@loomup/astro 0.1.2 → 0.1.4

package/dist/auth.d.ts

@@ -8,6 +8,8 @@ export type LoomupAuthEndpointContext = {
 export type LoomupAuthHandlerOptions = CreateServerClientOptions & {
     /** Catch-all Astro parameter name. Default: `loomup`. */
     param?: string;
+    /** Exact application callback URL allowlisted in `$auth.redirect_urls`. */
+    oauthCallbackUrl?: string;
 };
 /**
  * Create one Astro catch-all endpoint for login, logout, session hydration,

package/dist/auth.js

@@ -1,12 +1,20 @@
 /** Same-origin Astro auth endpoint for Loomup-backed applications. */
 import { LoomupError } from "@loomup/client";
-import { createServerClient, } from "./server.js";
+import { readTokens, writeTokens } from "./cookies.js";
+import { createServerClient, resolveServerUrl, } from "./server.js";
+const OAUTH_VERIFIER_COOKIE = "loomup-oauth-verifier";
+const OAUTH_RETURN_COOKIE = "loomup-oauth-return";
 function response(data, status = 200) {
     return Response.json(data, {
         status,
         headers: { "Cache-Control": "private, no-store" },
     });
 }
+function localErrorRedirect(returnTo, error) {
+    const destination = new URL(returnTo, "http://loomup.local");
+    destination.searchParams.set("error", error);
+    return `${destination.pathname}${destination.search}${destination.hash}`;
+}
 async function jsonBody(request) {
     try {
         const value = await request.json();
@@ -24,8 +32,180 @@ function assertSameOrigin(request) {
         throw new LoomupError("cross-origin auth mutation rejected", "forbidden", 403);
     }
 }
-function publicSession(user, accessToken) {
-    return { data: { user, access_token: accessToken } };
+function publicSession(user) {
+    return { data: { user } };
+}
+function joinUrl(base, path) {
+    return `${base.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
+}
+function upstreamCookie(headers, name) {
+    const extended = headers;
+    const values = typeof extended.getSetCookie === "function"
+        ? extended.getSetCookie()
+        : typeof extended.getAll === "function"
+            ? extended.getAll("Set-Cookie")
+            : [headers.get("Set-Cookie") ?? ""];
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const pattern = new RegExp(`(?:^|,\\s*)${escaped}=([^;]*)`);
+    for (const value of values) {
+        const match = pattern.exec(value);
+        if (match?.[1])
+            return match[1].replace(/^"|"$/g, "");
+    }
+    return undefined;
+}
+async function upstreamRequest(baseUrl, method, path, body, accessToken, serviceKey) {
+    const headers = { Accept: "application/json" };
+    if (body !== undefined)
+        headers["Content-Type"] = "application/json";
+    if (accessToken || serviceKey)
+        headers.Authorization = `Bearer ${accessToken ?? serviceKey}`;
+    const upstream = await fetch(joinUrl(baseUrl, path), {
+        method,
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    const text = await upstream.text();
+    let payload;
+    try {
+        payload = text ? JSON.parse(text) : null;
+    }
+    catch {
+        payload = null;
+    }
+    const envelope = payload;
+    if (!upstream.ok) {
+        const message = envelope?.error?.message ?? envelope?.message ?? text ?? upstream.statusText;
+        const code = envelope?.error?.code;
+        throw new LoomupError(String(message || upstream.statusText), typeof code === "string" ? code : undefined, upstream.status);
+    }
+    if (!envelope || !("data" in envelope)) {
+        throw new LoomupError("invalid response from Loomup", "invalid_response", 502);
+    }
+    return { data: envelope.data, response: upstream };
+}
+async function authExchange(baseUrl, cookies, options, path, body, currentRefresh) {
+    const { data, response: upstream } = await upstreamRequest(baseUrl, "POST", path, body, undefined, options.client?.serviceKey);
+    const accessToken = typeof data.access_token === "string"
+        ? data.access_token
+        : upstreamCookie(upstream.headers, "loomup_access");
+    const refreshToken = typeof data.refresh_token === "string"
+        ? data.refresh_token
+        : upstreamCookie(upstream.headers, "loomup_refresh") ?? currentRefresh;
+    if (!accessToken || !refreshToken) {
+        throw new LoomupError("Loomup auth response did not include a complete session", "invalid_response", 502);
+    }
+    writeTokens(cookies, {
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_in: typeof data.expires_in === "number" ? data.expires_in : undefined,
+    }, options.cookies);
+    return { accessToken, user: data.user };
+}
+async function userForAccess(baseUrl, accessToken) {
+    const { data } = await upstreamRequest(baseUrl, "GET", "/auth/me", undefined, accessToken);
+    return data;
+}
+async function sessionFromCookies(baseUrl, cookies, options) {
+    const tokens = readTokens(cookies, options.cookies?.names);
+    if (tokens.access) {
+        try {
+            return { accessToken: tokens.access, user: await userForAccess(baseUrl, tokens.access) };
+        }
+        catch (error) {
+            if (!(error instanceof LoomupError) || error.status !== 401 || !tokens.refresh)
+                throw error;
+        }
+    }
+    if (!tokens.refresh) {
+        throw new LoomupError("authentication required", "unauthorized", 401);
+    }
+    const session = await authExchange(baseUrl, cookies, options, "/auth/refresh", { refresh_token: tokens.refresh }, tokens.refresh);
+    return {
+        accessToken: session.accessToken,
+        user: session.user ?? (await userForAccess(baseUrl, session.accessToken)),
+    };
+}
+const REQUEST_HEADERS = [
+    "accept",
+    "content-type",
+    "idempotency-key",
+    "if-match",
+    "if-none-match",
+    "if-modified-since",
+    "range",
+    "x-loomup-upsert",
+];
+const RESPONSE_HEADERS = [
+    "accept-ranges",
+    "cache-control",
+    "content-disposition",
+    "content-range",
+    "content-type",
+    "etag",
+    "last-modified",
+];
+function proxyPath(action) {
+    const path = action.slice("data".length).replace(/^\/+/, "");
+    if (!path)
+        throw new LoomupError("missing Loomup API path", "not_found", 404);
+    const segments = path.split("/");
+    if (segments.some((segment) => segment === "." || segment === ".." || segment.includes("\\"))) {
+        throw new LoomupError("invalid Loomup API path", "invalid_input", 400);
+    }
+    if (path.startsWith("auth/") && path !== "auth/me") {
+        throw new LoomupError("use the Astro auth endpoint", "forbidden", 403);
+    }
+    if (path.startsWith("account/")) {
+        throw new LoomupError("use the Astro account endpoint", "forbidden", 403);
+    }
+    return `/${path}`;
+}
+async function proxyToLoomup(context, options, baseUrl, action) {
+    const method = context.request.method.toUpperCase();
+    if (!["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"].includes(method)) {
+        return response({ error: { code: "method_not_allowed" } }, 405);
+    }
+    if (method !== "GET" && method !== "HEAD")
+        assertSameOrigin(context.request);
+    let tokens = readTokens(context.cookies, options.cookies?.names);
+    if (!tokens.access) {
+        if (!tokens.refresh) {
+            throw new LoomupError("authentication required", "unauthorized", 401);
+        }
+        await authExchange(baseUrl, context.cookies, options, "/auth/refresh", { refresh_token: tokens.refresh }, tokens.refresh);
+        tokens = readTokens(context.cookies, options.cookies?.names);
+    }
+    if (!tokens.access) {
+        throw new LoomupError("authentication required", "unauthorized", 401);
+    }
+    const requestHeaders = new Headers();
+    for (const name of REQUEST_HEADERS) {
+        const value = context.request.headers.get(name);
+        if (value)
+            requestHeaders.set(name, value);
+    }
+    requestHeaders.set("Authorization", `Bearer ${tokens.access}`);
+    const incomingUrl = new URL(context.request.url);
+    const targetUrl = `${joinUrl(baseUrl, proxyPath(action))}${incomingUrl.search}`;
+    const upstream = await fetch(targetUrl, {
+        method,
+        headers: requestHeaders,
+        body: method === "GET" || method === "HEAD" ? undefined : context.request.body,
+        redirect: "manual",
+    });
+    const responseHeaders = new Headers();
+    for (const name of RESPONSE_HEADERS) {
+        const value = upstream.headers.get(name);
+        if (value)
+            responseHeaders.set(name, value);
+    }
+    responseHeaders.set("Cache-Control", upstream.headers.get("Cache-Control") ?? "private, no-store");
+    return new Response(upstream.body, {
+        status: upstream.status,
+        statusText: upstream.statusText,
+        headers: responseHeaders,
+    });
 }
 /**
  * Create one Astro catch-all endpoint for login, logout, session hydration,
@@ -43,41 +223,105 @@ export function createLoomupAuthHandler(options = {}) {
     const param = options.param ?? "loomup";
     return async (context) => {
         const action = context.params?.[param]?.replace(/^\/+|\/+$/g, "") ?? "";
+        const url = resolveServerUrl(options.url);
         const client = createServerClient(context.cookies, options);
         try {
+            if (action === "data" || action.startsWith("data/")) {
+                return await proxyToLoomup(context, options, url, action);
+            }
             switch (action) {
+                case "oauth/start": {
+                    assertSameOrigin(context.request);
+                    if (!options.oauthCallbackUrl) {
+                        throw new LoomupError("oauthCallbackUrl is required", "oauth_misconfigured", 500);
+                    }
+                    const body = await jsonBody(context.request);
+                    const provider = String(body.provider ?? "");
+                    if (!["google", "apple", "github"].includes(provider)) {
+                        throw new LoomupError("supported OAuth provider required", "invalid_input", 400);
+                    }
+                    const requestedReturn = String(body.returnTo ?? "/");
+                    const returnTo = requestedReturn.startsWith("/") && !requestedReturn.startsWith("//")
+                        ? requestedReturn
+                        : "/";
+                    const loomup = (await import("@loomup/client")).createClient({
+                        url,
+                        serviceKey: options.client?.serviceKey,
+                    });
+                    const authorization = await loomup.auth.authorizeOAuth({
+                        provider: provider,
+                        redirectTo: options.oauthCallbackUrl,
+                    });
+                    const secure = options.cookies?.secure ?? process.env.NODE_ENV === "production";
+                    const cookieOptions = { path: "/", httpOnly: true, sameSite: "lax", secure, maxAge: 600 };
+                    context.cookies.set(OAUTH_VERIFIER_COOKIE, authorization.code_verifier, cookieOptions);
+                    context.cookies.set(OAUTH_RETURN_COOKIE, encodeURIComponent(returnTo), cookieOptions);
+                    return new Response(null, { status: 302, headers: { Location: authorization.authorization_url } });
+                }
+                case "oauth/callback": {
+                    const callback = new URL(context.request.url);
+                    const code = callback.searchParams.get("code");
+                    const providerError = callback.searchParams.get("error");
+                    const verifier = context.cookies.get(OAUTH_VERIFIER_COOKIE)?.value;
+                    const encodedReturn = context.cookies.get(OAUTH_RETURN_COOKIE)?.value;
+                    let returnTo = "/";
+                    try {
+                        const candidate = decodeURIComponent(encodedReturn ?? "/");
+                        if (candidate.startsWith("/") && !candidate.startsWith("//"))
+                            returnTo = candidate;
+                    }
+                    catch { /* default */ }
+                    if (providerError && verifier) {
+                        context.cookies.delete(OAUTH_VERIFIER_COOKIE, { path: "/" });
+                        context.cookies.delete(OAUTH_RETURN_COOKIE, { path: "/" });
+                        return new Response(null, { status: 302, headers: { Location: localErrorRedirect(returnTo, providerError) } });
+                    }
+                    if (!code || !verifier) {
+                        throw new LoomupError("OAuth callback is incomplete", "oauth_flow_expired", 400);
+                    }
+                    await authExchange(url, context.cookies, options, "/auth/oauth/exchange", {
+                        code,
+                        code_verifier: verifier,
+                    });
+                    context.cookies.delete(OAUTH_VERIFIER_COOKIE, { path: "/" });
+                    context.cookies.delete(OAUTH_RETURN_COOKIE, { path: "/" });
+                    return new Response(null, { status: 302, headers: { Location: returnTo } });
+                }
                 case "session": {
                     if (context.request.method !== "GET") {
                         return response({ error: { code: "method_not_allowed" } }, 405);
                     }
-                    const user = await client.auth.me();
-                    return response(publicSession(user, client.accessToken));
+                    const session = await sessionFromCookies(url, context.cookies, options);
+                    return response(publicSession(session.user));
                 }
                 case "refresh": {
                     assertSameOrigin(context.request);
-                    const tokens = await client.auth.refresh();
-                    const user = tokens.user ?? (await client.auth.me());
-                    return response(publicSession(user, tokens.access_token));
+                    const refreshToken = readTokens(context.cookies, options.cookies?.names).refresh;
+                    if (!refreshToken)
+                        throw new LoomupError("no refresh token", "no_refresh", 401);
+                    const session = await authExchange(url, context.cookies, options, "/auth/refresh", { refresh_token: refreshToken }, refreshToken);
+                    const user = session.user ?? (await userForAccess(url, session.accessToken));
+                    return response(publicSession(user));
                 }
                 case "login": {
                     assertSameOrigin(context.request);
                     const body = await jsonBody(context.request);
-                    const tokens = await client.auth.signIn({
+                    const session = await authExchange(url, context.cookies, options, "/auth/login", {
                         email: String(body.email ?? ""),
                         password: String(body.password ?? ""),
                     });
-                    const user = tokens.user ?? (await client.auth.me());
-                    return response(publicSession(user, tokens.access_token));
+                    const user = session.user ?? (await userForAccess(url, session.accessToken));
+                    return response(publicSession(user));
                 }
                 case "register": {
                     assertSameOrigin(context.request);
                     const body = await jsonBody(context.request);
-                    const tokens = await client.auth.signUp({
+                    const session = await authExchange(url, context.cookies, options, "/auth/register", {
                         email: String(body.email ?? ""),
                         password: String(body.password ?? ""),
                     });
-                    const user = tokens.user ?? (await client.auth.me());
-                    return response(publicSession(user, tokens.access_token), 201);
+                    const user = session.user ?? (await userForAccess(url, session.accessToken));
+                    return response(publicSession(user), 201);
                 }
                 case "logout": {
                     assertSameOrigin(context.request);
@@ -89,15 +333,15 @@ export function createLoomupAuthHandler(options = {}) {
                     const body = await jsonBody(context.request);
                     const currentPassword = String(body.currentPassword ?? "");
                     const newPassword = String(body.newPassword ?? "");
-                    const user = await client.auth.me();
-                    await client.request("POST", "/account/api/change-password", {
-                        current_password: currentPassword,
-                        new_password: newPassword,
-                    });
+                    const current = await sessionFromCookies(url, context.cookies, options);
+                    await upstreamRequest(url, "POST", "/account/api/change-password", { current_password: currentPassword, new_password: newPassword }, current.accessToken);
                     // The core revokes every refresh session on password change. Issue a
                     // fresh current session so the browser does not fail on its next 401.
-                    const tokens = await client.auth.signIn({ email: user.email, password: newPassword });
-                    return response(publicSession(tokens.user ?? user, tokens.access_token));
+                    const session = await authExchange(url, context.cookies, options, "/auth/login", {
+                        email: current.user.email,
+                        password: newPassword,
+                    });
+                    return response(publicSession(session.user ?? current.user));
                 }
                 case "password-reset/request": {
                     assertSameOrigin(context.request);

package/dist/client.d.ts

@@ -33,9 +33,11 @@ export declare function createBrowserClient<TMap extends DefaultTableMap = Defau
 }, TUpdateMap extends DefaultUpdateMap = {
     [K in keyof TMap]: Partial<TMap[K]> & Record<string, unknown>;
 }>(options?: CreateBrowserClientOptions): LoomupClient<TMap, TInsertMap, TUpdateMap>;
-export type CreateAuthenticatedProjectOptions = CreateBrowserClientOptions & {
+export type CreateAuthenticatedProjectOptions = {
     /** Same-origin catch-all endpoint. Default: `/api/loomup`. */
     authEndpoint?: string;
+    /** Same-origin data gateway. Default: `<authEndpoint>/data`. */
+    dataEndpoint?: string;
     fetch?: typeof fetch;
 };
 export type AuthenticatedProject<TMap, TInsertMap, TUpdateMap> = {
@@ -44,8 +46,8 @@ export type AuthenticatedProject<TMap, TInsertMap, TUpdateMap> = {
     signOut(): Promise<void>;
 };
 /**
- * Hydrate the typed `db.issues` project client without exposing the refresh
- * token to JavaScript. Access-token renewal goes through the Astro endpoint.
+ * Hydrate the typed `db.issues` project client through Astro's same-origin
+ * data gateway. Loomup's URL and both session tokens remain server-only.
  */
 export declare function createAuthenticatedProject<TMap = DefaultTableMap, TInsertMap = {
     [K in keyof TMap]: Partial<TMap[K]> & Record<string, unknown>;

package/dist/client.js

@@ -65,23 +65,24 @@ async function authRequest(fetchImpl, endpoint, action, init) {
     return payload.data ?? {};
 }
 /**
- * Hydrate the typed `db.issues` project client without exposing the refresh
- * token to JavaScript. Access-token renewal goes through the Astro endpoint.
+ * Hydrate the typed `db.issues` project client through Astro's same-origin
+ * data gateway. Loomup's URL and both session tokens remain server-only.
  */
 export async function createAuthenticatedProject(options = {}) {
     const fetchImpl = options.fetch ?? globalThis.fetch;
     const endpoint = options.authEndpoint ?? "/api/loomup";
     const session = await authRequest(fetchImpl, endpoint, "session", { method: "GET" });
-    if (!session.user || !session.access_token) {
+    if (!session.user) {
         throw new LoomupError("authenticated session required", "unauthorized", 401);
     }
     const db = createProject({
-        url: resolveBrowserUrl(options.url),
-        token: session.access_token,
-        WebSocketImpl: options.WebSocketImpl,
+        url: options.dataEndpoint ?? `${endpoint.replace(/\/$/, "")}/data`,
         accessTokenProvider: async () => {
-            const refreshed = await authRequest(fetchImpl, endpoint, "refresh", { method: "POST" });
-            return refreshed.access_token;
+            await authRequest(fetchImpl, endpoint, "refresh", { method: "POST" });
+            // The core client requires a truthy retry signal. This marker is sent
+            // only to the same-origin gateway, which replaces Authorization with
+            // the server-held access token.
+            return "server-session";
         },
     });
     return {

package/dist/server.d.ts

@@ -2,7 +2,7 @@
  * Server-side Loomup client for Astro (SSR frontmatter, endpoints, middleware).
  * Persists access/refresh tokens in httpOnly cookies.
  */
-import { LoomupClient, type AuthTokens, type CreateClientOptions, type DefaultTableMap, type LoomupProject } from "@loomup/client";
+import { LoomupClient, type AuthTokens, type AuthSignUpResult, type CreateClientOptions, type DefaultTableMap, type LoomupProject, type OAuthAuthorizeInput, type OAuthExchangeInput } from "@loomup/client";
 import { type CookieOptions, type CookieStore } from "./cookies.js";
 export type { CookieNames, CookieOptions, CookieStore, CookieWriteOptions, } from "./cookies.js";
 export { DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, clearTokens, readTokens, resolveCookieNames, writeTokens, } from "./cookies.js";
@@ -25,6 +25,7 @@ export type CreateServerClientOptions = {
      */
     client?: Omit<CreateClientOptions, "url" | "token" | "refreshToken">;
 };
+export declare function resolveServerUrl(explicit?: string): string;
 /**
  * Cookie-backed Loomup client for Astro SSR.
  * Extends the core client so `.from()`, `.request()`, etc. stay identical.
@@ -47,12 +48,13 @@ export declare class ServerLoomupClient<TMap = DefaultTableMap, TInsertMap = {
     signUp(creds: {
         email: string;
         password: string;
-    }): Promise<AuthTokens>;
+    }): Promise<AuthSignUpResult>;
     signIn(creds: {
         email: string;
         password: string;
     }): Promise<AuthTokens>;
     refresh(): Promise<AuthTokens>;
+    exchangeOAuthCode(input: OAuthExchangeInput): Promise<AuthTokens>;
     signOut(): Promise<void>;
     setToken(token: string | undefined): void;
     setRefreshToken(token: string | undefined): void;
@@ -64,11 +66,11 @@ export declare class ServerLoomupClient<TMap = DefaultTableMap, TInsertMap = {
         signUp: (creds: {
             email: string;
             password: string;
-        }) => Promise<AuthTokens>;
+        }) => Promise<AuthSignUpResult>;
         register: (creds: {
             email: string;
             password: string;
-        }) => Promise<AuthTokens>;
+        }) => Promise<AuthSignUpResult>;
         signIn: (creds: {
             email: string;
             password: string;
@@ -77,6 +79,20 @@ export declare class ServerLoomupClient<TMap = DefaultTableMap, TInsertMap = {
             email: string;
             password: string;
         }) => Promise<AuthTokens>;
+        oauthProviders: () => Promise<import("@loomup/client").OAuthProviderInfo[]>;
+        authorizeOAuth: (input: OAuthAuthorizeInput) => Promise<import("@loomup/client").OAuthAuthorization>;
+        exchangeOAuthCode: (input: OAuthExchangeInput) => Promise<AuthTokens>;
+        resendVerification: (email: string) => Promise<import("@loomup/client").AuthActionResult>;
+        confirmVerification: (token: string) => Promise<AuthTokens>;
+        requestPasswordReset: (email: string) => Promise<import("@loomup/client").AuthActionResult>;
+        confirmPasswordReset: (input: {
+            token: string;
+            password: string;
+        }) => Promise<import("@loomup/client").AuthActionResult>;
+        acceptInvitation: (input: {
+            token: string;
+            password: string;
+        }) => Promise<AuthTokens>;
         signOut: () => Promise<void>;
         logout: () => Promise<void>;
         me: () => Promise<import("@loomup/client").User>;

package/dist/server.js

@@ -7,7 +7,7 @@ import { asCookieStore, clearTokens, readTokens, writeTokens, } from "./cookies.
 export { DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, clearTokens, readTokens, resolveCookieNames, writeTokens, } from "./cookies.js";
 export { LoomupError, createClient, StorageBucket, encodeObjectPath, normalizeStorageUpload, } from "@loomup/client";
 export { fileAndPathFromFormData, uploadFromFormData, storageDownloadResponse, } from "./objectStorage.js";
-function resolveServerUrl(explicit) {
+export function resolveServerUrl(explicit) {
     if (explicit)
         return explicit;
     if (typeof process !== "undefined") {
@@ -43,7 +43,8 @@ export class ServerLoomupClient extends LoomupClient {
     }
     async signUp(creds) {
         const data = await super.signUp(creds);
-        this.persistFromTokens(data);
+        if ("access_token" in data)
+            this.persistFromTokens(data);
         return data;
     }
     async signIn(creds) {
@@ -56,6 +57,11 @@ export class ServerLoomupClient extends LoomupClient {
         this.persistFromTokens(data);
         return data;
     }
+    async exchangeOAuthCode(input) {
+        const data = await super.exchangeOAuthCode(input);
+        this.persistFromTokens(data);
+        return data;
+    }
     async signOut() {
         await super.signOut();
         this.clearCookieTokens();
@@ -87,6 +93,14 @@ export class ServerLoomupClient extends LoomupClient {
             register: (creds) => this.signUp(creds),
             signIn: (creds) => this.signIn(creds),
             login: (creds) => this.signIn(creds),
+            oauthProviders: () => this.oauthProviders(),
+            authorizeOAuth: (input) => this.authorizeOAuth(input),
+            exchangeOAuthCode: (input) => this.exchangeOAuthCode(input),
+            resendVerification: (email) => this.resendEmailVerification(email),
+            confirmVerification: (token) => this.confirmEmailVerification(token),
+            requestPasswordReset: (email) => this.requestPasswordReset(email),
+            confirmPasswordReset: (input) => this.confirmPasswordReset(input),
+            acceptInvitation: (input) => this.acceptInvitation(input),
             signOut: () => this.signOut(),
             logout: () => this.signOut(),
             me: () => this.me(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomup/astro",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Astro integration and SSR helpers for Loomup Realtime",
   "type": "module",
   "main": "dist/index.js",