getmyenv 0.13.0 → 0.14.0

package/dist/lib/fs.js

@@ -27,17 +27,29 @@ export function getProjectRoot(cwd = process.cwd()) {
 export function getLocalDir(cwd = process.cwd()) {
     return path.join(getProjectRoot(cwd), LOCAL_DIR);
 }
-export function readProjectMeta(cwd = process.cwd()) {
-    const file = path.join(getLocalDir(cwd), "project.json");
+/** Text of a file as UTF-8, without a byte order mark (Notepad and PowerShell 5.1 add one). */
+export function readTextFile(file) {
+    return fs.readFileSync(file, "utf8").replace(/^/, "");
+}
+/**
+ * Parse a JSON file. Null when it does not exist. Invalid JSON throws
+ * `invalid`: a broken file is never read as missing, so it is never
+ * silently replaced.
+ */
+export function readJsonFile(file, invalid) {
     if (!fs.existsSync(file))
         return null;
-    let raw;
     try {
-        raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        return JSON.parse(readTextFile(file));
     }
     catch {
-        return null;
+        throw new Error(invalid);
     }
+}
+export const PROJECT_JSON_INVALID = ".getmyenv/project.json is not valid JSON. Fix it, or restore it: git checkout -- .getmyenv/project.json";
+export function readProjectMeta(cwd = process.cwd()) {
+    const file = path.join(getLocalDir(cwd), "project.json");
+    const raw = readJsonFile(file, PROJECT_JSON_INVALID);
     if (!raw || typeof raw !== "object")
         return null;
     const d = raw;
@@ -69,21 +81,32 @@ export function writeProjectMeta(meta, cwd = process.cwd()) {
     fs.writeFileSync(path.join(dir, "project.json"), JSON.stringify(payload, null, 2) + "\n", { mode: 0o600 });
 }
 /**
- * Write a file only this user can read. Never through a symlink. A new file
- * is created with `wx`; an existing one is replaced only when `overwrite`.
+ * Check that `file` can be written as a plain file: not a symlink, not a
+ * folder, and its folder exists. Returns its stats, or null when it is new.
  */
-export function writePrivateFile(file, content, opts) {
-    let stat = null;
-    try {
-        stat = fs.lstatSync(file);
-    }
-    catch {
-        /* does not exist */
-    }
+export function assertFileTarget(file) {
+    const stat = fs.lstatSync(file, { throwIfNoEntry: false }) ?? null;
     if (stat?.isSymbolicLink())
         throw new Error(`${file} is a symlink. Refusing to write through it.`);
+    if (stat?.isDirectory()) {
+        throw new Error(`${file} is a folder. Pass a file name with -o.`);
+    }
     if (stat && !stat.isFile())
         throw new Error(`${file} is not a regular file.`);
+    if (!stat) {
+        const dir = path.dirname(path.resolve(file));
+        if (!fs.statSync(dir, { throwIfNoEntry: false })?.isDirectory()) {
+            throw new Error(`The folder ${path.dirname(file)} does not exist. Create it first, or pick another path with -o.`);
+        }
+    }
+    return stat;
+}
+/**
+ * Write a file only this user can read. Never through a symlink. A new file
+ * is created with `wx`; an existing one is replaced only when `overwrite`.
+ */
+export function writePrivateFile(file, content, opts) {
+    const stat = assertFileTarget(file);
     if (stat && !opts.overwrite)
         throw new Error(`${file} already exists. Pick another name with -o.`);
     fs.writeFileSync(file, content, { mode: 0o600, flag: stat ? "w" : "wx" });
@@ -265,7 +288,7 @@ export function readClaimFile(cwd = process.cwd()) {
     if (!fs.existsSync(file))
         return null;
     try {
-        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        const raw = JSON.parse(readTextFile(file));
         if (typeof raw.claimCode !== "string" ||
             typeof raw.passphrase !== "string" ||
             typeof raw.projectId !== "string") {
@@ -303,20 +326,76 @@ export function clearClaimFile(cwd = process.cwd()) {
     fs.unlinkSync(file);
     return true;
 }
-/** dotenv rules (multiline values, inline comments, BOM), valid names only. */
-export function parseEnvText(text) {
-    const out = {};
+/** dotenv rules (multiline values, inline comments, BOM). Invalid names land in `skipped`. */
+export function readEnvText(text) {
+    const values = {};
+    const skipped = [];
     for (const [key, value] of Object.entries(dotenv.parse(text))) {
         if (isValidVariableName(key))
-            out[key] = value;
+            values[key] = value;
+        else
+            skipped.push(key);
+    }
+    return { values, skipped };
+}
+/** `readEnvText`, valid names only. */
+export function parseEnvText(text) {
+    return readEnvText(text).values;
+}
+/**
+ * Text from bytes, by byte order mark: UTF-16 LE or BE (PowerShell 5.1 `>`
+ * writes UTF-16 LE), else UTF-8 without its BOM.
+ */
+export function decodeText(buf) {
+    if (buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe) {
+        return buf.subarray(2, 2 + ((buf.length - 2) & ~1)).toString("utf16le");
+    }
+    if (buf.length >= 2 && buf[0] === 0xfe && buf[1] === 0xff) {
+        return Buffer.from(buf.subarray(2, 2 + ((buf.length - 2) & ~1))).swap16().toString("utf16le");
+    }
+    return buf.toString("utf8").replace(/^/, "");
+}
+/** `readEnvText` for a file, UTF-8 or UTF-16. A missing file reads as empty. */
+export function readEnvFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return { values: {}, skipped: [] };
+    return readEnvText(decodeText(fs.readFileSync(filePath)));
+}
+/** Names that appear more than once in an env file, with their count. dotenv keeps the last one. */
+export function duplicateEnvNames(filePath) {
+    if (!fs.existsSync(filePath))
+        return [];
+    const counts = new Map();
+    const text = decodeText(fs.readFileSync(filePath));
+    for (const line of splitEnvEntries(text)) {
+        // Same line rule as dotenv: optional `export`, a name, then = or :.
+        const m = line.match(/^\s*(?:export\s+)?([\w.-]+)\s*[=:]/);
+        if (m?.[1])
+            counts.set(m[1], (counts.get(m[1]) ?? 0) + 1);
+    }
+    return [...counts.entries()].filter(([, n]) => n > 1).map(([name, count]) => ({ name, count }));
+}
+/** Lines of an env file, skipping the inside of quoted multiline values. */
+function splitEnvEntries(text) {
+    const out = [];
+    const lines = text.replace(/\r\n?/g, "\n").split("\n");
+    let open = null;
+    for (const line of lines) {
+        if (open) {
+            if (line.includes(open))
+                open = null;
+            continue;
+        }
+        out.push(line);
+        const m = line.match(/^\s*(?:export\s+)?[\w.-]+\s*[=:]\s*(["'`])(.*)$/);
+        if (m && !m[2].includes(m[1]))
+            open = m[1];
     }
     return out;
 }
 /** `parseEnvText` for a file. A missing file reads as empty. */
 export function parseEnvFile(filePath) {
-    if (!fs.existsSync(filePath))
-        return {};
-    return parseEnvText(fs.readFileSync(filePath, "utf8"));
+    return readEnvFile(filePath).values;
 }
 const ENV_SKIP_DIRS = new Set([
     "node_modules",

package/dist/lib/known-keys-cache.d.ts

@@ -1,6 +1,7 @@
 /**
- * Staff additions to the known keys list, cached in the config dir and
- * refreshed once a day. Any failure keeps the bundled list.
+ * Staff additions to the known keys list, and the defaults staff turned off,
+ * cached in the config dir and refreshed once a day. Any failure keeps the
+ * bundled list.
  */
 import { type KnownKeyIndex } from "@getmyenv/shared";
 /** The bundled list plus the cached additions. No network. */

package/dist/lib/known-keys-cache.js

@@ -1,6 +1,7 @@
 /**
- * Staff additions to the known keys list, cached in the config dir and
- * refreshed once a day. Any failure keeps the bundled list.
+ * Staff additions to the known keys list, and the defaults staff turned off,
+ * cached in the config dir and refreshed once a day. Any failure keeps the
+ * bundled list.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -25,6 +26,8 @@ function readCache() {
             etag: typeof data.etag === "string" ? data.etag : null,
             checkedAt: data.checkedAt,
             entries: data.entries,
+            // Caches from older CLIs have no disabled list.
+            disabled: Array.isArray(data.disabled) ? data.disabled : [],
         };
     }
     catch {
@@ -44,7 +47,10 @@ export function knownKeys() {
     if (index)
         return index;
     const cached = readCache();
-    index = cached?.entries.length ? createKnownKeyIndex(KNOWN_KEYS, cached.entries) : BUNDLED_KNOWN_KEYS;
+    index =
+        cached && (cached.entries.length || cached.disabled.length)
+            ? createKnownKeyIndex(KNOWN_KEYS, cached.entries, cached.disabled)
+            : BUNDLED_KNOWN_KEYS;
     return index;
 }
 /**
@@ -77,7 +83,13 @@ export async function refreshKnownKeys(apiUrl) {
         const data = JSON.parse(text);
         if (!Array.isArray(data.entries))
             return;
-        writeCache({ apiUrl, etag: res.headers.get("etag"), checkedAt, entries: data.entries });
+        writeCache({
+            apiUrl,
+            etag: res.headers.get("etag"),
+            checkedAt,
+            entries: data.entries,
+            disabled: Array.isArray(data.disabled) ? data.disabled : [],
+        });
         index = null;
     }
     catch {

package/dist/lib/known-keys.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { publicSecretWarning } from "@getmyenv/shared";
 import { knownKeys } from "./known-keys-cache.js";
 /** "Did you mean OPENAI_API_KEY?" for names close to a known one. Nothing is renamed. */

package/dist/lib/recovery-code.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { assertRecoveryWrap, createRecoveryWrap, createUserKeys, formatRecoveryCode, recoveryCodesMatch, wipe, } from "@getmyenv/crypto";
 import { FACTS } from "@getmyenv/shared";
 import { readLine } from "./fs.js";

package/dist/lib/resolve.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { ApiError } from "./api.js";
 import { sleep } from "./authorize.js";
 import { signMachineProof } from "./identity.js";

package/dist/lib/run-env.d.ts

@@ -1,12 +1,28 @@
 export { explainLines, mergeEnv, runContextLabel, validationError, type MissingKey } from "@getmyenv/shared";
 /** Names from the server go into an environment or a file. Refuse any that are not variable names. */
 export declare function assertVariableNames(names: Iterable<string>): void;
+/**
+ * One argument for a Windows program: quoted by the MSVCRT rules (backslashes
+ * before a quote or the end are doubled, inner quotes become \"), then every
+ * cmd.exe metacharacter, quotes included, is escaped with ^ so cmd passes the
+ * text through untouched and never expands %VAR%. A .cmd or .bat file reads
+ * its arguments through cmd a second time, so those get a second ^.
+ */
+export declare function windowsArgument(arg: string, batch?: boolean): string;
 /**
  * One cmd.exe command line from argv. Windows needs the shell to find `npm.cmd`
  * and friends, and Node does not quote args passed alongside `shell: true`.
- * cmd expands %VAR% even inside quotes, so each % is closed out of the quotes
- * and escaped with ^.
+ * Arguments follow cross-spawn's rules (see `windowsArgument`). The command
+ * is quoted when it holds a space, so a path like C:\Program Files works.
+ */
+export declare function windowsCommandLine(args: string[], opts?: {
+    batch?: boolean;
+}): string;
+/**
+ * True when cmd.exe would start `command` from a .cmd or .bat file (npm, npx,
+ * pnpm and most node_modules/.bin shims). Looks in the current folder, then
+ * PATH, with PATHEXT, the way cmd does.
  */
-export declare function windowsCommandLine(args: string[]): string;
+export declare function isWindowsBatch(command: string, env: Record<string, string | undefined>, cwd?: string): boolean;
 /** Exit code for a child that ended by signal: 128 + signal number, like a shell. */
 export declare function signalExitCode(signal: NodeJS.Signals, numbers: Record<string, number>): number;

package/dist/lib/run-env.js

@@ -2,6 +2,8 @@
  * Pure pieces of `getmyenv run`. Merge, validate and explain live in
  * @getmyenv/shared so the homepage demo prints the same text.
  */
+import fs from "node:fs";
+import path from "node:path";
 import { isValidVariableName } from "@getmyenv/shared";
 export { explainLines, mergeEnv, runContextLabel, validationError } from "@getmyenv/shared";
 /** Names from the server go into an environment or a file. Refuse any that are not variable names. */
@@ -12,23 +14,74 @@ export function assertVariableNames(names) {
         }
     }
 }
+/** Characters cmd.exe treats as special. Each one gets a ^ in front, outside or inside quotes. */
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+/** Args made only of these go through as they are. */
+const PLAIN_ARG = /^[\w\-.:/\\+@]+$/;
+/**
+ * One argument for a Windows program: quoted by the MSVCRT rules (backslashes
+ * before a quote or the end are doubled, inner quotes become \"), then every
+ * cmd.exe metacharacter, quotes included, is escaped with ^ so cmd passes the
+ * text through untouched and never expands %VAR%. A .cmd or .bat file reads
+ * its arguments through cmd a second time, so those get a second ^.
+ */
+export function windowsArgument(arg, batch = false) {
+    if (arg !== "" && PLAIN_ARG.test(arg))
+        return arg;
+    let quoted = arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1");
+    quoted = `"${quoted}"`.replace(CMD_META, "^$1");
+    return batch ? quoted.replace(CMD_META, "^$1") : quoted;
+}
 /**
  * One cmd.exe command line from argv. Windows needs the shell to find `npm.cmd`
  * and friends, and Node does not quote args passed alongside `shell: true`.
- * cmd expands %VAR% even inside quotes, so each % is closed out of the quotes
- * and escaped with ^.
+ * Arguments follow cross-spawn's rules (see `windowsArgument`). The command
+ * is quoted when it holds a space, so a path like C:\Program Files works.
+ */
+export function windowsCommandLine(args, opts = {}) {
+    const [command = "", ...rest] = args;
+    return [windowsCommandName(command), ...rest.map((a) => windowsArgument(a, opts.batch === true))].join(" ");
+}
+/**
+ * The program to start. cmd finds it by its own quote rules, and the program
+ * reads its own name from the same text, so a path with spaces is plainly
+ * quoted. A % is closed out of the quotes and escaped, so cmd does not expand it.
  */
-export function windowsCommandLine(args) {
-    return args
-        .map((a) => {
-        if (a === "")
-            return '""';
-        if (!/[\s"&|<>^()%]/.test(a))
-            return a;
-        const escaped = a.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1");
-        return `"${escaped.replace(/%/g, '"^%"')}"`;
-    })
-        .join(" ");
+function windowsCommandName(command) {
+    if (PLAIN_ARG.test(command))
+        return command;
+    return `"${command.replace(/"/g, "").replace(/%/g, '"^%"')}"`;
+}
+function envValue(env, name) {
+    const key = Object.keys(env).find((k) => k.toUpperCase() === name);
+    return key ? env[key] : undefined;
+}
+/**
+ * True when cmd.exe would start `command` from a .cmd or .bat file (npm, npx,
+ * pnpm and most node_modules/.bin shims). Looks in the current folder, then
+ * PATH, with PATHEXT, the way cmd does.
+ */
+export function isWindowsBatch(command, env, cwd = process.cwd()) {
+    if (/\.(cmd|bat)$/i.test(command))
+        return true;
+    if (path.extname(command))
+        return false;
+    const exts = (envValue(env, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+    const hasDir = /[\\/]/.test(command);
+    const dirs = hasDir ? [""] : [cwd, ...(envValue(env, "PATH") ?? "").split(";").filter(Boolean)];
+    for (const dir of dirs) {
+        for (const ext of exts) {
+            const file = path.resolve(dir || cwd, `${command}${ext}`);
+            try {
+                if (fs.statSync(file).isFile())
+                    return /^\.(cmd|bat)$/i.test(ext);
+            }
+            catch {
+                /* not here */
+            }
+        }
+    }
+    return false;
 }
 /** Exit code for a child that ended by signal: 128 + signal number, like a shell. */
 export function signalExitCode(signal, numbers) {

package/dist/lib/template-file.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { mergeTemplateFile, templateFileSchema, TEMPLATE_FILE, TEMPLATE_FILE_MAX_KEYS, } from "@getmyenv/shared";
 import { getLocalDir } from "./fs.js";
 export function templateFilePath(cwd = process.cwd()) {

package/dist/lib/update-check.js

@@ -6,7 +6,7 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { CLI_VERSION } from "./api.js";
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 const FETCH_TIMEOUT_MS = 2500;

package/dist/lib/upload.js

@@ -5,10 +5,10 @@ import { writeKey } from "./vault.js";
 /** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
 export function assertWritable(linked, ctx) {
     if (linked.who.token.kind === "server") {
-        throw new Error(`Server tokens are read-only. ${FACTS.readOnlyWho}`);
+        throw new Error(`Server tokens cannot change values. ${FACTS.readOnlyWho}`);
     }
     if (ctx.protection === "locked") {
-        throw new Error(`${ctx.slug} is read-only. ${FACTS.readOnlyWho}`);
+        throw new Error(`${ctx.slug} is Read-only. ${FACTS.readOnlyWho}`);
     }
 }
 /**

package/dist/lib/vault.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { createUserKeys, generateContextKey, openSealedKey, sealContextKey, splitServerToken, unwrapPrivateKey, wipe, } from "@getmyenv/crypto";
 import { VAULT_UNLOCK_DURATION } from "@getmyenv/shared";
 import { ApiError } from "./api.js";

package/dist/providers/http.js

@@ -1,4 +1,4 @@
-import { API_TIMEOUT_MS } from "../lib/api.js";
+import { withDeadline } from "../lib/api.js";
 export class PlatformError extends Error {
     status;
     constructor(message, status) {
@@ -29,23 +29,26 @@ function errorMessage(body) {
  */
 export async function platformRequest(opts) {
     let res;
+    let text;
     try {
-        res = await fetch(`${opts.base}${opts.path}`, {
-            method: opts.method,
-            headers: {
-                authorization: `Bearer ${opts.token}`,
-                ...(opts.body !== undefined ? { "content-type": "application/json" } : {}),
-            },
-            body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
-            redirect: "error",
-            signal: AbortSignal.timeout(API_TIMEOUT_MS),
-        });
+        ({ res, text } = await withDeadline(async (signal) => {
+            const res = await fetch(`${opts.base}${opts.path}`, {
+                method: opts.method,
+                headers: {
+                    authorization: `Bearer ${opts.token}`,
+                    ...(opts.body !== undefined ? { "content-type": "application/json" } : {}),
+                },
+                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+                redirect: "error",
+                signal,
+            });
+            return { res, text: await res.text() };
+        }));
     }
     catch (err) {
         const why = err instanceof Error && err.name === "TimeoutError" ? "timed out" : "is unreachable";
         throw new PlatformError(`${opts.title} ${why}.`, 0);
     }
-    const text = await res.text();
     let parsed = null;
     if (text) {
         try {

package/dist/providers/netlify.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { isPublicEnvName, isReservedPushName } from "@getmyenv/shared";
+import { pushApiBase } from "../lib/api-url.js";
 import { PlatformError, platformRequest } from "./http.js";
 export const NETLIFY_API = "https://api.netlify.com";
 const MAX_VALUE_CHARS = 5000;
@@ -21,11 +22,12 @@ export function readNetlifyStateFile(cwd = process.cwd()) {
 }
 export function createNetlifyAdapter(opts) {
     const target = opts.target;
+    const base = pushApiBase(NETLIFY_API);
     let siteId = "";
     let accountId = "";
     let vars = null;
     const secretRefused = [];
-    const request = (method, p, body) => platformRequest({ title: "Netlify", base: NETLIFY_API, token: opts.token, method, path: p, body });
+    const request = (method, p, body) => platformRequest({ title: "Netlify", base, token: opts.token, method, path: p, body });
     const envPath = (suffix = "") => `/api/v1/accounts/${encodeURIComponent(accountId)}/env${suffix}?site_id=${encodeURIComponent(siteId)}`;
     const valuesOf = (v) => v.values ?? [];
     const find = (name) => (vars ?? []).find((v) => v.key === name);

package/dist/providers/vercel.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { isPublicEnvName, isReservedPushName } from "@getmyenv/shared";
+import { pushApiBase } from "../lib/api-url.js";
 import { PlatformError, platformRequest } from "./http.js";
 export const VERCEL_API = "https://api.vercel.com";
 const MAX_TOTAL_BYTES = 64 * 1024;
@@ -31,13 +32,14 @@ function vercelType(type) {
 }
 export function createVercelAdapter(opts) {
     const target = opts.target;
+    const base = pushApiBase(VERCEL_API);
     let projectId = "";
     let teamId;
     let envs = null;
     const request = (method, p, body) => {
         const sep = p.includes("?") ? "&" : "?";
         const full = teamId ? `${p}${sep}teamId=${encodeURIComponent(teamId)}` : p;
-        return platformRequest({ title: "Vercel", base: VERCEL_API, token: opts.token, method, path: full, body });
+        return platformRequest({ title: "Vercel", base, token: opts.token, method, path: full, body });
     };
     /** Entries that set a value for the pushed target on every branch. Branch-only entries are not ours. */
     const forTarget = (key) => (envs ?? []).filter((e) => !e.gitBranch && targetsOf(e).includes(target) && (key === undefined || e.key === key));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {
@@ -13,35 +13,42 @@
     "README.md",
     "LICENSE"
   ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/yobotn/getmyenv.git"
-  },
   "homepage": "https://getmyenv.com",
   "bugs": {
-    "url": "https://github.com/yobotn/getmyenv/issues"
+    "url": "https://getmyenv.com/contact",
+    "email": "hello@getmyenv.com"
   },
   "keywords": [
     "env",
-    "environment",
-    "secrets",
     "dotenv",
-    "cli"
+    "environment-variables",
+    "secrets",
+    "secrets-management",
+    "encryption",
+    "e2ee",
+    "end-to-end-encryption",
+    "cli",
+    "config",
+    "configuration",
+    "devops",
+    "vault",
+    ".env",
+    "api-keys"
   ],
   "license": "MIT",
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@getmyenv/crypto": "0.6.0",
-    "@getmyenv/shared": "0.12.0",
+    "@getmyenv/crypto": "0.6.1",
+    "@getmyenv/shared": "0.13.0",
     "@napi-rs/keyring": "^2.1.0",
     "commander": "^15.0.0",
     "dotenv": "^16.4.7",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.13.10",
+    "@types/node": "^24.19.0",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11"
   },