@rt-tools/auth-server 0.0.0-stage → 0.1.0

package/esm/lib/testing/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../projects/auth-server/src/lib/testing/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsD,eAAe,EAAW,MAAM,MAAM,CAAC;AAEpG,8BAA8B;AAC9B,eAAO,MAAM,WAAW,EAAE,MAA2C,CAAC;AACtE,eAAO,MAAM,WAAW,EAAE,MAAuB,CAAC;AAElD,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnI;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,CAiBrD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,GAAE,MAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzG"}

package/esm/lib/testing/keys.js

@@ -0,0 +1,23 @@
+import { createLocalJWKSet, exportJWK, generateKeyPair, SignJWT } from 'jose';
+/** The realm of the tests. */
+export const TEST_ISSUER = 'http://localhost:58080/realms/rt';
+export const TEST_CLIENT = 'orders-admin';
+export async function testRealm() {
+    const own = await generateKeyPair('RS256');
+    const foreign = await generateKeyPair('RS256');
+    const jwk = { ...(await exportJWK(own.publicKey)), kid: 'own', alg: 'RS256', use: 'sig' };
+    return {
+        keys: createLocalJWKSet({ keys: [jwk] }),
+        sign: async (claims, options = {}) => new SignJWT(claims)
+            .setProtectedHeader({ alg: 'RS256', kid: 'own' })
+            .setIssuer(options.issuer ?? TEST_ISSUER)
+            .setIssuedAt()
+            .setExpirationTime(options.expiresIn ?? '5m')
+            .sign(options.foreignKey ? foreign.privateKey : own.privateKey),
+    };
+}
+/** The claims of a person with the given roles in the test client, issued to it. */
+export function personClaims(roles, azp = TEST_CLIENT) {
+    return { sub: 'p-1', email: 'anna@example.com', resource_access: { [TEST_CLIENT]: { roles } }, azp };
+}
+//# sourceMappingURL=keys.js.map

package/esm/lib/testing/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../projects/auth-server/src/lib/testing/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAwB,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpG,8BAA8B;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAW,kCAAkC,CAAC;AACtE,MAAM,CAAC,MAAM,WAAW,GAAW,cAAc,CAAC;AAQlD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC3B,MAAM,GAAG,GAAkB,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAkB,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAQ,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC/F,OAAO;QACH,IAAI,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,EAAE,KAAK,EACP,MAA+B,EAC/B,UAAyE,EAAE,EAC5D,EAAE,CACjB,IAAI,OAAO,CAAC,MAAM,CAAC;aACd,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAChD,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC;aACxC,WAAW,EAAE;aACb,iBAAiB,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;aAC5C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;KAC1E,CAAC;AACN,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,KAAwB,EAAE,MAAc,WAAW;IAC5E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACzG,CAAC","sourcesContent":["import { createLocalJWKSet, exportJWK, generateKeyPair, JWK, JWTVerifyGetKey, SignJWT } from 'jose';\n\n/** The realm of the tests. */\nexport const TEST_ISSUER: string = 'http://localhost:58080/realms/rt';\nexport const TEST_CLIENT: string = 'orders-admin';\n\n/** A realm key pair and the key set the verifier reads, as a realm serves it. */\nexport interface ITestRealm {\n    readonly keys: JWTVerifyGetKey;\n    sign(claims: Record<string, unknown>, options?: { issuer?: string; expiresIn?: string; foreignKey?: boolean }): Promise<string>;\n}\n\nexport async function testRealm(): Promise<ITestRealm> {\n    const own: CryptoKeyPair = await generateKeyPair('RS256');\n    const foreign: CryptoKeyPair = await generateKeyPair('RS256');\n    const jwk: JWK = { ...(await exportJWK(own.publicKey)), kid: 'own', alg: 'RS256', use: 'sig' };\n    return {\n        keys: createLocalJWKSet({ keys: [jwk] }),\n        sign: async (\n            claims: Record<string, unknown>,\n            options: { issuer?: string; expiresIn?: string; foreignKey?: boolean } = {}\n        ): Promise<string> =>\n            new SignJWT(claims)\n                .setProtectedHeader({ alg: 'RS256', kid: 'own' })\n                .setIssuer(options.issuer ?? TEST_ISSUER)\n                .setIssuedAt()\n                .setExpirationTime(options.expiresIn ?? '5m')\n                .sign(options.foreignKey ? foreign.privateKey : own.privateKey),\n    };\n}\n\n/** The claims of a person with the given roles in the test client, issued to it. */\nexport function personClaims(roles: readonly string[], azp: string = TEST_CLIENT): Record<string, unknown> {\n    return { sub: 'p-1', email: 'anna@example.com', resource_access: { [TEST_CLIENT]: { roles } }, azp };\n}\n"]}

package/esm/lib/token-verifier.d.ts

@@ -0,0 +1,29 @@
+import { JWTVerifyGetKey } from 'jose';
+import { ICaller } from '@rt-tools/auth-contract';
+/** Where the tokens of an admin come from: the realm and the client of this admin. */
+export interface ITokenCheckOptions {
+    /** The realm issuer, for example `https://sso.example.com/realms/rt`. */
+    readonly issuer: string;
+    /** The client of this admin in the realm. A token issued to another client is refused. */
+    readonly clientId: string;
+}
+/** The token of the `Authorization` header, or `null` when the header is absent or of another form. */
+export declare function bearerToken(authorization: string | null | undefined): string | null;
+/**
+ * The token check of one admin, shared by the NestJS guard and the Connect interceptor.
+ *
+ * A token is accepted when a key of the realm signed it, the realm issued it, its term holds and
+ * it was issued to the client of this admin (`azp`). Every other case answers `null` and nothing
+ * more: the reason of a refusal is not told to the caller, so the answers do not show which tokens
+ * come close.
+ *
+ * The keys are fetched from the key set address of the realm and cached by `jose`; a key the
+ * realm rotates in is picked up without a restart.
+ */
+export declare class KeycloakTokenVerifier {
+    #private;
+    constructor(options: ITokenCheckOptions, keys?: JWTVerifyGetKey);
+    /** The caller of the `Authorization` header, or `null` when the token is not accepted. */
+    callerOf(authorization: string | null | undefined): Promise<ICaller | null>;
+}
+//# sourceMappingURL=token-verifier.d.ts.map

package/esm/lib/token-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/token-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,eAAe,EAAa,MAAM,MAAM,CAAC;AAElF,OAAO,EAAoB,OAAO,EAAmB,MAAM,yBAAyB,CAAC;AAErF,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B;AAID,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGnF;AA0BD;;;;;;;;;;GAUG;AACH,qBAAa,qBAAqB;;gBAIlB,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,EAAE,eAAe;IAK/D,0FAA0F;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;CAe3F"}

package/esm/lib/token-verifier.js

@@ -0,0 +1,67 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { callerFromClaims } from '@rt-tools/auth-contract';
+const BEARER = /^Bearer ([A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+)$/;
+/** The token of the `Authorization` header, or `null` when the header is absent or of another form. */
+export function bearerToken(authorization) {
+    const match = BEARER.exec(authorization?.trim() ?? '');
+    return match ? match[1] : null;
+}
+function resourceAccessOf(value) {
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const access = {};
+    for (const [clientId, entry] of Object.entries(value)) {
+        const roles = typeof entry === 'object' && entry !== null ? Reflect.get(entry, 'roles') : undefined;
+        access[clientId] = { roles: Array.isArray(roles) ? roles.filter((role) => typeof role === 'string') : [] };
+    }
+    return access;
+}
+/** The claims the caller is read from, taken from a verified payload by their shape. */
+function claimsOf(payload) {
+    return {
+        sub: String(payload.sub),
+        email: typeof payload['email'] === 'string' ? payload['email'] : undefined,
+        email_verified: payload['email_verified'] === true,
+        name: typeof payload['name'] === 'string' ? payload['name'] : undefined,
+        preferred_username: typeof payload['preferred_username'] === 'string' ? payload['preferred_username'] : undefined,
+        resource_access: resourceAccessOf(payload['resource_access']),
+    };
+}
+/**
+ * The token check of one admin, shared by the NestJS guard and the Connect interceptor.
+ *
+ * A token is accepted when a key of the realm signed it, the realm issued it, its term holds and
+ * it was issued to the client of this admin (`azp`). Every other case answers `null` and nothing
+ * more: the reason of a refusal is not told to the caller, so the answers do not show which tokens
+ * come close.
+ *
+ * The keys are fetched from the key set address of the realm and cached by `jose`; a key the
+ * realm rotates in is picked up without a restart.
+ */
+export class KeycloakTokenVerifier {
+    #options;
+    #keys;
+    constructor(options, keys) {
+        this.#options = options;
+        this.#keys = keys ?? createRemoteJWKSet(new URL(`${options.issuer}/protocol/openid-connect/certs`));
+    }
+    /** The caller of the `Authorization` header, or `null` when the token is not accepted. */
+    async callerOf(authorization) {
+        const token = bearerToken(authorization);
+        if (!token) {
+            return null;
+        }
+        try {
+            const { payload } = await jwtVerify(token, this.#keys, { issuer: this.#options.issuer });
+            if (payload['azp'] !== this.#options.clientId || typeof payload.sub !== 'string') {
+                return null;
+            }
+            return callerFromClaims(claimsOf(payload), this.#options.clientId);
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=token-verifier.js.map

package/esm/lib/token-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/token-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA+B,SAAS,EAAE,MAAM,MAAM,CAAC;AAElF,OAAO,EAAE,gBAAgB,EAA4B,MAAM,yBAAyB,CAAC;AAUrF,MAAM,MAAM,GAAW,8DAA8D,CAAC;AAEtF,uGAAuG;AACvG,MAAM,UAAU,WAAW,CAAC,aAAwC;IAChE,MAAM,KAAK,GAA2B,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAkD,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAY,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxI,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,wFAAwF;AACxF,SAAS,QAAQ,CAAC,OAAmB;IACjC,OAAO;QACH,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACxB,KAAK,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAClD,IAAI,EAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,kBAAkB,EAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;QACjH,eAAe,EAAE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;KAChE,CAAC;AACN,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAqB;IACrB,QAAQ,CAAqB;IAC7B,KAAK,CAAkB;IAEhC,YAAY,OAA2B,EAAE,IAAsB;QAC3D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,QAAQ,CAAC,aAAwC;QAC1D,MAAM,KAAK,GAAkB,WAAW,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;CACJ","sourcesContent":["import { createRemoteJWKSet, JWTPayload, JWTVerifyGetKey, jwtVerify } from 'jose';\n\nimport { callerFromClaims, ICaller, IKeycloakClaims } from '@rt-tools/auth-contract';\n\n/** Where the tokens of an admin come from: the realm and the client of this admin. */\nexport interface ITokenCheckOptions {\n    /** The realm issuer, for example `https://sso.example.com/realms/rt`. */\n    readonly issuer: string;\n    /** The client of this admin in the realm. A token issued to another client is refused. */\n    readonly clientId: string;\n}\n\nconst BEARER: RegExp = /^Bearer ([A-Za-z0-9\\-_]+\\.[A-Za-z0-9\\-_]+\\.[A-Za-z0-9\\-_]+)$/;\n\n/** The token of the `Authorization` header, or `null` when the header is absent or of another form. */\nexport function bearerToken(authorization: string | null | undefined): string | null {\n    const match: RegExpExecArray | null = BEARER.exec(authorization?.trim() ?? '');\n    return match ? match[1] : null;\n}\n\nfunction resourceAccessOf(value: unknown): IKeycloakClaims['resource_access'] {\n    if (typeof value !== 'object' || value === null) {\n        return undefined;\n    }\n    const access: Record<string, { roles?: readonly string[] }> = {};\n    for (const [clientId, entry] of Object.entries(value)) {\n        const roles: unknown = typeof entry === 'object' && entry !== null ? Reflect.get(entry, 'roles') : undefined;\n        access[clientId] = { roles: Array.isArray(roles) ? roles.filter((role: unknown): role is string => typeof role === 'string') : [] };\n    }\n    return access;\n}\n\n/** The claims the caller is read from, taken from a verified payload by their shape. */\nfunction claimsOf(payload: JWTPayload): IKeycloakClaims {\n    return {\n        sub: String(payload.sub),\n        email: typeof payload['email'] === 'string' ? payload['email'] : undefined,\n        email_verified: payload['email_verified'] === true,\n        name: typeof payload['name'] === 'string' ? payload['name'] : undefined,\n        preferred_username: typeof payload['preferred_username'] === 'string' ? payload['preferred_username'] : undefined,\n        resource_access: resourceAccessOf(payload['resource_access']),\n    };\n}\n\n/**\n * The token check of one admin, shared by the NestJS guard and the Connect interceptor.\n *\n * A token is accepted when a key of the realm signed it, the realm issued it, its term holds and\n * it was issued to the client of this admin (`azp`). Every other case answers `null` and nothing\n * more: the reason of a refusal is not told to the caller, so the answers do not show which tokens\n * come close.\n *\n * The keys are fetched from the key set address of the realm and cached by `jose`; a key the\n * realm rotates in is picked up without a restart.\n */\nexport class KeycloakTokenVerifier {\n    readonly #options: ITokenCheckOptions;\n    readonly #keys: JWTVerifyGetKey;\n\n    constructor(options: ITokenCheckOptions, keys?: JWTVerifyGetKey) {\n        this.#options = options;\n        this.#keys = keys ?? createRemoteJWKSet(new URL(`${options.issuer}/protocol/openid-connect/certs`));\n    }\n\n    /** The caller of the `Authorization` header, or `null` when the token is not accepted. */\n    public async callerOf(authorization: string | null | undefined): Promise<ICaller | null> {\n        const token: string | null = bearerToken(authorization);\n        if (!token) {\n            return null;\n        }\n        try {\n            const { payload } = await jwtVerify(token, this.#keys, { issuer: this.#options.issuer });\n            if (payload['azp'] !== this.#options.clientId || typeof payload.sub !== 'string') {\n                return null;\n            }\n            return callerFromClaims(claimsOf(payload), this.#options.clientId);\n        } catch {\n            return null;\n        }\n    }\n}\n"]}

package/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/package.json

@@ -1,6 +1,55 @@
 {
   "name": "@rt-tools/auth-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Keycloak token check, access declarations and the rights catalog sync for NestJS controllers and Connect procedures",
+  "author": "RT Team",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nickmdf/rt-tools.git",
+    "directory": "projects/auth-server"
+  },
+  "homepage": "https://github.com/nickmdf/rt-tools/tree/main/projects/auth-server",
+  "bugs": {
+    "url": "https://github.com/nickmdf/rt-tools/issues"
+  },
+  "keywords": [
+    "nestjs",
+    "connect",
+    "keycloak",
+    "oidc",
+    "permissions"
+  ],
+  "dependencies": {
+    "@rt-tools/auth-contract": "^0.1.0",
+    "jose": "^6.2.12",
+    "tslib": "^2.3.0"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@connectrpc/connect": "^2.0.0",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.8.0"
+  },
+  "peerDependenciesMeta": {
+    "@connectrpc/connect": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@connectrpc/connect": "2.2.0"
+  },
+  "sideEffects": false,
+  "main": "./cjs/index.js",
+  "types": "./esm/index.d.ts",
+  "module": "./esm/index.js",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./esm/index.d.ts",
+      "import": "./esm/index.js",
+      "require": "./cjs/index.js"
+    }
+  }
+}