@tapflowio/protocol 0.17.0 → 0.19.0

package/dist/validate/index.js

@@ -0,0 +1,364 @@
+/**
+ * Runtime validation for everything the relay receives — the half of the contract types cannot hold.
+ *
+ * `../index.ts` is types only, and deliberately so: the dashboard consumes it with `import type`, so it
+ * must erase completely. This entry point is where the runtime lives, reached as
+ * `@tapflowio/protocol/validate`, and only the relay imports it. `../AGENTS.md` reserved this spot.
+ *
+ * ## Why this exists at all
+ *
+ * The outbound direction has been compile-checked since #419 — `sendTo` refuses a message outside its
+ * union. Nothing checked the inbound direction, so the relay reached for `msg.sessionId!` and
+ * `msg.payload as X` on values that arrived over a network. #550 asked for `RelayMessage` (a flat
+ * interface where `type` is the only required member) to become a discriminated union, and doing that
+ * with a bare `as` at the door would have been a **downgrade**: the visible cast at
+ * `RelayServer.ts:753` would have become an invisible `msg.payload`, with the compiler now vouching
+ * for an attacker's JSON. So the union has to be the product of a parse, and this is that parse.
+ *
+ * ## The rule the two tiers come from
+ *
+ * **A field that was not validated must not appear in the type.** Anything else reintroduces the lie
+ * in a quieter place.
+ *
+ * - **Validated** — the full schema; parsing yields the interface. Used where the relay reads or acts
+ *   on the message.
+ * - **Envelope** — `type` plus whichever of `sessionId` / `requestId` the interface declares; parsing
+ *   yields `EnvelopeOf<I>`, so the relay **cannot** read a payload it did not check. Used where the
+ *   relay only forwards.
+ *
+ * ## Why the whole agent direction is Envelope except the six it consumes
+ *
+ * Not laziness, and not a deferral: agent-payload conformance is a property the protocol deliberately
+ * does not have. `AgentRegister.platform` is `string` — open, because a third-party platform registers
+ * through `AgentRegistry.register()` and the root AGENTS.md's OCP rule says that must work without
+ * modifying existing code — while `ChromePayload` is a **closed two-member union**. So a platform this
+ * repo promises to support has no valid `session:chrome` variant to send. Rejecting one would cost
+ * that platform its bezel and buttons permanently: the message arrives once per boot, a rejection
+ * skips `setChromeData` and therefore empties the re-join replay too, and there is no
+ * `session:chrome-error` for anyone to be told through.
+ *
+ * The six the relay consumes (`agent:register`, `agent:resources`, the two screenshot replies and the
+ * two ui-tree replies) forward nowhere, so rejecting them breaks no forward path — and their schemas
+ * carry a `.default()` for every field the relay currently reads through a `??`, which keeps today's
+ * tolerance for an older agent exactly as it is. `UIElement` is safe to validate where `ChromePayload`
+ * is not, for a reason worth stating: it is not a per-platform union but the normalized shape every
+ * platform maps *into*, so a third-party agent conforms by construction.
+ *
+ * ## What is not checked here, and where it is
+ *
+ * Role authorisation. `directionOf` answers which socket may send a type; deciding what to do about a
+ * mismatch (the relay closes a browser socket with 1008) stays in `RelayServer`, because it is a
+ * policy about a connection rather than a fact about a message.
+ */
+import * as z from 'zod';
+// ── field helpers ────────────────────────────────────────────────────────────
+//
+// `.min(1)`, never a bare `z.string()`, on both correlation fields. The predicates this replaces
+// (`isAddressed` / `isCorrelated`) rejected the empty string as well as the absent one, and dropping
+// that half would be a silent regression: a `device:boot` carrying `requestId: ''` would pass the door
+// and the relay would answer `device:boot-error` with `requestId: ''` — a frame whose required
+// correlator is present-but-empty, which every correlating consumer discards. `.min(1)` does not
+// change what `z.output` infers (`min(minLength): this` — zod 4.4.3 `v4/classic/schemas.d.ts:95`), so
+// it costs the tier assertions nothing.
+const sessionId = z.string().min(1);
+const requestId = z.string().min(1);
+const point = z.object({ x: z.number(), y: z.number() });
+// ── envelope-tier builders ───────────────────────────────────────────────────
+//
+// Four shapes cover all 22 forward-only messages. Getting one wrong is a compile error at its
+// assertion below rather than something that shows up as a dropped frame in production.
+/** `{ type, sessionId }` — no correlator on the interface. */
+const env = (type) => z.object({ type: z.literal(type), sessionId });
+/** `{ type, sessionId, requestId }`. */
+const envC = (type) => z.object({ type: z.literal(type), sessionId, requestId });
+/** `{ type, sessionId, requestId? }` — the relay originates some of these itself, so the agent's copy
+ *  is not always a reply. */
+const envCo = (type) => z.object({ type: z.literal(type), sessionId, requestId: requestId.optional() });
+// ── browser → relay ──────────────────────────────────────────────────────────
+//
+// Fully validated, and the only direction whose parse product is what gets forwarded. This is the
+// attacker-controllable side: a viewer can send arbitrary frames from devtools. `z.object` strips
+// unknown keys rather than rejecting them, so forwarding the product — not the original — is what
+// makes a key an attacker appended disappear before any agent sees it. Nothing in the repo loses a
+// field to that: the dashboard, `mcp-server` and `flow-runner` all send through a
+// `send(msg: BrowserToRelay)` signature, so their frames are already compile-checked against exactly
+// these shapes.
+const BROWSER_INBOUND = {
+    'agents:list': z.object({ type: z.literal('agents:list') }),
+    'session:start': z.object({ type: z.literal('session:start'), sessionId }),
+    'session:end': z.object({ type: z.literal('session:end'), sessionId }),
+    'session:leave': z.object({ type: z.literal('session:leave'), sessionId }),
+    'device:boot': z.object({
+        type: z.literal('device:boot'),
+        sessionId,
+        requestId,
+        payload: z.object({
+            deviceId: z.string(),
+            resetMode: z.enum(['app-only', 'full-erase']).optional(),
+            acceptH264: z.boolean().optional(),
+            secureContext: z.boolean().optional(),
+        }),
+    }),
+    'device:shutdown': z.object({
+        type: z.literal('device:shutdown'),
+        sessionId,
+        requestId: requestId.optional(),
+        payload: z.object({ deviceId: z.string() }),
+    }),
+    // Strict, because `ANSWERABLE` below answers a bad one rather than dropping it. A draft carried it
+    // through as `NaN` so the handler's `Number.isInteger` could keep replying `Build not found` — which
+    // worked, and left this message as the single special case in a class the door now handles uniformly.
+    // It was also the wrong diagnosis: nothing was looked up, so "not found" describes a query that never
+    // ran.
+    'app:install': z.object({ type: z.literal('app:install'), sessionId, requestId, buildId: z.number().int() }),
+    'app:launch': z.object({ type: z.literal('app:launch'), sessionId, requestId, buildId: z.number().int() }),
+    'app:clear-state': z.object({
+        type: z.literal('app:clear-state'), sessionId, requestId,
+        payload: z.object({ bundleId: z.string() }),
+    }),
+    'open-url': z.object({
+        type: z.literal('open-url'), sessionId, requestId, payload: z.object({ url: z.string() }),
+    }),
+    'input:touch:start': z.object({ type: z.literal('input:touch:start'), sessionId, payload: point }),
+    'input:touch:move': z.object({ type: z.literal('input:touch:move'), sessionId, payload: point }),
+    // `payload` optional because that is what the wire carries — the dashboard omits it and the agents
+    // never read it. See the note on `InputTouchEnd`.
+    'input:touch:end': z.object({
+        type: z.literal('input:touch:end'), sessionId, requestId, payload: point.optional(),
+    }),
+    'input:pinch:start': z.object({
+        type: z.literal('input:pinch:start'), sessionId, payload: z.object({ f0: point, f1: point }),
+    }),
+    'input:pinch:move': z.object({
+        type: z.literal('input:pinch:move'), sessionId, payload: z.object({ f0: point, f1: point }),
+    }),
+    'input:pinch:end': z.object({ type: z.literal('input:pinch:end'), sessionId, requestId }),
+    // `modifiers` is a bitmap, not a list — see the note on `InputKey`.
+    'input:key': z.object({
+        type: z.literal('input:key'), sessionId, requestId,
+        payload: z.object({ code: z.string(), modifiers: z.number().optional() }),
+    }),
+    'input:type': z.object({
+        type: z.literal('input:type'), sessionId, requestId, payload: z.object({ text: z.string() }),
+    }),
+    'input:button': z.object({
+        type: z.literal('input:button'), sessionId, requestId,
+        payload: z.object({ name: z.string(), phase: z.enum(['down', 'up']).optional() }),
+    }),
+    'input:rotate': z.object({ type: z.literal('input:rotate'), sessionId }),
+    'input:keyboard:toggle': z.object({ type: z.literal('input:keyboard:toggle'), sessionId }),
+    'clipboard:read': z.object({
+        type: z.literal('clipboard:read'), sessionId, requestId,
+        payload: z.object({ press: z.enum(['copy', 'cut']).optional() }).optional(),
+    }),
+    'clipboard:write': z.object({
+        type: z.literal('clipboard:write'), sessionId, requestId,
+        payload: z.object({ text: z.string(), pasteAfter: z.boolean().optional() }),
+    }),
+};
+// ── agent → relay ────────────────────────────────────────────────────────────
+/** The six the relay consumes. Every `.default()` below mirrors a `??` that is in `RelayServer` today,
+ *  so an agent older than a field keeps working exactly as it does now — the default lands in the
+ *  schema, where it is visible, instead of at the read site, where it read as defensive noise.
+ *
+ *  This is what makes rejection affordable here: `z.input` stays as loose as the wire has ever been
+ *  while `z.output` matches the interface, which is what the tier assertion compares. */
+const AGENT_CONSUMED = {
+    'agent:register': z.object({
+        type: z.literal('agent:register'),
+        // **All four defaults come from a `??` in `RelayServer`, and the list is exhaustive by
+        // construction** — `agentId ?? agentName` for identity, `devices ?? []`, `capabilities ?? []`, and
+        // `agentName ?? agentId ?? 'unknown'` / `platform ?? 'unknown'` in the connect log. A first draft
+        // defaulted only `capabilities` and `devices` and required these two, which would have made an
+        // agent omitting either **never register at all**: the frame is refused, no `agent:registered`
+        // goes back, and the agent's handshake promise never resolves — the whole Mac and every device on
+        // it simply absent from the dashboard, with one relay-side warn as the only trace. That is the
+        // most expensive rejection in the protocol, so this message is the one to be most tolerant on.
+        //
+        // `''` rather than `undefined` because `z.output` must match the interface, and it is behaviourally
+        // the same everywhere it reaches: `identity` stays falsy so no eviction runs, and the log line uses
+        // `||` for exactly this.
+        platform: z.string().default(''),
+        // How a viewer tells an agent that predates a capability from one that has it.
+        capabilities: z.array(z.string()).default([]),
+        agentId: z.string().optional(),
+        agentName: z.string().default(''),
+        // Deduplication by device id stays in the handler — it is a policy about the *set*, not a shape.
+        devices: z.array(z.object({
+            id: z.string(), name: z.string(), platform: z.string(), status: z.string(),
+            osVersion: z.string().optional(),
+        })).default([]),
+    }),
+    'agent:resources': z.object({
+        type: z.literal('agent:resources'),
+        resources: z.object({
+            cpuPercent: z.number(), memUsedMB: z.number(), memTotalMB: z.number(),
+            slotsAvailable: z.number(), slotsTotal: z.number(), reportedAt: z.number(),
+        }),
+    }),
+    'screenshot:done': z.object({
+        type: z.literal('screenshot:done'), sessionId, requestId,
+        // The claim, not the truth — the relay sniffs the bytes and logs a mismatch rather than
+        // overwriting this, because only the agent knows what it produced (#508).
+        format: z.enum(['png', 'jpeg']).default('png'),
+        data: z.string().default(''),
+    }),
+    'screenshot:error': z.object({
+        type: z.literal('screenshot:error'), sessionId, requestId, message: z.string().default(''),
+    }),
+    'ui:tree:response': z.object({
+        type: z.literal('ui:tree:response'), sessionId, requestId,
+        // Safe to validate where `ChromePayload` is not: a normalized shape every platform maps into,
+        // not a union with one member per platform.
+        elements: z.array(z.object({
+            role: z.enum([
+                'button', 'text', 'input', 'image', 'checkbox', 'switch', 'slider', 'list', 'cell', 'tab', 'other',
+            ]),
+            label: z.string(),
+            identifier: z.string().optional(),
+            frame: z.object({ x: z.number(), y: z.number(), width: z.number(), height: z.number() }),
+            enabled: z.boolean(),
+            rawRole: z.string().optional(),
+        })).default([]),
+    }),
+    'ui:tree:error': z.object({
+        type: z.literal('ui:tree:error'), sessionId, requestId, message: z.string().default(''),
+    }),
+};
+/** The 22 the relay only forwards. Envelope tier — see the header for why there is no exception. */
+const AGENT_FORWARDED = {
+    'session:chrome': env('session:chrome'),
+    'session:deviceInfo': env('session:deviceInfo'),
+    // The only member whose `sessionId` is optional, and it is a documented deferral rather than an
+    // oversight — stamping it would make a replayed ready satisfy an in-flight boot. See `DeviceReady`.
+    'device:ready': z.object({
+        type: z.literal('device:ready'),
+        sessionId: sessionId.optional(),
+        requestId: requestId.optional(),
+    }),
+    'device:booting': env('device:booting'),
+    'device:shutdown-done': envCo('device:shutdown-done'),
+    'device:boot-error': envCo('device:boot-error'),
+    'app:install-done': envC('app:install-done'),
+    'app:install-error': envC('app:install-error'),
+    'app:launch-done': envC('app:launch-done'),
+    'app:launch-error': envC('app:launch-error'),
+    'app:clear-state-done': envC('app:clear-state-done'),
+    'app:clear-state-error': envC('app:clear-state-error'),
+    'open-url:done': envC('open-url:done'),
+    'open-url:error': envC('open-url:error'),
+    'input:done': envC('input:done'),
+    'input:error': envC('input:error'),
+    'input:type-done': envC('input:type-done'),
+    'input:type-error': envC('input:type-error'),
+    'keyboard:toggled': env('keyboard:toggled'),
+    'clipboard:data': envC('clipboard:data'),
+    'clipboard:write-done': envC('clipboard:write-done'),
+    'clipboard:error': envC('clipboard:error'),
+};
+const AGENT_INBOUND = { ...AGENT_CONSUMED, ...AGENT_FORWARDED };
+// ── stream → relay ───────────────────────────────────────────────────────────
+//
+// One message, and its own direction on purpose: the relay assigns the role `'stream'` from it, so
+// merging it into the agent direction would let a control socket claim to be a session's stream
+// socket. Everything else on that socket is binary and never reaches this parser.
+const STREAM_INBOUND = {
+    'stream:register': z.object({ type: z.literal('stream:register'), sessionId }),
+};
+const INBOUND = { ...BROWSER_INBOUND, ...AGENT_INBOUND, ...STREAM_INBOUND };
+// ── the requests whose payload failure can be answered ───────────────────────
+//
+// **The envelope is judged separately from the payload, and that is what makes an answer possible.**
+// A frame whose `sessionId` and `requestId` are both good and whose payload is not carries everything
+// a reply needs: an address and a correlator. Refusing it wholesale would be the regression this door
+// otherwise ships — today a malformed `open-url` reaches the agent, which answers `open-url:error`
+// from its own guard (`IOSAgent.ts` says so in writing: "validating third-party frames at the relay's
+// door is #444, which will take this over"). Taking it over must not mean losing the answer.
+//
+// The cost of losing it is worst on the inputs, and not obviously: `awaitInputAck` reports silence
+// from a session that has never acked as **success** (#457), so a dropped `input:key` would be
+// reported to an MCP caller as an input that landed.
+//
+// Exactly the twelve browser requests that declare a required `requestId`. The relay maps each to the
+// reply its own waiter reads; `scripts/__tests__/correlatedRequestsGated.test.mjs` derives that set
+// from the protocol and holds all three lists to it.
+const ANSWERABLE = {
+    'device:boot': envC('device:boot'),
+    'app:install': envC('app:install'),
+    'app:launch': envC('app:launch'),
+    'app:clear-state': envC('app:clear-state'),
+    'open-url': envC('open-url'),
+    'input:touch:end': envC('input:touch:end'),
+    'input:pinch:end': envC('input:pinch:end'),
+    'input:key': envC('input:key'),
+    'input:button': envC('input:button'),
+    'input:type': envC('input:type'),
+    'clipboard:read': envC('clipboard:read'),
+    'clipboard:write': envC('clipboard:write'),
+};
+const DIRECTIONS = new Map([
+    ...Object.keys(BROWSER_INBOUND).map((t) => [t, 'browser']),
+    ...Object.keys(AGENT_INBOUND).map((t) => [t, 'agent']),
+    ...Object.keys(STREAM_INBOUND).map((t) => [t, 'stream']),
+]);
+/**
+ * Which socket role is allowed to send this type.
+ *
+ * This replaces `AGENT_MSG_TYPE_LIST` — 29 literals hand-copied into `RelayServer` and held by two
+ * type assertions. It is derived from the map above, which the assertions at the bottom of this file
+ * tie back to the protocol's own direction unions, so the copy is gone rather than moved.
+ *
+ * A runtime set cannot come out of a union directly (types erase), which is why it comes out of the
+ * schema map's keys. That makes the relay's role gate depend on this map existing — a real coupling,
+ * and the reason the coverage assertions below are not optional.
+ */
+export function directionOf(type) {
+    // Non-null: `DIRECTIONS` is built from the same keys `InboundType` is derived from, and the
+    // coverage assertions below make a divergence a compile error rather than a runtime miss.
+    return DIRECTIONS.get(type);
+}
+/**
+ * Parse a frame the relay received.
+ *
+ * **Takes no role.** A first design did, and it could not be called: `classifyConnection` returns
+ * `role: 'first-message'` for every local connection and every remote agent-scoped PAT, so the role is
+ * assigned from the first message's own `type`. `agent:register` is the message that *creates* the
+ * role, so selecting a schema by role to validate it is circular — and defaulting the unknown role to
+ * `'browser'`, which is what the relay does for a socket that skips the handshake, would have closed
+ * every agent's socket on its opening frame. The order is parse, then role, then gate.
+ */
+export function parseInbound(raw) {
+    // `JSON.parse` returns bare `null`, numbers and strings without throwing, and a caller that reads
+    // `.type` off one of those is the reason this is checked before anything else.
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        return { ok: false, reason: 'not-an-object' };
+    const frame = raw;
+    const type = frame['type'];
+    if (typeof type !== 'string' || !Object.hasOwn(INBOUND, type)) {
+        return { ok: false, reason: 'unknown-type', type: typeof type === 'string' ? type : String(type) };
+    }
+    const known = type;
+    // **The universe is the inbound map, not `AnyWireMessage`.** Eleven literals belong to no inbound
+    // direction — `session:joined`, `error`, `agents:listed` and the rest the relay produces. A browser
+    // that sends one today reaches the switch, matches no case and is ignored. Measuring `unknown-type`
+    // against every declared literal instead would classify those as a direction violation, and the
+    // relay closes a direction violation with 1008 — disconnecting a dashboard over a frame that is
+    // inert today.
+    const result = INBOUND[known].safeParse(frame);
+    if (!result.success) {
+        const detail = z.prettifyError(result.error);
+        // Second stage, and only for the twelve. If the envelope stands on its own, the failure is in the
+        // payload and the relay has an address and a correlator to answer with — see `ANSWERABLE`.
+        if (Object.hasOwn(ANSWERABLE, known)) {
+            const answerable = known;
+            const envelope = ANSWERABLE[answerable].safeParse(frame);
+            if (envelope.success) {
+                const { sessionId: s, requestId: r } = envelope.data;
+                return { ok: false, reason: 'bad-payload', type: answerable, sessionId: s, requestId: r, detail };
+            }
+        }
+        return { ok: false, reason: 'bad-shape', type: known, detail };
+    }
+    return { ok: true, msg: result.data, raw: frame };
+}
+//# sourceMappingURL=index.js.map

package/dist/validate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAA;AAexB,gFAAgF;AAChF,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,uGAAuG;AACvG,+FAA+F;AAC/F,iGAAiG;AACjG,sGAAsG;AACtG,wCAAwC;AACxC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACnC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAEnC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAExD,gFAAgF;AAChF,EAAE;AACF,8FAA8F;AAC9F,wFAAwF;AAExF,8DAA8D;AAC9D,MAAM,GAAG,GAAG,CAAmB,IAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;AACzF,wCAAwC;AACxC,MAAM,IAAI,GAAG,CAAmB,IAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;AACrG;6BAC6B;AAC7B,MAAM,KAAK,GAAG,CAAmB,IAAO,EAAE,EAAE,CAC1C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAEjF,gFAAgF;AAChF,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,mGAAmG;AACnG,kFAAkF;AAClF,qGAAqG;AACrG,gBAAgB;AAEhB,MAAM,eAAe,GAAG;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3D,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC;IAC1E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC;IACtE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC;IAC1E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,SAAS;QACT,SAAS;QACT,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;YACxD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAClC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SACtC,CAAC;KACH,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAClC,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC5C,CAAC;IACF,mGAAmG;IACnG,qGAAqG;IACrG,sGAAsG;IACtG,sGAAsG;IACtG,OAAO;IACP,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;IAC5G,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;IAC1G,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,SAAS;QACxD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC5C,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC1F,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClG,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChG,mGAAmG;IACnG,kDAAkD;IAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE;KACpF,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC5B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KAC7F,CAAC;IACF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KAC5F,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACzF,oEAAoE;IACpE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,SAAS;QAClD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KAC1E,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC7F,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,SAAS;QACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;KAClF,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC;IACxE,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC;IAC1F,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,SAAS;QACvD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC5E,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,SAAS;QACxD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KAC5E,CAAC;CACM,CAAA;AAEV,gFAAgF;AAEhF;;;;;yFAKyF;AACzF,MAAM,cAAc,GAAG;IACrB,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,uFAAuF;QACvF,mGAAmG;QACnG,kGAAkG;QAClG,+FAA+F;QAC/F,+FAA+F;QAC/F,kGAAkG;QAClG,+FAA+F;QAC/F,+FAA+F;QAC/F,EAAE;QACF,oGAAoG;QACpG,oGAAoG;QACpG,yBAAyB;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,+EAA+E;QAC/E,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,iGAAiG;QACjG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAChB,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;SAC3E,CAAC;KACH,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,SAAS;QACxD,wFAAwF;QACxF,0EAA0E;QAC1E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAC7B,CAAC;IACF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3F,CAAC;IACF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,SAAS;QACzD,8FAA8F;QAC9F,4CAA4C;QAC5C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACzB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;aACnG,CAAC;YACF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACxF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;YACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC/B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAChB,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACxF,CAAC;CACM,CAAA;AAEV,oGAAoG;AACpG,MAAM,eAAe,GAAG;IACtB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC;IACvC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,CAAC;IAC/C,gGAAgG;IAChG,oGAAoG;IACpG,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC/B,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;QAC/B,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC;IACvC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,CAAC;IACrD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC;IAC/C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC;IAC5C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC9C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC;IAC1C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC;IAC5C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IACpD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,CAAC;IACtD,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC;IACtC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC;IAChC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC;IAClC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC;IAC1C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC;IAC5C,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,CAAC;IAC3C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACxC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IACpD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC;CAClC,CAAA;AAEV,MAAM,aAAa,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,eAAe,EAAW,CAAA;AAExE,gFAAgF;AAChF,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,kFAAkF;AAClF,MAAM,cAAc,GAAG;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC;CACtE,CAAA;AAEV,MAAM,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,EAAW,CAAA;AAEpF,gFAAgF;AAChF,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,sGAAsG;AACtG,mGAAmG;AACnG,sGAAsG;AACtG,6FAA6F;AAC7F,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,qDAAqD;AACrD,EAAE;AACF,sGAAsG;AACtG,oGAAoG;AACpG,qDAAqD;AACrD,MAAM,UAAU,GAAG;IACjB,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC;IAClC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC;IAClC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC;IAChC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC;IAC1C,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC;IAC5B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC;IAC1C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC;IAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;IAC9B,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC;IACpC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC;IAChC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACxC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC;CAClC,CAAA;AA+CV,MAAM,UAAU,GAA0C,IAAI,GAAG,CAAC;IAChE,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAU,CAAC;IACnE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAU,CAAC;IAC/D,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAU,CAAC;CAClE,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,4FAA4F;IAC5F,0FAA0F;IAC1F,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,kGAAkG;IAClG,+EAA+E;IAC/E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAChH,MAAM,KAAK,GAAG,GAA8B,CAAA;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAA;IACpG,CAAC;IACD,MAAM,KAAK,GAAG,IAAmB,CAAA;IACjC,kGAAkG;IAClG,oGAAoG;IACpG,oGAAoG;IACpG,gGAAgG;IAChG,gGAAgG;IAChG,eAAe;IACf,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5C,kGAAkG;QAClG,2FAA2F;QAC3F,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,KAAuB,CAAA;YAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YACxD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAA;gBACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;YACnG,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAChE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAqB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AACpE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tapflowio/protocol",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Wire protocol contract for tapflow — the WebSocket message types exchanged between browser, relay, and device agents",
   "keywords": [
     "tapflow",
@@ -28,6 +28,13 @@
       "tsx": "./src/index.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
+    },
+    "./validate": {
+      "types": "./dist/validate/index.d.ts",
+      "source": "./src/validate/index.ts",
+      "tsx": "./src/validate/index.ts",
+      "import": "./dist/validate/index.js",
+      "default": "./dist/validate/index.js"
     }
   },
   "files": [
@@ -36,17 +43,22 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=20.12.0"
+    "node": ">=22.0.0"
   },
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "typescript": "^5.0.0",
+    "vitest": "^4.1.10"
+  },
   "scripts": {
     "build": "tsc -b",
-    "typecheck": "tsc -b && tsc -p tsconfig.assertions.json",
+    "typecheck": "tsc -b && tsc -p tsconfig.assertions.json && tsc -p src/__tests__/tsconfig.json",
+    "test": "vitest run",
     "lint": "eslint src"
-  },
-  "devDependencies": {
-    "typescript": "^5.0.0"
   }
-}
+}