nixamp 0.1.0 → 0.3.0

package/dist/session.d.ts

@@ -0,0 +1,29 @@
+export interface Session {
+    site: string;
+    email: string;
+    token: string;
+    signedInAt: number;
+}
+export declare function sessionPath(): string;
+export declare function readSession(): Session | null;
+export declare function writeSession(session: Session): void;
+export declare function clearSession(): void;
+/**
+ * Ask without echoing. Node has no "read a password" call, so the terminal is
+ * put in raw mode and the keystrokes are collected by hand.
+ */
+export declare function askSecret(prompt: string): Promise<string>;
+export interface LoginOptions {
+    site: string;
+    email: string;
+    /** Create the account rather than signing in to one. */
+    signUp: boolean;
+    fetcher?: typeof fetch;
+}
+/** Read the flags `nixamp login` accepts. */
+export declare function parseLoginArgs(argv: string[]): LoginOptions;
+/** `nixamp login` / `nixamp signup`. */
+export declare function login(argv: string[]): Promise<number>;
+export declare function logout(): number;
+/** `nixamp whoami`, which asks the server rather than trusting the file. */
+export declare function whoami(fetcher?: typeof fetch): Promise<number>;

package/dist/session.js

@@ -0,0 +1,184 @@
+/**
+ * Being signed in, from a terminal.
+ *
+ * `nixamp login` asks for an address and a password, and keeps the token it
+ * gets back beside the daemon's state. The desktop app bundles this same CLI,
+ * so signing in there and signing in here are the same thing on disk.
+ *
+ * The password is read with the echo turned off and is never written down: the
+ * token is what is kept, and it can be revoked without changing anything the
+ * person has to remember.
+ */
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
+import { dirname, join } from "node:path";
+import { stateDir } from "./daemon.js";
+import { DEFAULT_DIRECTORY } from "./directory.js";
+export function sessionPath() {
+    return join(stateDir(), "session.json");
+}
+export function readSession() {
+    try {
+        return JSON.parse(readFileSync(sessionPath(), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSession(session) {
+    const path = sessionPath();
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(session, null, 2)}\n`);
+    // A bearer token is as good as the password for as long as it lives, so it
+    // is not left readable by everyone with an account on the machine.
+    chmodSync(path, 0o600);
+}
+export function clearSession() {
+    rmSync(sessionPath(), { force: true });
+}
+/**
+ * Ask without echoing. Node has no "read a password" call, so the terminal is
+ * put in raw mode and the keystrokes are collected by hand.
+ */
+export async function askSecret(prompt) {
+    const input = process.stdin;
+    if (!input.isTTY) {
+        // A pipe has no echo to turn off, and reading a line is what a script
+        // wants anyway.
+        const rl = createInterface({ input, output: process.stdout });
+        try {
+            return await rl.question("");
+        }
+        finally {
+            rl.close();
+        }
+    }
+    process.stdout.write(prompt);
+    input.setRawMode(true);
+    input.resume();
+    input.setEncoding("utf8");
+    return new Promise((done) => {
+        let typed = "";
+        const onData = (key) => {
+            switch (key) {
+                case "\u0003": // ctrl-c
+                    input.setRawMode(false);
+                    input.pause();
+                    process.stdout.write("\n");
+                    process.exit(130);
+                    return;
+                case "\r":
+                case "\n":
+                case "\u0004": // ctrl-d
+                    input.setRawMode(false);
+                    input.pause();
+                    input.off("data", onData);
+                    process.stdout.write("\n");
+                    done(typed);
+                    return;
+                case "\u007f": // backspace
+                case "\b":
+                    typed = typed.slice(0, -1);
+                    return;
+                default:
+                    // One printable character. An arrow key arrives as a whole escape
+                    // sequence, which would otherwise be appended as several characters
+                    // of password nobody typed.
+                    if (key.length === 1 && key >= " " && key !== "\u007f")
+                        typed += key;
+            }
+        };
+        input.on("data", onData);
+    });
+}
+async function ask(prompt) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return (await rl.question(prompt)).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+/** Read the flags `nixamp login` accepts. */
+export function parseLoginArgs(argv) {
+    const at = (flag) => {
+        const index = argv.indexOf(flag);
+        return index === -1 ? undefined : argv[index + 1];
+    };
+    return {
+        site: (at("--site") ?? DEFAULT_DIRECTORY).replace(/\/+$/, ""),
+        email: at("--email") ?? argv.find((a) => !a.startsWith("-") && a.includes("@")) ?? "",
+        signUp: argv.includes("--signup") || argv.includes("--sign-up"),
+    };
+}
+/** `nixamp login` / `nixamp signup`. */
+export async function login(argv) {
+    const options = parseLoginArgs(argv);
+    const send = options.fetcher ?? fetch;
+    const email = options.email || (await ask("Email: "));
+    if (!email) {
+        console.error("nixamp: no email given");
+        return 64;
+    }
+    const password = await askSecret("Password: ");
+    if (!password) {
+        console.error("nixamp: no password given");
+        return 64;
+    }
+    const where = `${options.site}/api/v1/auth/${options.signUp ? "signup" : "login"}`;
+    let answer;
+    try {
+        answer = await send(where, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ email, password }),
+        });
+    }
+    catch (error) {
+        console.error(`nixamp: could not reach ${options.site}: ${error.message}`);
+        return 69;
+    }
+    const body = (await answer.json().catch(() => ({})));
+    if (!answer.ok || !body.token) {
+        console.error(`nixamp: ${body.error ?? `signing in failed (${answer.status})`}`);
+        return 1;
+    }
+    writeSession({ site: options.site, email, token: body.token, signedInAt: Date.now() });
+    console.log(`Signed in to ${options.site} as ${email}.`);
+    return 0;
+}
+export function logout() {
+    const session = readSession();
+    clearSession();
+    console.log(session ? `Signed out of ${session.site}.` : "nixamp: you were not signed in.");
+    return 0;
+}
+/** `nixamp whoami`, which asks the server rather than trusting the file. */
+export async function whoami(fetcher = fetch) {
+    const session = readSession();
+    if (session === null) {
+        console.log("nixamp: not signed in. Try `nixamp login`.");
+        return 1;
+    }
+    try {
+        const answer = await fetcher(`${session.site}/api/v1/auth/me`, {
+            headers: { authorization: `Bearer ${session.token}` },
+        });
+        if (!answer.ok) {
+            // The token outlived its welcome, which is worth saying plainly rather
+            // than leaving a stale file to confuse the next command.
+            console.log(`nixamp: signed in as ${session.email}, but ${session.site} no longer accepts it.`);
+            console.log("  Run `nixamp login` again.");
+            return 1;
+        }
+        const body = (await answer.json());
+        console.log(`${body.account?.email ?? session.email} at ${session.site}`);
+        return 0;
+    }
+    catch {
+        // Offline is not signed out: the token is still good, we just cannot ask.
+        console.log(`${session.email} at ${session.site} (could not reach it to check)`);
+        return 0;
+    }
+}

package/dist/share.d.ts

@@ -0,0 +1,74 @@
+import type { IncomingMessage } from "node:http";
+/**
+ * Two keys, two scopes.
+ *
+ * The full key drives the player: it can skip, stop, and point the server at a
+ * different source. The listen key can only hear it. A stream published to the
+ * public directory hands out the listen key, because a link that lets a
+ * stranger pause your music is not a link you can publish.
+ */
+export type Scope = "control" | "listen";
+/** The cookie, and the query parameter that sets it. */
+export declare const KEY_COOKIE = "nixamp_key";
+export declare const KEY_QUERY = "k";
+export declare const KEY_HEADER = "x-nixamp-key";
+/**
+ * 128 bits, base64url. Long enough that guessing is not a strategy, short
+ * enough to read down a phone screen when someone types it by hand.
+ */
+export declare function newKey(): string;
+/** Compare without leaking where two keys first differ. */
+export declare function keysMatch(a: string, b: string): boolean;
+/** Every place a key is accepted from, in the order they are looked for. */
+export declare function keyFrom(request: IncomingMessage, url: URL): string | null;
+/** The Set-Cookie for a browser that just opened the link. */
+export declare function keyCookie(key: string): string;
+/** Where an address actually goes, which is not always where you would like. */
+export declare function classify(address: string): "private" | "cgnat" | "public";
+/**
+ * The addresses another device could actually reach this machine on, nearest
+ * first. On a server the public one is the point: it is the address a phone
+ * somewhere else can open. It is labelled for what it is, because the key in
+ * the link is then the only thing between a stranger and the library.
+ */
+export declare function reachableAddresses(host: string, port: number): {
+    label: string;
+    url: string;
+}[];
+/** The full link, key and all. */
+export declare function shareLink(base: string, key: string | null): string;
+/**
+ * What a key is allowed to do. An unknown key is allowed nothing, which is the
+ * same answer as no key at all.
+ */
+export declare function scopeOf(offered: string | null, control: string | null, listen: string | null): Scope | null;
+/** Paths a listen key may have. Everything else needs the control key. */
+export declare function allowedForListening(path: string): boolean;
+/** How to run a command, so the tests never touch a real firewall. */
+export interface Runner {
+    read(path: string): string | null;
+    run(command: string, args: string[]): {
+        status: number | null;
+        stdout: string;
+    };
+}
+/** Which firewall is in the way, if any. */
+export type Firewall = "ufw" | "firewalld";
+/**
+ * Whether a firewall is running that would keep the port closed to other
+ * devices. Listening on 0.0.0.0 proves the socket is open on this machine and
+ * nothing more, so this is the difference between "it works" and "it works
+ * here".
+ */
+export declare function firewallInUse(io: Runner): Firewall | null;
+/** The commands that open and close a port, for each firewall we know. */
+export declare function portCommands(firewall: Firewall, port: number): {
+    open: string[];
+    close: string[];
+};
+/**
+ * Root runs it directly; anyone else goes through sudo, and only when sudo
+ * will not stop to ask. A server that hangs on an invisible password prompt is
+ * worse than one that tells you the command to run yourself.
+ */
+export declare function elevate(io: Runner, command: string[]): string[] | null;

package/dist/share.js

@@ -0,0 +1,172 @@
+/**
+ * The share link.
+ *
+ * `nixamp serve` listens on every interface so the phone in your pocket can
+ * reach it, and that is only reasonable because the address is not enough on
+ * its own: every request has to carry a key that is printed once, in the link.
+ * Someone else on the coffee shop wifi can find the port and gets nothing.
+ *
+ * The key travels in a cookie, set by opening the link. Nothing in the PWA had
+ * to change for that: a browser sends a same-origin cookie with every fetch,
+ * every EventSource and every `<audio src>` on its own.
+ */
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { networkInterfaces } from "node:os";
+/** The cookie, and the query parameter that sets it. */
+export const KEY_COOKIE = "nixamp_key";
+export const KEY_QUERY = "k";
+export const KEY_HEADER = "x-nixamp-key";
+/**
+ * 128 bits, base64url. Long enough that guessing is not a strategy, short
+ * enough to read down a phone screen when someone types it by hand.
+ */
+export function newKey() {
+    return randomBytes(16).toString("base64url");
+}
+/** Compare without leaking where two keys first differ. */
+export function keysMatch(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    // timingSafeEqual throws on a length mismatch, which is itself the answer.
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+/** Every place a key is accepted from, in the order they are looked for. */
+export function keyFrom(request, url) {
+    const query = url.searchParams.get(KEY_QUERY);
+    if (query)
+        return query;
+    const header = request.headers[KEY_HEADER];
+    if (typeof header === "string" && header)
+        return header;
+    for (const part of (request.headers.cookie ?? "").split(";")) {
+        const [name, ...rest] = part.trim().split("=");
+        if (name === KEY_COOKIE && rest.length > 0)
+            return decodeURIComponent(rest.join("="));
+    }
+    return null;
+}
+/** The Set-Cookie for a browser that just opened the link. */
+export function keyCookie(key) {
+    // HttpOnly because nothing in the page reads it: the browser attaches it to
+    // every same-origin request by itself. No Secure, because the whole point is
+    // a plain-http address on your own network.
+    return `${KEY_COOKIE}=${encodeURIComponent(key)}; Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly`;
+}
+/**
+ * Interfaces that exist for containers and virtual machines. An address on one
+ * of these reaches a bridge, not the phone on the sofa, and listing six of them
+ * buries the one line someone actually needed.
+ */
+const VIRTUAL = /^(docker|br-|veth|virbr|vmnet|vboxnet|lo)/;
+/** Where an address actually goes, which is not always where you would like. */
+export function classify(address) {
+    const [a, b] = address.split(".").map(Number);
+    if (a === 10)
+        return "private";
+    if (a === 192 && b === 168)
+        return "private";
+    if (a === 172 && b >= 16 && b <= 31)
+        return "private";
+    if (a === 169 && b === 254)
+        return "private";
+    // 100.64/10 is carrier-grade NAT, which in practice means Tailscale here.
+    if (a === 100 && b >= 64 && b <= 127)
+        return "cgnat";
+    return "public";
+}
+/**
+ * The addresses another device could actually reach this machine on, nearest
+ * first. On a server the public one is the point: it is the address a phone
+ * somewhere else can open. It is labelled for what it is, because the key in
+ * the link is then the only thing between a stranger and the library.
+ */
+export function reachableAddresses(host, port) {
+    const link = (address) => {
+        // A bare IPv6 address needs brackets before it is a URL.
+        const authority = address.includes(":") ? `[${address}]` : address;
+        return `http://${authority}:${port}`;
+    };
+    if (host !== "0.0.0.0" && host !== "::")
+        return [{ label: "here", url: link(host) }];
+    const LABELS = { private: "on your network", cgnat: "on tailscale", public: "on the internet" };
+    const found = [];
+    for (const [name, entries] of Object.entries(networkInterfaces())) {
+        if (VIRTUAL.test(name))
+            continue;
+        for (const entry of entries ?? []) {
+            // Link-local v6 needs a scope id to be usable, and nobody types those in.
+            if (entry.internal || entry.family !== "IPv4")
+                continue;
+            const kind = classify(entry.address);
+            found.push({ label: LABELS[kind], url: link(entry.address), kind });
+        }
+    }
+    const order = { private: 0, cgnat: 1, public: 2 };
+    found.sort((x, y) => order[x.kind] - order[y.kind]);
+    return [
+        { label: "here", url: `http://localhost:${port}` },
+        ...found.map(({ label, url }) => ({ label, url })),
+    ];
+}
+/** The full link, key and all. */
+export function shareLink(base, key) {
+    return key === null ? base : `${base}/s/${key}`;
+}
+/**
+ * What a key is allowed to do. An unknown key is allowed nothing, which is the
+ * same answer as no key at all.
+ */
+export function scopeOf(offered, control, listen) {
+    if (offered === null)
+        return null;
+    if (control !== null && keysMatch(offered, control))
+        return "control";
+    if (listen !== null && keysMatch(offered, listen))
+        return "listen";
+    return null;
+}
+/** Paths a listen key may have. Everything else needs the control key. */
+export function allowedForListening(path) {
+    if (path === "/api/command" || path === "/api/source")
+        return false;
+    return true;
+}
+/**
+ * Whether a firewall is running that would keep the port closed to other
+ * devices. Listening on 0.0.0.0 proves the socket is open on this machine and
+ * nothing more, so this is the difference between "it works" and "it works
+ * here".
+ */
+export function firewallInUse(io) {
+    if (process.platform !== "linux")
+        return null;
+    // ufw keeps its state in a file, so asking needs no privileges.
+    const ufw = io.read("/etc/ufw/ufw.conf");
+    if (ufw && /^ENABLED=yes/im.test(ufw))
+        return "ufw";
+    const firewalld = io.run("systemctl", ["is-active", "firewalld"]);
+    if (firewalld.status === 0 && firewalld.stdout.trim() === "active")
+        return "firewalld";
+    return null;
+}
+/** The commands that open and close a port, for each firewall we know. */
+export function portCommands(firewall, port) {
+    return firewall === "ufw"
+        ? { open: ["ufw", "allow", `${port}/tcp`], close: ["ufw", "delete", "allow", `${port}/tcp`] }
+        : {
+            open: ["firewall-cmd", `--add-port=${port}/tcp`],
+            close: ["firewall-cmd", `--remove-port=${port}/tcp`],
+        };
+}
+/**
+ * Root runs it directly; anyone else goes through sudo, and only when sudo
+ * will not stop to ask. A server that hangs on an invisible password prompt is
+ * worse than one that tells you the command to run yourself.
+ */
+export function elevate(io, command) {
+    const [head, ...rest] = command;
+    if (typeof process.getuid === "function" && process.getuid() === 0)
+        return [head, ...rest];
+    const canSudo = io.run("sudo", ["-n", "true"]);
+    return canSudo.status === 0 ? ["sudo", "-n", head, ...rest] : null;
+}

package/dist/sources.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Where a playlist comes from.
+ *
+ * A directory, a file, an .m3u, or a URL to any of those. ffmpeg reads a URL as
+ * happily as a path, so a remote track needs no special case once it is in the
+ * list; what needs care is telling the four apart, and telling an .m3u that
+ * lists tracks from an HLS playlist that *is* one track.
+ */
+/** http and https only. ffmpeg speaks more, but these are what a link is. */
+export declare function isRemote(source: string): boolean;
+export declare function isPlaylistFile(source: string): boolean;
+/**
+ * An HLS playlist describes one stream in segments; an .m3u describes a list of
+ * things to play. Both are "m3u8" on disk, and the tags are the only honest way
+ * to tell them apart. Expanding an HLS playlist into a track per segment would
+ * turn one song into four hundred.
+ */
+export declare function isHls(text: string): boolean;
+export interface Entry {
+    /** A path or a URL, whichever the playlist gave us. */
+    source: string;
+    title: string;
+    /** Seconds, from #EXTINF. Zero when it did not say, and for live. */
+    duration: number;
+}
+/** Resolve a playlist line against the playlist's own location. */
+export declare function resolveEntry(base: string, entry: string): string;
+/**
+ * Parse an .m3u or .m3u8. `#EXTINF:<seconds>,<title>` decorates the line after
+ * it; everything else beginning with # is a comment or a tag we do not need.
+ */
+export declare function parseM3u(text: string, base: string): Entry[];
+/** A .pls, which Shoutcast and Icecast hand out as often as an .m3u. */
+export declare function parsePls(text: string, base: string): Entry[];
+/** The last useful part of a path or URL, for when nothing named the track. */
+export declare function nameOf(source: string): string;
+export declare function playsInBrowser(source: string): boolean;

package/dist/sources.js

@@ -0,0 +1,125 @@
+/**
+ * Where a playlist comes from.
+ *
+ * A directory, a file, an .m3u, or a URL to any of those. ffmpeg reads a URL as
+ * happily as a path, so a remote track needs no special case once it is in the
+ * list; what needs care is telling the four apart, and telling an .m3u that
+ * lists tracks from an HLS playlist that *is* one track.
+ */
+/** http and https only. ffmpeg speaks more, but these are what a link is. */
+export function isRemote(source) {
+    return /^https?:\/\//i.test(source);
+}
+export function isPlaylistFile(source) {
+    const path = isRemote(source) ? new URL(source).pathname : source;
+    return /\.(m3u|m3u8|pls)$/i.test(path);
+}
+/**
+ * An HLS playlist describes one stream in segments; an .m3u describes a list of
+ * things to play. Both are "m3u8" on disk, and the tags are the only honest way
+ * to tell them apart. Expanding an HLS playlist into a track per segment would
+ * turn one song into four hundred.
+ */
+export function isHls(text) {
+    return /^#EXT-X-(?:STREAM-INF|TARGETDURATION|MEDIA-SEQUENCE|PLAYLIST-TYPE|ENDLIST)/im.test(text);
+}
+/** Resolve a playlist line against the playlist's own location. */
+export function resolveEntry(base, entry) {
+    if (isRemote(entry))
+        return entry;
+    if (isRemote(base))
+        return new URL(entry, base).toString();
+    if (entry.startsWith("/"))
+        return entry;
+    const dir = base.slice(0, Math.max(0, base.lastIndexOf("/")));
+    return dir ? `${dir}/${entry}` : entry;
+}
+/**
+ * Parse an .m3u or .m3u8. `#EXTINF:<seconds>,<title>` decorates the line after
+ * it; everything else beginning with # is a comment or a tag we do not need.
+ */
+export function parseM3u(text, base) {
+    const out = [];
+    let duration = 0;
+    let title = "";
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (line === "")
+            continue;
+        if (line.startsWith("#")) {
+            const info = /^#EXTINF:\s*(-?[\d.]+)\s*(?:,(.*))?$/i.exec(line);
+            if (info) {
+                const seconds = Number(info[1]);
+                // -1 is the conventional "unknown", which is also what live means.
+                duration = Number.isFinite(seconds) && seconds > 0 ? seconds : 0;
+                title = (info[2] ?? "").trim();
+            }
+            continue;
+        }
+        const source = resolveEntry(base, line);
+        out.push({ source, duration, title: title || nameOf(source) });
+        duration = 0;
+        title = "";
+    }
+    return out;
+}
+/** A .pls, which Shoutcast and Icecast hand out as often as an .m3u. */
+export function parsePls(text, base) {
+    const files = new Map();
+    const titles = new Map();
+    const lengths = new Map();
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        const match = /^(File|Title|Length)(\d+)\s*=\s*(.*)$/i.exec(line);
+        if (!match)
+            continue;
+        const [, kind, index, value] = match;
+        if (/^file$/i.test(kind))
+            files.set(index, value);
+        else if (/^title$/i.test(kind))
+            titles.set(index, value);
+        else
+            lengths.set(index, Number(value));
+    }
+    return [...files.entries()]
+        .sort((a, b) => Number(a[0]) - Number(b[0]))
+        .map(([index, file]) => {
+        const source = resolveEntry(base, file);
+        const seconds = lengths.get(index) ?? 0;
+        return {
+            source,
+            title: titles.get(index)?.trim() || nameOf(source),
+            duration: Number.isFinite(seconds) && seconds > 0 ? seconds : 0,
+        };
+    });
+}
+/** The last useful part of a path or URL, for when nothing named the track. */
+export function nameOf(source) {
+    const remote = isRemote(source);
+    const path = remote ? new URL(source).pathname : source;
+    const last = path.split("/").filter(Boolean).pop() ?? source;
+    // Percent-decoding is a URL's business. A file on disk called
+    // `Some%20Song.mp3` is called exactly that, and renaming it in the display
+    // would be a lie about what is in the directory.
+    if (!remote)
+        return last || source;
+    try {
+        return decodeURIComponent(last) || source;
+    }
+    catch {
+        return last || source;
+    }
+}
+/**
+ * Formats a browser will play as-is. Anything else gets transcoded on the way
+ * out, which is the difference between a library that plays on a phone and one
+ * that plays on the machine it lives on.
+ */
+const WEB_READY = new Set([".mp3", ".m4a", ".aac", ".ogg", ".oga", ".opus", ".webm", ".mp4", ".wav"]);
+export function playsInBrowser(source) {
+    if (isRemote(source))
+        return false;
+    const path = source.toLowerCase();
+    const dot = path.lastIndexOf(".");
+    return dot > 0 && WEB_READY.has(path.slice(dot));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",
@@ -39,7 +39,10 @@
     "pack:cli": "bun scripts/pack-cli.ts"
   },
   "dependencies": {
-    "@profullstack/hqtui": "^0.3.0"
+    "@profullstack/auth-system": "^0.6.0",
+    "@profullstack/hqtui": "^0.3.0",
+    "@profullstack/x402-gateway": "^0.4.0",
+    "pg": "^8.23.0"
   },
   "devDependencies": {
     "@types/node": "^26",