@kubun/plugin-service-server 0.14.0

package/LICENSE.md

@@ -0,0 +1,57 @@
+# The Prosperity Public License 3.0.0
+
+Contributor: Paul Le Cam
+
+Source Code: https://github.com/PaulLeCam/kubun
+
+## Purpose
+
+This license allows you to use and share this software for noncommercial purposes for free and to try this software for commercial purposes for thirty days.
+
+## Agreement
+
+In order to receive this license, you have to agree to its rules.  Those rules are both obligations under that agreement and conditions to your license.  Don't do anything with this software that triggers a rule you can't or won't follow.
+
+## Notices
+
+Make sure everyone who gets a copy of any part of this software from you, with or without changes, also gets the text of this license and the contributor and source code lines above.
+
+## Commercial Trial
+
+Limit your use of this software for commercial purposes to a thirty-day trial period.  If you use this software for work, your company gets one trial period for all personnel, not one trial per person.
+
+## Contributions Back
+
+Developing feedback, changes, or additions that you contribute back to the contributor on the terms of a standardized public software license such as [the Blue Oak Model License 1.0.0](https://blueoakcouncil.org/license/1.0.0), [the Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0.html), [the MIT license](https://spdx.org/licenses/MIT.html), or [the two-clause BSD license](https://spdx.org/licenses/BSD-2-Clause.html) doesn't count as use for a commercial purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, doesn't count as use for a commercial purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution doesn't count as use for a commercial purpose regardless of the source of funding or obligations resulting from the funding.
+
+## Defense
+
+Don't make any legal claim against anyone accusing this software, with or without changes, alone or with other technology, of infringing any patent.
+
+## Copyright
+
+The contributor licenses you to do everything with this software that would otherwise infringe their copyright in it.
+
+## Patent
+
+The contributor licenses you to do everything with this software that would otherwise infringe any patents they can license or become able to license.
+
+## Reliability
+
+The contributor can't revoke this license.
+
+## Excuse
+
+You're excused for unknowingly breaking [Notices](#notices) if you take all practical steps to comply within thirty days of learning you broke the rule.
+
+## No Liability
+
+***As far as the law allows, this software comes as is, without any warranty or condition, and the contributor won't be liable to anyone for any damages related to this software or this license, under any kind of legal claim.***

package/lib/authorizer.d.ts

@@ -0,0 +1,88 @@
+import { type VerifyTokenHook } from '@kokuin/capability';
+import { type DIDMethodResolver } from '@kokuin/token';
+import type { ServiceAuthorizer, ServiceHandlerContext } from '@kubun/plugin-service-api';
+import type { KubunErrorCode } from '@kubun/protocol';
+/**
+ * The capability action a caller presents to act for another subject over a
+ * generic service lane. Deliberately NOT `credential/administer`: that action is
+ * scoped to administering a controller's credential keys, so reusing it would
+ * both over-grant (a credential-admin delegate could suddenly act for the user
+ * on any service) and under-express (a "device acts for me" grant is not about
+ * credentials). It also keeps the host free of a `@kubun/credential` dependency.
+ * Matched by segment like every action, so a `service/*` grant covers it.
+ */
+export declare const SERVICE_ACT_FOR_ACTION = "service/act-for";
+/**
+ * The user-wide capability resource for acting on a subject's behalf, reusing the
+ * generic `urn:kubun:user:<did>` resource documents and p2p already use — one
+ * delegation covers "act for this user" rather than naming a service. The action
+ * segment (`service/act-for`) is what separates a service grant from a
+ * `document/write` grant over the same resource, so the reuse is safe. The DID is
+ * normalized so the resource is an equality key.
+ */
+export declare function serviceUserResource(subject: string): string;
+/**
+ * A subject authorization was refused for a write. Reads never throw this (they
+ * return the empty/not-found result instead, so a denial is indistinguishable
+ * from an absent record); writes do, so the caller receives an explicit error
+ * rather than a silent no-op.
+ *
+ * Carries the registered `KB07` ('Access denied') code so the host's translation
+ * gate forwards it to a remote caller as a well-known code rather than an opaque
+ * generic — the same code the graph lane already uses for access denials.
+ */
+export declare class ServiceAuthorizationError extends Error {
+    #private;
+    constructor(message?: string);
+    get code(): KubunErrorCode;
+}
+export type CreateCallerMayActForParams = {
+    /** Resolves a `did:kokuin:` subject's log so a delegation cap's signature and deny set verify. */
+    controllerResolver: DIDMethodResolver;
+    /** Delegation-revocation hook, consulted for every capability in the chain. */
+    revocationChecker?: VerifyTokenHook;
+    /** How the host supplies the caller's delegation tokens for a given subject. */
+    delegationTokens?: (subject: string) => Array<string> | Promise<Array<string>>;
+    /** Evaluate capability expiry at this time (epoch seconds) rather than now(). */
+    atTime?: number;
+};
+/**
+ * The cross-engine service authorizer: does the verified caller `iss` speak for
+ * the named `subject`? Mirrors the `controller-authority.ts`
+ * chain-then-independent, fail-closed pattern.
+ *
+ * - No `subject` → the caller acts only for itself; nothing to gate → allowed.
+ * - `iss === subject` (normalized) → a verified device signing as its own
+ *   controller DID; Enkaku already proved liveness → allowed (the shared-identity
+ *   path).
+ * - Otherwise a delegation cap from `subject` to `iss` must authorize
+ *   `service/act-for` on the subject's user resource; no tokens or no match →
+ *   denied.
+ */
+export declare function createCallerMayActFor(params: CreateCallerMayActForParams): ServiceAuthorizer;
+/** Shared inputs to the read/write authorization gates. */
+export type AuthorizeParams = {
+    /** The handler context, for its `authorize` gate. */
+    context: Pick<ServiceHandlerContext, 'authorize'>;
+    /** The authorization subject (the owner DID); omitted for a self-only call. */
+    subject?: string;
+};
+export type AuthorizeReadParams<Result> = AuthorizeParams & {
+    /** Returned on denial — the not-found/empty shape, so a denial reveals nothing. */
+    emptyResult: Result;
+    /** Runs and returns the result once the caller is authorized. */
+    proceed: () => Result | Promise<Result>;
+};
+/**
+ * Read-side authorization convention: if the caller may not act for `subject`,
+ * return `emptyResult` (the not-found/empty shape) so a denial is
+ * indistinguishable from an absent record — no existence oracle. Otherwise run
+ * `proceed` and return its result.
+ */
+export declare function authorizeRead<Result>(params: AuthorizeReadParams<Result>): Promise<Result>;
+/**
+ * Write-side authorization convention: if the caller may not act for `subject`,
+ * throw {@link ServiceAuthorizationError} so the caller receives an explicit auth
+ * error rather than a silent no-op. Otherwise return.
+ */
+export declare function authorizeWrite(params: AuthorizeParams): Promise<void>;

package/lib/authorizer.js

@@ -0,0 +1,140 @@
+import { checkCapability } from '@kokuin/capability';
+import { normalizeDID } from '@kokuin/token';
+/**
+ * The capability action a caller presents to act for another subject over a
+ * generic service lane. Deliberately NOT `credential/administer`: that action is
+ * scoped to administering a controller's credential keys, so reusing it would
+ * both over-grant (a credential-admin delegate could suddenly act for the user
+ * on any service) and under-express (a "device acts for me" grant is not about
+ * credentials). It also keeps the host free of a `@kubun/credential` dependency.
+ * Matched by segment like every action, so a `service/*` grant covers it.
+ */ export const SERVICE_ACT_FOR_ACTION = 'service/act-for';
+/**
+ * The user-wide capability resource for acting on a subject's behalf, reusing the
+ * generic `urn:kubun:user:<did>` resource documents and p2p already use — one
+ * delegation covers "act for this user" rather than naming a service. The action
+ * segment (`service/act-for`) is what separates a service grant from a
+ * `document/write` grant over the same resource, so the reuse is safe. The DID is
+ * normalized so the resource is an equality key.
+ */ export function serviceUserResource(subject) {
+    return `urn:kubun:user:${normalizeDID(subject)}`;
+}
+/**
+ * A subject authorization was refused for a write. Reads never throw this (they
+ * return the empty/not-found result instead, so a denial is indistinguishable
+ * from an absent record); writes do, so the caller receives an explicit error
+ * rather than a silent no-op.
+ *
+ * Carries the registered `KB07` ('Access denied') code so the host's translation
+ * gate forwards it to a remote caller as a well-known code rather than an opaque
+ * generic — the same code the graph lane already uses for access denials.
+ */ export class ServiceAuthorizationError extends Error {
+    #code = 'KB07';
+    constructor(message = 'Service authorization denied'){
+        super(message);
+        this.name = 'ServiceAuthorizationError';
+    }
+    get code() {
+        return this.#code;
+    }
+}
+/**
+ * The cross-engine service authorizer: does the verified caller `iss` speak for
+ * the named `subject`? Mirrors the `controller-authority.ts`
+ * chain-then-independent, fail-closed pattern.
+ *
+ * - No `subject` → the caller acts only for itself; nothing to gate → allowed.
+ * - `iss === subject` (normalized) → a verified device signing as its own
+ *   controller DID; Enkaku already proved liveness → allowed (the shared-identity
+ *   path).
+ * - Otherwise a delegation cap from `subject` to `iss` must authorize
+ *   `service/act-for` on the subject's user resource; no tokens or no match →
+ *   denied.
+ */ export function createCallerMayActFor(params) {
+    const { controllerResolver, revocationChecker, delegationTokens, atTime } = params;
+    return async ({ iss, subject })=>{
+        if (subject == null) {
+            return true;
+        }
+        const caller = normalizeDID(iss);
+        const owner = normalizeDID(subject);
+        if (caller === owner) {
+            return true;
+        }
+        const tokens = await delegationTokens?.(subject) ?? [];
+        if (tokens.length === 0) {
+            return false;
+        }
+        // A user-wide grant covers the subject's whole lane; `*` covers any subject.
+        const resources = [
+            serviceUserResource(subject),
+            '*'
+        ];
+        const methods = [
+            controllerResolver
+        ];
+        // First, try the tokens as one delegation chain (an A→B→C grant).
+        for (const res of resources){
+            try {
+                await checkCapability({
+                    act: SERVICE_ACT_FOR_ACTION,
+                    res
+                }, {
+                    iss: caller,
+                    sub: owner,
+                    cap: tokens
+                }, {
+                    atTime,
+                    verifyToken: revocationChecker,
+                    methods
+                });
+                return true;
+            } catch  {
+            // This resource does not match the chain — continue.
+            }
+        }
+        // Then each token independently (several unrelated direct grants).
+        for (const token of tokens){
+            for (const res of resources){
+                try {
+                    await checkCapability({
+                        act: SERVICE_ACT_FOR_ACTION,
+                        res
+                    }, {
+                        iss: caller,
+                        sub: owner,
+                        cap: token
+                    }, {
+                        atTime,
+                        verifyToken: revocationChecker,
+                        methods
+                    });
+                    return true;
+                } catch  {
+                // This token does not match this resource — continue.
+                }
+            }
+        }
+        return false;
+    };
+}
+/**
+ * Read-side authorization convention: if the caller may not act for `subject`,
+ * return `emptyResult` (the not-found/empty shape) so a denial is
+ * indistinguishable from an absent record — no existence oracle. Otherwise run
+ * `proceed` and return its result.
+ */ export async function authorizeRead(params) {
+    if (!await params.context.authorize(params.subject)) {
+        return params.emptyResult;
+    }
+    return await params.proceed();
+}
+/**
+ * Write-side authorization convention: if the caller may not act for `subject`,
+ * throw {@link ServiceAuthorizationError} so the caller receives an explicit auth
+ * error rather than a silent no-op. Otherwise return.
+ */ export async function authorizeWrite(params) {
+    if (!await params.context.authorize(params.subject)) {
+        throw new ServiceAuthorizationError();
+    }
+}

package/lib/index.d.ts

@@ -0,0 +1,81 @@
+import { type Server } from '@enkaku/server';
+import { type DIDResolver, type MethodRegistry } from '@kokuin/token';
+import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
+import type { ServiceHandler, ServiceProtocol, ServiceServerServeParams } from '@kubun/plugin-service-api';
+export type { AccessRules, Handlers, ServiceAuthorizer, ServiceConfig, ServiceHandler, ServiceHandlerContext, ServiceProviderImpl, ServiceServerServeParams, } from '@kubun/plugin-service-api';
+export { type AuthorizeParams, type AuthorizeReadParams, authorizeRead, authorizeWrite, type CreateCallerMayActForParams, createCallerMayActFor, SERVICE_ACT_FOR_ACTION, ServiceAuthorizationError, serviceUserResource, } from './authorizer.js';
+/**
+ * A configured service name resolves to a `service` provider that was never
+ * registered. `true`/`{ rules }` both require a provider; only `{ handlers }`
+ * may name an unregistered service.
+ */
+export declare class UnknownServiceError extends Error {
+    #private;
+    constructor(service: string);
+    get service(): string;
+}
+/**
+ * A custom service (`{ handlers }`) reuses the name of a provider-registered
+ * service. A custom impl must not shadow a registered one — the name is the
+ * collision.
+ */
+export declare class ServiceNameCollisionError extends Error {
+    #private;
+    constructor(service: string);
+    get service(): string;
+}
+/**
+ * Two served services expose the same fully-qualified procedure name. The merged
+ * handler map would silently drop one, so it is a serve-time error.
+ */
+export declare class ServiceProcedureCollisionError extends Error {
+    #private;
+    constructor(procedure: string);
+    get procedure(): string;
+}
+/**
+ * Options for the service-server plugin.
+ */
+export type ServiceServerPluginOptions = {
+    /**
+     * Method registry forwarded to Enkaku's transport-level message-signature
+     * verification. Defaults to the engine's own `did:kokuin:` controller resolver
+     * so a `did:kokuin:`-signed message over an authenticated socket verifies out
+     * of the box; pass a registry to override that default.
+     */
+    methods?: MethodRegistry;
+    /**
+     * DID resolver forwarded to Enkaku's transport-level message-signature
+     * verification. Supply one only to resolve a DID method the default `methods`
+     * registry does not cover.
+     */
+    resolver?: DIDResolver;
+};
+/**
+ * API provided by the service-server plugin.
+ */
+export type ServiceServerPluginAPI = {
+    serve: (params: ServiceServerServeParams) => Server<ServiceProtocol>;
+};
+/**
+ * Creates the service-server host plugin.
+ *
+ * The host owns the Enkaku serve core extracted from the RPC plugin: per-serve it
+ * collects the engine's `service` providers, applies the per-serve `services`
+ * config against them, merges the selected handlers/access-rules, and serves the
+ * union over the given transport with per-message `did:kokuin:` signature
+ * verification (`methods = [controllerResolverFor(db)]`, pre-transaction).
+ */
+export declare function createServiceServerPlugin(options?: ServiceServerPluginOptions): (params: PluginFactoryParams) => KubunPlugin;
+/**
+ * Wrap a service handler so the host — not the caller — supplies the verified
+ * `iss` and the `procedure` name to the per-serve authorizer, and so a forged
+ * subject is rejected before the handler body runs.
+ *
+ * The verified caller is the signed payload's `iss`. A payload `sub` that differs
+ * from `iss` is a forged-subject attempt (running as someone else) and is
+ * rejected outright, mirroring the RPC plugin's `resolveViewerDID`. The handler
+ * receives a bound `authorize(subject)` that calls the per-serve authorizer with
+ * host-supplied `{ iss, procedure }`; a handler cannot spoof either.
+ */
+export declare function wrapHandler(procedure: string, handler: ServiceHandler, authorizer: ServiceServerServeParams['authorizer']): ServiceHandler;

package/lib/index.js

@@ -0,0 +1,227 @@
+import { serve } from '@enkaku/server';
+import { normalizeDID } from '@kokuin/token';
+import { toHandlerError } from '@kubun/protocol';
+import { ServiceAuthorizationError } from './authorizer.js';
+export { authorizeRead, authorizeWrite, createCallerMayActFor, SERVICE_ACT_FOR_ACTION, ServiceAuthorizationError, serviceUserResource } from './authorizer.js';
+// The registry kind under which service providers register.
+const SERVICE_KIND = 'service';
+/**
+ * A configured service name resolves to a `service` provider that was never
+ * registered. `true`/`{ rules }` both require a provider; only `{ handlers }`
+ * may name an unregistered service.
+ */ export class UnknownServiceError extends Error {
+    #service;
+    constructor(service){
+        super(`No "service" provider registered for "${service}"`);
+        this.name = 'UnknownServiceError';
+        this.#service = service;
+    }
+    get service() {
+        return this.#service;
+    }
+}
+/**
+ * A custom service (`{ handlers }`) reuses the name of a provider-registered
+ * service. A custom impl must not shadow a registered one — the name is the
+ * collision.
+ */ export class ServiceNameCollisionError extends Error {
+    #service;
+    constructor(service){
+        super(`Custom service "${service}" collides with a provider-registered service of the same name`);
+        this.name = 'ServiceNameCollisionError';
+        this.#service = service;
+    }
+    get service() {
+        return this.#service;
+    }
+}
+/**
+ * Two served services expose the same fully-qualified procedure name. The merged
+ * handler map would silently drop one, so it is a serve-time error.
+ */ export class ServiceProcedureCollisionError extends Error {
+    #procedure;
+    constructor(procedure){
+        super(`Procedure "${procedure}" is exposed by more than one served service`);
+        this.name = 'ServiceProcedureCollisionError';
+        this.#procedure = procedure;
+    }
+    get procedure() {
+        return this.#procedure;
+    }
+}
+/**
+ * Apply the config resolution table for one `[name, config]` entry against the
+ * set of provider-registered services. Returns the service to serve, or `null`
+ * when the entry serves nothing (a disabled or no-op entry). Throws the named
+ * error for the collision / unknown-service cells.
+ */ function resolveService(name, config, providers) {
+    const provider = providers.get(name);
+    // Boolean toggles a provider-registered service.
+    if (typeof config === 'boolean') {
+        if (!config) {
+            // `false`: registered-but-disabled, or a plain no-op when unregistered.
+            return null;
+        }
+        if (provider == null) {
+            throw new UnknownServiceError(name);
+        }
+        return {
+            handlers: provider.handlers,
+            rules: provider.accessRules ?? {}
+        };
+    }
+    // Discriminate the object form by EXPLICIT key, never by shape-sniffing.
+    const isCustom = 'handlers' in config && config.handlers != null;
+    if (isCustom) {
+        // A custom impl must not shadow a provider-registered service.
+        if (provider != null) {
+            throw new ServiceNameCollisionError(name);
+        }
+        return {
+            handlers: config.handlers,
+            rules: config.rules ?? {}
+        };
+    }
+    // `{ rules }` (override) or `{}` (≡ `true`): both require a provider.
+    if (provider == null) {
+        throw new UnknownServiceError(name);
+    }
+    return {
+        handlers: provider.handlers,
+        rules: config.rules ?? provider.accessRules ?? {}
+    };
+}
+/**
+ * Creates the service-server host plugin.
+ *
+ * The host owns the Enkaku serve core extracted from the RPC plugin: per-serve it
+ * collects the engine's `service` providers, applies the per-serve `services`
+ * config against them, merges the selected handlers/access-rules, and serves the
+ * union over the given transport with per-message `did:kokuin:` signature
+ * verification (`methods = [controllerResolverFor(db)]`, pre-transaction).
+ */ export function createServiceServerPlugin(options) {
+    return (params)=>{
+        const servers = [];
+        const engine = params.engine;
+        // Same pre-transaction, deadlock-free position as the RPC plugin: Enkaku's
+        // per-message signature verification runs before any handler opens a write
+        // transaction, so resolving a `did:kokuin:` controller over the base db is
+        // correct here.
+        const methods = options?.methods ?? [
+            params.controllerResolverFor(params.db)
+        ];
+        const api = {
+            serve: (serveParams)=>{
+                const { transport, services, authorizer, signal, requireAuth } = serveParams;
+                const providerList = engine.getProvidersSync(SERVICE_KIND);
+                const providers = new Map();
+                for (const provider of providerList){
+                    providers.set(provider.name, provider);
+                }
+                // Compose the merged handler map + access rules for THIS serve. Each
+                // service's handlers are wrapped so the per-serve authorizer rides the
+                // handler's call context; a trivial handler simply ignores it.
+                const mergedHandlers = {};
+                const mergedRules = {};
+                for (const [name, config] of Object.entries(services)){
+                    const selected = resolveService(name, config, providers);
+                    if (selected == null) {
+                        continue;
+                    }
+                    for (const [procedure, handler] of Object.entries(selected.handlers)){
+                        if (procedure in mergedHandlers) {
+                            throw new ServiceProcedureCollisionError(procedure);
+                        }
+                        mergedHandlers[procedure] = wrapHandler(procedure, handler, authorizer);
+                    }
+                    Object.assign(mergedRules, selected.rules);
+                }
+                // Build serve params exactly like the RPC plugin. The merged protocol is
+                // the union of the served services' procedures, unknown statically — the
+                // handler map is cast to Enkaku's `ProcedureHandlers` at this one seam,
+                // where each concrete service otherwise keeps its own typed protocol.
+                const baseParams = {
+                    runtime: params.runtime,
+                    handlers: mergedHandlers,
+                    logger: params.getLogger('service-server'),
+                    signal,
+                    transport,
+                    resolver: options?.resolver,
+                    methods
+                };
+                // `requireAuth: false` serves the same merged procedures with no signature
+                // requirement (unauthenticated local mode); it omits `identity`/`accessRules`.
+                const enkakuServeParams = requireAuth === false ? {
+                    ...baseParams,
+                    requireAuth: false
+                } : {
+                    ...baseParams,
+                    identity: params.identity,
+                    accessRules: mergedRules
+                };
+                const server = serve(enkakuServeParams);
+                servers.push(server);
+                return server;
+            }
+        };
+        return {
+            name: 'service-server',
+            api,
+            dispose: async ()=>{
+                for (const server of servers){
+                    await server.dispose();
+                }
+            }
+        };
+    };
+}
+// Absent an explicit per-serve authorizer, a caller may act only for ITSELF: a
+// missing authorizer is safe (self-only), never open. A verified device signing
+// as its own controller DID is the shared-identity path; anything else needs a
+// configured authorizer to grant it.
+const selfOnlyAuthorizer = ({ iss, subject })=>subject == null || normalizeDID(iss) === normalizeDID(subject);
+/**
+ * Wrap a service handler so the host — not the caller — supplies the verified
+ * `iss` and the `procedure` name to the per-serve authorizer, and so a forged
+ * subject is rejected before the handler body runs.
+ *
+ * The verified caller is the signed payload's `iss`. A payload `sub` that differs
+ * from `iss` is a forged-subject attempt (running as someone else) and is
+ * rejected outright, mirroring the RPC plugin's `resolveViewerDID`. The handler
+ * receives a bound `authorize(subject)` that calls the per-serve authorizer with
+ * host-supplied `{ iss, procedure }`; a handler cannot spoof either.
+ */ export function wrapHandler(procedure, handler, authorizer) {
+    const check = authorizer ?? selfOnlyAuthorizer;
+    return async (context)=>{
+        // One gate: apply authz context, then translate on throw. A refusal carrying a
+        // registered code (KB07 from `ServiceAuthorizationError`) forwards to the caller
+        // as that well-known code; an uncoded internal throw stays opaque, its message
+        // never leaving the device.
+        try {
+            const payload = context.message?.payload;
+            const iss = payload?.iss;
+            if (payload?.sub != null && payload.sub !== iss) {
+                throw new ServiceAuthorizationError('signed payload subject does not match issuer');
+            }
+            const authorize = async (subject)=>{
+                // No verified caller (the `accessRules: false` local mode): a subject-scoped
+                // action cannot be authorized, so only self-acting (no subject) is allowed.
+                if (iss == null) {
+                    return subject == null;
+                }
+                return await check({
+                    iss,
+                    procedure,
+                    subject
+                });
+            };
+            return await handler({
+                ...context,
+                iss,
+                authorize
+            });
+        } catch (cause) {
+            throw toHandlerError(cause);
+        }
+    };
+}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@kubun/plugin-service-server",
+  "version": "0.14.0",
+  "license": "see LICENSE.md",
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib/*",
+    "LICENSE.md"
+  ],
+  "dependencies": {
+    "@enkaku/protocol": "^0.21.0",
+    "@enkaku/server": "^0.21.2",
+    "@kokuin/capability": "^0.3.0",
+    "@kokuin/token": "^0.5.0",
+    "@kubun/engine": "^0.14.0",
+    "@kubun/plugin-service-api": "^0.14.0",
+    "@kubun/protocol": "^0.14.0"
+  },
+  "devDependencies": {
+    "@enkaku/client": "^0.21.0",
+    "@enkaku/transport": "^0.21.0",
+    "@kokuin/controller": "^0.1.0",
+    "@kubun/db": "^0.14.0",
+    "@kubun/store-controller": "^0.14.0",
+    "@kubun/store-graph": "^0.14.0",
+    "@kubun/test-utils": "^0.13.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
+    "build:clean": "del lib",
+    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
+    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "test": "pnpm run test:types && pnpm run test:unit",
+    "test:types": "tsc --noEmit -p tsconfig.test.json",
+    "test:unit": "vitest run"
+  }
+}