agent-whiteboard 1.0.0

package/dist/server/snapshot-writer.js

@@ -0,0 +1,117 @@
+import { existsSync, mkdirSync, readdirSync, rmSync, unlinkSync, writeFileSync } from "fs";
+import { join, resolve, sep } from "path";
+import { getSnapshotsRoot } from "./paths.js";
+import { readSnapshotIdSafe } from "./snapshot-reader.js";
+import { isValidSnapshotFilename, validateWorkspaceInput } from "./validate.js";
+import { deleteViewports } from "./viewport-cache.js";
+/** Generate a snapshot id up front, before the write happens — lets callers
+ * broadcast the id to the browser (e.g. for viewport-cache keying) without
+ * waiting on the (synchronous, but logically separate) disk write. */
+export function generateSnapshotId() {
+    return crypto.randomUUID();
+}
+export function saveSnapshot(frames, options, rawPayload, id) {
+    try {
+        const { workspace } = options;
+        const root = getSnapshotsRoot();
+        const dir = join(root, workspace);
+        mkdirSync(dir, { recursive: true });
+        const now = new Date();
+        const usedId = id ?? crypto.randomUUID();
+        // Include the (already-unique) id so two writes in the same second never collide.
+        const filename = `${formatTimestamp(now)}_${usedId}_screen.json`;
+        const content = {
+            id: usedId,
+            timestamp: now.toISOString(),
+            workspace,
+            cursor: 0,
+            frames,
+            ...(options.title !== undefined ? { title: options.title } : {}),
+            ...(options.node_to_frame !== undefined ? { nodeToFrame: options.node_to_frame } : {}),
+            ...(rawPayload !== undefined ? { rawPayload } : {}),
+        };
+        writeFileSync(join(dir, filename), JSON.stringify(content, null, 2), "utf-8");
+        return usedId;
+    }
+    catch (err) {
+        console.error("[agent-whiteboard] snapshot write failed:", err instanceof Error ? err.message : String(err));
+        return undefined;
+    }
+}
+function formatTimestamp(d) {
+    const p = (n) => String(n).padStart(2, "0");
+    return (`${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}` +
+        `_${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`);
+}
+/**
+ * Workspace validation for the delete endpoints (NF26, v0.28 Sprint 59):
+ * builds on the shared `validateWorkspaceInput()` (render-core.ts) and adds
+ * the two checks specific to deleting an existing directory — containment
+ * (belt-and-suspenders against a resolved path escaping the snapshots root,
+ * e.g. workspace ".", B6) and existence (404 if the workspace was never
+ * created or was already deleted).
+ */
+export function validateWorkspaceForDelete(workspace, root) {
+    const validated = validateWorkspaceInput(workspace);
+    if (!validated.ok) {
+        return { ok: false, error: validated.error, status: 400 };
+    }
+    const dir = join(root, validated.workspace);
+    if (!resolve(dir).startsWith(resolve(root) + sep)) {
+        return { ok: false, error: "invalid workspace: path traversal not allowed", status: 400 };
+    }
+    if (!existsSync(dir)) {
+        return { ok: false, error: "workspace not found", status: 404 };
+    }
+    return { ok: true, workspace: validated.workspace };
+}
+/**
+ * Deletes the given snapshot filenames from `workspace` and cleans up their
+ * viewport-cache entries (C3, `02`). Missing files are silently skipped.
+ * Shared by POST /snapshots/delete-files (NF26, v0.28 Sprint 59).
+ */
+export function deleteSnapshotFiles(workspace, root, filenames) {
+    for (const f of filenames) {
+        if (!isValidSnapshotFilename(f)) {
+            return { ok: false, error: `invalid filename: ${f}` };
+        }
+    }
+    const workspaceDir = join(root, workspace);
+    let deleted = 0;
+    const deletedIds = [];
+    for (const f of filenames) {
+        const fullPath = join(workspaceDir, f);
+        const id = readSnapshotIdSafe(fullPath);
+        try {
+            unlinkSync(fullPath);
+            deleted++;
+            if (id !== undefined)
+                deletedIds.push(id);
+        }
+        catch {
+            // Missing files are silently skipped.
+        }
+    }
+    deleteViewports(deletedIds);
+    return { ok: true, deleted };
+}
+/**
+ * Removes an entire workspace directory and cleans up viewport-cache entries
+ * for every snapshot that lived in it (C3, `02`). Shared by
+ * POST /snapshots/delete-workspace (NF26, v0.28 Sprint 59).
+ */
+export function deleteWorkspace(workspace, root) {
+    const workspaceDir = join(root, workspace);
+    let idsToClean = [];
+    try {
+        idsToClean = readdirSync(workspaceDir)
+            .filter((f) => f.endsWith("_screen.json"))
+            .map((f) => readSnapshotIdSafe(join(workspaceDir, f)))
+            .filter((id) => id !== undefined);
+    }
+    catch {
+        // Workspace directory unreadable/absent — nothing to clean up.
+    }
+    rmSync(workspaceDir, { recursive: true, force: true });
+    deleteViewports(idsToClean);
+}

package/dist/server/snapshot.js

@@ -0,0 +1,47 @@
+import { mkdirSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+/** Generate a snapshot id up front, before the write happens — lets callers
+ * broadcast the id to the browser (e.g. for viewport-cache keying) without
+ * waiting on the (synchronous, but logically separate) disk write. */
+export function generateSnapshotId() {
+    return crypto.randomUUID();
+}
+export function saveSnapshot(type, payload, options, id) {
+    try {
+        const { workspace } = options;
+        const root = process.env.WHITEBOARD_SNAPSHOTS_DIR ?? join(homedir(), ".agent-whiteboard");
+        const dir = join(root, workspace);
+        mkdirSync(dir, { recursive: true });
+        const now = new Date();
+        const usedId = id ?? crypto.randomUUID();
+        // Include the (already-unique) id so two writes in the same second never collide.
+        const filename = `${formatTimestamp(now)}_${usedId}_screen.json`;
+        const content = {
+            id: usedId,
+            timestamp: now.toISOString(),
+            workspace,
+            type,
+            payload,
+        };
+        if (options.title !== undefined || options.node_to_frame !== undefined) {
+            const cleanedOptions = {};
+            if (options.title !== undefined)
+                cleanedOptions.title = options.title;
+            if (options.node_to_frame !== undefined)
+                cleanedOptions.node_to_frame = options.node_to_frame;
+            content.options = cleanedOptions;
+        }
+        writeFileSync(join(dir, filename), JSON.stringify(content, null, 2), "utf-8");
+        return usedId;
+    }
+    catch (err) {
+        console.error("[agent-whiteboard] snapshot write failed:", err instanceof Error ? err.message : String(err));
+        return undefined;
+    }
+}
+function formatTimestamp(d) {
+    const p = (n) => String(n).padStart(2, "0");
+    return (`${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}` +
+        `_${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`);
+}

package/dist/server/step-frames-builder.js

@@ -0,0 +1,70 @@
+// In-memory builder map for incremental step-frames creation (v0.8).
+// Agents call init → append × N → commit instead of generating one large payload.
+import { randomUUID } from "crypto";
+import { validateFrame } from "./validate.js";
+const TTL_MS = 30 * 60 * 1000; // 30 minutes
+const builders = new Map();
+/** Create a new builder entry. Returns the assigned UUID. */
+export function createBuilder(frame_type, workspace, title) {
+    const id = randomUUID();
+    const timer = setTimeout(() => expireBuilder(id), TTL_MS);
+    builders.set(id, { frame_type, workspace, title, frames: [], timer });
+    return id;
+}
+/** Append a frame to an existing builder entry. Validates payload against type ?? entry.frame_type. */
+export async function appendFrame(id, payload, label, type) {
+    const entry = builders.get(id);
+    if (!entry) {
+        return { ok: false, error: "step-frames session not found or expired" };
+    }
+    const validationError = await validateFrame({ type: type ?? entry.frame_type, payload });
+    if (validationError) {
+        return { ok: false, error: validationError };
+    }
+    entry.frames.push({ payload, ...(label !== undefined ? { label } : {}), ...(type !== undefined ? { type } : {}) });
+    // Reset TTL.
+    clearTimeout(entry.timer);
+    entry.timer = setTimeout(() => expireBuilder(id), TTL_MS);
+    return {
+        ok: true,
+        frame_count: entry.frames.length,
+        frames: entry.frames,
+        frame_type: entry.frame_type,
+        title: entry.title,
+    };
+}
+/**
+ * Commit the builder entry — returns the assembled entry for the caller to
+ * render. Deletes the entry from the map.
+ */
+export function commitBuilder(id) {
+    const entry = builders.get(id);
+    if (!entry) {
+        return { ok: false, error: "step-frames session not found or expired" };
+    }
+    if (entry.frames.length === 0) {
+        return { ok: false, error: "cannot commit empty step-frames sequence" };
+    }
+    clearTimeout(entry.timer);
+    builders.delete(id);
+    return { ok: true, entry };
+}
+/** Silently delete an expired builder entry (called by TTL timer). */
+export function expireBuilder(id) {
+    const entry = builders.get(id);
+    if (entry) {
+        clearTimeout(entry.timer);
+        builders.delete(id);
+    }
+}
+/** Return the size of the builder map — for testing only. */
+export function builderCount() {
+    return builders.size;
+}
+/** Clear all entries — for testing only. */
+export function resetBuilders() {
+    for (const entry of builders.values()) {
+        clearTimeout(entry.timer);
+    }
+    builders.clear();
+}

package/dist/server/validate.js

@@ -0,0 +1,140 @@
+// Server-side payload validation helpers.
+import mermaid from "mermaid";
+import { z } from "zod";
+/**
+ * Shared shape schemas for `node_actions` (wait_click) and `node_to_frame`
+ * (commit_step_frames) — the single implementation both MCP's zod
+ * inputSchema and REST's request-body validation parse against (F7/NF24),
+ * replacing REST's previously hand-written type guards.
+ */
+export const nodeActionsSchema = z.record(z.string(), z.array(z.string()));
+export const nodeToFrameSchema = z.record(z.string(), z.number());
+// Initialise once — no DOM side effects in parse-only mode.
+mermaid.initialize({ startOnLoad: false, securityLevel: "strict" });
+/**
+ * Layer 1: fast prefix check.
+ * Returns false if the payload does not begin with a known Mermaid keyword.
+ */
+export const MERMAID_KEYWORDS = [
+    "graph",
+    "flowchart",
+    "sequenceDiagram",
+    "classDiagram",
+    "erDiagram",
+    "gantt",
+    "pie",
+    "mindmap",
+];
+export function hasMermaidKeyword(payload) {
+    const first = payload.trimStart().split(/\s/)[0];
+    return MERMAID_KEYWORDS.includes(first);
+}
+/**
+ * Layer 2: full parse via Mermaid.js.
+ * Throws with a human-readable message if the syntax is invalid.
+ *
+ * Some diagram types (classDiagram, gantt, pie, mindmap) call DOMPurify
+ * internally, which requires a DOM context unavailable in Node.js.
+ * Those errors are swallowed — the keyword-prefix check (Layer 1) remains
+ * the safety net for those types. Genuine parse errors are always re-thrown.
+ */
+export async function parseMermaid(payload) {
+    try {
+        await mermaid.parse(payload);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        // Distinguish Node.js environment limitations (DOMPurify, DOM APIs missing)
+        // from genuine Mermaid syntax parse errors.
+        if (isNodeEnvLimitation(msg))
+            return; // can't validate in Node — skip
+        throw err; // real parse error — bubble up to caller
+    }
+}
+/**
+ * Validates a workspace name for snapshot routing.
+ * Accepts alphanumeric characters, dashes, underscores, dots, and spaces.
+ * Rejects path separators, null bytes, and the bare ".." sequence.
+ */
+export function isValidWorkspaceName(name) {
+    if (!name || name === "..")
+        return false;
+    return /^[a-zA-Z0-9_\-. ]+$/.test(name);
+}
+/**
+ * Validates a snapshot filename for path safety (NF28, v0.28 Sprint 61):
+ * must end with `_screen.json` and contain no `/` or `..`. The one
+ * implementation shared by POST /snapshots/load and
+ * snapshot-writer.ts's delete-files logic — previously copy-pasted in both.
+ */
+export function isValidSnapshotFilename(filename) {
+    return /^[^/]+_screen\.json$/.test(filename) && !filename.includes("..");
+}
+/**
+ * Validates the `workspace` field required by render(), init_step_frames(),
+ * list_snapshots(), and export_html() — same rule and error text everywhere
+ * (F14/F15/F18 in docs/03). Lives here (not render-core.ts) so both
+ * render-core.ts and snapshot-writer.ts can depend on it without a cycle
+ * (NF26, v0.28 Sprint 59) — render-core.ts re-exports it for its existing
+ * callers (app.ts, mcp.ts).
+ */
+export function validateWorkspaceInput(workspace) {
+    if (!workspace) {
+        return { ok: false, error: "workspace is required" };
+    }
+    const ws = workspace;
+    if (!isValidWorkspaceName(ws)) {
+        return {
+            ok: false,
+            error: "invalid workspace: must be alphanumeric with dashes, underscores, dots, or spaces — no path separators or '..'",
+        };
+    }
+    return { ok: true, workspace: ws };
+}
+/**
+ * Returns true if the error originates from a missing DOM API in Node.js,
+ * not from invalid Mermaid syntax.
+ */
+function isNodeEnvLimitation(msg) {
+    return (msg.includes("DOMPurify") ||
+        msg.includes("is not a function") ||
+        msg.includes("document is not defined") ||
+        msg.includes("window is not defined"));
+}
+/** Content types a single Frame can carry — the only content types anywhere in the MCP payload contract (v0.26 Sprint 45; "step-frames" no longer exists as a top-level type). */
+export const FRAME_TYPES = ["mermaid", "svg", "html", "katex", "vega-lite"];
+/**
+ * Validate one Frame — the single atomic-content validator (U2, v0.26).
+ * Every command path that accepts frame content (render(), each slide of
+ * slideshow(), the incremental append_frame() builder) funnels each frame
+ * through this same function; there is no second implementation.
+ * Returns null on success; an error string on failure. Async because Mermaid
+ * parse is async.
+ */
+export async function validateFrame(frame) {
+    const { type, payload } = frame;
+    if (!FRAME_TYPES.includes(type)) {
+        return `type must be one of: ${FRAME_TYPES.join(", ")}`;
+    }
+    if (type === "mermaid") {
+        if (!hasMermaidKeyword(payload)) {
+            return ("invalid payload: mermaid source must begin with a diagram keyword " +
+                "(e.g. 'graph TD', 'sequenceDiagram', 'classDiagram', ...)");
+        }
+        try {
+            await parseMermaid(payload);
+        }
+        catch (err) {
+            return `invalid mermaid syntax: ${err instanceof Error ? err.message : String(err)}`;
+        }
+    }
+    else if (type === "vega-lite") {
+        try {
+            JSON.parse(payload);
+        }
+        catch {
+            return "invalid payload: vega-lite payload must be valid JSON";
+        }
+    }
+    return null;
+}

package/dist/server/viewport-cache.js

@@ -0,0 +1,69 @@
+// Global viewport-cache file — maps "<snapshot id>:<frame index>" -> user-adjusted
+// Mermaid zoom/pan. Separate from the immutable snapshot JSON files (F19 / C3 in
+// docs/02). Composite key (v0.26.1, bug B19 in docs/01 — FR21): each frame of a
+// step-frames sequence persists its own manual viewport independently, consistent
+// with each frame now getting its own auto-fit trigger (was a bare `id` key,
+// shared across a whole sequence, pre-v0.26.1).
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { getSnapshotsRoot } from "./paths.js";
+function cachePath() {
+    return join(getSnapshotsRoot(), "viewport-cache.json");
+}
+function readCache() {
+    try {
+        const raw = readFileSync(cachePath(), "utf-8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            return {};
+        return parsed;
+    }
+    catch (err) {
+        // ENOENT (no cache file yet, e.g. first run) is expected and not logged.
+        // Anything else (corrupted JSON, permission error) silently discards all
+        // persisted zoom/pan state, so it's worth a warning.
+        if (err?.code !== "ENOENT") {
+            console.error("[agent-whiteboard] viewport-cache read failed, resetting cache:", err instanceof Error ? err.message : String(err));
+        }
+        return {};
+    }
+}
+function writeCache(cache) {
+    try {
+        mkdirSync(getSnapshotsRoot(), { recursive: true });
+        writeFileSync(cachePath(), JSON.stringify(cache, null, 2), "utf-8");
+    }
+    catch (err) {
+        console.error("[agent-whiteboard] viewport-cache write failed:", err instanceof Error ? err.message : String(err));
+    }
+}
+function cacheKey(id, frameIndex) {
+    return `${id}:${frameIndex}`;
+}
+export function getViewport(id, frameIndex) {
+    return readCache()[cacheKey(id, frameIndex)];
+}
+export function setViewport(id, frameIndex, viewport) {
+    const cache = readCache();
+    cache[cacheKey(id, frameIndex)] = viewport;
+    writeCache(cache);
+}
+export function deleteViewport(id) {
+    deleteViewports([id]);
+}
+/** Removes every per-frame entry for each given snapshot id (prefix match on "<id>:"). */
+export function deleteViewports(ids) {
+    if (ids.length === 0)
+        return;
+    const cache = readCache();
+    const prefixes = ids.map((id) => `${id}:`);
+    let changed = false;
+    for (const key of Object.keys(cache)) {
+        if (prefixes.some((prefix) => key.startsWith(prefix))) {
+            delete cache[key];
+            changed = true;
+        }
+    }
+    if (changed)
+        writeCache(cache);
+}

package/dist/server/ws.js

@@ -0,0 +1,71 @@
+// WebSocket push to all connected browser clients.
+import { getDoneArmed, setBroadcastFn } from "./interaction.js";
+const clients = new Set();
+// Wire up the broadcast function so interaction.ts can push state changes
+// without a circular import.
+setBroadcastFn((msg) => broadcast(msg));
+export function addClient(ws) {
+    clients.add(ws);
+    ws.on("close", () => clients.delete(ws));
+    // Push current armed state immediately so a fresh browser tab shows the right
+    // Done button visibility without waiting for the next state change.
+    const payload = JSON.stringify({ action: "set_done_armed", armed: getDoneArmed() });
+    if (ws.readyState === 1 /* OPEN */)
+        ws.send(payload);
+}
+export function broadcast(message) {
+    const payload = JSON.stringify(message);
+    for (const client of clients) {
+        if (client.readyState === 1 /* OPEN */) {
+            client.send(payload);
+        }
+    }
+}
+export function broadcastReplace(msg) {
+    if (!("payload" in msg)) {
+        broadcast({
+            action: "replace",
+            type: msg.type,
+            frameCount: msg.frameCount,
+            ...(msg.title !== undefined ? { title: msg.title } : {}),
+        });
+        return;
+    }
+    broadcast({
+        action: "replace",
+        type: msg.type,
+        payload: msg.payload,
+        id: msg.id,
+        cursor: msg.cursor,
+        total: msg.total,
+        ...(msg.frameLabel !== undefined ? { frameLabel: msg.frameLabel } : {}),
+        ...(msg.title !== undefined ? { title: msg.title } : {}),
+        ...(msg.nodeToFrame !== undefined ? { nodeToFrame: msg.nodeToFrame } : {}),
+        ...(msg.viewport !== undefined ? { viewport: msg.viewport } : {}),
+    });
+}
+/**
+ * Broadcast a step-frames event. Used by append_frame (partial), commit_step_frames
+ * (final), and /step's (REST + MCP) frame-advance broadcast.
+ * `nodeToFrame` (v0.26.1, bug B18 in docs/01): this wrapper previously had no slot
+ * for it at all, so every call site silently dropped the map even when the caller
+ * had one — the exact drift the v0.23 broadcastReplace() unification was meant to
+ * prevent, reintroduced one layer up. See docs/02 C2e.
+ * `viewport` (v0.26.1, bug B19/FR21 in docs/01): a per-frame saved viewport to
+ * restore instead of auto-fitting, looked up by the caller via
+ * `getViewport(id, cursor)` — each frame of a sequence now re-fits or restores
+ * independently instead of the whole sequence sharing one viewport.
+ */
+export function broadcastStepFrames(frames, frameType, cursor, id, title, nodeToFrame, viewport) {
+    broadcastReplace({
+        type: frames[cursor].type ?? frameType,
+        payload: frames[cursor].payload,
+        frameLabel: frames[cursor].label,
+        cursor,
+        total: frames.length,
+        id,
+        title,
+        nodeToFrame,
+        viewport,
+    });
+}

package/package.json

@@ -0,0 +1,92 @@
+{
+  "name": "agent-whiteboard",
+  "version": "1.0.0",
+  "description": "A domain-agnostic interactive whiteboard for AI teacher agents — render diagrams, math, charts, and HTML to a local browser tab via MCP tools.",
+  "type": "module",
+  "bin": {
+    "agent-whiteboard": "bin/cli.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/bobpuley/agent-whiteboard.git"
+  },
+  "homepage": "https://github.com/bobpuley/agent-whiteboard#readme",
+  "bugs": {
+    "url": "https://github.com/bobpuley/agent-whiteboard/issues"
+  },
+  "author": "Marco Pugliese",
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "claude",
+    "claude-code",
+    "whiteboard",
+    "ai-agent",
+    "teaching",
+    "visualization",
+    "mermaid"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "dev": "concurrently --kill-others-on-fail --names \"server,client,browser\" \"npm run dev:server\" \"npm run dev:client\" \"npm run dev:open\"",
+    "dev:server": "tsx watch server/index.ts",
+    "dev:client": "vite --config client/vite.config.ts",
+    "dev:open": "wait-on http://localhost:5173 && node -e \"import('open').then(m => m.default('http://localhost:5173'))\"",
+    "dev:test": "concurrently --kill-others-on-fail --names \"server,client\" \"tsx server/index.ts\" \"npm run dev:client\"",
+    "typecheck": "svelte-check --tsconfig client/tsconfig.json",
+    "build": "tsc -p tsconfig.json && npm run typecheck && vite build --config client/vite.config.ts",
+    "test": "vitest run",
+    "test:e2e": "playwright test",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix"
+  },
+  "dependencies": {
+    "@hono/node-server": "^1.13.7",
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@types/dompurify": "^3.2.0",
+    "bootstrap": "^5.3.8",
+    "dompurify": "^3.4.7",
+    "happy-dom": "^20.10.6",
+    "hono": "^4.7.11",
+    "katex": "^0.17.0",
+    "mermaid": "^11.15.0",
+    "open": "^10.1.2",
+    "vega": "^6.2.0",
+    "vega-embed": "^7.1.0",
+    "vega-lite": "^6.4.3",
+    "ws": "^8.21.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@playwright/test": "^1.60.0",
+    "@sveltejs/vite-plugin-svelte": "^2.4.6",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/svelte": "^4.2.3",
+    "@tsconfig/svelte": "^5.0.4",
+    "@types/node": "^20.17.57",
+    "@types/ws": "^8.18.1",
+    "concurrently": "^9.1.2",
+    "eslint": "^10.6.0",
+    "eslint-plugin-svelte": "^3.20.0",
+    "globals": "^17.7.0",
+    "svelte": "^4.2.19",
+    "svelte-check": "^4.7.1",
+    "svelte-eslint-parser": "^1.8.0",
+    "tsx": "^3.14.0",
+    "typescript": "^5.8.3",
+    "typescript-eslint": "^8.62.1",
+    "vite": "^4.5.10",
+    "vitest": "^0.34.6",
+    "wait-on": "^8.0.3"
+  }
+}