@pixpilot/trpc-access-testing 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pixpilot
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,33 @@
-# Temporary Holding Version
+# @pixpilot/trpc-access-testing
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Test tRPC route classifications, database activity, and isolation between users.
+
+```sh
+pnpm add -D @pixpilot/trpc-access-testing
+```
+
+Requires Node.js 22+ and tRPC 11. Use your existing test runner; no CLI is required.
+
+1. List every procedure in an `AccessManifest<typeof appRouter>`.
+2. Create one tracker and inject `instrumentDrizzleDb(testDb, tracker)` into test contexts and services.
+3. Create an access tester with your router, manifest, tracker, and server-context `getUserId`.
+4. Run `testAuthentication` for protected routes and `testIsolation` with two users.
+5. Assert results **and unchanged foreign data** for mutations, then call `ensureCoverage()`.
+
+The app supplies its schema, database fixtures, contexts, and assertions. The package
+exports functions so these stay inside ordinary tests and CI.
+
+See the [usage guide](docs/usage.md), [API reference](docs/api.md), and
+[complete, runnable PostgreSQL example](examples/ownership.test.ts).
+
+Run this package's checks:
+
+```sh
+pnpm --filter @pixpilot/trpc-access-testing typecheck
+pnpm --filter @pixpilot/trpc-access-testing lint
+pnpm --filter @pixpilot/trpc-access-testing test
+pnpm --filter @pixpilot/trpc-access-testing build
+```
+
+Tests use real in-memory PostgreSQL through PGlite and Drizzle; no Docker or
+external database is needed.

package/dist/index.cjs

@@ -0,0 +1,244 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let _trpc_server = require("@trpc/server");
+let node_async_hooks = require("node:async_hooks");
+
+//#region src/drizzle/instrument-drizzle-db.ts
+const activities = {
+	select: "read",
+	selectDistinct: "read",
+	selectDistinctOn: "read",
+	insert: "write",
+	update: "write",
+	delete: "write",
+	refreshMaterializedView: "write",
+	findFirst: "read",
+	findMany: "read",
+	$count: "read"
+};
+const executions = /* @__PURE__ */ new Set([
+	"then",
+	"catch",
+	"finally",
+	"execute",
+	"all",
+	"get",
+	"run"
+]);
+/** Wrap a test-only Drizzle database; preserve its types and record query execution, not SQL text. */
+function instrumentDrizzleDb(db, tracker) {
+	function wrap(target, activity, operation) {
+		return new Proxy(target, { get(object, key) {
+			const value = Reflect.get(object, key, object);
+			if (key === "$client" || key === "session" || key === "_" || key === "batch") throw new Error(`Direct Drizzle internals (${String(key)}) bypass access tracking`);
+			if (typeof value !== "function") return key === "query" && typeof value === "object" && value !== null ? wrapRelations(value) : value;
+			return (...args) => {
+				const method = String(key);
+				if (method === "transaction") {
+					const callback = args[0];
+					if (typeof callback !== "function") throw new TypeError("Expected transaction callback");
+					return Reflect.apply(value, object, [(tx) => Reflect.apply(callback, void 0, [wrap(tx)]), ...args.slice(1)]);
+				}
+				if (method === "execute" && activity === void 0) {
+					const raw = Reflect.apply(value, object, args);
+					if (raw instanceof Promise) {
+						tracker.record("unknown", "execute");
+						return raw;
+					}
+					return typeof raw === "object" && raw !== null ? wrap(raw, "unknown", "execute") : raw;
+				}
+				const nextActivity = activities[method] ?? activity;
+				const nextOperation = activities[method] === void 0 ? operation : method;
+				const executes = executions.has(method) && (nextActivity !== void 0 || method === "execute");
+				if (executes) tracker.record(nextActivity ?? "unknown", nextOperation ?? method);
+				const result = Reflect.apply(value, object, args);
+				if ([
+					"as",
+					"getSQL",
+					"toSQL"
+				].includes(method)) return result;
+				if (executes || result instanceof Promise || typeof result !== "object" || result === null) return result;
+				return wrap(result, nextActivity, nextOperation);
+			};
+		} });
+	}
+	function wrapRelations(target) {
+		return new Proxy(target, { get(object, key) {
+			const value = Reflect.get(object, key, object);
+			return typeof value === "object" && value !== null ? wrap(value) : value;
+		} });
+	}
+	return wrap(db);
+}
+
+//#endregion
+//#region src/manifest/get-registered-procedures.ts
+/** Isolate tRPC v11 router introspection and reject incompletely loaded lazy routers. */
+function getRegisteredProcedures(router) {
+	const definition = Reflect.get(router, "_def");
+	if (Object.keys(definition.lazy).length > 0) throw new Error("Lazy routers are unsupported; supply an eagerly assembled test router");
+	return Object.fromEntries(Object.entries(definition.procedures).map(([path, procedure]) => {
+		return [path, Reflect.get(procedure, "_def").type];
+	}));
+}
+
+//#endregion
+//#region src/manifest/ensure-manifest-coverage.ts
+/** Compare the actual registered router against an explicit, complete access manifest. */
+function ensureManifestCoverage(router, manifest) {
+	const paths = Object.keys(getRegisteredProcedures(router));
+	const registered = new Set(paths);
+	const issues = [];
+	for (const path of paths) {
+		if (!Object.hasOwn(manifest, path)) {
+			issues.push(`Missing manifest entry: ${path}`);
+			continue;
+		}
+		const access = manifest[path];
+		if (access === void 0 || !["public", "user"].includes(access.auth) || ![
+			"none",
+			"read",
+			"write"
+		].includes(access.db) || typeof access.isolated !== "boolean" || access.isolated && access.auth !== "user") issues.push(`Invalid manifest entry: ${path} (isolation requires auth: user)`);
+	}
+	for (const path of Object.keys(manifest)) if (!registered.has(path)) issues.push(`Stale manifest entry: ${path}`);
+	if (issues.length > 0) throw new Error(issues.join("\n"));
+}
+
+//#endregion
+//#region src/tracking/ensure-database-access.ts
+/** Enforce DB permissions even when the request itself threw an authorization error. */
+function ensureDatabaseAccess(procedure, access, events) {
+	const violations = events.filter((event) => event.procedure !== procedure || access.db === "none" || access.db === "read" && event.activity !== "read");
+	if (violations.length > 0) throw new Error(`Database access violation in ${procedure} (db: ${access.db}): ${violations.map((event) => `${event.activity} via ${event.operation}`).join(", ")}`);
+}
+
+//#endregion
+//#region src/testing/invoke-procedure.ts
+/** Invoke an eagerly registered query/mutation using tRPC's server-side caller. */
+async function invokeProcedure(router, ctx, path, input) {
+	const procedures = getRegisteredProcedures(router);
+	if (!Object.hasOwn(procedures, path)) throw new Error(`Unknown tRPC procedure: ${path}`);
+	if (procedures[path] === "subscription") throw new Error(`Subscriptions need stream-specific tests: ${path}`);
+	let current = router.createCaller(ctx);
+	for (const segment of path.split(".")) current = Reflect.get(current, segment);
+	if (typeof current !== "function") throw new Error(`Not a callable procedure: ${path}`);
+	return Reflect.apply(current, void 0, [input]);
+}
+
+//#endregion
+//#region src/testing/create-access-tester.ts
+/** Test actual tRPC callers with explicit users, DB policies, and required scenario coverage. */
+function createAccessTester(options) {
+	const { router, manifest, tracker, getUserId } = options;
+	ensureManifestCoverage(router, manifest);
+	const exercised = /* @__PURE__ */ new Set();
+	const authenticated = /* @__PURE__ */ new Set();
+	const isolated = /* @__PURE__ */ new Set();
+	async function call(request) {
+		const access = manifest[request.path];
+		if (!Object.hasOwn(manifest, request.path)) throw new Error(`Unknown procedure: ${request.path}`);
+		const result = await tracker.capture(request.path, async () => invokeProcedure(router, request.ctx, request.path, request.input));
+		ensureDatabaseAccess(request.path, access, result.events);
+		if (result.ok) exercised.add(request.path);
+		return result;
+	}
+	return {
+		call,
+		async testAuthentication(request) {
+			if (manifest[request.path].auth !== "user") throw new Error(`Authentication test requires auth: user: ${request.path}`);
+			if (getUserId(request.ctx) != null) throw new Error("Expected an anonymous context");
+			const result = await call(request);
+			if (result.ok || !(result.error instanceof _trpc_server.TRPCError) || result.error.code !== "UNAUTHORIZED") throw new Error(`Anonymous access was not rejected with UNAUTHORIZED: ${request.path}`);
+			authenticated.add(request.path);
+		},
+		async testIsolation(test) {
+			if (!manifest[test.path].isolated) throw new Error(`Isolation test requires isolated: true: ${test.path}`);
+			const ownerId = getUserId(test.owner.ctx);
+			const otherId = getUserId(test.other.ctx);
+			if (ownerId == null || otherId == null || ownerId === "" || otherId === "" || ownerId === otherId) throw new Error("Isolation tests require two distinct authenticated user IDs");
+			const otherResult = await call({
+				...test.other,
+				path: test.path
+			});
+			await test.verifyOther(otherResult);
+			const ownerResult = await call({
+				...test.owner,
+				path: test.path
+			});
+			if (!ownerResult.ok) throw new Error(`Owner access failed: ${test.path}`, { cause: ownerResult.error });
+			await test.verifyOwner(ownerResult.data);
+			isolated.add(test.path);
+		},
+		ensureCoverage() {
+			ensureManifestCoverage(router, manifest);
+			const issues = [];
+			for (const path of Object.keys(getRegisteredProcedures(router))) {
+				const access = manifest[path];
+				if (!exercised.has(path)) issues.push(`Missing successful call: ${path}`);
+				if (access.auth === "user" && !authenticated.has(path)) issues.push(`Missing anonymous rejection test: ${path}`);
+				if (access.isolated && !isolated.has(path)) issues.push(`Missing isolation test: ${path}`);
+			}
+			if (issues.length > 0) throw new Error(issues.join("\n"));
+		}
+	};
+}
+
+//#endregion
+//#region src/testing/ensure-access-denied.ts
+/** Require an intentional access denial; unrelated failures do not prove isolation. */
+function ensureAccessDenied(result) {
+	if (result.ok || !(result.error instanceof _trpc_server.TRPCError) || ![
+		"UNAUTHORIZED",
+		"FORBIDDEN",
+		"NOT_FOUND"
+	].includes(result.error.code)) throw new Error("Expected UNAUTHORIZED, FORBIDDEN, or NOT_FOUND access denial");
+}
+
+//#endregion
+//#region src/tracking/create-access-tracker.ts
+/** Capture DB activity per awaited request, including failures and concurrent calls. */
+function createAccessTracker() {
+	const storage = new node_async_hooks.AsyncLocalStorage();
+	return {
+		record(activity, operation = activity) {
+			const scope = storage.getStore();
+			if (scope?.active === true) scope.events.push(Object.freeze({
+				procedure: scope.procedure,
+				activity,
+				operation
+			}));
+		},
+		async capture(procedure, run) {
+			const scope = {
+				procedure,
+				events: [],
+				active: true
+			};
+			return storage.run(scope, async () => {
+				try {
+					return {
+						ok: true,
+						data: await run(),
+						events: Object.freeze([...scope.events])
+					};
+				} catch (error) {
+					return {
+						ok: false,
+						error,
+						events: Object.freeze([...scope.events])
+					};
+				} finally {
+					scope.active = false;
+				}
+			});
+		}
+	};
+}
+
+//#endregion
+exports.createAccessTester = createAccessTester;
+exports.createAccessTracker = createAccessTracker;
+exports.ensureAccessDenied = ensureAccessDenied;
+exports.ensureDatabaseAccess = ensureDatabaseAccess;
+exports.ensureManifestCoverage = ensureManifestCoverage;
+exports.instrumentDrizzleDb = instrumentDrizzleDb;

package/dist/index.d.cts

@@ -0,0 +1,82 @@
+import { AnyProcedure, AnyRouter, inferProcedureInput, inferProcedureOutput, inferRouterContext } from "@trpc/server";
+//#region src/types.d.ts
+interface ProcedureAccess {
+  auth: 'public' | 'user';
+  db: 'none' | 'read' | 'write';
+  isolated: boolean;
+}
+type Paths<T> = { [K in keyof T & string]: T[K] extends AnyProcedure ? K : T[K] extends object ? `${K}.${Paths<T[K]>}` : never; }[keyof T & string];
+type AtPath<T, P extends string> = P extends `${infer K}.${infer Rest}` ? K extends keyof T ? AtPath<T[K], Rest> : never : P extends keyof T ? T[P] : never;
+type ProcedurePath<R extends AnyRouter> = Paths<R['_def']['record']>;
+type ProcedureAt<R extends AnyRouter, P extends ProcedurePath<R>> = Extract<AtPath<R['_def']['record'], P>, AnyProcedure>;
+type AccessManifest<R extends AnyRouter> = Readonly<Record<ProcedurePath<R>, ProcedureAccess>>;
+type DatabaseActivity = 'read' | 'write' | 'unknown';
+interface DatabaseEvent {
+  readonly procedure: string;
+  readonly activity: DatabaseActivity;
+  readonly operation: string;
+}
+type AccessResult<T> = ({
+  readonly ok: true;
+  readonly data: T;
+} | {
+  readonly ok: false;
+  readonly error: unknown;
+}) & {
+  readonly events: readonly DatabaseEvent[];
+};
+interface AccessTracker {
+  capture: <T>(procedure: string, run: () => T | PromiseLike<T>) => Promise<AccessResult<T>>;
+  record: (activity: DatabaseActivity, operation?: string) => void;
+}
+interface ProcedureCall<R extends AnyRouter, P extends ProcedurePath<R>> {
+  path: P;
+  ctx: inferRouterContext<R>;
+  input: inferProcedureInput<ProcedureAt<R, P>>;
+}
+interface IsolationTest<R extends AnyRouter, P extends ProcedurePath<R>> {
+  path: P;
+  owner: Omit<ProcedureCall<R, P>, 'path'>;
+  other: Omit<ProcedureCall<R, P>, 'path'>;
+  verifyOwner: (data: inferProcedureOutput<ProcedureAt<R, P>>) => void | Promise<void>;
+  /** Check denied/empty results AND persisted state for mutations, including errors after writes. */
+  verifyOther: (result: AccessResult<inferProcedureOutput<ProcedureAt<R, P>>>) => void | Promise<void>;
+}
+interface AccessTesterOptions<R extends AnyRouter> {
+  router: R;
+  manifest: AccessManifest<R>;
+  tracker: AccessTracker;
+  getUserId: (ctx: inferRouterContext<R>) => string | null | undefined;
+}
+interface AccessTester<R extends AnyRouter> {
+  call: <P extends ProcedurePath<R>>(call: ProcedureCall<R, P>) => Promise<AccessResult<inferProcedureOutput<ProcedureAt<R, P>>>>;
+  testAuthentication: <P extends ProcedurePath<R>>(call: ProcedureCall<R, P>) => Promise<void>;
+  testIsolation: <P extends ProcedurePath<R>>(test: IsolationTest<R, P>) => Promise<void>;
+  ensureCoverage: () => void;
+}
+//#endregion
+//#region src/drizzle/instrument-drizzle-db.d.ts
+/** Wrap a test-only Drizzle database; preserve its types and record query execution, not SQL text. */
+export declare function instrumentDrizzleDb<T extends object>(db: T, tracker: AccessTracker): T;
+//#endregion
+//#region src/manifest/ensure-manifest-coverage.d.ts
+/** Compare the actual registered router against an explicit, complete access manifest. */
+export declare function ensureManifestCoverage(router: AnyRouter, manifest: Readonly<Record<string, ProcedureAccess>>): void;
+//#endregion
+//#region src/testing/create-access-tester.d.ts
+/** Test actual tRPC callers with explicit users, DB policies, and required scenario coverage. */
+export declare function createAccessTester<R extends AnyRouter>(options: AccessTesterOptions<R>): AccessTester<R>;
+//#endregion
+//#region src/testing/ensure-access-denied.d.ts
+/** Require an intentional access denial; unrelated failures do not prove isolation. */
+export declare function ensureAccessDenied(result: AccessResult<unknown>): void;
+//#endregion
+//#region src/tracking/create-access-tracker.d.ts
+/** Capture DB activity per awaited request, including failures and concurrent calls. */
+export declare function createAccessTracker(): AccessTracker;
+//#endregion
+//#region src/tracking/ensure-database-access.d.ts
+/** Enforce DB permissions even when the request itself threw an authorization error. */
+export declare function ensureDatabaseAccess(procedure: string, access: ProcedureAccess, events: readonly DatabaseEvent[]): void;
+//#endregion
+export type { AccessManifest, AccessResult, AccessTester, AccessTesterOptions, AccessTracker, DatabaseActivity, DatabaseEvent, IsolationTest, ProcedureAccess, ProcedureAt, ProcedureCall, ProcedurePath };

package/dist/index.d.ts

@@ -0,0 +1,82 @@
+import { AnyProcedure, AnyRouter, inferProcedureInput, inferProcedureOutput, inferRouterContext } from "@trpc/server";
+//#region src/types.d.ts
+interface ProcedureAccess {
+  auth: 'public' | 'user';
+  db: 'none' | 'read' | 'write';
+  isolated: boolean;
+}
+type Paths<T> = { [K in keyof T & string]: T[K] extends AnyProcedure ? K : T[K] extends object ? `${K}.${Paths<T[K]>}` : never; }[keyof T & string];
+type AtPath<T, P extends string> = P extends `${infer K}.${infer Rest}` ? K extends keyof T ? AtPath<T[K], Rest> : never : P extends keyof T ? T[P] : never;
+type ProcedurePath<R extends AnyRouter> = Paths<R['_def']['record']>;
+type ProcedureAt<R extends AnyRouter, P extends ProcedurePath<R>> = Extract<AtPath<R['_def']['record'], P>, AnyProcedure>;
+type AccessManifest<R extends AnyRouter> = Readonly<Record<ProcedurePath<R>, ProcedureAccess>>;
+type DatabaseActivity = 'read' | 'write' | 'unknown';
+interface DatabaseEvent {
+  readonly procedure: string;
+  readonly activity: DatabaseActivity;
+  readonly operation: string;
+}
+type AccessResult<T> = ({
+  readonly ok: true;
+  readonly data: T;
+} | {
+  readonly ok: false;
+  readonly error: unknown;
+}) & {
+  readonly events: readonly DatabaseEvent[];
+};
+interface AccessTracker {
+  capture: <T>(procedure: string, run: () => T | PromiseLike<T>) => Promise<AccessResult<T>>;
+  record: (activity: DatabaseActivity, operation?: string) => void;
+}
+interface ProcedureCall<R extends AnyRouter, P extends ProcedurePath<R>> {
+  path: P;
+  ctx: inferRouterContext<R>;
+  input: inferProcedureInput<ProcedureAt<R, P>>;
+}
+interface IsolationTest<R extends AnyRouter, P extends ProcedurePath<R>> {
+  path: P;
+  owner: Omit<ProcedureCall<R, P>, 'path'>;
+  other: Omit<ProcedureCall<R, P>, 'path'>;
+  verifyOwner: (data: inferProcedureOutput<ProcedureAt<R, P>>) => void | Promise<void>;
+  /** Check denied/empty results AND persisted state for mutations, including errors after writes. */
+  verifyOther: (result: AccessResult<inferProcedureOutput<ProcedureAt<R, P>>>) => void | Promise<void>;
+}
+interface AccessTesterOptions<R extends AnyRouter> {
+  router: R;
+  manifest: AccessManifest<R>;
+  tracker: AccessTracker;
+  getUserId: (ctx: inferRouterContext<R>) => string | null | undefined;
+}
+interface AccessTester<R extends AnyRouter> {
+  call: <P extends ProcedurePath<R>>(call: ProcedureCall<R, P>) => Promise<AccessResult<inferProcedureOutput<ProcedureAt<R, P>>>>;
+  testAuthentication: <P extends ProcedurePath<R>>(call: ProcedureCall<R, P>) => Promise<void>;
+  testIsolation: <P extends ProcedurePath<R>>(test: IsolationTest<R, P>) => Promise<void>;
+  ensureCoverage: () => void;
+}
+//#endregion
+//#region src/drizzle/instrument-drizzle-db.d.ts
+/** Wrap a test-only Drizzle database; preserve its types and record query execution, not SQL text. */
+export declare function instrumentDrizzleDb<T extends object>(db: T, tracker: AccessTracker): T;
+//#endregion
+//#region src/manifest/ensure-manifest-coverage.d.ts
+/** Compare the actual registered router against an explicit, complete access manifest. */
+export declare function ensureManifestCoverage(router: AnyRouter, manifest: Readonly<Record<string, ProcedureAccess>>): void;
+//#endregion
+//#region src/testing/create-access-tester.d.ts
+/** Test actual tRPC callers with explicit users, DB policies, and required scenario coverage. */
+export declare function createAccessTester<R extends AnyRouter>(options: AccessTesterOptions<R>): AccessTester<R>;
+//#endregion
+//#region src/testing/ensure-access-denied.d.ts
+/** Require an intentional access denial; unrelated failures do not prove isolation. */
+export declare function ensureAccessDenied(result: AccessResult<unknown>): void;
+//#endregion
+//#region src/tracking/create-access-tracker.d.ts
+/** Capture DB activity per awaited request, including failures and concurrent calls. */
+export declare function createAccessTracker(): AccessTracker;
+//#endregion
+//#region src/tracking/ensure-database-access.d.ts
+/** Enforce DB permissions even when the request itself threw an authorization error. */
+export declare function ensureDatabaseAccess(procedure: string, access: ProcedureAccess, events: readonly DatabaseEvent[]): void;
+//#endregion
+export type { AccessManifest, AccessResult, AccessTester, AccessTesterOptions, AccessTracker, DatabaseActivity, DatabaseEvent, IsolationTest, ProcedureAccess, ProcedureAt, ProcedureCall, ProcedurePath };

package/dist/index.js

@@ -0,0 +1,238 @@
+import { TRPCError } from "@trpc/server";
+import { AsyncLocalStorage } from "node:async_hooks";
+
+//#region src/drizzle/instrument-drizzle-db.ts
+const activities = {
+	select: "read",
+	selectDistinct: "read",
+	selectDistinctOn: "read",
+	insert: "write",
+	update: "write",
+	delete: "write",
+	refreshMaterializedView: "write",
+	findFirst: "read",
+	findMany: "read",
+	$count: "read"
+};
+const executions = /* @__PURE__ */ new Set([
+	"then",
+	"catch",
+	"finally",
+	"execute",
+	"all",
+	"get",
+	"run"
+]);
+/** Wrap a test-only Drizzle database; preserve its types and record query execution, not SQL text. */
+function instrumentDrizzleDb(db, tracker) {
+	function wrap(target, activity, operation) {
+		return new Proxy(target, { get(object, key) {
+			const value = Reflect.get(object, key, object);
+			if (key === "$client" || key === "session" || key === "_" || key === "batch") throw new Error(`Direct Drizzle internals (${String(key)}) bypass access tracking`);
+			if (typeof value !== "function") return key === "query" && typeof value === "object" && value !== null ? wrapRelations(value) : value;
+			return (...args) => {
+				const method = String(key);
+				if (method === "transaction") {
+					const callback = args[0];
+					if (typeof callback !== "function") throw new TypeError("Expected transaction callback");
+					return Reflect.apply(value, object, [(tx) => Reflect.apply(callback, void 0, [wrap(tx)]), ...args.slice(1)]);
+				}
+				if (method === "execute" && activity === void 0) {
+					const raw = Reflect.apply(value, object, args);
+					if (raw instanceof Promise) {
+						tracker.record("unknown", "execute");
+						return raw;
+					}
+					return typeof raw === "object" && raw !== null ? wrap(raw, "unknown", "execute") : raw;
+				}
+				const nextActivity = activities[method] ?? activity;
+				const nextOperation = activities[method] === void 0 ? operation : method;
+				const executes = executions.has(method) && (nextActivity !== void 0 || method === "execute");
+				if (executes) tracker.record(nextActivity ?? "unknown", nextOperation ?? method);
+				const result = Reflect.apply(value, object, args);
+				if ([
+					"as",
+					"getSQL",
+					"toSQL"
+				].includes(method)) return result;
+				if (executes || result instanceof Promise || typeof result !== "object" || result === null) return result;
+				return wrap(result, nextActivity, nextOperation);
+			};
+		} });
+	}
+	function wrapRelations(target) {
+		return new Proxy(target, { get(object, key) {
+			const value = Reflect.get(object, key, object);
+			return typeof value === "object" && value !== null ? wrap(value) : value;
+		} });
+	}
+	return wrap(db);
+}
+
+//#endregion
+//#region src/manifest/get-registered-procedures.ts
+/** Isolate tRPC v11 router introspection and reject incompletely loaded lazy routers. */
+function getRegisteredProcedures(router) {
+	const definition = Reflect.get(router, "_def");
+	if (Object.keys(definition.lazy).length > 0) throw new Error("Lazy routers are unsupported; supply an eagerly assembled test router");
+	return Object.fromEntries(Object.entries(definition.procedures).map(([path, procedure]) => {
+		return [path, Reflect.get(procedure, "_def").type];
+	}));
+}
+
+//#endregion
+//#region src/manifest/ensure-manifest-coverage.ts
+/** Compare the actual registered router against an explicit, complete access manifest. */
+function ensureManifestCoverage(router, manifest) {
+	const paths = Object.keys(getRegisteredProcedures(router));
+	const registered = new Set(paths);
+	const issues = [];
+	for (const path of paths) {
+		if (!Object.hasOwn(manifest, path)) {
+			issues.push(`Missing manifest entry: ${path}`);
+			continue;
+		}
+		const access = manifest[path];
+		if (access === void 0 || !["public", "user"].includes(access.auth) || ![
+			"none",
+			"read",
+			"write"
+		].includes(access.db) || typeof access.isolated !== "boolean" || access.isolated && access.auth !== "user") issues.push(`Invalid manifest entry: ${path} (isolation requires auth: user)`);
+	}
+	for (const path of Object.keys(manifest)) if (!registered.has(path)) issues.push(`Stale manifest entry: ${path}`);
+	if (issues.length > 0) throw new Error(issues.join("\n"));
+}
+
+//#endregion
+//#region src/tracking/ensure-database-access.ts
+/** Enforce DB permissions even when the request itself threw an authorization error. */
+function ensureDatabaseAccess(procedure, access, events) {
+	const violations = events.filter((event) => event.procedure !== procedure || access.db === "none" || access.db === "read" && event.activity !== "read");
+	if (violations.length > 0) throw new Error(`Database access violation in ${procedure} (db: ${access.db}): ${violations.map((event) => `${event.activity} via ${event.operation}`).join(", ")}`);
+}
+
+//#endregion
+//#region src/testing/invoke-procedure.ts
+/** Invoke an eagerly registered query/mutation using tRPC's server-side caller. */
+async function invokeProcedure(router, ctx, path, input) {
+	const procedures = getRegisteredProcedures(router);
+	if (!Object.hasOwn(procedures, path)) throw new Error(`Unknown tRPC procedure: ${path}`);
+	if (procedures[path] === "subscription") throw new Error(`Subscriptions need stream-specific tests: ${path}`);
+	let current = router.createCaller(ctx);
+	for (const segment of path.split(".")) current = Reflect.get(current, segment);
+	if (typeof current !== "function") throw new Error(`Not a callable procedure: ${path}`);
+	return Reflect.apply(current, void 0, [input]);
+}
+
+//#endregion
+//#region src/testing/create-access-tester.ts
+/** Test actual tRPC callers with explicit users, DB policies, and required scenario coverage. */
+function createAccessTester(options) {
+	const { router, manifest, tracker, getUserId } = options;
+	ensureManifestCoverage(router, manifest);
+	const exercised = /* @__PURE__ */ new Set();
+	const authenticated = /* @__PURE__ */ new Set();
+	const isolated = /* @__PURE__ */ new Set();
+	async function call(request) {
+		const access = manifest[request.path];
+		if (!Object.hasOwn(manifest, request.path)) throw new Error(`Unknown procedure: ${request.path}`);
+		const result = await tracker.capture(request.path, async () => invokeProcedure(router, request.ctx, request.path, request.input));
+		ensureDatabaseAccess(request.path, access, result.events);
+		if (result.ok) exercised.add(request.path);
+		return result;
+	}
+	return {
+		call,
+		async testAuthentication(request) {
+			if (manifest[request.path].auth !== "user") throw new Error(`Authentication test requires auth: user: ${request.path}`);
+			if (getUserId(request.ctx) != null) throw new Error("Expected an anonymous context");
+			const result = await call(request);
+			if (result.ok || !(result.error instanceof TRPCError) || result.error.code !== "UNAUTHORIZED") throw new Error(`Anonymous access was not rejected with UNAUTHORIZED: ${request.path}`);
+			authenticated.add(request.path);
+		},
+		async testIsolation(test) {
+			if (!manifest[test.path].isolated) throw new Error(`Isolation test requires isolated: true: ${test.path}`);
+			const ownerId = getUserId(test.owner.ctx);
+			const otherId = getUserId(test.other.ctx);
+			if (ownerId == null || otherId == null || ownerId === "" || otherId === "" || ownerId === otherId) throw new Error("Isolation tests require two distinct authenticated user IDs");
+			const otherResult = await call({
+				...test.other,
+				path: test.path
+			});
+			await test.verifyOther(otherResult);
+			const ownerResult = await call({
+				...test.owner,
+				path: test.path
+			});
+			if (!ownerResult.ok) throw new Error(`Owner access failed: ${test.path}`, { cause: ownerResult.error });
+			await test.verifyOwner(ownerResult.data);
+			isolated.add(test.path);
+		},
+		ensureCoverage() {
+			ensureManifestCoverage(router, manifest);
+			const issues = [];
+			for (const path of Object.keys(getRegisteredProcedures(router))) {
+				const access = manifest[path];
+				if (!exercised.has(path)) issues.push(`Missing successful call: ${path}`);
+				if (access.auth === "user" && !authenticated.has(path)) issues.push(`Missing anonymous rejection test: ${path}`);
+				if (access.isolated && !isolated.has(path)) issues.push(`Missing isolation test: ${path}`);
+			}
+			if (issues.length > 0) throw new Error(issues.join("\n"));
+		}
+	};
+}
+
+//#endregion
+//#region src/testing/ensure-access-denied.ts
+/** Require an intentional access denial; unrelated failures do not prove isolation. */
+function ensureAccessDenied(result) {
+	if (result.ok || !(result.error instanceof TRPCError) || ![
+		"UNAUTHORIZED",
+		"FORBIDDEN",
+		"NOT_FOUND"
+	].includes(result.error.code)) throw new Error("Expected UNAUTHORIZED, FORBIDDEN, or NOT_FOUND access denial");
+}
+
+//#endregion
+//#region src/tracking/create-access-tracker.ts
+/** Capture DB activity per awaited request, including failures and concurrent calls. */
+function createAccessTracker() {
+	const storage = new AsyncLocalStorage();
+	return {
+		record(activity, operation = activity) {
+			const scope = storage.getStore();
+			if (scope?.active === true) scope.events.push(Object.freeze({
+				procedure: scope.procedure,
+				activity,
+				operation
+			}));
+		},
+		async capture(procedure, run) {
+			const scope = {
+				procedure,
+				events: [],
+				active: true
+			};
+			return storage.run(scope, async () => {
+				try {
+					return {
+						ok: true,
+						data: await run(),
+						events: Object.freeze([...scope.events])
+					};
+				} catch (error) {
+					return {
+						ok: false,
+						error,
+						events: Object.freeze([...scope.events])
+					};
+				} finally {
+					scope.active = false;
+				}
+			});
+		}
+	};
+}
+
+//#endregion
+export { createAccessTester, createAccessTracker, ensureAccessDenied, ensureDatabaseAccess, ensureManifestCoverage, instrumentDrizzleDb };

package/docs/api.md

@@ -0,0 +1,79 @@
+# API
+
+All exports come from `@pixpilot/trpc-access-testing`.
+
+## Manifest
+
+`AccessManifest<typeof router>` maps every dotted procedure path to:
+
+| Field      | Values              | Meaning                                                           |
+| ---------- | ------------------- | ----------------------------------------------------------------- |
+| `auth`     | `public\|user`      | Anonymous rejection tests required for `user`.                    |
+| `db`       | `none\|read\|write` | No DB operations; reads only; or reads/writes/unknown operations. |
+| `isolated` | boolean             | Cross-user assertions required when true; requires `auth: user`.  |
+
+`db: read` and `db: write` allow zero queries (for example, cache hits).
+Neither forces a query to occur. An admin route can use `auth: user,
+isolated: false`; test its role-specific permissions separately.
+
+`ensureManifestCoverage(router, manifest): void` checks registered paths against
+the manifest at runtime, including JavaScript callers. Throws on missing/stale
+paths, invalid classifications, and lazy routers. TypeScript's `satisfies` also
+checks paths during development.
+
+## Access tester
+
+`createAccessTester({ router, manifest, tracker, getUserId })` validates the
+manifest immediately and returns:
+
+| Method                                                            | Behavior                                                                    |
+| ----------------------------------------------------------------- | --------------------------------------------------------------------------- |
+| `call({ path, ctx, input })`                                      | Calls the real procedure, checks DB policy, returns an `AccessResult`.      |
+| `testAuthentication({ path, ctx, input })`                        | Requires an anonymous context and a tRPC `UNAUTHORIZED` response.           |
+| `testIsolation({ path, owner, other, verifyOwner, verifyOther })` | Requires distinct authenticated identities and awaits both assertions.      |
+| `ensureCoverage()`                                                | Throws for missing successful calls, anonymous checks, or isolation checks. |
+
+Paths, contexts, inputs, and output callback values are inferred from the router.
+Pass `input: undefined` for procedures without input. With defaulted input fields,
+supply values in the shape accepted by your procedure's input parser.
+
+`owner` and `other` each contain `{ ctx, input }`. Their inputs can differ to
+exercise spoofed ownership or create different rows.
+
+`AccessResult<T>` is a discriminated union:
+
+```ts
+type AccessResult<T> =
+  | { ok: true; data: T; events: readonly DatabaseEvent[] }
+  | { ok: false; error: unknown; events: readonly DatabaseEvent[] };
+```
+
+Procedure errors are returned with `ok: false`. Manifest errors, DB violations,
+coverage errors, and failed verification callbacks throw. DB policy is checked
+even when a procedure throws. `testAuthentication` requires correctly shaped input;
+a validation error is not accepted as authentication enforcement.
+
+`ensureAccessDenied(result): void` throws unless a failed result contains a
+tRPC `UNAUTHORIZED`, `FORBIDDEN`, or `NOT_FOUND` error. Use explicit assertions
+for successful empty responses. Always check foreign persisted state for mutations.
+
+## Tracking
+
+`createAccessTracker()` returns:
+
+- `capture(procedure, callback)`: awaits a callback and returns its `AccessResult`
+  with a frozen event snapshot, including events recorded before errors.
+- `record(activity, operation?)`: records an event in the current capture.
+  Outside an active capture it does nothing, so fixture setup is excluded.
+
+Each event contains `{ procedure, activity, operation }`. Activity is `read`,
+`write`, or `unknown`. The default operation label equals the activity.
+Events do not contain SQL or query parameters.
+
+`instrumentDrizzleDb(db, tracker)` returns a proxy retaining the database's
+TypeScript type. Inject this returned object; it does not modify the original
+database. No Drizzle or PGlite runtime dependency is bundled.
+
+`ensureDatabaseAccess(path, classification, events): void` validates a captured
+event list independently. It throws for mismatched originating paths, any
+activity under `db: none`, or write/unknown activity under `db: read`.

package/docs/usage.md

@@ -0,0 +1,135 @@
+# Usage
+
+## Wire the application
+
+Keep this package in dev dependencies and import it only from tests. Supply your
+actual eagerly assembled tRPC router, not a duplicate router created just for the tests.
+
+```ts
+import type { AccessManifest } from '@pixpilot/trpc-access-testing';
+import {
+  createAccessTester,
+  createAccessTracker,
+  instrumentDrizzleDb,
+} from '@pixpilot/trpc-access-testing';
+
+const manifest = {
+  health: { auth: 'public', db: 'none', isolated: false },
+  'documents.get': { auth: 'user', db: 'read', isolated: true },
+} satisfies AccessManifest<typeof appRouter>;
+
+const tracker = createAccessTracker();
+const db = instrumentDrizzleDb(testDb, tracker);
+const access = createAccessTester({
+  router: appRouter,
+  manifest,
+  tracker,
+  getUserId: (ctx) => ctx.user?.id,
+});
+```
+
+Here `appRouter` is your application router and `testDb` is your test database.
+Add all your actual procedure paths to the manifest. The example assumes your
+context has `user` and `db` fields; adapt those to the application.
+
+Use the **same tracker and wrapped database** in contexts, injected repositories,
+and services. A service that imports an unwrapped global database will bypass
+tracking; replace that binding in the test setup. Seed and inspect fixtures using
+the original database, outside the tracked request.
+
+## Check access
+
+Seed Users A and B and a document owned by A. Create server contexts for A, B,
+and an anonymous request, each using the wrapped database. Client input must
+never determine the authorization identity.
+
+```ts
+import { expect, it } from 'vitest';
+
+it('covers access to documents.get', async () => {
+  await access.testAuthentication({
+    path: 'documents.get',
+    ctx: { user: null, db },
+    input: { id: 'a-document' },
+  });
+  await access.testIsolation({
+    path: 'documents.get',
+    owner: { ctx: { user: { id: 'user-a' }, db }, input: { id: 'a-document' } },
+    other: { ctx: { user: { id: 'user-b' }, db }, input: { id: 'a-document' } },
+    verifyOwner: (document) => {
+      expect(document?.id).toBe('a-document');
+    },
+    verifyOther: (result) => {
+      expect(result).toMatchObject({ ok: true, data: null });
+    },
+  });
+});
+```
+
+For a route that intentionally throws, use `ensureAccessDenied(result)` inside
+`verifyOther`. It accepts only tRPC `UNAUTHORIZED`, `FORBIDDEN`, and `NOT_FOUND`;
+connection failures, validation errors, and internal errors do not prove isolation.
+
+For update/delete tests, also read A's persisted records inside `verifyOther`
+and assert they are unchanged. An error response can follow an unauthorized write.
+For list routes, assert that every returned row belongs to B. For creation, assert
+that ownership is assigned from B's server context, even when input spoofs A's ID.
+Use separate fixtures or IDs for separate scenarios.
+
+The attacker runs first, then the owner, then the route is marked isolated only
+after both verification callbacks pass. Owner calls must succeed; each callback
+must contain meaningful assertions. This library cannot prove an empty callback
+contains a useful test.
+
+## Require coverage
+
+Exercise public/shared routes using `access.call` and assert the result:
+
+```ts
+const result = await access.call({
+  path: 'health',
+  ctx: { user: null, db },
+  input: undefined,
+});
+expect(result).toMatchObject({ ok: true, data: 'ok' });
+```
+
+Call `access.ensureCoverage()` after the complete suite. With Vitest, an
+`afterAll(() => access.ensureCoverage())` hook is suitable when all cases share
+one tester. Create that tester once per suite; resetting it per test resets its
+coverage. Each registered path needs a successful call, every `auth: user` route
+needs an anonymous rejection test, and every `isolated: true` route needs a
+completed isolation test. Multiple scenarios for the same path are allowed.
+For suites split across files, use a central coverage suite rather than expecting
+coverage sets to merge across processes.
+
+Construction already fails on missing, stale, or invalid manifest entries.
+Mark admin, health, shared-data, and other exceptional tRPC procedures explicitly.
+HTTP webhooks outside the tRPC router are outside this manifest.
+
+## Database and runtime boundaries
+
+- The Drizzle adapter is tested with PostgreSQL/PGlite and Drizzle 0.45.x.
+  It tracks CRUD builders, relational queries, prepared queries, counts,
+  transactions, and nested transactions, without parsing SQL.
+- Raw `execute` calls are `unknown`, rejected by `db: none` and `db: read`.
+  A `db: write` classification permits them. Keep raw-SQL paths explicit.
+- Activity describes attempted ORM operations, not committed changes. A rolled-back
+  or failed write is still recorded as a write.
+- Builder classifications cannot inspect side effects inside SQL expressions,
+  CTEs, stored functions, or triggers. Verify persisted state for those cases.
+  Database activity auditing does not establish ownership.
+- Direct access to `$client`, `session`, `_`, and `batch` through the wrapped DB
+  throws. The wrapper is test instrumentation, not a production security boundary;
+  an independently retained raw client can bypass it.
+- Other database adapters can call `tracker.record('read' | 'write' | 'unknown',
+operation)` at their execution boundary. ORM/driver classification is their responsibility.
+- Await all request database work. Detached background jobs that outlive a request
+  are not included. Test jobs separately.
+- Node.js `AsyncLocalStorage` preserves originating procedure names across awaited
+  service/repository calls and separates concurrent requests. Edge runtimes are unsupported.
+- Lazy routers and subscriptions fail explicitly; assemble lazy routers eagerly
+  for tests, and test subscription streams separately.
+- Calls use the server-side tRPC caller. This covers tRPC middleware and resolvers;
+  HTTP session parsing, cookies, headers, and transport adapters need their own tests.
+- In-memory PostgreSQL tests do not verify production RLS roles, extensions, or deployment configuration.

package/examples/ownership.test.ts

@@ -0,0 +1,113 @@
+import type { AccessManifest } from '@pixpilot/trpc-access-testing';
+import { PGlite } from '@electric-sql/pglite';
+import {
+  createAccessTester,
+  createAccessTracker,
+  instrumentDrizzleDb,
+} from '@pixpilot/trpc-access-testing';
+import { initTRPC, TRPCError } from '@trpc/server';
+import { and, eq } from 'drizzle-orm';
+import { pgTable, text } from 'drizzle-orm/pg-core';
+import { drizzle } from 'drizzle-orm/pglite';
+import { afterAll, beforeAll, expect, it } from 'vitest';
+import { z } from 'zod';
+
+const users = pgTable('users', { id: text().primaryKey() }).enableRLS();
+const documents = pgTable('documents', {
+  id: text().primaryKey(),
+  ownerId: text()
+    .notNull()
+    .references(() => users.id),
+  body: text().notNull(),
+}).enableRLS();
+const schema = { users, documents };
+type TestDb = ReturnType<typeof drizzle<typeof schema>>;
+interface Context {
+  userId: string | null;
+  db: TestDb;
+}
+
+// Substitute your application's real router and fixtures when adapting this example.
+const t = initTRPC.context<Context>().create();
+const router = t.router({
+  health: t.procedure.query(() => 'ok'),
+  documents: t.router({
+    get: t.procedure
+      .use(async ({ ctx, next }) => {
+        if (ctx.userId === null) throw new TRPCError({ code: 'UNAUTHORIZED' });
+        return next({ ctx: { ...ctx, userId: ctx.userId } });
+      })
+      .input(z.object({ id: z.string() }))
+      .query(async ({ ctx, input }) => {
+        const rows = await ctx.db
+          .select()
+          .from(documents)
+          .where(and(eq(documents.id, input.id), eq(documents.ownerId, ctx.userId)));
+        return rows[0] ?? null;
+      }),
+  }),
+});
+const manifest = {
+  health: { auth: 'public', db: 'none', isolated: false },
+  'documents.get': { auth: 'user', db: 'read', isolated: true },
+} satisfies AccessManifest<typeof router>;
+
+let client: PGlite;
+let db: TestDb;
+let access: ReturnType<typeof createAccessTester<typeof router>>;
+beforeAll(async () => {
+  client = new PGlite();
+  await client.exec(
+    'CREATE TABLE users (id text PRIMARY KEY); CREATE TABLE documents (id text PRIMARY KEY, "ownerId" text NOT NULL REFERENCES users(id), body text NOT NULL);',
+  );
+  const rawDb = drizzle(client, { schema });
+  const tracker = createAccessTracker();
+  db = instrumentDrizzleDb(rawDb, tracker);
+  await rawDb.insert(users).values([{ id: 'user-a' }, { id: 'user-b' }]);
+  await rawDb
+    .insert(documents)
+    .values({ id: 'a-document', ownerId: 'user-a', body: 'private' });
+  access = createAccessTester({
+    router,
+    manifest,
+    tracker,
+    getUserId: (ctx) => ctx.userId,
+  });
+}, 30000);
+afterAll(async () => {
+  try {
+    access.ensureCoverage();
+  } finally {
+    await client.close();
+  }
+});
+
+it('covers the public health procedure', async () => {
+  expect(
+    await access.call({
+      path: 'health',
+      ctx: { userId: null, db },
+      input: undefined,
+    }),
+  ).toMatchObject({ ok: true, data: 'ok' });
+});
+
+it('requires authentication and isolates the document owner', async () => {
+  const input = { id: 'a-document' };
+  await access.testAuthentication({
+    path: 'documents.get',
+    ctx: { userId: null, db },
+    input,
+  });
+  await access.testIsolation({
+    path: 'documents.get',
+    owner: { ctx: { userId: 'user-a', db }, input },
+    other: { ctx: { userId: 'user-b', db }, input },
+    verifyOwner: (row) => {
+      expect(row?.id).toBe(input.id);
+    },
+    verifyOther: (result) => {
+      expect(result).toMatchObject({ ok: true, data: null });
+    },
+  });
+});

package/package.json

@@ -1,6 +1,83 @@
 {
   "name": "@pixpilot/trpc-access-testing",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "type": "module",
+  "version": "0.2.0",
+  "description": "Manifest coverage, database auditing and cross-user isolation tests for tRPC",
+  "author": "Mo Doaie <m.doaie@hotmail.com>",
+  "license": "MIT",
+  "homepage": "https://github.com/pixpilot/trpc-tools",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pixpilot/trpc-tools.git",
+    "directory": "packages/trpc-access-testing"
+  },
+  "bugs": {
+    "url": "https://github.com/pixpilot/trpc-tools/issues"
+  },
+  "keywords": [
+    "trpc",
+    "testing",
+    "authorization",
+    "isolation",
+    "drizzle"
+  ],
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "docs",
+    "examples"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "prettier": "@internal/prettier-config",
+  "engines": {
+    "node": ">=22"
+  },
+  "peerDependencies": {
+    "@trpc/server": "^11.16.0"
+  },
+  "devDependencies": {
+    "@electric-sql/pglite": "^0.5.8",
+    "@trpc/server": "^11.16.0",
+    "@types/node": "^26.6.2",
+    "@vitest/coverage-v8": "^5.0.1",
+    "@vitest/ui": "^5.0.1",
+    "drizzle-orm": "^0.45.2",
+    "eslint": "^10.11.0",
+    "tsdown": "^0.23.0",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.1",
+    "zod": "^4.6.5",
+    "@internal/eslint-config": "0.3.0",
+    "@internal/prettier-config": "0.0.1",
+    "@internal/tsconfig": "0.1.0",
+    "@internal/vitest-config": "0.1.0",
+    "@internal/tsdown-config": "0.1.0"
+  },
+  "scripts": {
+    "clean": "git clean -xdf .cache .turbo dist",
+    "clean:all": "pnpm clean && git clean -xdf node_modules",
+    "build": "tsdown",
+    "build:watch": "tsdown --watch",
+    "test": "vitest --run",
+    "test:watch": "vitest --watch",
+    "test:ui": "vitest --ui --watch",
+    "test:ui:coverage": "vitest --ui --coverage --watch --hookTimeout=30000 --coverage.thresholds.lines=0 --coverage.thresholds.functions=0 --coverage.thresholds.branches=0 --coverage.thresholds.statements=0",
+    "test:coverage": "vitest --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint",
+    "format": "prettier --check . --ignore-path ../../.gitignore --ignore-path ../../.prettierignore"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts"
 }