@ti-engine/web-framework 1.19.1 → 1.20.1

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 This document will contain the list of changes made to the framework. The format is based on the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) specification.
 
+## Version 1.20.1
+
+* fix(types): emit `/// <reference types="node" />` into `web-server.d.ts`, which names `node:http`.
+  Without it a consumer who has not separately configured Node's types gets `TS2591` from inside the
+  published declarations. See `@ti-engine/core` 1.9.1 for why the 1.20.0 gate did not catch this
+* build(release): bump package version from `1.20.0` to `1.20.1`
+
+## Version 1.20.0
+
+TypeScript declarations now ship with the package, verified against a consumer type-checking with `skipLibCheck: false`
+before they can be committed. See `@ti-engine/core` 1.9.0 for why the previous attempt was withdrawn.
+
+* feat(types): generate and publish `.d.ts` declarations for every module, wired through `types` conditions in both
+  `exports` and `imports`
+* feat(definitions): expose the shared type definitions as `@ti-engine/web-framework/definitions`
+* fix(session-store)!: the store's `set`, `get` and `touch` are typed against `express-session`'s `SessionData`, which
+  is what the `Store` contract hands them — not `TiSession`, which additionally requires `id`, `save`, `regenerate` and
+  `destroy`. The implementation only ever reads `cookie.maxAge`, so the annotation was describing a stricter input than
+  the base class can supply and than the code needs. Documentation only; no behaviour changes
+* fix(web-handlers): `ExpressResponse` referred to `import("express").res`, which express does not export. It is
+  `Response`
+* refactor(exports): the extras hung off `module.exports` after a class assignment — `instance`, `authMethod`,
+  `applyAuthMethodVisibility`, the static route matchers — are assigned to the class itself. `module.exports` *is* the
+  class, so this is the same object with the same properties at runtime; as a declaration it is the difference between
+  a namespace merge and an export assignment colliding with named exports, which is not valid TypeScript
+* fix(types): the same closure-style `{function(...)}` and `@private`-on-`#member` corrections as `core` 1.9.0
+* build(deps): add `@types/express`, `@types/express-session` and `@types/node`. The published declarations name types
+  from all three
+
 ## Version 1.19.1
 
 Documentation and packaging only — no functional change.

package/bin/web-app-manager.js

@@ -15,6 +15,8 @@ const configRegistry = require( "#config-registry" );
 const configService = require( "#config-service" );
 const authorization = require( "#authorization" );
 
+/** @import { TiSession } from "#definitions" */
+
 const RE_NONCE_ATTR = /\{ti-nonce-placeholder}/g;
 const RE_CSRF_ATTR = /\{ti-csrf-placeholder}/g;
 const RE_HTMX_CONFIG = /\{ti-htmx-config-placeholder}/g;
@@ -462,7 +464,6 @@ class TiWebAppManager {
      * @param {boolean} [options.isHome] Optional flag to indicate whether the requested route is the home page.
      * @param {string} [options.nonce] Optional CSP nonce to inject into inline scripts/styles.
      * @returns {Promise<string>}
-     * @private
      */
     #getHtmlFragment( session, staticContentPaths, fragment, options = {} ) {
         return new Promise( ( resolve, reject ) => {
@@ -487,7 +488,6 @@ class TiWebAppManager {
      * @param {string[]} staticContentPaths A list of directories to search for static content. If sent as expected by the web server, the first item in the array should be the system default path.
      * @param {string} filePath Relative path to the static file to locate.
      * @returns {Promise<string>}
-     * @private
      */
     #locateStaticFile( staticContentPaths, filePath ) {
         return new Promise( ( resolve, reject ) => {
@@ -530,7 +530,6 @@ class TiWebAppManager {
      * @param {string[]} staticContentPaths
      * @param {Array<string>} components
      * @returns {Promise<string>}
-     * @private
      */
     #replaceComponentPlaceholders( html, staticContentPaths, components ) {
         return new Promise( ( resolve, reject ) => {
@@ -573,7 +572,6 @@ class TiWebAppManager {
      * @param {string} tagName
      * @param {string} replacement
      * @returns {string}
-     * @private
      */
     #replacePlaceholderElement( html, tagName, replacement ) {
         const start = html.indexOf( `<${ tagName }` );
@@ -643,7 +641,6 @@ class TiWebAppManager {
      * @method
      * @param {string} openingTag The full opening tag text, e.g. `<ti-foo-placeholder bar="baz">`.
      * @returns {Object<string, string>}
-     * @private
      */
     #parsePlaceholderAttributes( openingTag ) {
         const attributes = {};
@@ -660,4 +657,4 @@ class TiWebAppManager {
 }
 
 module.exports = TiWebAppManager;
-module.exports.applyAuthMethodVisibility = applyAuthMethodVisibility;
+TiWebAppManager.applyAuthMethodVisibility = applyAuthMethodVisibility;

package/bin/web-server.js

@@ -98,6 +98,12 @@ const applyWebConfigEnvOverrides = require( "#web-config-env" );
 
 const webServerConfig = require( "#web-server-config" );
 
+/** @import { TiAuthMethod, TiTokenEndpointAuthMethod } from "#auth-manager" */
+/** @import { TiSession } from "#definitions" */
+/** @import User from "#user" */
+/** @import TiWebAppManager from "#web-app-manager" */
+/** @import { ServiceAddress, ServiceConfiguration } from "@ti-engine/core/definitions" */
+
 /**
  * Default unprotected static-asset route matchers. The path segments are matched with `(?:[^/]+\/)*` rather than
  * `(?:.+\/)*`: the inner `[^/]+` cannot also consume the "/" delimiter, so the pattern is unambiguous and matches
@@ -643,7 +649,6 @@ class TiWebServer extends ServiceConsumer {
      * middleware mounting is ever needed.
      *
      * @type {Set<string>}
-     * @private
      */
     static #REGISTRABLE_METHODS = new Set( [ "get", "post", "put", "patch", "delete", "options", "head", "all" ] );
 
@@ -666,7 +671,6 @@ class TiWebServer extends ServiceConsumer {
      * clear a default entry. Absent from the config file, an explicitly empty array means exactly that.
      *
      * @type {Object}
-     * @private
      */
     static #STATIC_CACHE_DEFAULTS = Object.freeze( {
         maxAge: 0,
@@ -682,7 +686,6 @@ class TiWebServer extends ServiceConsumer {
      * value any cache treats as meaningful, and the conventional pairing for `immutable`).
      *
      * @type {number}
-     * @private
      */
     static #IMMUTABLE_MAX_AGE = 31536000;
 
@@ -694,7 +697,6 @@ class TiWebServer extends ServiceConsumer {
      * @static
      * @param {string} entry
      * @returns {string|null}
-     * @private
      */
     static #normalizeImmutablePath( entry ) {
         if ( typeof entry !== "string" || entry.trim() === "" ) {
@@ -715,7 +717,6 @@ class TiWebServer extends ServiceConsumer {
      * @param {string} rootPath
      * @param {string} filePath
      * @returns {string}
-     * @private
      */
     static #toServedPath( rootPath, filePath ) {
         // Split on the platform separator only: on POSIX a backslash is a legal filename character, not a delimiter.
@@ -881,7 +882,6 @@ class TiWebServer extends ServiceConsumer {
      * @param {number} port The port to listen on.
      * @param {string} host The host to listen on.
      * @returns {Promise<NodeServer>}
-     * @private
      */
     #beginListening( server, port, host ) {
         return new Promise( ( resolve, reject ) => {
@@ -901,7 +901,6 @@ class TiWebServer extends ServiceConsumer {
      * @method
      * @param {NodeServer} server The server instance to stop listening on.
      * @returns {Promise}
-     * @private
      */
     #endListening( server ) {
         return new Promise( ( resolve, reject ) => {
@@ -933,5 +932,5 @@ class TiWebServer extends ServiceConsumer {
 
 module.exports = TiWebServer;
 // Exported for unit testing of the ReDoS-hardened matchers; not part of the customization surface.
-module.exports.RE_STATIC_UNPROTECTED = RE_STATIC_UNPROTECTED;
-module.exports.RE_WELL_KNOWN_UNPROTECTED = RE_WELL_KNOWN_UNPROTECTED;
+TiWebServer.RE_STATIC_UNPROTECTED = RE_STATIC_UNPROTECTED;
+TiWebServer.RE_WELL_KNOWN_UNPROTECTED = RE_WELL_KNOWN_UNPROTECTED;

package/components/admin-config-handlers.js

@@ -19,6 +19,9 @@
 
 const exceptions = require( "@ti-engine/core/exceptions" );
 
+/** @import ConfigService from "#config-service" */
+/** @import { ExpressHandler } from "#web-handlers" */
+
 function sendData( response, data ) {
     response.set( "Cache-Control", "no-store" );
     response.set( "Content-Type", "application/json; charset=utf-8" );

package/components/auth-manager.js

@@ -13,6 +13,8 @@ const { randomBytes } = require( "node:crypto" );
 const openidClient = require( "openid-client" );
 const User = require( "#user" );
 
+/** @import { SettingsAuth } from "#web-server" */
+
 /**
  * Enum for specifying the authentication method.
  *
@@ -281,7 +283,6 @@ class AuthManager {
      * unavailable so a sign-in attempt against it is rejected per-request instead of taking down startup.
      *
      * @method
-     * @private
      */
     #dropUnconfiguredOpenIDProviders() {
         const providers = [
@@ -302,7 +303,6 @@ class AuthManager {
      * @method
      * @param {SettingsOAuth2Client} [oauth2] The provider's OAuth2 settings.
      * @returns {boolean}
-     * @private
      */
     #isOpenIDConfigured( oauth2 ) {
         return !!( oauth2 && typeof oauth2.clientID === "string" && oauth2.clientID.trim() !== "" );
@@ -318,7 +318,6 @@ class AuthManager {
      * @method
      * @param {SettingsOAuth2Client} oauth2
      * @returns {Promise<openidClient.Configuration>}
-     * @private
      */
     #initializeOpenIDClient( oauth2 ) {
         return new Promise( ( resolve, reject ) => {
@@ -362,7 +361,6 @@ class AuthManager {
      * @param {string} username
      * @param {string} password
      * @returns {Promise}
-     * @private
      */
     #authenticateLocal( username, password ) {
         return new Promise( ( resolve, reject ) => {
@@ -383,7 +381,6 @@ class AuthManager {
      * @param {SettingsOAuth2Client} oauth2
      * @param {openidClient.Configuration} clientConfig
      * @returns {Promise<Object>}
-     * @private
      */
     #authenticateOpenID( baseUrl, oauth2, clientConfig ) {
         return new Promise( ( resolve, reject ) => {
@@ -416,7 +413,6 @@ class AuthManager {
      * @param {Object} oidc
      * @param {openidClient.Configuration} clientConfig
      * @returns {Promise<User>}
-     * @private
      */
     #authorizeOpenID( currentUrl, oidc, clientConfig ) {
         return new Promise( ( resolve, reject ) => {
@@ -439,4 +435,4 @@ class AuthManager {
 }
 
 module.exports = AuthManager;
-module.exports.authMethod = authMethodEnum;
+AuthManager.authMethod = authMethodEnum;

package/components/authorization.js

@@ -108,7 +108,7 @@ function isAccessAllowed( requiredRoles, userRoles ) {
  * Responds `401` when unauthenticated (no session user) and `403` when authenticated but lacking the role.
  *
  * @param {...(string|number)} roles
- * @returns {function(Object, Object, Function): void}
+ * @returns {(request: Object, response: Object, next: Function) => void}
  */
 function requireRole( ...roles ) {
     return ( request, response, next ) => {
@@ -128,7 +128,7 @@ function requireRole( ...roles ) {
 /**
  * Express middleware that admits only `admin`-role users.
  *
- * @type {function(Object, Object, Function): void}
+ * @type {(request: Object, response: Object, next: Function) => void}
  */
 const requireAdmin = requireRole( ADMIN_ROLE );
 

package/components/config-change-notifier.js

@@ -70,8 +70,8 @@ class ConfigChangeNotifier {
      * Subscribes a listener to configuration-change events.
      *
      * @method
-     * @param {function(ConfigChangeEvent): void} listener
-     * @returns {function(): void} An unsubscribe function.
+     * @param {(event: ConfigChangeEvent) => void} listener
+     * @returns {() => void} An unsubscribe function.
      * @public
      */
     subscribe( listener ) {
@@ -94,5 +94,5 @@ class ConfigChangeNotifier {
 
 const instance = new ConfigChangeNotifier();
 module.exports = ConfigChangeNotifier;
-module.exports.instance = instance;
-module.exports.CONFIG_CHANGED = CONFIG_CHANGED;
+ConfigChangeNotifier.instance = instance;
+ConfigChangeNotifier.CONFIG_CHANGED = CONFIG_CHANGED;

package/components/config-registry.js

@@ -45,11 +45,11 @@ const instancePathToDataPath = ( instancePath ) => {
  * {@link ConfigService#applyEdits} call.
  *
  * @typedef {Object} ValidatorContext
- * @property {function(string): Promise<*>} getConfig Resolves the *pending* value of `key` when it is part of the
+ * @property {(key: string) => Promise<*>} getConfig Resolves the *pending* value of `key` when it is part of the
  *      current edit batch, otherwise its current committed value. Lets a validator check a sibling document's
  *      post-edit state — but calling this for the document being validated itself just returns the same incoming
  *      value already passed as the validator's first argument, not its prior state.
- * @property {function(string): Promise<*>} getStoredConfig Always resolves the current committed value of `key`,
+ * @property {(key: string) => Promise<*>} getStoredConfig Always resolves the current committed value of `key`,
  *      even when `key` is the document currently under validation. Use this to compare a document against its own
  *      previous state (e.g. detecting an edit that should have bumped a version marker).
  */
@@ -214,7 +214,6 @@ class ConfigRegistry {
      * @method
      * @param {Object} registration
      * @returns {Function} The compiled (and cached) ajv validate function for the document's schema.
-     * @private
      */
     #schemaValidator( registration ) {
         if ( !registration.compiled ) {
@@ -229,7 +228,6 @@ class ConfigRegistry {
      * @method
      * @param {Object} schema
      * @returns {Object} A shallow copy without the ajv-6-incompatible Draft-2020-12 `$schema` annotation.
-     * @private
      */
     #stripUnsupportedMeta( schema ) {
         if ( schema && schema.$schema && String( schema.$schema ).includes( "draft/2020-12" ) ) {
@@ -244,7 +242,6 @@ class ConfigRegistry {
      * @method
      * @param {ConfigValidationIssue|string} issue
      * @returns {ConfigValidationIssue}
-     * @private
      */
     #normalizeIssue( issue ) {
         if ( typeof issue === "string" ) {
@@ -257,4 +254,4 @@ class ConfigRegistry {
 
 const instance = new ConfigRegistry();
 module.exports = ConfigRegistry;
-module.exports.instance = instance;
+ConfigRegistry.instance = instance;

package/components/config-service.js

@@ -8,6 +8,10 @@
 
 const exceptions = require( "@ti-engine/core/exceptions" );
 
+/** @import ConfigChangeNotifier from "#config-change-notifier" */
+/** @import ConfigRegistry from "#config-registry" */
+/** @import ConfigStore from "#config-store" */
+
 /**
  * Orchestrates validated, versioned configuration edits on top of {@link ConfigStore} and {@link ConfigRegistry}.
  *
@@ -115,8 +119,8 @@ class ConfigService {
      * @param {string} editorKey
      * @param {Object} definition
      * @param {string[]} definition.documents The configKeys this editor spans.
-     * @param {function(Object): *} definition.compose Maps `{ [configKey]: value }` → a view for the UI.
-     * @param {function(*, Object): Object<string, Object>} definition.decompose Maps `(editedView, currentDocs)` → the
+     * @param {(configs: Object) => *} definition.compose Maps `{ [configKey]: value }` → a view for the UI.
+     * @param {(editedView: *, currentDocs: Object) => Object.<string, Object>} definition.decompose Maps `(editedView, currentDocs)` → the
      *        full new values for the documents that changed (`{ [configKey]: newValue }`).
      * @param {Object} [definition.metadata]
      * @returns {ConfigService} this (chainable)
@@ -321,8 +325,8 @@ class ConfigService {
      * Subscribes a listener to `config:changed` events (delegates to the change notifier). Returns an unsubscribe fn.
      *
      * @method
-     * @param {function(Object): void} listener
-     * @returns {function(): void}
+     * @param {(configs: Object) => void} listener
+     * @returns {() => void}
      * @public
      */
     onConfigChanged( listener ) {
@@ -335,7 +339,6 @@ class ConfigService {
      * @method
      * @param {string[]} keys
      * @returns {Promise<{docs: Object<string, Object>, versions: Object<string, number>}>}
-     * @private
      */
     #loadDocuments( keys ) {
         return Promise.all( keys.map( ( key ) => this.#store.getCurrent( key ) ) ).then( ( currents ) => {
@@ -357,4 +360,4 @@ function clone( value ) {
 
 const instance = new ConfigService();
 module.exports = ConfigService;
-module.exports.instance = instance;
+ConfigService.instance = instance;

package/components/config-store.js

@@ -222,7 +222,6 @@ class ConfigStore {
      * @method
      * @param {string} key
      * @returns {Promise<Object|null>}
-     * @private
      */
     #readJSON( key ) {
         return cache.instance.getJSON( key ).then( ( result ) => ( Array.isArray( result ) ? ( result[ 0 ] ?? null ) : ( result ?? null ) ) );
@@ -233,7 +232,6 @@ class ConfigStore {
      * @param {string} key
      * @param {Object} value
      * @returns {Promise}
-     * @private
      */
     #writeJSON( key, value ) {
         return cache.instance.setJSON( key, value );
@@ -243,4 +241,4 @@ class ConfigStore {
 
 const instance = new ConfigStore();
 module.exports = ConfigStore;
-module.exports.instance = Object.freeze( instance );
+ConfigStore.instance = Object.freeze( instance );

package/components/definitions.types.js

@@ -6,6 +6,8 @@
  * You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
+/** @import { TiLocalizationLanguage } from "@ti-engine/core/localization" */
+
 /**
  * @callback TiSessionCallback
  * @param {Error|null} [error]
@@ -20,7 +22,7 @@
  * @property {Object} [cookie]
  * @property {Object} [oidc]
  * @property {string} [csrfToken]
- * @property {function(TiSessionCallback): TiSession} regenerate
- * @property {function(TiSessionCallback): TiSession} destroy
- * @property {function(TiSessionCallback=): TiSession} save
+ * @property {(callback: TiSessionCallback) => TiSession} regenerate
+ * @property {(callback: TiSessionCallback) => TiSession} destroy
+ * @property {(callback?: TiSessionCallback) => TiSession} save
  */

package/components/session-store.js

@@ -12,6 +12,9 @@ const exceptions = require( "@ti-engine/core/exceptions" );
 const _ = require( "lodash" );
 const session = require( "express-session" );
 
+/** @import { SessionData } from "express-session" */
+/** @import { TiException } from "@ti-engine/core/exceptions" */
+
 // The name of the session store in the cache:
 const sessionStoreName = "ti:web:sessions";
 
@@ -37,8 +40,8 @@ class SessionStore extends session.Store {
      *
      * @method
      * @param {string} sessionID
-     * @param {TiSession} session
-     * @param {function( (Error|TiException|null)= )} callback
+     * @param {SessionData} session
+     * @param {(error?: Error|TiException|null) => void} callback
      * @public
      */
     set( sessionID, session, callback ) {
@@ -58,7 +61,7 @@ class SessionStore extends session.Store {
      *
      * @method
      * @param {string} sessionID
-     * @param {function( (Error|TiException|null)=, (TiSession)= )} callback
+     * @param {(error?: Error|TiException|null, session?: SessionData|null) => void} callback
      * @public
      */
     get( sessionID, callback ) {
@@ -75,7 +78,7 @@ class SessionStore extends session.Store {
      *
      * @method
      * @param {string} sessionID
-     * @param {function( (Error|TiException|null)= )} callback
+     * @param {(error?: Error|TiException|null) => void} callback
      * @public
      */
     destroy( sessionID, callback ) {
@@ -92,8 +95,8 @@ class SessionStore extends session.Store {
      *
      * @method
      * @param {string} sessionID
-     * @param {TiSession} session
-     * @param {function( (Error|TiException|null)= )} callback
+     * @param {SessionData} session
+     * @param {(error?: Error|TiException|null) => void} callback
      * @public
      */
     touch( sessionID, session, callback ) {

package/components/user.js

@@ -6,6 +6,8 @@
  * You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
+/** @import { TiLocalizationLanguage } from "@ti-engine/core/localization" */
+
 /**
  * Represents a user in the system.
  *

package/components/web-handlers.js

@@ -17,8 +17,11 @@ const cache = require( "@ti-engine/core/cache" );
 const authMethod = require( "#auth-manager" ).authMethod;
 const authorization = require( "#authorization" );
 
+/** @import { TiAuthMethod } from "#auth-manager" */
+/** @import TiWebServer from "#web-server" */
+
 /** @typedef {import("express").Request} ExpressRequest */
-/** @typedef {import("express").res} ExpressResponse */
+/** @typedef {import("express").Response} ExpressResponse */
 
 /**
  * Express middleware callback.
@@ -26,7 +29,7 @@ const authorization = require( "#authorization" );
  * @callback ExpressHandler
  * @param {ExpressRequest} request
  * @param {ExpressResponse} response
- * @param {function( Error | null )} next
+ * @param {(error: Error|null) => void} next
  * @returns {void}
  */
 
@@ -37,7 +40,7 @@ const authorization = require( "#authorization" );
  * @param {Error} error
  * @param {ExpressRequest} request
  * @param {ExpressResponse} response
- * @param {function( Error | null )} next
+ * @param {(error: Error|null) => void} next
  * @returns {void}
  */
 
@@ -154,7 +157,7 @@ let getRequestOrigin = ( request ) => {
  * @method
  * @param {ExpressRequest} request
  * @param {string} redirectTo
- * @param {function( TiSession ): TiSession} modifier
+ * @param {(session: TiSession) => TiSession} modifier
  * @returns {Promise<string>}
  * @private
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ti-engine/web-framework",
-  "version": "1.19.1",
+  "version": "1.20.1",
   "description": "A web-framework based on the ti-engine. It provides a customizable ready-to-use web-server microservice and a set of tools for creating web applications. NOTICE: This is still a work in progress and the full architecture, design, and functionality are not available!",
   "keywords": [
     "ti-engine",
@@ -15,43 +15,105 @@
   "author": "Boris Kostadinov <kostadinov.boris@gmail.com>",
   "license": "GPL-3.0-or-later",
   "exports": {
-    "./config-management": "./components/config-service.js",
-    "./web-application": "./bin/web-app-manager.js",
-    "./web-server": "./bin/web-server.js"
+    "./config-management": {
+      "types": "./types/components/config-service.d.ts",
+      "default": "./components/config-service.js"
+    },
+    "./web-application": {
+      "types": "./types/bin/web-app-manager.d.ts",
+      "default": "./bin/web-app-manager.js"
+    },
+    "./web-server": {
+      "types": "./types/bin/web-server.d.ts",
+      "default": "./bin/web-server.js"
+    },
+    "./definitions": {
+      "types": "./types/components/definitions.types.d.ts",
+      "default": "./components/definitions.types.js"
+    }
   },
   "imports": {
-    "#admin-config-handlers": "./components/admin-config-handlers.js",
-    "#auth-manager": "./components/auth-manager.js",
-    "#authorization": "./components/authorization.js",
-    "#config-change-notifier": "./components/config-change-notifier.js",
-    "#config-registry": "./components/config-registry.js",
-    "#config-service": "./components/config-service.js",
-    "#config-store": "./components/config-store.js",
-    "#session-store": "./components/session-store.js",
-    "#user": "./components/user.js",
-    "#web-app-manager": "./bin/web-app-manager.js",
-    "#web-config-env": "./components/web-config-env.js",
-    "#web-handlers": "./components/web-handlers.js",
-    "#web-server": "./bin/web-server.js",
+    "#admin-config-handlers": {
+      "types": "./types/components/admin-config-handlers.d.ts",
+      "default": "./components/admin-config-handlers.js"
+    },
+    "#auth-manager": {
+      "types": "./types/components/auth-manager.d.ts",
+      "default": "./components/auth-manager.js"
+    },
+    "#authorization": {
+      "types": "./types/components/authorization.d.ts",
+      "default": "./components/authorization.js"
+    },
+    "#config-change-notifier": {
+      "types": "./types/components/config-change-notifier.d.ts",
+      "default": "./components/config-change-notifier.js"
+    },
+    "#config-registry": {
+      "types": "./types/components/config-registry.d.ts",
+      "default": "./components/config-registry.js"
+    },
+    "#config-service": {
+      "types": "./types/components/config-service.d.ts",
+      "default": "./components/config-service.js"
+    },
+    "#config-store": {
+      "types": "./types/components/config-store.d.ts",
+      "default": "./components/config-store.js"
+    },
+    "#definitions": {
+      "types": "./types/components/definitions.types.d.ts",
+      "default": "./components/definitions.types.js"
+    },
+    "#session-store": {
+      "types": "./types/components/session-store.d.ts",
+      "default": "./components/session-store.js"
+    },
+    "#user": {
+      "types": "./types/components/user.d.ts",
+      "default": "./components/user.js"
+    },
+    "#web-app-manager": {
+      "types": "./types/bin/web-app-manager.d.ts",
+      "default": "./bin/web-app-manager.js"
+    },
+    "#web-config-env": {
+      "types": "./types/components/web-config-env.d.ts",
+      "default": "./components/web-config-env.js"
+    },
+    "#web-handlers": {
+      "types": "./types/components/web-handlers.d.ts",
+      "default": "./components/web-handlers.js"
+    },
+    "#web-server": {
+      "types": "./types/bin/web-server.d.ts",
+      "default": "./bin/web-server.js"
+    },
     "#web-server-config": "./bin/web-server.json"
   },
   "dependencies": {
-    "@ti-engine/core": "*",
     "@alpinejs/csp": "^3.15.12",
-    "htmx.org": "^2.0.10",
+    "@ti-engine/core": "*",
+    "@types/express": "^5.0.6",
+    "@types/express-session": "^1.18.2",
+    "@types/node": "^24.10.1",
     "ajv": "^8.20.0",
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
     "helmet": "^8.3.0",
+    "htmx.org": "^2.0.10",
     "lodash": "^4.18.1",
     "openid-client": "^6.8.4"
   },
-  "devDependencies": {},
+  "devDependencies": {
+    "typescript": "^7.0.2"
+  },
   "files": [
     "bin/",
     "!bin/tls/**/*",
     "components/",
+    "types/",
     ".env",
     "package.json",
     "README.md",
@@ -71,6 +133,7 @@
   },
   "scripts": {
     "postinstall": "node ./bin/build/post-install.js",
-    "test": "node --test test/*.test.js"
+    "test": "node --test test/*.test.js",
+    "build:types": "tsc -p tsconfig.types.json"
   }
 }