@sovereignfs/sdk 1.25.0 → 2.0.1

package/dist/testing.js

@@ -0,0 +1,560 @@
+// src/testing/fake-core.ts
+import { SignJWT, exportJWK, generateKeyPair } from "jose";
+async function challengeOf(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var random = (prefix) => `${prefix}_${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
+var json = (body, status = 200, headers = {}) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json", ...headers }
+});
+var problem = (status, error, message, headers = {}) => json({ error, message }, status, headers);
+function createFakeCore(options = {}) {
+  const url = new URL(options.url ?? "https://core.test").origin;
+  const credentials = {
+    clientId: options.clientId ?? "fake-app",
+    clientSecret: options.clientSecret ?? "fake-secret"
+  };
+  const now = options.now ?? (() => Date.now());
+  const lifetime = options.accessTokenSeconds ?? 900;
+  const api = "api" in options ? options.api : { versions: ["v1"], capabilities: ["directory", "notifications", "email", "activity"] };
+  const appTokens = options.appTokens ?? true;
+  const people = /* @__PURE__ */ new Map();
+  const codes = /* @__PURE__ */ new Map();
+  const sessionOf = /* @__PURE__ */ new Map();
+  let signing;
+  const keys = () => signing ??= generateKeyPair("EdDSA", { extractable: true }).then(async (pair) => ({
+    privateKey: pair.privateKey,
+    publicJwk: { ...await exportJWK(pair.publicKey), kid: "fake-1", alg: "EdDSA", use: "sig" }
+  }));
+  const refreshTokens = /* @__PURE__ */ new Map();
+  const accessTokens = /* @__PURE__ */ new Map();
+  const failures = [];
+  const requests = [];
+  const seen = { refreshes: 0, appTokens: 0, reused: 0 };
+  const targetOf = (path) => path === "/api/auth/oauth2/token" ? "token" : path === "/.well-known/openid-configuration" ? "discovery" : path === "/.well-known/sovereign-instance" ? "instance" : "api";
+  const takeFailure = (target) => {
+    const index = failures.findIndex((f) => f.target === "any" || f.target === target);
+    const found = failures[index];
+    if (!found) return void 0;
+    found.times -= 1;
+    if (found.times <= 0) failures.splice(index, 1);
+    return found.failure;
+  };
+  const down = () => {
+    throw new TypeError("fetch failed", {
+      cause: Object.assign(new Error("connect ECONNREFUSED"), { code: "ECONNREFUSED" })
+    });
+  };
+  const hang = (signal) => new Promise((_resolve, reject) => {
+    const stop = () => reject(signal?.reason ?? new DOMException("The operation was aborted.", "TimeoutError"));
+    if (!signal) return;
+    if (signal.aborted) stop();
+    else signal.addEventListener("abort", stop, { once: true });
+  });
+  const issueAccess = (access) => {
+    const token = random("at");
+    accessTokens.set(token, { ...access, expiresAt: now() + lifetime * 1e3 });
+    return token;
+  };
+  const tokenEndpoint = async (request, failure, signal) => {
+    const given = request.headers.get("authorization") ?? "";
+    const decoded = given.startsWith("Basic ") ? atob(given.slice(6)) : "";
+    const colon = decoded.indexOf(":");
+    const decode = (part) => {
+      try {
+        return decodeURIComponent(part.replace(/\+/g, " "));
+      } catch {
+        return part;
+      }
+    };
+    if (colon < 0 || decode(decoded.slice(0, colon)) !== credentials.clientId || decode(decoded.slice(colon + 1)) !== credentials.clientSecret) {
+      return json({ error: "invalid_client", error_description: "the app is not recognised" }, 401);
+    }
+    const form = new URLSearchParams(await request.text());
+    const grant = form.get("grant_type");
+    let answer;
+    if (grant === "authorization_code") {
+      const record = codes.get(form.get("code") ?? "");
+      const verifier = form.get("code_verifier") ?? "";
+      if (!record || record.used || form.get("redirect_uri") !== record.redirectUri || await challengeOf(verifier) !== record.challenge) {
+        if (record) record.used = true;
+        answer = json({ error: "invalid_grant", error_description: "the code is not valid" }, 400);
+      } else {
+        record.used = true;
+        const person = people.get(record.sub);
+        const issued = Math.floor(now() / 1e3);
+        const idToken = await new SignJWT({
+          ...record.nonce ? { nonce: record.nonce } : {},
+          sid: record.sid,
+          name: person?.name ?? record.sub,
+          ...record.scope.split(" ").includes("roles") ? { roles: record.roles } : {}
+        }).setProtectedHeader({ alg: "EdDSA", kid: "fake-1" }).setIssuer(url).setAudience(credentials.clientId).setSubject(record.sub).setIssuedAt(issued).setExpirationTime(issued + 3600).sign((await keys()).privateKey);
+        let refresh;
+        if (record.scope.split(" ").includes("offline_access")) {
+          refresh = random("rt");
+          refreshTokens.set(refresh, { sub: record.sub, used: false });
+        }
+        answer = json({
+          token_type: "Bearer",
+          access_token: issueAccess({ kind: "person", sub: record.sub }),
+          id_token: idToken,
+          ...refresh ? { refresh_token: refresh } : {},
+          expires_in: lifetime,
+          scope: record.scope
+        });
+      }
+    } else if (grant === "refresh_token") {
+      const presented = form.get("refresh_token") ?? "";
+      const known = refreshTokens.get(presented);
+      if (!known) {
+        answer = json({ error: "invalid_grant", error_description: "the token is not valid" }, 400);
+      } else if (known.used) {
+        seen.reused += 1;
+        for (const [token, other] of refreshTokens)
+          if (other.sub === known.sub) refreshTokens.delete(token);
+        for (const [token, other] of accessTokens)
+          if (other.kind === "person" && other.sub === known.sub) accessTokens.delete(token);
+        answer = json(
+          { error: "invalid_grant", error_description: "the token was already used" },
+          400
+        );
+      } else {
+        known.used = true;
+        seen.refreshes += 1;
+        const next = random("rt");
+        refreshTokens.set(next, { sub: known.sub, used: false });
+        answer = json({
+          token_type: "Bearer",
+          access_token: issueAccess({ kind: "person", sub: known.sub }),
+          refresh_token: next,
+          expires_in: lifetime,
+          scope: "directory notifications"
+        });
+      }
+    } else if (grant === "client_credentials" && appTokens) {
+      seen.appTokens += 1;
+      answer = json({
+        token_type: "Bearer",
+        access_token: issueAccess({ kind: "app" }),
+        expires_in: lifetime
+      });
+    } else {
+      answer = json(
+        { error: "unsupported_grant_type", error_description: "the grant is not offered" },
+        400
+      );
+    }
+    if (failure?.kind === "lost-answer") return hang(signal);
+    return answer;
+  };
+  const bearer = (request) => {
+    const header = request.headers.get("authorization") ?? "";
+    const token = header.startsWith("Bearer ") ? header.slice(7) : "";
+    const found = accessTokens.get(token);
+    if (!found || found.expiresAt <= now()) {
+      return problem(401, "invalid_token", "The token is missing, expired or revoked.", {
+        "www-authenticate": 'Bearer error="invalid_token"'
+      });
+    }
+    return found;
+  };
+  const user = (person) => ({
+    sub: person.sub,
+    name: person.name,
+    picture: person.picture ?? null
+  });
+  const sent = /* @__PURE__ */ new Map();
+  const notificationJson = (n) => ({
+    id: n.id,
+    title: n.title,
+    body: n.body ?? null,
+    url: n.url ?? null,
+    category: n.category ?? "info",
+    createdAt: new Date(n.createdAt).toISOString(),
+    readAt: n.readAt === null ? null : new Date(n.readAt).toISOString(),
+    expiresAt: new Date(n.createdAt + 30 * 864e5).toISOString()
+  });
+  const emails = /* @__PURE__ */ new Map();
+  const emailApi = async (request) => {
+    const who = bearer(request);
+    if (who instanceof Response) return who;
+    if (who.kind !== "app" || request.method !== "POST") {
+      return problem(403, "insufficient_scope", "Only an app acting for itself may send email.");
+    }
+    const body = await request.json().catch(() => void 0);
+    const text = (value, max) => typeof value === "string" && value.trim() !== "" && value.length <= max;
+    if (!body || !text(body.to, 255) || !text(body.subject, 150) || !text(body.body, 5e3) || body.link !== void 0 && typeof body.link !== "string" || body.key !== void 0 && !text(body.key, 100)) {
+      return problem(400, "invalid_request", "to, subject and body are required text.");
+    }
+    const to = body.to;
+    const key = body.key;
+    const same = key === void 0 ? void 0 : [...emails.values()].find(
+      (email) => email.to === to && email.key === key && now() - email.sentAt < 864e5
+    );
+    if (same) return json({ id: same.id }, 202);
+    const id = random("m");
+    if (people.has(to) && people.get(to)?.active !== false) {
+      emails.set(id, {
+        id,
+        to,
+        subject: body.subject,
+        body: body.body,
+        ...typeof body.link === "string" ? { link: body.link } : {},
+        ...key === void 0 ? {} : { key },
+        sentAt: now()
+      });
+    }
+    return json({ id }, 202);
+  };
+  const entries = /* @__PURE__ */ new Map();
+  const activityApi = async (request) => {
+    const who = bearer(request);
+    if (who instanceof Response) return who;
+    if (who.kind !== "app" || request.method !== "POST") {
+      return problem(
+        403,
+        "insufficient_scope",
+        "Only an app acting for itself may record activity."
+      );
+    }
+    const body = await request.json().catch(() => void 0);
+    const text = (value, max) => typeof value === "string" && value.trim() !== "" && value.length <= max;
+    const when = typeof body?.at === "string" ? Date.parse(body.at) : now();
+    if (!body || !text(body.to, 255) || !text(body.summary, 200) || body.link !== void 0 && typeof body.link !== "string" || body.key !== void 0 && !text(body.key, 100) || !Number.isFinite(when)) {
+      return problem(400, "invalid_request", "to and summary are required text.");
+    }
+    const to = body.to;
+    const key = body.key;
+    const same = key === void 0 ? void 0 : [...entries.values()].find(
+      (entry) => entry.to === to && entry.key === key && now() - entry.recordedAt < 864e5
+    );
+    if (same) return json({ id: same.id }, 202);
+    const id = random("a");
+    if (people.has(to) && people.get(to)?.active !== false) {
+      entries.set(id, {
+        id,
+        to,
+        summary: body.summary,
+        ...typeof body.link === "string" ? { link: body.link } : {},
+        at: when,
+        ...key === void 0 ? {} : { key },
+        recordedAt: now()
+      });
+    }
+    return json({ id }, 202);
+  };
+  const notificationsApi = async (request, path) => {
+    const who = bearer(request);
+    if (who instanceof Response) return who;
+    const sendPath = path.pathname === "/api/v1/notifications" && request.method === "POST";
+    if (sendPath) {
+      if (who.kind !== "app") {
+        return problem(403, "insufficient_scope", "Only an app acting for itself may send.");
+      }
+      const body = await request.json().catch(() => void 0);
+      if (!body || typeof body.to !== "string" || typeof body.title !== "string" || body.title === "") {
+        return problem(400, "invalid_request", "to and title are required.");
+      }
+      const id = random("n");
+      if (people.get(body.to)?.active !== false && people.has(body.to)) {
+        sent.set(id, {
+          id,
+          to: body.to,
+          title: body.title,
+          ...typeof body.body === "string" ? { body: body.body } : {},
+          ...typeof body.url === "string" ? { url: body.url } : {},
+          ...typeof body.category === "string" ? { category: body.category } : {},
+          createdAt: now(),
+          readAt: null,
+          dismissed: false
+        });
+      }
+      return json({ id }, 202);
+    }
+    if (who.kind !== "person") {
+      return problem(
+        403,
+        "insufficient_scope",
+        "The token does not carry the notifications scope."
+      );
+    }
+    const mine = () => [...sent.values()].filter((n) => n.to === who.sub && !n.dismissed);
+    if (path.pathname === "/api/v1/notifications" && request.method === "GET") {
+      const unread = path.searchParams.get("unread") === "true";
+      const limit = Number(path.searchParams.get("limit") ?? 50);
+      const found = mine().filter((n) => !unread || n.readAt === null).sort((a, b) => b.createdAt - a.createdAt).slice(0, Number.isInteger(limit) && limit > 0 ? limit : 50);
+      return json({ notifications: found.map(notificationJson) });
+    }
+    if (request.method === "POST" && path.pathname === "/api/v1/notifications/read-all") {
+      const all = mine().filter((n) => n.readAt === null);
+      for (const n of all) n.readAt = now();
+      return json({ count: all.length });
+    }
+    if (request.method === "POST" && path.pathname === "/api/v1/notifications/dismiss-all") {
+      const all = mine();
+      for (const n of all) n.dismissed = true;
+      return json({ count: all.length });
+    }
+    const one = /^\/api\/v1\/notifications\/([^/]+)\/(read|dismiss)$/.exec(path.pathname);
+    if (one && request.method === "POST") {
+      const found = mine().find((n) => n.id === one[1]);
+      if (!found) return problem(404, "not_found", "There is no such notification.");
+      if (one[2] === "read") found.readAt ??= now();
+      else found.dismissed = true;
+      return json(notificationJson(found));
+    }
+    return problem(404, "not_found", "There is no such route.");
+  };
+  const directory = async (request, path) => {
+    const who = bearer(request);
+    if (who instanceof Response) return who;
+    if (who.kind !== "person") {
+      return problem(403, "insufficient_scope", "The token does not carry the directory scope.");
+    }
+    if (path.pathname === "/api/v1/directory/users" && request.method === "GET") {
+      const q = (path.searchParams.get("q") ?? "").trim().toLowerCase();
+      if (q === "" || q.length > 100)
+        return problem(400, "invalid_request", "q is 1 to 100 characters.");
+      const limit = Number(path.searchParams.get("limit") ?? 10);
+      const found = [...people.values()].filter((p) => p.active !== false && p.name.toLowerCase().includes(q)).slice(0, Number.isInteger(limit) && limit > 0 ? limit : 10);
+      return json({ users: found.map(user) });
+    }
+    if (path.pathname === "/api/v1/directory/users/resolve" && request.method === "POST") {
+      const body = await request.json().catch(() => void 0);
+      const subs = body?.subs;
+      if (!Array.isArray(subs) || subs.length < 1 || subs.length > 100 || subs.some((s) => typeof s !== "string" || s === "")) {
+        return problem(400, "invalid_request", "subs is 1 to 100 identifiers.");
+      }
+      const users = [];
+      for (const sub of subs) {
+        const person = people.get(sub);
+        if (person) users.push({ ...user(person), active: person.active !== false });
+      }
+      return json({ users });
+    }
+    if (path.pathname === "/api/v1/directory/users/by-email" && request.method === "GET") {
+      const email = path.searchParams.get("email") ?? "";
+      if (!email.includes("@"))
+        return problem(400, "invalid_request", "email is a whole email address.");
+      return problem(404, "not_found", "There is no such person.");
+    }
+    return problem(404, "not_found", "There is no such route.");
+  };
+  const handle = async (request, signal) => {
+    const path = new URL(request.url);
+    if (path.origin !== url) down();
+    const target = targetOf(path.pathname);
+    const failure = takeFailure(target);
+    if (failure?.kind === "down") down();
+    if (failure?.kind === "timeout") return hang(signal);
+    if (failure?.kind === "status") {
+      return problem(
+        failure.status,
+        failure.status === 429 ? "rate_limited" : "invalid_request",
+        "The fake core was told to fail.",
+        {
+          // Marks an answer the fake was told to give, which the contract does not have to describe.
+          "x-fake-failure": "true",
+          ...failure.retryAfter === void 0 ? {} : { "retry-after": String(failure.retryAfter) }
+        }
+      );
+    }
+    if (path.pathname === "/.well-known/openid-configuration") {
+      return json({
+        issuer: url,
+        token_endpoint: `${url}/api/auth/oauth2/token`,
+        authorization_endpoint: `${url}/api/auth/oauth2/authorize`,
+        end_session_endpoint: `${url}/api/auth/oauth2/end-session`,
+        jwks_uri: `${url}/api/auth/jwks`,
+        response_types_supported: ["code"],
+        subject_types_supported: ["public"],
+        id_token_signing_alg_values_supported: ["EdDSA"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
+        authorization_response_iss_parameter_supported: true
+      });
+    }
+    if (path.pathname === "/api/auth/jwks") {
+      return json({ keys: [(await keys()).publicJwk] });
+    }
+    if (path.pathname === "/.well-known/sovereign-instance") {
+      const document = {
+        name: options.instance?.name ?? "Fake instance",
+        url,
+        logo: { light: null, dark: null },
+        favicon: null
+      };
+      if (api) document.api = api;
+      return json(document, 200, { "access-control-allow-origin": "*" });
+    }
+    if (path.pathname === "/api/auth/oauth2/token" && request.method === "POST") {
+      return tokenEndpoint(request, failure, signal);
+    }
+    if (path.pathname === "/api/v1/activity") {
+      const answer = await activityApi(request);
+      return failure?.kind === "lost-answer" ? hang(signal) : answer;
+    }
+    if (path.pathname === "/api/v1/email") {
+      const answer = await emailApi(request);
+      return failure?.kind === "lost-answer" ? hang(signal) : answer;
+    }
+    if (path.pathname.startsWith("/api/v1/notifications")) {
+      const answer = await notificationsApi(request, path);
+      return failure?.kind === "lost-answer" ? hang(signal) : answer;
+    }
+    if (path.pathname.startsWith("/api/v1/")) {
+      const answer = await directory(request, path);
+      return failure?.kind === "lost-answer" ? hang(signal) : answer;
+    }
+    return problem(404, "not_found", "There is no such route.");
+  };
+  const fakeFetch = (async (input, init) => {
+    const request = new Request(input, init);
+    const signal = init?.signal ?? (input instanceof Request ? input.signal : void 0);
+    const entry = {
+      method: request.method,
+      path: new URL(request.url).pathname,
+      status: 0
+    };
+    requests.push(entry);
+    const answer = await handle(request, signal);
+    entry.status = answer.status;
+    return answer;
+  });
+  const notice = async (typ, event, who, wrong) => {
+    const issued = Math.floor(now() / 1e3);
+    const claims = { events: { [event]: {} } };
+    if (who.sub && wrong !== "no-subject") claims.sub = who.sub;
+    if (who.sid && wrong !== "no-subject") claims.sid = who.sid;
+    if (wrong === "event") claims.events = {};
+    if (wrong === "nonce") claims.nonce = "a-nonce";
+    let jwt = new SignJWT(claims).setProtectedHeader({ alg: "EdDSA", kid: "fake-1", typ: wrong === "type" ? "JWT" : typ }).setIssuer(wrong === "issuer" ? "https://elsewhere.test" : url).setAudience(wrong === "audience" ? "another-app" : credentials.clientId).setIssuedAt(wrong === "future" ? issued + 3600 : issued).setExpirationTime(wrong === "expired" ? issued - 10 : issued + 120);
+    if (wrong !== "no-jti") jwt = jwt.setJti(random("jti"));
+    if (wrong === "signature") {
+      const other = await generateKeyPair("EdDSA");
+      return jwt.sign(other.privateKey);
+    }
+    return jwt.sign((await keys()).privateKey);
+  };
+  return {
+    url,
+    credentials,
+    fetch: fakeFetch,
+    addPerson(person) {
+      people.set(person.sub, {
+        sub: person.sub,
+        name: person.name ?? person.sub,
+        picture: person.picture ?? null,
+        active: person.active ?? true
+      });
+    },
+    signIn(sub) {
+      if (!people.has(sub)) people.set(sub, { sub, name: sub, picture: null, active: true });
+      const token = random("rt");
+      refreshTokens.set(token, { sub, used: false });
+      return token;
+    },
+    fail(failure, { target = "any", times = Number.POSITIVE_INFINITY } = {}) {
+      failures.push({ failure, target, times });
+    },
+    heal() {
+      failures.length = 0;
+    },
+    authorize(authorizationUrl, sub, options2 = {}) {
+      const request = new URL(authorizationUrl);
+      const given = request.searchParams;
+      const redirectUri = given.get("redirect_uri") ?? "";
+      const scope = given.get("scope") ?? "";
+      const problems = [
+        request.origin + request.pathname !== `${url}/api/auth/oauth2/authorize` && "wrong endpoint",
+        given.get("client_id") !== credentials.clientId && "unknown client_id",
+        given.get("response_type") !== "code" && "response_type is not code",
+        given.get("code_challenge_method") !== "S256" && "PKCE S256 is required",
+        !given.get("code_challenge") && "a code_challenge is required",
+        !redirectUri && "a redirect_uri is required",
+        !scope.split(" ").includes("openid") && "the openid scope is required"
+      ].filter(Boolean);
+      if (problems.length > 0) {
+        throw new Error(`the fake core refuses this authorization request: ${problems.join(", ")}`);
+      }
+      const code = random("code");
+      const sid = random("sid");
+      codes.set(code, {
+        sub,
+        sid,
+        nonce: given.get("nonce"),
+        challenge: given.get("code_challenge") ?? "",
+        redirectUri,
+        scope,
+        roles: options2.roles ?? [],
+        used: false
+      });
+      sessionOf.set(sub, sid);
+      if (!people.has(sub)) people.set(sub, { sub, name: sub, picture: null, active: true });
+      const back = new URL(redirectUri);
+      back.searchParams.set("code", code);
+      const state = given.get("state");
+      if (state) back.searchParams.set("state", state);
+      back.searchParams.set("iss", url);
+      return back.toString();
+    },
+    sessionIdOf: (sub) => sessionOf.get(sub),
+    async logoutToken(who, { wrong } = {}) {
+      return notice("logout+jwt", "http://schemas.openid.net/event/backchannel-logout", who, wrong);
+    },
+    async accountDeletedToken(who, { wrong } = {}) {
+      return notice("account-deleted+jwt", "urn:sovereignfs:event:account-deleted", who, wrong);
+    },
+    get notificationsSent() {
+      return [...sent.values()];
+    },
+    get activityRecorded() {
+      return [...entries.values()];
+    },
+    get emailsSent() {
+      return [...emails.values()];
+    },
+    revoke(sub) {
+      for (const [token, other] of refreshTokens)
+        if (other.sub === sub) refreshTokens.delete(token);
+      for (const [token, other] of accessTokens)
+        if (other.kind === "person" && other.sub === sub) accessTokens.delete(token);
+    },
+    expireAccessTokens() {
+      accessTokens.clear();
+    },
+    get seen() {
+      return { requests: [...requests], ...seen };
+    }
+  };
+}
+function memorySessionStore(now = () => Date.now()) {
+  const records = /* @__PURE__ */ new Map();
+  return {
+    get(id) {
+      const found = records.get(id);
+      if (!found || found.expiresAt <= now()) return void 0;
+      return found.record;
+    },
+    set(id, record, expiresAt) {
+      records.set(id, { record, expiresAt });
+    },
+    delete(id) {
+      records.delete(id);
+    },
+    deleteMatching({ sub, sid }) {
+      for (const [id, { record }] of records) {
+        if (record.kind !== "session") continue;
+        if (sid !== void 0 && record.sid === sid || sid === void 0 && sub !== void 0 && record.sub === sub) {
+          records.delete(id);
+        }
+      }
+    }
+  };
+}
+export {
+  createFakeCore,
+  memorySessionStore
+};

package/package.json

@@ -1,50 +1,76 @@
 {
   "name": "@sovereignfs/sdk",
-  "version": "1.25.0",
+  "version": "2.0.1",
   "type": "module",
-  "description": "Sovereign SDK — the plugin↔platform contract (types and interfaces).",
-  "license": "AGPL-3.0-or-later",
-  "publishConfig": {
-    "access": "public"
+  "description": "How a JavaScript app's server talks to the Sovereign server it signs people in with: tokens, failure, version support.",
+  "license": "MPL-2.0",
+  "sideEffects": [
+    "./src/browser.ts",
+    "./dist/browser.js"
+  ],
+  "engines": {
+    "node": ">=22.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sovereignfs/sovereign.git",
+    "directory": "packages/sdk"
+  },
+  "homepage": "https://github.com/sovereignfs/sovereign/tree/main/packages/sdk#readme",
+  "bugs": {
+    "url": "https://github.com/sovereignfs/sovereign/issues"
+  },
+  "sovereign": {
+    "core": ">=0.46.0"
   },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
+      "browser": "./dist/browser.js",
       "default": "./dist/index.js"
     },
-    "./e2ee-crypto": {
-      "types": "./dist/e2ee-crypto.d.ts",
-      "default": "./dist/e2ee-crypto.js"
-    },
-    "./e2ee-device": {
-      "types": "./dist/e2ee-device.d.ts",
-      "default": "./dist/e2ee-device.js"
-    },
-    "./e2ee-object": {
-      "types": "./dist/e2ee-object.d.ts",
-      "default": "./dist/e2ee-object.js"
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "default": "./dist/next.js"
     },
-    "./e2ee-state": {
-      "types": "./dist/e2ee-state.d.ts",
-      "default": "./dist/e2ee-state.js"
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "default": "./dist/testing.js"
     }
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "files": [
     "dist",
-    "src"
+    "LICENSE",
+    "README.md"
   ],
+  "dependencies": {
+    "jose": "^6.2.13",
+    "openid-client": "^6.8.8"
+  },
   "peerDependencies": {
-    "next": ">=15.0.0"
+    "next": ">=15"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
   },
   "devDependencies": {
-    "next": "^15.0.0",
-    "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
-    "@sovereignfs/tsconfig": "0.0.0"
+    "@sovereignfs/api-client": "0.1.0",
+    "@sovereignfs/config": "0.0.0",
+    "@sovereignfs/tsconfig": "0.0.0",
+    "@types/node": "^24.19.2",
+    "@types/react": "^19.3.0",
+    "next": "^16.4.3",
+    "react": "^19.3.1",
+    "tsup": "^9.0.0",
+    "typescript": "~6.0.3"
   },
   "scripts": {
     "build": "tsup",
     "typecheck": "tsc --noEmit"
-  },
-  "types": "./dist/index.d.ts"
+  }
 }

package/dist/chunk-MLKGABMK.js

@@ -1,9 +0,0 @@
-var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-export {
-  __export
-};