@ggui-ai/blueprint-probe 0.1.0-rc.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing the Work or
+      Derivative Works thereof, You may choose to offer, and charge a
+      fee for, acceptance of support, warranty, indemnity, or other
+      liability obligations and/or rights consistent with this License.
+      However, in accepting such obligations, You may act only on Your
+      own behalf and on Your sole responsibility, not on behalf of any
+      other Contributor, and only if You agree to indemnify, defend,
+      and hold each Contributor harmless for any liability incurred by,
+      or claims asserted against, such Contributor by reason of your
+      accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Loqu, Inc. (Guuey)
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied. See the License for the specific language governing
+   permissions and limitations under the License.

package/README.md

@@ -0,0 +1,54 @@
+# @ggui-ai/blueprint-probe
+
+> Dev / CI runtime probe for ggui blueprint manifests.
+
+A development and continuous-integration tool that catches blueprints
+which throw on initial render — hook misuse, destructuring of `undefined`,
+missing prop coercions — at publish/CI time instead of at iframe-load
+time.
+
+The static gates in `@ggui-ai/registry-core`'s `checkConformance()` catch
+syntax errors and shape mismatches. This probe goes one step further: it
+actually compiles the blueprint, calls its default export through React's
+server renderer (`renderToString`), and reports a failure if the first
+render throws.
+
+## Not a production runtime dependency
+
+This package **executes blueprint code** via Node's `vm` module. `vm` is
+not a security boundary — a malicious blueprint can climb the prototype
+chain to host globals. Treat `blueprint-probe` as a dev / CI tool:
+
+- Use it in CI, local publish flows, and authoring tooling.
+- Do **not** wire it into a production path that handles untrusted
+  blueprints without an additional isolation layer (a separate process
+  with no secrets in its environment, or a true V8 isolate such as
+  `isolated-vm`).
+
+## Usage
+
+```ts
+import { blueprintProbeRunner } from "@ggui-ai/blueprint-probe";
+
+const result = await blueprintProbeRunner.probe(blueprintManifest);
+if (!result.ok) {
+  console.error(result.errors);
+}
+```
+
+`blueprintProbeRunner` implements the `BlueprintProbeRunner` interface
+from `@ggui-ai/registry-core`. Wire it into the publish flow as the
+optional `blueprintProbe` deps slot so static gates always run while the
+runtime probe stays opt-in (it pulls `react-dom` into the import graph).
+
+## Caveats
+
+This is a **best-effort smoke check**, not a guarantee:
+
+- `renderToString` is server-side — there is no `window`/`document`, and
+  `useEffect` does not fire. Blueprints that synchronously touch
+  `document.*`/`window.*` during render may false-positive (probe fails,
+  iframe would render fine). Blueprints that surface a runtime error only
+  inside `useEffect` may false-negative.
+- Treat probe success as "no obvious render-time crash" — not "guaranteed
+  to work in the iframe runtime".

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+import type { BlueprintProbeRunner } from '@ggui-ai/registry-core';
+/**
+ * Server-side blueprint runtime probe — a dev / CI tool. Wire it into
+ * the publish flow as the opt-in `PublishArtifactDeps.blueprintProbe`
+ * deps slot so the static gates always run while the runtime probe
+ * stays opt-in (avoids forcing react-dom into every conformance HTTP
+ * caller). It executes blueprint code via `vm`, so do not place it on
+ * a production path handling untrusted blueprints without a separate
+ * isolation layer — see the file-level security caveat.
+ */
+export declare const blueprintProbeRunner: BlueprintProbeRunner;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA4DA,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,wBAAwB,CAAC;AAsBhC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,oBAuClC,CAAC"}

package/dist/index.js

@@ -0,0 +1,232 @@
+/**
+ * `@ggui-ai/blueprint-probe` — server-side runtime probe for blueprint
+ * manifests.
+ *
+ * Implements {@link BlueprintProbeRunner} from `@ggui-ai/registry-core`.
+ * The static gates in `checkConformance()` catch syntax errors, missing
+ * exports, and obvious shape mismatches; this probe goes one step
+ * further by actually CALLING the blueprint's default export through
+ * React's server renderer to catch:
+ *
+ *   - destructuring of `undefined` (e.g. `const { foo } = props` where
+ *     fixtureProps omits `foo`)
+ *   - hook-call-order violations
+ *   - thrown errors during the first render
+ *   - missing prop coercions (e.g. calling `.toFixed()` on a string)
+ *
+ * Implementation: compile TSX → CJS via esbuild, run inside Node's
+ * `vm` module with a `require` shim that resolves the always-allowed
+ * blueprint imports (react, react/jsx-runtime) to the real impls and
+ * stubs `@ggui-ai/gadgets` with a no-op Proxy. The default export is
+ * then rendered via {@link renderToString} with the manifest's
+ * `fixtureProps` (or `{}` if absent).
+ *
+ * Why not happy-dom: the probe doesn't need a window/document —
+ * `renderToString` is server-side. Skipping happy-dom keeps the
+ * dependency footprint smaller (~6 MB delta) and avoids the
+ * "happy-dom diverges from real iframe env" risk class.
+ *
+ * Why CJS not ESM: Node's `vm.runInContext` runs synchronous code in
+ * a context; ESM requires `vm.Module` which is unstable. CJS keeps
+ * the surface small.
+ *
+ * SSR / CSR caveat — this is a best-effort smoke check.
+ * `renderToString` is server-side: there is no `window`,
+ * no `document`, and `useEffect` does NOT fire. Blueprints that
+ * synchronously read `document.*` or `window.*` during render (or rely
+ * on layout effects to bail out of a render path) will false-positive
+ * here — the probe will report `probe_failed` even though the live
+ * iframe runtime would render them fine. Inverse: a blueprint that
+ * relies on `useEffect` to surface a runtime error will false-NEGATIVE
+ * (probe says ok; iframe blows up). Consumers should treat probe
+ * success as "no obvious render-time crash" — not "guaranteed to work
+ * in the iframe runtime".
+ *
+ * Security caveat — `vm.runInContext` is NOT a security boundary.
+ * A malicious blueprint that imports `react`
+ * (always-allowed) can climb the prototype chain to the host's
+ * `Function` constructor and read `process.env`. This probe is a
+ * smoke check, not a sandbox; do not wire it into a path that handles
+ * untrusted blueprints without first running it in a separate
+ * isolation layer (separate Lambda with no secrets in env, or
+ * `isolated-vm` for a real V8 isolate).
+ */
+import { createRequire } from 'node:module';
+import * as vm from 'node:vm';
+import { transformSync } from 'esbuild';
+import * as React from 'react';
+/**
+ * Timeout bound for `vm.runInContext`. An unbounded probe can hang
+ * the host on a `while(true){}` blueprint until the HTTP gateway's
+ * 30s ceiling fires — denying publish throughput. The timeout is
+ * comfortably above any legitimate blueprint render but far enough
+ * below the transport ceiling that the probe failure is the one
+ * observed.
+ *
+ * NOTE: `vm.runInContext` only times out synchronous CJS evaluation.
+ * `renderToString` runs OUTSIDE the vm context and is also
+ * synchronous + CPU-bound — a blueprint that puts a setState-in-
+ * render loop into its component body can still hang React's
+ * server renderer. There's no synchronous way to bound that without
+ * a worker thread; the HTTP gateway's 30s transport ceiling is the
+ * fallback bound for that case.
+ */
+const PROBE_VM_TIMEOUT_MS = 5000;
+/**
+ * Server-side blueprint runtime probe — a dev / CI tool. Wire it into
+ * the publish flow as the opt-in `PublishArtifactDeps.blueprintProbe`
+ * deps slot so the static gates always run while the runtime probe
+ * stays opt-in (avoids forcing react-dom into every conformance HTTP
+ * caller). It executes blueprint code via `vm`, so do not place it on
+ * a production path handling untrusted blueprints without a separate
+ * isolation layer — see the file-level security caveat.
+ */
+export const blueprintProbeRunner = {
+    async probe(manifest) {
+        try {
+            const compiled = compileToCjs(manifest.source);
+            const moduleDefault = evaluateModule(compiled);
+            if (typeof moduleDefault !== 'function') {
+                return probeFailed(`blueprint default export is not a function/component (got ${describeType(moduleDefault)})`);
+            }
+            const Component = moduleDefault;
+            const props = manifest.fixtureProps !== undefined &&
+                manifest.fixtureProps !== null &&
+                typeof manifest.fixtureProps === 'object' &&
+                !Array.isArray(manifest.fixtureProps)
+                ? manifest.fixtureProps
+                : {};
+            // `react-dom/server` is loaded via dynamic import so the module
+            // graph here doesn't drag the server-side renderer into every
+            // consumer that just imports `BlueprintProbeRunner` for the
+            // type. The import is awaited once per probe.
+            const { renderToString } = await import('react-dom/server');
+            renderToString(React.createElement(Component, props));
+            return { ok: true, errors: [] };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            // Server-side absolute paths in error text would leak deployment
+            // topology to anyone publishing a broken blueprint. Scrub paths
+            // and drop the stack entirely — the publisher can't act on a
+            // stack from the probe's vm context.
+            const scrubbedMessage = scrubServerPaths(message);
+            return probeFailed(`runtime probe threw: ${scrubbedMessage}`, {
+                message: scrubbedMessage,
+            });
+        }
+    },
+};
+function compileToCjs(source) {
+    // `jsx: 'automatic'` emits `require('react/jsx-runtime')` calls so
+    // the probe doesn't need a `React` global in scope. `format: 'cjs'`
+    // keeps the eval-via-vm surface small.
+    const { code } = transformSync(source, {
+        loader: 'tsx',
+        format: 'cjs',
+        target: 'es2020',
+        jsx: 'automatic',
+        sourcemap: false,
+    });
+    return code;
+}
+function evaluateModule(code) {
+    const moduleObj = { exports: {} };
+    // `createRequire` against this file resolves react / react-dom /
+    // react/jsx-runtime through the package's own node_modules graph —
+    // the same React instance the probe later calls `renderToString`
+    // on. Without a shared instance, hooks throw the "more than one
+    // copy of React" runtime check.
+    const realRequire = createRequire(import.meta.url);
+    const requireShim = (specifier) => {
+        if (specifier === '@ggui-ai/gadgets') {
+            return gadgetsStub;
+        }
+        // Only react surfaces are routed through — anything else got
+        // through the gate-7 import allow-list already, so we don't
+        // expect other specifiers here. Surface as a probe failure so
+        // misconfigured blueprints fail loud.
+        if (specifier === 'react' ||
+            specifier === 'react-dom' ||
+            specifier === 'react/jsx-runtime' ||
+            specifier === 'react-dom/server') {
+            return realRequire(specifier);
+        }
+        throw new Error(`probe require-shim does not resolve \`${specifier}\` — only the always-allowed blueprint imports are routed through.`);
+    };
+    const context = vm.createContext({
+        module: moduleObj,
+        exports: moduleObj.exports,
+        require: requireShim,
+        // `console` lets blueprints log without crashing the probe.
+        console,
+    });
+    // Bound synchronous evaluation. Without `timeout`, a
+    // `while(true){}` blueprint hangs the host. Node surfaces the
+    // bound as a thrown Error; the outer catch maps it to
+    // `blueprint_runtime_probe_failed` with a clear message.
+    vm.runInContext(code, context, {
+        filename: 'blueprint.cjs.js',
+        timeout: PROBE_VM_TIMEOUT_MS,
+    });
+    return moduleObj.exports.default;
+}
+/**
+ * Stub for `@ggui-ai/gadgets`. Every hook returns `undefined` (or
+ * `[undefined, () => undefined]` for setState-shaped tuples). The
+ * Proxy responds to any property access with a no-op function so
+ * blueprints that call hooks the probe doesn't pre-stub still get a
+ * survivable answer.
+ */
+const noopHook = () => undefined;
+// The stub mimics what `require('@ggui-ai/gadgets')` would return —
+// a CJS module namespace whose shape is unknown by design (the probe
+// doesn't ship a gadget registry). `Record<string, unknown>` is the
+// honest type; the `as Record<string, unknown>` on the Proxy target
+// is the lone shape-unknown cast in this file (the stub is the
+// shape-unknown construct, not data with a known type).
+const gadgetsStub = new Proxy({}, {
+    get(_, prop) {
+        if (prop === '__esModule')
+            return true;
+        if (typeof prop === 'symbol')
+            return undefined;
+        return noopHook;
+    },
+});
+function probeFailed(message, detail) {
+    return {
+        ok: false,
+        errors: [
+            {
+                code: 'blueprint_runtime_probe_failed',
+                message,
+                ...(detail !== undefined ? { detail } : {}),
+            },
+        ],
+    };
+}
+function describeType(v) {
+    if (v === null)
+        return 'null';
+    if (Array.isArray(v))
+        return 'array';
+    return typeof v;
+}
+/**
+ * Strip absolute filesystem paths from probe error messages.
+ * Lambda's `/var/task/...` and the dev host's `/home/node/...`
+ * paths leak through esbuild diagnostics + thrown Error messages;
+ * the publisher can't act on them and they reveal deployment
+ * topology.
+ *
+ * The regex matches any `/`-prefixed run up to a `packages/`, `cloud/`,
+ * or `node_modules/` segment and keeps the tail from that segment on —
+ * so `/var/task/node_modules/react/index.js` becomes
+ * `node_modules/react/index.js`. Anything that doesn't match a
+ * recognised segment is left as-is; we'd rather over-keep than
+ * accidentally strip a user-meaningful identifier.
+ */
+function scrubServerPaths(input) {
+    return input.replace(/\/[^\s)]+\/(packages|cloud|node_modules)\b/g, '$1');
+}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@ggui-ai/blueprint-probe",
+  "version": "0.1.0-rc.1",
+  "description": "Dev/CI runtime probe for ggui blueprint manifests. Implements BlueprintProbeRunner from @ggui-ai/registry-core using Node's vm module + React's renderToString. Catches blueprints that throw on initial render (hook misuse, destructuring errors, missing props) in CI instead of at iframe-load time.",
+  "license": "Apache-2.0",
+  "keywords": [
+    "ggui",
+    "blueprint",
+    "registry",
+    "conformance",
+    "ci",
+    "react"
+  ],
+  "homepage": "https://github.com/ggui-ai/ggui/tree/main/packages/blueprint-probe",
+  "bugs": {
+    "url": "https://github.com/ggui-ai/ggui/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ggui-ai/ggui.git",
+    "directory": "packages/blueprint-probe"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "esbuild": "^0.25.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "@ggui-ai/artifact-manifest": "0.1.0-rc.1",
+    "@ggui-ai/registry-core": "0.1.0-rc.1"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "typescript": "^5.0.0",
+    "vitest": "^3.0.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "author": "ggui contributors <hello@ggui.ai>",
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  }
+}