@wtfalch/files 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 William Falch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,104 @@
+# @wtfalch/files
+
+Public client SDK and API types for the Files service. Requires Node 22+ or a
+browser with Fetch and AbortSignal.timeout support. The client has no runtime
+package dependencies.
+
+```sh
+npm install @wtfalch/files
+```
+
+```ts
+import { createFilesClient, ApiError } from '@wtfalch/files';
+
+const files = createFilesClient({
+  url: serviceOrigin,
+  credential: () => serviceKey,
+  organisationId,
+});
+
+const files = await files.listFiles(collectionId, { limit: 50 });
+const download = await files.downloadFile(fileId);
+```
+
+Use the deployed service's HTTPS origin and a scoped service credential. The
+credential callback runs for every request, so rotation does not require a new
+client. The client refuses redirects and omits browser cookies. An HTTP origin
+is accepted only for localhost development. Do not embed a privileged service
+credential in public browser code.
+
+Requests require current service permissions and configured budgets. A retry
+of the same operation should retain its request ID. API failures throw
+`ApiError` with `status` and `code`; the SDK does not expose raw upstream error
+bodies.
+
+The root export provides the client and public request/response types.
+`@wtfalch/files/client` is also supported. There are no server, database,
+migration, provider-adapter or authorization-engine exports. The service
+implementation is maintained in a private repository.
+
+The first 0.1.0 SDK targets the new service API. Production migration from Valet
+is a separate rollout; installing the SDK does not migrate accounts or files.
+
+## Management integration
+
+`createFilesManagementClient` covers operator rates, organisations and audit,
+plus tenant quotas, budgets, usage and share listings. Supply an authenticated
+`fetch` that signs a human management proof or attaches an issued management key.
+The calling application's transport must check the current user's permissions
+before using a service key on their behalf. The SDK adds no authentication itself.
+HTTPS is required by default, with HTTP allowed for localhost development.
+For a server-side management client on a trusted private network, explicitly set
+`allowInsecureHttp: true` to use an origin such as `http://files:3000`.
+This does not detect or secure private networks; the host application owns that
+boundary. Redirects remain disabled and cookies omitted. The file client still
+requires HTTPS outside localhost.
+
+```ts
+import { createFilesManagementClient } from '@wtfalch/files';
+
+const management = createFilesManagementClient({
+  url: serviceOrigin,
+  fetch: authenticatedManagementFetch,
+});
+const query = {
+  from: '2026-09-01T00:00:00Z',
+  to: '2026-09-02T00:00:00Z',
+  limit: 200,
+};
+const page = await management.listAudit(query);
+if (page.next) {
+  const nextPage = await management.listAudit({ ...query, cursor: page.next });
+}
+```
+
+Audit reads require `platform.audit:read`. Date ranges are capped at 92 days;
+omitting both dates selects the most recent 92 days. Reuse the same filters and
+pass `next` unchanged: converting its timestamp to a JavaScript `Date` loses
+the microseconds needed for pagination. Audit types are exported as `AuditQuery`,
+`AuditEvent` and `AuditPage`. CSV export remains available through
+`GET /v1/manage/audit?format=csv`; its `x-next-cursor` header supplies continuation.
+
+`provisionOrganisation()` returns the organisation fields plus `created`:
+`true` for a new organisation (HTTP 201), `false` when it already existed
+(HTTP 200). A repeat provisioning call preserves the existing ceilings and share
+host; use `updateOrganisationCeiling()` to change them. Byte and money totals
+remain decimal strings, including values above JavaScript's safe integer range.
+
+For the operator application's existing transport, compose the SDK on the server:
+
+```ts
+const management = createFilesManagementClient({
+  url: filesOrigin,
+  allowInsecureHttp: privateNetworkHttpEnabled,
+  fetch: filesManagementFetch(access, operatorOrganisationId),
+});
+const result = await management.provisionOrganisation(input);
+if (!result.created) {
+  // Show the retained values; provisioning did not apply the requested ceilings.
+}
+```
+
+`allowInsecureHttp` should come from trusted deployment configuration, never a
+request parameter. Keep application permission checks inside the supplied fetch
+and retain the UI's error mapping when replacing a custom client with the SDK.

package/dist/client.d.ts

@@ -0,0 +1,51 @@
+import { type ClientOptions, type ManagementClientOptions } from './transport.js';
+import type { AuditPage, AuditQuery, BudgetSummary, CreatedShare, FilesRate, OrganisationShare, OrganisationSummary, ProvisionOrganisationInput, ProvisionOrganisationResult, QuotaSummary, SetRateInput, Share, StoredFile, UpdateOrganisationCeilingInput, UploadInput, UploadReservation, UsageDay } from './types.js';
+export { ApiError, type ClientOptions, type ManagementClientOptions } from './transport.js';
+export declare function createFilesClient(options: ClientOptions): {
+    createCollection: (name: string) => Promise<{
+        id: string;
+        name: string;
+    }>;
+    reserveUpload: (input: UploadInput) => Promise<UploadReservation>;
+    confirmUpload: (id: string) => Promise<StoredFile>;
+    getFile: (id: string) => Promise<StoredFile>;
+    downloadFile: (id: string) => Promise<{
+        url: string;
+        expiresIn: number;
+    }>;
+    deleteFile: (id: string) => Promise<void>;
+    listFiles: (collection: string, page?: {
+        after?: string;
+        limit?: number;
+    }) => Promise<StoredFile[]>;
+    createShare: (fileId: string, expiresAt: string | null) => Promise<CreatedShare>;
+    listShares: (fileId: string) => Promise<Share[]>;
+    revokeShare: (shareId: string) => Promise<void>;
+};
+/** Operator and tenant management routes. `options.fetch` authenticates
+ * each request with a signed human proof or an issued management key;
+ * this client sends no bearer credential or organisation header of its own. */
+export declare function createFilesManagementClient(options: ManagementClientOptions): {
+    listAudit: (query?: AuditQuery) => Promise<AuditPage>;
+    listRates: () => Promise<{
+        rates: FilesRate[];
+    }>;
+    setRate: (input: SetRateInput) => Promise<FilesRate>;
+    listOrganisations: () => Promise<{
+        organisations: OrganisationSummary[];
+    }>;
+    provisionOrganisation: (input: ProvisionOrganisationInput) => Promise<ProvisionOrganisationResult>;
+    updateOrganisationCeiling: (organisationId: string, input: UpdateOrganisationCeilingInput) => Promise<OrganisationSummary>;
+    getQuota: () => Promise<QuotaSummary>;
+    setQuota: (limitBytes: string | null) => Promise<QuotaSummary>;
+    setKeyQuota: (keyId: string, limitBytes: string | null) => Promise<QuotaSummary>;
+    getBudget: () => Promise<BudgetSummary>;
+    setBudget: (limitMicros: string | null) => Promise<BudgetSummary>;
+    setKeyBudget: (keyId: string, limitMicros: string | null) => Promise<BudgetSummary>;
+    getUsage: (from: string, to: string) => Promise<{
+        days: UsageDay[];
+    }>;
+    listOrganisationShares: () => Promise<{
+        shares: OrganisationShare[];
+    }>;
+};

package/dist/client.js

@@ -0,0 +1,65 @@
+import { clientCall, managementCall, managementCallWithStatus, } from './transport.js';
+export { ApiError } from './transport.js';
+export function createFilesClient(options) {
+    const call = clientCall(options);
+    return {
+        createCollection: (name) => call('POST', '/v1/collections', { name }),
+        reserveUpload: (input) => call('POST', '/v1/uploads', input),
+        confirmUpload: (id) => call('POST', `/v1/uploads/${encodeURIComponent(id)}/confirm`),
+        getFile: (id) => call('GET', `/v1/files/${encodeURIComponent(id)}`),
+        downloadFile: (id) => call('GET', `/v1/files/${encodeURIComponent(id)}/download`),
+        deleteFile: (id) => call('DELETE', `/v1/files/${encodeURIComponent(id)}`),
+        listFiles: (collection, page = {}) => call('GET', `/v1/collections/${encodeURIComponent(collection)}/files?${new URLSearchParams({
+            ...(page.after ? { after: page.after } : {}),
+            ...(page.limit !== undefined ? { limit: String(page.limit) } : {}),
+        })}`),
+        // Public share links (task S6): `files.files:share`/`files.shares:read`,
+        // bearer key or signed request -- both reach the same /v1/files/*
+        // routes this client already calls.
+        createShare: (fileId, expiresAt) => call('POST', `/v1/files/${encodeURIComponent(fileId)}/shares`, { expiresAt }),
+        listShares: (fileId) => call('GET', `/v1/files/${encodeURIComponent(fileId)}/shares`).then((r) => r.shares),
+        revokeShare: (shareId) => call('DELETE', `/v1/shares/${encodeURIComponent(shareId)}`),
+    };
+}
+/** Operator and tenant management routes. `options.fetch` authenticates
+ * each request with a signed human proof or an issued management key;
+ * this client sends no bearer credential or organisation header of its own. */
+export function createFilesManagementClient(options) {
+    const call = managementCall(options);
+    const callWithStatus = managementCallWithStatus(options);
+    return {
+        listAudit: (query = {}) => {
+            const params = new URLSearchParams();
+            for (const key of ['organisation', 'from', 'to', 'limit', 'cursor']) {
+                const value = query[key];
+                if (value !== undefined)
+                    params.set(key, String(value));
+            }
+            return call('GET', `/v1/manage/audit?${params}`);
+        },
+        listRates: () => call('GET', '/v1/manage/rates'),
+        setRate: (input) => call('POST', '/v1/manage/rates', input),
+        listOrganisations: () => call('GET', '/v1/manage/organisations'),
+        provisionOrganisation: async (input) => {
+            const { data, status } = await callWithStatus('POST', '/v1/manage/organisations', input);
+            return { ...data, created: status === 201 };
+        },
+        updateOrganisationCeiling: (organisationId, input) => call('PATCH', `/v1/manage/organisations/${encodeURIComponent(organisationId)}`, input),
+        // Tenant routes (task S4b): the caller's own organisation, from the
+        // signed request's claim -- there is no organisation id to pass here.
+        getQuota: () => call('GET', '/v1/manage/quota'),
+        setQuota: (limitBytes) => call('PUT', '/v1/manage/quota', { limitBytes }),
+        setKeyQuota: (keyId, limitBytes) => call('PUT', `/v1/manage/keys/${encodeURIComponent(keyId)}/quota`, {
+            limitBytes,
+        }),
+        getBudget: () => call('GET', '/v1/manage/budget'),
+        setBudget: (limitMicros) => call('PUT', '/v1/manage/budget', { limitMicros }),
+        setKeyBudget: (keyId, limitMicros) => call('PUT', `/v1/manage/keys/${encodeURIComponent(keyId)}/budget`, {
+            limitMicros,
+        }),
+        getUsage: (from, to) => call('GET', `/v1/manage/usage?${new URLSearchParams({ from, to })}`),
+        // Public share links (task S6): every active link in the caller's
+        // organisation, with the file's name -- never the token or URL.
+        listOrganisationShares: () => call('GET', '/v1/manage/shares'),
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './client.js';
+export type * from './types.js';
+export { fileReference, fileIdFromReference } from './references.js';

package/dist/index.js

@@ -0,0 +1,2 @@
+export * from './client.js';
+export { fileReference, fileIdFromReference } from './references.js';

package/dist/references.d.ts

@@ -0,0 +1,3 @@
+export declare function fileReference(id: string): string;
+/** Parsing a legacy reference supplies an identifier, never authority. */
+export declare function fileIdFromReference(value: string): string | null;

package/dist/references.js

@@ -0,0 +1,10 @@
+const ref = /^(?:files:file|storage:file|valet:artifact)\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+export function fileReference(id) {
+    if (!ref.test(`files:file/${id}`))
+        throw new Error('Invalid file id');
+    return `files:file/${id.toLowerCase()}`;
+}
+/** Parsing a legacy reference supplies an identifier, never authority. */
+export function fileIdFromReference(value) {
+    return ref.exec(value)?.[1]?.toLowerCase() ?? null;
+}

package/dist/transport.d.ts

@@ -0,0 +1,31 @@
+export interface ClientOptions {
+    url: string;
+    credential: () => string | Promise<string>;
+    /** Organisation selection; the service verifies credential access to it. */
+    organisationId?: string;
+    fetch?: typeof fetch;
+}
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message?: string);
+}
+export declare function clientCall(options: ClientOptions): <T>(method: string, path: string, input?: unknown) => Promise<T>;
+export interface ManagementClientOptions {
+    url: string;
+    /** Explicit opt-in for server-to-server HTTP on a trusted private network.
+     * Defaults to false. The caller is responsible for protecting the connection. */
+    allowInsecureHttp?: boolean;
+    /** Authenticates each request with a signed human proof or issued key;
+     * this transport carries no credential of its own. */
+    fetch: typeof fetch;
+}
+/** Same wire shape as `clientCall`, except the response body itself is the
+ * data (no `{ data }` envelope) and no bearer/organisation header is sent --
+ * the caller-supplied `fetch` is the whole authentication story. */
+export declare function managementCall(options: ManagementClientOptions): <T>(method: string, path: string, input?: unknown) => Promise<T>;
+/** Retain response status for idempotent provisioning (201 created, 200 existing). */
+export declare function managementCallWithStatus(options: ManagementClientOptions): <T>(method: string, path: string, input?: unknown) => Promise<{
+    data: T;
+    status: number;
+}>;

package/dist/transport.js

@@ -0,0 +1,99 @@
+export class ApiError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message ?? code);
+        this.status = status;
+        this.code = code;
+    }
+}
+function requireServiceOrigin(url, allowInsecureHttp = false) {
+    const base = new URL(url);
+    if (base.username ||
+        base.password ||
+        base.search ||
+        base.hash ||
+        base.pathname !== '/' ||
+        (base.protocol !== 'https:' &&
+            !(base.protocol === 'http:' &&
+                (allowInsecureHttp || ['localhost', '127.0.0.1', '[::1]'].includes(base.hostname)))))
+        throw new Error('Use an HTTPS service origin (HTTP is allowed only for localhost)');
+    return base;
+}
+/** `{ error: { code, message } }`, the same shape both response envelopes use. */
+function errorFrom(value) {
+    const error = typeof value === 'object' && value !== null && 'error' in value ? value.error : null;
+    const code = typeof error === 'object' && error !== null && 'code' in error && typeof error.code === 'string'
+        ? error.code
+        : 'request_failed';
+    const message = typeof error === 'object' && error !== null && 'message' in error ? error.message : undefined;
+    return { code, message: typeof message === 'string' ? message : undefined };
+}
+export function clientCall(options) {
+    const base = requireServiceOrigin(options.url);
+    return async (method, path, input) => {
+        const response = await (options.fetch ?? fetch)(new URL(path, base), {
+            method,
+            redirect: 'error',
+            credentials: 'omit',
+            headers: {
+                authorization: `Bearer ${await options.credential()}`,
+                ...(options.organisationId ? { 'x-organisation-id': options.organisationId } : {}),
+                ...(input === undefined ? {} : { 'content-type': 'application/json' }),
+            },
+            body: input === undefined ? undefined : JSON.stringify(input),
+            signal: AbortSignal.timeout(30000),
+        });
+        if (response.status === 204)
+            return undefined;
+        let value;
+        try {
+            value = await response.json();
+        }
+        catch {
+            throw new ApiError(response.status, 'invalid_response');
+        }
+        if (!response.ok) {
+            const { code, message } = errorFrom(value);
+            throw new ApiError(response.status, code, message);
+        }
+        if (!value || typeof value !== 'object' || !('data' in value))
+            throw new ApiError(response.status, 'invalid_response');
+        return value.data;
+    };
+}
+/** Same wire shape as `clientCall`, except the response body itself is the
+ * data (no `{ data }` envelope) and no bearer/organisation header is sent --
+ * the caller-supplied `fetch` is the whole authentication story. */
+export function managementCall(options) {
+    const call = managementCallWithStatus(options);
+    return async (method, path, input) => (await call(method, path, input)).data;
+}
+/** Retain response status for idempotent provisioning (201 created, 200 existing). */
+export function managementCallWithStatus(options) {
+    const base = requireServiceOrigin(options.url, options.allowInsecureHttp);
+    return async (method, path, input) => {
+        const response = await options.fetch(new URL(path, base), {
+            method,
+            redirect: 'error',
+            credentials: 'omit',
+            headers: input === undefined ? {} : { 'content-type': 'application/json' },
+            body: input === undefined ? undefined : JSON.stringify(input),
+            signal: AbortSignal.timeout(30000),
+        });
+        if (response.status === 204)
+            return { data: undefined, status: response.status };
+        let value;
+        try {
+            value = await response.json();
+        }
+        catch {
+            throw new ApiError(response.status, 'invalid_response');
+        }
+        if (!response.ok) {
+            const { code, message } = errorFrom(value);
+            throw new ApiError(response.status, code, message);
+        }
+        return { data: value, status: response.status };
+    };
+}

package/dist/types.d.ts

@@ -0,0 +1,184 @@
+/** Public HTTP contracts. Internal object keys and quota rows are never returned. */
+export interface UploadInput {
+    collectionId: string;
+    name: string;
+    contentType: string;
+    bytes: number;
+    requestId: string;
+    replace?: {
+        fileId: string;
+        version: number;
+    };
+    retention: 'scratch' | 'durable';
+}
+export interface StoredFile {
+    id: string;
+    ref: string;
+    name: string;
+    contentType: string;
+    bytes: string;
+    version: number;
+    collectionId: string;
+    expiresAt: string | null;
+}
+export type UploadReservation = {
+    uploadId: string;
+    fileId: string;
+    state: 'confirmed';
+} | {
+    uploadId: string;
+    fileId: string;
+    state: 'pending';
+    url: string;
+    headers: {
+        'content-type': string;
+        'content-length': string;
+    };
+    expiresAt: string;
+};
+/** Public share links (task S6). `url` is returned only from `createShare`,
+ * once, and is never included in a listing -- `Share` (below) is what
+ * `listShares` returns instead. */
+export interface CreatedShare {
+    shareId: string;
+    url: string;
+    expiresAt: string | null;
+    createdAt: string;
+}
+export interface Share {
+    shareId: string;
+    expiresAt: string | null;
+    createdAt: string;
+    createdBy: string;
+    revokedAt: string | null;
+}
+/** The organisation's active links (task S6, signed-request-only client). */
+export interface OrganisationShare {
+    shareId: string;
+    fileId: string;
+    fileName: string;
+    expiresAt: string | null;
+    createdAt: string;
+}
+/** Operator management contracts (ADR 0021 signed requests only). A GB-day
+ * rate is a small price and travels as a JSON number; ceilings, usage and
+ * spend are cumulative totals and travel as bigint-safe strings, `null`
+ * meaning uncapped. */
+export interface FilesRate {
+    microsPerGbDay: number;
+    /** The per-GB upload price, reserved when an upload is reserved and
+     * settled when it is confirmed -- the same small-price convention as
+     * `microsPerGbDay`. */
+    microsPerGbUpload: number;
+    effectiveFrom: string;
+    createdAt: string;
+    createdBy: string;
+}
+export interface SetRateInput {
+    microsPerGbDay: number;
+    /** Omitted: the new rate carries forward whatever upload price is
+     * already in force, rather than zeroing it. */
+    microsPerGbUpload?: number;
+    /** ISO calendar date; must be tomorrow UTC or later. */
+    effectiveFrom: string;
+}
+export interface OrganisationSummary {
+    organisationId: string;
+    ceilingBytes: string | null;
+    ceilingMicros: string | null;
+    usedBytes: string;
+    reservedBytes: string;
+    spentMicros: string;
+    suspended: boolean;
+    /** The organisation's own public share domain, a bare lowercase host name
+     * such as `share.lokessmie.no` (task S7). `null` means it has none, and
+     * `createShare` answers 503 `not_configured` for it. Unique across
+     * organisations: a host another organisation already owns is refused with
+     * 409 `conflict`. */
+    shareHost: string | null;
+}
+export interface ProvisionOrganisationInput {
+    organisationId: string;
+    ceilingBytes: string | null;
+    ceilingMicros: string | null;
+    /** Omitted or `null`: provisioned with no share domain. */
+    shareHost?: string | null;
+}
+export interface ProvisionOrganisationResult extends OrganisationSummary {
+    /** False when already provisioned: existing ceilings and share host were retained. */
+    created: boolean;
+}
+export interface UpdateOrganisationCeilingInput {
+    ceilingBytes?: string | null;
+    ceilingMicros?: string | null;
+    suspended?: boolean;
+    /** `undefined` leaves it untouched; `null` clears it, which retires every
+     * existing link for that organisation immediately (task S7). */
+    shareHost?: string | null;
+}
+/** Tenant management contracts (task S4b), same signed-request-only client.
+ * Byte and money totals travel as bigint-safe strings, `null` uncapped. */
+export interface QuotaSummary {
+    organisation: {
+        limitBytes: string | null;
+        ceilingBytes: string | null;
+        usedBytes: string;
+        reservedBytes: string;
+    };
+    keys: Array<{
+        keyId: string;
+        limitBytes: string | null;
+        usedBytes: string;
+        reservedBytes: string;
+    }>;
+}
+export interface BudgetSummary {
+    organisation: {
+        limitMicros: string | null;
+        ceilingMicros: string | null;
+        spentMicros: string;
+        reservedMicros: string;
+    };
+    keys: Array<{
+        keyId: string;
+        limitMicros: string | null;
+        spentMicros: string;
+        reservedMicros: string;
+    }>;
+}
+/** `gbDays`/`rateMicrosPerGbDay` are small numbers and travel as JSON
+ * numbers, matching `FilesRate.microsPerGbDay`; `chargedMicros` is a
+ * cumulative amount and travels as a bigint-safe string. */
+export interface UsageDay {
+    day: string;
+    keyId: string;
+    gbDays: number;
+    chargedMicros: string;
+    rateMicrosPerGbDay: number;
+}
+/** Operator audit filters. Omitted dates select the most recent 92 days. */
+export interface AuditQuery {
+    organisation?: string;
+    from?: string;
+    to?: string;
+    limit?: number;
+    /** Pass the previous page's `next` unchanged to preserve timestamp precision. */
+    cursor?: string;
+}
+export interface AuditEvent {
+    id: number;
+    occurredAt: string;
+    organisationId: string | null;
+    action: string;
+    actorDisplay: string;
+    targetType: string;
+    targetId: string | null;
+    outcome: string;
+    context: string;
+    reason: string | null;
+    reference: string | null;
+}
+export interface AuditPage {
+    events: AuditEvent[];
+    next: string | null;
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@wtfalch/files",
+  "version": "0.3.0",
+  "type": "module",
+  "license": "MIT",
+  "description": "Public client SDK and API types for the Files service.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/wtfalch/files",
+    "directory": "packages/sdk"
+  },
+  "files": [
+    "dist/index.js",
+    "dist/index.d.ts",
+    "dist/client.js",
+    "dist/client.d.ts",
+    "dist/transport.js",
+    "dist/transport.d.ts",
+    "dist/types.js",
+    "dist/types.d.ts",
+    "dist/references.js",
+    "dist/references.d.ts"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "default": "./dist/client.js"
+    }
+  },
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "pnpm build && node ../../scripts/verify-sdk.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "typescript": "^5.9.0",
+    "vitest": "^4.1.6"
+  }
+}