@magield/collectors 0.0.0-stage → 0.7.1

package/dist/signals/webrtc.js

@@ -0,0 +1,168 @@
+import { hash } from '../hash.js';
+/**
+ * What the WebRTC stack says about the network beneath the browser.
+ *
+ * In `INVASIVE_COLLECTORS` rather than the default set. No permission prompt is
+ * involved — candidate gathering needs none — but this reads the shape of
+ * somebody's home network, which is about the person rather than the browser.
+ *
+ * ## What it is for
+ *
+ * A candidate is a route the browser would accept media on, and the set of them
+ * describes the path out:
+ *
+ *   `host`  an address on the machine itself
+ *   `srflx` the address a STUN server saw, which is the real public egress
+ *   `relay` a TURN relay, meaning nothing direct worked
+ *
+ * The `srflx` address is the one that matters, and it is the reason this is
+ * worth collecting: it is observed by a third party rather than asserted by the
+ * client, so a proxy that rewrites HTTP headers does not move it. A request
+ * whose HTTP address is residential while its `srflx` address belongs to a
+ * datacentre is a contradiction the header cannot produce on its own.
+ *
+ * ## What it mostly gets, in practice
+ *
+ * Browsers have spent years closing this. Chrome replaces host candidates with
+ * an mDNS name — a random `.local` hostname regenerated per origin — so the
+ * classic "local IP leak" is gone by default. Firefox does the same under
+ * `resistFingerprinting`.
+ *
+ * That is recorded rather than worked around: `webrtc.mdns` says the
+ * obfuscation is active, which is itself a fact about the browser, and no local
+ * address is reported when there is none to report. What survives is the
+ * candidate *shape* — how many of each type, whether a relay was needed,
+ * whether gathering completed at all — and the public address, which is not
+ * obfuscated because a STUN server has to know it for the protocol to work.
+ */
+/**
+ * A public STUN server, used only to learn the reflexive address.
+ *
+ * This is an outbound request from the visitor's browser to a third party, and
+ * it is the reason this collector is opt-in even though it prompts for nothing.
+ * Google's is used because it is the one every WebRTC application already
+ * contacts, so it adds no new party to a connection the browser makes anyway —
+ * but a deployment that would rather not can run its own and change this line.
+ */
+const STUN = 'stun:stun.l.google.com:19302';
+/** Short: gathering usually settles in well under this, and the wave has a budget. */
+const GATHER_TIMEOUT_MS = 700;
+export const webrtcCollector = {
+    id: 'webrtc',
+    wave: 'deep',
+    optional: true,
+    async collect({ window }) {
+        const out = {};
+        const Ctor = window.RTCPeerConnection ??
+            window.webkitRTCPeerConnection;
+        if (Ctor === undefined) {
+            // Present and null: the probe ran and the API is absent, which is a
+            // different fact from the collector never running.
+            out['webrtc.supported'] = false;
+            out['webrtc.candidates'] = null;
+            return out;
+        }
+        out['webrtc.supported'] = true;
+        let connection;
+        try {
+            connection = new Ctor({ iceServers: [{ urls: STUN }] });
+            // A data channel is what makes the browser gather at all. Nothing is
+            // sent on it and no media device is touched.
+            connection.createDataChannel('probe');
+            const candidates = [];
+            const gathered = new Promise((resolve) => {
+                let settled = false;
+                const finish = () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    resolve();
+                };
+                connection?.addEventListener('icecandidate', (event) => {
+                    // A null candidate is the end-of-gathering marker, not a failure.
+                    if (event.candidate === null)
+                        return finish();
+                    if (event.candidate.candidate !== '')
+                        candidates.push(event.candidate.candidate);
+                });
+                setTimeout(finish, GATHER_TIMEOUT_MS);
+            });
+            const offer = await connection.createOffer();
+            await connection.setLocalDescription(offer);
+            await gathered;
+            summarise(candidates, out);
+        }
+        catch {
+            out['webrtc.candidates'] = null;
+        }
+        finally {
+            try {
+                connection?.close();
+            }
+            catch {
+                // A connection that will not close is not worth a thrown signal.
+            }
+        }
+        return out;
+    },
+};
+/** IPv4 and IPv6 both, since a candidate line carries either. */
+const ADDRESS = /(?:\d{1,3}\.){3}\d{1,3}|(?:[0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}/i;
+function summarise(candidates, out) {
+    out['webrtc.candidates'] = candidates.length;
+    if (candidates.length === 0) {
+        // Gathering produced nothing. Common in containers with no usable
+        // interface, and common behind a firewall that drops STUN — so it is
+        // reported as a count rather than inferred into a verdict.
+        out['webrtc.mdns'] = null;
+        out['webrtc.publicIp'] = null;
+        return;
+    }
+    let host = 0;
+    let srflx = 0;
+    let relay = 0;
+    let mdns = 0;
+    const publicAddresses = new Set();
+    const localAddresses = new Set();
+    for (const line of candidates) {
+        const type = /\btyp\s+(\w+)/.exec(line)?.[1] ?? '';
+        if (type === 'host')
+            host++;
+        else if (type === 'srflx')
+            srflx++;
+        else if (type === 'relay')
+            relay++;
+        // Chrome substitutes a per-origin random hostname for host candidates, so
+        // the address field reads `<uuid>.local` rather than an address.
+        if (line.includes('.local')) {
+            mdns++;
+            continue;
+        }
+        const address = ADDRESS.exec(line)?.[0];
+        if (address === undefined)
+            continue;
+        if (type === 'host')
+            localAddresses.add(address);
+        else if (type === 'srflx' || type === 'relay')
+            publicAddresses.add(address);
+    }
+    out['webrtc.host'] = host;
+    out['webrtc.srflx'] = srflx;
+    out['webrtc.relay'] = relay;
+    // True when the browser is obfuscating host candidates, which is the default
+    // on current Chrome. A fact about the browser, not a failure of the probe.
+    out['webrtc.mdns'] = mdns > 0;
+    // The reflexive address: observed by a third party rather than asserted by
+    // the client, which is what makes it worth comparing against the HTTP one.
+    const [first] = [...publicAddresses].sort();
+    out['webrtc.publicIp'] = first ?? null;
+    // Local addresses are hashed rather than reported. The count and stability
+    // are what a check would read — whether the machine has one interface or
+    // twelve, and whether that changed — and the addresses themselves describe
+    // somebody's home network without adding anything to that.
+    out['webrtc.localCount'] = localAddresses.size;
+    out['webrtc.localHash'] = localAddresses.size === 0 ? null : hash([...localAddresses].sort().join(','));
+    // No direct route was usable. Ordinary on a locked-down corporate network,
+    // and also what a relayed or heavily proxied connection looks like.
+    out['webrtc.relayOnly'] = relay > 0 && srflx === 0;
+}

package/dist/stable-core.d.ts

@@ -0,0 +1,128 @@
+import type { SignalValue } from './types.js';
+/**
+ * The stable core: what a device still looks like after it clears storage.
+ *
+ * The device id lives in cookies, localStorage and IndexedDB, so it is gone the
+ * moment someone opens a private window or clears site data — and with it goes
+ * every limit keyed on the device, including the credential-stuffing defence.
+ * That is not a bug in the storage layer; it is what private browsing *is*.
+ *
+ * The answer is a second, weaker identifier built only from signals that do not
+ * depend on storage at all: the GPU, the rendering stack, the CPU class, the
+ * screen. Those are the same in a private window as outside one.
+ *
+ * ## What is deliberately excluded
+ *
+ * Anything that changes on its own. A browser version, a window size, a
+ * connection type — include those and the core shifts under a returning user,
+ * which is the failure that makes a fingerprint useless: it stops recognising
+ * the people it is supposed to recognise.
+ *
+ * ## The privacy tension, stated plainly
+ *
+ * This links a private window to ordinary browsing on the same machine. Someone
+ * using a private window is often specifically trying to prevent that. There is
+ * no version of this that is both effective against storage clearing and
+ * respectful of the intent behind it — the two are the same act.
+ *
+ * So it is: hashed with the tenant salt before it is stored, never shared
+ * between tenants, suppressed entirely under `consent: 'deferred'`, and
+ * individually disableable. And it is weaker evidence than a real device id by
+ * design — enough to notice one device trying forty accounts, not enough to
+ * treat as identity.
+ */
+/**
+ * Signals that survive a storage wipe and do not drift.
+ *
+ * Ordered for readability; the hash sorts them.
+ */
+declare const STABLE_KEYS: readonly ["webgl.renderer", "webgl.vendor", "webgl.parametersHash", "webgl.fragmentHighFloat", "math.quirksHash", "err.nullAccessMessage", "screen.colorDepth", "screen.devicePixelRatio", "nav.hardwareConcurrency", "nav.deviceMemory", "nav.maxTouchPoints", "nav.platform", "tz.timezone"];
+/**
+ * Keys left out, with the reason — so the next person to add one has to argue
+ * with something.
+ *
+ *   nav.userAgent        moves on every browser update
+ *   features.hash        moves on every browser update
+ *   screen.innerWidth    moves when the window is resized
+ *   screen.chromeHeight  needs focus, and moves with the toolbar
+ *   nav.languages        a user can change it, and some browsers reorder it
+ *   canvas.stable        a property of the browser's privacy settings, not the device
+ *   nav.connectionType   changes with the network, which is the point of it
+ *
+ * The next three were in the core until a measurement removed them. Safari 26,
+ * same machine, normal versus private browsing:
+ *
+ *   canvas.hash     9cabb395 -> ec0c368d
+ *   screen.width    1728     -> 1340
+ *   screen.height   1117     ->  823
+ *
+ * Everything else was identical, so a core without these three would have
+ * matched — and with them it could not.
+ *
+ *   canvas.hash     Safari's fingerprinting protection seeds canvas noise **per
+ *                   session**. Two renders inside one session agree, so
+ *                   `canvas.stable` reports true and the noise check below does
+ *                   not fire. There is no in-session test that detects this;
+ *                   the only reliable answer is to keep rendered output out of
+ *                   a core that has to survive privacy modes.
+ *
+ *   screen.width    Safari private reports the *viewport* as the screen: 1340x823
+ *   screen.height   were exactly innerWidth and innerHeight. So these are not a
+ *                   different screen, they are a spoof — and one that moves
+ *                   again whenever the window is resized.
+ */
+export declare const EXCLUDED_FROM_CORE: readonly ["nav.userAgent", "features.hash", "screen.innerWidth", "screen.chromeHeight", "nav.languages", "canvas.stable", "nav.connectionType", "canvas.hash", "screen.width", "screen.height"];
+export interface StableCore {
+    readonly hash: string;
+    /** How many of the stable keys were actually present. */
+    readonly present: number;
+    readonly total: number;
+    /** The exact values that went into the hash, so two captures can be diffed. */
+    readonly parts: Readonly<Record<string, SignalValue>>;
+    /** A randomised signal was detected and left out, lowering the core's entropy. */
+    readonly noiseExcluded: boolean;
+    /**
+     * Below this, the hash is too thin to relink on — a handful of common values
+     * would collide across unrelated devices, and a wrong link is worse than none.
+     */
+    readonly usable: boolean;
+}
+/**
+ * Signals a browser may randomise between two reads in the same session.
+ *
+ * Kept as a guard even though canvas is no longer in the core, because the same
+ * per-read randomisation could appear on another signal — and because it
+ * catches Brave, which farbles per read rather than per session.
+ *
+ * It does **not** catch Safari, whose noise is seeded once per session: two
+ * renders agree, the check passes, and the value still differs the next time
+ * the browser is opened. That is why canvas was removed outright rather than
+ * guarded. An in-session test cannot detect a per-session seed.
+ */
+declare const NOISE_TARGETS: readonly ["canvas.hash"];
+export declare function stableCore(signals: Readonly<Record<string, SignalValue>>): StableCore;
+/**
+ * The machine, separated from the browser running on it.
+ *
+ * Two tiers because they decay at different rates, and the difference between
+ * them is itself information. A browser update changes the engine tier and
+ * leaves the hardware tier alone; a new laptop changes both. Hashing all
+ * thirteen keys together means any single change mints a brand-new identity,
+ * so a returning customer who updated Chrome looks exactly like a stranger.
+ *
+ * The hardware tier is what a device-keyed limit should key on: it survives a
+ * cleared profile *and* a browser update, which is the combination a
+ * credential-stuffing run produces on purpose.
+ */
+declare const HARDWARE_KEYS: readonly ["webgl.renderer", "webgl.vendor", "webgl.parametersHash", "webgl.fragmentHighFloat", "screen.colorDepth", "screen.devicePixelRatio", "nav.hardwareConcurrency", "nav.deviceMemory", "nav.maxTouchPoints"];
+/** The build and its configuration: everything that moves when the browser does. */
+declare const BROWSER_KEYS: readonly ["math.quirksHash", "err.nullAccessMessage", "nav.platform", "tz.timezone"];
+export interface CoreTier {
+    readonly hash: string;
+    readonly present: number;
+    readonly total: number;
+    readonly usable: boolean;
+}
+export declare function hardwareCore(signals: Readonly<Record<string, SignalValue>>): CoreTier;
+export declare function browserCore(signals: Readonly<Record<string, SignalValue>>): CoreTier;
+export { STABLE_KEYS, NOISE_TARGETS, HARDWARE_KEYS, BROWSER_KEYS };

package/dist/stable-core.js

@@ -0,0 +1,187 @@
+import { hashRecord } from './hash.js';
+/**
+ * The stable core: what a device still looks like after it clears storage.
+ *
+ * The device id lives in cookies, localStorage and IndexedDB, so it is gone the
+ * moment someone opens a private window or clears site data — and with it goes
+ * every limit keyed on the device, including the credential-stuffing defence.
+ * That is not a bug in the storage layer; it is what private browsing *is*.
+ *
+ * The answer is a second, weaker identifier built only from signals that do not
+ * depend on storage at all: the GPU, the rendering stack, the CPU class, the
+ * screen. Those are the same in a private window as outside one.
+ *
+ * ## What is deliberately excluded
+ *
+ * Anything that changes on its own. A browser version, a window size, a
+ * connection type — include those and the core shifts under a returning user,
+ * which is the failure that makes a fingerprint useless: it stops recognising
+ * the people it is supposed to recognise.
+ *
+ * ## The privacy tension, stated plainly
+ *
+ * This links a private window to ordinary browsing on the same machine. Someone
+ * using a private window is often specifically trying to prevent that. There is
+ * no version of this that is both effective against storage clearing and
+ * respectful of the intent behind it — the two are the same act.
+ *
+ * So it is: hashed with the tenant salt before it is stored, never shared
+ * between tenants, suppressed entirely under `consent: 'deferred'`, and
+ * individually disableable. And it is weaker evidence than a real device id by
+ * design — enough to notice one device trying forty accounts, not enough to
+ * treat as identity.
+ */
+/**
+ * Signals that survive a storage wipe and do not drift.
+ *
+ * Ordered for readability; the hash sorts them.
+ */
+const STABLE_KEYS = [
+    // Rendering stack. These are strings the driver reports, not rendered output,
+    // which is what makes them survive fingerprinting protection.
+    'webgl.renderer',
+    'webgl.vendor',
+    'webgl.parametersHash',
+    'webgl.fragmentHighFloat',
+    // Engine and libm quirks: constant for a given browser build on given hardware.
+    'math.quirksHash',
+    'err.nullAccessMessage',
+    // Physical machine — the properties privacy modes leave alone.
+    'screen.colorDepth',
+    'screen.devicePixelRatio',
+    'nav.hardwareConcurrency',
+    'nav.deviceMemory',
+    'nav.maxTouchPoints',
+    // Configuration a user rarely changes and never mid-session.
+    'nav.platform',
+    'tz.timezone',
+];
+/**
+ * Keys left out, with the reason — so the next person to add one has to argue
+ * with something.
+ *
+ *   nav.userAgent        moves on every browser update
+ *   features.hash        moves on every browser update
+ *   screen.innerWidth    moves when the window is resized
+ *   screen.chromeHeight  needs focus, and moves with the toolbar
+ *   nav.languages        a user can change it, and some browsers reorder it
+ *   canvas.stable        a property of the browser's privacy settings, not the device
+ *   nav.connectionType   changes with the network, which is the point of it
+ *
+ * The next three were in the core until a measurement removed them. Safari 26,
+ * same machine, normal versus private browsing:
+ *
+ *   canvas.hash     9cabb395 -> ec0c368d
+ *   screen.width    1728     -> 1340
+ *   screen.height   1117     ->  823
+ *
+ * Everything else was identical, so a core without these three would have
+ * matched — and with them it could not.
+ *
+ *   canvas.hash     Safari's fingerprinting protection seeds canvas noise **per
+ *                   session**. Two renders inside one session agree, so
+ *                   `canvas.stable` reports true and the noise check below does
+ *                   not fire. There is no in-session test that detects this;
+ *                   the only reliable answer is to keep rendered output out of
+ *                   a core that has to survive privacy modes.
+ *
+ *   screen.width    Safari private reports the *viewport* as the screen: 1340x823
+ *   screen.height   were exactly innerWidth and innerHeight. So these are not a
+ *                   different screen, they are a spoof — and one that moves
+ *                   again whenever the window is resized.
+ */
+export const EXCLUDED_FROM_CORE = [
+    'nav.userAgent',
+    'features.hash',
+    'screen.innerWidth',
+    'screen.chromeHeight',
+    'nav.languages',
+    'canvas.stable',
+    'nav.connectionType',
+    'canvas.hash',
+    'screen.width',
+    'screen.height',
+];
+const MINIMUM_KEYS = 8;
+/**
+ * Signals a browser may randomise between two reads in the same session.
+ *
+ * Kept as a guard even though canvas is no longer in the core, because the same
+ * per-read randomisation could appear on another signal — and because it
+ * catches Brave, which farbles per read rather than per session.
+ *
+ * It does **not** catch Safari, whose noise is seeded once per session: two
+ * renders agree, the check passes, and the value still differs the next time
+ * the browser is opened. That is why canvas was removed outright rather than
+ * guarded. An in-session test cannot detect a per-session seed.
+ */
+const NOISE_TARGETS = ['canvas.hash'];
+export function stableCore(signals) {
+    const present = {};
+    // `canvas.stable` is the collector rendering twice and comparing. False means
+    // the browser is injecting noise, and we already know not to trust it.
+    const canvasRandomised = signals['canvas.stable'] === false;
+    for (const key of STABLE_KEYS) {
+        if (canvasRandomised && NOISE_TARGETS.includes(key))
+            continue;
+        const value = signals[key];
+        if (value !== undefined && value !== null && value !== '')
+            present[key] = value;
+    }
+    const count = Object.keys(present).length;
+    return {
+        hash: hashRecord(present),
+        present: count,
+        total: STABLE_KEYS.length,
+        parts: present,
+        noiseExcluded: canvasRandomised,
+        // A core built from three values is not an identifier, it is a coincidence
+        // waiting to happen. Saying so is cheaper than explaining a wrong link.
+        usable: count >= MINIMUM_KEYS,
+    };
+}
+/**
+ * The machine, separated from the browser running on it.
+ *
+ * Two tiers because they decay at different rates, and the difference between
+ * them is itself information. A browser update changes the engine tier and
+ * leaves the hardware tier alone; a new laptop changes both. Hashing all
+ * thirteen keys together means any single change mints a brand-new identity,
+ * so a returning customer who updated Chrome looks exactly like a stranger.
+ *
+ * The hardware tier is what a device-keyed limit should key on: it survives a
+ * cleared profile *and* a browser update, which is the combination a
+ * credential-stuffing run produces on purpose.
+ */
+const HARDWARE_KEYS = [
+    'webgl.renderer',
+    'webgl.vendor',
+    'webgl.parametersHash',
+    'webgl.fragmentHighFloat',
+    'screen.colorDepth',
+    'screen.devicePixelRatio',
+    'nav.hardwareConcurrency',
+    'nav.deviceMemory',
+    'nav.maxTouchPoints',
+];
+/** The build and its configuration: everything that moves when the browser does. */
+const BROWSER_KEYS = ['math.quirksHash', 'err.nullAccessMessage', 'nav.platform', 'tz.timezone'];
+/** Hardware needs fewer keys to be worth trusting, because each carries more. */
+const MINIMUM_HARDWARE_KEYS = 5;
+function tier(signals, keys, minimum) {
+    const present = {};
+    for (const key of keys) {
+        const value = signals[key];
+        if (value !== undefined && value !== null && value !== '')
+            present[key] = value;
+    }
+    const count = Object.keys(present).length;
+    return { hash: hashRecord(present), present: count, total: keys.length, usable: count >= minimum };
+}
+export function hardwareCore(signals) {
+    return tier(signals, HARDWARE_KEYS, MINIMUM_HARDWARE_KEYS);
+}
+export function browserCore(signals) {
+    return tier(signals, BROWSER_KEYS, 2);
+}
+export { STABLE_KEYS, NOISE_TARGETS, HARDWARE_KEYS, BROWSER_KEYS };

package/dist/types.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Collectors run in three budgeted waves so a protected action is never
+ * delayed. A wave that exceeds its budget is abandoned and reported, never
+ * awaited — a slow fingerprint is worse than a missing one.
+ *
+ * See docs/signals.md section 1.
+ */
+export type Wave = 'instant' | 'warm' | 'deep';
+/**
+ * How long each wave may take before the rest of it is skipped.
+ *
+ * Generous on purpose. A budget is a ceiling, not a cost: a fast device
+ * finishes the instant wave in a few milliseconds and never comes near it. The
+ * ceiling exists for the slow device, and the old one (instant 5 ms, warm
+ * 60 ms) was set against desktop timings — a mid-range phone runs these several
+ * times slower and lost half its signals, bot detection among them. The total a
+ * protected action waits is still capped by the SDK's `timeoutMs`.
+ */
+export declare const WAVE_BUDGET_MS: Record<Wave, number>;
+/** Everything a collector is allowed to touch, injected rather than global. */
+export interface CollectorEnv {
+    readonly window: Window & typeof globalThis;
+    readonly navigator: Navigator;
+    readonly document: Document;
+    readonly screen: Screen;
+    readonly performance: Performance;
+}
+export type SignalValue = string | number | boolean | null;
+export interface Collector {
+    readonly id: string;
+    readonly wave: Wave;
+    /**
+     * The tenant may switch this off without it counting as missing evidence.
+     *
+     * Disabling a required collector lowers confidence, because the signal is
+     * genuinely absent. Disabling an optional one does not: it is a choice the
+     * product offered, and charging confidence for taking it means penalising a
+     * tenant for using their own privacy control on every request thereafter.
+     *
+     * Says nothing about a collector that ran and found nothing. That is a real
+     * absence and still counts.
+     */
+    readonly optional?: boolean;
+    collect(env: CollectorEnv): Promise<Record<string, SignalValue>> | Record<string, SignalValue>;
+}
+export interface CollectionResult {
+    readonly signals: Record<string, SignalValue>;
+    readonly durationMs: number;
+    /** Collectors that threw, timed out, or were disabled. */
+    readonly skipped: readonly string[];
+    readonly errors: readonly string[];
+    /** 0..1 — how much of the expected signal set was actually obtained. */
+    readonly confidence: number;
+}

package/dist/types.js

@@ -0,0 +1,15 @@
+/**
+ * How long each wave may take before the rest of it is skipped.
+ *
+ * Generous on purpose. A budget is a ceiling, not a cost: a fast device
+ * finishes the instant wave in a few milliseconds and never comes near it. The
+ * ceiling exists for the slow device, and the old one (instant 5 ms, warm
+ * 60 ms) was set against desktop timings — a mid-range phone runs these several
+ * times slower and lost half its signals, bot detection among them. The total a
+ * protected action waits is still capped by the SDK's `timeoutMs`.
+ */
+export const WAVE_BUDGET_MS = {
+    instant: 60,
+    warm: 200,
+    deep: 400,
+};

package/package.json

@@ -1,6 +1,34 @@
 {
   "name": "@magield/collectors",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.7.1",
+  "description": "Browser signal collectors used by the Magic Shield web SDK",
+  "license": "SEE LICENSE IN LICENSE",
+  "files": [
+    "dist",
+    "!**/*.map",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck:tests": "tsc -p tsconfig.test.json",
+    "test": "vitest run",
+    "clean": "rm -rf dist .turbo"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.