pakstr 0.19.2 → 0.19.3

package/android-template/app/src/androidTest/java/com/pakstr/app/Nip98ProxyOriginTest.kt

@@ -0,0 +1,208 @@
+package com.pakstr.app
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.net.URL
+import java.util.Base64
+
+class Nip98ProxyOriginTest {
+
+    private val localUrl = URL("http://127.0.0.1:${Config.PORT}/api/auth/login")
+
+    @Test
+    fun validLocalNip98EventGeneratesForwardingOrigin() {
+        assertEquals(
+            ProxyOrigin("127.0.0.1:${Config.PORT}", "http"),
+            localNip98ProxyOrigin(nip98Header(), "POST", localUrl)
+        )
+    }
+
+    @Test
+    fun bodylessNip98RequestAddsOriginWithoutEntityHeadersOrBody() {
+        val authorization = nip98Header()
+        val headers = prepareProxyRequestHeaders(
+            mapOf(
+                "authorization" to authorization,
+                "content-type" to "",
+                "content-length" to "0",
+                "transfer-encoding" to "chunked"
+            ),
+            "POST",
+            localUrl,
+            "https://api.example.com"
+        )
+        val request = bodylessProxyRequestBytes(
+            "POST",
+            URL("https://api.example.com/api/auth/login"),
+            headers
+        ).toString(Charsets.ISO_8859_1)
+
+        assertTrue(request.contains("authorization: $authorization\r\n"))
+        assertTrue(request.contains("X-Forwarded-Host: 127.0.0.1:${Config.PORT}\r\n"))
+        assertTrue(request.contains("X-Forwarded-Proto: http\r\n"))
+        assertFalse(request.contains("Content-Type", ignoreCase = true))
+        assertFalse(request.contains("Content-Length", ignoreCase = true))
+        assertFalse(request.contains("Transfer-Encoding", ignoreCase = true))
+        assertTrue(request.endsWith("Connection: close\r\n\r\n"))
+    }
+
+    @Test
+    fun bodyBearingNip98RequestAddsOriginAndPreservesBodyHeaders() {
+        val authorization = nip98Header()
+        val headers = prepareProxyRequestHeaders(
+            mapOf(
+                "authorization" to authorization,
+                "content-type" to "application/json",
+                "content-length" to "11"
+            ),
+            "POST",
+            localUrl,
+            "https://api.example.com"
+        )
+        val policy = proxyRequestBodyPolicy(
+            mapOf(
+                "content-type" to "application/json",
+                "content-length" to "11"
+            )
+        )
+
+        assertEquals(authorization, headers["authorization"])
+        assertEquals("application/json", headers["content-type"])
+        assertEquals("127.0.0.1:${Config.PORT}", headers["X-Forwarded-Host"])
+        assertEquals("http", headers["X-Forwarded-Proto"])
+        assertTrue(policy.shouldWriteBody)
+        assertEquals("application/json", policy.contentType)
+    }
+
+    @Test
+    fun noAuthorizationIsUnchanged() {
+        val input = mapOf("accept" to "application/json")
+
+        assertEquals(
+            input,
+            prepareProxyRequestHeaders(input, "GET", localUrl, "https://api.example.com")
+        )
+    }
+
+    @Test
+    fun bearerAuthorizationIsUnchanged() {
+        val input = mapOf("authorization" to "Bearer token")
+
+        assertEquals(
+            input,
+            prepareProxyRequestHeaders(input, "POST", localUrl, "https://api.example.com")
+        )
+    }
+
+    @Test
+    fun malformedNostrAuthorizationFailsClosed() {
+        assertNull(localNip98ProxyOrigin("Nostr not-base64", "POST", localUrl))
+        assertNull(localNip98ProxyOrigin("Nostr e30=", "POST", localUrl))
+    }
+
+    @Test
+    fun wrongKindFailsClosed() {
+        assertNull(localNip98ProxyOrigin(nip98Header(kind = 1), "POST", localUrl))
+    }
+
+    @Test
+    fun wrongMethodFailsClosed() {
+        assertNull(localNip98ProxyOrigin(nip98Header(method = "GET"), "POST", localUrl))
+    }
+
+    @Test
+    fun wrongPathFailsClosed() {
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(url = "http://127.0.0.1:${Config.PORT}/api/other"),
+            "POST",
+            localUrl
+        ))
+    }
+
+    @Test
+    fun wrongQueryFailsClosed() {
+        val requestUrl = URL("http://127.0.0.1:${Config.PORT}/api/auth/login?next=one")
+
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(url = "http://127.0.0.1:${Config.PORT}/api/auth/login?next=two"),
+            "POST",
+            requestUrl
+        ))
+    }
+
+    @Test
+    fun nonLocalHostFailsClosed() {
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(url = "http://localhost:${Config.PORT}/api/auth/login"),
+            "POST",
+            localUrl
+        ))
+    }
+
+    @Test
+    fun upstreamUrlFailsClosed() {
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(url = "https://api.example.com/api/auth/login"),
+            "POST",
+            localUrl
+        ))
+    }
+
+    @Test
+    fun ambiguousOrUnusableTagsFailClosed() {
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(extraTags = ",[\"u\",\"http://127.0.0.1:${Config.PORT}/api/auth/login\"]"),
+            "POST",
+            localUrl
+        ))
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(extraTags = ",[\"method\",\"POST\"]"),
+            "POST",
+            localUrl
+        ))
+        assertNull(localNip98ProxyOrigin(nip98Header(url = ""), "POST", localUrl))
+        assertNull(localNip98ProxyOrigin(nip98Header(method = ""), "POST", localUrl))
+    }
+
+    @Test
+    fun spoofedForwardingHeadersCannotOverrideDerivedValues() {
+        val headers = prepareProxyRequestHeaders(
+            mapOf(
+                "authorization" to nip98Header(),
+                "Forwarded" to "host=attacker.example;proto=https",
+                "X-Forwarded-Host" to "attacker.example",
+                "X-Forwarded-Proto" to "https"
+            ),
+            "POST",
+            localUrl,
+            "https://api.example.com"
+        )
+
+        assertFalse(headers.keys.any { it.equals("Forwarded", ignoreCase = true) })
+        assertEquals("127.0.0.1:${Config.PORT}", headers["X-Forwarded-Host"])
+        assertEquals("http", headers["X-Forwarded-Proto"])
+    }
+
+    @Test
+    fun missingApiBaseReturnsExistingHeadersUnchanged() {
+        val input = mapOf(
+            "authorization" to nip98Header(),
+            "X-Forwarded-Host" to "caller.example"
+        )
+
+        assertEquals(input, prepareProxyRequestHeaders(input, "POST", localUrl, null))
+    }
+
+    private fun nip98Header(
+        kind: Int = 27235,
+        url: String = localUrl.toString(),
+        method: String = "POST",
+        extraTags: String = ""
+    ): String {
+        val event = """{"kind":$kind,"tags":[["u","$url"],["method","$method"]$extraTags]}"""
+        return "Nostr ${Base64.getEncoder().encodeToString(event.toByteArray())}"
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/LocalServer.kt

@@ -6,10 +6,219 @@ import android.webkit.MimeTypeMap
 import com.pakstr.app.debug.AppDebugLogger
 
 import fi.iki.elonen.NanoHTTPD
+import java.io.BufferedInputStream
+import java.io.ByteArrayOutputStream
 import java.io.IOException
 import java.net.HttpURLConnection
+import java.net.InetSocketAddress
+import java.net.Socket
 import java.net.URL
+import java.nio.charset.StandardCharsets
 import java.util.Locale
+import javax.net.ssl.HttpsURLConnection
+import javax.net.ssl.SSLSocketFactory
+
+internal data class ProxyRequestBodyPolicy(
+    val shouldWriteBody: Boolean,
+    val contentType: String?
+)
+
+internal class InvalidContentLengthException : IllegalArgumentException()
+
+internal class UnsupportedTransferEncodingException : IllegalArgumentException()
+
+internal fun proxyRequestBodyPolicy(
+    headers: Map<String, String>
+): ProxyRequestBodyPolicy {
+    if (headers.containsKey("transfer-encoding")) {
+        throw UnsupportedTransferEncodingException()
+    }
+
+    val contentLengthHeader = headers["content-length"]
+    val contentLength = when {
+        contentLengthHeader == null -> 0L
+        !contentLengthHeader.matches(Regex("[0-9]+")) -> {
+            throw InvalidContentLengthException()
+        }
+        else -> contentLengthHeader.toLongOrNull()
+            ?: throw InvalidContentLengthException()
+    }
+
+    return ProxyRequestBodyPolicy(
+        shouldWriteBody = contentLength > 0,
+        contentType = headers["content-type"]
+    )
+}
+
+internal fun shouldForwardProxyRequestHeader(
+    name: String
+): Boolean = name.lowercase() !in setOf(
+    "host",
+    "content-length",
+    "connection",
+    "accept-encoding",
+    "transfer-encoding",
+    "forwarded",
+    "x-forwarded-host",
+    "x-forwarded-proto"
+)
+
+internal data class ProxyHttpResponse(
+    val code: Int,
+    val contentType: String?,
+    val body: ByteArray
+)
+
+internal fun bodylessProxyRequestBytes(
+    method: String,
+    url: URL,
+    headers: Map<String, String>
+): ByteArray {
+    val defaultPort = if (url.protocol == "https") 443 else 80
+    val hostHeader = if (url.port == -1 || url.port == defaultPort) {
+        url.host
+    } else {
+        "${url.host}:${url.port}"
+    }
+    val path = buildString {
+        append(url.path.ifEmpty { "/" })
+        url.query?.let {
+            append('?')
+            append(it)
+        }
+    }
+
+    return buildString {
+        append("$method $path HTTP/1.1\r\n")
+        append("Host: $hostHeader\r\n")
+        headers.forEach { (name, value) ->
+            if (shouldForwardProxyRequestHeader(name) &&
+                !name.equals("content-type", ignoreCase = true)
+            ) {
+                append("$name: $value\r\n")
+            }
+        }
+        append("Connection: close\r\n\r\n")
+    }.toByteArray(StandardCharsets.ISO_8859_1)
+}
+
+internal fun executeBodylessProxyRequest(
+    method: String,
+    url: URL,
+    headers: Map<String, String>
+): ProxyHttpResponse {
+    val port = when {
+        url.port != -1 -> url.port
+        url.protocol == "https" -> 443
+        else -> 80
+    }
+    if (url.protocol != "http" && url.protocol != "https") {
+        throw IOException("Unsupported API URL protocol: ${url.protocol}")
+    }
+
+    val transport = Socket().apply {
+        connect(InetSocketAddress(url.host, port), 15000)
+        soTimeout = 30000
+    }
+    val socket = if (url.protocol == "https") {
+        (SSLSocketFactory.getDefault() as SSLSocketFactory).createSocket(
+            transport,
+            url.host,
+            port,
+            true
+        )
+    } else {
+        transport
+    }
+
+    socket.use {
+        if (url.protocol == "https") {
+            val sslSocket = it as javax.net.ssl.SSLSocket
+            sslSocket.startHandshake()
+            if (!HttpsURLConnection.getDefaultHostnameVerifier()
+                    .verify(url.host, sslSocket.session)
+            ) {
+                throw IOException("Hostname verification failed for ${url.host}")
+            }
+        }
+
+        it.getOutputStream().apply {
+            write(bodylessProxyRequestBytes(method, url, headers))
+            flush()
+        }
+
+        return readProxyHttpResponse(BufferedInputStream(it.getInputStream()))
+    }
+}
+
+private fun readProxyHttpResponse(input: BufferedInputStream): ProxyHttpResponse {
+    val statusLine = readHttpLine(input)
+    val code = statusLine.split(' ', limit = 3).getOrNull(1)?.toIntOrNull()
+        ?: throw IOException("Invalid HTTP status line")
+    val headers = mutableMapOf<String, String>()
+
+    while (true) {
+        val line = readHttpLine(input)
+        if (line.isEmpty()) break
+        val separator = line.indexOf(':')
+        if (separator <= 0) throw IOException("Invalid HTTP response header")
+        headers[line.substring(0, separator).lowercase()] =
+            line.substring(separator + 1).trim()
+    }
+
+    val body = when {
+        headers["transfer-encoding"]?.equals("chunked", ignoreCase = true) == true -> {
+            readChunkedBody(input)
+        }
+        headers["content-length"] != null -> {
+            readFixedLengthBody(input, headers.getValue("content-length").toLong())
+        }
+        else -> input.readBytes()
+    }
+
+    return ProxyHttpResponse(code, headers["content-type"], body)
+}
+
+private fun readHttpLine(input: BufferedInputStream): String {
+    val bytes = ByteArrayOutputStream()
+    while (true) {
+        val value = input.read()
+        if (value == -1) throw IOException("Unexpected end of HTTP response")
+        if (value == '\r'.code) {
+            if (input.read() != '\n'.code) throw IOException("Invalid HTTP line ending")
+            return bytes.toString(StandardCharsets.ISO_8859_1.name())
+        }
+        bytes.write(value)
+    }
+}
+
+private fun readChunkedBody(input: BufferedInputStream): ByteArray {
+    val body = ByteArrayOutputStream()
+    while (true) {
+        val size = readHttpLine(input).substringBefore(';').trim().toLong(16)
+        if (size == 0L) {
+            while (readHttpLine(input).isNotEmpty()) Unit
+            return body.toByteArray()
+        }
+        body.write(readFixedLengthBody(input, size))
+        if (readHttpLine(input).isNotEmpty()) throw IOException("Invalid chunk ending")
+    }
+}
+
+private fun readFixedLengthBody(
+    input: BufferedInputStream,
+    length: Long
+): ByteArray {
+    if (length > Int.MAX_VALUE) throw IOException("HTTP response body too large")
+    val body = ByteArray(length.toInt())
+    var offset = 0
+    while (offset < body.size) {
+        val read = input.read(body, offset, body.size - offset)
+        if (read == -1) throw IOException("Unexpected end of HTTP response body")
+        offset += read
+    }
+    return body
+}
 
 class LocalServer(
 
@@ -182,13 +391,51 @@ class LocalServer(
             }
 
             val finalUrl = apiBase.removeSuffix("/") + uri
+            val url = URL(finalUrl)
+            val method = session?.method?.name ?: "GET"
+            val requestHeaders = session?.headers ?: emptyMap()
+            val query = session?.queryParameterString
+            val localRequestUrl = URL(
+                "http://127.0.0.1:${Config.PORT}$uri" +
+                        if (query.isNullOrEmpty()) "" else "?$query"
+            )
+            val preparedHeaders = prepareProxyRequestHeaders(
+                headers = requestHeaders,
+                method = method,
+                requestUrl = localRequestUrl,
+                apiBase = apiBase
+            )
+            val bodyPolicy = if (
+                method == "POST" || method == "PUT" || method == "PATCH"
+            ) {
+                proxyRequestBodyPolicy(requestHeaders)
+            } else {
+                null
+            }
 
-            val connection = URL(finalUrl).openConnection() as HttpURLConnection
+            if (bodyPolicy?.shouldWriteBody == false) {
+                val response = executeBodylessProxyRequest(
+                    method,
+                    url,
+                    preparedHeaders
+                )
+                if (AppDebugLogger.isNetworkLoggingEnabled(context)) {
+                    AppDebugLogger.network(
+                        context,
+                        "Response: ${response.code} $finalUrl"
+                    )
+                }
+                return newFixedLengthResponse(
+                    Response.Status.lookup(response.code) ?: Response.Status.OK,
+                    response.contentType ?: "application/json",
+                    response.body.inputStream(),
+                    response.body.size.toLong()
+                )
+            }
+
+            val connection = url.openConnection() as HttpURLConnection
             connection.doInput = true
             connection.instanceFollowRedirects = false
-
-            val method = session?.method?.name ?: "GET"
-
             connection.requestMethod = method
 
             connection.connectTimeout = 15000
@@ -198,30 +445,14 @@ class LocalServer(
              * Forward headers
              */
 
-            session?.headers?.forEach { (key, value) ->
-
-                val skip = setOf(
-                    "host", "content-length", "connection", "accept-encoding"
+            preparedHeaders.forEach { (key, value) ->
+                connection.setRequestProperty(
+                    key, value
                 )
-
-
-                if (!skip.contains(key.lowercase())) {
-
-                    connection.setRequestProperty(
-                        key, value
-                    )
-                }
             }
-            session?.headers?.get("authorization")
-                ?.let { auth ->
-                    connection.setRequestProperty(
-                        "Authorization", auth
-                    )
-                }
-
 
-            if (method == "POST" || method == "PUT" || method == "PATCH") {
 
+            if (bodyPolicy?.shouldWriteBody == true) {
                 val files = HashMap<String, String>()
 
                 session?.parseBody(files)
@@ -231,7 +462,7 @@ class LocalServer(
                 val bytes = body.toByteArray(Charsets.UTF_8)
 
                 connection.doOutput = true
-                session?.headers?.get("content-type")
+                bodyPolicy.contentType
                     ?.let {
                         connection.setRequestProperty(
                             "Content-Type", it
@@ -280,6 +511,18 @@ class LocalServer(
 
             )
 
+        } catch (e: InvalidContentLengthException) {
+            return newFixedLengthResponse(
+                Response.Status.BAD_REQUEST,
+                "application/json",
+                """{"error":"invalid_content_length"}"""
+            )
+        } catch (e: UnsupportedTransferEncodingException) {
+            return newFixedLengthResponse(
+                Response.Status.BAD_REQUEST,
+                "application/json",
+                """{"error":"unsupported_transfer_encoding"}"""
+            )
         } catch (e: Exception) {
             AppDebugLogger.error(
 

package/android-template/app/src/main/java/com/pakstr/app/Nip98ProxyOrigin.kt

@@ -0,0 +1,90 @@
+package com.pakstr.app
+
+import org.json.JSONArray
+import org.json.JSONObject
+import java.net.URL
+import java.util.Base64
+
+internal data class ProxyOrigin(
+    val host: String,
+    val proto: String
+)
+
+internal fun localNip98ProxyOrigin(
+    authorization: String?,
+    method: String,
+    requestUrl: URL
+): ProxyOrigin? {
+    val encodedEvent = authorization
+        ?.takeIf { it.startsWith("Nostr ") }
+        ?.removePrefix("Nostr ")
+        ?.takeIf { it.isNotBlank() }
+        ?: return null
+
+    return runCatching {
+        val event = JSONObject(
+            String(Base64.getDecoder().decode(encodedEvent), Charsets.UTF_8)
+        )
+        val kind = event.opt("kind")
+        if (kind !is Number || kind.toInt() != 27235 || kind.toDouble() != 27235.0) {
+            return null
+        }
+
+        val tags = event.optJSONArray("tags") ?: return null
+        val signedUrlValue = uniqueUsableTagValue(tags, "u") ?: return null
+        val signedMethod = uniqueUsableTagValue(tags, "method") ?: return null
+        if (!signedMethod.equals(method, ignoreCase = true)) return null
+
+        val signedUrl = URL(signedUrlValue)
+        if (signedUrl.protocol != "http" ||
+            signedUrl.host != "127.0.0.1" ||
+            signedUrl.port != Config.PORT ||
+            signedUrl.userInfo != null ||
+            signedUrl.ref != null ||
+            signedUrl.path != requestUrl.path ||
+            signedUrl.query != requestUrl.query
+        ) {
+            return null
+        }
+
+        ProxyOrigin(
+            host = "127.0.0.1:${Config.PORT}",
+            proto = "http"
+        )
+    }.getOrNull()
+}
+
+internal fun prepareProxyRequestHeaders(
+    headers: Map<String, String>,
+    method: String,
+    requestUrl: URL,
+    apiBase: String?
+): Map<String, String> {
+    if (apiBase.isNullOrBlank()) return headers
+
+    val prepared = headers.filterKeys(::shouldForwardProxyRequestHeader).toMutableMap()
+    localNip98ProxyOrigin(
+        authorization = headers.entries.firstOrNull {
+            it.key.equals("authorization", ignoreCase = true)
+        }?.value,
+        method = method,
+        requestUrl = requestUrl
+    )?.let { origin ->
+        prepared["X-Forwarded-Host"] = origin.host
+        prepared["X-Forwarded-Proto"] = origin.proto
+    }
+    return prepared
+}
+
+private fun uniqueUsableTagValue(tags: JSONArray, name: String): String? {
+    var value: String? = null
+    var matchingTags = 0
+    for (index in 0 until tags.length()) {
+        val tag = tags.optJSONArray(index) ?: continue
+        if (tag.optString(0) != name) continue
+        matchingTags++
+        if (tag.length() != 2 || tag.opt(1) !is String) return null
+        value = tag.optString(1).takeIf { it.isNotBlank() } ?: return null
+    }
+    return value.takeIf { matchingTags == 1 }
+}

package/android-template/app/src/test/java/com/pakstr/app/ProxyRequestPolicyTest.kt

@@ -0,0 +1,97 @@
+package com.pakstr.app
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.net.URL
+
+class ProxyRequestPolicyTest {
+
+    @Test
+    fun bodylessPostDoesNotWriteBodyOrManufactureContentType() {
+        val policy = proxyRequestBodyPolicy(emptyMap())
+
+        assertFalse(policy.shouldWriteBody)
+        assertNull(policy.contentType)
+    }
+
+    @Test
+    fun zeroLengthPostDoesNotWriteBodyOrManufactureContentType() {
+        val policy = proxyRequestBodyPolicy(
+            mapOf("content-length" to "0")
+        )
+
+        assertFalse(policy.shouldWriteBody)
+        assertNull(policy.contentType)
+    }
+
+    @Test
+    fun bodylessRequestOmitsEntityHeadersAndBody() {
+        val request = bodylessProxyRequestBytes(
+            "POST",
+            URL("https://example.com/api/auth/login"),
+            mapOf(
+                "authorization" to "Nostr event",
+                "content-type" to "",
+                "content-length" to "0",
+                "transfer-encoding" to "chunked"
+            )
+        ).toString(Charsets.ISO_8859_1)
+
+        assertTrue(request.startsWith("POST /api/auth/login HTTP/1.1\r\n"))
+        assertTrue(request.contains("authorization: Nostr event\r\n"))
+        assertFalse(request.contains("Content-Type", ignoreCase = true))
+        assertFalse(request.contains("Content-Length", ignoreCase = true))
+        assertFalse(request.contains("Transfer-Encoding", ignoreCase = true))
+        assertTrue(request.endsWith("Connection: close\r\n\r\n"))
+    }
+
+    @Test
+    fun jsonPostWritesBodyAndPreservesContentType() {
+        val policy = proxyRequestBodyPolicy(
+            mapOf(
+                "content-length" to "11",
+                "content-type" to "application/json"
+            )
+        )
+
+        assertTrue(policy.shouldWriteBody)
+        assertEquals("application/json", policy.contentType)
+    }
+
+    @Test
+    fun authorizationIsForwardedButTransferEncodingIsNot() {
+        assertTrue(shouldForwardProxyRequestHeader("authorization"))
+        assertFalse(shouldForwardProxyRequestHeader("transfer-encoding"))
+    }
+
+    @Test
+    fun transferEncodedBodyIsRejected() {
+        assertThrows(UnsupportedTransferEncodingException::class.java) {
+            proxyRequestBodyPolicy(
+                mapOf("transfer-encoding" to "chunked")
+            )
+        }
+    }
+
+    @Test
+    fun malformedContentLengthIsRejected() {
+        assertThrows(InvalidContentLengthException::class.java) {
+            proxyRequestBodyPolicy(
+                mapOf("content-length" to "invalid")
+            )
+        }
+    }
+
+    @Test
+    fun negativeContentLengthIsRejected() {
+        assertThrows(InvalidContentLengthException::class.java) {
+            proxyRequestBodyPolicy(
+                mapOf("content-length" to "-1")
+            )
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.19.2",
+  "version": "0.19.3",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",