributed by Sigstore's TUF repository, which
+ * signs and versions it so a stale or forged copy is refused. `tuf-js` does the
+ * TUF verification. Its default fetcher is Node's global `fetch`, which would
+ * open the network outside src/http and past the egress policy (#1133, #1139),
+ * so a fetcher is supplied here that downloads through the function the caller
+ * gives it — in AddonsManager, `guardedFetch`.
+ *
+ * The TUF cache starts from the root shipped inside `@sigstore/tuf` (its
+ * `seeds.json`) and lives where the caller says (`<data>/addons/.sigstore`).
+ */
+export declare const DEFAULT_TUF_MIRROR = "https://tuf-repo-cdn.sigstore.dev";
+/** A GET that resolves to the status and body, or throws when the host cannot be reached. */
+export type TufDownload = (url: string, maxBytes: number) => Promise<{
+    status: number;
+    body: Buffer;
+}>;
+/** The trusted root as shipped in `@sigstore/tuf`, with no network. For tests and as the TUF seed. */
+export declare function seededTrustedRoot(mirrorUrl?: string): unknown;
+/**
+ * The current trusted root, refreshed from the TUF repository through
+ * `download` and verified by TUF. Throws when the repository cannot be reached
+ * or does not verify.
+ */
+export declare function fetchTrustedRoot(options: {
+    cacheDir: string;
+    mirrorUrl?: string;
+    download: TufDownload;
+    maxBytes: number;
+}): Promise<unknown>;

package/lib/src/utils/sniffMime.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The type a file's bytes show it to be, for the formats we can recognise
+ * (#1624). An upload's declared type is the browser's claim; this is the
+ * evidence. Returns null when the bytes match none of the formats below —
+ * the caller decides what an unrecognised file is.
+ *
+ * Markup is recognised from the first kilobyte, case-insensitively, after
+ * leading whitespace (trimStart also drops a byte-order mark). SVG is checked before HTML because
+ * an SVG may itself contain a `<script>`.
+ */
+export type SniffedMime = 'image/jpeg' | 'image/png' | 'image/gif' | 'image/webp' | 'application/pdf' | 'image/svg+xml' | 'text/html' | 'text/xml';
+/** Every type sniffMime can return: a claim of one of these must match the bytes. */
+export declare const SNIFFABLE_MIME: ReadonlySet<string>;
+export declare function sniffMime(b: Buffer): SniffedMime | null;
+/**
+ * The type an upload is stored and served as. The bytes decide when they are
+ * recognisable; a claim of a recognisable type the bytes do not bear out
+ * becomes `application/octet-stream`; anything else keeps its declared type,
+ * since nothing here can check it (a .docx, a plain text file).
+ */
+export declare function resolveUploadMime(bytes: Buffer, declared: string | undefined): string;

package/lib/src/utils/storeSearchIndex.d.ts

@@ -0,0 +1,75 @@
+/**
+ * A private store's own saved search index (#1458, epic #1454).
+ *
+ * A private page is in NO shared index (#1456), so its owner could not search
+ * it at all. Each store therefore keeps its own search index beside its page
+ * index — `{store}/search-index.json`, written through the store's own I/O, so
+ * it is ciphertext at rest exactly when the store is (operator, 2026-09-22:
+ * "each store keeps its own saved search index").
+ *
+ * It is SAVED, not built at search time: a document per page holds everything
+ * a match needs — title, body text, tags, category and `lastModified` — so a
+ * search reads one small file per store and never opens a page file. Building
+ * from the pages at search time was rejected as too slow for a large store.
+ *
+ * This module holds the shape and the matching rule and nothing else: no I/O,
+ * no config, no access decision. Who may read a store's index is decided
+ * before anyone gets here (PageManager, with the requester's context).
+ */
+/** One page, as its store's search index holds it. */
+export interface StoreSearchDocument {
+    uuid: string;
+    title: string;
+    /** The page body — what a full-text match reads. */
+    text: string;
+    /** Frontmatter `tags` and `user-keywords`, folded into one list. */
+    tags: string[];
+    /** Frontmatter `system-category`, empty when the page carries none. */
+    category: string;
+    lastModified: string;
+}
+/** The file: `{ version, documents: { [uuid]: StoreSearchDocument } }`. */
+export interface StoreSearchIndexFile {
+    version: number;
+    documents: Record<string, StoreSearchDocument>;
+}
+export declare const STORE_SEARCH_INDEX_VERSION = 1;
+/** What a caller asks a store's index. Every field is optional; all of them narrow. */
+export interface StoreSearchQuery {
+    /** Free text. Empty means "every document", as the shared no-text branch does. */
+    query?: string;
+    /** `system-category` values; a document matches when it carries one of them. */
+    categories?: string[];
+    /** `user-keywords` / tags; a document matches when it carries one of them. */
+    userKeywords?: string[];
+    /** Which fields the free text is matched in: `title`, `content`, `category`, `keywords`, or `all`. */
+    searchIn?: string[];
+    /** Longest snippet returned. Default 200, as the Lunr provider's default is. */
+    snippetLength?: number;
+}
+export interface StoreSearchMatch {
+    document: StoreSearchDocument;
+    score: number;
+    snippet: string;
+}
+/**
+ * The document for one page of a store, from what a save already has in hand.
+ *
+ * The same frontmatter fields the shared index reads (`tags`,
+ * `user-keywords`, `system-category`), so a private page and a public one are
+ * found by the same words.
+ */
+export declare function storeSearchDocument(args: {
+    uuid: string;
+    title: string;
+    content: string;
+    metadata?: Record<string, unknown>;
+}): StoreSearchDocument;
+/**
+ * The documents of one store that match, best first.
+ *
+ * Every term must match somewhere (AND), as the field-scoped shared search
+ * does. A title match scores far above a body match, so the page a reader
+ * named comes first.
+ */
+export declare function matchStoreSearch(documents: Record<string, StoreSearchDocument>, ask?: StoreSearchQuery): StoreSearchMatch[];

package/lib/src/utils/subjectMayDo.d.ts

@@ -0,0 +1,21 @@
+/**
+ * subjectMayDo — the one door for a plugin, middleware or handler that has an
+ * engine and a subject and needs an allow/deny (#1198, security-posture P2).
+ *
+ * Asks the PDP (`PolicyDecisionPoint.permits`) and nothing else. The
+ * subject is forwarded as it was given, so `viaToken` / `viaShare` reach the
+ * ceilings. No engine, no PDP, or no subject is a refusal — the
+ * anonymous role's policy is asked through `ANONYMOUS_SUBJECT` by the caller
+ * that means anonymous, never by this helper defaulting to it.
+ *
+ * Exists so the sites that used to ask `userHasRole(userContext, 'admin')`
+ * had somewhere to go that is not a second evaluator: a role name skips
+ * PolicyEvaluator, deny policies and the token ceiling; this does not.
+ */
+import type { PermissionSubject } from '../managers/UserManager.js';
+import type { CorePermission } from '../security/permissions.generated.js';
+type EngineLike = {
+    getManager: (name: string) => unknown;
+} | null | undefined;
+export declare function subjectMayDo(engine: EngineLike, subject: PermissionSubject | null | undefined, action: CorePermission): Promise<boolean>;
+export {};

package/lib/src/utils/systemCategoryRules.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The rules a `ngdpbase.system-category` entry's values follow
+ * (docs/system-category.md, "The fields"), said once for every reader: the
+ * configuration merge, which refuses an add-on's entry that breaks them
+ * (#1559), and ValidationManager, which checks the site's own entries at
+ * startup.
+ */
+export declare const SYSTEM_CATEGORY_KEY = "ngdpbase.system-category";
+/**
+ * The fields of an entry that are its `owner`'s declaration (operator,
+ * 2026-09-29): `encrypt` and `defaultPrivate` stand, and `shareMaxDays` is
+ * decided by the owner. For an entry an add-on declares, a site's
+ * `app-custom-config.json` never changes them, nor `owner` itself.
+ */
+export declare const OWNER_DECIDED_FIELDS: readonly ["owner", "encrypt", "defaultPrivate", "shareMaxDays"];
+/** One mistyped value: what is wrong, and what every reader takes it to mean. */
+export interface SystemCategoryValueProblem {
+    /** Names the entry, the field and the bad value. */
+    message: string;
+    /** What the value is read as, and what that does. */
+    readAs: string;
+}
+/**
+ * What is wrong with the types of one entry's values, one per field, naming
+ * the entry and the field. Empty when sound. `defaultPrivate` is the boolean
+ * `true` or `false`, or the string `"choice"`; `encrypt` is a boolean.
+ * Anything else is compared as false by every reader, so the string `"true"`
+ * would start pages public and leave the vault unsealed.
+ */
+export declare function systemCategoryValueProblems(key: string, entry: unknown): SystemCategoryValueProblem[];

package/lib/src/utils/systemCategoryRules.js

@@ -0,0 +1,41 @@
+/**
+ * The rules a `ngdpbase.system-category` entry's values follow
+ * (docs/system-category.md, "The fields"), said once for every reader: the
+ * configuration merge, which refuses an add-on's entry that breaks them
+ * (#1559), and ValidationManager, which checks the site's own entries at
+ * startup.
+ */
+export const SYSTEM_CATEGORY_KEY = 'ngdpbase.system-category';
+/**
+ * The fields of an entry that are its `owner`'s declaration (operator,
+ * 2026-09-29): `encrypt` and `defaultPrivate` stand, and `shareMaxDays` is
+ * decided by the owner. For an entry an add-on declares, a site's
+ * `app-custom-config.json` never changes them, nor `owner` itself.
+ */
+export const OWNER_DECIDED_FIELDS = ['owner', 'encrypt', 'defaultPrivate', 'shareMaxDays'];
+/**
+ * What is wrong with the types of one entry's values, one per field, naming
+ * the entry and the field. Empty when sound. `defaultPrivate` is the boolean
+ * `true` or `false`, or the string `"choice"`; `encrypt` is a boolean.
+ * Anything else is compared as false by every reader, so the string `"true"`
+ * would start pages public and leave the vault unsealed.
+ */
+export function systemCategoryValueProblems(key, entry) {
+    if (!entry || typeof entry !== 'object')
+        return [];
+    const e = entry;
+    const problems = [];
+    if (e.defaultPrivate !== undefined && e.defaultPrivate !== true && e.defaultPrivate !== false && e.defaultPrivate !== 'choice') {
+        problems.push({
+            message: `system-category '${key}': defaultPrivate must be true, false or "choice", got ${JSON.stringify(e.defaultPrivate)}`,
+            readAs: 'it is read as false, so new pages start public'
+        });
+    }
+    if (e.encrypt !== undefined && typeof e.encrypt !== 'boolean') {
+        problems.push({
+            message: `system-category '${key}': encrypt must be true or false, got ${JSON.stringify(e.encrypt)}`,
+            readAs: 'it is read as false, so the vault is not sealed'
+        });
+    }
+    return problems;
+}

package/lib/src/utils/userCreateError.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Typed user-creation failures and the safe messages registration may show (#1086).
+ *
+ * `POST /register` used to disclose every username on the instance to an
+ * unauthenticated visitor. Two independent defects produced that:
+ *
+ * 1. `UserManager.createUser` built its duplicate-username error by joining
+ *    `getAllUsernames()` into the message.
+ * 2. `processRegister` forwarded `getErrorMessage(err)` straight into a
+ *    redirect, which the register page rendered.
+ *
+ * The second is the one that matters. Fixing only the message would leave the
+ * route one internal `throw` away from the same exposure, because it treats
+ * arbitrary exception text as user-facing copy — and every layer beneath it
+ * can throw.
+ *
+ * So failures now carry a machine-readable `reason`, and the route maps that to
+ * a small closed set of messages. Anything unrecognised — a disk error, a
+ * provider bug, a future exception nobody anticipated — becomes the generic
+ * failure. That default is what makes this hold for errors that do not exist
+ * yet.
+ *
+ * The codebase is careful about this elsewhere, which is what made the
+ * registration path look like an oversight rather than a policy: login returns
+ * a uniform "Invalid username or password", `requestMagicLink` always redirects
+ * with `magic=sent` whether or not the address exists, and agent-token revoke
+ * returns 404 rather than 403 to avoid confirming that a token exists.
+ */
+/** Why a user could not be created. */
+export type UserCreateFailureReason = 
+/** The requested username is already taken. */
+'username-taken'
+/** The display name collides with something that already exists. */
+ | 'display-name-conflict'
+/** The email address already belongs to another account (#1748). */
+ | 'email-taken';
+/**
+ * A user-creation failure with a reason a caller can branch on.
+ *
+ * The `message` is for logs and may contain internal detail; it must never be
+ * shown to a caller. `safeRegistrationMessage` is the only thing that decides
+ * what a visitor sees.
+ */
+export declare class UserCreateError extends Error {
+    readonly reason: UserCreateFailureReason;
+    constructor(reason: UserCreateFailureReason, message: string);
+}
+/** Shown when the cause is unknown, or known but not safe to describe. */
+export declare const GENERIC_REGISTRATION_FAILURE = "Registration failed. Please try again.";
+/**
+ * Map a thrown value to a message that is safe to show an unauthenticated
+ * visitor.
+ *
+ * Deliberately conservative: only a real `UserCreateError` carrying a known
+ * reason produces a specific message. A plain object shaped like one is not
+ * trusted, because only the code that constructs a `UserCreateError` has
+ * decided the reason is accurate.
+ *
+ * Callers must still log the original error — this discards detail on purpose,
+ * and the detail is what makes a real failure diagnosable.
+ */
+export declare function safeRegistrationMessage(err: unknown): string;

package/lib/src/utils/username.d.ts

@@ -0,0 +1,53 @@
+/**
+ * One spelling of a username, for comparison (#1436).
+ *
+ * A username is an identifier, not prose: `jim`, `Jim` and `" jim "` are one
+ * account, and every comparison has to agree about that. Before this they did
+ * not. `FileUserProvider` keyed its map on the raw string, so those three were
+ * three separate accounts and `createUser`'s duplicate check did not see the
+ * case variants — an account could be registered whose name differed from an
+ * existing one only in case, which is the classic lookalike.
+ *
+ * The same split ran through the code the other way. `getAnonymousUser()`
+ * emits `'Anonymous'` while roughly ten sites compare against `'anonymous'`,
+ * so those guards never fired for a real visitor. They failed closed, which is
+ * luck rather than design — it is the same defect as #1433, where a viewer was
+ * written to the cache key under one spelling and read back under another.
+ *
+ * __Normalize to compare; keep the original to display.__ The stored record
+ * keeps whatever the person typed, because that is their name; the index and
+ * every equality test use this.
+ */
+/**
+ * The comparison form of a username: trimmed, lower-cased.
+ *
+ * Lower-case rather than upper: `toLowerCase()` is what the existing checks
+ * already used (`isSystemPrincipal`, the sitemap subject list), so this agrees
+ * with them rather than introducing a third convention.
+ *
+ * A non-string is normalized to the empty string rather than throwing, because
+ * callers pass values straight from a request body — and empty is already the
+ * "no username" case every caller handles.
+ */
+export declare function normalizeUsername(username: unknown): string;
+/**
+ * True when two usernames name the same account.
+ *
+ * Exists so a comparison reads as the question it is asking, and so no call
+ * site re-implements the rule by hand — which is how the spellings diverged.
+ */
+export declare function sameUsername(a: unknown, b: unknown): boolean;
+/**
+ * Names no person may register.
+ *
+ * `anonymous` is the principal for "nobody authenticated" — a real account
+ * holding that name would collide with it wherever the name is compared.
+ * `asserted` was the subject removed in #1435; it is reserved so the name
+ * cannot be taken in the window before anyone reconsiders the concept.
+ *
+ * The system principal is NOT listed here: its name comes from `.env` and is
+ * checked separately by `isSystemPrincipal`, because an operator chooses it.
+ */
+export declare const RESERVED_USERNAMES: readonly string[];
+/** True when the name belongs to a principal rather than a person. */
+export declare function isReservedUsername(username: unknown): boolean;

package/lib/src/utils/vaultUrlRewrite.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Rewrite links to private pages from `private/…` to `vaults/…` (#1506).
+ *
+ * Old addresses are not redirected (operator, 2026-09-28), so every link a
+ * page stores is rewritten once instead. Links to a private page written the
+ * #1457 way, `[store/Title]`, carry no prefix and are untouched; this is for
+ * the full forms a person may have written by hand:
+ *
+ *   - a URL path or page name:  `/private/jim/default/Diary`, `[x|private/jim/default/Diary]`
+ *   - URL-encoded:              `/view/private%2Fjim%2Fdefault%2FDiary`
+ *
+ * Only a target naming a vault that exists is rewritten, so text that merely
+ * looks like one — `/private/var/folders/…` on macOS, `private/secrets.md` —
+ * is left alone. A second run writes nothing: a rewritten link no longer
+ * starts with `private`.
+ */
+/** The migration id, recorded per vault and for the public pages. */
+export declare const VAULT_URL_MIGRATION = "vault-urls";
+/**
+ * @param content - a page's body
+ * @param vaults - the vaults that exist, as `owner/store`
+ * @returns the rewritten body and how many links changed
+ */
+export declare function rewriteLegacyVaultUrls(content: string, vaults: ReadonlySet<string>): {
+    content: string;
+    rewritten: number;
+};

package/lib/src/utils/version.d.ts

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+/**
+ * Version Management Script for ngdpbase
+ *
+ * Helps manage semantic versioning for the project.
+ *
+ * Usage:
+ *   node version.js                    - Show current version
+ *   node version.js patch              - Increment patch version (bug fixes)
+ *   node version.js minor              - Increment minor version (new features)
+ *   node version.js major              - Increment major version (breaking changes)
+ *   node version.js set <version>      - Set specific version
+ */
+/**
+ * Parsed version components
+ */
+export interface VersionComponents {
+    major: number;
+    minor: number;
+    patch: number;
+}
+/**
+ * Version increment type
+ */
+export type VersionIncrementType = 'major' | 'minor' | 'patch';
+/**
+ * Minimal shape of the parts of package-lock.json this tool touches.
+ */
+export interface PackageLock {
+    version?: string;
+    lockfileVersion?: number;
+    packages?: Record<string, {
+        version?: string;
+        [key: string]: unknown;
+    }>;
+    [key: string]: unknown;
+}
+/**
+ * Set the project's own version in a parsed lockfile — the pure half of
+ * {@link updatePackageLock}, split out so the mapping is testable without
+ * touching the filesystem.
+ *
+ * Writes exactly two fields: the top-level `version` and the root package entry
+ * `packages[""].version`. Dependency entries are never touched — only npm may
+ * change those, and rewriting one here would corrupt resolution.
+ *
+ * @param {PackageLock} lock - Parsed lockfile (mutated in place and returned)
+ * @param {string} newVersion - New version string
+ * @returns {PackageLock} The same object, for convenient chaining
+ */
+export declare function applyVersionToLock(lock: PackageLock, newVersion: string): PackageLock;
+/**
+ * Parse a semantic version string
+ *
+ * @param {string} version - Version string (e.g., "1.2.3")
+ * @returns {VersionComponents} Parsed version components
+ * @throws {Error} If version format is invalid
+ */
+export declare function parseVersion(version: string): VersionComponents;
+/**
+ * Whether `version` is `minimum` or later (both `x.y.z`). An add-on states the
+ * core release it needs this way (#1757: `ngdpbase.minVersion`).
+ *
+ * @throws {Error} If either version format is invalid
+ */
+export declare function isAtLeast(version: string, minimum: string): boolean;
+/**
+ * Format version components into string
+ *
+ * @param {number} major - Major version
+ * @param {number} minor - Minor version
+ * @param {number} patch - Patch version
+ * @returns {string} Formatted version string
+ */
+export declare function formatVersion(major: number, minor: number, patch: number): string;
+/**
+ * Increment version based on type
+ *
+ * @param {string} currentVersion - Current version string
+ * @param {VersionIncrementType} type - Type of increment
+ * @returns {string} New version string
+ * @throws {Error} If increment type is invalid
+ */
+export declare function incrementVersion(currentVersion: string, type: VersionIncrementType): string;

package/lib/src/utils/videoFrame.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Single-frame extraction from a video file via ffmpeg-static (#722 Slice 1).
+ *
+ * Used by FileSystemMediaProvider.getThumbnailBuffer to populate poster-frame
+ * thumbnails for video items, plugging the resulting JPEG buffer into the
+ * existing Sharp pipeline (same downstream code path as image thumbnails).
+ *
+ * ffmpeg-static ships a statically-linked ffmpeg binary in the package — no
+ * system ffmpeg dependency. The package exports the absolute binary path.
+ */
+/**
+ * Extract a single video frame at the given timestamp as an MJPEG buffer.
+ * Returns null on any error so the caller can fall back to the icon
+ * placeholder without crashing the request.
+ *
+ * @param filePath  Absolute path to the source video file
+ * @param atSeconds Seek timestamp; defaults to 1 (the conventional poster
+ *                  position — early enough to be quick, late enough to
+ *                  usually skip the black opening frame)
+ */
+export declare function extractVideoFrame(filePath: string, atSeconds?: number): Promise<Buffer | null>;

package/package.json

@@ -1,4 +1,55 @@
-{ "name": "@jwilleke/ngdpbase-types", "version": "0.0.0",
-  "description": "Placeholder that reserves this name. Not installable: the real package is published from GitHub Actions with provenance at each ngdpbase release.",
+{
+  "name": "@jwilleke/ngdpbase-types",
+  "version": "5.18.0",
+  "description": "TypeScript types for ngdpbase add-ons, and a test kit of core's own values. A dev dependency, versioned with ngdpbase.",
   "license": "Apache-2.0",
-  "repository": { "type": "git", "url": "git+https://github.com/jwilleke/ngdpbase.git", "directory": "packages/ngdpbase-types" } }
+  "author": "Jim Willeke",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jwilleke/ngdpbase.git",
+    "directory": "packages/ngdpbase-types"
+  },
+  "homepage": "https://github.com/jwilleke/ngdpbase/blob/master/docs/guides/addons-developer-guide.md",
+  "type": "module",
+  "types": "./lib/packages/ngdpbase-types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/packages/ngdpbase-types/index.d.ts"
+    },
+    "./testing": {
+      "types": "./lib/packages/ngdpbase-types/testing.d.ts",
+      "default": "./lib/packages/ngdpbase-types/testing.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=24.15.0"
+  },
+  "dependencies": {
+    "@jwilleke/oidc-auth-server": "0.4.0",
+    "@simplewebauthn/server": "^14.0.3",
+    "@types/express": "^5.0.5",
+    "@types/express-session": "^1.19.0",
+    "@types/fs-extra": "^11.0.4",
+    "@types/markdown-it": "^14.2.0",
+    "@types/multer": "^2.3.0",
+    "@types/node": "^24.19.2",
+    "better-sqlite3-multiple-ciphers": "^13.0.3",
+    "express": "^5.3.0",
+    "express-session": "^1.19.0",
+    "fs-extra": "^11.4.1",
+    "ipaddr.js": "^2.5.0",
+    "jose": "^6.2.12",
+    "linkedom": "^0.18.13",
+    "markdown-it": "^14.3.1",
+    "minimatch": "^10.2.6",
+    "minisearch": "7.2.0",
+    "multer": "^2.4.0",
+    "winston": "^3.17.0"
+  }
+}