az2aws 1.6.2 → 1.7.0

package/lib/loginStates.js

@@ -9,6 +9,21 @@ const inquirer_1 = __importDefault(require("inquirer"));
 const debug_1 = __importDefault(require("debug"));
 const CLIError_1 = require("./CLIError");
 const debug = (0, debug_1.default)("az2aws");
+async function readTextContent(page, element) {
+    if (!element) {
+        return "";
+    }
+    return page.evaluate((node) => { var _a; return (_a = node.textContent) !== null && _a !== void 0 ? _a : ""; }, element);
+}
+const PASSWORD_SELECTOR = 'input[name="Password"]:not(.moveOffScreen),input[name="passwd"]:not(.moveOffScreen)';
+function printPageMessage(message, allowSensitiveOutput = true) {
+    if (allowSensitiveOutput) {
+        console.log(message);
+    }
+}
+function createSensitiveCliError(message, sanitizedMessage, allowSensitiveOutput = true) {
+    return new CLIError_1.CLIError(allowSensitiveOutput ? message : sanitizedMessage);
+}
 /**
  * To proxy the input/output of the Azure login page, it's easiest to run a loop that
  * monitors the state of the page and then perform the corresponding CLI behavior.
@@ -20,15 +35,12 @@ exports.states = [
     {
         name: "username input",
         selector: `input[name="loginfmt"]:not(.moveOffScreen)`,
-        async handler(page, _selected, noPrompt, defaultUsername) {
+        async handler(page, _selected, noPrompt, defaultUsername, _defaultPassword, _rememberMe, allowSensitiveOutput) {
             const error = await page.$(".alert-error");
             if (error) {
                 debug("Found error message. Displaying");
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-                const errorMessage = await page.evaluate(
-                // eslint-disable-next-line
-                (err) => { var _a; return (_a = err === null || err === void 0 ? void 0 : err.textContent) !== null && _a !== void 0 ? _a : ""; }, error);
-                console.log(errorMessage);
+                const errorMessage = await readTextContent(page, error);
+                printPageMessage(errorMessage, allowSensitiveOutput);
             }
             let username;
             if (noPrompt && defaultUsername) {
@@ -37,7 +49,6 @@ exports.states = [
             }
             else {
                 debug("Prompting user for username");
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
                 ({ username } = await inquirer_1.default.prompt([
                     {
                         type: "input",
@@ -60,7 +71,6 @@ exports.states = [
             });
             await page.keyboard.press("Backspace");
             debug("Typing username");
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
             await page.keyboard.type(username);
             await (0, promises_1.setTimeout)(500);
             debug("Waiting for submit button to be visible");
@@ -87,22 +97,16 @@ exports.states = [
     {
         name: "account selection",
         selector: `#aadTile > div > div.table-cell.tile-img > img`,
-        async handler(page) {
+        async handler(page, _selected, noPrompt, _defaultUsername, _defaultPassword, _rememberMe, allowSensitiveOutput) {
             debug("Multiple accounts associated with username.");
             const aadTile = await page.$("#aadTileTitle");
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-            const aadTileMessage = await page.evaluate(
-            // eslint-disable-next-line
-            (a) => { var _a; return (_a = a === null || a === void 0 ? void 0 : a.textContent) !== null && _a !== void 0 ? _a : ""; }, aadTile);
+            const aadTileMessage = await readTextContent(page, aadTile);
             const msaTile = await page.$("#msaTileTitle");
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-            const msaTileMessage = await page.evaluate(
-            // eslint-disable-next-line
-            (m) => { var _a; return (_a = m === null || m === void 0 ? void 0 : m.textContent) !== null && _a !== void 0 ? _a : ""; }, msaTile);
+            const msaTileMessage = await readTextContent(page, msaTile);
             const accounts = [
                 aadTile ? { message: aadTileMessage, selector: "#aadTileTitle" } : null,
                 msaTile ? { message: msaTileMessage, selector: "#msaTileTitle" } : null,
-            ].filter((a) => a !== null);
+            ].filter((account) => account !== null);
             let account;
             if (accounts.length === 0) {
                 throw new CLIError_1.CLIError("No accounts found on account selection screen.");
@@ -110,10 +114,16 @@ exports.states = [
             else if (accounts.length === 1) {
                 account = accounts[0];
             }
+            else if (noPrompt) {
+                debug("Skipping account prompt and using default account");
+                account = accounts.find((candidate) => {
+                    return candidate.message === aadTileMessage;
+                });
+            }
             else {
                 debug("Asking user to choose account");
-                console.log("It looks like this Username is used with more than one account from Microsoft. Which one do you want to use?");
-                const answers = await inquirer_1.default.prompt([
+                printPageMessage("It looks like this Username is used with more than one account from Microsoft. Which one do you want to use?", allowSensitiveOutput);
+                const { account: selectedAccount } = await inquirer_1.default.prompt([
                     {
                         name: "account",
                         message: "Account:",
@@ -122,7 +132,9 @@ exports.states = [
                         default: aadTileMessage,
                     },
                 ]);
-                account = accounts.find((a) => a.message === answers.account);
+                account = accounts.find((candidate) => {
+                    return candidate.message === selectedAccount;
+                });
             }
             if (!account) {
                 throw new Error("Unable to find account");
@@ -135,32 +147,22 @@ exports.states = [
     {
         name: "passwordless",
         selector: `input[value='Send notification']`,
-        async handler(page) {
+        async handler(page, _selected, _noPrompt, _defaultUsername, _defaultPassword, _rememberMe, allowSensitiveOutput) {
             debug("Sending notification");
-            // eslint-disable-next-line
             await page.click("input[value='Send notification']");
             debug("Waiting for auth code");
-            // eslint-disable-next-line
             await page.waitForSelector(`#idRemoteNGC_DisplaySign`, {
                 visible: true,
                 timeout: 60000,
             });
             debug("Printing the message displayed");
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
             const messageElement = await page.$("#idDiv_RemoteNGC_PollingDescription");
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
             const codeElement = await page.$("#idRemoteNGC_DisplaySign");
-            // eslint-disable-next-line
-            const message = await page.evaluate(
-            // eslint-disable-next-line
-            (el) => { var _a; return (_a = el === null || el === void 0 ? void 0 : el.textContent) !== null && _a !== void 0 ? _a : ""; }, messageElement);
-            console.log(message);
+            const message = await readTextContent(page, messageElement);
+            printPageMessage(message, allowSensitiveOutput);
             debug("Printing the auth code");
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-            const authCode = await page.evaluate(
-            // eslint-disable-next-line
-            (el) => { var _a; return (_a = el === null || el === void 0 ? void 0 : el.textContent) !== null && _a !== void 0 ? _a : ""; }, codeElement);
-            console.log(authCode);
+            const authCode = await readTextContent(page, codeElement);
+            printPageMessage(authCode, allowSensitiveOutput);
             debug("Waiting for response");
             await page.waitForSelector(`#idRemoteNGC_DisplaySign`, {
                 hidden: true,
@@ -170,16 +172,13 @@ exports.states = [
     },
     {
         name: "password input",
-        selector: `input[name="Password"]:not(.moveOffScreen),input[name="passwd"]:not(.moveOffScreen)`,
-        async handler(page, _selected, noPrompt, _defaultUsername, defaultPassword) {
+        selector: PASSWORD_SELECTOR,
+        async handler(page, _selected, noPrompt, _defaultUsername, defaultPassword, _rememberMe, allowSensitiveOutput) {
             const error = await page.$(".alert-error");
             if (error) {
                 debug("Found error message. Displaying");
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-                const errorMessage = await page.evaluate(
-                // eslint-disable-next-line
-                (err) => { var _a; return (_a = err === null || err === void 0 ? void 0 : err.textContent) !== null && _a !== void 0 ? _a : ""; }, error);
-                console.log(errorMessage);
+                const errorMessage = await readTextContent(page, error);
+                printPageMessage(errorMessage, allowSensitiveOutput);
                 defaultPassword = ""; // Password error. Unset the default and allow user to enter it.
             }
             let password;
@@ -189,7 +188,6 @@ exports.states = [
             }
             else {
                 debug("Prompting user for password");
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
                 ({ password } = await inquirer_1.default.prompt([
                     {
                         name: "password",
@@ -199,9 +197,13 @@ exports.states = [
                 ]));
             }
             debug("Focusing on password input");
-            await page.focus(`input[name="Password"],input[name="passwd"]`);
+            await page.focus(PASSWORD_SELECTOR);
+            debug("Clearing input");
+            await page.$eval(PASSWORD_SELECTOR, (el) => {
+                el.select();
+            });
+            await page.keyboard.press("Backspace");
             debug("Typing password");
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
             await page.keyboard.type(password);
             debug("Submitting form");
             await page.click("span[class=submit],input[type=submit]");
@@ -212,11 +214,9 @@ exports.states = [
     {
         name: "TFA instructions",
         selector: `#idDiv_SAOTCAS_Description`,
-        async handler(page, selected) {
-            const descriptionMessage = await page.evaluate(
-            // eslint-disable-next-line
-            (description) => { var _a; return (_a = description === null || description === void 0 ? void 0 : description.textContent) !== null && _a !== void 0 ? _a : ""; }, selected);
-            console.log(descriptionMessage);
+        async handler(page, selected, _noPrompt, _defaultUsername, _defaultPassword, _rememberMe, allowSensitiveOutput) {
+            const descriptionMessage = await readTextContent(page, selected);
+            printPageMessage(descriptionMessage, allowSensitiveOutput);
             try {
                 debug("Waiting for authentication code to be displayed");
                 await page.waitForSelector("#idRichContext_DisplaySign", {
@@ -226,12 +226,9 @@ exports.states = [
                 debug("Checking if authentication code is displayed");
                 const authenticationCodeElement = await page.$("#idRichContext_DisplaySign");
                 debug("Reading the authentication code");
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-                const authenticationCode = await page.evaluate(
-                // eslint-disable-next-line
-                (d) => { var _a; return (_a = d === null || d === void 0 ? void 0 : d.textContent) !== null && _a !== void 0 ? _a : ""; }, authenticationCodeElement);
+                const authenticationCode = await readTextContent(page, authenticationCodeElement);
                 debug("Printing the authentication code to console");
-                console.log(authenticationCode);
+                printPageMessage(authenticationCode, allowSensitiveOutput);
             }
             catch (_a) {
                 debug("No authentication code found on page");
@@ -246,36 +243,26 @@ exports.states = [
     {
         name: "TFA failed",
         selector: `#idDiv_SAASDS_Description,#idDiv_SAASTO_Description`,
-        async handler(page, selected) {
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-            const descriptionMessage = await page.evaluate(
-            // eslint-disable-next-line
-            (description) => { var _a; return (_a = description === null || description === void 0 ? void 0 : description.textContent) !== null && _a !== void 0 ? _a : ""; }, selected);
-            throw new CLIError_1.CLIError(descriptionMessage);
+        async handler(page, selected, _noPrompt, _defaultUsername, _defaultPassword, _rememberMe, allowSensitiveOutput) {
+            const descriptionMessage = await readTextContent(page, selected);
+            throw createSensitiveCliError(descriptionMessage, "Authentication failed during MFA challenge.", allowSensitiveOutput);
         },
     },
     {
         name: "TFA code input",
         selector: "input[name=otc]:not(.moveOffScreen)",
-        async handler(page) {
+        async handler(page, _selected, _noPrompt, _defaultUsername, _defaultPassword, _rememberMe, allowSensitiveOutput) {
             const error = await page.$(".alert-error");
             if (error) {
                 debug("Found error message. Displaying");
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-                const errorMessage = await page.evaluate(
-                // eslint-disable-next-line
-                (err) => { var _a; return (_a = err === null || err === void 0 ? void 0 : err.textContent) !== null && _a !== void 0 ? _a : ""; }, error);
-                console.log(errorMessage);
+                const errorMessage = await readTextContent(page, error);
+                printPageMessage(errorMessage, allowSensitiveOutput);
             }
             else {
                 const description = await page.$("#idDiv_SAOTCC_Description");
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-                const descriptionMessage = await page.evaluate(
-                // eslint-disable-next-line
-                (d) => { var _a; return (_a = d === null || d === void 0 ? void 0 : d.textContent) !== null && _a !== void 0 ? _a : ""; }, description);
-                console.log(descriptionMessage);
+                const descriptionMessage = await readTextContent(page, description);
+                printPageMessage(descriptionMessage, allowSensitiveOutput);
             }
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
             const { verificationCode } = await inquirer_1.default.prompt([
                 {
                     type: "input",
@@ -291,7 +278,6 @@ exports.states = [
             });
             await page.keyboard.press("Backspace");
             debug("Typing verification code");
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
             await page.keyboard.type(verificationCode);
             debug("Submitting form");
             await page.click("input[type=submit]");
@@ -327,12 +313,9 @@ exports.states = [
     {
         name: "Service exception",
         selector: "#service_exception_message",
-        async handler(page, selected) {
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-            const descriptionMessage = await page.evaluate(
-            // eslint-disable-next-line
-            (description) => { var _a; return (_a = description === null || description === void 0 ? void 0 : description.textContent) !== null && _a !== void 0 ? _a : ""; }, selected);
-            throw new CLIError_1.CLIError(descriptionMessage);
+        async handler(page, selected, _noPrompt, _defaultUsername, _defaultPassword, _rememberMe, allowSensitiveOutput) {
+            const descriptionMessage = await readTextContent(page, selected);
+            throw createSensitiveCliError(descriptionMessage, "Login provider returned a service exception.", allowSensitiveOutput);
         },
     },
 ];

package/lib/sensitiveOutput.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldAllowSensitiveOutput = shouldAllowSensitiveOutput;
+exports.redactUrlForLogs = redactUrlForLogs;
+exports.sanitizeMessage = sanitizeMessage;
+exports.formatCliErrorMessage = formatCliErrorMessage;
+exports.formatUnexpectedErrorMessage = formatUnexpectedErrorMessage;
+exports.formatDebugErrorMessage = formatDebugErrorMessage;
+const REDACTED = "[redacted]";
+const SAFE_MICROSOFT_LOGIN_PATH_SEGMENTS = new Set([
+    "common",
+    "consumers",
+    "organizations",
+    "favicon.ico",
+    "kmsi",
+]);
+const URL_PATTERN = /\bhttps?:\/\/[^\s"'`<>]+/gi;
+const AWS_ACCESS_KEY_ID_PATTERN = /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g;
+const SENSITIVE_FIELD_NAMES = [
+    "AZURE_DEFAULT_PASSWORD",
+    "password",
+    "aws_access_key_id",
+    "aws_secret_access_key",
+    "aws_session_token",
+    "AccessKeyId",
+    "SecretAccessKey",
+    "SessionToken",
+    "SAMLAssertion",
+    "SAMLResponse",
+    "Authorization",
+    "Cookie",
+    "Set-Cookie",
+];
+const SENSITIVE_ASSIGNMENT_PATTERN = new RegExp(`((?:${SENSITIVE_FIELD_NAMES.join("|")})\\s*[=:]\\s*)(?:"[^"]*"|'[^']*'|.+)`, "gi");
+const SENSITIVE_JSON_PATTERN = new RegExp(`((?:"(?:${SENSITIVE_FIELD_NAMES.join("|")})"\\s*:\\s*))(?:"[^"]*"|null|[^\\s,}]+)`, "gi");
+function shouldAllowSensitiveOutput(env = process.env) {
+    return !env.CI && !env.GITHUB_ACTIONS;
+}
+function redactUrlForLogs(url) {
+    try {
+        const parsedUrl = new URL(url);
+        const pathSegments = parsedUrl.pathname.split("/");
+        if (parsedUrl.hostname === "login.microsoftonline.com" &&
+            pathSegments[1] &&
+            !SAFE_MICROSOFT_LOGIN_PATH_SEGMENTS.has(pathSegments[1])) {
+            pathSegments[1] = REDACTED;
+            parsedUrl.pathname = pathSegments.join("/");
+        }
+        if (parsedUrl.username || parsedUrl.password) {
+            parsedUrl.username = REDACTED;
+            parsedUrl.password = REDACTED;
+        }
+        for (const key of new Set(parsedUrl.searchParams.keys())) {
+            parsedUrl.searchParams.set(key, REDACTED);
+        }
+        if (parsedUrl.hash) {
+            parsedUrl.hash = REDACTED;
+        }
+        return parsedUrl.toString();
+    }
+    catch (_a) {
+        const questionMarkIndex = url.indexOf("?");
+        if (questionMarkIndex === -1) {
+            return url;
+        }
+        return `${url.slice(0, questionMarkIndex)}?${REDACTED}`;
+    }
+}
+function sanitizeMessage(message) {
+    return message
+        .replace(URL_PATTERN, (url) => redactUrlForLogs(url))
+        .replace(AWS_ACCESS_KEY_ID_PATTERN, REDACTED)
+        .replace(SENSITIVE_ASSIGNMENT_PATTERN, `$1${REDACTED}`)
+        .replace(SENSITIVE_JSON_PATTERN, `$1"${REDACTED}"`);
+}
+function formatCliErrorMessage(message, env = process.env) {
+    return shouldAllowSensitiveOutput(env) ? message : sanitizeMessage(message);
+}
+function formatUnexpectedErrorMessage(error, env = process.env) {
+    const message = error instanceof Error ? error.message : String(error);
+    return shouldAllowSensitiveOutput(env) ? message : sanitizeMessage(message);
+}
+function formatDebugErrorMessage(error, env = process.env) {
+    return formatUnexpectedErrorMessage(error, env);
+}

package/lib/sessionDuration.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionDurationHoursValidationMessage = void 0;
+exports.parseSessionDurationHours = parseSessionDurationHours;
+exports.validateSessionDurationHours = validateSessionDurationHours;
+exports.sessionDurationHoursValidationMessage = "Duration hours must be a whole number between 1 and 12";
+function parseSessionDurationHours(input) {
+    if (input === undefined) {
+        return null;
+    }
+    if (typeof input === "number") {
+        return Number.isInteger(input) && input > 0 && input <= 12 ? input : null;
+    }
+    const trimmed = input.trim();
+    if (!/^\d+$/.test(trimmed)) {
+        return null;
+    }
+    const parsed = Number(trimmed);
+    return parsed > 0 && parsed <= 12 ? parsed : null;
+}
+function validateSessionDurationHours(input) {
+    // Inquirer types `validate` input as string, but it may validate a numeric
+    // `default` value before coercing it to user input.
+    return parseSessionDurationHours(input) === null
+        ? exports.sessionDurationHoursValidationMessage
+        : true;
+}

package/lib/updateNotifier.js

@@ -13,12 +13,19 @@ const CACHE_TTL_MS = 1000 * 60 * 60 * 24; // 24 hours
 const FAKE_LATEST_VERSION_ENV = "AZ2AWS_FAKE_LATEST_VERSION";
 const ANSI_YELLOW = "\u001b[33m";
 const ANSI_RESET = "\u001b[0m";
-function getCachePath() {
-    return path_1.default.join(os_1.default.homedir(), ".config", "az2aws", "update-check.json");
+const CONFIG_DIR_MODE = 0o700;
+const CACHE_FILE_MODE = 0o600;
+function getCachePath(env = process.env) {
+    var _a, _b;
+    if (process.platform === "win32") {
+        const cacheRoot = ((_a = env.LOCALAPPDATA) === null || _a === void 0 ? void 0 : _a.trim()) || ((_b = env.APPDATA) === null || _b === void 0 ? void 0 : _b.trim()) || os_1.default.homedir();
+        return path_1.default.win32.join(cacheRoot, PACKAGE_NAME, "update-check.json");
+    }
+    return path_1.default.join(os_1.default.homedir(), ".config", PACKAGE_NAME, "update-check.json");
 }
-function readCache() {
+function readCache(env = process.env) {
     try {
-        const data = fs_1.default.readFileSync(getCachePath(), "utf-8");
+        const data = fs_1.default.readFileSync(getCachePath(env), "utf-8");
         const cache = JSON.parse(data);
         if (Date.now() - cache.checkedAt < CACHE_TTL_MS) {
             return cache;
@@ -29,12 +36,19 @@ function readCache() {
     }
     return null;
 }
-function writeCache(latestVersion) {
+function writeCache(latestVersion, env = process.env) {
     try {
-        const cachePath = getCachePath();
-        const dir = path_1.default.dirname(cachePath);
-        fs_1.default.mkdirSync(dir, { recursive: true });
-        fs_1.default.writeFileSync(cachePath, JSON.stringify({ latestVersion, checkedAt: Date.now() }));
+        const cachePath = getCachePath(env);
+        const pathModule = process.platform === "win32" ? path_1.default.win32 : path_1.default;
+        const dir = pathModule.dirname(cachePath);
+        fs_1.default.mkdirSync(dir, { recursive: true, mode: CONFIG_DIR_MODE });
+        if (process.platform !== "win32") {
+            fs_1.default.chmodSync(dir, CONFIG_DIR_MODE);
+        }
+        fs_1.default.writeFileSync(cachePath, JSON.stringify({ latestVersion, checkedAt: Date.now() }), { mode: CACHE_FILE_MODE });
+        if (process.platform !== "win32") {
+            fs_1.default.chmodSync(cachePath, CACHE_FILE_MODE);
+        }
     }
     catch (_a) {
         // Ignore cache write failures
@@ -126,13 +140,13 @@ async function checkForUpdate(currentVersion, options = {}) {
             latestVersion = forcedLatestVersion;
         }
         else {
-            const cache = readCache();
+            const cache = readCache(env);
             if (cache) {
                 latestVersion = cache.latestVersion;
             }
             else {
                 latestVersion = await fetchLatestVersion();
-                writeCache(latestVersion);
+                writeCache(latestVersion, env);
             }
         }
         if (compareVersions(currentVersion, latestVersion) > 0) {

package/lib/validateCliOptions.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateCliOptions = validateCliOptions;
+const CLIError_1 = require("./CLIError");
+function validateCliOptions(options) {
+    if (options.allProfiles && options.credentialProcess) {
+        throw new CLIError_1.CLIError("--credential-process cannot be used with --all-profiles.");
+    }
+    if (options.configure && options.credentialProcess) {
+        throw new CLIError_1.CLIError("--credential-process cannot be used with --configure.");
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "az2aws",
-  "version": "1.6.2",
+  "version": "1.7.0",
   "description": "Use Azure AD SSO to log into the AWS CLI. A modern, actively maintained alternative to aws-azure-login.",
   "main": "lib/index.js",
   "author": {
@@ -44,6 +44,8 @@
       "puppeteer"
     ],
     "overrides": {
+      "basic-ftp@<5.2.1": "5.2.2",
+      "brace-expansion@<1.1.13": "1.1.13",
       "yauzl@<3.2.1": "3.2.1"
     }
   },
@@ -58,6 +60,7 @@
     "prettier:write": "prettier --write \"src/**/*.{ts,json}\"",
     "prettier:check": "prettier --check \"src/**/*.ts\"",
     "test": "vitest run",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "lint": "pnpm eslint && pnpm prettier:check"