@pulsebyshiga/node 0.2.0

package/dist/types.d.ts

@@ -0,0 +1,446 @@
+/**
+ * Wire types for the Pulse API. Two sections:
+ *
+ * 1. ENGINE API — reconciled 1:1 against the live public contract
+ *    (https://engine-api.shiga.io/swagger/public/index.html). These are real.
+ * 2. PROPOSED product extension — the collection-session/client-session/webhook
+ *    surface the embedded product needs; not yet in the engine (see
+ *    docs/engine-gap.md).
+ *
+ * Wire convention (both): snake_case JSON, decimal amounts as strings.
+ */
+/** Networks the engine supports today (uppercase on the wire). Non-EVM support is on the gap list. */
+export type EngineNetwork = 'BASE' | 'POLYGON' | 'ARBITRUM' | 'OPTIMISM' | 'ETHEREUM' | 'BSC';
+export type CreateQuoteParams = {
+    /** Decimal string in the source currency, e.g. "100.50". */
+    amount: string;
+    source_currency: string;
+    destination_currency: string;
+    network?: EngineNetwork;
+};
+/** A locked price. Orders are created FROM a quote (`quote_id`) before it expires. */
+export type Quote = {
+    id: string;
+    rate: string;
+    source_amount: string;
+    destination_amount: string;
+    expires_at: string;
+};
+export type CreateOfframpOrderParams = {
+    quote_id: string;
+    /** Partner's stable reference for the end user. */
+    customer_id: string;
+    customer_name: string;
+    customer_email: string;
+    /** Payout target — resolve via banks.resolve() (name enquiry) first. */
+    account_number: string;
+    account_name: string;
+    bank_code: string;
+    bank_name: string;
+};
+/** Crypto → fiat. The user sends stablecoin to `deposit_address`; fiat lands in the bank account. */
+export type OfframpOrder = {
+    id: string;
+    customer_id: string;
+    deposit_address: string;
+    /**
+     * Proposed: one deposit address per chain family so a single order serves every
+     * supported chain (one EVM address for all EVM chains, plus Solana, TON, …).
+     * Keyed by family or network name. Absent on today's single-address engine —
+     * `deposit_address` is the fallback. See docs/engine-gap.md.
+     */
+    deposit_addresses?: Record<string, string>;
+    source_amount: string;
+    source_currency: string;
+    destination_amount: string;
+    destination_currency: string;
+    quoted_rate: string;
+    /** Lifecycle value — the engine does not document the enum yet (gap list). */
+    status: string;
+    reference: string;
+    flow_type: string;
+    execution_mode: string;
+    metadata: Record<string, unknown>;
+    created_at: string;
+    updated_at: string;
+};
+export type CreateOnrampOrderParams = {
+    quote_id: string;
+    customer_id: string;
+    customer_name: string;
+    customer_email: string;
+    /** Wallet that receives the crypto once the fiat lands. */
+    destination_address: string;
+    destination_tag?: string;
+};
+/** Virtual bank account the end user pays into for an onramp order. */
+export type OnrampVirtualAccount = {
+    id: string;
+    account_name: string;
+    account_number: string;
+    bank_code: string;
+    bank_name: string;
+    amount: string;
+    provider: string;
+    provider_reference: string;
+    reference: string;
+    status: string;
+    type: string;
+    expires_at: string;
+    created_at: string;
+    updated_at: string;
+};
+/** Fiat → crypto. The user pays `account`; crypto is sent to `destination_address`. */
+export type OnrampOrder = {
+    id: string;
+    customer_id: string;
+    account: OnrampVirtualAccount;
+    destination_address: string;
+    source_amount: string;
+    source_currency: string;
+    destination_amount: string;
+    destination_currency: string;
+    quoted_rate: string;
+    /** Lifecycle value — the engine does not document the enum yet (gap list). */
+    status: string;
+    reference: string;
+    flow_type: string;
+    execution_mode: string;
+    metadata: Record<string, unknown>;
+    created_at: string;
+    updated_at: string;
+};
+export type Bank = {
+    /** NIP bank code. */
+    code: string;
+    name: string;
+};
+export type ResolveAccountParams = {
+    account_number: string;
+    bank_code: string;
+};
+export type VerifiedAccount = {
+    account_name: string;
+    account_number: string;
+    bank_code: string;
+    bank_name: string;
+};
+export type Gate = 'naira' | 'usd';
+/**
+ * Which way value flows. `offramp` = crypto in → fiat out (the collection
+ * product: user sends stablecoin, fiat settles to a bank account). `onramp` =
+ * fiat in → crypto out (user pays a virtual bank account, crypto is sent to a
+ * wallet). Defaults to `offramp` when a session omits it.
+ */
+export type CollectionDirection = 'offramp' | 'onramp';
+export type Asset = 'USDC' | 'USDT';
+/**
+ * Full network set per the approved design (business requirement). The
+ * per-partner ENABLED subset comes from Pulse config (R5.1) once it exists.
+ */
+export type Network = 'ethereum' | 'base' | 'polygon' | 'arbitrum' | 'optimism' | 'celo' | 'plasma' | 'solana' | 'ton';
+export type FiatCurrency = 'NGN' | 'USD';
+export type TargetAmount = {
+    currency: FiatCurrency;
+    amount: string;
+};
+/**
+ * Crypto side of a session, as an alternative to `target`: the amount of `asset`
+ * the user SENDS (offramp). The fiat target is derived from it. Exactly one of
+ * `target` / `source` is provided.
+ */
+export type SourceAmount = {
+    asset: Asset;
+    amount: string;
+};
+export type NairaAccountProvision = {
+    provision: true;
+    /** Sensitive — server-to-server only; never reaches the hosted flow. */
+    bvn: string;
+    /** Sensitive — server-to-server only; never reaches the hosted flow. */
+    nin: string;
+};
+export type NairaAccountReference = {
+    provision: false;
+    virtual_account_ref: string;
+};
+export type NairaAccount = NairaAccountProvision | NairaAccountReference;
+export type CreateNairaSessionParams = {
+    gate: 'naira';
+    /** Value direction; defaults to `offramp` (crypto in → fiat out). */
+    direction?: CollectionDirection;
+    /** Fiat side — provide this OR `source` (the crypto side). */
+    target?: TargetAmount;
+    /** Crypto side (offramp) — the amount of `asset` to send; fiat is derived. */
+    source?: SourceAmount;
+    asset: Asset;
+    network: Network;
+    /** Partner's stable reference for the end user. */
+    user_ref: string;
+    account: NairaAccount;
+    partner_ref?: string;
+};
+export type CreateUsdSessionParams = {
+    gate: 'usd';
+    /** Value direction; defaults to `offramp` (crypto in → fiat out). */
+    direction?: CollectionDirection;
+    /** Fiat side — provide this OR `source` (the crypto side). */
+    target?: TargetAmount;
+    /** Crypto side (offramp) — the amount of `asset` to send; fiat is derived. */
+    source?: SourceAmount;
+    asset: Asset;
+    network: Network;
+    partner_ref?: string;
+};
+export type CreateCollectionSessionParams = CreateNairaSessionParams | CreateUsdSessionParams;
+export type SessionQuote = {
+    /** Fiat per 1 asset unit, decimal string. */
+    rate: string;
+    asset: Asset;
+    /** Exact stablecoin amount the user must send. */
+    asset_amount: string;
+    locked_until: string;
+};
+export type OrderStatus = 'awaiting_payment' | 'deposit_detected' | 'deposit_confirmed' | 'converting' | 'converted_unsettled' | 'completed' | 'expired' | 'failed';
+export type AmountStatus = 'pending' | 'exact' | 'underpaid' | 'overpaid';
+export type Deposit = {
+    tx_hash: string;
+    /** On-chain detected amount — always the credited figure, never the quoted one. */
+    amount: string;
+    asset: Asset;
+    network: Network;
+    detected_at: string;
+    confirmed_at: string | null;
+};
+/**
+ * Funds detected on a network other than the order's. PROPOSED contract shape
+ * (PRD §10 wrong-chain row) — the real detection signal comes from Pulse;
+ * recovery policy is a [DECIDE] item.
+ */
+export type WrongChainDeposit = {
+    tx_hash: string;
+    amount: string;
+    asset: Asset;
+    /** Network the funds actually arrived on (may be outside the supported set). */
+    network: string;
+    detected_at: string;
+};
+export type Disbursement = {
+    settlement_ref: string;
+    currency: FiatCurrency;
+    amount: string;
+    /** Naira gate only; null for USD (partner omnibus). */
+    virtual_account_ref: string | null;
+    completed_at: string;
+};
+/**
+ * Onramp only: the virtual bank account the end user transfers fiat into.
+ * Mirrors the engine's onramp `account` (see docs/engine-gap.md). Null on
+ * offramp orders, where the user sends crypto to `deposit_address` instead.
+ */
+export type PayAccount = {
+    bank_name: string;
+    bank_code: string;
+    /** Optional bank logo (progressive enhancement; hidden if it fails to load). */
+    bank_logo_url?: string;
+    account_number: string;
+    account_name: string;
+    /** Fiat to transfer (equals target.amount), decimal string. */
+    amount: string;
+    expires_at: string;
+};
+export type CollectionSession = {
+    order_id: string;
+    /** Short-lived single-order token for the hosted flow. Returned once. */
+    session_token: string;
+    /** Unique per order — the attribution key. */
+    deposit_address: string;
+    /** Solana Pay URI (solana) or EIP-681 URI (EVM). */
+    qr_payload: string;
+    quote: SessionQuote;
+    status: OrderStatus;
+    created_at: string;
+};
+export type CollectionOrder = {
+    id: string;
+    gate: Gate;
+    direction: CollectionDirection;
+    status: OrderStatus;
+    amount_status: AmountStatus;
+    target: TargetAmount;
+    asset: Asset;
+    network: Network;
+    user_ref: string | null;
+    partner_ref: string | null;
+    /** Offramp: where the user sends crypto. Onramp: unused (see pay_account). */
+    deposit_address: string;
+    /**
+     * Offramp: deposit address per chain family/network when the engine returns
+     * them, so switching chains reuses the same order instead of creating a new
+     * one. Falls back to `deposit_address`. See `depositAddressFor`.
+     */
+    deposit_addresses?: Record<string, string>;
+    qr_payload: string;
+    /** Onramp: the virtual bank account to pay into. Null on offramp. */
+    pay_account: PayAccount | null;
+    quote: SessionQuote;
+    deposit: Deposit | null;
+    wrong_chain_deposit: WrongChainDeposit | null;
+    disbursement: Disbursement | null;
+    created_at: string;
+};
+/** Theme tokens as stored against the partner record (wire snake_case). */
+export type PartnerConfigTheme = {
+    primary_color?: string;
+    border_radius?: string;
+    mode?: 'light' | 'dark';
+    font_family?: string;
+    ink_color?: string;
+    muted_color?: string;
+    background_color?: string;
+    button_text_color?: string;
+    line_color?: string;
+    success_color?: string;
+    danger_color?: string;
+    page_background_color?: string;
+    density?: 'comfortable' | 'compact';
+};
+/** Copy overrides as stored against the partner record (wire snake_case). */
+export type PartnerConfigStrings = {
+    title?: string;
+    subtitle?: string;
+    hero_label?: string;
+    success_title?: string;
+    success_subtitle?: string;
+    expired_title?: string;
+    expired_subtitle?: string;
+    refresh_button?: string;
+    copy_button?: string;
+    copied_button?: string;
+};
+/**
+ * PROPOSED contract shape (R5 per-partner config). Set on the partner's
+ * dashboard, stored against the partner record in Pulse, resolved via the API
+ * key at session creation, and carried on client-session responses so the
+ * hosted flow reflects it with zero partner front-end code.
+ *
+ * Semantics: absent/null config = full defaults — every network and asset is
+ * available. `enabled_networks`/`enabled_assets` only ever NARROW the full
+ * built-in set, never widen it; mount options may narrow further but cannot
+ * re-enable what the config removed. Pulse enforces the lists server-side
+ * (session creation and re-selection reject disabled values) — the embed
+ * merely mirrors them in the UI.
+ */
+export type PartnerConfig = {
+    /** Subset of the full network set this partner accepts. Absent = all. */
+    enabled_networks?: Network[];
+    /** Subset of the asset set this partner accepts. Absent = all. */
+    enabled_assets?: Asset[];
+    theme?: PartnerConfigTheme;
+    strings?: PartnerConfigStrings;
+    /** "none" removes the attribution footer (R3.4 — never mandatory). */
+    attribution?: 'subtle' | 'none';
+    /** Default flow when the mount doesn't pin one: selection UI or direct pay. */
+    flow?: 'select' | 'direct';
+};
+/**
+ * GET /v1/client/session response — the order plus the resolved partner
+ * config (also echoed on refresh_quote/select for symmetry). `partner_config`
+ * missing or null means the partner has no dashboard config.
+ */
+export type ClientSessionState = CollectionOrder & {
+    partner_config?: PartnerConfig | null;
+};
+/**
+ * PROPOSED contract: `POST /v1/client/telemetry` (session-token auth, body
+ * `{ events: ClientTelemetryEvent[] }`, responds 202). Batched, pseudonymous
+ * funnel/error events emitted by the hosted embed — session/order ids are the
+ * only correlation keys; no PII, and delivery is fire-and-forget (the payment
+ * flow never depends on it). See docs/observability.md.
+ */
+export type ClientTelemetryEvent = {
+    /** e.g. "session_loaded", "step_viewed", "status_change", "client_error". */
+    name: string;
+    /** ISO timestamp at emission. */
+    at: string;
+    /** Embed build that emitted the event, e.g. "embed/0.1.0". */
+    source: string;
+    /** Small scalar payload (step, status, error code…) — never free-form PII. */
+    data?: Record<string, string | number | boolean | null>;
+};
+export type ListOrdersParams = {
+    gate?: Gate;
+    status?: OrderStatus;
+    user_ref?: string;
+    created_after?: string;
+    created_before?: string;
+    limit?: number;
+    cursor?: string;
+};
+export type Page<T> = {
+    data: T[];
+    next_cursor: string | null;
+};
+export type AmountMismatchData = {
+    order_id: string;
+    expected: string;
+    received: string;
+    asset: Asset;
+    network: Network;
+    tx_hash: string;
+};
+type WebhookEventBase = {
+    /** evt_* — the idempotency key for consumers. */
+    id: string;
+    created_at: string;
+};
+export type WebhookEvent = (WebhookEventBase & {
+    type: 'collection.order.created';
+    data: {
+        order: CollectionOrder;
+    };
+}) | (WebhookEventBase & {
+    type: 'collection.deposit.detected';
+    data: {
+        order_id: string;
+        deposit: Deposit;
+    };
+}) | (WebhookEventBase & {
+    type: 'collection.deposit.confirmed';
+    data: {
+        order_id: string;
+        deposit: Deposit;
+    };
+}) | (WebhookEventBase & {
+    type: 'collection.deposit.wrong_chain';
+    data: {
+        order_id: string;
+        deposit: WrongChainDeposit;
+        expected_network: Network;
+    };
+}) | (WebhookEventBase & {
+    type: 'collection.amount.underpaid';
+    data: AmountMismatchData;
+}) | (WebhookEventBase & {
+    type: 'collection.amount.overpaid';
+    data: AmountMismatchData;
+}) | (WebhookEventBase & {
+    type: 'disbursement.completed';
+    data: {
+        order_id: string;
+        disbursement: Disbursement;
+    };
+}) | (WebhookEventBase & {
+    type: 'collection.order.expired';
+    data: {
+        order_id: string;
+    };
+}) | (WebhookEventBase & {
+    type: 'collection.order.failed';
+    data: {
+        order_id: string;
+        reason: string;
+    };
+});
+export type WebhookEventType = WebhookEvent['type'];
+export {};

package/dist/types.js

@@ -0,0 +1,12 @@
+/**
+ * Wire types for the Pulse API. Two sections:
+ *
+ * 1. ENGINE API — reconciled 1:1 against the live public contract
+ *    (https://engine-api.shiga.io/swagger/public/index.html). These are real.
+ * 2. PROPOSED product extension — the collection-session/client-session/webhook
+ *    surface the embedded product needs; not yet in the engine (see
+ *    docs/engine-gap.md).
+ *
+ * Wire convention (both): snake_case JSON, decimal amounts as strings.
+ */
+export {};

package/dist/version.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Kept in sync with package.json by a unit test (version drift fails CI) —
+ * a source constant avoids JSON-import interop differences across Node
+ * versions this SDK supports.
+ */
+export declare const SDK_VERSION = "0.2.0";

package/dist/version.js

@@ -0,0 +1,6 @@
+/**
+ * Kept in sync with package.json by a unit test (version drift fails CI) —
+ * a source constant avoids JSON-import interop differences across Node
+ * versions this SDK supports.
+ */
+export const SDK_VERSION = '0.2.0';

package/dist/webhooks.d.ts

@@ -0,0 +1,49 @@
+import type { WebhookEvent } from './types.js';
+export type VerifyOptions = {
+    /** Max allowed clock skew between the signature timestamp and now. Default 300s. */
+    toleranceSeconds?: number;
+    /** Unix-seconds clock, injectable for tests. */
+    now?: () => number;
+};
+/**
+ * Produce a "Pulse-Signature" header value for a payload:
+ * `t=<unix>,v1=<hex hmac-sha256 of "<unix>.<payload>">`.
+ * Exported for test fixtures and the local dev mock.
+ */
+export declare function signPayload(payload: string, secret: string, timestamp: number): string;
+export type ProcessedEventStore = {
+    /** True if this event id has already been processed. */
+    has(eventId: string): boolean | Promise<boolean>;
+    /** Record an event id as processed. */
+    add(eventId: string): void | Promise<void>;
+};
+/**
+ * Single-process default. In multi-instance deployments back verifyOnce with
+ * a shared store (Redis, DB) via the ProcessedEventStore contract instead.
+ */
+export declare class InMemoryProcessedEventStore {
+    private readonly ttlMs;
+    private readonly seen;
+    constructor(ttlMs?: number);
+    has(eventId: string): boolean;
+    add(eventId: string): void;
+}
+export declare class Webhooks {
+    private readonly secret;
+    private readonly store;
+    constructor(secret?: string, store?: ProcessedEventStore);
+    /**
+     * Verify a webhook delivery against its "Pulse-Signature" header and return
+     * the typed event. `payload` MUST be the raw request body — a re-serialized
+     * JSON object will not match the signature.
+     * Throws SignatureVerificationError on any mismatch.
+     */
+    verify(payload: string | Buffer, signatureHeader: string, secret?: string, options?: VerifyOptions): WebhookEvent;
+    /**
+     * Verify a delivery AND de-duplicate on event id in one call. Delivery is
+     * at-least-once, so redeliveries WILL arrive: the first sight of an id
+     * returns the typed event, a duplicate returns null (skip it, respond 200).
+     * Signature failures still throw before the store is touched.
+     */
+    verifyOnce(payload: string | Buffer, signatureHeader: string, secret?: string, options?: VerifyOptions): Promise<WebhookEvent | null>;
+}

package/dist/webhooks.js

@@ -0,0 +1,135 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { SignatureVerificationError } from './errors.js';
+const DEFAULT_TOLERANCE_SECONDS = 300;
+/**
+ * Produce a "Pulse-Signature" header value for a payload:
+ * `t=<unix>,v1=<hex hmac-sha256 of "<unix>.<payload>">`.
+ * Exported for test fixtures and the local dev mock.
+ */
+export function signPayload(payload, secret, timestamp) {
+    const mac = createHmac('sha256', secret).update(`${timestamp}.${payload}`).digest('hex');
+    return `t=${timestamp},v1=${mac}`;
+}
+const DEFAULT_DEDUPE_TTL_MS = 24 * 60 * 60 * 1000;
+/**
+ * Single-process default. In multi-instance deployments back verifyOnce with
+ * a shared store (Redis, DB) via the ProcessedEventStore contract instead.
+ */
+export class InMemoryProcessedEventStore {
+    ttlMs;
+    seen = new Map();
+    constructor(ttlMs = DEFAULT_DEDUPE_TTL_MS) {
+        this.ttlMs = ttlMs;
+    }
+    has(eventId) {
+        const expiresAt = this.seen.get(eventId);
+        if (expiresAt === undefined)
+            return false;
+        if (expiresAt <= Date.now()) {
+            this.seen.delete(eventId);
+            return false;
+        }
+        return true;
+    }
+    add(eventId) {
+        const now = Date.now();
+        for (const [id, expiresAt] of this.seen) {
+            if (expiresAt <= now)
+                this.seen.delete(id);
+        }
+        this.seen.set(eventId, now + this.ttlMs);
+    }
+}
+export class Webhooks {
+    secret;
+    store;
+    constructor(secret, store) {
+        this.secret = secret ?? null;
+        this.store = store ?? new InMemoryProcessedEventStore();
+    }
+    /**
+     * Verify a webhook delivery against its "Pulse-Signature" header and return
+     * the typed event. `payload` MUST be the raw request body — a re-serialized
+     * JSON object will not match the signature.
+     * Throws SignatureVerificationError on any mismatch.
+     */
+    verify(payload, signatureHeader, secret, options = {}) {
+        const resolvedSecret = secret ?? this.secret;
+        if (resolvedSecret === null || resolvedSecret === '') {
+            throw new SignatureVerificationError('No webhook secret provided — pass one to verify() or the Pulse constructor');
+        }
+        const raw = typeof payload === 'string' ? payload : payload.toString('utf8');
+        const { timestamp, signatures } = parseSignatureHeader(signatureHeader);
+        const expected = createHmac('sha256', resolvedSecret)
+            .update(`${timestamp}.${raw}`)
+            .digest('hex');
+        const expectedBuf = Buffer.from(expected, 'utf8');
+        const matches = signatures.some((candidate) => {
+            const candidateBuf = Buffer.from(candidate, 'utf8');
+            return (candidateBuf.length === expectedBuf.length && timingSafeEqual(candidateBuf, expectedBuf));
+        });
+        if (!matches) {
+            throw new SignatureVerificationError('Webhook signature does not match the payload');
+        }
+        const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+        const nowSeconds = options.now?.() ?? Math.floor(Date.now() / 1000);
+        if (Math.abs(nowSeconds - timestamp) > tolerance) {
+            throw new SignatureVerificationError(`Webhook timestamp outside tolerance (${tolerance}s) — possible replay`);
+        }
+        return parseEvent(raw);
+    }
+    /**
+     * Verify a delivery AND de-duplicate on event id in one call. Delivery is
+     * at-least-once, so redeliveries WILL arrive: the first sight of an id
+     * returns the typed event, a duplicate returns null (skip it, respond 200).
+     * Signature failures still throw before the store is touched.
+     */
+    async verifyOnce(payload, signatureHeader, secret, options = {}) {
+        const event = this.verify(payload, signatureHeader, secret, options);
+        if (await this.store.has(event.id)) {
+            return null;
+        }
+        await this.store.add(event.id);
+        return event;
+    }
+}
+function parseSignatureHeader(header) {
+    let timestamp = null;
+    const signatures = [];
+    for (const part of header.split(',')) {
+        const eq = part.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = part.slice(0, eq).trim();
+        const value = part.slice(eq + 1).trim();
+        if (key === 't') {
+            const parsed = Number(value);
+            if (Number.isInteger(parsed) && parsed > 0)
+                timestamp = parsed;
+        }
+        else if (key === 'v1' && value !== '') {
+            signatures.push(value);
+        }
+    }
+    if (timestamp === null || signatures.length === 0) {
+        throw new SignatureVerificationError('Malformed Pulse-Signature header');
+    }
+    return { timestamp, signatures };
+}
+function parseEvent(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new SignatureVerificationError('Webhook payload is not valid JSON');
+    }
+    if (typeof parsed !== 'object' ||
+        parsed === null ||
+        !('id' in parsed) ||
+        !('type' in parsed) ||
+        !('data' in parsed)) {
+        throw new SignatureVerificationError('Webhook payload is not an event envelope');
+    }
+    return parsed;
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@pulsebyshiga/node",
+  "version": "0.2.0",
+  "description": "Pulse Collect backend SDK — collection sessions, orders, and webhook signature verification",
+  "license": "MIT",
+  "author": "Shiga Digital",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Pulse-Digital/pulse-collect.git",
+    "directory": "packages/node-sdk"
+  },
+  "sideEffects": false,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=18.17"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.6.3",
+    "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}