@securecoms/agent-bridge 0.38.0 → 0.40.0

package/connectors/openclaw/openclaw-entry.outbound.test.ts

@@ -0,0 +1,217 @@
+// packages/connect-agent-bridge/connectors/openclaw/openclaw-entry.outbound.test.ts
+//
+// Item A (proactive delivery): the OpenClaw connector advertises the outbound
+// targets "owner" and "default". They are not channel ids. They resolve through
+// the bridge's bearer-gated GET /v1/owner-dm (the owner DM from the signed
+// manifest in force), and fail closed: a 404, any non-2xx, a network error or a
+// malformed body posts NOTHING and returns {ok:false, error: OWNER_DM_UNKNOWN_ERROR}.
+// Any other `to` keeps the explicit-channel behaviour.
+//
+// Drives the REAL plugin.gateway.startAccount path with a fake loopback
+// WebSocket and a fake fetch (same harness shape as openclaw-entry.inbound.test.ts).
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { buildConnectionFile, writeConnectionFile } from "../../src/service/connection-file.js";
+
+const BOUND_ID = "agent-identity";
+const PORT = 7097;
+const TOKEN_VALUE = "outbound-test-token";
+const ORIGINAL_CONN_FILE_ENV = process.env.SECURECOMS_CONNECTION_FILE;
+
+function waitFor(predicate: () => boolean, timeout = 3000): Promise<void> {
+  const start = Date.now();
+  return new Promise((resolve, reject) => {
+    const check = () => {
+      if (predicate()) return resolve();
+      if (Date.now() - start > timeout) return reject(new Error("waitFor: condition never became true"));
+      setTimeout(check, 5);
+    };
+    check();
+  });
+}
+
+function makeFakeWebSocket() {
+  const instances: any[] = [];
+  class FakeWebSocket {
+    listeners: Record<string, Array<(ev?: unknown) => void>> = {};
+    constructor(public url: string) { instances.push(this); }
+    addEventListener(type: string, cb: (ev?: unknown) => void) { (this.listeners[type] ??= []).push(cb); }
+    send() {}
+    close() { this._emit("close"); }
+    _emit(type: string, ev?: unknown) { for (const cb of this.listeners[type] ?? []) cb(ev ?? {}); }
+  }
+  return { FakeWebSocket, instances };
+}
+
+type OwnerDm =
+  | { kind: "ok"; body: unknown }
+  | { kind: "status"; status: number; body?: unknown }
+  | { kind: "network" }
+  | { kind: "badjson" };
+
+describe("openclaw-entry: outbound owner/default targets resolve through /v1/owner-dm", () => {
+  let home: string;
+  let controller: AbortController;
+  let sends: Array<Record<string, unknown>>;
+  let ownerDmCalls: Array<{ auth: string | null }>;
+  let ownerDm: OwnerDm;
+
+  beforeEach(() => {
+    home = mkdtempSync(join(tmpdir(), "sc-outbound-"));
+    const tokenFile = join(home, "bridge-token");
+    writeFileSync(tokenFile, TOKEN_VALUE, { mode: 0o600 });
+    writeConnectionFile(home, buildConnectionFile({
+      identityId: BOUND_ID, port: PORT, tokenFile, slug: "outbound-test", label: "Outbound Test",
+      instanceId: "outbound-test-instance", now: new Date().toISOString(),
+    }));
+    process.env.SECURECOMS_CONNECTION_FILE = join(home, ".securecoms", "connections", `${BOUND_ID}.json`);
+    sends = [];
+    ownerDmCalls = [];
+    ownerDm = { kind: "ok", body: { channel_id: "dm-1" } };
+    vi.stubGlobal("fetch", vi.fn(async (url: string, init?: RequestInit) => {
+      const u = String(url);
+      if (u.endsWith("/healthz")) return { ok: true, json: async () => ({ identity_id: BOUND_ID, joined_channels: 1 }) };
+      if (u.endsWith("/v1/owner-dm")) {
+        const h = (init?.headers ?? {}) as Record<string, string>;
+        ownerDmCalls.push({ auth: h.authorization ?? null });
+        if (ownerDm.kind === "network") throw new Error("ECONNREFUSED");
+        if (ownerDm.kind === "badjson") {
+          return { ok: true, status: 200, json: async () => { throw new SyntaxError("bad json"); }, text: async () => "<html>" };
+        }
+        if (ownerDm.kind === "status") {
+          return { ok: false, status: ownerDm.status, json: async () => ownerDm.kind === "status" ? ownerDm.body ?? {} : {}, text: async () => "" };
+        }
+        return { ok: true, status: 200, json: async () => ownerDm.body };
+      }
+      if (u.endsWith("/v1/send")) {
+        sends.push(JSON.parse(String(init?.body)));
+        return { ok: true, json: async () => ({ message_id: "m-1" }) };
+      }
+      if (u.endsWith("/v1/status")) return { ok: true, json: async () => ({ ok: true }) };
+      throw new Error(`unexpected fetch: ${u}`);
+    }));
+    controller = new AbortController();
+  });
+
+  afterEach(async () => {
+    controller.abort();
+    vi.unstubAllGlobals();
+    vi.unmock("node:os");
+    if (ORIGINAL_CONN_FILE_ENV === undefined) delete process.env.SECURECOMS_CONNECTION_FILE;
+    else process.env.SECURECOMS_CONNECTION_FILE = ORIGINAL_CONN_FILE_ENV;
+    vi.resetModules();
+  });
+
+  async function start() {
+    vi.resetModules();
+    vi.doMock("node:os", async (importOriginal) => {
+      const actual = await importOriginal<typeof import("node:os")>();
+      return { ...actual, homedir: () => home };
+    });
+    const mod = await import("./openclaw-entry.js");
+    let plugin: any;
+    mod.default.register({
+      runtime: { channel: {}, error: () => {} },
+      on: () => {},
+      registerTrustedToolPolicy: () => {},
+      registerChannel: ({ plugin: p }: { plugin: unknown }) => { plugin = p; },
+    });
+    const { FakeWebSocket, instances } = makeFakeWebSocket();
+    vi.stubGlobal("WebSocket", FakeWebSocket);
+    const account = plugin.config.resolveAccount({}, "default");
+    plugin.gateway.startAccount({ account, cfg: {}, log: () => {}, abortSignal: controller.signal }).catch(() => {});
+    await waitFor(() => instances.length >= 1);
+    instances[0]._emit("open");
+    return { plugin, mod };
+  }
+
+  const advertised = ["owner", "default"] as const;
+
+  it("keeps the advertised target labels unchanged", async () => {
+    const { plugin } = await start();
+    expect(plugin.outbound.targets).toEqual([
+      { id: "owner", label: "SecureComs Owner", accountId: "default" },
+      { id: "default", label: "SecureComs Owner (default)", accountId: "default" },
+    ]);
+  });
+
+  for (const to of advertised) {
+    it(`(a) to="${to}": resolves via /v1/owner-dm with the bearer and sends once to the resolved channel`, async () => {
+      const { plugin } = await start();
+      const res = await plugin.outbound.sendText({ text: "x", to, accountId: "default" });
+      expect(res).toEqual({ ok: true });
+      expect(ownerDmCalls).toEqual([{ auth: `Bearer ${TOKEN_VALUE}` }]);
+      expect(sends).toHaveLength(1);
+      expect(sends[0]).toEqual({ channel_id: "dm-1", text: "x" }); // no in_reply_to, no idempotency_key
+    });
+
+    it(`(b) to="${to}": a 404 posts nothing and returns the fixed error`, async () => {
+      const { plugin, mod } = await start();
+      ownerDm = { kind: "status", status: 404, body: { error: "owner_dm_unknown" } };
+      const res = await plugin.outbound.sendText({ text: "secret body", to, accountId: "default" });
+      expect(sends).toHaveLength(0);
+      expect(res.ok).toBe(false);
+      expect(res.error).toBe(mod.OWNER_DM_UNKNOWN_ERROR);
+      expect(res.error.length).toBeGreaterThan(0);
+      expect(res.error).not.toContain("secret body");
+    });
+  }
+
+  const failures: Array<[string, OwnerDm]> = [
+    ["a 500", { kind: "status", status: 500 }],
+    ["a 401", { kind: "status", status: 401 }],
+    ["a network error", { kind: "network" }],
+    ["a non-JSON 200 body", { kind: "badjson" }],
+    ["a 200 with no channel_id", { kind: "ok", body: {} }],
+    ["a 200 with an empty channel_id", { kind: "ok", body: { channel_id: "" } }],
+    ["a 200 with a non-string channel_id", { kind: "ok", body: { channel_id: 7 } }],
+    ["a 200 that resolves to the literal 'owner'", { kind: "ok", body: { channel_id: "owner" } }],
+    ["a 200 that resolves to the literal 'default'", { kind: "ok", body: { channel_id: "default" } }],
+  ];
+  for (const [name, mode] of failures) {
+    it(`(b) ${name} fails closed: no send, fixed error`, async () => {
+      const { plugin, mod } = await start();
+      ownerDm = mode;
+      const res = await plugin.outbound.sendText({ text: "x", to: "owner", accountId: "default" });
+      expect(sends).toHaveLength(0);
+      expect(res).toEqual({ ok: false, error: mod.OWNER_DM_UNKNOWN_ERROR });
+    });
+  }
+
+  it("(c) in no case does a send carry channel_id 'owner' or 'default'", async () => {
+    const { plugin } = await start();
+    const modes: OwnerDm[] = [
+      { kind: "ok", body: { channel_id: "dm-1" } },
+      { kind: "status", status: 404, body: { error: "owner_dm_unknown" } },
+      { kind: "status", status: 500 },
+      { kind: "network" },
+      { kind: "badjson" },
+      { kind: "ok", body: {} },
+    ];
+    for (const m of modes) {
+      ownerDm = m;
+      for (const to of advertised) await plugin.outbound.sendText({ text: "x", to, accountId: "default" });
+    }
+    expect(sends.length).toBeGreaterThan(0); // vacuity control: the ok mode did send
+    expect(sends.some((s) => s.channel_id === "owner" || s.channel_id === "default")).toBe(false);
+  });
+
+  it("any other `to` keeps the explicit-channel behaviour and never calls /v1/owner-dm", async () => {
+    const { plugin } = await start();
+    const res = await plugin.outbound.sendText({ text: "x", to: "chan-uuid-1", accountId: "default" });
+    expect(res).toEqual({ ok: true });
+    expect(ownerDmCalls).toHaveLength(0);
+    expect(sends).toEqual([{ channel_id: "chan-uuid-1", text: "x" }]);
+  });
+
+  it("no `to` still errors without a send or a lookup", async () => {
+    const { plugin } = await start();
+    const res = await plugin.outbound.sendText({ text: "x", accountId: "default" });
+    expect(res.ok).toBe(false);
+    expect(sends).toHaveLength(0);
+    expect(ownerDmCalls).toHaveLength(0);
+  });
+});

package/dist/bin.d.ts

@@ -29,6 +29,8 @@ export declare function slugFromCredentialPath(credentialPath: string): string;
 export declare function chooseInstallExecPath(runningExecPath: string, override: string | undefined, deps: ResolveNodeDeps): string;
 export declare function realGetHealth(port: number): DaemonHealth | null;
 export declare function realCopyConnector(srcDir: string, dstDir: string, harness: Harness): void;
+export declare function realReadHermesEnv(p: string): string | null;
+export declare function realAppendHermesEnv(p: string, text: string): void;
 /** The stderr line (with newline) a failed service verb prints. */
 export declare function formatServiceError(verb: string, e: unknown): string;
 /**

package/dist/bin.js

@@ -44763,6 +44763,16 @@ var BridgeAgent = class _BridgeAgent {
   async consumeUploaded(read) {
     if (!this.outboxPin || !await consumeOutboxFile(this.outboxPin, read)) writeServiceLog("warn", "vault_outbox.consume_failed");
   }
+  /**
+   * Item A (OQ-A1): the owner DM channel id of the signed manifest in force, else null. In force means the owner pin is
+   * set (same guard as applyManifest). No channelOwner, no listChannels heuristic, no fallback.
+   */
+  ownerDmChannelId() {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    const inForce = pin !== null ? this.toolGrantManifest : null;
+    const id = inForce?.owner_dm_channel_id;
+    return typeof id === "string" && id !== "" ? id : null;
+  }
   /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
   vaultOutboxPath() {
     return this.outboxPin?.dir ?? null;
@@ -50172,7 +50182,9 @@ function capabilities(opts) {
     // version this daemon parses into BridgeMessage.vault_refs (never fetched
     // on receipt) and opens with the R4 pins on /v1/vault-read. A daemon
     // without this field skips and acks a link, so the agent never sees it.
-    vault_ref: 1
+    vault_ref: 1,
+    // Item A: GET /v1/owner-dm resolves the literal `owner`/`default` cron target from the signed manifest in force.
+    owner_dm_route: 1
   };
 }
 var SEND_CAP = 64 * 1024;
@@ -50356,6 +50368,10 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/vault-outbox") {
         return json(res, 200, { path: agent.vaultOutboxPath() });
       }
+      if (method === "GET" && path === "/v1/owner-dm") {
+        const channelId = agent.ownerDmChannelId();
+        return channelId === null ? json(res, 404, { error: "owner_dm_unknown" }) : json(res, 200, { channel_id: channelId });
+      }
       if (method === "POST" && path === "/v1/send-attachment") {
         const parsed = sendAttachmentSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
@@ -51138,7 +51154,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
 var LOWER_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 // src/bin.ts
-import { readFileSync as readFileSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5, rmSync as rmSync8, existsSync as existsSync7, realpathSync as realpathSync4, readdirSync as readdirSync4, statSync as statSync8, chmodSync as chmodSync7 } from "node:fs";
+import { readFileSync as readFileSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5, appendFileSync, rmSync as rmSync8, existsSync as existsSync7, realpathSync as realpathSync4, readdirSync as readdirSync4, statSync as statSync8, chmodSync as chmodSync7 } from "node:fs";
 import { join as join27, dirname as dirname14, isAbsolute as isAbsolute3, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { homedir as homedir5, userInfo } from "node:os";
@@ -51587,6 +51603,36 @@ function enableHermesConfig(home, deps) {
     message: `enabled ${HERMES_PLUGIN_NAME} in ${path} (the original was backed up alongside it as config.yaml.bak-wire-<ts>-<pid>).`
   };
 }
+var HERMES_HOME_CHANNEL_KEY = "SECURECOMS_HOME_CHANNEL";
+var HERMES_HOME_CHANNEL_LINE = `${HERMES_HOME_CHANNEL_KEY}=owner`;
+function hermesEnvPath(home) {
+  return `${home}/.hermes/.env`;
+}
+var HOME_CHANNEL_ASSIGNMENT = new RegExp(`^\\s*(?:export\\s+)?${HERMES_HOME_CHANNEL_KEY}\\s*=`, "m");
+function homeChannelEnvAppendix(text) {
+  const current = text ?? "";
+  if (HOME_CHANNEL_ASSIGNMENT.test(current)) return null;
+  const sep = current === "" || current.endsWith("\n") ? "" : "\n";
+  return `${sep}${HERMES_HOME_CHANNEL_LINE}
+`;
+}
+function ensureHermesHomeChannel(home, deps) {
+  const path = hermesEnvPath(home);
+  try {
+    const appendix = homeChannelEnvAppendix(deps.readHermesEnv(path));
+    if (appendix === null) {
+      deps.log(`[securecoms] ${HERMES_HOME_CHANNEL_KEY} is already set in ${path}; kept as is.`);
+      return;
+    }
+    deps.appendHermesEnv(path, appendix);
+    deps.log(`[securecoms] set ${HERMES_HOME_CHANNEL_LINE} in ${path} (scheduled messages go to the owner's DM).`);
+  } catch {
+    deps.log(
+      `wire: could not update ${path}; scheduled messages need it. Add this line manually:
+  ${HERMES_HOME_CHANNEL_LINE}`
+    );
+  }
+}
 function parseArg(argv, flag) {
   const i = argv.indexOf(flag);
   return i >= 0 ? argv[i + 1] : void 0;
@@ -51635,6 +51681,7 @@ function runWire(deps) {
       );
       return 1;
     }
+    ensureHermesHomeChannel(deps.home, deps);
   }
   if (typeof entry.port === "number") {
     const h = deps.getHealth(entry.port);
@@ -52883,6 +52930,17 @@ function realBackupHermesConfig(p, originalText) {
 function realWriteHermesConfig(p, newText) {
   writeFileSync5(p, newText, "utf8");
 }
+function realReadHermesEnv(p) {
+  try {
+    return readFileSync17(p, "utf8");
+  } catch (e) {
+    if (e?.code === "ENOENT") return null;
+    throw e;
+  }
+}
+function realAppendHermesEnv(p, text) {
+  appendFileSync(p, text, { encoding: "utf8", mode: 384 });
+}
 function realWireArgv() {
   if (process.argv.includes("--harness")) return process.argv;
   const detected = detectHarness(homedir5(), realStatDir);
@@ -52906,7 +52964,9 @@ function realWireDeps() {
     connectorsSrcDir: (h) => connectorsSrcDir(import.meta.url, h),
     readHermesConfig: realReadHermesConfig,
     backupHermesConfig: realBackupHermesConfig,
-    writeHermesConfig: realWriteHermesConfig
+    writeHermesConfig: realWriteHermesConfig,
+    readHermesEnv: realReadHermesEnv,
+    appendHermesEnv: realAppendHermesEnv
   };
 }
 function runWireVerb(verb) {
@@ -53365,8 +53425,10 @@ export {
   formatServiceError,
   nodeMajorOk,
   parseVerb,
+  realAppendHermesEnv,
   realCopyConnector,
   realGetHealth,
+  realReadHermesEnv,
   runMode,
   slugFromCredentialPath,
   startThenServe,

package/dist/bridge-agent.d.ts

@@ -2539,6 +2539,11 @@ export declare class BridgeAgent {
     }>;
     /** Audit 2026-10-30 MED 5: an uploaded file leaves the outbox (no plaintext lingers). Content-free log. */
     private consumeUploaded;
+    /**
+     * Item A (OQ-A1): the owner DM channel id of the signed manifest in force, else null. In force means the owner pin is
+     * set (same guard as applyManifest). No channelOwner, no listChannels heuristic, no fallback.
+     */
+    ownerDmChannelId(): string | null;
     /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
     vaultOutboxPath(): string | null;
     /** Download + verify + decrypt a vault file node. Returns the plaintext

package/dist/http-server.d.ts

@@ -58,6 +58,7 @@ export declare function capabilities(opts: {
     send_types: string[];
     webhook_push: boolean;
     vault_ref: number;
+    owner_dm_route: number;
 };
 export declare const memoryRecordSchema: z.ZodObject<{
     conversation_id: z.ZodString;

package/dist/index.js

@@ -44477,6 +44477,16 @@ var BridgeAgent = class _BridgeAgent {
   async consumeUploaded(read) {
     if (!this.outboxPin || !await consumeOutboxFile(this.outboxPin, read)) writeServiceLog2("warn", "vault_outbox.consume_failed");
   }
+  /**
+   * Item A (OQ-A1): the owner DM channel id of the signed manifest in force, else null. In force means the owner pin is
+   * set (same guard as applyManifest). No channelOwner, no listChannels heuristic, no fallback.
+   */
+  ownerDmChannelId() {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    const inForce = pin !== null ? this.toolGrantManifest : null;
+    const id = inForce?.owner_dm_channel_id;
+    return typeof id === "string" && id !== "" ? id : null;
+  }
   /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
   vaultOutboxPath() {
     return this.outboxPin?.dir ?? null;
@@ -50032,7 +50042,9 @@ function capabilities(opts) {
     // version this daemon parses into BridgeMessage.vault_refs (never fetched
     // on receipt) and opens with the R4 pins on /v1/vault-read. A daemon
     // without this field skips and acks a link, so the agent never sees it.
-    vault_ref: 1
+    vault_ref: 1,
+    // Item A: GET /v1/owner-dm resolves the literal `owner`/`default` cron target from the signed manifest in force.
+    owner_dm_route: 1
   };
 }
 var SEND_CAP = 64 * 1024;
@@ -50216,6 +50228,10 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/vault-outbox") {
         return json(res, 200, { path: agent.vaultOutboxPath() });
       }
+      if (method === "GET" && path === "/v1/owner-dm") {
+        const channelId = agent.ownerDmChannelId();
+        return channelId === null ? json(res, 404, { error: "owner_dm_unknown" }) : json(res, 200, { channel_id: channelId });
+      }
       if (method === "POST" && path === "/v1/send-attachment") {
         const parsed = sendAttachmentSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);

package/dist/service/wire.d.ts

@@ -60,6 +60,14 @@ export interface WireDeps extends HermesConfigIoDeps {
      * tests and never inspects the path for its own sake).
      */
     connectorsSrcDir: (harness: Harness) => string;
+    /** The Hermes profile env file's text; null when the file does not exist.
+     *  Throws on any other read failure, so an unreadable file is never
+     *  mistaken for an absent key (see ensureHermesHomeChannel). */
+    readHermesEnv: (path: string) => string | null;
+    /** Appends `text` to the env file (creating it 0600 when missing). An
+     *  append never rewrites another line and never changes an existing
+     *  file's mode. */
+    appendHermesEnv: (path: string, text: string) => void;
 }
 /**
  * Detects an installed harness by probing well-known home-relative dirs.
@@ -136,6 +144,22 @@ export declare function enableHermesConfig(home: string, deps: HermesConfigIoDep
     ok: boolean;
     message: string;
 };
+/** The Hermes cron home-channel env var (the connector registers it as
+ *  `cron_deliver_env_var`) and the value `wire` sets: the literal `owner`,
+ *  which the connector resolves only through GET /v1/owner-dm (Item A). */
+export declare const HERMES_HOME_CHANNEL_KEY = "SECURECOMS_HOME_CHANNEL";
+export declare const HERMES_HOME_CHANNEL_LINE = "SECURECOMS_HOME_CHANNEL=owner";
+/** The env file Hermes loads for the profile `wire` targets: `<HERMES_HOME>/.env`,
+ *  with HERMES_HOME the default `~/.hermes` (the same profile scope as
+ *  `hermesConfigPath`). */
+export declare function hermesEnvPath(home: string): string;
+/** The text to append so the env file sets the home channel, or null when the
+ *  key is already assigned (any value, including an owner-set channel id or an
+ *  empty one: `wire` never overwrites it). Pure. */
+export declare function homeChannelEnvAppendix(text: string | null): string | null;
+/** Sets the Hermes cron home channel when absent. Never fatal to `wire`: the
+ *  connector is wired without it, and a failure prints the manual line. */
+export declare function ensureHermesHomeChannel(home: string, deps: Pick<WireDeps, "readHermesEnv" | "appendHermesEnv" | "log">): void;
 /**
  * Installs the reference connector into the harness's plugin dir and drops
  * an explicit securecoms.binding.json naming the resolved agent's identity.

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.38.0";
+export declare const BRIDGE_VERSION = "0.40.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.38.0",
+  "version": "0.40.0",
   "type": "module",
   "engines": {
     "node": ">=24"