@objectstack/types 17.0.0-rc.1 → 17.0.0-rc.3

package/CHANGELOG.md

@@ -1,5 +1,169 @@
 # @objectstack/types
 
+## 17.0.0-rc.3
+
+### Patch Changes
+
+- Updated dependencies [2e284b2]
+  - @objectstack/spec@17.0.0-rc.3
+
+## 17.0.0-rc.2
+
+### Minor Changes
+
+- b25a116: fix(verify): resolve the enterprise organizations package from the HOST APP (#4700)
+
+  `bootStack(app, { multiTenant: true })` — and therefore `objectstack verify
+--multi-tenant` — could never load `@objectstack/organizations`. Node ESM
+  resolves a bare `import()` against the **importer's own realpath**, which for
+  `packages/verify` is inside the framework workspace, while the enterprise
+  package is cloud-private and only ever lives in the verified app's
+  `node_modules`. Every real host app fell into the catch and was told to
+  "Install/link it in this workspace" — about a package it had already installed.
+  Same defect class as cloud#1013, which fixed `objectstack serve`; #4699 fixed
+  that one call site and this issue tracked the two the sweep left behind.
+
+  **New: `@objectstack/types/node`.** The host-app resolver (`createHostRequire` /
+  `createHostImporter`) moved out of `packages/cli/src/utils/import-from-host.ts`
+  — where `@objectstack/verify` and the dogfood suite could not import it without
+  inverting the dependency direction — into a **node-only subpath export** of
+  `@objectstack/types`. One behaviour, one source; the CLI now consumes it and its
+  private copy is deleted.
+
+  It is a subpath and **not** the root export because `@objectstack/types` is a
+  dependency of `@objectstack/hono` ("edge-compatible REST API server for
+  Cloudflare Workers, Deno, Bun, and Node") and of the plugin layer a `LiteKernel`
+  boots on Workers. The root entry reaches zero `node:` builtins, and a Workers
+  bundle breaks on `node:module` even when nothing calls it. `tsup` emits the two
+  entries as separate self-contained bundles (`splitting: false`), and a test
+  walks the root's import graph and fails on the first reachable `node:`
+  specifier, so the isolation is enforced rather than merely intended. Same
+  arrangement `@objectstack/metadata` already ships for its `./node` subpath.
+
+  **New: `BootOptions.hostRoot`** (optional, defaults to `process.cwd()`) names
+  the app whose `node_modules` supplies those optional packages — for a harness
+  booting an app that is not the working directory.
+
+  **The dogfood multi-org gates had never run.** Two suites probed availability
+  with the same bare `import()` and so were **constant-false** — not "false
+  because absent" but false by construction, in every environment including the
+  cloud CI whose comment claimed it ran them. The #1994 cross-tenant RLS proof and
+  the attachments cross-tenant isolation block had therefore never executed while
+  the suite reported green (Prime Directive #10, test-suite edition). They now
+  resolve like the runtime does, and `OS_TEST_MULTI_ORG_ENABLED=1` declares that a
+  run is expected to ship the package — turning a silent skip into a loud failure,
+  so a run can no longer pass by quietly not running the gates it exists for.
+
+### Patch Changes
+
+- Updated dependencies [430dcc2]
+- Updated dependencies [e6ac4bd]
+- Updated dependencies [80334c7]
+- Updated dependencies [ce5242c]
+- Updated dependencies [a7163ea]
+- Updated dependencies [e6e9379]
+- Updated dependencies [98877c9]
+- Updated dependencies [98877c9]
+- Updated dependencies [e6b1b69]
+- Updated dependencies [ad047d2]
+- Updated dependencies [2826d1e]
+- Updated dependencies [5a84d41]
+- Updated dependencies [20b1a9e]
+- Updated dependencies [203a449]
+- Updated dependencies [ac37fc6]
+- Updated dependencies [4820f55]
+- Updated dependencies [462d9c4]
+- Updated dependencies [7d21581]
+- Updated dependencies [f2445c9]
+- Updated dependencies [23338c3]
+- Updated dependencies [5b843fb]
+- Updated dependencies [b4487aa]
+- Updated dependencies [65ca83a]
+- Updated dependencies [67bf2e2]
+- Updated dependencies [c6d1cb4]
+- Updated dependencies [36030ff]
+- Updated dependencies [6117f7b]
+- Updated dependencies [e533b0b]
+- Updated dependencies [cdf4d9a]
+- Updated dependencies [aee1806]
+- Updated dependencies [c13350b]
+- Updated dependencies [c13350b]
+- Updated dependencies [9ca2d85]
+- Updated dependencies [c13350b]
+- Updated dependencies [891d345]
+- Updated dependencies [a52e2ef]
+- Updated dependencies [5293114]
+- Updated dependencies [20bc357]
+- Updated dependencies [5966c2a]
+- Updated dependencies [2382580]
+- Updated dependencies [d9fa683]
+- Updated dependencies [3c7bcc0]
+- Updated dependencies [4b6cac7]
+- Updated dependencies [7631964]
+- Updated dependencies [ac471a0]
+- Updated dependencies [60ae58e]
+- Updated dependencies [ce92674]
+- Updated dependencies [9f601e8]
+- Updated dependencies [51c5227]
+- Updated dependencies [a4a85c8]
+- Updated dependencies [07a4e26]
+- Updated dependencies [ec975f1]
+- Updated dependencies [eb4204b]
+- Updated dependencies [4f13be2]
+- Updated dependencies [61cc079]
+- Updated dependencies [0e96e46]
+- Updated dependencies [d52d4fe]
+- Updated dependencies [742cebb]
+- Updated dependencies [ce92674]
+- Updated dependencies [cf2c9b7]
+- Updated dependencies [0f9faa2]
+- Updated dependencies [7cf42fe]
+- Updated dependencies [5966c2a]
+- Updated dependencies [f78dd83]
+- Updated dependencies [a2cd18a]
+- Updated dependencies [4638aaa]
+- Updated dependencies [0222d3c]
+- Updated dependencies [0a936ea]
+- Updated dependencies [023c00b]
+- Updated dependencies [155507e]
+- Updated dependencies [7bba90b]
+- Updated dependencies [7e05d8e]
+- Updated dependencies [061406d]
+- Updated dependencies [c1f344b]
+- Updated dependencies [9c93465]
+- Updated dependencies [ebb209c]
+- Updated dependencies [63b33e6]
+- Updated dependencies [2a44c1d]
+- Updated dependencies [695cfbd]
+- Updated dependencies [7445149]
+- Updated dependencies [071d0dc]
+- Updated dependencies [0848bea]
+- Updated dependencies [d51bed2]
+- Updated dependencies [b8b3c64]
+- Updated dependencies [0c0fbd9]
+- Updated dependencies [f3141d8]
+- Updated dependencies [5a84d41]
+- Updated dependencies [fd3013a]
+- Updated dependencies [21676eb]
+- Updated dependencies [e336549]
+- Updated dependencies [d40f43a]
+- Updated dependencies [e5e7ee0]
+- Updated dependencies [a2ebea2]
+- Updated dependencies [800bdb0]
+- Updated dependencies [04f1182]
+- Updated dependencies [5647006]
+- Updated dependencies [38f7e4f]
+- Updated dependencies [c57f3cf]
+- Updated dependencies [97faca3]
+- Updated dependencies [ad5fe25]
+- Updated dependencies [ea90179]
+- Updated dependencies [ce92674]
+- Updated dependencies [5ef0b5b]
+- Updated dependencies [48fbacb]
+- Updated dependencies [355e951]
+- Updated dependencies [dadb43f]
+  - @objectstack/spec@17.0.0-rc.2
+
 ## 17.0.0-rc.1
 
 ### Minor Changes

package/dist/node.d.mts

@@ -0,0 +1,28 @@
+/**
+ * Imports a package as the host app would see it.
+ *
+ * `any` is the module namespace of a package this repo does not compile against
+ * (it is not a dependency of the importing package at all) — every call site
+ * reads an export off it dynamically, exactly as the bare `import()` it replaces
+ * did.
+ */
+type HostImporter = (pkg: string) => Promise<any>;
+/**
+ * A `require` anchored at the **host app's** `package.json` — i.e. the project
+ * `objectstack serve` was invoked in, or the app `bootStack` is verifying, whose
+ * `node_modules` carries the packages it declares.
+ *
+ * @param hostRoot Directory holding the host app's `package.json` (default: the
+ * process CWD, which is where the CLI reads `objectstack.config.ts` from too).
+ */
+declare function createHostRequire(hostRoot?: string): NodeRequire;
+/**
+ * Build an importer that resolves from the host app first, then falls back to
+ * the importing package's own resolution.
+ *
+ * @param hostRequire Reuse an existing host `require` (callers usually also need
+ * it to read the host `package.json`); defaults to one anchored at the CWD.
+ */
+declare function createHostImporter(hostRequire?: NodeRequire): HostImporter;
+
+export { type HostImporter, createHostImporter, createHostRequire };

package/dist/node.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Imports a package as the host app would see it.
+ *
+ * `any` is the module namespace of a package this repo does not compile against
+ * (it is not a dependency of the importing package at all) — every call site
+ * reads an export off it dynamically, exactly as the bare `import()` it replaces
+ * did.
+ */
+type HostImporter = (pkg: string) => Promise<any>;
+/**
+ * A `require` anchored at the **host app's** `package.json` — i.e. the project
+ * `objectstack serve` was invoked in, or the app `bootStack` is verifying, whose
+ * `node_modules` carries the packages it declares.
+ *
+ * @param hostRoot Directory holding the host app's `package.json` (default: the
+ * process CWD, which is where the CLI reads `objectstack.config.ts` from too).
+ */
+declare function createHostRequire(hostRoot?: string): NodeRequire;
+/**
+ * Build an importer that resolves from the host app first, then falls back to
+ * the importing package's own resolution.
+ *
+ * @param hostRequire Reuse an existing host `require` (callers usually also need
+ * it to read the host `package.json`); defaults to one anchored at the CWD.
+ */
+declare function createHostImporter(hostRequire?: NodeRequire): HostImporter;
+
+export { type HostImporter, createHostImporter, createHostRequire };

package/dist/node.js

@@ -0,0 +1,52 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/node.ts
+var node_exports = {};
+__export(node_exports, {
+  createHostImporter: () => createHostImporter,
+  createHostRequire: () => createHostRequire
+});
+module.exports = __toCommonJS(node_exports);
+var import_node_module = require("module");
+var import_node_path = require("path");
+var import_node_url = require("url");
+function createHostRequire(hostRoot = process.cwd()) {
+  return (0, import_node_module.createRequire)((0, import_node_path.join)(hostRoot, "package.json"));
+}
+function createHostImporter(hostRequire = createHostRequire()) {
+  return async (pkg) => {
+    let resolved;
+    try {
+      resolved = hostRequire.resolve(pkg);
+    } catch {
+      return import(
+        /* webpackIgnore: true */
+        pkg
+      );
+    }
+    return import((0, import_node_url.pathToFileURL)(resolved).href);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createHostImporter,
+  createHostRequire
+});
+//# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/node.ts"],"sourcesContent":["// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * `@objectstack/types/node` — the **node-only** slice of the shared utilities.\n *\n * WHY A SUBPATH AND NOT THE ROOT EXPORT. `@objectstack/types` is a dependency of\n * `@objectstack/hono`, whose whole reason to exist is \"edge-compatible REST API\n * server for Cloudflare Workers, Deno, Bun, and Node\" — and of the plugin/service\n * layer a `LiteKernel` boots on Workers. The root entry (`src/index.ts`) reaches\n * **zero** `node:` builtins today, and that is a property those consumers depend\n * on: a Workers bundle that pulls in `node:module` fails to build (or dies at\n * first call) even when nothing ever invokes it. Everything here needs\n * `node:module` / `node:url` by definition — it exists to drive Node's own\n * resolver — so it lives behind its own entry point instead.\n *\n * The isolation is structural, not conventional: `tsup` builds `src/index.ts` and\n * `src/node.ts` as separate entries with `splitting: false`, so the root bundle\n * contains no reference to this file, and `node-isolation.test.ts` fails the\n * build if anything reachable from the root ever imports a `node:` builtin. Same\n * arrangement `@objectstack/metadata` already ships for `./node`.\n *\n * ── What lives here ──────────────────────────────────────────────────────────\n *\n * Resolving optional packages from the **host app**, not from the framework\n * package doing the importing.\n *\n * Node ESM resolves a bare `import('pkg')` against the **importer's own\n * realpath**. Framework packages (the CLI, `@objectstack/verify`,\n * `@objectstack/dogfood`) are reached through `link:`/workspace dependencies, so\n * their realpath is inside the *framework* workspace — a bare import from any of\n * them can only ever see packages installed in the framework's own\n * `node_modules`. Every package that lives OUTSIDE that workspace and is supplied\n * by the app being served, verified or tested — a cloud-private package such as\n * `@objectstack/organizations` or `@objectstack/service-ai-studio`, or anything a\n * customer installs into their own project — is therefore invisible to a bare\n * import, no matter what the host app declares in its `package.json`\n * (cloud#1013: `objectstack serve` could never load the enterprise multi-org\n * runtime, so every self-hosted walled-posture deployment hit the ADR-0093 D5\n * fail-fast and exited 1; framework#4700: `bootStack({ multiTenant: true })` told\n * apps to install a package they had already installed, and the dogfood\n * multi-org probes were constant-false).\n *\n * The fix is to resolve from the host app's root and import the resolved\n * absolute path. The importing package's own resolution stays as the fallback,\n * for the framework-owned packages it depends on and the host does not declare.\n *\n * Resolution failure is the ONLY thing that falls back. A package the host\n * resolves but that throws while it evaluates is a genuine crash and propagates\n * unchanged: re-importing it bare would replace the real cause with a\n * `MODULE_NOT_FOUND`, which every caller here classifies as \"not installed\" —\n * turning a broken package into a silent skip (or, on the organizations path,\n * into a fatal message telling the operator to install what is already there).\n */\n\nimport { createRequire } from 'node:module';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\n/**\n * Imports a package as the host app would see it.\n *\n * `any` is the module namespace of a package this repo does not compile against\n * (it is not a dependency of the importing package at all) — every call site\n * reads an export off it dynamically, exactly as the bare `import()` it replaces\n * did.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type HostImporter = (pkg: string) => Promise<any>;\n\n/**\n * A `require` anchored at the **host app's** `package.json` — i.e. the project\n * `objectstack serve` was invoked in, or the app `bootStack` is verifying, whose\n * `node_modules` carries the packages it declares.\n *\n * @param hostRoot Directory holding the host app's `package.json` (default: the\n * process CWD, which is where the CLI reads `objectstack.config.ts` from too).\n */\nexport function createHostRequire(hostRoot: string = process.cwd()): NodeRequire {\n  return createRequire(join(hostRoot, 'package.json'));\n}\n\n/**\n * Build an importer that resolves from the host app first, then falls back to\n * the importing package's own resolution.\n *\n * @param hostRequire Reuse an existing host `require` (callers usually also need\n * it to read the host `package.json`); defaults to one anchored at the CWD.\n */\nexport function createHostImporter(\n  hostRequire: NodeRequire = createHostRequire(),\n): HostImporter {\n  return async (pkg: string): Promise<any> => {\n    let resolved: string;\n    try {\n      resolved = hostRequire.resolve(pkg);\n    } catch {\n      // Invisible to the host app — try the importing package's own\n      // dependencies. A package neither can see throws MODULE_NOT_FOUND from\n      // here, which is what the callers' \"missing vs crashed\" classification\n      // expects.\n      return import(/* webpackIgnore: true */ pkg);\n    }\n    return import(pathToFileURL(resolved).href);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsDA,yBAA8B;AAC9B,uBAAqB;AACrB,sBAA8B;AAqBvB,SAAS,kBAAkB,WAAmB,QAAQ,IAAI,GAAgB;AAC/E,aAAO,sCAAc,uBAAK,UAAU,cAAc,CAAC;AACrD;AASO,SAAS,mBACd,cAA2B,kBAAkB,GAC/B;AACd,SAAO,OAAO,QAA8B;AAC1C,QAAI;AACJ,QAAI;AACF,iBAAW,YAAY,QAAQ,GAAG;AAAA,IACpC,QAAQ;AAKN,aAAO;AAAA;AAAA,QAAiC;AAAA;AAAA,IAC1C;AACA,WAAO,WAAO,+BAAc,QAAQ,EAAE;AAAA,EACxC;AACF;","names":[]}

package/dist/node.mjs

@@ -0,0 +1,26 @@
+// src/node.ts
+import { createRequire } from "module";
+import { join } from "path";
+import { pathToFileURL } from "url";
+function createHostRequire(hostRoot = process.cwd()) {
+  return createRequire(join(hostRoot, "package.json"));
+}
+function createHostImporter(hostRequire = createHostRequire()) {
+  return async (pkg) => {
+    let resolved;
+    try {
+      resolved = hostRequire.resolve(pkg);
+    } catch {
+      return import(
+        /* webpackIgnore: true */
+        pkg
+      );
+    }
+    return import(pathToFileURL(resolved).href);
+  };
+}
+export {
+  createHostImporter,
+  createHostRequire
+};
+//# sourceMappingURL=node.mjs.map

package/dist/node.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/node.ts"],"sourcesContent":["// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * `@objectstack/types/node` — the **node-only** slice of the shared utilities.\n *\n * WHY A SUBPATH AND NOT THE ROOT EXPORT. `@objectstack/types` is a dependency of\n * `@objectstack/hono`, whose whole reason to exist is \"edge-compatible REST API\n * server for Cloudflare Workers, Deno, Bun, and Node\" — and of the plugin/service\n * layer a `LiteKernel` boots on Workers. The root entry (`src/index.ts`) reaches\n * **zero** `node:` builtins today, and that is a property those consumers depend\n * on: a Workers bundle that pulls in `node:module` fails to build (or dies at\n * first call) even when nothing ever invokes it. Everything here needs\n * `node:module` / `node:url` by definition — it exists to drive Node's own\n * resolver — so it lives behind its own entry point instead.\n *\n * The isolation is structural, not conventional: `tsup` builds `src/index.ts` and\n * `src/node.ts` as separate entries with `splitting: false`, so the root bundle\n * contains no reference to this file, and `node-isolation.test.ts` fails the\n * build if anything reachable from the root ever imports a `node:` builtin. Same\n * arrangement `@objectstack/metadata` already ships for `./node`.\n *\n * ── What lives here ──────────────────────────────────────────────────────────\n *\n * Resolving optional packages from the **host app**, not from the framework\n * package doing the importing.\n *\n * Node ESM resolves a bare `import('pkg')` against the **importer's own\n * realpath**. Framework packages (the CLI, `@objectstack/verify`,\n * `@objectstack/dogfood`) are reached through `link:`/workspace dependencies, so\n * their realpath is inside the *framework* workspace — a bare import from any of\n * them can only ever see packages installed in the framework's own\n * `node_modules`. Every package that lives OUTSIDE that workspace and is supplied\n * by the app being served, verified or tested — a cloud-private package such as\n * `@objectstack/organizations` or `@objectstack/service-ai-studio`, or anything a\n * customer installs into their own project — is therefore invisible to a bare\n * import, no matter what the host app declares in its `package.json`\n * (cloud#1013: `objectstack serve` could never load the enterprise multi-org\n * runtime, so every self-hosted walled-posture deployment hit the ADR-0093 D5\n * fail-fast and exited 1; framework#4700: `bootStack({ multiTenant: true })` told\n * apps to install a package they had already installed, and the dogfood\n * multi-org probes were constant-false).\n *\n * The fix is to resolve from the host app's root and import the resolved\n * absolute path. The importing package's own resolution stays as the fallback,\n * for the framework-owned packages it depends on and the host does not declare.\n *\n * Resolution failure is the ONLY thing that falls back. A package the host\n * resolves but that throws while it evaluates is a genuine crash and propagates\n * unchanged: re-importing it bare would replace the real cause with a\n * `MODULE_NOT_FOUND`, which every caller here classifies as \"not installed\" —\n * turning a broken package into a silent skip (or, on the organizations path,\n * into a fatal message telling the operator to install what is already there).\n */\n\nimport { createRequire } from 'node:module';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\n/**\n * Imports a package as the host app would see it.\n *\n * `any` is the module namespace of a package this repo does not compile against\n * (it is not a dependency of the importing package at all) — every call site\n * reads an export off it dynamically, exactly as the bare `import()` it replaces\n * did.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type HostImporter = (pkg: string) => Promise<any>;\n\n/**\n * A `require` anchored at the **host app's** `package.json` — i.e. the project\n * `objectstack serve` was invoked in, or the app `bootStack` is verifying, whose\n * `node_modules` carries the packages it declares.\n *\n * @param hostRoot Directory holding the host app's `package.json` (default: the\n * process CWD, which is where the CLI reads `objectstack.config.ts` from too).\n */\nexport function createHostRequire(hostRoot: string = process.cwd()): NodeRequire {\n  return createRequire(join(hostRoot, 'package.json'));\n}\n\n/**\n * Build an importer that resolves from the host app first, then falls back to\n * the importing package's own resolution.\n *\n * @param hostRequire Reuse an existing host `require` (callers usually also need\n * it to read the host `package.json`); defaults to one anchored at the CWD.\n */\nexport function createHostImporter(\n  hostRequire: NodeRequire = createHostRequire(),\n): HostImporter {\n  return async (pkg: string): Promise<any> => {\n    let resolved: string;\n    try {\n      resolved = hostRequire.resolve(pkg);\n    } catch {\n      // Invisible to the host app — try the importing package's own\n      // dependencies. A package neither can see throws MODULE_NOT_FOUND from\n      // here, which is what the callers' \"missing vs crashed\" classification\n      // expects.\n      return import(/* webpackIgnore: true */ pkg);\n    }\n    return import(pathToFileURL(resolved).href);\n  };\n}\n"],"mappings":";AAsDA,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AACrB,SAAS,qBAAqB;AAqBvB,SAAS,kBAAkB,WAAmB,QAAQ,IAAI,GAAgB;AAC/E,SAAO,cAAc,KAAK,UAAU,cAAc,CAAC;AACrD;AASO,SAAS,mBACd,cAA2B,kBAAkB,GAC/B;AACd,SAAO,OAAO,QAA8B;AAC1C,QAAI;AACJ,QAAI;AACF,iBAAW,YAAY,QAAQ,GAAG;AAAA,IACpC,QAAQ;AAKN,aAAO;AAAA;AAAA,QAAiC;AAAA;AAAA,IAC1C;AACA,WAAO,OAAO,cAAc,QAAQ,EAAE;AAAA,EACxC;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/types",
-  "version": "17.0.0-rc.1",
+  "version": "17.0.0-rc.3",
   "license": "Apache-2.0",
   "description": "Shared interfaces describing the ObjectStack Runtime environment",
   "main": "dist/index.js",
@@ -10,10 +10,15 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.mjs",
       "require": "./dist/index.js"
+    },
+    "./node": {
+      "types": "./dist/node.d.ts",
+      "import": "./dist/node.mjs",
+      "require": "./dist/node.js"
     }
   },
   "dependencies": {
-    "@objectstack/spec": "17.0.0-rc.1"
+    "@objectstack/spec": "17.0.0-rc.3"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
@@ -45,7 +50,7 @@
     "node": ">=22.0.0"
   },
   "scripts": {
-    "build": "tsup --config ../../tsup.config.ts",
+    "build": "tsup",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
   }