@impractical-ai/motion 0.1.4 → 0.1.6

package/dist/{stdio-JCRFEHDW.js → stdio-GHDI4S7P.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   openBrowser
-} from "./chunk-KC6BJJXH.js";
+} from "./chunk-BUHNO2W2.js";
 import {
   ApiError,
   admitMcpCall,
@@ -11,7 +11,7 @@ import {
   saveConfig,
   validateApiResponse,
   withAdmissionReceipt
-} from "./chunk-M77TS5RO.js";
+} from "./chunk-KITRCE33.js";
 import {
   PACKAGE_VERSION,
   PRODUCTION_APP_URL,
@@ -19,7 +19,7 @@ import {
   __commonJS,
   __export,
   __toESM
-} from "./chunk-EFP4P3WA.js";
+} from "./chunk-LJ4YH3YJ.js";
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -30993,6 +30993,23 @@ var StdioServerTransport = class {
   }
 };
 
+// ../supabase/functions/_shared/usage-policy.ts
+var FREE_WEEKLY_LIMIT = 200;
+var FREE_WEEKLY_VIDEO_ESTIMATE = "usually 4-5 videos";
+var ADMISSION_RECEIPT_TTL_SECONDS = 3 * 60 * 60;
+var UNMETERED_MCP_TOOLS = /* @__PURE__ */ new Set([
+  "connect",
+  "account_status",
+  "whoami",
+  "upgrade",
+  "studio_link",
+  // This tool has a packaged local fallback and is explicitly required before
+  // authentication-dependent work. Admission must not block that fallback.
+  "engine_types"
+]);
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+
 // src/mcp/tools.ts
 var json2 = (value) => ({ text: JSON.stringify(value, null, 2) });
 var fail = (text) => ({ text, isError: true });
@@ -31111,24 +31128,74 @@ var whoami = {
 };
 var upgradeTool = {
   name: "upgrade",
-  title: "Get the Pro billing link",
-  description: "Return the authenticated Pro billing URL. Set open=true only after the user explicitly asks to open it in their browser.",
+  title: "Explain Pro and get the billing link",
+  description: "Explain what Pro costs and unlocks for this workspace, and return the authenticated billing URL. Only a workspace admin can buy \u2014 checking out subscribes the whole workspace. Set open=true only after the user explicitly asks to open it in their browser.",
   inputSchema: {
     open: external_exports.boolean().optional().describe("Open billing in the user's browser. Defaults to false.")
   },
   local: true,
   handler: async (args, ctx) => {
     const url2 = `${(ctx.appUrl ?? "https://motion.impractical.ai").replace(/\/$/, "")}/account/billing`;
+    const account = await ctx.invoke("workspace-bootstrap").catch(() => null);
+    const role = account?.role === "admin" ? "admin" : "member";
+    const canPurchase = role === "admin";
+    const plan = account?.plan ?? "free";
+    const seats = Math.max(1, account?.billing?.seatCount ?? 1);
+    const limit = account?.quota?.limit ?? FREE_WEEKLY_LIMIT;
+    const remaining = account?.quota?.remaining ?? 0;
     const opened = args.open === true ? ctx.openExternal?.(url2) ?? false : false;
-    return { text: opened ? `Opened billing in the user's browser: ${url2}` : url2 };
+    return json2({
+      plan,
+      role,
+      canPurchase,
+      price: { amountUsd: 50, per: "user / month" },
+      billedFor: `${seats} seat${seats === 1 ? "" : "s"} \u2014 every admin and member is a paid seat`,
+      unlocks: [
+        "Unlimited videos and exports \u2014 no weekly ceiling",
+        "Iterate on one video as many times as it takes",
+        "A dedicated allowance per person, not shared across workspaces"
+      ],
+      // Exact, because we meter calls. How many videos that is depends on how
+      // hard they iterate, so do not turn it into a per-user video count.
+      freePlanNow: limit >= 1e6 ? "This workspace is already on Pro." : `${remaining} of ${limit} free calls left this week (${FREE_WEEKLY_VIDEO_ESTIMATE}).`,
+      url: url2,
+      opened,
+      instructions: "Summarise the value in one or two sentences, then give the URL. Do not open a browser unless asked. " + (canPurchase ? "Checking out subscribes the whole workspace \u2014 say so before they act on it." : "Only a workspace admin can approve the purchase, so tell this user to ask an admin to upgrade.")
+    });
   }
 };
 var listProjects = {
   name: "list_projects",
   title: "List video projects",
-  description: "List every video project in the connected workspace, newest first.",
-  inputSchema: {},
-  handler: async (_args, ctx) => json2(await ctx.invoke("list-projects", {}))
+  description: "List video projects in the connected workspace, newest first. Large workspaces: pass limit/offset to page instead of relying on a truncated dump, and nameFilter to search.",
+  inputSchema: {
+    limit: external_exports.number().int().min(1).max(200).optional().describe("Return at most this many projects (default: all)."),
+    offset: external_exports.number().int().min(0).optional().describe("Skip this many projects, for paging."),
+    nameFilter: external_exports.string().optional().describe("Case-insensitive substring match on the project name/slug.")
+  },
+  handler: async (args, ctx) => {
+    const result = await ctx.invoke("list-projects", {});
+    let projects = result.projects ?? [];
+    const total = projects.length;
+    const filter = typeof args.nameFilter === "string" ? args.nameFilter.trim().toLowerCase() : "";
+    if (filter) {
+      projects = projects.filter(
+        (project) => `${project.name ?? ""} ${project.slug ?? ""}`.toLowerCase().includes(filter)
+      );
+    }
+    const matched = projects.length;
+    const offset = typeof args.offset === "number" ? args.offset : 0;
+    const limit = typeof args.limit === "number" ? args.limit : projects.length;
+    projects = projects.slice(offset, offset + limit);
+    return json2({
+      total,
+      matched,
+      offset,
+      returned: projects.length,
+      hasMore: offset + projects.length < matched,
+      projects
+    });
+  }
 };
 var getProject = {
   name: "get_project",
@@ -31194,7 +31261,7 @@ var createVideo = {
 var listDraftFiles = {
   name: "list_draft_files",
   title: "List a draft's files",
-  description: "List the source files of a draft with their sizes and the current revision. Cheap orientation \u2014 prefer this over reading every file.",
+  description: "List the source files of a draft with their sizes and the current revision. Cheap orientation \u2014 prefer this over reading every file. If notes.json is present, it holds the user's queued timecoded edit requests \u2014 read it before directing.",
   inputSchema: { draftId: external_exports.string().describe("The draft id.") },
   handler: async (args, ctx) => {
     const draft = await getDraft(ctx, String(args.draftId));
@@ -31212,10 +31279,12 @@ var listDraftFiles = {
 var readDraftFile = {
   name: "read_draft_file",
   title: "Read one draft file",
-  description: "Read the contents of a single file in a draft.",
+  description: "Read the contents of a single file in a draft. notes.json, when present, is the user's edit queue: [{ id, at, text, done, mentions? }] \u2014 timecoded requests written while watching. Address open items and set done: true on each one you handle.",
   inputSchema: {
     draftId: external_exports.string().describe("The draft id."),
-    path: external_exports.string().describe("File path within the draft, e.g. 'direction.ts'.")
+    path: external_exports.string().describe("File path within the draft, e.g. 'direction.ts'."),
+    startLine: external_exports.number().int().min(1).optional().describe("1-based first line to return \u2014 page large files instead of truncating."),
+    lineCount: external_exports.number().int().min(1).optional().describe("Number of lines to return from startLine.")
   },
   handler: async (args, ctx) => {
     const draft = await getDraft(ctx, String(args.draftId));
@@ -31226,7 +31295,20 @@ var readDraftFile = {
         `No file "${path}" in draft ${args.draftId}. Available: ${Object.keys(draft.files).sort().join(", ")}`
       );
     }
-    return { text: content };
+    const lines = content.split("\n");
+    const startLine = typeof args.startLine === "number" ? Math.max(1, args.startLine) : 1;
+    const lineCount = typeof args.lineCount === "number" ? Math.max(1, args.lineCount) : lines.length;
+    if (startLine === 1 && lineCount >= lines.length) return { text: content };
+    const slice = lines.slice(startLine - 1, startLine - 1 + lineCount);
+    if (slice.length === 0) {
+      return {
+        text: `[no lines returned: startLine ${startLine} is beyond ${lines.length} lines \u2014 page with startLine/lineCount]`
+      };
+    }
+    return {
+      text: `[lines ${startLine}-${startLine - 1 + slice.length} of ${lines.length} \u2014 page with startLine/lineCount]
+` + slice.join("\n")
+    };
   }
 };
 var writeDraftFiles = {
@@ -31298,12 +31380,13 @@ var jobStatus = {
     const jobIds = args.jobIds;
     if (!args.wait) return json2(await ctx.invoke("job-status", { jobIds }));
     const budgetMs = waitBudgetMs(args.waitSeconds, JOB_WAIT_SECONDS);
-    const started = Date.now();
+    const now = ctx.now ?? Date.now;
+    const started = now();
     const deadline = started + budgetMs;
     let rows = [];
     let consecutiveErrors = 0;
     let lastError = "";
-    while (Date.now() < deadline) {
+    while (now() < deadline) {
       if (progress?.signal?.aborted) break;
       try {
         const result = await ctx.invoke("job-status", { jobIds });
@@ -31317,11 +31400,12 @@ var jobStatus = {
         }
       }
       progress?.report?.({
-        progress: Math.min(Date.now() - started, budgetMs),
+        progress: Math.min(now() - started, budgetMs),
         total: budgetMs,
         message: rows.length ? rows.map((row) => describeJob(row.id, row, consecutiveErrors, lastError)).join("; ") : jobIds.join(", ")
       });
-      await nap(ctx, 2e3);
+      const remainingMs = deadline - now();
+      if (remainingMs > 0) await nap(ctx, Math.min(2e3, remainingMs));
     }
     return json2({
       timedOut: true,
@@ -31503,15 +31587,25 @@ var PREVIEW_URL = `${PREVIEW_ORIGIN}/stage.html`;
 var FRAME_TYPE = "jpeg";
 var FRAME_QUALITY = 80;
 var FRAME_MIME = "image/jpeg";
-async function launchChromium() {
+async function launchChromium(launcher = chromium) {
+  if (process.env.CI) {
+    try {
+      return await launcher.launch({ headless: true });
+    } catch (error51) {
+      throw new Error(
+        "CI requires the Playwright-managed Chromium pinned by cli/package-lock.json. Run `npx playwright-core install chromium`; system Chrome fallback is disabled in CI.",
+        { cause: error51 }
+      );
+    }
+  }
   if (process.env.PLAYWRIGHT_CHANNEL === "chrome") {
-    return chromium.launch({ channel: "chrome", headless: true });
+    return launcher.launch({ channel: "chrome", headless: true });
   }
   try {
-    return await chromium.launch({ headless: true });
+    return await launcher.launch({ headless: true });
   } catch {
     try {
-      return await chromium.launch({ channel: "chrome", headless: true });
+      return await launcher.launch({ channel: "chrome", headless: true });
     } catch (error51) {
       throw new Error(
         `No usable Chromium found for frame capture. Install Google Chrome, or run \`npx playwright install chromium\`. If Chrome is installed but blocked by Gatekeeper, set PLAYWRIGHT_CHANNEL=chrome.
@@ -31842,21 +31936,6 @@ ${notes.join("\n")}`.trim(),
   }
 };
 
-// ../supabase/functions/_shared/usage-policy.ts
-var ADMISSION_RECEIPT_TTL_SECONDS = 3 * 60 * 60;
-var UNMETERED_MCP_TOOLS = /* @__PURE__ */ new Set([
-  "connect",
-  "account_status",
-  "whoami",
-  "upgrade",
-  "studio_link",
-  // This tool has a packaged local fallback and is explicitly required before
-  // authentication-dependent work. Admission must not block that fallback.
-  "engine_types"
-]);
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
-
 // src/mcp/stdio.ts
 var engineTypesTool = {
   name: "engine_types",
@@ -31910,6 +31989,82 @@ function toolProgress(extra) {
     }
   };
 }
+function formatUsageNotice(notice) {
+  if (typeof notice === "string") return `Quota warning: ${notice}`;
+  const value = notice;
+  if (!value?.message) return "";
+  return value.level === "nearly_spent" || value.level === "spent" ? `${value.message} Mention \`upgrade\` only if it is relevant to what they are doing right now.` : `${value.message}`;
+}
+function sanitizeResetTime(value) {
+  if (typeof value !== "string" || value.length > 64) return null;
+  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/.exec(value);
+  if (!match) return null;
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText] = match;
+  const [year, month, day, hour, minute, second] = [yearText, monthText, dayText, hourText, minuteText, secondText].map(Number);
+  const daysInMonth = new Date(Date.UTC(year, month, 0)).getUTCDate();
+  if (month < 1 || month > 12 || day < 1 || day > daysInMonth || hour > 23 || minute > 59 || second > 59) return null;
+  const timestamp = new Date(value);
+  return Number.isNaN(timestamp.getTime()) ? null : timestamp.toISOString();
+}
+function sanitizeUpgradeUrl(value, appUrl) {
+  if (typeof value !== "string" || typeof appUrl !== "string" || value.length > 2048 || /[\u0000-\u001f\u007f]/.test(value)) {
+    return null;
+  }
+  try {
+    const url2 = new URL(value);
+    const billingUrl = new URL("/account/billing", appUrl);
+    if (url2.protocol !== "https:" || url2.origin !== billingUrl.origin || url2.pathname !== billingUrl.pathname || url2.username || url2.password || !url2.hostname) return null;
+    url2.search = "";
+    url2.hash = "";
+    return url2.toString();
+  } catch {
+    return null;
+  }
+}
+function formatWeeklyQuota(appUrl, details) {
+  const resetTime = sanitizeResetTime(details.resetTime);
+  const upgradeUrl = sanitizeUpgradeUrl(details.upgradeUrl, appUrl);
+  const spent = details.spent;
+  const spentCalls = Number.isSafeInteger(spent?.calls) && Number(spent?.calls) >= 0 ? Number(spent?.calls) : null;
+  const options = [
+    {
+      id: "upgrade",
+      label: "Review upgrade options",
+      tool: "upgrade",
+      ...upgradeUrl ? { url: upgradeUrl } : {}
+    },
+    {
+      id: "wait",
+      label: "Wait for the weekly reset"
+    }
+  ];
+  const response = {
+    error: "weekly_mcp_quota_exceeded",
+    headline: "The free weekly MCP allowance has been used.",
+    message: "No work was started for this call.",
+    ...spentCalls === null ? {} : { spent: { calls: spentCalls } },
+    ...resetTime ? { resetTime } : {},
+    scopeNote: "Free calls are shared across every Free workspace you belong to.",
+    options,
+    ...upgradeUrl ? { upgradeUrl } : {}
+  };
+  return JSON.stringify(response, null, 2);
+}
+function formatGenericRateLimit(toolName, appUrl, details) {
+  const resetTime = sanitizeResetTime(details?.resetTime);
+  const upgradeUrl = sanitizeUpgradeUrl(details?.upgradeUrl, appUrl);
+  const metadata = [
+    resetTime ? `Reset time: ${resetTime}` : null,
+    upgradeUrl ? `Upgrade: ${upgradeUrl}` : null
+  ].filter((line) => line !== null);
+  return [
+    `${toolName} failed: Rate limit exceeded.`,
+    "",
+    "No work was started for this call because the service returned a rate limit.",
+    ...metadata,
+    "Call `upgrade` for plan options, or retry after the limit resets. `account_status` remains available without using quota."
+  ].join("\n");
+}
 function register(server, tool, ctx) {
   server.registerTool(
     tool.name,
@@ -31925,15 +32080,25 @@ function register(server, tool, ctx) {
         const output = admission?.receipt && ctx.withAdmission ? await ctx.withAdmission(admission.receipt, execute) : await execute();
         if (admission?.warning) output.text += `
 
-Quota warning: ${admission.warning}`;
+${formatUsageNotice(admission.warning)}`;
         return toContent(output);
       } catch (error51) {
         const status = error51.status;
         const message = error51 instanceof Error ? error51.message : String(error51);
         const details = error51 instanceof ApiError ? error51.details : void 0;
-        const resetTime = typeof details?.resetTime === "string" ? details.resetTime : void 0;
-        const upgradeUrl = typeof details?.upgradeUrl === "string" ? details.upgradeUrl : void 0;
-        const hint = status === 401 || isNotConnected(message) ? "\n\nCall the `connect` tool to authenticate this workspace." : status === 402 ? "\n\nThe workspace needs an active subscription or trial." : status === 429 ? "\n\nNo work was started for this call. The free workspace has used all 200 weekly MCP calls." + (resetTime ? ` It resets at ${resetTime}.` : " It resets Monday at 00:00 UTC.") + ` Ask the user to upgrade${upgradeUrl ? ` at ${upgradeUrl}` : " with the `upgrade` tool"}, or retry after the reset. \`account_status\` remains available without using quota.` : "";
+        if (status === 429 && details?.error === "weekly_mcp_quota_exceeded") {
+          return toContent({
+            text: formatWeeklyQuota(ctx.appUrl, details),
+            isError: true
+          });
+        }
+        if (status === 429) {
+          return toContent({
+            text: formatGenericRateLimit(tool.name, ctx.appUrl, details),
+            isError: true
+          });
+        }
+        const hint = status === 401 || isNotConnected(message) ? "\n\nCall the `connect` tool to authenticate this workspace." : status === 402 ? "\n\nThe workspace needs an active subscription or trial." : "";
         return toContent({ text: `${tool.name} failed: ${message}${hint}`, isError: true });
       }
     }
@@ -31971,7 +32136,7 @@ function createServer(ctx) {
       // agent that skips motion_context still cannot produce slop by default.
       // The full language (ease table, blur doctrine, camera grammar, beat
       // sheets) ships live in motion_context's `guidance.motionDirection`.
-      instructions: "Impractical Motion makes studio-quality motion-graphics videos. Draft source lives in the cloud \u2014 there is no working copy on disk, so edit through these tools rather than writing files.\n\nYou are the director. Call engine_types first to learn the API, then motion_context to study the current house library and production references, then create_video, then write App.tsx (the stage markup) and direction.ts (the GSAP choreography) with edit_draft_file / write_draft_files. Every save returns its committed revision and preview-build job id immediately. Follow that id with job_status and fix any build error it returns. Call get_frames to SEE the result before telling the user it is done, then call export_video, follow its returned job id with job_status, and hand the user the studio_link.\n\nJOBS OUTLIVE TOOL CALLS. Job-producing mutations return their durable job id BEFORE any wait; resume that exact id with job_status({ jobIds: [...], wait: true }). Never start a second export or re-apply an edit after a committed revision. If the MCP client kills a call and shows only a timeout, assume the acknowledgment may have been lost: DO NOT blindly retry a mutating or metered tool. Verify state first. For a write/edit, use list_draft_files and read_draft_file to confirm the intended source and revision. For an export or other project mutation, use get_project/list_projects to check whether it already started or completed. brand_extract returns a durable run handle; continue that exact jobId in status mode and never re-extract blindly. If its start acknowledgement is lost, check brand_list/brand_get before starting again. Retry only when those reads prove the mutation did not commit; otherwise continue from the observed state.\n\nTHE MOTION FLOOR \u2014 these hold even if you read nothing else:\n1. Beat out the story before writing code: every beat needs a time, a thing on screen, and a move. A beat with no move is not a beat.\n2. Text enters on RISE \u2014 text.reveal(el, 'rise') on promo-out, lines ~0.2s apart. Do NOT default type to 'blur': word-by-word de-blur reads as out-of-focus and a staggered blur turns to mush. Blur is for whole-frame moves \u2014 fx.spike(el, 'blur') alongside a whip or dive, where it hides the cut. Never animate blur above 20px.\n3. Every ease is a named house curve \u2014 ease-out-* for entrances, ease-in-out-* for travel and ALL camera moves, ease-in-* for exits and dives only. Never leave an ease unspecified, and never put an ease-in-* on an entrance.\n4. Motion is fast: entrances 0.4-0.6s, exits shorter, line staggers ~0.2s apart, nothing over 1s except a deliberate hold drift or slow push.\n5. Nothing is ever static \u2014 every hold carries a slow drift or camera push. Cuts are HARD (tl.set), never crossfades.\n6. Determinism: no Date.now, Math.random, setTimeout, or CSS transitions. The exporter renders by seeking, so wall-clock motion shimmers or vanishes.\n7. Never claim a video is done without calling get_frames and looking at the frames."
+      instructions: "Impractical Motion makes studio-quality motion-graphics videos. Draft source lives in the cloud \u2014 there is no working copy on disk, so edit through these tools rather than writing files.\n\nTHE USER'S EDITS COME FIRST. While watching a draft in the Studio the user queues timecoded edit requests into its notes.json (\"Edits for agent\"). Before directing an existing draft, read_draft_file notes.json (it may not exist \u2014 that is fine); address the open items, and mark each one you have handled by setting its `done` to true with edit_draft_file, leaving the rest of the entry intact. The Studio shows the user what you resolved.\n\nYou are the director. Call engine_types first to learn the API, then motion_context to study the current house library and production references, then create_video, then write App.tsx (the stage markup) and direction.ts (the GSAP choreography) with edit_draft_file / write_draft_files. Every save returns its committed revision and preview-build job id immediately. Follow that id with job_status and fix any build error it returns. Call get_frames to SEE the result before telling the user it is done, then call export_video, follow its returned job id with job_status, and hand the user the studio_link.\n\nJOBS OUTLIVE TOOL CALLS. Job-producing mutations return their durable job id BEFORE any wait; resume that exact id with job_status({ jobIds: [...], wait: true }). Never start a second export or re-apply an edit after a committed revision. If the MCP client kills a call and shows only a timeout, assume the acknowledgment may have been lost: DO NOT blindly retry a mutating or metered tool. Verify state first. For a write/edit, use list_draft_files and read_draft_file to confirm the intended source and revision. For an export or other project mutation, use get_project/list_projects to check whether it already started or completed. brand_extract returns a durable run handle; continue that exact jobId in status mode and never re-extract blindly. If its start acknowledgement is lost, check brand_list/brand_get before starting again. Retry only when those reads prove the mutation did not commit; otherwise continue from the observed state.\n\nTHE MOTION FLOOR \u2014 these hold even if you read nothing else:\n1. Beat out the story before writing code: every beat needs a time, a thing on screen, and a move. A beat with no move is not a beat.\n2. Text enters on RISE \u2014 text.reveal(el, 'rise') on promo-out, lines ~0.2s apart. Do NOT default type to 'blur': word-by-word de-blur reads as out-of-focus and a staggered blur turns to mush. Blur is for whole-frame moves \u2014 fx.spike(el, 'blur') alongside a whip or dive, where it hides the cut. Never animate blur above 20px.\n3. Every ease is a named house curve \u2014 ease-out-* for entrances, ease-in-out-* for travel and ALL camera moves, ease-in-* for exits and dives only. Never leave an ease unspecified, and never put an ease-in-* on an entrance.\n4. Motion is fast: entrances 0.4-0.6s, exits shorter, line staggers ~0.2s apart, nothing over 1s except a deliberate hold drift or slow push.\n5. Nothing is ever static \u2014 every hold carries a slow drift or camera push. Cuts are HARD (tl.set), never crossfades.\n6. Determinism: no Date.now, Math.random, setTimeout, or CSS transitions. The exporter renders by seeking, so wall-clock motion shimmers or vanishes.\n7. Never claim a video is done without calling get_frames and looking at the frames."
     }
   );
   for (const tool of TOOLS) register(server, tool, validatedCtx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impractical-ai/motion",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "private": false,
   "description": "Create and refine Impractical Motion videos from coding agents and the terminal.",
   "homepage": "https://github.com/Openpod/impractical-motion#readme",
@@ -25,15 +25,16 @@
     "node": ">=22"
   },
   "scripts": {
-    "build": "node ../scripts/build-engine-dts.mjs && rm -rf dist && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22 --splitting --outdir=dist --external:playwright-core --banner:js=\"#!/usr/bin/env node\" && chmod +x dist/index.js",
+    "build": "node ../scripts/verify-locked-cli-install.mjs && node ../scripts/build-engine-dts.mjs --cli-only && rm -rf dist && ./node_modules/esbuild/bin/esbuild src/index.ts --bundle --platform=node --format=esm --target=node22 --splitting --outdir=dist --external:playwright-core --banner:js=\"#!/usr/bin/env node\" && chmod +x dist/index.js",
     "typecheck": "tsc --noEmit",
-    "test": "npm run build && esbuild tests/onboarding.test.ts tests/mcp-tools.test.ts tests/mcp-frames.test.ts tests/engine-dts.test.ts tests/mcp-connect.test.ts tests/mcp-longpoll.test.ts --bundle --platform=node --format=esm --packages=external --outdir=dist --out-extension:.js=.mjs && node --test dist/onboarding.test.mjs dist/mcp-tools.test.mjs dist/mcp-frames.test.mjs dist/engine-dts.test.mjs dist/mcp-connect.test.mjs dist/mcp-longpoll.test.mjs",
+    "test": "npm run typecheck && npm run build && esbuild tests/onboarding.test.ts tests/mcp-tools.test.ts tests/mcp-frames.test.ts tests/engine-dts.test.ts tests/mcp-connect.test.ts tests/mcp-longpoll.test.ts tests/mcp-agent-timeout.test.ts tests/api-hardening.test.ts --bundle --platform=node --format=esm --packages=external --outdir=dist --out-extension:.js=.mjs && node --test dist/onboarding.test.mjs dist/mcp-tools.test.mjs dist/mcp-frames.test.mjs dist/engine-dts.test.mjs dist/mcp-connect.test.mjs dist/mcp-longpoll.test.mjs dist/mcp-agent-timeout.test.mjs dist/api-hardening.test.mjs",
     "prepack": "npm run build"
   },
   "publishConfig": {
     "access": "public"
   },
   "devDependencies": {
+    "@types/node": "^26.1.0",
     "esbuild": "^0.25.0",
     "typescript": "^5.6.3"
   },