@namzu/cli 8.1.0 → 8.2.0

package/dist/tui/credential-entry.d.ts

@@ -25,7 +25,28 @@
  * package has no component tests and a secret is the worst thing to leave
  * unverifiable.
  */
-import type { DetectedProvider, ProviderRegistryEntry } from '../integrations/providers/index.js';
+import { type DetectedProvider, type ProviderRegistryEntry } from '../integrations/providers/index.js';
+/**
+ * Which kind of secret was pasted.
+ *
+ * The distinction is not cosmetic: the two travel differently on the wire —
+ * `constructProvider` sends one as `authToken` and the other as `apiKey` — and
+ * they expire differently. A subscription token is short-lived and is renewed
+ * from refresh metadata that only the discovered credential carries; a hand
+ * pasted one has none, so it lapses in hours with nothing to renew it. An
+ * operator who is not told that at the moment they paste discovers it as a 401
+ * mid-turn, which is the difference between a feature and a trap.
+ */
+export type CredentialKind = 'api-key' | 'subscription-token';
+/**
+ * Classify a pasted secret by its own shape.
+ *
+ * Reuses the classifier the session layer already decides the wire header with
+ * (`isAnthropicOAuthToken`), so the screen cannot say one thing while the
+ * request says another. Every other provider takes an API key and nothing else,
+ * so asking the question of them would invent a distinction they do not have.
+ */
+export declare function classifyCredential(entry: ProviderRegistryEntry, key: string): CredentialKind;
 /**
  * What a key looks like on screen. Never the key.
  *
@@ -64,18 +85,29 @@ export type Verification = {
 /**
  * What namzu tells the operator it did with what they typed.
  *
- * Every branch says three things: that it worked or did not, that the key is
- * held for this session only, and the environment variable that persists it.
- * The middle one is the part a person is most likely to assume otherwise —
- * typing a credential into an application usually means it was saved.
+ * Every branch says four things: that it worked or did not, WHICH KIND of
+ * credential it took, that it is held for this session only, and the
+ * environment variable that persists it. The third is the part a person is most
+ * likely to assume otherwise — typing a credential into an application usually
+ * means it was saved.
+ *
+ * The kind is said out loud because the two behave differently after this
+ * screen, and only one of them can be renewed. See {@link CredentialKind}.
  */
-export declare function describeDisposition(entry: ProviderRegistryEntry, verification: Verification): string;
+export declare function describeDisposition(entry: ProviderRegistryEntry, verification: Verification, kind?: CredentialKind): string;
 /**
  * The detected-provider record a typed key produces.
  *
  * Shaped exactly like a discovered one so every downstream path — session
  * construction, the model picker, `/provider` — treats it identically. The only
  * difference is `source`, so a surface can say where it came from.
+ *
+ * `oauth` is deliberately NOT set, for a subscription token as much as for an
+ * API key. That field means "this credential can be renewed from a refresh
+ * token", the session layer gates its refresh on it, and a hand-pasted token
+ * supplies no refresh token — so filling it in would claim a renewal path that
+ * does not exist and turn a disclosed expiry into a silent 401. The disclosure
+ * in `describeDisposition` is the substitute.
  */
 export declare function sessionCredential(entry: ProviderRegistryEntry, key: string): DetectedProvider;
 //# sourceMappingURL=credential-entry.d.ts.map

package/dist/tui/credential-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-entry.d.ts","sourceRoot":"","sources":["../../src/tui/credential-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAEjG;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAexF;AAED,qDAAqD;AACrD,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AAC/B,oEAAoE;GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,YAAY,GACxB,MAAM,CAuBR;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAQ7F"}
+{"version":3,"file":"credential-entry.d.ts","sourceRoot":"","sources":["../../src/tui/credential-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAE1B,MAAM,oCAAoC,CAAA;AAE3C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,oBAAoB,CAAA;AAE7D;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAG5F;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAmBxF;AAED,qDAAqD;AACrD,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AAC/B,oEAAoE;GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,YAAY,EAC1B,IAAI,GAAE,cAA0B,GAC9B,MAAM,CAmCR;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAQ7F"}

package/dist/tui/credential-entry.js

@@ -25,6 +25,20 @@
  * package has no component tests and a secret is the worst thing to leave
  * unverifiable.
  */
+import { isAnthropicOAuthToken, } from '../integrations/providers/index.js';
+/**
+ * Classify a pasted secret by its own shape.
+ *
+ * Reuses the classifier the session layer already decides the wire header with
+ * (`isAnthropicOAuthToken`), so the screen cannot say one thing while the
+ * request says another. Every other provider takes an API key and nothing else,
+ * so asking the question of them would invent a distinction they do not have.
+ */
+export function classifyCredential(entry, key) {
+    if (entry.id !== 'anthropic')
+        return 'api-key';
+    return isAnthropicOAuthToken(key.trim()) ? 'subscription-token' : 'api-key';
+}
 /**
  * What a key looks like on screen. Never the key.
  *
@@ -56,11 +70,15 @@ export function keyLooksUsable(key) {
     if (/\s/.test(trimmed)) {
         return { ok: false, reason: 'That contains a space — check for a truncated or wrapped paste.' };
     }
-    if (trimmed.startsWith('$') || trimmed.includes('=')) {
+    // Assignment-SHAPED, not "contains an equals sign". The old test rejected any
+    // `=` anywhere, which is fine for an API key and wrong for a subscription
+    // token: a JWT-shaped one is base64 and may carry `=` padding, so the screen
+    // refused a valid credential and blamed the operator's paste for it. This
+    // still catches the case the check exists for — `ANTHROPIC_API_KEY=sk-…`
+    // copied out of a shell profile — because that has a variable name in front.
+    if (trimmed.startsWith('$') || /^[A-Za-z_][A-Za-z0-9_]*=/.test(trimmed)) {
         return {
             ok: false,
-            // The classic: pasting `ANTHROPIC_API_KEY=sk-…` or `$MY_KEY` from a
-            // shell profile rather than the value.
             reason: 'That looks like a shell assignment or variable. Paste the key itself.',
         };
     }
@@ -69,21 +87,26 @@ export function keyLooksUsable(key) {
 /**
  * What namzu tells the operator it did with what they typed.
  *
- * Every branch says three things: that it worked or did not, that the key is
- * held for this session only, and the environment variable that persists it.
- * The middle one is the part a person is most likely to assume otherwise —
- * typing a credential into an application usually means it was saved.
+ * Every branch says four things: that it worked or did not, WHICH KIND of
+ * credential it took, that it is held for this session only, and the
+ * environment variable that persists it. The third is the part a person is most
+ * likely to assume otherwise — typing a credential into an application usually
+ * means it was saved.
+ *
+ * The kind is said out loud because the two behave differently after this
+ * screen, and only one of them can be renewed. See {@link CredentialKind}.
  */
-export function describeDisposition(entry, verification) {
+export function describeDisposition(entry, verification, kind = 'api-key') {
+    const noun = kind === 'subscription-token' ? 'subscription token' : 'API key';
     const persist = entry.envVars[0];
     const durable = persist
         ? `To keep it, set ${persist} in your shell and restart.`
         : 'To keep it, configure the credential in your environment and restart.';
     if (verification.kind === 'rejected') {
-        return `${entry.label} rejected that key: ${verification.reason}\nNothing was stored.`;
+        return `${entry.label} rejected that ${noun}: ${verification.reason}\nNothing was stored.`;
     }
     const checked = verification.kind === 'verified'
-        ? `${entry.label} accepted the key.`
+        ? `${entry.label} accepted the ${noun}.`
         : // Said plainly rather than implied. Claiming a key is good would be
             // inventing a verification that did not happen — and this now covers
             // two ways of not happening: a driver that declares no credential
@@ -91,8 +114,17 @@ export function describeDisposition(entry, verification) {
             // wording asserted the first ("offers no way to check it"), which
             // would be false for a probe that timed out. Neither is a bad key,
             // and neither is a checked one.
-            `Key accepted, but NOT checked — ${entry.label} could not confirm it just now, so the first message will be the test.`;
-    return `${checked}\nHeld in memory for this session only — it is not written anywhere. ${durable}`;
+            `${noun.replace(/^./, (c) => c.toUpperCase())} accepted, but NOT checked — ${entry.label} could not confirm it just now, so the first message will be the test.`;
+    // Disclosed HERE, at the paste, and not left to be discovered as a 401 in the
+    // middle of a turn. A discovered subscription token arrives with a refresh
+    // token and an expiry, and the session layer renews it between turns; a
+    // pasted one carries neither, so there is nothing to renew it with. Saying
+    // "it lasts hours" is the honest form of a limitation we cannot remove
+    // without an authorization flow namzu does not have.
+    const expiry = kind === 'subscription-token'
+        ? '\nA pasted subscription token has no refresh data with it, so it expires in a few hours and namzu cannot renew it — expect to enter it again.'
+        : '';
+    return `${checked}\nHeld in memory for this session only — it is not written anywhere. ${durable}${expiry}`;
 }
 /**
  * The detected-provider record a typed key produces.
@@ -100,6 +132,13 @@ export function describeDisposition(entry, verification) {
  * Shaped exactly like a discovered one so every downstream path — session
  * construction, the model picker, `/provider` — treats it identically. The only
  * difference is `source`, so a surface can say where it came from.
+ *
+ * `oauth` is deliberately NOT set, for a subscription token as much as for an
+ * API key. That field means "this credential can be renewed from a refresh
+ * token", the session layer gates its refresh on it, and a hand-pasted token
+ * supplies no refresh token — so filling it in would claim a renewal path that
+ * does not exist and turn a disclosed expiry into a silent 401. The disclosure
+ * in `describeDisposition` is the substitute.
  */
 export function sessionCredential(entry, key) {
     return {

package/dist/tui/credential-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-entry.js","sourceRoot":"","sources":["../../src/tui/credential-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACzE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAA;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO;YACN,EAAE,EAAE,KAAK;YACT,oEAAoE;YACpE,uCAAuC;YACvC,MAAM,EAAE,uEAAuE;SAC/E,CAAA;IACF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACpB,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAA4B,EAC5B,YAA0B;IAE1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,OAAO;QACtB,CAAC,CAAC,mBAAmB,OAAO,6BAA6B;QACzD,CAAC,CAAC,uEAAuE,CAAA;IAE1E,IAAI,YAAY,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO,GAAG,KAAK,CAAC,KAAK,uBAAuB,YAAY,CAAC,MAAM,uBAAuB,CAAA;IACvF,CAAC;IAED,MAAM,OAAO,GACZ,YAAY,CAAC,IAAI,KAAK,UAAU;QAC/B,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,oBAAoB;QACpC,CAAC,CAAC,oEAAoE;YACrE,qEAAqE;YACrE,kEAAkE;YAClE,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,gCAAgC;YAChC,mCAAmC,KAAK,CAAC,KAAK,wEAAwE,CAAA;IAEzH,OAAO,GAAG,OAAO,wEAAwE,OAAO,EAAE,CAAA;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA4B,EAAE,GAAW;IAC1E,OAAO;QACN,KAAK;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE;QAClB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,YAAY,EAAE,EAAE;KAChB,CAAA;AACF,CAAC"}
+{"version":3,"file":"credential-entry.js","sourceRoot":"","sources":["../../src/tui/credential-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAGN,qBAAqB,GACrB,MAAM,oCAAoC,CAAA;AAe3C;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA4B,EAAE,GAAW;IAC3E,IAAI,KAAK,CAAC,EAAE,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IAC9C,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACzE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAA;IAChG,CAAC;IACD,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uEAAuE;SAC/E,CAAA;IACF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACpB,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAA4B,EAC5B,YAA0B,EAC1B,OAAuB,SAAS;IAEhC,MAAM,IAAI,GAAG,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,OAAO;QACtB,CAAC,CAAC,mBAAmB,OAAO,6BAA6B;QACzD,CAAC,CAAC,uEAAuE,CAAA;IAE1E,IAAI,YAAY,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO,GAAG,KAAK,CAAC,KAAK,kBAAkB,IAAI,KAAK,YAAY,CAAC,MAAM,uBAAuB,CAAA;IAC3F,CAAC;IAED,MAAM,OAAO,GACZ,YAAY,CAAC,IAAI,KAAK,UAAU;QAC/B,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,iBAAiB,IAAI,GAAG;QACxC,CAAC,CAAC,oEAAoE;YACrE,qEAAqE;YACrE,kEAAkE;YAClE,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,gCAAgC;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,gCAAgC,KAAK,CAAC,KAAK,wEAAwE,CAAA;IAEnK,8EAA8E;IAC9E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,MAAM,GACX,IAAI,KAAK,oBAAoB;QAC5B,CAAC,CAAC,+IAA+I;QACjJ,CAAC,CAAC,EAAE,CAAA;IAEN,OAAO,GAAG,OAAO,wEAAwE,OAAO,GAAG,MAAM,EAAE,CAAA;AAC5G,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA4B,EAAE,GAAW;IAC1E,OAAO;QACN,KAAK;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE;QAClB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,YAAY,EAAE,EAAE;KAChB,CAAA;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/cli",
-  "version": "8.1.0",
+  "version": "8.2.0",
   "description": "Operator CLI for the Namzu agent platform — namzu doctor + future commands. Dual-purpose: standalone bin (`namzu doctor`) and library (`import { runDoctor } from '@namzu/cli'`).",
   "keywords": [
     "namzu",
@@ -44,11 +44,11 @@
     "ink": "^7.0.3",
     "react": "^19.2.6",
     "yaml": "^2.9.0",
-    "@namzu/ollama": "2.1.0",
+    "@namzu/anthropic": "3.2.0",
     "@namzu/openai": "1.2.0",
     "@namzu/sdk": "^21.1.0",
     "@namzu/openrouter": "2.1.0",
-    "@namzu/anthropic": "3.2.0"
+    "@namzu/ollama": "2.1.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",