flowingts 0.0.0 → 0.19.0

package/dist/utils/request-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-target.js","sourceRoot":"","sources":["../../src/utils/request-target.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,MAAM,UAAU,GAAG,4FAA4F,CAAC;AAEhH,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IACxB,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,GAAG,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IACnD,sFAAsF;IACtF,OAAO,IAAI,GAAG,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;AAC9C,CAAC;AAQD;;;;GAIG;AACH,MAAM,WAAW,GAAG,oCAAoC,CAAC;AACzD,kGAAkG;AAClG,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,4FAA4F;AAC5F,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,8DAA8D;QAC9D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqC,EAAE,KAAuB;IAC1F,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAC7D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/utils/safe-json.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `JSON.parse` contra prototype pollution (S-08).
+ *
+ * O `JSON.parse` cria `"__proto__"` como propriedade própria, o que é inofensivo sozinho. O risco
+ * aparece depois, quando o objeto passa por um merge recursivo ou por `Object.assign` em código do
+ * usuário ou de bibliotecas. Por isso, o body é conferido logo na entrada:
+ * - `__proto__` em qualquer nível;
+ * - `constructor` cujo valor é um objeto com `prototype` (o outro caminho até o protótipo).
+ *
+ * A conferência só percorre o objeto quando o texto pode conter essas chaves, inclusive com escapes
+ * `\u`. Bodies comuns seguem pelo caminho rápido.
+ */
+export type ProtoPoisoning = 'error' | 'remove';
+export declare class ProtoPoisoningError extends Error {
+    readonly key: string;
+    constructor(key: string);
+}
+export declare function parseJson(text: string, mode?: ProtoPoisoning): unknown;
+/**
+ * A mesma proteção do `parseJson` (S-08) para o valor de um parser próprio (F-12). Diferente do JSON, um parser
+ * (YAML com âncoras, por exemplo) pode devolver referências repetidas ou circulares: cada objeto é visitado uma vez.
+ */
+export declare function scrubParsed(root: unknown, mode?: ProtoPoisoning): void;
+//# sourceMappingURL=safe-json.d.ts.map

package/dist/utils/safe-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-json.d.ts","sourceRoot":"","sources":["../../src/utils/safe-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhD,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM;IAAhC,YAAqB,GAAG,EAAE,MAAM,EAE/B;CACF;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAwB,GAAG,OAAO,CAK/E;AAwBD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,GAAE,cAAwB,GAAG,IAAI,CAsB/E"}

package/dist/utils/safe-json.js

@@ -0,0 +1,83 @@
+/**
+ * `JSON.parse` contra prototype pollution (S-08).
+ *
+ * O `JSON.parse` cria `"__proto__"` como propriedade própria, o que é inofensivo sozinho. O risco
+ * aparece depois, quando o objeto passa por um merge recursivo ou por `Object.assign` em código do
+ * usuário ou de bibliotecas. Por isso, o body é conferido logo na entrada:
+ * - `__proto__` em qualquer nível;
+ * - `constructor` cujo valor é um objeto com `prototype` (o outro caminho até o protótipo).
+ *
+ * A conferência só percorre o objeto quando o texto pode conter essas chaves, inclusive com escapes
+ * `\u`. Bodies comuns seguem pelo caminho rápido.
+ */
+export class ProtoPoisoningError extends Error {
+    key;
+    constructor(key) {
+        super(`Object contains forbidden key "${key}"`);
+        this.key = key;
+    }
+}
+export function parseJson(text, mode = 'error') {
+    const value = JSON.parse(text);
+    if (!text.includes('proto') && !text.includes('constructor') && !text.includes('\\u'))
+        return value;
+    scrub(value, mode);
+    return value;
+}
+function scrub(root, mode) {
+    const stack = [root];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (typeof node !== 'object' || node === null)
+            continue;
+        const obj = node;
+        if (Object.hasOwn(obj, '__proto__')) {
+            if (mode === 'error')
+                throw new ProtoPoisoningError('__proto__');
+            // biome-ignore lint/suspicious/noProto: é exatamente a chave própria que está sendo removida.
+            delete obj['__proto__'];
+        }
+        if (Object.hasOwn(obj, 'constructor')) {
+            const ctor = obj['constructor'];
+            if (typeof ctor === 'object' && ctor !== null && Object.hasOwn(ctor, 'prototype')) {
+                if (mode === 'error')
+                    throw new ProtoPoisoningError('constructor.prototype');
+                delete obj['constructor'];
+            }
+        }
+        for (const key of Object.keys(obj))
+            stack.push(obj[key]);
+    }
+}
+/**
+ * A mesma proteção do `parseJson` (S-08) para o valor de um parser próprio (F-12). Diferente do JSON, um parser
+ * (YAML com âncoras, por exemplo) pode devolver referências repetidas ou circulares: cada objeto é visitado uma vez.
+ */
+export function scrubParsed(root, mode = 'error') {
+    const seen = new WeakSet();
+    const stack = [root];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (typeof node !== 'object' || node === null || seen.has(node))
+            continue;
+        seen.add(node);
+        const obj = node;
+        if (Object.hasOwn(obj, '__proto__')) {
+            if (mode === 'error')
+                throw new ProtoPoisoningError('__proto__');
+            // biome-ignore lint/suspicious/noProto: é exatamente a chave própria que está sendo removida.
+            delete obj['__proto__'];
+        }
+        if (Object.hasOwn(obj, 'constructor')) {
+            const ctor = obj['constructor'];
+            if (typeof ctor === 'object' && ctor !== null && Object.hasOwn(ctor, 'prototype')) {
+                if (mode === 'error')
+                    throw new ProtoPoisoningError('constructor.prototype');
+                delete obj['constructor'];
+            }
+        }
+        for (const key of Object.keys(obj))
+            stack.push(obj[key]);
+    }
+}
+//# sourceMappingURL=safe-json.js.map

package/dist/utils/safe-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-json.js","sourceRoot":"","sources":["../../src/utils/safe-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACvB,GAAG;IAAxB,YAAqB,GAAW;QAC9B,KAAK,CAAC,kCAAkC,GAAG,GAAG,CAAC,CAAC;mBAD7B,GAAG;IAExB,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAI,GAAmB,OAAO;IACpE,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpG,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,IAAa,EAAE,IAAoB;IAChD,MAAM,KAAK,GAAc,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;YACjE,8FAA8F;YAC9F,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBAClF,IAAI,IAAI,KAAK,OAAO;oBAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;gBAC7E,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,IAAI,GAAmB,OAAO;IACvE,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,KAAK,GAAc,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;YACjE,8FAA8F;YAC9F,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBAClF,IAAI,IAAI,KAAK,OAAO;oBAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;gBAC7E,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/utils/trace-context.d.ts

@@ -0,0 +1,17 @@
+/** Contexto de trace W3C recebido (`traceparent`/`tracestate`), em `ctx.trace` (F-38). */
+export interface TraceContext {
+    /** 32 caracteres hex. */
+    readonly traceId: string;
+    /** Span de quem chamou: 16 caracteres hex. */
+    readonly parentSpanId: string;
+    /** Flag `sampled` de quem chamou. */
+    readonly sampled: boolean;
+    /** `tracestate` recebido, se válido. */
+    readonly tracestate?: string;
+}
+/**
+ * Valida o `traceparent` pela especificação W3C: versão `ff` é inválida, ids zerados também, e a versão `00`
+ * não admite campos extras (versões futuras admitem). Maiúsculas são rejeitadas, como manda a especificação.
+ */
+export declare function parseTraceparent(traceparent: unknown, tracestate?: unknown): TraceContext | undefined;
+//# sourceMappingURL=trace-context.d.ts.map

package/dist/utils/trace-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-context.d.ts","sourceRoot":"","sources":["../../src/utils/trace-context.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,WAAW,YAAY;IAC3B,yBAAyB;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AASD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAcrG"}

package/dist/utils/trace-context.js

@@ -0,0 +1,30 @@
+// https://www.w3.org/TR/trace-context/#traceparent-header-field-values
+const TRACEPARENT = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})(-.*)?$/;
+const ZERO_TRACE = '0'.repeat(32);
+const ZERO_SPAN = '0'.repeat(16);
+/** Lista de `chave=valor` separados por vírgula, só com ASCII imprimível; até 512 caracteres. */
+const TRACESTATE = /^[\x20-\x7e]{1,512}$/;
+/**
+ * Valida o `traceparent` pela especificação W3C: versão `ff` é inválida, ids zerados também, e a versão `00`
+ * não admite campos extras (versões futuras admitem). Maiúsculas são rejeitadas, como manda a especificação.
+ */
+export function parseTraceparent(traceparent, tracestate) {
+    if (typeof traceparent !== 'string' || traceparent.length > 512)
+        return undefined;
+    const m = TRACEPARENT.exec(traceparent.trim());
+    if (!m)
+        return undefined;
+    const [, version, traceId, parentSpanId, flags, extra] = m;
+    if (version === 'ff' || (version === '00' && extra !== undefined))
+        return undefined;
+    if (traceId === ZERO_TRACE || parentSpanId === ZERO_SPAN)
+        return undefined;
+    const state = typeof tracestate === 'string' && TRACESTATE.test(tracestate) ? tracestate : undefined;
+    return Object.freeze({
+        traceId,
+        parentSpanId,
+        sampled: (Number.parseInt(flags, 16) & 1) === 1,
+        ...(state === undefined ? {} : { tracestate: state }),
+    });
+}
+//# sourceMappingURL=trace-context.js.map

package/dist/utils/trace-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-context.js","sourceRoot":"","sources":["../../src/utils/trace-context.ts"],"names":[],"mappings":"AAYA,uEAAuE;AACvE,MAAM,WAAW,GAAG,mEAAmE,CAAC;AACxF,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAClC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACjC,iGAAiG;AACjG,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAoB,EAAE,UAAoB;IACzE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAClF,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAiE,CAAC;IAC3H,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,IAAI,OAAO,KAAK,UAAU,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,YAAY;QACZ,OAAO,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAC/C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,9 +1,88 @@
 {
   "name": "flowingts",
-  "version": "0.0.0",
-  "description": "Flowing: framework de APIs em TypeScript com decorators, contratos por rota e o básico de produção pronto. Nome reservado; a primeira versão funcional sai em breve.",
-  "license": "MIT",
+  "version": "0.19.0",
+  "description": "Micro-framework HTTP para Node.js com decorators TC39 nativos, schema-first (TypeBox + Ajv) e defaults seguros.",
+  "keywords": [
+    "http",
+    "framework",
+    "decorators",
+    "tc39",
+    "typescript",
+    "typebox",
+    "ajv",
+    "schema",
+    "api",
+    "rest"
+  ],
   "author": "Caio Fernandes",
-  "repository": { "type": "git", "url": "git+https://github.com/code-cfernandes/sashiko.git" },
-  "files": ["README.md"]
-}
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/code-cfernandes/flowing.git"
+  },
+  "homepage": "https://github.com/code-cfernandes/flowing#readme",
+  "bugs": {
+    "url": "https://github.com/code-cfernandes/flowing/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": [
+    "./dist/index.js",
+    "./dist/core/index.js",
+    "./dist/core/app.js",
+    "./dist/shims/*.js"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": "^12.16.1",
+      "onFail": "download"
+    }
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.6.5",
+    "@types/node": "^26.0.0",
+    "@types/qs": "^6.15.1",
+    "qs": "^6.17.1",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2",
+    "zod": "^4.6.7"
+  },
+  "dependencies": {
+    "@fastify/busboy": "^3.2.5",
+    "@sinclair/typebox": "^0.34.52",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
+    "fast-json-stringify": "^7.2.1",
+    "find-my-way": "^9.10.0",
+    "magic-bytes.js": "^1.13.1"
+  },
+  "scripts": {
+    "dev": "tsx watch examples/app-users/server.ts",
+    "example:users": "tsx examples/app-users/server.ts",
+    "test:examples": "node --import tsx --test --test-timeout=20000 --test-reporter=spec 'examples/*/app.test.ts'",
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome lint .",
+    "format": "biome format --write .",
+    "check": "biome check .",
+    "test": "node --import tsx --test --test-timeout=10000 --test-reporter=spec 'test/**/*.test.ts'",
+    "test:watch": "node --import tsx --test --test-timeout=10000 --watch 'test/**/*.test.ts'",
+    "test:coverage": "node --import tsx --test --test-timeout=10000 --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=95 --test-coverage-branches=85 --test-coverage-functions=90 'test/**/*.test.ts'",
+    "clean": "rm -rf dist"
+  }
+}