matrix-nodejs-homeserver 0.3.1 → 0.3.2

package/dist/federation/client.js

@@ -2,6 +2,7 @@ import { canonicalJson } from "../core/json.js";
 import { unpaddedBase64 } from "../core/crypto.js";
 import { M } from "../core/m.js";
 import { MatrixError } from "../core/errors.js";
+import { checkLiteral } from "../core/outbound.js";
 import { sign } from "node:crypto";
 import { resolveSrv } from "node:dns/promises";
 import { Agent, request } from "node:https";
@@ -169,6 +170,11 @@ var FederationClient = class {
 		return null;
 	}
 	raw(target, method, pathWithQuery, body, headers, timeoutMs, poolKey = target.hostHeader) {
+		try {
+			checkLiteral(this.hs.addressPolicy, target.host);
+		} catch (err) {
+			return Promise.reject(err);
+		}
 		return new Promise((resolve, reject) => {
 			let connectTimer = null;
 			const req = request({
@@ -178,6 +184,7 @@ var FederationClient = class {
 				path: pathWithQuery,
 				servername: isIP(target.tlsName) ? void 0 : target.tlsName,
 				agent: this.agentFor(poolKey),
+				lookup: this.hs.addressPolicy.lookup,
 				headers: {
 					host: target.hostHeader,
 					...headers,

package/dist/federation/index.d.ts

@@ -136,7 +136,7 @@ export declare class FederationService {
    */
   backfill(roomId: string, fromEventIds: string[], limit?: number): Promise<number>;
   /** Download remote media (authenticated federation endpoint, falling back to the legacy one). */
-  fetchMedia(server: string, mediaId: string): Promise<{
+  fetchMedia(server: string, mediaId: string, maxBytes: number): Promise<{
     data: Uint8Array;
     contentType: string | null;
     filename: string | null;

package/dist/federation/index.js

@@ -8,6 +8,7 @@ import { authStateFromAuthEvents, checkAuth, getState, membershipOf } from "../c
 import { globMatch } from "../core/glob.js";
 import { resolveState } from "../core/stateres.js";
 import { MissingStateError } from "../core/rooms.js";
+import { publicGet } from "../core/outbound.js";
 import { FederationClient } from "./client.js";
 import { KeyRing } from "./keyring.js";
 import { TransactionSender } from "./sender.js";
@@ -961,13 +962,16 @@ var FederationService = class {
 		return 0;
 	}
 	/** Download remote media (authenticated federation endpoint, falling back to the legacy one). */
-	async fetchMedia(server, mediaId) {
+	async fetchMedia(server, mediaId, maxBytes) {
 		this.requireEnabled();
 		const res = await this.client.requestRaw(server, "GET", `/_matrix/federation/v1/media/download/${encodeURIComponent(mediaId)}`, { timeoutMs: 6e4 });
 		if (res.status === 200) {
 			const ct = String(res.headers["content-type"] ?? "");
 			const m = /boundary=("?)([^";]+)\1/.exec(ct);
-			if (ct.startsWith("multipart/") && m) return parseMultipartMedia(res.body, m[2], this);
+			if (ct.startsWith("multipart/") && m) return parseMultipartMedia(res.body, m[2], {
+				maxBytes,
+				fetch: this.hs.publicFetch
+			});
 		}
 		const legacy = await this.client.requestRaw(server, "GET", `/_matrix/media/v3/download/${encodeURIComponent(server)}/${encodeURIComponent(mediaId)}`, {
 			query: { allow_remote: "false" },
@@ -1020,7 +1024,7 @@ function filenameFromDisposition(header) {
 	return plain ? plain[1] : null;
 }
 /** Parse a federation media multipart/mixed response: a JSON part then the file (or a redirect). */
-async function parseMultipartMedia(body, boundary, fed) {
+async function parseMultipartMedia(body, boundary, limits) {
 	const delimiter = Buffer.from(`--${boundary}`);
 	const parts = [];
 	let idx = body.indexOf(delimiter);
@@ -1041,10 +1045,13 @@ async function parseMultipartMedia(body, boundary, fed) {
 		if (i > 0) headers[line.slice(0, i).trim().toLowerCase()] = line.slice(i + 1).trim();
 	}
 	if (headers.location) {
-		const res = await fetch(headers.location, { signal: AbortSignal.timeout(6e4) });
-		if (!res.ok) throw errors.notFound("Remote media redirect failed");
+		const res = await publicGet(limits.fetch, headers.location, {
+			maxBytes: limits.maxBytes,
+			timeoutMs: 6e4
+		});
+		if (res.status !== 200) throw errors.notFound("Remote media redirect failed");
 		return {
-			data: new Uint8Array(await res.arrayBuffer()),
+			data: new Uint8Array(res.body),
 			contentType: res.headers.get("content-type"),
 			filename: filenameFromDisposition(res.headers.get("content-disposition") ?? void 0)
 		};

package/dist/homeserver.d.ts

@@ -6,10 +6,10 @@ import { IdentityServers } from "./core/identity.js";
 import { M } from "./core/m.js";
 import { AppServiceRegistration, AppServiceService } from "./core/appservices.js";
 import { AuthService } from "./core/auth.js";
+import { DatabaseAdapter } from "./storage/types.js";
 import { KeyService } from "./core/keys.js";
 import { ClusterAdapter, StreamManager } from "./core/cluster.js";
 import { Notifier } from "./core/notifier.js";
-import { DatabaseAdapter } from "./storage/types.js";
 import { RoomService } from "./core/rooms.js";
 import { TypingService } from "./core/typing.js";
 import { PushService } from "./core/push.js";
@@ -26,6 +26,7 @@ import { SettingsService } from "./core/settings.js";
 import { AdminRoomOptions, AdminRoomService } from "./core/adminroom.js";
 import { ResolvedUserAuth, UserAuthAdapter } from "./adapters/auth.js";
 import { MediaAdapter, Thumbnailer } from "./adapters/media.js";
+import { AddressPolicy } from "./core/outbound.js";
 import { EventEmitter } from "node:events";
 //#region src/homeserver.d.ts
 export interface Logger {
@@ -82,6 +83,11 @@ export interface HomeserverOptions {
   accessTokenLifetimeMs?: number;
   /** Maximum `/sync` long-poll duration in ms. Default: 30000. */
   maxSyncTimeoutMs?: number;
+  /**
+   * How many `/sync` responses one process builds at once (default 4). Requests woken together
+   * wait in the process instead of queueing their database reads ahead of everything else.
+   */
+  maxConcurrentSyncs?: number;
   /**
    * Enables `/preview_url`. Off by default because it makes the server fetch arbitrary URLs.
    * Private/internal addresses stay blocked unless `allowPrivateAddresses` is set.
@@ -92,6 +98,13 @@ export interface HomeserverOptions {
   logger?: Logger;
   /** Custom `fetch` for outgoing HTTP requests. */
   fetch?: typeof globalThis.fetch;
+  /**
+   * Let requests to addresses that users or remote servers choose (federation, push gateways,
+   * identity servers, URL previews, remote media) reach private addresses: localhost, LAN and
+   * other non-public ranges. `true` allows all of them, a list allows those ranges only (e.g.
+   * `["127.0.0.1/32"]` for a push gateway on the same machine). Default: none.
+   */
+  allowPrivateAddresses?: boolean | string[];
   /**
    * Rate limiting. `false` disables it; otherwise per-action overrides and an optional
    * shared limiter (defaults to an in-memory token bucket). Admins are never limited.
@@ -102,7 +115,7 @@ export interface HomeserverOptions {
   sso?: SsoOptions;
   /**
    * Coordination between instances. The default (`localCluster()`) supports one process;
-   * use `postgresCluster()` / `redisCluster()` to scale horizontally.
+   * use `postgresCluster()` to scale horizontally.
    */
   cluster?: ClusterAdapter;
   /**
@@ -151,6 +164,7 @@ export interface ResolvedConfig {
   defaultRoomVersion: string;
   accessTokenLifetimeMs: number | null;
   maxSyncTimeoutMs: number;
+  maxConcurrentSyncs: number;
   urlPreviews: {
     allowPrivateAddresses: boolean;
   } | null;
@@ -189,8 +203,12 @@ export declare class Homeserver extends EventEmitter {
   readonly policyServers: PolicyServers;
   readonly threepids: ThreepidService;
   readonly identityServers: IdentityServers;
-  /** `fetch` used for outgoing requests (push gateways, URL previews, OAuth). Overridable for testing. */
+  /** `fetch` for requests to addresses the operator configured (OAuth, SSO, application services). */
   readonly fetch: typeof globalThis.fetch;
+  /** Which addresses requests to user- or remote-chosen destinations may reach (see `allowPrivateAddresses`). */
+  readonly addressPolicy: AddressPolicy;
+  /** `fetch` for user- or remote-chosen URLs: refuses private addresses unless allowed, never follows redirects. */
+  readonly publicFetch: typeof globalThis.fetch;
   /** Resolves once storage is migrated and the server is ready to serve requests. */
   readonly ready: Promise<void>;
   private _signingKey;

package/dist/homeserver.js

@@ -3,6 +3,7 @@ import "./core/m.js";
 import { SUPPORTED_ROOM_VERSIONS } from "./core/events.js";
 import { PartialStateService } from "./core/partialstate.js";
 import { RoomService } from "./core/rooms.js";
+import { addressPolicy, policyFetch } from "./core/outbound.js";
 import { FederationService } from "./federation/index.js";
 import { PolicyServers } from "./core/policy.js";
 import { ThreepidService } from "./core/threepid.js";
@@ -13,9 +14,9 @@ import { Notifier } from "./core/notifier.js";
 import { StreamManager, localCluster, newInstanceId } from "./core/cluster.js";
 import { TypingService } from "./core/typing.js";
 import { PushService } from "./core/push.js";
+import { SsoService } from "./core/sso.js";
 import { AdminService } from "./core/admin.js";
 import { OAuthDelegation } from "./core/oauth.js";
-import { SsoService } from "./core/sso.js";
 import { DelayedEventService } from "./core/delayed.js";
 import { AuditService } from "./core/audit.js";
 import { SettingsService } from "./core/settings.js";
@@ -78,8 +79,12 @@ var Homeserver = class extends EventEmitter {
 	policyServers;
 	threepids;
 	identityServers;
-	/** `fetch` used for outgoing requests (push gateways, URL previews, OAuth). Overridable for testing. */
+	/** `fetch` for requests to addresses the operator configured (OAuth, SSO, application services). */
 	fetch;
+	/** Which addresses requests to user- or remote-chosen destinations may reach (see `allowPrivateAddresses`). */
+	addressPolicy;
+	/** `fetch` for user- or remote-chosen URLs: refuses private addresses unless allowed, never follows redirects. */
+	publicFetch;
 	/** Resolves once storage is migrated and the server is ready to serve requests. */
 	ready;
 	_signingKey = null;
@@ -109,6 +114,7 @@ var Homeserver = class extends EventEmitter {
 			defaultRoomVersion,
 			accessTokenLifetimeMs: options.accessTokenLifetimeMs ?? null,
 			maxSyncTimeoutMs: options.maxSyncTimeoutMs ?? 3e4,
+			maxConcurrentSyncs: Math.max(1, options.maxConcurrentSyncs ?? 4),
 			urlPreviews: options.urlPreviews ? { allowPrivateAddresses: typeof options.urlPreviews === "object" && !!options.urlPreviews.allowPrivateAddresses } : null,
 			thumbnailer: options.thumbnailer ?? null,
 			rtc: options.rtc ?? {},
@@ -138,6 +144,9 @@ var Homeserver = class extends EventEmitter {
 		this.push = new PushService(this);
 		this.admin = new AdminService(this);
 		this.oauth = options.oauth ? new OAuthDelegation(this, options.oauth) : null;
+		this.fetch = options.fetch ?? globalThis.fetch;
+		this.addressPolicy = addressPolicy(options.allowPrivateAddresses);
+		this.publicFetch = policyFetch(this.addressPolicy, options.fetch);
 		this.federation = new FederationService(this, options.federation);
 		this.delayedEvents = new DelayedEventService(this, options.delayedEvents);
 		this.audit = new AuditService(this, options.audit);
@@ -157,7 +166,6 @@ var Homeserver = class extends EventEmitter {
 			this.cleanupTimer = setInterval(() => void this.cleanup().catch((err) => this.logger.warn("Cleanup failed", err)), cleanupEvery);
 			this.cleanupTimer.unref?.();
 		}
-		this.fetch = options.fetch ?? globalThis.fetch;
 		registerRoutes(this.router);
 		this.ready = this.init(options);
 		this.ready.catch((err) => this.logger.error("Homeserver failed to start", err));

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { ThreepidEmail, ThreepidOptions, ThreepidPurpose, ThreepidSms } from "./core/threepid.js";
 import { M, UNSTABLE } from "./core/m.js";
 import { AppServiceRegistration, loadAppServiceRegistrations, parseAppServiceRegistration } from "./core/appservices.js";
-import { ClusterAdapter, localCluster } from "./core/cluster.js";
 import { DatabaseAdapter, FieldDef, FindManyOptions, ModelDef, Operator, Row, Schema, WhereClause } from "./storage/types.js";
+import { ClusterAdapter, localCluster } from "./core/cluster.js";
 import { AdminService, ServerNoticesOptions } from "./core/admin.js";
 import { OAuthDelegationOptions } from "./core/oauth.js";
 import { SsoOptions, SsoProvider } from "./core/sso.js";
@@ -22,5 +22,5 @@ import { memoryAdapter } from "./storage/memory.js";
 import { MysqlPoolLike, PgPoolLike, SqlAdapterOptions, SqlDialect, SqlExecutor, SqliteDatabaseLike, mysqlAdapter, postgresAdapter, sqlAdapter, sqliteAdapter } from "./storage/sql.js";
 import { schema } from "./storage/schema.js";
 import { S3MediaOptions, s3Media } from "./adapters/s3.js";
-import { PgClusterPoolLike, RedisLike, RedisSubscriberLike, postgresCluster, redisCluster } from "./adapters/cluster.js";
-export { type AdminRoomOptions, type AdminService, type AppServiceRegistration, type AuditAction, type AuditEntry, type AuditOptions, type ClusterAdapter, type DatabaseAdapter, type DelayedEventsOptions, type FederationOptions, type FieldDef, type FindManyOptions, Homeserver, type HomeserverOptions, type Logger, M, MatrixError, type MediaAdapter, type MediaMetadata, type ModelDef, type MysqlPoolLike, type NodeHandler, type OAuthDelegationOptions, type Operator, type PasswordCheckContext, type PgClusterPoolLike, type PgPoolLike, type RateLimitAction, type RateLimitRule, type RateLimiter, type RedisLike, type RedisSubscriberLike, type Row, type RtcOptions, type S3MediaOptions, type Schema, type ServerNoticesOptions, type SqlAdapterOptions, type SqlDialect, type SqlExecutor, type SqliteDatabaseLike, type SsoOptions, type SsoProvider, type ThreepidEmail, type ThreepidOptions, type ThreepidPurpose, type ThreepidSms, type ThumbnailRequest, type Thumbnailer, type TurnOptions, UNSTABLE, type UserAuthAdapter, type WhereClause, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, redisCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };
+import { PgClusterPoolLike, postgresCluster } from "./adapters/cluster.js";
+export { type AdminRoomOptions, type AdminService, type AppServiceRegistration, type AuditAction, type AuditEntry, type AuditOptions, type ClusterAdapter, type DatabaseAdapter, type DelayedEventsOptions, type FederationOptions, type FieldDef, type FindManyOptions, Homeserver, type HomeserverOptions, type Logger, M, MatrixError, type MediaAdapter, type MediaMetadata, type ModelDef, type MysqlPoolLike, type NodeHandler, type OAuthDelegationOptions, type Operator, type PasswordCheckContext, type PgClusterPoolLike, type PgPoolLike, type RateLimitAction, type RateLimitRule, type RateLimiter, type Row, type RtcOptions, type S3MediaOptions, type Schema, type ServerNoticesOptions, type SqlAdapterOptions, type SqlDialect, type SqlExecutor, type SqliteDatabaseLike, type SsoOptions, type SsoProvider, type ThreepidEmail, type ThreepidOptions, type ThreepidPurpose, type ThreepidSms, type ThumbnailRequest, type Thumbnailer, type TurnOptions, UNSTABLE, type UserAuthAdapter, type WhereClause, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };

package/dist/index.js

@@ -11,5 +11,5 @@ import { Homeserver, createHomeserver } from "./homeserver.js";
 import { getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, isMatrixPath } from "./http/adapters.js";
 import { mysqlAdapter, postgresAdapter, sqlAdapter, sqliteAdapter } from "./storage/sql.js";
 import { s3Media } from "./adapters/s3.js";
-import { postgresCluster, redisCluster } from "./adapters/cluster.js";
-export { Homeserver, M, MatrixError, UNSTABLE, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, redisCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };
+import { postgresCluster } from "./adapters/cluster.js";
+export { Homeserver, M, MatrixError, UNSTABLE, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };

package/dist/storage/batch.js

@@ -0,0 +1,11 @@
+//#region src/storage/batch.ts
+/**
+* Run independent reads together: in one round trip when the adapter can (`findManyBatch`),
+* otherwise concurrently. Results come in the order of the queries.
+*/
+function readBatch(db, queries) {
+	if (db.findManyBatch) return db.findManyBatch(queries);
+	return Promise.all(queries.map((query) => db.findMany(query.model, query.opts)));
+}
+//#endregion
+export { readBatch };

package/dist/storage/memory.js

@@ -72,6 +72,7 @@ function memoryAdapter() {
 					rows.sort((a, b) => a[field] < b[field] ? -dir : a[field] > b[field] ? dir : 0);
 				}
 				if (opts.limit !== void 0) rows = rows.slice(0, opts.limit);
+				if (opts.fields?.length) return rows.map((r) => Object.fromEntries(opts.fields.map((f) => [f, structuredClone(r[f] ?? null)])));
 				return rows.map((r) => structuredClone(r));
 			},
 			async update(model, where, data) {

package/dist/storage/schema.js

@@ -249,7 +249,7 @@ const schema = {
 			forgotten: b
 		},
 		primaryKey: ["room_id", "user_id"],
-		indexes: [["user_id"]]
+		indexes: [["user_id"], ["stream"]]
 	},
 	room_aliases: {
 		fields: {

package/dist/storage/sql.js

@@ -130,11 +130,30 @@ function sqlAdapter({ dialect, executor: rootExecutor, tablePrefix = "", transac
 			},
 			async findMany(model, opts = {}) {
 				const params = [];
-				let sql = `SELECT * FROM ${t(model)}${buildWhere(model, opts.where, params)}`;
+				let sql = `SELECT ${opts.fields?.length ? opts.fields.map(q).join(", ") : "*"} FROM ${t(model)}${buildWhere(model, opts.where, params)}`;
 				if (opts.sortBy) sql += ` ORDER BY ${q(opts.sortBy.field)} ${opts.sortBy.direction === "asc" ? "ASC" : "DESC"}`;
 				if (opts.limit !== void 0) sql += ` LIMIT ${Math.max(0, Math.floor(opts.limit))}`;
 				return (await executor.query(sql, params)).map((r) => fromDb(model, r));
 			},
+			...dialect === "postgres" ? { async findManyBatch(queries) {
+				if (queries.length === 0) return [];
+				const params = [];
+				const parts = queries.map(({ model, opts = {} }, i) => {
+					const fields = opts.fields?.length && opts.sortBy && !opts.fields.includes(opts.sortBy.field) ? [...opts.fields, opts.sortBy.field] : opts.fields;
+					let inner = `SELECT ${fields?.length ? fields.map(q).join(", ") : "*"} FROM ${t(model)}${buildWhere(model, opts.where, params)}`;
+					const order = opts.sortBy ? `${q(opts.sortBy.field)} ${opts.sortBy.direction === "asc" ? "ASC" : "DESC"}` : "";
+					if (order) inner += ` ORDER BY ${order}`;
+					if (opts.limit !== void 0) inner += ` LIMIT ${Math.max(0, Math.floor(opts.limit))}`;
+					return `SELECT ${i} AS i, row_number() OVER (${order ? `ORDER BY ${order.replace(/^"/, "b.\"")}` : ""}) AS n, to_jsonb(b) AS r FROM (${inner}) b`;
+				});
+				const rows = await executor.query(`${parts.join(" UNION ALL ")} ORDER BY i, n`, params);
+				const out = queries.map(() => []);
+				for (const row of rows) {
+					const r = typeof row.r === "string" ? JSON.parse(row.r) : row.r;
+					out[Number(row.i)].push(fromDb(queries[Number(row.i)].model, r));
+				}
+				return out;
+			} } : {},
 			async update(model, where, data) {
 				const fields = Object.keys(data).filter((k) => data[k] !== void 0);
 				if (fields.length === 0) return 0;

package/dist/storage/types.d.ts

@@ -21,8 +21,18 @@ export interface WhereClause {
   operator?: Operator;
 }
 export type Row = Record<string, any>;
+/** One read of a `findManyBatch`. */
+export interface BatchQuery {
+  model: string;
+  opts?: FindManyOptions;
+}
 export interface FindManyOptions {
   where?: WhereClause[];
+  /**
+   * Only these fields are needed. Adapters should read just these (a smaller query and less to
+   * parse); one that ignores the option and returns whole rows is still correct.
+   */
+  fields?: string[];
   sortBy?: {
     field: string;
     direction: "asc" | "desc";
@@ -35,6 +45,12 @@ export interface FindManyOptions {
  * All `where` clauses are combined with AND.
  */
 export interface DatabaseAdapter {
+  /**
+   * Several independent reads in one go: the results in the same order as the queries. Optional;
+   * an adapter that talks to a database server can send them in one round trip. Without it,
+   * callers run the reads separately (see `readBatch`).
+   */
+  findManyBatch?(queries: BatchQuery[]): Promise<Row[][]>;
   /** Create tables / collections for the given schema. Must be idempotent. */
   migrate?(schema: Schema): Promise<void>;
   create(model: string, data: Row): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "matrix-nodejs-homeserver",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "A framework- and database-agnostic Matrix homeserver library for Node.js",
   "keywords": [
     "chat",
@@ -41,10 +41,12 @@
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test \"test/**/*.test.ts\"",
     "lint": "oxlint",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",
     "build": "tsdown",
+    "check:package": "publint && attw --pack . --profile esm-only",
     "prepare": "npm run build",
     "start:example": "node examples/node-http.ts",
     "start:multi-node-example": "node examples/multi-node.ts",
@@ -53,15 +55,17 @@
     "release": "changeset publish"
   },
   "devDependencies": {
+    "@arethetypeswrong/cli": "^0.18.5",
     "@changesets/cli": "^3.0.3",
     "@types/node": "^26.6.5",
     "oxfmt": "^0.73.0",
     "oxlint": "^1.88.0",
+    "publint": "^0.3.25",
     "tsdown": "^0.23.1",
     "typescript": "7.0.2",
     "zod": "^4.6.7"
   },
   "engines": {
-    "node": ">=26"
+    "node": ">=22"
   }
 }