@seamless-auth/types 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @seamless-auth/types
 
+## 0.3.0
+
+### Minor Changes
+
+- f180c99: Add a Zod-free entry point for role matching.
+
+  `ROLE_NAME_PATTERN`, `roleGrantsAccess`, and `hasScopedRole` moved to
+  `src/schemas/role/matching.ts`, which imports nothing at runtime. Two subpath
+  exports expose it: `@seamless-auth/types/role/matching` for the matchers alone,
+  and `@seamless-auth/types/role` for those plus `RoleNameSchema`. Consumers on
+  the authorization path can now match roles without loading Zod or the schema
+  barrel.
+
+  The package also declares `"sideEffects": false` so bundlers can tree-shake the
+  barrel.
+
+  This is additive. The package root still exports everything it did before, and
+  the matching behavior is unchanged.
+
 ## 0.2.0
 
 ### Minor Changes

package/README.md

@@ -45,6 +45,23 @@ const user = UserSchema.parse(data);
 User role schemas accept plain roles such as `admin` and colon-separated scoped roles such as
 `admin:read` and `admin:write`. Whitespace, underscores, slashes, and backslashes are rejected.
 
+### Match roles without Zod
+
+`roleGrantsAccess` and `hasScopedRole` are plain string logic, but reaching them through the
+package root loads Zod and every schema in the barrel. Code on the authorization hot path can
+import them from `@seamless-auth/types/role/matching` instead, which has no runtime dependencies:
+
+```ts
+import { hasScopedRole } from '@seamless-auth/types/role/matching';
+
+if (!hasScopedRole(user.roles, 'billing:invoices:read')) {
+  throw new Error('forbidden');
+}
+```
+
+`@seamless-auth/types/role` adds `RoleNameSchema` on top of the same matchers, and the package
+root still exports all of them, so existing imports keep working.
+
 ### Infer types
 
 ```ts
@@ -60,7 +77,7 @@ function handleUser(user: User) {
 ## Modules
 
 Every module is re-exported from the package root, so import from
-`@seamless-auth/types` rather than a subpath.
+`@seamless-auth/types` unless one of the subpath exports below fits better.
 
 | Module         | Covers                                                              |
 | -------------- | ------------------------------------------------------------------- |
@@ -82,6 +99,13 @@ Every module is re-exported from the package root, so import from
 | `metrics`      | Dashboard metrics, timeseries, and security anomalies               |
 | `admin`        | Admin-only user detail, anomalies, and device replacement recovery  |
 
+### Subpath exports
+
+| Subpath                              | Covers                                 |
+| ------------------------------------ | -------------------------------------- |
+| `@seamless-auth/types/role`          | Role name schema plus the matchers     |
+| `@seamless-auth/types/role/matching` | The matchers alone, with no Zod import |
+
 ---
 
 ## Zod as the Source of Truth

package/dist/schemas/role/matching.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Role matching logic, deliberately free of any Zod import. Consumers on the
+ * authorization hot path can reach this through the `./role/matching` subpath
+ * export without pulling Zod into their dependency tree.
+ */
+/**
+ * Roles are colon-scoped (`billing:invoices:read`). Underscores, slashes, and
+ * whitespace are excluded so a role name is always safe to embed in a JWT claim,
+ * a URL path segment, and a config file without escaping.
+ */
+export declare const ROLE_NAME_PATTERN: RegExp;
+/**
+ * Whether a granted role satisfies a required role. A `:*` suffix grants every
+ * role under that prefix, an unscoped role grants every role beneath it, and a
+ * `:write` role implies the matching `:read` role.
+ */
+export declare function roleGrantsAccess(grantedRole: string, requiredRole: string): boolean;
+/** Whether any granted role satisfies at least one of the required roles. */
+export declare function hasScopedRole(grantedRoles: unknown, requiredRoles: string | string[]): boolean;
+//# sourceMappingURL=matching.d.ts.map

package/dist/schemas/role/matching.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matching.d.ts","sourceRoot":"","sources":["../../../src/schemas/role/matching.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,QAAiE,CAAC;AAUhG;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAmCnF;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAW9F"}

package/dist/schemas/role/matching.js

@@ -0,0 +1,59 @@
+/**
+ * Role matching logic, deliberately free of any Zod import. Consumers on the
+ * authorization hot path can reach this through the `./role/matching` subpath
+ * export without pulling Zod into their dependency tree.
+ */
+/**
+ * Roles are colon-scoped (`billing:invoices:read`). Underscores, slashes, and
+ * whitespace are excluded so a role name is always safe to embed in a JWT claim,
+ * a URL path segment, and a config file without escaping.
+ */
+export const ROLE_NAME_PATTERN = /^(?!.*[_/\\\s])(?=.{1,80}$)[A-Za-z0-9-]+(?::[A-Za-z0-9-]+)*$/;
+function normalizeRole(value) {
+    return value.trim();
+}
+function samePrefix(left, right) {
+    return left.length === right.length && left.every((part, index) => part === right[index]);
+}
+/**
+ * Whether a granted role satisfies a required role. A `:*` suffix grants every
+ * role under that prefix, an unscoped role grants every role beneath it, and a
+ * `:write` role implies the matching `:read` role.
+ */
+export function roleGrantsAccess(grantedRole, requiredRole) {
+    const granted = normalizeRole(grantedRole);
+    const required = normalizeRole(requiredRole);
+    if (!granted || !required) {
+        return false;
+    }
+    if (granted === required) {
+        return true;
+    }
+    if (granted.endsWith(':*')) {
+        const prefix = granted.slice(0, -2);
+        return required === prefix || required.startsWith(`${prefix}:`);
+    }
+    if (!required.includes(':')) {
+        return false;
+    }
+    if (!granted.includes(':')) {
+        return required.startsWith(`${granted}:`);
+    }
+    const grantedParts = granted.split(':');
+    const requiredParts = required.split(':');
+    const grantedAction = grantedParts[grantedParts.length - 1];
+    const requiredAction = requiredParts[requiredParts.length - 1];
+    return (grantedAction === 'write' &&
+        requiredAction === 'read' &&
+        samePrefix(grantedParts.slice(0, -1), requiredParts.slice(0, -1)));
+}
+/** Whether any granted role satisfies at least one of the required roles. */
+export function hasScopedRole(grantedRoles, requiredRoles) {
+    if (!Array.isArray(grantedRoles)) {
+        return false;
+    }
+    const required = Array.isArray(requiredRoles) ? requiredRoles : [requiredRoles];
+    const granted = grantedRoles.filter((role) => typeof role === 'string');
+    return required.some((requiredRole) => granted.some((grantedRole) => roleGrantsAccess(grantedRole, requiredRole)));
+}
+//# sourceMappingURL=matching.js.map

package/dist/schemas/role/matching.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matching.js","sourceRoot":"","sources":["../../../src/schemas/role/matching.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AAEhG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,KAAe;IACjD,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,YAAoB;IACxE,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAE7C,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,cAAc,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/D,OAAO,CACL,aAAa,KAAK,OAAO;QACzB,cAAc,KAAK,MAAM;QACzB,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,YAAqB,EAAE,aAAgC;IACnF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IAExF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACpC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC"}

package/dist/schemas/role/schema.d.ts

@@ -1,20 +1,7 @@
 import { z } from 'zod';
-/**
- * Roles are colon-scoped (`billing:invoices:read`). Underscores, slashes, and
- * whitespace are excluded so a role name is always safe to embed in a JWT claim,
- * a URL path segment, and a config file without escaping.
- */
-export declare const ROLE_NAME_PATTERN: RegExp;
+export * from './matching.js';
 export declare const RoleNameSchema: z.ZodString;
 export type RoleName = z.infer<typeof RoleNameSchema>;
 /** @deprecated Use {@link RoleNameSchema}. */
 export declare const RoleSchema: z.ZodString;
-/**
- * Whether a granted role satisfies a required role. A `:*` suffix grants every
- * role under that prefix, an unscoped role grants every role beneath it, and a
- * `:write` role implies the matching `:read` role.
- */
-export declare function roleGrantsAccess(grantedRole: string, requiredRole: string): boolean;
-/** Whether any granted role satisfies at least one of the required roles. */
-export declare function hasScopedRole(grantedRoles: unknown, requiredRoles: string | string[]): boolean;
 //# sourceMappingURL=schema.d.ts.map

package/dist/schemas/role/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/role/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,QAAiE,CAAC;AAEhG,eAAO,MAAM,cAAc,aAA6C,CAAC;AAEzE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,8CAA8C;AAC9C,eAAO,MAAM,UAAU,aAAiB,CAAC;AAUzC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAmCnF;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAW9F"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/role/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,cAAc,eAAe,CAAC;AAE9B,eAAO,MAAM,cAAc,aAA6C,CAAC;AAEzE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,8CAA8C;AAC9C,eAAO,MAAM,UAAU,aAAiB,CAAC"}

package/dist/schemas/role/schema.js

@@ -1,58 +1,7 @@
 import { z } from 'zod';
-/**
- * Roles are colon-scoped (`billing:invoices:read`). Underscores, slashes, and
- * whitespace are excluded so a role name is always safe to embed in a JWT claim,
- * a URL path segment, and a config file without escaping.
- */
-export const ROLE_NAME_PATTERN = /^(?!.*[_/\\\s])(?=.{1,80}$)[A-Za-z0-9-]+(?::[A-Za-z0-9-]+)*$/;
+import { ROLE_NAME_PATTERN } from './matching.js';
+export * from './matching.js';
 export const RoleNameSchema = z.string().trim().regex(ROLE_NAME_PATTERN);
 /** @deprecated Use {@link RoleNameSchema}. */
 export const RoleSchema = RoleNameSchema;
-function normalizeRole(value) {
-    return value.trim();
-}
-function samePrefix(left, right) {
-    return left.length === right.length && left.every((part, index) => part === right[index]);
-}
-/**
- * Whether a granted role satisfies a required role. A `:*` suffix grants every
- * role under that prefix, an unscoped role grants every role beneath it, and a
- * `:write` role implies the matching `:read` role.
- */
-export function roleGrantsAccess(grantedRole, requiredRole) {
-    const granted = normalizeRole(grantedRole);
-    const required = normalizeRole(requiredRole);
-    if (!granted || !required) {
-        return false;
-    }
-    if (granted === required) {
-        return true;
-    }
-    if (granted.endsWith(':*')) {
-        const prefix = granted.slice(0, -2);
-        return required === prefix || required.startsWith(`${prefix}:`);
-    }
-    if (!required.includes(':')) {
-        return false;
-    }
-    if (!granted.includes(':')) {
-        return required.startsWith(`${granted}:`);
-    }
-    const grantedParts = granted.split(':');
-    const requiredParts = required.split(':');
-    const grantedAction = grantedParts[grantedParts.length - 1];
-    const requiredAction = requiredParts[requiredParts.length - 1];
-    return (grantedAction === 'write' &&
-        requiredAction === 'read' &&
-        samePrefix(grantedParts.slice(0, -1), requiredParts.slice(0, -1)));
-}
-/** Whether any granted role satisfies at least one of the required roles. */
-export function hasScopedRole(grantedRoles, requiredRoles) {
-    if (!Array.isArray(grantedRoles)) {
-        return false;
-    }
-    const required = Array.isArray(requiredRoles) ? requiredRoles : [requiredRoles];
-    const granted = grantedRoles.filter((role) => typeof role === 'string');
-    return required.some((requiredRole) => granted.some((grantedRole) => roleGrantsAccess(grantedRole, requiredRole)));
-}
 //# sourceMappingURL=schema.js.map

package/dist/schemas/role/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/role/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AAEhG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAIzE,8CAA8C;AAC9C,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,KAAe;IACjD,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,YAAoB;IACxE,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAE7C,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,cAAc,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/D,OAAO,CACL,aAAa,KAAK,OAAO;QACzB,cAAc,KAAK,MAAM;QACzB,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,YAAqB,EAAE,aAAgC;IACnF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IAExF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACpC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/role/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,cAAc,eAAe,CAAC;AAE9B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAIzE,8CAA8C;AAC9C,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/types",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
   "author": "Fells Code, LLC",
   "license": "AGPL-3.0-only",
@@ -11,8 +11,17 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./role": {
+      "types": "./dist/schemas/role/schema.d.ts",
+      "import": "./dist/schemas/role/schema.js"
+    },
+    "./role/matching": {
+      "types": "./dist/schemas/role/matching.d.ts",
+      "import": "./dist/schemas/role/matching.js"
     }
   },
+  "sideEffects": false,
   "files": [
     "dist",
     "README.md",