botprint 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Botprint contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/PRIVACY.md

@@ -0,0 +1,94 @@
+# Privacy
+
+Botprint is local-first diagnostic tooling.
+
+Botprint does not upload profile data, reports, compare artifacts, auth headers, or browser metadata. Artifacts stay on disk unless you choose to share them.
+
+## What Profiles Contain
+
+Botprint profiles can contain browser-environment data, including:
+
+- user agent and client hint brands, platform, and mobile flag
+- platform, language, and languages
+- timezone
+- viewport, outer window, and screen metrics including color depth
+- device scale factor, hardware concurrency, device memory, speech voice count
+- plugin and MIME type counts, PDF viewer availability
+- `navigator.webdriver`, `window.chrome` presence, known automation globals
+- WebGL vendor and renderer, unmasked when available
+- canvas and audio sample hashes
+- which of a fixed list of common fonts are installed
+- cookie, localStorage, sessionStorage, IndexedDB, and service worker availability
+- selected Permissions API states and `Notification.permission`
+- WebRTC API availability and host-candidate gathering presence (no STUN servers are contacted)
+- request headers the browser sent to the local diagnostic page, from a fixed allowlist: Accept, Accept-Encoding, Accept-Language, DNT, Priority, Sec-CH-UA*, Sec-Fetch-*, Sec-GPC, Upgrade-Insecure-Requests, User-Agent. Cookies, Authorization, Host, and any other header are never recorded.
+- CDP browser product and protocol version
+- profile label, target URL, probe context, and browser context ID
+
+Existing-target profiles may also include:
+
+- CDP target ID
+- target type
+- a `page-contamination-possible` probe warning
+
+These fields are useful for diagnostics, but they can reveal details about a browser environment. Review artifacts before sharing them publicly.
+
+## Fresh Diagnostic Page
+
+By default, Botprint creates a fresh local diagnostic page inside the browser context of the first open page target and runs the probe there. The diagnostic page is static HTML served from a local socket that exists only for the duration of the run. The page runs in the same context as your open pages but does not read them.
+
+The diagnostic server binds to `127.0.0.1` by default.
+
+For Docker or cross-namespace browser setups, users may explicitly choose:
+
+```bash
+--diagnostic-bind 0.0.0.0
+--diagnostic-host host.docker.internal
+```
+
+Only use broader binding when the browser cannot reach the default localhost page.
+
+## Existing Target Mode
+
+Existing-target mode runs the probe inside an already-open CDP page target.
+
+This is useful when you need to measure a specific page or framework context, but it is less isolated than the default fresh diagnostic page. Existing-target output may reflect:
+
+- page scripts
+- framework state
+- service workers
+- content security policy
+- cookies
+- storage state
+- application state
+- extensions or browser policy affecting that page
+
+The probe performs short-lived browser API checks. It attempts to clean up storage keys it creates, but a page crash, timeout, or browser-level interruption could leave small local artifacts such as a temporary storage key or IndexedDB database name.
+
+Do not run existing-target probes on sensitive logged-in pages unless you are comfortable with the page observing normal in-page JavaScript execution.
+
+## Auth Headers
+
+`--auth-header` values are used only for the CDP connection path.
+
+Botprint does not persist auth-header values in profile artifacts.
+
+If you quote commands in issues, pull requests, or agent prompts, redact header values:
+
+```bash
+--auth-header "Authorization: Bearer <redacted>"
+```
+
+## Sharing Checklist
+
+Before sharing a profile or report publicly:
+
+- confirm it does not include sensitive labels or target URLs
+- review timezone and locale information
+- review screen, hardware, and WebGL details
+- avoid sharing auth headers or shell history
+- prefer synthetic examples from `examples/synthetic` for public docs and tests
+
+## No Telemetry
+
+Botprint has no telemetry pipeline. It does not phone home.

package/README.md

@@ -0,0 +1,221 @@
+# Botprint
+
+Botprint shows what your automated browser exposes to the web, and what changed from your baseline.
+
+It connects to a running Chromium-based browser over the Chrome DevTools Protocol (CDP), runs a probe in a page inside the browser context you are debugging, and writes a schema-versioned JSON profile. Profiles can be rendered as reports, compared against a baseline, and condensed into short explanations for coding agents.
+
+Botprint is a diagnostic tool. It reports what the browser exposes, what differs between two environments, and which launch option or environment difference is most likely responsible. It does not ship spoofing presets or patches.
+
+Typical questions it answers:
+
+- Why does my Playwright or Puppeteer flow behave differently in Docker or CI than on my laptop?
+- What does the site actually see from this browser agent: user agent, client hints, Accept-Language, timezone, fonts, GPU, storage, permissions?
+- Is this difference real environment drift, or an artifact of how I measured it?
+
+## Install
+
+Release binaries (no runtime needed):
+
+```bash
+curl -fsSL https://github.com/oh-meh/botprint/releases/latest/download/botprint-linux-x64 -o botprint
+chmod +x botprint && sudo mv botprint /usr/local/bin/
+```
+
+Replace `linux-x64` with `linux-arm64`, `darwin-arm64`, `darwin-x64`, or `windows-x64.exe`.
+
+With [Bun](https://bun.sh):
+
+```bash
+bunx botprint help          # run without installing
+bun install -g botprint     # or install globally
+```
+
+From source:
+
+```bash
+git clone https://github.com/oh-meh/botprint && cd botprint
+bun install && bun run build   # writes dist/botprint
+```
+
+## Quickstart
+
+Start the browser with a CDP port and collect a profile:
+
+```bash
+botprint run --cdp http://127.0.0.1:9222 --out local.profile.json --label local
+```
+
+Compare two environments:
+
+```bash
+botprint compare local.profile.json docker.profile.json          # Markdown summary
+botprint compare local.profile.json docker.profile.json --json   # full diff list
+```
+
+Render a report or a compact explanation:
+
+```bash
+botprint report docker.profile.json
+botprint explain docker.profile.json --for-agent
+```
+
+A profile report looks like this (synthetic Docker example):
+
+````markdown
+# Botprint Profile: synthetic-docker
+
+## Key Signals
+- WebDriver: false; window.chrome: false
+- WebGL: SwiftShader Device (Synthetic)
+- Canvas: stable; audio: available
+- Fonts: 0 of 31 common fonts detected
+- Storage: cookies=true, indexedDB=error
+- Accept-Language: (not sent)
+
+## Top Findings
+_Showing top 5 of 9 findings. Use `--json` for the full finding list._
+- **IndexedDB is unavailable** (compatibility_risk): IndexedDB status is error.
+- **Browser identifies itself as headless** (warning): User agent reports HeadlessChrome/145. Client hint brands include HeadlessChrome.
+- **Software WebGL renderer detected** (warning): Renderer evidence: WebKit WebGL SwiftShader Device (Synthetic).
+- **No common fonts detected** (warning): None of 31 common fonts rendered differently from the generic fallback families.
+- **No Accept-Language header is sent** (warning): The browser's request for the diagnostic page carried no Accept-Language header.
+````
+
+And a compare:
+
+````markdown
+# Botprint Compare: synthetic-local -> synthetic-docker
+
+## Summary
+- Verdict: material
+- Material: yes
+- Differences: 28
+- Categories: automation, cdp, environment, http, identity, permissions, rendering, storage
+- Warnings: comparison.browser_binary_mismatch, comparison.headless_mode_mismatch
+
+## Top Differences
+_Showing top 5 of 28 differences. Use `--json` for the full diff list._
+- **window.chrome presence changed** (material): signals.automation.chrome_object true -> false
+- **Timezone changed** (material): signals.environment.timezone "America/New_York" -> "UTC"
+- **WebGL renderer changed** (material): signals.rendering.webgl.unmasked_renderer "ANGLE Metal Renderer: Synthetic GPU" -> "SwiftShader Device (Synthetic)"
+- **Detected font set changed** (material): signals.rendering.fonts.detected ["Arial","Courier New","Georgia","Helvetica","Helvetica Neue","Menlo","Monaco","Times New Roman","Verdana"] -> []
+- **IndexedDB availability changed** (material): signals.storage.indexed_db "available" -> "error"
+````
+
+Full synthetic examples live in [`examples/synthetic`](examples/synthetic).
+
+## What It Measures
+
+| Category | Signals |
+| --- | --- |
+| `identity` | user agent, client hint brands/platform/mobile, platform, language and languages, plugin and MIME counts, PDF viewer |
+| `automation` | `navigator.webdriver`, `window.chrome` presence, known automation globals |
+| `environment` | timezone, viewport, outer window size, screen metrics and color depth, hardware concurrency, device memory, speech voice count |
+| `rendering` | WebGL vendor/renderer (masked and unmasked), canvas hash, audio hash, detected common fonts |
+| `storage` | cookies, localStorage, sessionStorage, IndexedDB, service worker |
+| `permissions` | Permissions API states and `Notification.permission` |
+| `webrtc` | API availability and local host-candidate gathering (no STUN) |
+| `http` | request headers the browser sent for the diagnostic page: User-Agent, Accept-Language, Sec-CH-UA client hints, Sec-Fetch, Accept-Encoding |
+| `cdp` | browser product and protocol version |
+
+Findings are generated from these signals with stable IDs. Each finding names the launch option or environment difference that commonly causes it, for example `--enable-automation` for `navigator.webdriver`, or the headless shell binary for a missing `window.chrome`.
+
+## Browser Contexts
+
+Playwright and Puppeteer apply locale, timezone, viewport, permissions, and init scripts per browser context, not per browser. By default `botprint run` creates its fresh diagnostic page inside the browser context of the first open page target, so those options are measured. The profile records which context was used in `source.browser_context_id` and `source.browser_context_source`.
+
+- `--context default` measures the browser's default context instead (process-level defaults only).
+- `--context <id>` picks a specific context; IDs are listed by `botprint targets --cdp ... --json`.
+- If no page is open, the fresh page falls back to the default context and the profile carries the `default-browser-context` note.
+- The diagnostic page is a real page in that context for the length of the probe: Playwright's `context.on("page")` fires, init scripts and route handlers apply to it, and it is closed when the probe ends.
+
+## Existing Pages
+
+To measure an already-open page in place, including its scripts, service workers, CSP, and storage state:
+
+```bash
+botprint targets --cdp http://127.0.0.1:9222 --json
+botprint run --cdp http://127.0.0.1:9222 --target <targetId> --out site.profile.json
+botprint run --cdp http://127.0.0.1:9222 --target-url https://app.example.test/ --out site.profile.json
+```
+
+These profiles carry the `page-contamination-possible` note, and HTTP headers are not captured in this mode.
+
+## Docker
+
+When the browser runs in a container, it needs a host-reachable diagnostic URL:
+
+```bash
+botprint run --cdp http://127.0.0.1:9334 --out docker.profile.json --label docker \
+  --diagnostic-bind 0.0.0.0 --diagnostic-host host.docker.internal
+```
+
+Omit both flags otherwise so the diagnostic page stays bound to `127.0.0.1`.
+
+## Playwright
+
+Expose CDP from the browser you want to measure:
+
+```ts
+import { chromium } from "playwright";
+
+const browser = await chromium.launch({ headless: true, args: ["--remote-debugging-port=9333"] });
+const page = await browser.newPage();
+await page.goto("about:blank");
+// Keep the process alive while Botprint connects to http://127.0.0.1:9333.
+```
+
+```python
+from playwright.sync_api import sync_playwright
+
+with sync_playwright() as p:
+    browser = p.chromium.launch(headless=True, args=["--remote-debugging-port=9333"])
+    page = browser.new_context().new_page()
+    page.goto("about:blank")
+    input("Botprint can attach to http://127.0.0.1:9333. Press Enter to quit.")
+```
+
+Use the headless mode and browser binary that the environment under investigation really runs. Playwright's default `chromium` is the headless shell; `channel: "chromium"` runs new headless mode. Both report `HeadlessChrome` in the user agent; only the shell also drops `window.chrome`, the PDF viewer plugins, and the outer window size.
+
+## Commands
+
+| Command | Purpose |
+| --- | --- |
+| `run` | Collect a profile from a CDP endpoint. |
+| `targets` | List page targets and their browser context IDs. `--json` for scripts. |
+| `report` | Render a Markdown report from a profile. |
+| `compare` | Compare a baseline profile against a candidate. |
+| `explain` | Render a compact explanation of a profile or compare result. |
+| `guide` | Guided terminal flow over the same commands. Alias: `tui`. |
+
+`botprint help <command>` lists flags. Notable `run` flags: `--probe-timeout <ms>` (per-check timeout inside the browser, default 2000), `--timeout <ms>` (CDP operations, default 10000), `--auth-header` (repeatable, for remote endpoints).
+
+## Exit Codes
+
+| Code | Meaning |
+| --- | --- |
+| `0` | Success, or compare found no material drift. |
+| `1` | Compare found material or high-confidence automation drift. |
+| `2` | Usage error. |
+| `3` | CDP connectivity failure. |
+| `4` | Probe failure. |
+| `5` | Schema validation failure. |
+
+## Output Contract
+
+Profile JSON and compare JSON are the stable surfaces for scripts and agents. Markdown and `explain` output are prose. Profiles from an older `schema_version` fail validation with a hint to regenerate, so re-collect baselines with the Botprint version that compares them. The contract, finding IDs, warning IDs, and category glossary are documented in [`docs/agent-usage.md`](docs/agent-usage.md). Drop-in agent presets (a Claude Code skill and an `AGENTS.md` snippet) live in [`agent-presets/`](agent-presets).
+
+## Validated On
+
+- Linux x64: Chromium headless, Playwright Chromium headless shell (source run and compiled binary)
+- macOS arm64: Google Chrome new headless (source run and compiled binary); headed Chrome, Playwright Chromium, and Docker Chrome via `chromedp/headless-shell` last checked on v0.1
+
+Not yet validated: Windows binary, remote authenticated `wss://` CDP endpoints.
+
+## Privacy
+
+Botprint does not upload anything. Profiles stay on disk. See [`PRIVACY.md`](PRIVACY.md) for what they contain.
+
+## Contributing and License
+
+See [`CONTRIBUTING.md`](CONTRIBUTING.md). MIT, see [`LICENSE`](LICENSE).

package/docs/agent-usage.md

@@ -0,0 +1,109 @@
+# Agent Usage
+
+This is the reference for coding agents (Claude Code, Codex, Cursor, browser-use, and similar) that run Botprint or interpret its output. The README covers installation and human workflows.
+
+Botprint is a diagnostic tool: it reports what a browser exposes, what differs from a baseline, and which launch option or environment difference is likely responsible. Report findings as causes to investigate. Botprint does not ship spoofing presets or patches.
+
+## When To Use
+
+- A Playwright, Puppeteer, browser-use, Stagehand, or raw CDP flow behaves differently across local, Docker, CI, or remote browsers.
+- The user wants to know what a site sees from a given browser: identity, headers, locale, fonts, GPU, storage, permissions.
+- The user provides a Botprint profile, compare JSON, report, or `explain` output.
+
+## Workflow
+
+1. Expose CDP on the browser under investigation (`--remote-debugging-port=9222`).
+2. Collect a profile per environment with `botprint run`. The fresh page is created inside the browser context of the first open page target, so framework context options are measured. Pass `--context default` to measure process defaults, or `--target`/`--target-url` to probe an open page in place.
+3. If a known-good baseline exists, `botprint compare baseline.json candidate.json --json`.
+4. Decide from JSON and exit codes. Use `report` and `explain --for-agent` as prose context.
+5. Read `verdict.warnings[]` before interpreting diffs: they say when a difference is a measurement artifact rather than drift.
+
+```bash
+botprint run --cdp http://127.0.0.1:9222 --out local.profile.json --label local
+botprint targets --cdp http://127.0.0.1:9222 --json
+botprint run --cdp http://127.0.0.1:9222 --target-url https://app.example.test/ --out site.profile.json --label site
+botprint compare local.profile.json docker.profile.json --json
+botprint explain compare.json --for-agent
+```
+
+Docker browsers need `--diagnostic-bind 0.0.0.0 --diagnostic-host host.docker.internal`. Remote endpoints take `--auth-header "Authorization: Bearer <redacted>"` (repeatable). Redact header values whenever you quote a command.
+
+## Stable Contract
+
+Parse and rely on:
+
+- profile JSON and compare JSON, keyed by `schema_version` (currently `0.3`)
+- exit codes
+- profile `source.probe_context`, `source.browser_context_id`, `source.browser_context_source`, `source.probe_warnings[]`, `source.target_id`, `source.target_type`
+- profile `findings[]`: `id`, `severity`, `category`
+- compare diff `id`, `level`, `category`, `path`, `baseline`, `candidate`; absent values are `{ "kind": "absent" }`
+- compare `verdict.level`, `verdict.material`, `verdict.categories[]`, `verdict.warnings[].id`, `verdict.warnings[].evidence`
+
+Treat as prose only: Markdown report bodies, `explain` wording, finding `title`/`evidence`/`explanation`/`likely_implications`/`suggested_investigation`, and warning `summary`/`implications`.
+
+## Exit Codes
+
+| Code | Meaning |
+| --- | --- |
+| `0` | Success, or compare found no material drift. |
+| `1` | Compare found material or high-confidence automation drift. Not a crash. |
+| `2` | Usage error. |
+| `3` | CDP connectivity failure. Check the endpoint and `--remote-debugging-port`. |
+| `4` | Probe failure. The in-browser probe threw; the message includes the exception. |
+| `5` | Schema validation failure. Regenerate the profile; do not hand-edit JSON. |
+
+## Findings
+
+Severity values: `high_confidence_automation_signal`, `compatibility_risk`, `warning`, `notable`, `normal`.
+
+| ID | Severity | Common cause |
+| --- | --- | --- |
+| `automation.webdriver_exposed` | high confidence | `--enable-automation`, passed by default by Puppeteer and Playwright, always by Selenium. |
+| `automation.common_globals_present` | high confidence | ChromeDriver (`cdc_*`), legacy headless stacks. |
+| `automation.chrome_object_missing` | notable | Headless shell binary (Playwright's default `chromium`) rather than new headless mode. |
+| `identity.headless_user_agent` | warning | Any Chromium headless mode; the headless shell and `--headless=new` both report `HeadlessChrome`. Only a headed browser reports `Chrome`. |
+| `identity.empty_plugins` | notable | The headless shell exposes no PDF viewer plugins; headed and new headless expose a fixed set. |
+| `environment.default_viewport` | notable | No viewport configured; Chromium default is 800x600. |
+| `environment.zero_outer_window` | notable | Headless shell reports no window. |
+| `rendering.swiftshader_webgl` | warning | No GPU, Docker, CI, or `--disable-gpu`. |
+| `rendering.webgl_unavailable` | compatibility risk | GPU disabled or unsupported flags. |
+| `rendering.unmasked_webgl_unavailable` | notable | Browser withholds `WEBGL_debug_renderer_info`. |
+| `rendering.canvas_unstable` | notable / compatibility risk | Canvas output varied between two draws. |
+| `rendering.no_common_fonts` | warning | Minimal container image with no fonts installed (`fc-list` is empty). |
+| `storage.cookies_disabled` | compatibility risk | Cookies disabled by policy or context option. |
+| `storage.indexeddb_unavailable` | compatibility risk / notable | Storage policy or restricted origin; `timeout` means the probe hit `--probe-timeout`. |
+| `permissions.unexpected_permissions_behavior` | notable | Permissions API query errored. |
+| `permissions.notifications_denied` | notable | The headless shell reports `Notification.permission` as denied; headed and new headless report prompt. |
+| `webrtc.host_candidate_error` | notable | WebRTC blocked by policy or sandboxing; `timeout` means the probe hit `--probe-timeout`. |
+| `http.accept_language_missing` | warning | No locale configured (headless shell, minimal containers). Set Playwright `locale` or `--lang`. |
+
+## Compare Levels and Warnings
+
+Diff `level` and `verdict.level`: `advisory`, `material`, `high_confidence_automation` (`verdict.level` can also be `none`). Loss of a storage capability, timezone, WebGL renderer, `window.chrome`, Accept-Language, and lost fonts are material; most other drift is advisory. User agent diffs ignore build-number noise and fire only on family, major version, or platform changes.
+
+Warnings never change the verdict or exit code. They tell you how much to trust the diffs:
+
+- `comparison.browser_binary_mismatch`: different binary families or majors two or more apart. Diffs may be binary artifacts.
+- `comparison.headless_mode_mismatch`: one profile is headless and the other is not, judged from the CDP product and the user agent. When the headless shell is involved, plugins, `window.chrome`, outer window, and notifications change too; with new headless mode only the user agent does.
+- `comparison.probe_context_mismatch`: one profile is a fresh page, the other an existing target.
+- `comparison.browser_context_mismatch`: one profile measured a page-target context and the other the browser default context. Locale, timezone, viewport, and permission diffs may be context configuration.
+- `comparison.http_not_captured`: headers exist on only one side; header diffs are skipped.
+
+Profile `source.probe_warnings[]`:
+
+- `page-contamination-possible`: existing-target profile; page scripts, service workers, CSP, cookies, and app state may affect signals.
+- `default-browser-context`: no page target was open, so the fresh page used the browser default context.
+- `multiple-browser-contexts`: page targets span several contexts; the first was used. Pass `--context <id>` to choose.
+- `http-not-captured`: the diagnostic page request was not observed.
+
+## Category Glossary
+
+- `automation`: WebDriver, `window.chrome`, known automation globals.
+- `identity`: user agent, client hints, platform, language(s), plugins, MIME types, PDF viewer.
+- `environment`: timezone, viewport, outer window, screen, hardware concurrency, device memory, speech voices.
+- `rendering`: WebGL, canvas, audio, fonts.
+- `storage`: cookies, localStorage, sessionStorage, IndexedDB, service worker.
+- `permissions`: Permissions API states and `Notification.permission` (`notification_api`).
+- `webrtc`: WebRTC API and host-candidate gathering.
+- `http`: request headers sent for the diagnostic page (fresh-page mode only).
+- `cdp`: browser product and protocol metadata.

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "botprint",
+  "version": "0.2.0",
+  "description": "Botprint shows what your automated browser exposes to the web, and what changed from your baseline.",
+  "license": "MIT",
+  "type": "module",
+  "keywords": [
+    "cdp",
+    "chrome-devtools-protocol",
+    "browser-automation",
+    "playwright",
+    "puppeteer",
+    "headless-chrome",
+    "diagnostics",
+    "agent-tools",
+    "debugging"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oh-meh/botprint.git"
+  },
+  "bugs": {
+    "url": "https://github.com/oh-meh/botprint/issues"
+  },
+  "homepage": "https://github.com/oh-meh/botprint#readme",
+  "engines": {
+    "bun": ">=1.2.0"
+  },
+  "bin": {
+    "botprint": "src/cli.ts"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "PRIVACY.md",
+    "docs/agent-usage.md"
+  ],
+  "scripts": {
+    "botprint": "bun run src/cli.ts",
+    "build": "bun build --compile src/cli.ts --outfile dist/botprint",
+    "build:release": "bun run scripts/build-release.ts",
+    "examples:generate": "bun run scripts/generate-examples.ts",
+    "smoke:local": "bun run scripts/smoke-local.ts",
+    "test": "bun test",
+    "typecheck": "tsc --noEmit",
+    "check": "bun run typecheck && bun test"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.13",
+    "typescript": "^6.0.3"
+  },
+  "dependencies": {
+    "zod": "^4.3.6"
+  }
+}