insta 0.1.16 → 0.1.17

package/dist/agent.js

@@ -18,6 +18,9 @@ export function canonicalTarget(path) {
     return url.pathname + url.search;
 }
 const guidance = 'agent session missing, expired, or for another project/environment — run `insta agent setup`';
+/** No usable agent session for the project, looked up from the current directory. */
+export class AgentSessionMissing extends Error {
+}
 export async function issueAgentSession(api, projectId) {
     const pair = generateKeyPairSync('ed25519');
     const client = mode?.client ?? detectAgent(false)?.client ?? 'unknown';
@@ -60,7 +63,7 @@ export async function loadAgentSession(apiUrl, projectId, cwd = process.cwd()) {
         return session;
     }
     catch {
-        throw new Error(guidance);
+        throw new AgentSessionMissing(guidance);
     }
 }
 // Routes the CLI may call on an account-level (bootstrap) session, by first path segment. Every

package/dist/commands/billing.js

@@ -32,15 +32,36 @@ export function billingLines(s, org) {
     ];
     if (s.subscriptionStatus)
         lines.push(`subscription:    ${s.subscriptionStatus}`);
-    if (s.billingStatus === 'suspended') {
-        // Four causes, five messages, and every one is a dead end for the others. Tier first: only a
+    if (s.pendingPlanChange) {
+        const pending = s.pendingPlanChange;
+        const boundary = new Date(pending.effectiveAt).toISOString().replace('T', ' ').replace('.000Z', ' UTC');
+        lines.push(pending.status === 'scheduled'
+            ? `next plan:       ${pending.toTier} at ${boundary}`
+            : `plan change:     preparing ${pending.toTier}; requested boundary ${boundary}`);
+        if (pending.changeKind === 'upgrade') {
+            lines.push(`full-cycle allowance: $${Number(pending.includedUsd).toFixed(2)} (next renewal)`);
+            lines.push('Current cycle: proportional allowance increase; existing usage and renewal date are preserved.');
+        }
+        else
+            lines.push(`next allowance:  $${Number(pending.includedUsd).toFixed(2)} (available after cutover)`);
+        lines.push(pending.changeKind === 'downgrade'
+            ? 'Current paid plan remains active until period end. Withdraw this downgrade in Console Plans before it takes effect.'
+            : 'A plan change is pending; contact support for billing changes.');
+    }
+    if (s.tier === 'enterprise') {
+        lines.push('Enterprise billing is managed by staff; payment failure does not change the plan.');
+        if (s.billingStatus === 'suspended')
+            lines.push('Contact support for billing or resource recovery.');
+    }
+    else if (s.billingStatus === 'suspended' && !s.pendingPlanChange) {
+        // Ordinary-plan recovery advice depends on the cause. Tier first: only a
         // free org can spend a prepaid wallet, and waiting for the next cycle genuinely fixes that one.
         // (Tier, not subscriptionStatus, because rows written before non-payment suspended carry
         // `unpaid` beside tier 'free' and survive with no migration.) Then the status splits the paid
         // branch three ways: an invoice to settle, a subscription to replace, or — when it reads
         // healthy — a suspension that outlived its cause, which is what a recovery whose compute failed
         // to restart looks like, and where telling them to pay means re-settling a paid invoice. The
-        // replace case is the one that splits again, because enterprise has no self-serve checkout.
+        // Enterprise and pending changes were handled above: neither offers self-serve checkout.
         //
         // EVERY command here carries the caller's --org. `billing` and the command being suggested
         // resolve the target independently, so a hint that drops the flag acts on a different org than
@@ -53,13 +74,9 @@ export function billingLines(s, org) {
             : lapsed
                 ? `⚠  org suspended — subscription payment did not go through; settle it in \`insta billing portal${flag}\``
                 : ended
-                    ? s.tier === 'enterprise'
-                        // Per-deal, and `billing subscribe` cannot create one: naming a self-serve tier here
-                        // would move them off the plan they negotiated.
-                        ? '⚠  org suspended — the subscription ended; contact support to restore this plan'
-                        // Their OWN tier, not a hardcoded one: suggesting `subscribe pro` to a Team org
-                        // resubscribes it onto the wrong plan.
-                        : `⚠  org suspended — the subscription ended; resubscribe with \`insta billing subscribe ${s.tier}${flag}\``
+                    // Their OWN tier, not a hardcoded one: suggesting `subscribe pro` to a Team org
+                    // resubscribes it onto the wrong plan.
+                    ? `⚠  org suspended — the subscription ended; resubscribe with \`insta billing subscribe ${s.tier}${flag}\``
                     // Deliberately claims nothing about the subscription: `incomplete` reaches here too,
                     // and that one is neither current nor failed. All this branch knows is that the
                     // suspension has no billing cause it can name.
@@ -157,7 +174,7 @@ export async function billingRedeem(code, opts) {
     for (const l of redeemLines(res))
         info(l);
 }
-// insta billing portal — open the Stripe Customer Portal (change plan / card / cancel).
+// insta billing portal — manage payment methods. UTC-managed plans cannot change/cancel here.
 export async function billingPortal(opts) {
     const api = await ApiClient.load();
     const orgId = await resolveOrgId(opts);

package/dist/commands/compute.js

@@ -1,4 +1,6 @@
-import { ApiClient, ApiError, requireProject } from '../api.js';
+import { AgentApprovalRequired, ApiClient, ApiError, requireProject } from '../api.js';
+import { AgentSessionMissing } from '../agent.js';
+import { safeText } from '../config.js';
 import { info, printJson, handleApproval, relayExitCode, writeFileAtomicSync, resolveThroughSymlink } from '../util.js';
 import { resolveComputeServiceId, resolveSoleService, q, parseVolumeGib, parseCount } from './services.js';
 export const isWorker = (s) => s.port === 0;
@@ -103,7 +105,7 @@ export function domainStatusLines(r, ctx = {}) {
     }
     const records = recordsOf(r);
     const out = [`${r.hostname} -> ${targetOf(r)}`];
-    const txt = records.find((d) => d.type === 'TXT');
+    const txt = records.find((d) => d.type === 'TXT' && d.purpose !== 'edge_ownership');
     // The ROUTING records for the hostname, whatever type they take: a CNAME for a subdomain, or the
     // A/AAAA PAIR an apex needs (Fly's apex path emits both). All of them, not the first one —
     // a correct A beside a missing AAAA is not "routing is fine".
@@ -111,12 +113,6 @@ export function domainStatusLines(r, ctx = {}) {
     const routing = records.filter(isRouting);
     const blockers = [];
     const stage = (label, state, detail) => out.push(`  ${pad(label, 12)}${pad(state, 10)}${detail ? `  ${detail}` : ''}`);
-    // The ONE verdict rule, applied to EVERY record the platform returned regardless of its role.
-    // A record is settled only when the platform says `ok` — or, for a provider that reports no
-    // per-record status at all (Fly), when it vouched for the whole set with `configured`. missing,
-    // mismatch and never-checked are each outstanding and each add a blocker. Applying this to only
-    // some records lets an apex whose AAAA is missing, or a still-pending validation record, ride
-    // under a `serving https://…` line.
     const verdictOf = (d) => d.status ?? (r.configured ? 'ok' : 'unchecked');
     if (txt) {
         const st = verdictOf(txt);
@@ -173,15 +169,16 @@ export function domainStatusLines(r, ctx = {}) {
             blockers.push(`${d.type} unchecked`);
         }
     }
-    // Everything else the platform returned — a Let's Encrypt validation CNAME, any extra record.
-    // Same rule, no exemption: an outstanding record is outstanding whatever its role.
     for (const d of records) {
         if (d === txt || isRouting(d))
             continue;
         const st = verdictOf(d);
         const lbl = d.type.toLowerCase();
         const where = `${d.name} -> ${d.value}${d.note ? `  (${d.note})` : ''}`;
-        if (st === 'ok')
+        if (d.type === 'TXT' && d.purpose === 'edge_ownership' && st === 'unchecked') {
+            stage('edge TXT', 'unchecked', `${where} (Cloudflare validates this record; see certificate status below)`);
+        }
+        else if (st === 'ok')
             stage(lbl, 'ok', where);
         else if (st === 'mismatch') {
             stage(lbl, 'mismatch', `${d.type} ${d.name} must point at ${d.value}`);
@@ -822,7 +819,7 @@ import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
-import { aliasFor, certifiesPublicKey, hasOwnedBlock, isSafeAlias, isSafeConfigValue, isSafeSSHHost, isSafeSSHUsername, isSafeTimestamp, isSSHCertificateRecord, mayWidenCAHost, parseCAPublicKey, planCertAuthority, renderConfigBlock, revertCertAuthority, upsertConfigBlock, ownedBlock, ownedBlockIsFirst } from './ssh-config.js';
+import { ALIAS_SUFFIX, aliasFor, certifiesPublicKey, hasOwnedBlock, isSafeAlias, isSafeConfigValue, isSafeSSHHost, isSafeSSHUsername, isSafeTimestamp, isSSHCertificateRecord, mayWidenCAHost, parseCAPublicKey, planCertAuthority, renderConfigBlock, revertCertAuthority, upsertConfigBlock, ownedBlock, ownedBlockIsFirst } from './ssh-config.js';
 /** Where this CLI keeps its own SSH material. Deliberately NOT ~/.ssh: we never
  *  touch a key the user already had, and a dedicated key pairs with
  *  IdentitiesOnly to avoid being identified by the wrong one. */
@@ -1017,6 +1014,8 @@ function ensureKeyPair() {
 const keyMaterial = (record) => record.split(/\s+/).slice(0, 2).join(' ');
 async function mintCert(api, projectId, serviceId, publicKey, alias, signal) {
     const res = await api.rawRequest('POST', `/projects/${projectId}/services/${serviceId}/ssh-cert`, { publicKey }, { signal });
+    if (res.status === 202 && res.body?.status === 'approval_required')
+        throw new AgentApprovalRequired(res.body);
     if (res.status < 200 || res.status >= 300) {
         throw new ApiError(res.status, res.body?.error ?? 'could not issue an ssh certificate');
     }
@@ -1458,6 +1457,27 @@ function readUserText(path) {
     }
     return text;
 }
+/** Another process holds this alias's renewal lock and is renewing it now. */
+class RenewalInProgress extends Error {
+}
+/** The one line a missing or expired certificate that could not be renewed gets: the cause and the fix. */
+export function renewalFailureNotice(alias, err) {
+    const head = `insta: the SSH certificate for ${alias} is missing or expired`;
+    const fix = `insta compute ssh ${alias.slice(0, -ALIAS_SUFFIX.length)}`;
+    if (err instanceof RenewalInProgress) {
+        return `${head} and another ssh may be renewing it right now. Retry in a moment, or run "${fix}".`;
+    }
+    if (err instanceof AgentSessionMissing) {
+        return `${head}. Agent mode found no agent session for its project in this directory. Run ssh from the project directory, or ask a person to run "${fix}".`;
+    }
+    if (err instanceof AgentApprovalRequired) {
+        return `${head} and renewing it needs approval. ${safeText(err.message.replace(/\s+/g, ' ')).trim()} Retry after it is approved.`;
+    }
+    if (err instanceof ApiError && err.status === 403 && err.message.endsWith('denied by agent policy')) {
+        return `${head} and this project's agent policy does not allow renewing it.`;
+    }
+    return `${head} and could not be renewed. Run "${fix}" to renew it.`;
+}
 /**
  * The renewal hook OpenSSH runs while PARSING the config, before it connects.
  *
@@ -1475,15 +1495,20 @@ function readUserText(path) {
  *    rule __update-check relies on), so the fast path is genuinely local only
  *    when the hook enters through that name.
  *  - Silent and fail-safe. An unlinked directory, an expired login or a network
- *    outage must not print anything or fail the parse: the existing certificate
- *    stays in place and the login then fails with SSH's own message, not a CLI
- *    error spliced into the middle of an ssh session.
+ *    outage must not fail the parse: the existing certificate stays in place.
+ *    Only an already expired one earns a single stderr line saying why.
  */
 export async function ensureCertForAlias(alias, timeoutMs = RENEWAL_REQUEST_TIMEOUT_MS) {
     let release;
+    let explainOnExit = false;
+    let cause;
     try {
         if (!isSafeAlias(alias))
             return;
+        const managed = readAliasStore();
+        if (!managed[alias])
+            return; // not an alias this CLI manages: stay silent
+        explainOnExit = true; // set before the repair, which can throw too
         // Repair BEFORE the renewal gate, because the stanza can lag the store
         // with no certificate due: an alias set up before the Port line existed
         // dials :22 on every connection, and waiting for its certificate to age
@@ -1491,15 +1516,17 @@ export async function ensureCertForAlias(alias, timeoutMs = RENEWAL_REQUEST_TIME
         // predicate is content drift, so the common case -- an up-to-date stanza --
         // is one file read and a string compare, with no lock taken; only a stale
         // stanza takes the alias-store lock, re-checks under it and rewrites.
-        if (configBlockStale(readAliasStore())) {
+        if (configBlockStale(managed)) {
             withAliasStoreLock(() => {
                 const store = readAliasStore();
                 if (store[alias] && configBlockStale(store))
                     installConfigBlock(store);
             }, { waitMs: KNOWN_HOSTS_LOCK_WAIT_MS });
         }
-        if (!certNeedsRenewal(instaCertPath(alias)))
+        if (!certNeedsRenewal(instaCertPath(alias))) {
+            explainOnExit = false; // the certificate works, so no second check on the way out
             return;
+        }
         // An IDE opens several connections at once and `scp` adds more, so the
         // near-expiry certificate is observed by every one of them simultaneously
         // and each would mint its own replacement -- redundant requests against a
@@ -1510,8 +1537,10 @@ export async function ensureCertForAlias(alias, timeoutMs = RENEWAL_REQUEST_TIME
         // a lock that can hang `ssh` itself -- strictly worse than the duplicate
         // request it would prevent. The loser simply lets the winner renew.
         release = acquireRenewalLock(alias);
-        if (!release)
+        if (!release) {
+            cause = new RenewalInProgress();
             return;
+        }
         // Re-checked after the lock. Without this the second process through the
         // door renews again over the certificate the first just wrote -- the lock
         // would serialise the stampede instead of collapsing it.
@@ -1619,11 +1648,15 @@ export async function ensureCertForAlias(alias, timeoutMs = RENEWAL_REQUEST_TIME
             out.staged.discard();
         }
     }
-    catch {
-        // Deliberately swallowed. See above.
+    catch (err) {
+        cause = err;
     }
     finally {
         release?.();
+        // Silent unless this ssh is about to fail: any exit that left the certificate expired says why.
+        if (explainOnExit && certNeedsRenewal(instaCertPath(alias), { marginMs: 0 })) {
+            process.stderr.write(renewalFailureNotice(alias, cause) + '\n');
+        }
     }
 }
 /** A renewal lock older than this is broken even if its holder is alive. That

package/dist/commands/domain.js

@@ -208,6 +208,15 @@ export async function domainNameserversReset(domainName, opts, deps) {
     for (const line of domainLines(r, !opts.org))
         info(line);
 }
+export async function domainRenew(domainName, mode, opts, deps) {
+    if (mode !== 'on' && mode !== 'off')
+        die('mode must be on or off');
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('PATCH', domainPath(orgId, domainName), { autorenew: mode === 'on' });
+    if (opts.json)
+        return printJson(r);
+    info(`${r.domainName}  auto-renew ${r.autorenew ? 'on' : 'off'}`);
+}
 export async function domainTransferLock(domainName, mode, opts, deps) {
     if (mode !== 'on' && mode !== 'off')
         die('mode must be on or off');
@@ -386,7 +395,20 @@ export async function zoneDelegate(domainName, opts, deps) {
 }
 export async function zoneList(opts, deps) {
     const { api, orgId } = await orgDeps(opts, deps);
-    const r = await api.request('GET', zonePath(orgId));
+    const r = { items: [] };
+    let cursor;
+    const seen = new Set();
+    do {
+        const path = `${zonePath(orgId)}?limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ''}`;
+        const page = await api.request('GET', path);
+        r.items.push(...page.items);
+        cursor = page.nextCursor;
+        if (cursor) {
+            if (seen.has(cursor))
+                throw new Error('zone listing returned a repeated pagination cursor');
+            seen.add(cursor);
+        }
+    } while (cursor);
     if (opts.json)
         return printJson(r);
     if (!r.items.length)

package/dist/commands/ssh-config.js

@@ -142,9 +142,7 @@ export function renderConfigBlock(o) {
         // the one carrying our certificate. Without this line a developer with a
         // full ssh-agent gets intermittent, unexplainable auth failures.
         '  IdentitiesOnly yes');
-        // Connection multiplexing collapses scp, an IDE's several connections and a
-        // second terminal onto ONE connection; without it a single developer can
-        // reach the per-service session cap in an afternoon.
+        // Multiplexing spares a handshake per ssh, and 60s keeps a master from outliving a pod that scaled to zero.
         //
         // The socket is keyed on %C -- a hash of (local host, remote host, port,
         // user) -- not %r@%h:%p. A ControlPath is a Unix-domain socket, whose path
@@ -161,7 +159,7 @@ export function renderConfigBlock(o) {
         // effective-config tests need a real `ssh` and skip on Windows, so this
         // branch is asserted on the rendered text instead.
         if ((o.platform ?? process.platform) !== 'win32') {
-            lines.push('  ControlMaster auto', '  ControlPath ~/.insta/ssh/cm-%C', '  ControlPersist 10m');
+            lines.push('  ControlMaster auto', '  ControlPath ~/.insta/ssh/cm-%C', '  ControlPersist 60s');
         }
         if (o.ensureCertCommand) {
             // Renewal happens while OpenSSH PARSES the config, before it connects, so

package/dist/commands/template.js

@@ -34,6 +34,7 @@ export function normalizeInfoServices(raw) {
         name, type: s?.type, port: s?.port,
         volumeGib: s?.volumeGib ?? s?.volume?.size,
         volume: s?.volume === true || s?.volumeGib != null || s?.volume?.size != null,
+        mountPath: typeof s?.mountPath === 'string' ? s.mountPath : undefined,
     });
     if (Array.isArray(raw))
         return raw.map((s) => one(s?.name ?? '?', s));
@@ -73,7 +74,7 @@ export function templateInfoLines(t, bold = (s) => s) {
         const summary = services.map((s) => {
             // A size only when the registry still carries one: a manifest names no size any more, so
             // "persistent /data" is all there is to say until the service exists.
-            const disk = s.volumeGib ? `${s.volumeGib}Gi volume` : s.volume ? 'persistent /data' : undefined;
+            const disk = s.volumeGib ? `${s.volumeGib}Gi volume` : s.volume ? `persistent ${s.mountPath ?? '/data'}` : undefined;
             const bits = [s.type && s.type !== 'compute' ? s.type : undefined, s.port ? `port ${s.port}` : undefined, disk].filter(Boolean);
             return `${s.name}${bits.length ? ` (${bits.join(', ')})` : ''}`;
         });

package/dist/config.js

@@ -257,9 +257,10 @@ async function readLinkPlane(root) {
     }
 }
 /** Text safe to echo to a terminal: C0 and C1 control characters and DEL removed — ESC and the
- *  single-byte C1 introducers (U+009B CSI among them) alike, so no escape sequence survives. */
-function safeText(text) {
-    return String(text).replace(/[\u0000-\u001f\u007f-\u009f]/g, '');
+ *  single-byte C1 introducers (U+009B CSI among them) alike, so no escape sequence survives.
+ *  Bidi marks, embeddings, overrides and isolates go too, so nothing can reorder what is shown. */
+export function safeText(text) {
+    return String(text).replace(/[\u0000-\u001f\u007f-\u009f‎‏‪-‮⁦-⁩]/g, '');
 }
 /** A control-plane URL safe to persist and to print: control characters removed, surrounding
  *  whitespace trimmed, and any userinfo (INSTA_API_URL may carry credentials) removed.

package/dist/index.js

@@ -293,6 +293,9 @@ dom.command('list').description("Domains bought through InstaCloud in this org
 dom.command('status <name>').description("A bought domain's order and attach state")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((name, o) => domainCmd.domainStatus(name, o)));
+dom.command('renew <domain> <mode>').description('Turn automatic renewal on or off for a bought domain (mode: on|off). Does not renew immediately. Agent credentials are refused; run with a human login')
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, mode, o) => domainCmd.domainRenew(domain, mode, o)));
 dom.command('delegate <domain>').description("Move a bought domain's DNS onto an InstaCloud-managed zone — the way an apex hostname gets a certificate and serves. Every record is copied first and the nameservers switch after, so serving hostnames stay up and ones that failed by delegating away revive on their own. While managed, `domain records` answers 409 for every verb (managed-zone record editing is not covered yet); `nameservers reset` is the way back (org admin; gated: domain.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.domainDelegate(domain, o)));
@@ -555,7 +558,7 @@ bill.command('subscribe <tier>').description('Subscribe the org to a paid tier (
 bill.command('redeem <code>').description("Redeem a one-time credit code into the org's wallet")
     .option('--org <id>').option('--json')
     .action(guard((code, o) => billingRedeem(code, o)));
-bill.command('portal').description('Open the Stripe Customer Portal (change plan / card / cancel)')
+bill.command('portal').description('Open Stripe payment-method management (owner/admin)')
     .option('--org <id>').option('--no-open', 'print the URL instead of opening a browser').option('--json')
     .action(guard((o) => billingPortal(o)));
 bill.command('usage').description('Usage for the current billing cycle by billing dimension (org by default; --proj for one project)')

package/dist/template-manifest.js

@@ -91,7 +91,7 @@ export function validateManifest(m) {
         // platform's own check (provisioning/templateManifest.ts) so an author hears it here.
         if (type && MANAGED_TYPES.includes(type)) {
             const bare = svc;
-            for (const field of ['image', 'build', 'port', 'healthcheck', 'volume', 'volumeGib', 'spec', 'alwaysOn']) {
+            for (const field of ['image', 'build', 'port', 'healthcheck', 'volume', 'volumeGib', 'spec', 'alwaysOn', 'command', 'mountPath']) {
                 if (bare[field] !== undefined) {
                     problems.push(`${where}.${field}: a ${type} service is platform-managed and carries no ${field} — declare it bare ({ type: ${type} })`);
                 }
@@ -151,6 +151,16 @@ export function validateManifest(m) {
         if (authored.spec !== undefined) {
             problems.push(`${where}: compute size is the platform's to choose — remove spec`);
         }
+        // Validate runtime fields: command and mountPath
+        if (svc.command !== undefined && (typeof svc.command !== 'string' || !svc.command.trim())) {
+            problems.push(`${where}.command must be a non-empty string`);
+        }
+        if (svc.mountPath !== undefined) {
+            if (svc.volume !== true)
+                problems.push(`${where}.mountPath requires volume: true`);
+            else if (typeof svc.mountPath !== 'string' || !svc.mountPath.startsWith('/'))
+                problems.push(`${where}.mountPath must be an absolute path`);
+        }
         const env = svc.env ?? {};
         for (const group of ['fixed', 'generated', 'required', 'optional']) {
             for (const varName of Object.keys(env[group] ?? {})) {

package/dist/util.js

@@ -226,7 +226,7 @@ const targetGroup = (a) => (a.target === 'db' ? 'postgres' : String(a.target ??
 const OP_COMMAND = {
     'service.add': (a) => `insta service add ${a.type ?? '<type>'} ${a.name ?? '<name>'}`,
     deploy: (a) => `insta deploy${a.branch ? ` --branch ${a.branch}` : ''}`,
-    'secrets.set': (a) => `insta secrets set ${a.name ?? '<NAME>'} ${a.value ?? '<value>'}`,
+    'secrets.set': (a) => `insta secrets set ${a.name ?? '<NAME>'} <value>`,
     metrics: (a) => `insta ${targetGroup(a)} metrics`,
     logs: (a) => `insta ${targetGroup(a)} logs`,
     'approvals.approve': (a) => `insta agent approvals approve ${a.approvalId ?? '<id>'}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [
@@ -52,6 +52,6 @@
     "@types/node": "^20.14.0",
     "tsx": "^4.16.0",
     "typescript": "^5.5.0",
-    "vitest": "^2.0.0"
+    "vitest": "^4.1.11"
   }
 }