@webtwizz/cloud 0.0.0-stage → 0.1.0

package/AI_GUIDE.md

@@ -0,0 +1,118 @@
+# @webtwizz/cloud: building on WebTwizz Cloud
+
+Read this before writing sign-ins, database code or file uploads on a site with WebTwizz Cloud. It matches the version installed next to it. Call all of it WebTwizz Cloud (sign-ins, database, files) and never name any company behind it.
+
+Every setting is already in the site's environment (`WEBTWIZZ_AUTH_URL`, `WEBTWIZZ_AUTH_SECRET`, `DATABASE_URL`, `WEBTWIZZ_STORAGE_*`, `WEBTWIZZ_FILES_URL`). Never add, rename or print them.
+
+## Sign-ins
+
+1. `src/lib/auth/server.ts`
+
+```ts
+import { createAuth } from '@webtwizz/cloud/server';
+
+export const auth = createAuth();
+```
+
+2. `src/app/api/auth/[...path]/route.ts`
+
+```ts
+import { auth } from '@/lib/auth/server';
+
+export const { GET, POST, PUT, DELETE, PATCH } = auth.handler();
+```
+
+3. `src/lib/auth/client.ts`, the browser client. It takes no arguments and talks to the route above.
+
+```ts
+import { createAuthClient } from '@webtwizz/cloud/client';
+
+export const authClient = createAuthClient();
+```
+
+4. In client components: `authClient.signUp.email({ email, password, name })`, `authClient.signIn.email({ email, password })`, `authClient.signOut()`. Each returns `{ data, error }`. Never show `error.message`. Keep what they typed, `console.error(error)`, and show `authMessage(error)`:
+
+```ts
+import { authMessage } from '@webtwizz/cloud';
+
+const { error } = await authClient.signIn.email({ email, password });
+if (error) setMessage(authMessage(error));
+```
+
+For wording that fits the site, pass overrides: `authMessage(error, { USER_ALREADY_EXISTS: 'You already have a booking account.' })`.
+
+5. Protect pages in `src/proxy.ts`, listing only the protected routes in the matcher (a matcher over every path blocks the sign-in page's own scripts):
+
+```ts
+import { auth } from '@/lib/auth/server';
+
+export default auth.middleware({ loginUrl: '/sign-in' });
+
+export const config = { matcher: ['/account/:path*'] };
+```
+
+6. On the server, check the session before protected data or any write, in the route handler or server action itself:
+
+```ts
+const { data: session } = await auth.getSession();
+if (!session?.user) return Response.json({ error: 'Sign in first' }, { status: 401 });
+```
+
+Never destructure `{ user }` from the top level.
+
+7. Signed-up users are rows in the `webtwizz.users` view (`id`, `name`, `email`, `email_verified`, `image`, `role`, `created_at`), kept by sign-ins. Read it, never write to it, never create a users or passwords table. Your own tables keep a plain `user_id uuid` column (no foreign key) set from `session.user.id`.
+
+8. Every sign-in page gets a "Forgot password?" link to `/reset-password`, a client page in two steps: their email, then `authClient.forgetPassword.emailOtp({ email })`, which emails a 6-digit code; then the code and a new password, then `authClient.emailOtp.resetPassword({ email, otp, password })`, then send them to sign in. Leave `/reset-password` out of the proxy matcher. The owner can also send a reset code from the Data panel, and it lands on this page.
+
+Sign-ins are email and password only. Sign-in emails (reset codes, confirmations) are sent for the site automatically; never build email sending or add an email service for them. If the user asks for another way to sign in, say WebTwizz Cloud sign-ins are email and password for now and build that.
+
+Sites built before this package import sign-ins from another package in `src/lib/auth/`. When you work on their sign-ins, move `server.ts`, `client.ts` and the auth route to the files above (same sign-ins, same users) and remove the old package.
+
+## Database
+
+One shared client, server-side only (route handlers, server components, server actions):
+
+```ts
+// src/lib/db.ts
+import { createDb } from '@webtwizz/cloud/db';
+
+export const sql = createDb();
+```
+
+It is the `postgres` package with pooler-safe settings, so queries look like ``await sql`select * from notes where user_id = ${session.user.id}` ``. Schema and data changes go through the `database` tool.
+
+The database can pause or fill up on the owner's plan. Wrap reads and saves in try/catch and show `MESSAGES.unavailable` on a page or `MESSAGES.saveFailed` on a form (`import { MESSAGES } from '@webtwizz/cloud'`). Visitors never see WebTwizz, plans or limits.
+
+Pages that only show data set `export const revalidate = 60`, and the server action that saves calls `revalidatePath` for them. Pages for a signed-in user stay dynamic.
+
+## Files
+
+Two buckets: `public` (anyone can view, for images shown on the site) and `private` (documents, opened through short-lived links). Images you place on pages yourself keep using the usual image tools; this is for what visitors or the site's features upload.
+
+```ts
+// src/app/api/uploads/route.ts
+import { MESSAGES } from '@webtwizz/cloud';
+import { FileError, createFiles } from '@webtwizz/cloud/files';
+import { auth } from '@/lib/auth/server';
+
+export async function POST(request: Request) {
+  const { data: session } = await auth.getSession();
+  if (!session?.user) return Response.json({ error: 'Sign in first' }, { status: 401 });
+  const { name, type, size } = await request.json();
+  try {
+    const upload = await createFiles().uploadUrl({ bucket: 'public', name, type, size, folder: session.user.id, accept: ['image/*'] });
+    return Response.json(upload);
+  } catch (error) {
+    if (error instanceof FileError) return Response.json({ error: error.message }, { status: 400 });
+    return Response.json({ error: MESSAGES.uploadsPaused }, { status: 503 });
+  }
+}
+```
+
+The browser then sends the file with exactly the returned headers: `fetch(upload.url, { method: 'PUT', headers: upload.headers, body: file })`. The link holds the file's size, so send the same file you described. If the PUT fails with an access error, storage is full: show `MESSAGES.uploadsPaused`. Save `upload.key` in your table.
+
+Show files with `createFiles().publicUrl(key)` in a plain `<img>` or link, or `await createFiles().privateUrl(key)` (5 minutes; pass `{ download: 'name.pdf' }` to download) after checking the visitor may see it. Remove with `createFiles().remove(bucket, key)`. Never reuse a key.
+
+## Owner tools
+
+The owner manages users under Users in the Data panel (password reset, block, delete with their rows, export), sets who can sign up and the sign-in emails in Settings > Cloud > Users, and downloads everything from Settings > Cloud > Database. Point them there when they ask.

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# @webtwizz/cloud
+
+## 0.1.0
+
+- Sign-ins (`createAuth`, `createAuthClient`), plain words for every sign-in error (`authMessage`), a pooler-safe database client (`createDb`) and file uploads and links (`createFiles`).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WebTwizz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,53 @@
-# Temporary Holding Version
+# @webtwizz/cloud
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Sign-ins, database and file storage for sites built on [WebTwizz](https://webtwizz.com) Cloud.
+
+```sh
+npm install @webtwizz/cloud
+```
+
+WebTwizz puts every setting in the site's environment, so each module works with no arguments.
+
+| Import | What it gives you |
+| --- | --- |
+| `@webtwizz/cloud` | `authMessage(error)` plain words for sign-in errors, `MESSAGES` for unavailable and failed saves |
+| `@webtwizz/cloud/server` | `createAuth()` with `.handler()`, `.middleware()`, `.getSession()` and the server sign-in methods |
+| `@webtwizz/cloud/client` | `createAuthClient()` for client components |
+| `@webtwizz/cloud/db` | `createDb()`, a `postgres` client with pooler-safe settings |
+| `@webtwizz/cloud/files` | `createFiles()` with `uploadUrl`, `publicUrl`, `privateUrl`, `remove` |
+
+`server`, `db` and `files` are server-only. [AI_GUIDE.md](AI_GUIDE.md) has the full walkthrough and ships with each version.
+
+## Environment
+
+| Variable | Used by |
+| --- | --- |
+| `WEBTWIZZ_AUTH_URL`, `WEBTWIZZ_AUTH_SECRET` | `server` |
+| `DATABASE_URL` | `db` |
+| `WEBTWIZZ_STORAGE_ENDPOINT`, `WEBTWIZZ_STORAGE_REGION`, `WEBTWIZZ_STORAGE_KEY`, `WEBTWIZZ_STORAGE_SECRET` | `files` |
+| `WEBTWIZZ_STORAGE_READ_KEY`, `WEBTWIZZ_STORAGE_READ_SECRET` | `files` private links |
+| `WEBTWIZZ_FILES_URL`, `WEBTWIZZ_STORAGE_MAX_FILE_MB` | `files`, optional |
+
+## Development
+
+```sh
+npm ci
+npm test                 # unit tests
+npm run test:integration # real throwaway project, needs NEON_API_KEY
+npm run build
+```
+
+`test/fixture` is a small Next app that CI builds against the packed tarball.
+
+## Releases
+
+- Add a changeset (`npx changeset`) to any PR that changes what sites get.
+- When CI passes on `main`, the Release workflow versions, tags and publishes to npm with provenance (trusted publishing, no token).
+- Dependency updates merged by Renovate ship as a patch on their own.
+- Run the Release workflow by hand to publish the current commit under the `next` tag and try it on a test site first.
+
+Sites pin an exact version, so a release never changes a live site until WebTwizz upgrades it.
+
+## License
+
+MIT

package/dist/chunk-ESAV545E.js

@@ -0,0 +1,12 @@
+// src/env.ts
+function env(name) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`${name} is not set. WebTwizz sets it on sites that have WebTwizz Cloud (Settings > Cloud).`);
+  }
+  return value;
+}
+
+export {
+  env
+};

package/dist/chunk-G54JBUO3.js

@@ -0,0 +1,53 @@
+// src/errors.ts
+var TRY_LATER = "Sign-in isn't working right now. Please try again in a minute.";
+var TOO_MANY = "Too many tries. Wait a minute and try again.";
+var AUTH_MESSAGES = {
+  INVALID_EMAIL_OR_PASSWORD: "That email or password doesn't match.",
+  INVALID_PASSWORD: "That password doesn't match.",
+  INVALID_EMAIL: "That email doesn't look right.",
+  USER_NOT_FOUND: "There's no account with that email.",
+  USER_ALREADY_EXISTS: "There's already an account with that email.",
+  USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "There's already an account with that email.",
+  PASSWORD_TOO_SHORT: "Use at least 8 characters for the password.",
+  PASSWORD_TOO_LONG: "That password is too long.",
+  EMAIL_NOT_VERIFIED: "Confirm your email first: check your inbox for the code.",
+  EMAIL_ALREADY_VERIFIED: "Your email is already confirmed. You can sign in.",
+  EMAIL_MISMATCH: "That email doesn't match this account.",
+  EMAIL_CAN_NOT_BE_UPDATED: "The email on this account can't be changed.",
+  CHANGE_EMAIL_DISABLED: "The email on this account can't be changed.",
+  INVALID_OTP: "That code isn't right. Check it and try again.",
+  OTP_EXPIRED: "That code has expired. Ask for a new one.",
+  INVALID_TOKEN: "That link isn't valid anymore. Ask for a new one.",
+  TOKEN_EXPIRED: "That link has expired. Ask for a new one.",
+  TOO_MANY_ATTEMPTS: TOO_MANY,
+  BANNED_USER: "This account can't sign in.",
+  SESSION_EXPIRED: "You were signed out. Please sign in again.",
+  SESSION_NOT_FRESH: "For your security, sign in again to do this.",
+  CREDENTIAL_ACCOUNT_NOT_FOUND: "This account doesn't have a password yet.",
+  USER_ALREADY_HAS_PASSWORD: "This account already has a password.",
+  PASSWORD_ALREADY_SET: "This account already has a password.",
+  FAILED_TO_UNLINK_LAST_ACCOUNT: "You can't remove your only way to sign in.",
+  SOCIAL_ACCOUNT_ALREADY_LINKED: "That account is already connected.",
+  LINKED_ACCOUNT_ALREADY_EXISTS: "That account is already connected.",
+  MISSING_FIELD: "Fill in every field and try again.",
+  VALIDATION_ERROR: "Check what you entered and try again.",
+  FIELD_NOT_ALLOWED: "Check what you entered and try again."
+};
+function authMessage(error, overrides = {}) {
+  if (error?.status === 429) return overrides.TOO_MANY_ATTEMPTS ?? TOO_MANY;
+  const code = error?.code;
+  return code && (overrides[code] ?? AUTH_MESSAGES[code]) || TRY_LATER;
+}
+var MESSAGES = {
+  unavailable: "This isn't available right now. Please try again later.",
+  saveFailed: "Couldn't save right now. Please try again later.",
+  uploadsPaused: "Uploads are paused right now. Please try again later.",
+  fileType: "That type of file can't be uploaded here.",
+  fileTooLarge: (mb) => `That file is too big. The limit is ${mb} MB.`
+};
+
+export {
+  AUTH_MESSAGES,
+  authMessage,
+  MESSAGES
+};

package/dist/client.d.ts

@@ -0,0 +1,6 @@
+import { createAuthClient as createAuthClient$1 } from '@neondatabase/auth/next';
+
+type AuthClient = ReturnType<typeof createAuthClient$1>;
+declare function createAuthClient(): AuthClient;
+
+export { type AuthClient, createAuthClient };

package/dist/client.js

@@ -0,0 +1,8 @@
+// src/client.ts
+import { createAuthClient as create } from "@neondatabase/auth/next";
+function createAuthClient() {
+  return create();
+}
+export {
+  createAuthClient
+};

package/dist/db.d.ts

@@ -0,0 +1,9 @@
+import postgres from 'postgres';
+
+type DbOptions = postgres.Options<Record<string, postgres.PostgresType>> & {
+    url?: string;
+};
+type Db = postgres.Sql<Record<string, never>>;
+declare function createDb({ url, ...options }?: DbOptions): Db;
+
+export { type Db, type DbOptions, createDb };

package/dist/db.js

@@ -0,0 +1,13 @@
+import {
+  env
+} from "./chunk-ESAV545E.js";
+
+// src/db.ts
+import "server-only";
+import postgres from "postgres";
+function createDb({ url, ...options } = {}) {
+  return postgres(url ?? env("DATABASE_URL"), { ...options, prepare: false });
+}
+export {
+  createDb
+};

package/dist/files.d.ts

@@ -0,0 +1,35 @@
+type Bucket = 'public' | 'private';
+type UploadRequest = {
+    bucket: Bucket;
+    name: string;
+    type: string;
+    size: number;
+    folder?: string;
+    accept?: string[];
+};
+type Upload = {
+    url: string;
+    key: string;
+    headers: Record<string, string>;
+};
+declare class FileError extends Error {
+    code: 'too_large' | 'type';
+    constructor(code: 'too_large' | 'type', message: string);
+}
+declare function safeName(name: string): string;
+declare function accepts(type: string, accept: string[]): boolean;
+declare function createFiles(): {
+    maxFileMb: number;
+    /** A 5-minute link the browser PUTs the file to, with the exact headers it must send. */
+    uploadUrl({ bucket, name, type, size, folder, accept }: UploadRequest): Promise<Upload>;
+    publicUrl(key: string): string;
+    /** A short-lived link to a private file; check the visitor may see it first. */
+    privateUrl(key: string, { expiresIn, download }?: {
+        expiresIn?: number;
+        download?: string;
+    }): Promise<string>;
+    remove(bucket: Bucket, key: string): Promise<void>;
+};
+type Files = ReturnType<typeof createFiles>;
+
+export { type Bucket, FileError, type Files, type Upload, type UploadRequest, accepts, createFiles, safeName };

package/dist/files.js

@@ -0,0 +1,92 @@
+import {
+  MESSAGES
+} from "./chunk-G54JBUO3.js";
+import {
+  env
+} from "./chunk-ESAV545E.js";
+
+// src/files.ts
+import "server-only";
+import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+var FileError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "FileError";
+  }
+  code;
+};
+var IMMUTABLE = "public, max-age=31536000, immutable";
+function safeName(name) {
+  const cleaned = name.normalize("NFKD").replace(/[^\w.-]+/g, "-").replace(/-+/g, "-").replace(/^[-.]+|-+$/g, "");
+  return cleaned.slice(-80) || "file";
+}
+function accepts(type, accept) {
+  return accept.some((rule) => rule.endsWith("/*") ? type.startsWith(rule.slice(0, -1)) : type === rule);
+}
+function encodeKey(key) {
+  return key.split("/").map(encodeURIComponent).join("/");
+}
+function createFiles() {
+  const endpoint = env("WEBTWIZZ_STORAGE_ENDPOINT").replace(/\/+$/, "");
+  const filesUrl = (process.env.WEBTWIZZ_FILES_URL || endpoint).replace(/\/+$/, "");
+  const region = env("WEBTWIZZ_STORAGE_REGION");
+  const client = (key, secret) => new S3Client({
+    region,
+    endpoint,
+    forcePathStyle: true,
+    requestChecksumCalculation: "WHEN_REQUIRED",
+    credentials: { accessKeyId: env(key), secretAccessKey: env(secret) }
+  });
+  const writer = client("WEBTWIZZ_STORAGE_KEY", "WEBTWIZZ_STORAGE_SECRET");
+  let reader;
+  const maxFileMb = Number(process.env.WEBTWIZZ_STORAGE_MAX_FILE_MB) || 0;
+  return {
+    maxFileMb,
+    /** A 5-minute link the browser PUTs the file to, with the exact headers it must send. */
+    async uploadUrl({ bucket, name, type, size, folder, accept }) {
+      if (maxFileMb && size > maxFileMb * 1024 * 1024) throw new FileError("too_large", MESSAGES.fileTooLarge(maxFileMb));
+      if (accept && !accepts(type, accept)) throw new FileError("type", MESSAGES.fileType);
+      const prefix = folder ? `${folder.split("/").map(safeName).join("/")}/` : "";
+      const key = `${prefix}${crypto.randomUUID()}-${safeName(name)}`;
+      const headers = { "Content-Type": type };
+      if (bucket === "public") headers["Cache-Control"] = IMMUTABLE;
+      const command = new PutObjectCommand({
+        Bucket: bucket,
+        Key: key,
+        ContentType: type,
+        ContentLength: size,
+        CacheControl: headers["Cache-Control"]
+      });
+      const url = await getSignedUrl(writer, command, {
+        expiresIn: 300,
+        signableHeaders: /* @__PURE__ */ new Set(["content-type", "content-length"])
+      });
+      return { url, key, headers };
+    },
+    publicUrl(key) {
+      return `${filesUrl}/public/${encodeKey(key)}`;
+    },
+    /** A short-lived link to a private file; check the visitor may see it first. */
+    async privateUrl(key, { expiresIn = 300, download } = {}) {
+      reader ??= client("WEBTWIZZ_STORAGE_READ_KEY", "WEBTWIZZ_STORAGE_READ_SECRET");
+      const command = new GetObjectCommand({
+        Bucket: "private",
+        Key: key,
+        ResponseContentDisposition: download ? `attachment; filename="${safeName(download)}"` : void 0
+      });
+      const url = await getSignedUrl(reader, command, { expiresIn });
+      return url.startsWith(`${endpoint}/`) ? filesUrl + url.slice(endpoint.length) : url;
+    },
+    async remove(bucket, key) {
+      await writer.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }));
+    }
+  };
+}
+export {
+  FileError,
+  accepts,
+  createFiles,
+  safeName
+};

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+type CloudError = {
+    code?: string;
+    status?: number;
+} | null | undefined;
+declare const AUTH_MESSAGES: Record<string, string>;
+/** Plain words for a sign-in error, never the library's own text. */
+declare function authMessage(error: CloudError, overrides?: Record<string, string>): string;
+declare const MESSAGES: {
+    readonly unavailable: "This isn't available right now. Please try again later.";
+    readonly saveFailed: "Couldn't save right now. Please try again later.";
+    readonly uploadsPaused: "Uploads are paused right now. Please try again later.";
+    readonly fileType: "That type of file can't be uploaded here.";
+    readonly fileTooLarge: (mb: number) => string;
+};
+
+export { AUTH_MESSAGES, type CloudError, MESSAGES, authMessage };

package/dist/index.js

@@ -0,0 +1,10 @@
+import {
+  AUTH_MESSAGES,
+  MESSAGES,
+  authMessage
+} from "./chunk-G54JBUO3.js";
+export {
+  AUTH_MESSAGES,
+  MESSAGES,
+  authMessage
+};

package/dist/server.d.ts

@@ -0,0 +1,11 @@
+import { createNeonAuth } from '@neondatabase/auth/next/server';
+
+type AuthOptions = {
+    url?: string;
+    secret?: string;
+    sessionDataTtl?: number;
+};
+type Auth = ReturnType<typeof createNeonAuth>;
+declare function createAuth(options?: AuthOptions): Auth;
+
+export { type Auth, type AuthOptions, createAuth };

package/dist/server.js

@@ -0,0 +1,19 @@
+import {
+  env
+} from "./chunk-ESAV545E.js";
+
+// src/server.ts
+import "server-only";
+import { createNeonAuth } from "@neondatabase/auth/next/server";
+function createAuth(options = {}) {
+  return createNeonAuth({
+    baseUrl: options.url ?? env("WEBTWIZZ_AUTH_URL"),
+    cookies: {
+      secret: options.secret ?? env("WEBTWIZZ_AUTH_SECRET"),
+      sessionDataTtl: options.sessionDataTtl
+    }
+  });
+}
+export {
+  createAuth
+};

package/package.json

@@ -1,6 +1,86 @@
 {
   "name": "@webtwizz/cloud",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Sign-ins, database and file storage for sites built on WebTwizz Cloud",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/WebTwizz/webtwizz-cloud.git"
+  },
+  "homepage": "https://webtwizz.com",
+  "keywords": [
+    "webtwizz",
+    "auth",
+    "postgres",
+    "storage",
+    "nextjs"
+  ],
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "AI_GUIDE.md",
+    "CHANGELOG.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "default": "./dist/client.js"
+    },
+    "./db": {
+      "types": "./dist/db.d.ts",
+      "default": "./dist/db.js"
+    },
+    "./files": {
+      "types": "./dist/files.d.ts",
+      "default": "./dist/files.js"
+    },
+    "./AI_GUIDE.md": "./AI_GUIDE.md",
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "release": "npm run build && changeset publish",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "peerDependencies": {
+    "next": ">=16.0.0",
+    "react": ">=18.0.0"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "3.1148.0",
+    "@aws-sdk/s3-request-presigner": "3.1148.0",
+    "@neondatabase/auth": "0.5.0-beta",
+    "postgres": "3.4.9",
+    "server-only": "0.0.1"
+  },
+  "devDependencies": {
+    "@changesets/cli": "3.0.3",
+    "@types/node": "26.6.4",
+    "@types/react": "19.3.0",
+    "next": "16.4.0",
+    "react": "19.3.0",
+    "react-dom": "19.3.0",
+    "tsup": "8.5.1",
+    "typescript": "5.9.3",
+    "vitest": "4.1.11"
+  }
+}