@sanlabs/sanbox-cli 0.0.4 → 0.0.9

package/dist/config.js

@@ -1,7 +1,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import { CliError, commandAction } from "./errors.js";
+import { userSessionStore } from "./userSession.js";
 export const defaultApiUrl = "https://console.sanbox.cloud";
+export const resolveApiUrl = (flags = {}) => String(flags["api-url"] || process.env.SANBOX_API_URL || readLocalConfig().api_url || defaultApiUrl).replace(/\/+$/, "");
 export const readLocalConfig = (cwd = process.cwd()) => {
     const configPath = path.join(cwd, ".sanbox", "config.json");
     try {
@@ -11,7 +13,6 @@ export const readLocalConfig = (cwd = process.cwd()) => {
         const record = parsed;
         return {
             api_url: typeof record.api_url === "string" ? record.api_url : undefined,
-            org: typeof record.org === "string" ? record.org : undefined,
             default_template: typeof record.default_template === "string" ? record.default_template : undefined
         };
     }
@@ -21,22 +22,31 @@ export const readLocalConfig = (cwd = process.cwd()) => {
         throw error;
     }
 };
-export const readConfig = (flags = {}, options = {}) => {
-    const localConfig = readLocalConfig();
-    const apiUrl = String(flags["api-url"] || process.env.SANBOX_API_URL || localConfig.api_url || defaultApiUrl).replace(/\/+$/, "");
-    const org = String(flags.org || process.env.SANBOX_ORG || localConfig.org || "").trim();
-    const apiKey = process.env.SANBOX_API_KEY || "";
-    if (options.requireOrg !== false && !org) {
-        throw new CliError("org_required", "Organization context is required.", {
-            nextActions: [commandAction(["sanbox", "context", "--json"], "Select an organization and retry with SANBOX_ORG set.", { SANBOX_ORG: "<org-slug>" })]
+export const readConfig = (flags = {}) => {
+    const apiUrl = resolveApiUrl(flags);
+    const environmentApiKey = process.env.SANBOX_API_KEY || "";
+    const savedSession = environmentApiKey ? null : userSessionStore.read(apiUrl);
+    if (savedSession && Date.parse(savedSession.expiresAt) <= Date.now())
+        userSessionStore.delete(apiUrl);
+    const apiKey = environmentApiKey || (savedSession && Date.parse(savedSession.expiresAt) > Date.now() ? savedSession.accessToken : "");
+    if (!apiKey) {
+        throw new CliError("authentication_required", "Sign in with sanbox login or set SANBOX_API_KEY for automation.", {
+            nextActions: [commandAction(["sanbox", "login"], "Sign in with your Sanbox user account.")]
         });
     }
-    if (!apiKey) {
-        throw new CliError("api_key_required", "SANBOX_API_KEY is required.", {
-            nextActions: [commandAction(["sanbox", "auth", "check", "--json"], "Set a Sanbox control-plane API key and check access.", { SANBOX_API_KEY: "<sanbox-api-key>" })]
+    return { apiUrl, apiKey };
+};
+export const readUserConfig = (flags = {}, sessionStore = userSessionStore) => {
+    const apiUrl = resolveApiUrl(flags);
+    const session = sessionStore.read(apiUrl);
+    if (session && Date.parse(session.expiresAt) <= Date.now())
+        sessionStore.delete(apiUrl);
+    if (!session || Date.parse(session.expiresAt) <= Date.now()) {
+        throw new CliError("user_login_required", "SSH requires a Sanbox user login. Run sanbox login.", {
+            nextActions: [commandAction(["sanbox", "login"], "Sign in with the account that owns the computer.")]
         });
     }
-    return { apiUrl, org, apiKey };
+    return { apiUrl, apiKey: session.accessToken };
 };
 export function readTemplateSelection(flags = {}, options = {}) {
     const flagValue = flags.template;
@@ -52,7 +62,7 @@ export function readTemplateSelection(flags = {}, options = {}) {
         return null;
     throw new CliError("template_required", "A template must be selected explicitly.", {
         nextActions: [
-            commandAction(["sanbox", "templates", "list", "--json"], "List templates available to the selected organization."),
+            commandAction(["sanbox", "templates", "list", "--json"], "List templates available to the API key's organization."),
             commandAction(["sanbox", "run", "<task>", "--template", "<template-id>"], "Run with an explicit template."),
             commandAction(["sanbox", "context", "--json"], "Select a template for this shell and inspect the resolved context.", { SANBOX_TEMPLATE: "<template-id>" })
         ]

package/dist/deviceLogin.js

@@ -0,0 +1,106 @@
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import os from "node:os";
+import { CliError } from "./errors.js";
+const loginRequestIdPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const responseBody = async (response) => {
+    const text = await response.text();
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { error: text };
+    }
+};
+const responseError = (response, body) => new CliError("cli_login_failed", typeof body.error === "string" ? body.error : response.statusText || "Sanbox login failed.", { status: response.status });
+export const openBrowser = (url, platform = process.platform) => {
+    const command = platform === "darwin" ? "open" : platform === "win32" ? "rundll32" : "xdg-open";
+    const args = platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+    try {
+        const child = spawn(command, args, { detached: true, stdio: "ignore" });
+        child.once("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+export const loginWithBrowser = async (options) => {
+    const fetchImpl = options.fetchImpl || fetch;
+    const sleep = options.sleep || ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    const verifier = options.verifier || randomBytes(32).toString("base64url");
+    const challenge = createHash("sha256").update(verifier, "utf8").digest("base64url");
+    const requestResponse = await fetchImpl(`${options.apiUrl}/v1/cli-auth/requests`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            device_challenge: challenge,
+            device_name: options.deviceName || `${os.hostname()} local terminal`
+        })
+    });
+    const requestBody = await responseBody(requestResponse);
+    if (!requestResponse.ok)
+        throw responseError(requestResponse, requestBody);
+    const request = requestBody;
+    let verificationUrl;
+    try {
+        verificationUrl = new URL(request.verification_url);
+    }
+    catch {
+        throw new CliError("cli_login_invalid", "Sanbox returned an invalid login request.");
+    }
+    if (!loginRequestIdPattern.test(request.request_id || "") ||
+        !request.user_code ||
+        verificationUrl.origin !== new URL(options.apiUrl).origin ||
+        !Number.isFinite(Date.parse(request.expires_at)) ||
+        Date.parse(request.expires_at) <= Date.now()) {
+        throw new CliError("cli_login_invalid", "Sanbox returned an invalid login request.");
+    }
+    const browserOpened = options.launchBrowser ? options.launchBrowser(request.verification_url) : false;
+    options.onPrompt?.(request, browserOpened);
+    const intervalMs = Math.max(1_000, Math.min(10_000, Number(request.interval_seconds || 2) * 1_000));
+    while (Date.now() < Date.parse(request.expires_at)) {
+        await sleep(intervalMs);
+        const tokenResponse = await fetchImpl(`${options.apiUrl}/v1/cli-auth/requests/${encodeURIComponent(request.request_id)}/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ device_verifier: verifier })
+        });
+        const tokenBody = await responseBody(tokenResponse);
+        if (tokenResponse.status === 202)
+            continue;
+        if (!tokenResponse.ok)
+            throw responseError(tokenResponse, tokenBody);
+        const result = tokenBody;
+        if (!result.access_token?.startsWith("sbx_user_") ||
+            !result.email ||
+            !result.organization?.id ||
+            !result.organization.slug ||
+            !result.organization.name ||
+            !Number.isFinite(Date.parse(result.expires_at)) ||
+            Date.parse(result.expires_at) <= Date.now()) {
+            throw new CliError("cli_login_invalid", "Sanbox returned an invalid user session.");
+        }
+        return {
+            accessToken: result.access_token,
+            apiUrl: options.apiUrl,
+            email: result.email,
+            organization: result.organization,
+            expiresAt: result.expires_at
+        };
+    }
+    throw new CliError("cli_login_expired", "Sanbox login expired. Run sanbox login again.");
+};
+export const revokeUserSession = async (apiUrl, accessToken, fetchImpl = fetch) => {
+    const response = await fetchImpl(`${apiUrl}/v1/cli-auth/session`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (response.ok || response.status === 401)
+        return;
+    const body = await responseBody(response);
+    throw responseError(response, body);
+};

package/dist/fileAccess.js

@@ -0,0 +1,16 @@
+import { CliError } from "./errors.js";
+const durationPattern = /^(\d+)(s|m|h|d)$/;
+export const parseFileAccessExpiry = (value) => {
+    const normalized = value.trim().toLowerCase();
+    const match = durationPattern.exec(normalized);
+    if (!match) {
+        throw new CliError("invalid_file_access_expiry", "--expires must be a duration such as 15m, 1h, or 1d.");
+    }
+    const amount = Number(match[1]);
+    const multiplier = { s: 1, m: 60, h: 3600, d: 86400 }[match[2]];
+    const seconds = amount * multiplier;
+    if (!Number.isSafeInteger(seconds) || seconds < 60 || seconds > 7 * 86400) {
+        throw new CliError("invalid_file_access_expiry", "--expires must be between 60s and 7d.");
+    }
+    return seconds;
+};

package/dist/output.js

@@ -77,7 +77,9 @@ export const summarizeRun = (payload) => {
     const selection = [
         templateId ? `template=${templateId}` : "",
         run.provider_id ? `provider=${run.provider_id}` : "",
-        run.model_id ? `model=${run.model_id}` : ""
+        run.model_id ? `model=${run.model_id}` : "",
+        run.sandbox_state ? `sandbox=${run.sandbox_state}` : "",
+        run.snapshot_generation ? `snapshot=${run.snapshot_generation}` : ""
     ].filter(Boolean).join(" ");
     return `${run.id} ${run.status}${selection ? ` ${selection}` : ""}${run.exit_code === null ? "" : ` exit=${run.exit_code}`}${run.error ? ` error=${run.error}` : ""}`;
 };

package/dist/runs.js

@@ -2,7 +2,7 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { buildInputBundle } from "./inputs.js";
-const terminalStatuses = new Set(["completed", "failed", "canceled", "expired"]);
+const terminalStatuses = new Set(["completed", "failed", "canceled"]);
 export const isTerminalRun = (run) => terminalStatuses.has(run.status);
 export const waitForRun = async (client, runId, options = {}) => {
     const pollIntervalMs = options.pollIntervalMs ?? 2000;
@@ -16,6 +16,25 @@ export const waitForRun = async (client, runId, options = {}) => {
     }
     return payload;
 };
+export const waitForSandboxState = async (client, runId, target, options = {}) => {
+    const pollIntervalMs = options.pollIntervalMs ?? 2000;
+    const deadline = Date.now() + (options.timeoutSeconds ?? 1800) * 1000;
+    let payload = await client.getRun(runId);
+    while (payload.run.sandbox_state !== target) {
+        if (payload.run.sandbox_state === "error" || payload.run.sandbox_state === "deleted") {
+            throw new Error(`Sandbox entered ${payload.run.sandbox_state} while waiting for ${target}.`);
+        }
+        if (target === "running" && payload.run.sandbox_state === "paused") {
+            throw new Error("Sandbox returned to paused before the manual lease became ready.");
+        }
+        if (Date.now() > deadline) {
+            throw new Error(`Timed out waiting for sandbox ${runId} to become ${target}.`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+        payload = await client.getRun(runId);
+    }
+    return payload;
+};
 export const createRun = async (client, options) => {
     let inputCollectionId;
     if (options.inputs.length > 0) {
@@ -31,8 +50,7 @@ export const createRun = async (client, options) => {
         external_run_id: options.externalRunId,
         workload_id: options.templateId,
         instruction: options.instruction,
-        ...(inputCollectionId ? { input_collection_id: inputCollectionId } : {}),
-        retention_ttl_seconds: options.retentionTtlSeconds
+        ...(inputCollectionId ? { input_collection_id: inputCollectionId } : {})
     });
 };
 export const readTasks = async (tasksPath) => {

package/dist/ssh.js

@@ -0,0 +1,129 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { WebSocket } from "ws";
+import { CliError } from "./errors.js";
+const waitForCommand = (command, args, environment = process.env) => new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: "inherit", env: environment });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+        if (signal) {
+            resolve(128 + (os.constants.signals[signal] || 0));
+            return;
+        }
+        resolve(code ?? 1);
+    });
+});
+export const sshArguments = (session, privateKeyPath, knownHostsPath, proxyCommand = "sanbox ssh-proxy") => [
+    "-F", os.devNull,
+    "-o", `ProxyCommand=${proxyCommand}`,
+    "-o", `IdentityFile=${privateKeyPath}`,
+    "-o", "IdentitiesOnly=yes",
+    "-o", `UserKnownHostsFile=${knownHostsPath}`,
+    "-o", "StrictHostKeyChecking=yes",
+    "-o", `HostKeyAlias=${session.host_alias}`,
+    "-o", "PasswordAuthentication=no",
+    "-o", "KbdInteractiveAuthentication=no",
+    "-o", "ClearAllForwardings=yes",
+    `${session.username}@${session.host_alias}`
+];
+export const sshProxyEnvironment = (apiUrl, websocketUrl, environment = process.env) => {
+    const childEnvironment = { ...environment };
+    delete childEnvironment.SANBOX_API_KEY;
+    childEnvironment.SANBOX_SSH_WEBSOCKET_URL = websocketUrl;
+    childEnvironment.SANBOX_SSH_ORIGIN = new URL(apiUrl).origin;
+    return childEnvironment;
+};
+export const openSSH = async (client, runId) => {
+    const temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "sanbox-ssh-"));
+    const privateKeyPath = path.join(temporaryDirectory, "id_ed25519");
+    const publicKeyPath = `${privateKeyPath}.pub`;
+    const knownHostsPath = path.join(temporaryDirectory, "known_hosts");
+    try {
+        let keygenExit;
+        try {
+            keygenExit = await waitForCommand("ssh-keygen", [
+                "-q", "-t", "ed25519", "-N", "", "-C", "sanbox-ephemeral", "-f", privateKeyPath
+            ]);
+        }
+        catch {
+            throw new CliError("ssh_client_unavailable", "OpenSSH ssh-keygen is required for sanbox ssh.");
+        }
+        if (keygenExit !== 0) {
+            throw new CliError("ssh_keygen_failed", "Could not generate the ephemeral SSH key.");
+        }
+        const publicKey = (await fs.readFile(publicKeyPath, "utf8")).trim();
+        const session = await client.createSSHSession(runId, publicKey);
+        await fs.writeFile(knownHostsPath, `${session.host_alias} ${session.host_public_key}\n`, { mode: 0o600 });
+        const environment = sshProxyEnvironment(client.config.apiUrl, session.websocket_url);
+        const proxyCommand = process.env.SANBOX_SSH_PROXY_COMMAND || "sanbox ssh-proxy";
+        try {
+            return await waitForCommand("ssh", sshArguments(session, privateKeyPath, knownHostsPath, proxyCommand), environment);
+        }
+        catch {
+            throw new CliError("ssh_client_unavailable", "The OpenSSH client is required for sanbox ssh.");
+        }
+    }
+    finally {
+        await fs.rm(temporaryDirectory, { recursive: true, force: true });
+    }
+};
+export const runSSHProxy = async () => {
+    const url = process.env.SANBOX_SSH_WEBSOCKET_URL;
+    if (!url)
+        throw new CliError("ssh_session_required", "SANBOX_SSH_WEBSOCKET_URL is required by the SSH proxy.");
+    const origin = process.env.SANBOX_SSH_ORIGIN;
+    process.stdin.pause();
+    const socket = new WebSocket(url, origin ? { origin } : undefined);
+    socket.binaryType = "nodebuffer";
+    return await new Promise((resolve, reject) => {
+        let completed = false;
+        const finish = (code) => {
+            if (completed)
+                return;
+            completed = true;
+            process.stdin.pause();
+            resolve(code);
+        };
+        const closeSocket = () => {
+            if (socket.readyState === WebSocket.OPEN)
+                socket.close(1011, "SSH proxy failed");
+            else if (socket.readyState === WebSocket.CONNECTING)
+                socket.terminate();
+        };
+        socket.once("open", () => {
+            process.stdin.on("data", (data) => {
+                if (socket.readyState === WebSocket.OPEN)
+                    socket.send(data, { binary: true });
+            });
+            process.stdin.once("end", () => {
+                if (socket.readyState === WebSocket.OPEN)
+                    socket.send(JSON.stringify({ type: "close" }));
+            });
+            process.stdin.resume();
+        });
+        socket.on("message", (data, isBinary) => {
+            if (isBinary) {
+                process.stdout.write(Buffer.isBuffer(data) ? data : Buffer.from(data));
+                return;
+            }
+            try {
+                const message = JSON.parse(String(data));
+                if (message.type === "error") {
+                    process.stderr.write(`${typeof message.message === "string" ? message.message : "SSH connection failed."}\n`);
+                    closeSocket();
+                    finish(1);
+                }
+            }
+            catch {
+                // Ignore unknown control messages. SSH bytes are always binary.
+            }
+        });
+        socket.once("close", (code) => finish(code === 1000 ? 0 : 1));
+        socket.once("error", (error) => {
+            closeSocket();
+            reject(error);
+        });
+    });
+};

package/dist/userSession.js

@@ -0,0 +1,124 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { CliError, commandAction } from "./errors.js";
+export const defaultCredentialsPath = path.join(os.homedir(), ".sanbox", "credentials.json");
+const emptyCredentials = () => ({ version: 1, sessions: {} });
+const originFor = (apiUrl) => new URL(apiUrl).origin;
+const invalidCredentials = (credentialsPath) => new CliError("credential_store_invalid", `The saved Sanbox user sessions in ${credentialsPath} are invalid. Remove the file, then run sanbox login.`);
+const unavailable = (credentialsPath) => new CliError("credential_store_unavailable", `The Sanbox CLI could not access ${credentialsPath}.`, {
+    nextActions: [commandAction(["sanbox", "login"], "Make sure your user account can read and write the ~/.sanbox directory, then sign in again.")]
+});
+const parseSession = (value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    const organization = record.organization;
+    if (typeof record.accessToken !== "string" || !record.accessToken.startsWith("sbx_user_") ||
+        typeof record.apiUrl !== "string" || typeof record.email !== "string" ||
+        typeof record.expiresAt !== "string" || !organization || typeof organization !== "object" ||
+        Array.isArray(organization))
+        return null;
+    const org = organization;
+    if (typeof org.id !== "string" || typeof org.slug !== "string" || typeof org.name !== "string")
+        return null;
+    return {
+        accessToken: record.accessToken,
+        apiUrl: record.apiUrl,
+        email: record.email,
+        expiresAt: record.expiresAt,
+        organization: { id: org.id, slug: org.slug, name: org.name }
+    };
+};
+const parseCredentials = (value, credentialsPath) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw invalidCredentials(credentialsPath);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw invalidCredentials(credentialsPath);
+    }
+    const record = parsed;
+    if (record.version !== 1 || !record.sessions || typeof record.sessions !== "object" || Array.isArray(record.sessions)) {
+        throw invalidCredentials(credentialsPath);
+    }
+    const sessions = {};
+    for (const [origin, value] of Object.entries(record.sessions)) {
+        const session = parseSession(value);
+        if (!session || originFor(session.apiUrl) !== origin)
+            throw invalidCredentials(credentialsPath);
+        sessions[origin] = session;
+    }
+    return { version: 1, sessions };
+};
+const readCredentials = (credentialsPath) => {
+    try {
+        return parseCredentials(fs.readFileSync(credentialsPath, "utf8"), credentialsPath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return emptyCredentials();
+        if (error instanceof CliError)
+            throw error;
+        throw unavailable(credentialsPath);
+    }
+};
+const writeCredentials = (credentialsPath, credentials) => {
+    const directory = path.dirname(credentialsPath);
+    const temporaryPath = path.join(directory, `.${path.basename(credentialsPath)}.${process.pid}.${randomUUID()}.tmp`);
+    try {
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        if (process.platform !== "win32")
+            fs.chmodSync(directory, 0o700);
+        fs.writeFileSync(temporaryPath, `${JSON.stringify(credentials, null, 2)}\n`, {
+            encoding: "utf8",
+            flag: "wx",
+            mode: 0o600
+        });
+        fs.renameSync(temporaryPath, credentialsPath);
+        if (process.platform !== "win32")
+            fs.chmodSync(credentialsPath, 0o600);
+    }
+    catch {
+        try {
+            fs.unlinkSync(temporaryPath);
+        }
+        catch {
+            // The temporary file may not have been created.
+        }
+        throw unavailable(credentialsPath);
+    }
+};
+export const createUserSessionStore = (credentialsPath = defaultCredentialsPath) => ({
+    read(apiUrl) {
+        return readCredentials(credentialsPath).sessions[originFor(apiUrl)] || null;
+    },
+    write(session) {
+        const credentials = readCredentials(credentialsPath);
+        credentials.sessions[originFor(session.apiUrl)] = session;
+        writeCredentials(credentialsPath, credentials);
+    },
+    delete(apiUrl) {
+        const credentials = readCredentials(credentialsPath);
+        const origin = originFor(apiUrl);
+        if (!credentials.sessions[origin])
+            return;
+        delete credentials.sessions[origin];
+        if (Object.keys(credentials.sessions).length === 0) {
+            try {
+                fs.unlinkSync(credentialsPath);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw unavailable(credentialsPath);
+            }
+            return;
+        }
+        writeCredentials(credentialsPath, credentials);
+    }
+});
+export const userSessionStore = createUserSessionStore();

package/dist/version.js

@@ -1 +1 @@
-export const version = "0.0.4";
+export const version = "0.0.9";

package/dist/watch.js

@@ -1,6 +1,6 @@
 import { SanboxApiError } from "./api.js";
-const terminalStatuses = new Set(["completed", "failed", "canceled", "expired"]);
-const terminalEventKinds = new Set(["run.completed", "run.failed", "run.canceled", "run.expired"]);
+const terminalStatuses = new Set(["completed", "failed", "canceled"]);
+const terminalEventKinds = new Set(["run.completed", "run.failed", "run.canceled"]);
 const retryableNetworkCodes = new Set(["ECONNRESET", "ECONNREFUSED", "EPIPE", "ETIMEDOUT", "EAI_AGAIN", "ENETUNREACH"]);
 export class WatchInterruptedError extends Error {
     constructor() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanlabs/sanbox-cli",
-  "version": "0.0.4",
+  "version": "0.0.9",
   "private": false,
   "repository": {
     "type": "git",
@@ -29,10 +29,12 @@
   "dependencies": {
     "fast-glob": "^3.3.3",
     "ignore": "^7.0.5",
+    "ws": "^8.21.3",
     "yazl": "^3.3.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
+    "@types/ws": "^8.18.1",
     "@types/yazl": "^3.3.0",
     "tsx": "^4.21.0",
     "typescript": "^6.0.3"