@roamcode.ai/server 1.0.0

package/dist/usage-service.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Claude usage limits (the `/usage` slash command), surfaced in the session rail and settings:
+ * the 5-hour SESSION limit, the all-model WEEKLY limit, and any provider-named weekly buckets.
+ *
+ * DATA SOURCE: the real `claude` CLI's `/usage` command returns the exact numbers. Invoked headlessly
+ * as `claudeBin -p "/usage" --output-format json --dangerously-skip-permissions` (clean exit, ONE JSON
+ * line). Its `.result` string carries the human-readable usage block we parse here, e.g.:
+ *
+ *   Current session: 12% used · resets Jun 25 at 11:30pm (Europe/Istanbul)
+ *   Current week (all models): 72% used · resets Jun 25 at 10pm (Europe/Istanbul)
+ *   Current week (Fable): 2% used · resets Jun 25 at 9:59pm (Europe/Istanbul)
+ *
+ * The spawn is the cost; a short TTL cache keeps it to ~once/3min regardless of how fast the rail
+ * polls. A failed/empty fetch (claude missing / not logged in / parse fail) degrades GRACEFULLY to the
+ * last good cached value, or null when there's none — the feature simply hides in the UI, never 500s.
+ *
+ * Deps are INJECTABLE (`runUsage` + `now`, mirroring the updater's style) so the parse + cache logic is
+ * unit-testable against fixture text with no real spawn.
+ */
+/** A single usage bar: percent used (0–100) plus a reset string when the provider supplies one. */
+export interface Bar {
+    percent: number;
+    /** Claude omits this while a window is still at 0%, so reset time is optional. */
+    resets?: string;
+}
+export interface ModelWeekBar extends Bar {
+    model: string;
+}
+/**
+ * Parsed usage snapshot. `session` is the 5-hour limit; `week` is the all-models weekly limit;
+ * `weekModels` contains provider-named weekly buckets. `weekSonnet` remains for older clients.
+ */
+export interface UsageInfo {
+    session?: Bar;
+    week?: Bar;
+    /** Provider-named weekly buckets such as Fable or the legacy Sonnet-only limit. */
+    weekModels?: ModelWeekBar[];
+    /** Legacy compatibility for older clients; new code should prefer weekModels. */
+    weekSonnet?: Bar;
+    fetchedAt: number;
+}
+/** Resolve the raw `.result` string from `claude /usage`. NEVER rejects — resolves "" on any failure. */
+export type RunUsage = () => Promise<string>;
+export interface UsageServiceDeps {
+    runUsage: RunUsage;
+    /** Clock seam so the cache TTL is testable. */
+    now: () => number;
+    /** Cache TTL in ms (default USAGE_CACHE_MS). A getUsage within this window reuses the cache. */
+    ttlMs?: number;
+}
+interface UsagePty {
+    onData(cb: (data: string) => void): void;
+    onExit(cb: (event: {
+        exitCode: number;
+    }) => void): void;
+    kill(signal?: string): void;
+}
+type UsagePtySpawn = (file: string, args: string[], options: {
+    name: string;
+    cols: number;
+    rows: number;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}) => UsagePty;
+/** Cache TTL for a parsed usage snapshot. The rail polls ~every 60s; this throttles the real spawn to
+ * roughly once every few minutes regardless of poll rate. */
+export declare const USAGE_CACHE_MS: number;
+/** Hard timeout for the `claude /usage` spawn so a hung CLI never blocks the /usage response. */
+export declare const USAGE_TIMEOUT_MS = 15000;
+/**
+ * Parse the `/usage` result text into a UsageInfo. PURE: no spawn, no clock (the `now` arg stamps
+ * `fetchedAt`). Returns null when neither the session nor the all-models week line parses (the feature
+ * is then unavailable → the UI hides). Model-specific weeks and reset strings are optional. Reset
+ * strings are kept as-is (trimmed); the UI may shorten them further.
+ */
+export declare function parseUsage(text: string, now?: number): UsageInfo | null;
+/**
+ * The real `runUsage` adapter. Claude 2.1.207+ omits account-limit lines when stdin is not a TTY, so a
+ * normal child-process pipe returns only the diagnostic "What's contributing" section and parses as no
+ * limits. Run the short-lived `/usage` command in its own isolated PTY instead. This is NOT a RoamCode tmux
+ * session; it exits with the command and never attaches to a user's chat. ANTHROPIC_API_KEY is stripped so
+ * subscription auth is used. NEVER rejects — resolves "" on spawn error, timeout, malformed JSON, or a
+ * missing `.result`.
+ */
+export declare function createUsageRunner(opts: {
+    claudeBin: string;
+    env?: NodeJS.ProcessEnv;
+    timeoutMs?: number;
+    /** Test seam; production lazily loads node-pty, already required by terminal sessions. */
+    ptySpawn?: UsagePtySpawn;
+}): RunUsage;
+/**
+ * Resolves + caches the parsed Claude usage. The cache stores the LAST GOOD snapshot; the TTL governs
+ * when `runUsage` is re-run. A failed/empty fetch returns the last good value (or null), never throws.
+ */
+export declare class UsageService {
+    private readonly runUsage;
+    private readonly now;
+    private readonly ttlMs;
+    private cache?;
+    constructor(deps: UsageServiceDeps);
+    /**
+     * Get the current usage. Within the TTL (and not forced) returns the cached snapshot WITHOUT
+     * re-spawning. Otherwise runs `runUsage`, parses, and (on success) caches it as the new last-good.
+     * A failed/empty refresh keeps the last good value (or null) and re-stamps the cache time so an
+     * outage doesn't re-spawn on every poll.
+     */
+    getUsage(force?: boolean): Promise<UsageInfo | null>;
+}
+/** Construct a UsageService with the real spawn adapter (the production wiring). */
+export declare function createUsageService(opts: {
+    claudeBin: string;
+    env?: NodeJS.ProcessEnv;
+    now?: () => number;
+    timeoutMs?: number;
+    ttlMs?: number;
+}): UsageService;
+export {};

package/dist/usage-service.js

@@ -0,0 +1,173 @@
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+/** Cache TTL for a parsed usage snapshot. The rail polls ~every 60s; this throttles the real spawn to
+ * roughly once every few minutes regardless of poll rate. */
+export const USAGE_CACHE_MS = 3 * 60 * 1000;
+/** Hard timeout for the `claude /usage` spawn so a hung CLI never blocks the /usage response. */
+export const USAGE_TIMEOUT_MS = 15_000;
+/** Match one usage line (`<label>: NN% used [· resets <when>]`) into a Bar. Tolerant of spacing / the
+ * middle `·` / `reset` vs `resets`, case-insensitive. Returns undefined when the line isn't present. */
+function matchBar(text, re) {
+    const m = re.exec(text);
+    if (!m)
+        return undefined;
+    const parsed = Number.parseInt(m[1], 10);
+    if (Number.isNaN(parsed))
+        return undefined;
+    // Clamp to [0,100] so a malformed/over-100 value can't render an overflowing progress bar.
+    const percent = Math.max(0, Math.min(100, parsed));
+    const resets = (m[2] ?? "").trim();
+    return { percent, ...(resets ? { resets } : {}) };
+}
+const OPTIONAL_RESET = String.raw `(?:\s*·?\s*resets?\s*(.+))?\s*$`;
+const SESSION_RE = new RegExp(String.raw `^Current session:\s*(\d+)%\s*used${OPTIONAL_RESET}`, "im");
+const WEEK_RE = new RegExp(String.raw `^Current week \(all models\):\s*(\d+)%\s*used${OPTIONAL_RESET}`, "im");
+const MODEL_WEEK_RE = new RegExp(String.raw `^Current week \((?!all models\))(.+?)\):\s*(\d+)%\s*used${OPTIONAL_RESET}`, "gim");
+function matchModelWeeks(text) {
+    return Array.from(text.matchAll(MODEL_WEEK_RE), (match) => {
+        const model = match[1].trim().replace(/\s+only$/i, "");
+        const percent = Math.max(0, Math.min(100, Number.parseInt(match[2], 10)));
+        const resets = (match[3] ?? "").trim();
+        return { model, percent, ...(resets ? { resets } : {}) };
+    }).filter((bar) => bar.model.length > 0 && !Number.isNaN(bar.percent));
+}
+/**
+ * Parse the `/usage` result text into a UsageInfo. PURE: no spawn, no clock (the `now` arg stamps
+ * `fetchedAt`). Returns null when neither the session nor the all-models week line parses (the feature
+ * is then unavailable → the UI hides). Model-specific weeks and reset strings are optional. Reset
+ * strings are kept as-is (trimmed); the UI may shorten them further.
+ */
+export function parseUsage(text, now = Date.now()) {
+    if (typeof text !== "string" || !text.trim())
+        return null;
+    const session = matchBar(text, SESSION_RE);
+    const week = matchBar(text, WEEK_RE);
+    const weekModels = matchModelWeeks(text);
+    const weekSonnetModel = weekModels.find((bar) => bar.model.toLowerCase() === "sonnet");
+    const weekSonnet = weekSonnetModel
+        ? {
+            percent: weekSonnetModel.percent,
+            ...(weekSonnetModel.resets ? { resets: weekSonnetModel.resets } : {}),
+        }
+        : undefined;
+    if (!session && !week)
+        return null;
+    const info = { fetchedAt: now };
+    if (session)
+        info.session = session;
+    if (week)
+        info.week = week;
+    if (weekModels.length > 0)
+        info.weekModels = weekModels;
+    if (weekSonnet)
+        info.weekSonnet = weekSonnet;
+    return info;
+}
+/**
+ * Pull the JSON object out of a PTY stream. Claude writes one JSON line, then may restore terminal modes
+ * with ANSI sequences; using the outermost braces excludes that terminal trailer without trying to strip
+ * arbitrary content from the JSON string itself.
+ */
+function resultFromPtyOutput(output) {
+    const start = output.indexOf("{");
+    const end = output.lastIndexOf("}");
+    if (start < 0 || end < start)
+        return "";
+    try {
+        const parsed = JSON.parse(output.slice(start, end + 1));
+        return typeof parsed.result === "string" ? parsed.result : "";
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * The real `runUsage` adapter. Claude 2.1.207+ omits account-limit lines when stdin is not a TTY, so a
+ * normal child-process pipe returns only the diagnostic "What's contributing" section and parses as no
+ * limits. Run the short-lived `/usage` command in its own isolated PTY instead. This is NOT a RoamCode tmux
+ * session; it exits with the command and never attaches to a user's chat. ANTHROPIC_API_KEY is stripped so
+ * subscription auth is used. NEVER rejects — resolves "" on spawn error, timeout, malformed JSON, or a
+ * missing `.result`.
+ */
+export function createUsageRunner(opts) {
+    return () => new Promise((resolve) => {
+        let settled = false;
+        const finish = (val) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(val);
+        };
+        // Subscription auth only (mirrors claude-process): never pass an API key to the child.
+        const env = { ...(opts.env ?? process.env) };
+        delete env.ANTHROPIC_API_KEY;
+        let child;
+        try {
+            const ptySpawn = opts.ptySpawn ??
+                ((file, args, options) => {
+                    const pty = require("node-pty");
+                    return pty.spawn(file, args, options);
+                });
+            child = ptySpawn(opts.claudeBin, ["-p", "/usage", "--output-format", "json", "--dangerously-skip-permissions"], { name: "xterm-256color", cols: 200, rows: 24, cwd: process.cwd(), env });
+        }
+        catch {
+            finish("");
+            return;
+        }
+        let stdout = "";
+        const timer = setTimeout(() => {
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                // already gone
+            }
+            finish("");
+        }, opts.timeoutMs ?? USAGE_TIMEOUT_MS);
+        child.onData((data) => (stdout += data));
+        child.onExit(() => {
+            clearTimeout(timer);
+            finish(resultFromPtyOutput(stdout));
+        });
+    });
+}
+/**
+ * Resolves + caches the parsed Claude usage. The cache stores the LAST GOOD snapshot; the TTL governs
+ * when `runUsage` is re-run. A failed/empty fetch returns the last good value (or null), never throws.
+ */
+export class UsageService {
+    runUsage;
+    now;
+    ttlMs;
+    cache;
+    constructor(deps) {
+        this.runUsage = deps.runUsage;
+        this.now = deps.now;
+        this.ttlMs = deps.ttlMs ?? USAGE_CACHE_MS;
+    }
+    /**
+     * Get the current usage. Within the TTL (and not forced) returns the cached snapshot WITHOUT
+     * re-spawning. Otherwise runs `runUsage`, parses, and (on success) caches it as the new last-good.
+     * A failed/empty refresh keeps the last good value (or null) and re-stamps the cache time so an
+     * outage doesn't re-spawn on every poll.
+     */
+    async getUsage(force = false) {
+        const now = this.now();
+        if (!force && this.cache && now - this.cache.at < this.ttlMs)
+            return this.cache.info;
+        const raw = await this.runUsage();
+        const parsed = parseUsage(raw, now);
+        // On a failed/empty refresh keep the last good snapshot if we have one, else null.
+        const info = parsed ?? this.cache?.info ?? null;
+        this.cache = { at: now, info };
+        return info;
+    }
+}
+/** Construct a UsageService with the real spawn adapter (the production wiring). */
+export function createUsageService(opts) {
+    return new UsageService({
+        runUsage: createUsageRunner({ claudeBin: opts.claudeBin, env: opts.env, timeoutMs: opts.timeoutMs }),
+        now: opts.now ?? (() => Date.now()),
+        ttlMs: opts.ttlMs,
+    });
+}

package/dist/vapid.d.ts

@@ -0,0 +1,17 @@
+export interface VapidKeys {
+    /** URL-safe base64 public key — safe to send to the browser for the push subscription. */
+    publicKey: string;
+    /** URL-safe base64 private key — NEVER leaves the server (signs pushes). */
+    privateKey: string;
+}
+export interface ResolveVapidKeysOptions {
+    dataDir: string;
+    /** Injectable generator for tests. Defaults to web-push's NIST P-256 generator. */
+    generate?: () => VapidKeys;
+}
+/**
+ * Generate the VAPID keypair on first run and persist it to `<dataDir>/vapid.json` (mode 0600 — the
+ * private key is a server secret). On subsequent runs the persisted pair is reused so existing
+ * browser subscriptions stay valid (rotating the key would invalidate every subscription).
+ */
+export declare function resolveVapidKeys(opts: ResolveVapidKeysOptions): VapidKeys;

package/dist/vapid.js

@@ -0,0 +1,31 @@
+import { chmodSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import webpush from "web-push";
+import { ensureDataDir } from "./data-dir.js";
+function defaultGenerate() {
+    const { publicKey, privateKey } = webpush.generateVAPIDKeys();
+    return { publicKey, privateKey };
+}
+/**
+ * Generate the VAPID keypair on first run and persist it to `<dataDir>/vapid.json` (mode 0600 — the
+ * private key is a server secret). On subsequent runs the persisted pair is reused so existing
+ * browser subscriptions stay valid (rotating the key would invalidate every subscription).
+ */
+export function resolveVapidKeys(opts) {
+    const path = join(opts.dataDir, "vapid.json");
+    try {
+        const existing = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof existing.publicKey === "string" && typeof existing.privateKey === "string") {
+            return { publicKey: existing.publicKey, privateKey: existing.privateKey };
+        }
+    }
+    catch {
+        // no vapid.json yet (or corrupt) — generate + persist below
+    }
+    const keys = (opts.generate ?? defaultGenerate)();
+    ensureDataDir(opts.dataDir);
+    // mode is honored only on CREATE; chmodSync unconditionally enforces 0600 even if the path existed.
+    writeFileSync(path, JSON.stringify(keys), { mode: 0o600 });
+    chmodSync(path, 0o600);
+    return keys;
+}

package/dist/web-push-send.d.ts

@@ -0,0 +1,20 @@
+import type { VapidKeys } from "./vapid.js";
+export interface PushRecipient {
+    endpoint: string;
+    p256dh: string;
+    auth: string;
+}
+export type PushSendFn = (sub: PushRecipient, payload: string) => Promise<{
+    statusCode?: number;
+}>;
+export interface CreateWebPushSendOptions {
+    vapid: VapidKeys;
+    /** VAPID subject: a mailto: or https: URL the push service can contact (web-push requires it). */
+    subject: string;
+}
+/**
+ * Bind a real Web Push sender. Maps our flat PushSubscriptionRecord to the {endpoint, keys} shape
+ * web-push.sendNotification expects, and normalizes the outcome to { statusCode } so the dispatcher
+ * can prune on 404/410 without depending on web-push's error type.
+ */
+export declare function createWebPushSend(opts: CreateWebPushSendOptions): PushSendFn;

package/dist/web-push-send.js

@@ -0,0 +1,21 @@
+import webpush from "web-push";
+/**
+ * Bind a real Web Push sender. Maps our flat PushSubscriptionRecord to the {endpoint, keys} shape
+ * web-push.sendNotification expects, and normalizes the outcome to { statusCode } so the dispatcher
+ * can prune on 404/410 without depending on web-push's error type.
+ */
+export function createWebPushSend(opts) {
+    webpush.setVapidDetails(opts.subject, opts.vapid.publicKey, opts.vapid.privateKey);
+    return async (sub, payload) => {
+        try {
+            const res = await webpush.sendNotification({ endpoint: sub.endpoint, keys: { p256dh: sub.p256dh, auth: sub.auth } }, payload);
+            return { statusCode: res.statusCode };
+        }
+        catch (err) {
+            const status = err.statusCode;
+            if (typeof status === "number")
+                return { statusCode: status };
+            throw err; // a non-HTTP failure (e.g. encryption) — let the dispatcher swallow it
+        }
+    };
+}

package/dist/ws-ticket.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Single-use, short-lived tickets for the terminal WebSocket handshake.
+ *
+ * WHY: a browser WebSocket cannot send an Authorization header, so the client historically put the
+ * LONG-LIVED access token in the WS URL (`?token=`). Query strings are routinely written into proxy /
+ * tunnel / access logs, so that leaked a full-access credential. The flow now is: POST /ws-ticket (over
+ * the normal header-authed API) → get a 32-byte ticket → open the WS with `?ticket=`. A logged ticket is
+ * worthless: it is consumed by the very connection that carried it (single-use) and dies within TTL_MS
+ * anyway. The legacy `?token=` path is kept for old bundles (see transport.ts) but is deprecated.
+ */
+/** Ticket lifetime. Long enough for the client to turn the POST response into a WS connect (even on a
+ *  slow mobile link), short enough that a logged/leaked ticket is stale almost immediately. */
+export declare const WS_TICKET_TTL_MS = 30000;
+export interface WsTicketStoreOptions {
+    /** Override the TTL (tests). Default {@link WS_TICKET_TTL_MS}. */
+    ttlMs?: number;
+    /** Injectable clock for tests. Default Date.now. */
+    now?: () => number;
+    /** Injectable ticket generator for tests. Default: 32 CSPRNG bytes, base64url. */
+    generate?: () => string;
+}
+/**
+ * In-memory single-use ticket store. Deliberately NOT persisted: a ticket outliving a server restart
+ * would defeat its 30s point, and the client just re-POSTs on reconnect. Expired entries are swept
+ * LAZILY on each issue/consume — issuance is token-gated + rate-limited, so the map stays tiny without
+ * a timer.
+ */
+export declare class WsTicketStore {
+    /** ticket → expiry (epoch ms). */
+    private readonly tickets;
+    private readonly ttlMs;
+    private readonly now;
+    private readonly generate;
+    constructor(opts?: WsTicketStoreOptions);
+    /** Mint a fresh single-use ticket. The response shape is exactly what POST /ws-ticket returns. */
+    issue(): {
+        ticket: string;
+        expiresInMs: number;
+    };
+    /** Consume a ticket: true exactly ONCE for a live ticket; false for unknown, expired, or already-used
+     *  (the entry is deleted on first consume, so a replayed WS URL is rejected). */
+    consume(ticket: string): boolean;
+    /** Drop expired entries so an unconsumed flood can't grow the map (lazy — no timer to leak). */
+    private sweep;
+    /** TEST ONLY: how many un-consumed tickets are currently held (post-sweep count). */
+    size(): number;
+}

package/dist/ws-ticket.js

@@ -0,0 +1,62 @@
+import { randomBytes } from "node:crypto";
+/**
+ * Single-use, short-lived tickets for the terminal WebSocket handshake.
+ *
+ * WHY: a browser WebSocket cannot send an Authorization header, so the client historically put the
+ * LONG-LIVED access token in the WS URL (`?token=`). Query strings are routinely written into proxy /
+ * tunnel / access logs, so that leaked a full-access credential. The flow now is: POST /ws-ticket (over
+ * the normal header-authed API) → get a 32-byte ticket → open the WS with `?ticket=`. A logged ticket is
+ * worthless: it is consumed by the very connection that carried it (single-use) and dies within TTL_MS
+ * anyway. The legacy `?token=` path is kept for old bundles (see transport.ts) but is deprecated.
+ */
+/** Ticket lifetime. Long enough for the client to turn the POST response into a WS connect (even on a
+ *  slow mobile link), short enough that a logged/leaked ticket is stale almost immediately. */
+export const WS_TICKET_TTL_MS = 30_000;
+/**
+ * In-memory single-use ticket store. Deliberately NOT persisted: a ticket outliving a server restart
+ * would defeat its 30s point, and the client just re-POSTs on reconnect. Expired entries are swept
+ * LAZILY on each issue/consume — issuance is token-gated + rate-limited, so the map stays tiny without
+ * a timer.
+ */
+export class WsTicketStore {
+    /** ticket → expiry (epoch ms). */
+    tickets = new Map();
+    ttlMs;
+    now;
+    generate;
+    constructor(opts = {}) {
+        this.ttlMs = opts.ttlMs ?? WS_TICKET_TTL_MS;
+        this.now = opts.now ?? Date.now;
+        this.generate = opts.generate ?? (() => randomBytes(32).toString("base64url"));
+    }
+    /** Mint a fresh single-use ticket. The response shape is exactly what POST /ws-ticket returns. */
+    issue() {
+        this.sweep();
+        const ticket = this.generate();
+        this.tickets.set(ticket, this.now() + this.ttlMs);
+        return { ticket, expiresInMs: this.ttlMs };
+    }
+    /** Consume a ticket: true exactly ONCE for a live ticket; false for unknown, expired, or already-used
+     *  (the entry is deleted on first consume, so a replayed WS URL is rejected). */
+    consume(ticket) {
+        this.sweep();
+        const expiresAt = this.tickets.get(ticket);
+        if (expiresAt === undefined)
+            return false;
+        this.tickets.delete(ticket); // single-use: gone whether it validates or not
+        return this.now() <= expiresAt;
+    }
+    /** Drop expired entries so an unconsumed flood can't grow the map (lazy — no timer to leak). */
+    sweep() {
+        const t = this.now();
+        for (const [ticket, expiresAt] of this.tickets) {
+            if (expiresAt < t)
+                this.tickets.delete(ticket);
+        }
+    }
+    /** TEST ONLY: how many un-consumed tickets are currently held (post-sweep count). */
+    size() {
+        this.sweep();
+        return this.tickets.size;
+    }
+}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@roamcode.ai/server",
+  "version": "1.0.0",
+  "description": "Host-native server for RoamCode",
+  "homepage": "https://roamcode.ai",
+  "bugs": "https://github.com/burakgon/roamcode/issues",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/burakgon/roamcode.git"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "roamcode-server": "./dist/start.js"
+  },
+  "dependencies": {
+    "@fastify/multipart": "^10.1.0",
+    "@fastify/static": "^9.3.0",
+    "@fastify/websocket": "^11.3.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "better-sqlite3": "^12.11.1",
+    "fastify": "^5.10.0",
+    "node-pty": "1.1.0",
+    "web-push": "^3.6.7",
+    "zod": "^4.4.3",
+    "@roamcode.ai/web": "1.0.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/web-push": "^3.6.4",
+    "@types/ws": "^8.18.1",
+    "ws": "^8.21.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "start": "node dist/start.js"
+  }
+}