@storyshelf/auth-oauth 0.1.0

package/README.md

@@ -0,0 +1,68 @@
+# @storyshelf/auth-oauth
+
+An OAuth/OIDC auth adapter for StoryShelf: authenticates users against an OpenID Connect provider (e.g. Keycloak) via the authorization-code flow. Sessions are HMAC-signed cookies with a 7-day TTL.
+
+## Install
+
+```sh
+nub add @storyshelf/auth-oauth
+```
+
+or
+
+```sh
+npm install @storyshelf/auth-oauth
+```
+
+## Quick start
+
+```ts
+import { createOAuthAuth } from "@storyshelf/auth-oauth";
+import { createShelfRouter } from "@storyshelf/core";
+
+const auth = createOAuthAuth({
+  issuer: process.env.OIDC_ISSUER!,
+  clientId: process.env.OIDC_CLIENT_ID!,
+  clientSecret: process.env.OIDC_CLIENT_SECRET!,
+  secret: process.env.SHELF_SECRET!,      // session signing secret
+  redirectUrl: process.env.OIDC_REDIRECT_URL!,
+  scopes: ["openid", "email", "profile"], // optional
+});
+
+const app = createShelfRouter({ database, storage, auth });
+```
+
+## API
+
+### `OAuthAuthOptions`
+
+```ts
+interface OAuthAuthOptions {
+  issuer: string;        // OIDC issuer base URL
+  clientId: string;      // OIDC client id
+  clientSecret: string;  // OIDC client secret
+  secret: string;        // secret used to HMAC-sign session cookies
+  redirectUrl: string;   // callback/redirect URI registered with the provider
+  scopes?: string[];     // defaults to ["openid", "email", "profile"]
+}
+```
+
+### `createOAuthAuth(options: OAuthAuthOptions): OAuthAuth`
+
+Returns an `OAuthAuth`, which extends `AuthAdapter` with an extra method:
+
+```ts
+interface OAuthAuth extends AuthAdapter {
+  loginUrl(state: string): string;
+}
+```
+
+- `loginUrl(state)` — builds the authorization URL to redirect users to your OIDC provider.
+- `handleCallback(callback)` — exchanges the authorization code for a token and fetches the userinfo endpoint, returning an `AuthUser` or `null`.
+- `check(request)`, `createSession(user)`, `destroySession(sessionId)` — the standard `AuthAdapter` interface, with sessions verified using timing-safe comparison.
+
+## How it fits in
+
+`auth-oauth` is the `auth` option for `createShelfRouter` when you want to sign in with an existing identity provider. When supplied, the router redirects unauthenticated UI requests to `loginUrl` and handles the OIDC callback to establish a session.
+
+See `docs/architecture.md` and ADR 0008.

package/dist/index.d.mts

@@ -0,0 +1,34 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { AuthAdapter } from "@storyshelf/core/adapter/auth";
+//#region src/index.d.ts
+/** Options for configuring an OAuth/OIDC auth adapter. */
+interface OAuthAuthOptions {
+  /** OIDC issuer base URL. */
+  issuer: string;
+  /** OAuth client ID. */
+  clientId: string;
+  /** OAuth client secret. */
+  clientSecret: string;
+  /** Secret used to sign and verify session cookies. */
+  secret: string;
+  /** Redirect URL registered with the OIDC provider. */
+  redirectUrl: string;
+  /** Optional OAuth scopes. Defaults to `openid`, `email`, `profile`. */
+  scopes?: string[];
+}
+/** Auth adapter that authenticates against an OAuth/OIDC provider. */
+interface OAuthAuth extends AuthAdapter {
+  /** Build the provider authorization URL for a login flow with the given anti-CSRF `state`. */
+  loginUrl(state: string): string;
+}
+/**
+ * Create an OAuth/OIDC auth adapter.
+ *
+ * @param options - OIDC provider and session configuration.
+ * @returns An OAuthAuth instance.
+ */
+declare function createOAuthAuth(options: OAuthAuthOptions): OAuthAuth;
+//#endregion
+export { OAuthAuth, OAuthAuthOptions, createOAuthAuth };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -0,0 +1,150 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SESSION_COOKIE } from "@storyshelf/core/adapter/auth";
+import { createHmac, timingSafeEqual } from "node:crypto";
+//#region src/index.ts
+const SESSION_TTL_MS = 6048e5;
+function hmacHex(secret, value) {
+	return createHmac("sha256", secret).update(value).digest("hex");
+}
+function equalStrings(left, right) {
+	const leftBuffer = Buffer.from(left);
+	const rightBuffer = Buffer.from(right);
+	return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}
+function encodePayload(payload) {
+	return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodePayload(body) {
+	try {
+		return JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+}
+function signPayload(secret, payload) {
+	const body = encodePayload(payload);
+	return `${body}.${hmacHex(secret, body)}`;
+}
+function verifyPayload(secret, token) {
+	const dot = token.lastIndexOf(".");
+	if (dot === -1) return null;
+	const body = token.slice(0, dot);
+	const signature = token.slice(dot + 1);
+	if (!equalStrings(hmacHex(secret, body), signature)) return null;
+	return decodePayload(body);
+}
+function readCookie(request, name) {
+	const header = request.headers.get("cookie");
+	if (!header) return;
+	for (const part of header.split(";")) {
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
+	}
+}
+function toUser(payload) {
+	return {
+		id: payload.userId,
+		email: payload.email,
+		name: payload.name,
+		avatarUrl: payload.avatarUrl,
+		role: payload.role
+	};
+}
+function buildLoginUrl(options, scopes, state) {
+	const params = new URLSearchParams({
+		client_id: options.clientId,
+		redirect_uri: options.redirectUrl,
+		response_type: "code",
+		scope: scopes.join(" "),
+		state
+	});
+	return `${options.issuer}/protocol/openid-connect/auth?${params.toString()}`;
+}
+async function exchangeCode(options, code) {
+	const body = new URLSearchParams({
+		grant_type: "authorization_code",
+		code,
+		client_id: options.clientId,
+		client_secret: options.clientSecret,
+		redirect_uri: options.redirectUrl
+	});
+	const response = await fetch(`${options.issuer}/protocol/openid-connect/token`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: body.toString()
+	});
+	if (!response.ok) return null;
+	return (await response.json()).access_token ?? null;
+}
+async function fetchUserInfo(options, accessToken) {
+	const response = await fetch(`${options.issuer}/protocol/openid-connect/userinfo`, { headers: { authorization: `Bearer ${accessToken}` } });
+	if (!response.ok) return null;
+	const info = await response.json();
+	if (!info.sub) return null;
+	return {
+		id: info.sub,
+		email: info.email ?? "",
+		name: info.name ?? info.email ?? info.sub,
+		avatarUrl: info.picture,
+		role: "member"
+	};
+}
+/**
+* Create an OAuth/OIDC auth adapter.
+*
+* @param options - OIDC provider and session configuration.
+* @returns An OAuthAuth instance.
+*/
+function createOAuthAuth(options) {
+	const { secret } = options;
+	const scopes = options.scopes ?? [
+		"openid",
+		"email",
+		"profile"
+	];
+	const check = async (request) => {
+		const token = readCookie(request, SESSION_COOKIE);
+		if (!token) return null;
+		const payload = verifyPayload(secret, token);
+		if (!payload || payload.expiresAt <= Date.now()) return null;
+		return toUser(payload);
+	};
+	const createSession = async (user) => {
+		const payload = {
+			userId: user.id,
+			email: user.email,
+			name: user.name,
+			avatarUrl: user.avatarUrl,
+			role: user.role,
+			expiresAt: Date.now() + SESSION_TTL_MS
+		};
+		return signPayload(secret, payload);
+	};
+	const handleCallback = async (callback) => {
+		const token = await exchangeCode(options, callback.code);
+		if (!token) return null;
+		return fetchUserInfo(options, token);
+	};
+	return {
+		metadata: {
+			name: "OAuth",
+			version: "0.1.0",
+			description: "OAuth/OIDC auth adapter",
+			kind: "oauth"
+		},
+		check,
+		createSession,
+		async destroySession() {
+			await Promise.resolve();
+		},
+		handleCallback,
+		loginUrl: (state) => buildLoginUrl(options, scopes, state)
+	};
+}
+//#endregion
+export { createOAuthAuth };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import { SESSION_COOKIE, type AuthAdapter, type AuthCallback, type AuthUser } from \"@storyshelf/core/adapter/auth\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\ndeclare const __PKG_VERSION__: string;\n\nconst SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ninterface SessionPayload {\n  userId: string;\n  email: string;\n  name: string;\n  avatarUrl?: string;\n  role: AuthUser[\"role\"];\n  expiresAt: number;\n}\n\ninterface TokenResponse {\n  access_token?: string;\n}\n\ninterface UserInfoResponse {\n  sub?: string;\n  email?: string;\n  name?: string;\n  picture?: string;\n}\n\n/** Options for configuring an OAuth/OIDC auth adapter. */\nexport interface OAuthAuthOptions {\n  /** OIDC issuer base URL. */\n  issuer: string;\n  /** OAuth client ID. */\n  clientId: string;\n  /** OAuth client secret. */\n  clientSecret: string;\n  /** Secret used to sign and verify session cookies. */\n  secret: string;\n  /** Redirect URL registered with the OIDC provider. */\n  redirectUrl: string;\n  /** Optional OAuth scopes. Defaults to `openid`, `email`, `profile`. */\n  scopes?: string[];\n}\n\n/** Auth adapter that authenticates against an OAuth/OIDC provider. */\nexport interface OAuthAuth extends AuthAdapter {\n  /** Build the provider authorization URL for a login flow with the given anti-CSRF `state`. */\n  loginUrl(state: string): string;\n}\n\nfunction hmacHex(secret: string, value: string): string {\n  return createHmac(\"sha256\", secret).update(value).digest(\"hex\");\n}\n\nfunction equalStrings(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction encodePayload(payload: SessionPayload): string {\n  return Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n}\n\nfunction decodePayload(body: string): SessionPayload | null {\n  try {\n    return JSON.parse(Buffer.from(body, \"base64url\").toString(\"utf8\")) as SessionPayload;\n  } catch {\n    return null;\n  }\n}\n\nfunction signPayload(secret: string, payload: SessionPayload): string {\n  const body = encodePayload(payload);\n  return `${body}.${hmacHex(secret, body)}`;\n}\n\nfunction verifyPayload(secret: string, token: string): SessionPayload | null {\n  const dot = token.lastIndexOf(\".\");\n  if (dot === -1) {\n    return null;\n  }\n  const body = token.slice(0, dot);\n  const signature = token.slice(dot + 1);\n  if (!equalStrings(hmacHex(secret, body), signature)) {\n    return null;\n  }\n  return decodePayload(body);\n}\n\nfunction readCookie(request: Request, name: string): string | undefined {\n  const header = request.headers.get(\"cookie\");\n  if (!header) {\n    return undefined;\n  }\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) {\n      continue;\n    }\n    if (part.slice(0, eq).trim() === name) {\n      return part.slice(eq + 1).trim();\n    }\n  }\n  return undefined;\n}\n\nfunction toUser(payload: SessionPayload): AuthUser {\n  return {\n    id: payload.userId,\n    email: payload.email,\n    name: payload.name,\n    avatarUrl: payload.avatarUrl,\n    role: payload.role,\n  };\n}\n\nfunction buildLoginUrl(options: OAuthAuthOptions, scopes: string[], state: string): string {\n  const params = new URLSearchParams({\n    client_id: options.clientId,\n    redirect_uri: options.redirectUrl,\n    response_type: \"code\",\n    scope: scopes.join(\" \"),\n    state,\n  });\n  return `${options.issuer}/protocol/openid-connect/auth?${params.toString()}`;\n}\n\nasync function exchangeCode(options: OAuthAuthOptions, code: string): Promise<string | null> {\n  const body = new URLSearchParams({\n    grant_type: \"authorization_code\",\n    code,\n    client_id: options.clientId,\n    client_secret: options.clientSecret,\n    redirect_uri: options.redirectUrl,\n  });\n  const response = await fetch(`${options.issuer}/protocol/openid-connect/token`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body: body.toString(),\n  });\n  if (!response.ok) {\n    return null;\n  }\n  const data = (await response.json()) as TokenResponse;\n  return data.access_token ?? null;\n}\n\nasync function fetchUserInfo(\n  options: OAuthAuthOptions,\n  accessToken: string,\n): Promise<AuthUser | null> {\n  const response = await fetch(`${options.issuer}/protocol/openid-connect/userinfo`, {\n    headers: { authorization: `Bearer ${accessToken}` },\n  });\n  if (!response.ok) {\n    return null;\n  }\n  const info = (await response.json()) as UserInfoResponse;\n  if (!info.sub) {\n    return null;\n  }\n  return {\n    id: info.sub,\n    email: info.email ?? \"\",\n    name: info.name ?? info.email ?? info.sub,\n    avatarUrl: info.picture,\n    role: \"member\",\n  };\n}\n\n/**\n * Create an OAuth/OIDC auth adapter.\n *\n * @param options - OIDC provider and session configuration.\n * @returns An OAuthAuth instance.\n */\nexport function createOAuthAuth(options: OAuthAuthOptions): OAuthAuth {\n  const { secret } = options;\n  const scopes = options.scopes ?? [\"openid\", \"email\", \"profile\"];\n\n  // Async is required by the AuthAdapter interface, though the logic is synchronous.\n  // eslint-disable-next-line require-await\n  const check = async (request: Request): Promise<AuthUser | null> => {\n    const token = readCookie(request, SESSION_COOKIE);\n    if (!token) {\n      return null;\n    }\n    const payload = verifyPayload(secret, token);\n    if (!payload || payload.expiresAt <= Date.now()) {\n      return null;\n    }\n    return toUser(payload);\n  };\n\n  // eslint-disable-next-line require-await\n  const createSession = async (user: AuthUser): Promise<string> => {\n    const payload: SessionPayload = {\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n      avatarUrl: user.avatarUrl,\n      role: user.role,\n      expiresAt: Date.now() + SESSION_TTL_MS,\n    };\n    return signPayload(secret, payload);\n  };\n\n  const handleCallback = async (callback: AuthCallback): Promise<AuthUser | null> => {\n    const token = await exchangeCode(options, callback.code);\n    if (!token) {\n      return null;\n    }\n    return fetchUserInfo(options, token);\n  };\n\n  return {\n    metadata: {\n      name: \"OAuth\",\n      version: typeof __PKG_VERSION__ === \"undefined\" ? \"0.0.0\" : __PKG_VERSION__, // oxlint-disable-line unicorn/no-typeof-undefined\n      description: \"OAuth/OIDC auth adapter\",\n      kind: \"oauth\",\n    },\n    check,\n    createSession,\n    async destroySession() {\n      await Promise.resolve();\n    },\n    handleCallback,\n    loginUrl: (state: string) => buildLoginUrl(options, scopes, state),\n  };\n}\n"],"mappings":";;;;;;AAKA,MAAM,iBAAiB;AA4CvB,SAAS,QAAQ,QAAgB,OAAuB;CACtD,OAAO,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAChE;AAEA,SAAS,aAAa,MAAc,OAAwB;CAC1D,MAAM,aAAa,OAAO,KAAK,IAAI;CACnC,MAAM,cAAc,OAAO,KAAK,KAAK;CACrC,OAAO,WAAW,WAAW,YAAY,UAAU,gBAAgB,YAAY,WAAW;AAC5F;AAEA,SAAS,cAAc,SAAiC;CACtD,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW;AAClE;AAEA,SAAS,cAAc,MAAqC;CAC1D,IAAI;EACF,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;CACnE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,QAAgB,SAAiC;CACpE,MAAM,OAAO,cAAc,OAAO;CAClC,OAAO,GAAG,KAAK,GAAG,QAAQ,QAAQ,IAAI;AACxC;AAEA,SAAS,cAAc,QAAgB,OAAsC;CAC3E,MAAM,MAAM,MAAM,YAAY,GAAG;CACjC,IAAI,QAAQ,IACV,OAAO;CAET,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;CAC/B,MAAM,YAAY,MAAM,MAAM,MAAM,CAAC;CACrC,IAAI,CAAC,aAAa,QAAQ,QAAQ,IAAI,GAAG,SAAS,GAChD,OAAO;CAET,OAAO,cAAc,IAAI;AAC3B;AAEA,SAAS,WAAW,SAAkB,MAAkC;CACtE,MAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;CAC3C,IAAI,CAAC,QACH;CAEF,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,IACT;EAEF,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,MAAM,MAC/B,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CAEnC;AAEF;AAEA,SAAS,OAAO,SAAmC;CACjD,OAAO;EACL,IAAI,QAAQ;EACZ,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,WAAW,QAAQ;EACnB,MAAM,QAAQ;CAChB;AACF;AAEA,SAAS,cAAc,SAA2B,QAAkB,OAAuB;CACzF,MAAM,SAAS,IAAI,gBAAgB;EACjC,WAAW,QAAQ;EACnB,cAAc,QAAQ;EACtB,eAAe;EACf,OAAO,OAAO,KAAK,GAAG;EACtB;CACF,CAAC;CACD,OAAO,GAAG,QAAQ,OAAO,gCAAgC,OAAO,SAAS;AAC3E;AAEA,eAAe,aAAa,SAA2B,MAAsC;CAC3F,MAAM,OAAO,IAAI,gBAAgB;EAC/B,YAAY;EACZ;EACA,WAAW,QAAQ;EACnB,eAAe,QAAQ;EACvB,cAAc,QAAQ;CACxB,CAAC;CACD,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,OAAO,iCAAiC;EAC9E,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,KAAK,SAAS;CACtB,CAAC;CACD,IAAI,CAAC,SAAS,IACZ,OAAO;CAGT,QAAO,MADa,SAAS,KAAK,EAAA,CACtB,gBAAgB;AAC9B;AAEA,eAAe,cACb,SACA,aAC0B;CAC1B,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,OAAO,oCAAoC,EACjF,SAAS,EAAE,eAAe,UAAU,cAAc,EACpD,CAAC;CACD,IAAI,CAAC,SAAS,IACZ,OAAO;CAET,MAAM,OAAQ,MAAM,SAAS,KAAK;CAClC,IAAI,CAAC,KAAK,KACR,OAAO;CAET,OAAO;EACL,IAAI,KAAK;EACT,OAAO,KAAK,SAAS;EACrB,MAAM,KAAK,QAAQ,KAAK,SAAS,KAAK;EACtC,WAAW,KAAK;EAChB,MAAM;CACR;AACF;;;;;;;AAQA,SAAgB,gBAAgB,SAAsC;CACpE,MAAM,EAAE,WAAW;CACnB,MAAM,SAAS,QAAQ,UAAU;EAAC;EAAU;EAAS;CAAS;CAI9D,MAAM,QAAQ,OAAO,YAA+C;EAClE,MAAM,QAAQ,WAAW,SAAS,cAAc;EAChD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,UAAU,cAAc,QAAQ,KAAK;EAC3C,IAAI,CAAC,WAAW,QAAQ,aAAa,KAAK,IAAI,GAC5C,OAAO;EAET,OAAO,OAAO,OAAO;CACvB;CAGA,MAAM,gBAAgB,OAAO,SAAoC;EAC/D,MAAM,UAA0B;GAC9B,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,WAAW,KAAK;GAChB,MAAM,KAAK;GACX,WAAW,KAAK,IAAI,IAAI;EAC1B;EACA,OAAO,YAAY,QAAQ,OAAO;CACpC;CAEA,MAAM,iBAAiB,OAAO,aAAqD;EACjF,MAAM,QAAQ,MAAM,aAAa,SAAS,SAAS,IAAI;EACvD,IAAI,CAAC,OACH,OAAO;EAET,OAAO,cAAc,SAAS,KAAK;CACrC;CAEA,OAAO;EACL,UAAU;GACR,MAAM;GACN,SAAA;GACA,aAAa;GACb,MAAM;EACR;EACA;EACA;EACA,MAAM,iBAAiB;GACrB,MAAM,QAAQ,QAAQ;EACxB;EACA;EACA,WAAW,UAAkB,cAAc,SAAS,QAAQ,KAAK;CACnE;AACF"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@storyshelf/auth-oauth",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "OIDC authorization-code auth adapter for StoryShelf.",
+  "author": {
+    "name": "Siddhant Gupta",
+    "url": "https://guptasiddhant.com"
+  },
+  "license": "MIT",
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GuptaSiddhant/storyshelf.git",
+    "directory": "packages/auth-oauth"
+  },
+  "homepage": "https://github.com/GuptaSiddhant/storyshelf#readme",
+  "bugs": {
+    "url": "https://github.com/GuptaSiddhant/storyshelf/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "exports": {
+      ".": "./dist/index.mjs",
+      "./package.json": "./package.json"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown -w",
+    "fmt": "oxfmt -c ../../.oxfmtrc.json ./src",
+    "lint": "oxlint --type-aware --type-check ./src",
+    "test": "vitest run",
+    "prepublishOnly": "nub run build"
+  },
+  "dependencies": {
+    "@storyshelf/core": "workspace:*",
+    "hono": "^4.11.0"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "oxfmt": "catalog:",
+    "oxlint": "catalog:",
+    "oxlint-tsgolint": "catalog:",
+    "tsdown": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  },
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "source": "./src/index.ts",
+      "default": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
+  }
+}