@sleepy-hollow/framework 0.3.0

package/dist/types-Bet36nZS.d.ts

@@ -0,0 +1,390 @@
+import { N as NormalizedRoute } from './types-BC7LJJ6G.js';
+import { E as EmbeddedSqliteDatabase } from './types-BUXw3UwN.js';
+
+/** How one test run ended. */
+type TestResultStatus = "passed" | "failed" | "skipped";
+/** One acceptance criterion an approval covers. */
+interface ApprovedCriterion {
+    /** The criterion's identifier, such as `AC-F020-001`. */
+    readonly id: string;
+}
+/**
+ * A requirement as the test layer needs to see it: its criteria, its status,
+ * and the digest binding the approval to the exact content approved.
+ */
+interface RequirementEvidence {
+    /** The requirement's identifier, such as `SH-F020`. */
+    readonly id: string;
+    /** Where the requirement stands in its lifecycle. */
+    readonly status: "draft" | "approved" | "verified";
+    /** Digest of the governed content, which the approval binds to. */
+    readonly governedContentDigest: string;
+    /** Requirements this one builds on. */
+    readonly dependsOn?: readonly string[];
+    /** The acceptance criteria tests must map to. */
+    readonly criteria: readonly ApprovedCriterion[];
+    /** The recorded approval, and whether it still binds this content. */
+    readonly approval?: {
+        readonly valid: boolean;
+        readonly digest: string;
+        readonly criteria: readonly string[];
+    };
+}
+/** A test, together with the criteria it claims to verify. */
+interface CriterionTestSpec {
+    /** Stable identifier for this test. */
+    readonly id: string;
+    /** The requirement being verified. */
+    readonly requirementId: string;
+    /** The criteria within it this test verifies. */
+    readonly criteria: readonly string[];
+    /** Human-readable name. */
+    readonly name: string;
+    /** Path of the file the test is defined in. */
+    readonly sourcePath: string;
+    /** The test body. */
+    readonly fn: (context?: unknown) => void | Promise<void>;
+    /** Skips the test while keeping its mapping visible. */
+    readonly ignore?: boolean;
+}
+/** A registered test, as recorded for traceability. */
+interface CriterionTestDescriptor {
+    /** Stable identifier for this test. */
+    readonly id: string;
+    /** The requirement being verified. */
+    readonly requirementId: string;
+    /** The criteria this test verifies. */
+    readonly criteria: readonly string[];
+    /** Human-readable name. */
+    readonly name: string;
+    /** Name the test was registered under with the runner. */
+    readonly registeredName: string;
+    /** Path of the file the test is defined in. */
+    readonly sourcePath: string;
+}
+/** Registers criterion tests and remembers what was registered. */
+interface CriterionTestRegistry {
+    /**
+     * Registers one test against the criteria it verifies.
+     *
+     * @param spec The test, and what it claims to verify.
+     * @returns The descriptor recorded for it.
+     */
+    criterionTest(spec: CriterionTestSpec): CriterionTestDescriptor;
+    /**
+     * Lists what has been registered.
+     *
+     * @returns Every descriptor, in registration order.
+     */
+    descriptors(): readonly CriterionTestDescriptor[];
+}
+/** A manifest entry: a test, and a digest of the source it was defined in. */
+interface TestManifestEntry extends CriterionTestDescriptor {
+    /** Digest of the test's source, so a later edit is detectable. */
+    readonly sourceDigest: string;
+}
+/**
+ * The registered test suite, digested.
+ *
+ * Comparing manifests across revisions is what makes a weakened or deleted
+ * test visible rather than silent.
+ */
+interface TestManifest {
+    /** Identifies the manifest format. */
+    readonly schema: "sleepy-hollow-test-manifest/v1";
+    /** Every registered test. */
+    readonly tests: readonly TestManifestEntry[];
+}
+/** How one test actually ended when run. */
+interface TestExecutionResult {
+    /** Identifier of the test. */
+    readonly testId: string;
+    /** How it ended. */
+    readonly status: TestResultStatus;
+    /** How long it took. */
+    readonly durationMs?: number;
+    /** Supporting output, such as a failure message. */
+    readonly evidence?: string;
+}
+/** One criterion's verification state, and what determined it. */
+interface CriterionTrace {
+    /** The requirement the criterion belongs to. */
+    readonly requirementId: string;
+    /** The criterion. */
+    readonly criterionId: string;
+    /** Tests mapped to it. */
+    readonly testIds: readonly string[];
+    /** Its state; `unmapped` means no test claims it. */
+    readonly status: "passing" | "failing" | "skipped" | "unmapped";
+}
+/**
+ * Which criteria are verified, which are not, and what changed since the last
+ * run. `eligibleForVerification` is the gate: it is false whenever a criterion
+ * is unmapped, a test was removed, or a mapping was weakened.
+ */
+interface TraceabilityReport {
+    /** Identifies the report format. */
+    readonly schema: "sleepy-hollow-traceability/v1";
+    /** Every criterion, with its state. */
+    readonly criteria: readonly CriterionTrace[];
+    /** Criteria whose mapped tests all passed. */
+    readonly passingCriteria: readonly string[];
+    /** Criteria with at least one failing test. */
+    readonly failingCriteria: readonly string[];
+    /** Criteria whose tests were skipped. */
+    readonly skippedCriteria: readonly string[];
+    /** Criteria no test claims. */
+    readonly unmappedCriteria: readonly string[];
+    /** Tests claiming no criterion. */
+    readonly unmappedTests: readonly string[];
+    /** Tests present in the previous manifest and now gone. */
+    readonly removedTests: readonly string[];
+    /** Tests whose source changed since the previous manifest. */
+    readonly changedTests: readonly string[];
+    /** Mappings that now cover fewer criteria than before. */
+    readonly weakenedMappings: readonly string[];
+    /** Whether this run may support a claim of verification. */
+    readonly eligibleForVerification: boolean;
+}
+/** One baseline check proving the tree was otherwise healthy. */
+interface BaselineCheck {
+    /** Identifier of the check. */
+    readonly id: string;
+    /** Whether it passed. */
+    readonly status: "passed" | "failed";
+    /** What was checked. */
+    readonly kind: "type" | "startup" | "dependency" | "unaffected-test";
+    /** Supporting output. */
+    readonly evidence?: string;
+}
+/**
+ * One test's result during a red-state run, and why it failed.
+ *
+ * The failure kind is what separates credible red state from a broken tree: a
+ * test failing for `missing-behavior` is evidence, one failing to `compile` or
+ * for `permission` reasons is not.
+ */
+interface RedTestResult {
+    /** Identifier of the test. */
+    readonly testId: string;
+    /** The criteria it maps to. */
+    readonly criterionIds: readonly string[];
+    /** Digest of the test source, so the run binds to what was executed. */
+    readonly testDigest: string;
+    /** How it ended. */
+    readonly status: TestResultStatus;
+    /** Why it failed; only `missing-behavior` counts as expected red. */
+    readonly failureKind?: "missing-behavior" | "compile" | "assertion" | "permission" | "startup" | "dependency" | "unrelated";
+    /** Supporting output. */
+    readonly evidence?: string;
+    /** Why this failure was expected, when it was. */
+    readonly expectedReason?: string;
+}
+/**
+ * The classification of a red-state run: credible evidence that the behaviour
+ * is genuinely absent, a broken baseline, or an invalid claim.
+ */
+interface RedStateResult {
+    /** What the run amounts to. */
+    readonly kind: "expected-red" | "broken-baseline" | "invalid-red";
+    /** Whether it is usable as red-state evidence. */
+    readonly valid: boolean;
+    /** The requirement being implemented. */
+    readonly requirementId: string;
+    /** Digest of the requirement's governed content at the time of the run. */
+    readonly requirementDigest: string;
+    /** Revision the run was performed against. */
+    readonly baselineRevision: string;
+    /** What performed the run. */
+    readonly runner: string;
+    /** Where it ran. */
+    readonly environment: string;
+    /** The criteria the run covers. */
+    readonly criteria: readonly string[];
+    /** Each test's result. */
+    readonly tests: readonly RedTestResult[];
+    /** Why the run was rejected, when it was. */
+    readonly diagnostics: readonly TestingDiagnostic[];
+}
+/** One reason a testing artifact was refused. */
+interface TestingDiagnostic {
+    /** Stable machine-readable identifier for this kind of fault. */
+    readonly code: string;
+    /** What is wrong, in one sentence. */
+    readonly message: string;
+    /** What the fault concerns, such as a test or criterion. */
+    readonly subject?: string;
+    /** What to change to resolve it. */
+    readonly correction: string;
+}
+/** What a test application factory is given to build the application. */
+interface TestApplicationFactoryContext<Principal, Credentials> {
+    /** An isolated store for this test. */
+    readonly database: EmbeddedSqliteDatabase;
+    /** The caller the test acts as, when it declares one. */
+    readonly principal?: Principal;
+    /** Credentials the test authenticates with, when it declares any. */
+    readonly credentials?: Credentials;
+}
+/** The application under test, reduced to what a test needs of it. */
+interface TestApplication {
+    /**
+     * Answers one request.
+     *
+     * @param request The request to answer.
+     * @returns The response.
+     */
+    fetch(request: Request): Response | Promise<Response>;
+}
+/** Where to load the project's security module from, under test. */
+interface TestApplicationSecurityOptions {
+    /** Project root the security module is resolved against. */
+    readonly root: string;
+    /** Path to the security module; defaults to the conventional location. */
+    readonly securityModule?: string;
+    /** Imports the module; supply your own to compose without disk access. */
+    readonly load?: (specifier: string) => Promise<unknown>;
+}
+/** Builds the application under test. */
+type TestApplicationFactory<Principal, Credentials> = (context: TestApplicationFactoryContext<Principal, Credentials>) => TestApplication | Promise<TestApplication>;
+/** The caller, the seed data, and the teardown a test runs with. */
+interface TestApplicationFixtures<Principal, Credentials> {
+    /** The caller the test acts as. */
+    readonly principal?: Principal;
+    /** Credentials the test authenticates with. */
+    readonly credentials?: Credentials;
+    /** Populates the store before the test body runs. */
+    readonly seed?: (context: {
+        readonly database: EmbeddedSqliteDatabase;
+        readonly application: TestApplication;
+    }) => void | Promise<void>;
+    /** Runs after the test, before the store is closed. */
+    readonly cleanup?: () => void | Promise<void>;
+    /** Origin requests are addressed to; defaults to a local placeholder. */
+    readonly origin?: string;
+}
+/**
+ * A test application is built either from an application factory or from a
+ * route inventory the framework composes security over, never from neither and
+ * never from both. The union makes the invalid combinations unrepresentable
+ * rather than leaving them to a runtime diagnostic.
+ */
+type TestApplicationOptions<Principal, Credentials> = TestApplicationFixtures<Principal, Credentials> & ({
+    readonly create: TestApplicationFactory<Principal, Credentials>;
+    readonly routes?: undefined;
+    readonly security?: undefined;
+} | {
+    readonly routes: readonly NormalizedRoute[];
+    readonly security?: TestApplicationSecurityOptions;
+    readonly create?: undefined;
+});
+/** One JSON request a test makes. */
+interface JsonRequestOptions<Body> {
+    /** The HTTP method; defaults to `GET`. */
+    readonly method?: string;
+    /** Path to call, relative to the application's origin. */
+    readonly path: string;
+    /** Additional headers. */
+    readonly headers?: HeadersInit;
+    /** Body to send as JSON. */
+    readonly body?: Body;
+}
+/** A response, with its JSON body already parsed. */
+interface JsonTestResponse<Body> {
+    /** The response itself. */
+    readonly response: Response;
+    /** Its parsed body. */
+    readonly body: Body;
+}
+/** What a test asserts about a problem-details response. */
+interface ProblemExpectation {
+    /** Expected status. */
+    readonly status: number;
+    /** Expected problem type. */
+    readonly type?: string;
+    /** Expected title. */
+    readonly title?: string;
+    /** Expected additional members. */
+    readonly extensions?: Readonly<Record<string, unknown>>;
+}
+/** A problem-details response body, as defined by RFC 9457. */
+interface ProblemDetails {
+    /** Identifies the problem type. */
+    readonly type: string;
+    /** Short human-readable summary. */
+    readonly title: string;
+    /** The HTTP status. */
+    readonly status: number;
+    /** Detail specific to this occurrence. */
+    readonly detail?: string;
+    /** Identifies this occurrence. */
+    readonly instance?: string;
+    /** Additional members the problem type defines. */
+    readonly [key: string]: unknown;
+}
+/**
+ * A running application under test, with its store.
+ *
+ * It implements `AsyncDisposable`, so `await using` closes the store and runs
+ * cleanup even when the test body throws.
+ */
+interface TestApplicationContext {
+    /** The isolated store this test runs against. */
+    readonly database: EmbeddedSqliteDatabase;
+    /** The application under test. */
+    readonly application: TestApplication;
+    /**
+     * Calls the application directly.
+     *
+     * @param input The request, URL, or path to call.
+     * @param init Request options.
+     * @returns The response.
+     */
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    /**
+     * Calls the application with a JSON body and parses the JSON response.
+     *
+     * @param options The method, path, headers, and body.
+     * @returns The response, and its parsed body.
+     */
+    request<RequestBody = undefined, ResponseBody = unknown>(options: JsonRequestOptions<RequestBody>): Promise<JsonTestResponse<ResponseBody>>;
+    /**
+     * Asserts a response is the expected problem, and returns it parsed.
+     *
+     * @param response The response to check.
+     * @param expectation What the problem must be.
+     * @returns The parsed problem details.
+     */
+    assertProblem(response: Response, expectation: ProblemExpectation): Promise<ProblemDetails>;
+    /** Runs cleanup and closes the store. */
+    close(): Promise<void>;
+    /** Closes the context at the end of an `await using` block. */
+    [Symbol.asyncDispose](): Promise<void>;
+}
+/** One requirement's place in the dependency graph. */
+interface RequirementDependency {
+    /** The requirement's identifier. */
+    readonly id: string;
+    /** Requirements it builds on. */
+    readonly dependsOn: readonly string[];
+}
+/**
+ * Which tests a change requires running.
+ *
+ * Selection falls back to `full` whenever targeting cannot be justified, so an
+ * unattributable change runs everything rather than silently running less.
+ */
+interface TestSelection {
+    /** Whether a subset suffices, or everything must run. */
+    readonly mode: "targeted" | "full";
+    /** Requirements implicated by the change. */
+    readonly requirementIds: readonly string[];
+    /** Tests to run. */
+    readonly testIds: readonly string[];
+    /** Why each requirement was implicated. */
+    readonly reasons: Readonly<Record<string, readonly string[]>>;
+    /** Why targeting was refused, when it was. */
+    readonly diagnostics: readonly TestingDiagnostic[];
+}
+
+export type { ApprovedCriterion as A, BaselineCheck as B, CriterionTestRegistry as C, JsonRequestOptions as J, ProblemExpectation as P, RequirementEvidence as R, TestingDiagnostic as T, ProblemDetails as a, RedTestResult as b, RedStateResult as c, TestApplicationOptions as d, TestApplicationContext as e, TestManifest as f, TestExecutionResult as g, TraceabilityReport as h, CriterionTestSpec as i, CriterionTestDescriptor as j, RequirementDependency as k, TestSelection as l, CriterionTrace as m, JsonTestResponse as n, TestApplication as o, TestApplicationFactory as p, TestApplicationFactoryContext as q, TestApplicationFixtures as r, TestApplicationSecurityOptions as s, TestManifestEntry as t, TestResultStatus as u };

package/dist/types-DmzdxsaA.d.ts

@@ -0,0 +1,113 @@
+import { z } from 'zod';
+
+/** Which part of an exchange a schema governs. */
+type ValidationLocation = "params" | "query" | "headers" | "body" | "response";
+/** One way a value failed its schema. */
+interface ValidationIssue {
+    /** Which part of the exchange the value came from. */
+    readonly location: ValidationLocation;
+    /** Path to the offending field within that location. */
+    readonly path: readonly PropertyKey[];
+    /** Stable machine-readable identifier for this kind of failure. */
+    readonly code: string;
+    /** What was wrong with the value; never the value itself. */
+    readonly message: string;
+}
+/**
+ * A validation failure, as reported to the diagnostic sink.
+ *
+ * It names the route, the schema, and the failing paths, but never the
+ * submitted values, so diagnostics stay safe to log.
+ */
+interface ValidationDiagnostic {
+    /** Stable machine-readable identifier for this kind of fault. */
+    readonly code: string;
+    /** Validation faults are always errors; there are no warnings. */
+    readonly severity: "error";
+    /** What is wrong, in one sentence. */
+    readonly summary: string;
+    /** The route that was called. */
+    readonly route: string;
+    /** File the route was discovered from. */
+    readonly source: string;
+    /** Which schema rejected the value. */
+    readonly schemaLocation: string;
+    /** Every issue found; validation does not stop at the first. */
+    readonly issues: readonly ValidationIssue[];
+    /** What to change to resolve it. */
+    readonly correction: string;
+}
+/** How the validating router behaves. */
+interface ValidationOptions {
+    /** The posture to run under; production reports less to the caller. */
+    readonly mode?: "development" | "production" | "test";
+    /** Receives each failure, for logging. */
+    readonly onDiagnostic?: (diagnostic: ValidationDiagnostic) => void;
+}
+/** One schema after normalization: what enforces it, and what documents it. */
+interface NormalizedSchema {
+    /** The schema enforced at request time. */
+    readonly runtime: z.ZodType;
+    /** The same shape as contract documentation. */
+    readonly contract: Readonly<Record<string, unknown>>;
+}
+/** A body schema, carrying the size ceiling enforced before parsing. */
+interface NormalizedBodySchema extends NormalizedSchema {
+    /** Largest body accepted; a larger one is refused unread. */
+    readonly maxBytes: number;
+}
+/** Every schema of one operation, after normalization. */
+interface NormalizedOperationSchemas {
+    /** Schema for path parameters. */
+    readonly params?: NormalizedSchema;
+    /** Schema for query string values. */
+    readonly query?: NormalizedSchema;
+    /** Schema for request headers, and which headers are read. */
+    readonly headers?: NormalizedSchema & {
+        readonly names: readonly string[];
+    };
+    /** Schema for the request body, and its size ceiling. */
+    readonly body?: NormalizedBodySchema;
+    /** Schema per response status; `null` where a status carries no body. */
+    readonly responses: Readonly<Record<number, NormalizedSchema | null>>;
+}
+/** One route's validation, resolved and ready to enforce. */
+interface NormalizedValidationRoute {
+    /** The HTTP method. */
+    readonly method: string;
+    /** The route path. */
+    readonly path: string;
+    /** File the route was discovered from. */
+    readonly source: string;
+    /** The normalized schemas for this operation. */
+    readonly schemas: NormalizedOperationSchemas;
+}
+/** A request handler that validates, and its resolved schema inventory. */
+interface ValidatedRouter {
+    /** Resolved validation for every route, for inspection and evidence. */
+    readonly routes: readonly NormalizedValidationRoute[];
+    /**
+     * Answers one request, validating it and its response.
+     *
+     * @param request The incoming request.
+     * @returns The response, or a problem-details response on failure.
+     */
+    fetch(request: Request): Promise<Response>;
+}
+/**
+ * Thrown when route schemas cannot be normalized.
+ *
+ * Raised at startup, so a schema that is not strict, or a response status with
+ * no schema, is refused before the route can serve a single request.
+ */
+declare class SchemaNormalizationError extends Error {
+    readonly diagnostics: readonly ValidationDiagnostic[];
+    /**
+     * Builds an error whose message lists every diagnostic, one per line.
+     *
+     * @param diagnostics Every fault found, in the order detected.
+     */
+    constructor(diagnostics: readonly ValidationDiagnostic[]);
+}
+
+export { type NormalizedBodySchema as N, SchemaNormalizationError as S, type ValidatedRouter as V, type NormalizedOperationSchemas as a, type NormalizedSchema as b, type NormalizedValidationRoute as c, type ValidationDiagnostic as d, type ValidationIssue as e, type ValidationLocation as f, type ValidationOptions as g };

package/dist/validation.d.ts

@@ -0,0 +1,57 @@
+export { z } from 'zod';
+import { d as ValidationDiagnostic, g as ValidationOptions, V as ValidatedRouter, c as NormalizedValidationRoute } from './types-DmzdxsaA.js';
+export { N as NormalizedBodySchema, a as NormalizedOperationSchemas, b as NormalizedSchema, S as SchemaNormalizationError, e as ValidationIssue, f as ValidationLocation } from './types-DmzdxsaA.js';
+import { N as NormalizedRoute } from './types-BC7LJJ6G.js';
+
+/**
+ * Renders a diagnostic as human-readable lines for a terminal or log.
+ *
+ * @param diagnostic The failure to render.
+ * @returns The rendered text, carrying paths but never submitted values.
+ */
+declare function formatValidationDiagnostic(diagnostic: ValidationDiagnostic): string;
+/**
+ * Wraps diagnostics in a versioned envelope for machine consumption.
+ *
+ * @param diagnostics The failures to report.
+ * @returns The diagnostics, tagged with their format version.
+ */
+declare function validationDiagnosticResult(diagnostics: readonly ValidationDiagnostic[]): {
+    readonly version: 1;
+    readonly diagnostics: readonly ValidationDiagnostic[];
+};
+
+/**
+ * Wraps a route table so requests and responses are validated.
+ *
+ * A request that fails its schema is answered with problem details rather than
+ * raised as a fault. A response that fails its schema is a defect in the
+ * service, and is treated as one.
+ *
+ * @param routes The discovered route table.
+ * @param options The posture, and where to report failures.
+ * @returns A validating router, and its resolved schema inventory.
+ * @throws {SchemaNormalizationError} When any route's schemas are invalid.
+ */
+declare function createValidatedRouter(routes: readonly NormalizedRoute[], options?: ValidationOptions): ValidatedRouter;
+
+/** A route paired with its normalized schemas, ready to be enforced. */
+interface PreparedRoute {
+    /** The route as discovered. */
+    readonly source: NormalizedRoute;
+    /** Its schemas, normalized. */
+    readonly normalized: NormalizedValidationRoute;
+}
+/**
+ * Normalizes every route's schemas once, at startup.
+ *
+ * Faults are collected across the whole table rather than thrown at the first,
+ * so one run reports every schema that needs correcting.
+ *
+ * @param routes The discovered route table.
+ * @returns Each route paired with its normalized schemas.
+ * @throws {SchemaNormalizationError} When any route's schemas are invalid.
+ */
+declare function normalizeRoutes(routes: readonly NormalizedRoute[]): readonly PreparedRoute[];
+
+export { NormalizedValidationRoute, type PreparedRoute, ValidatedRouter, ValidationDiagnostic, ValidationOptions, createValidatedRouter, formatValidationDiagnostic, normalizeRoutes, validationDiagnosticResult };

package/dist/validation.js

@@ -0,0 +1,20 @@
+import {
+  SchemaNormalizationError,
+  createValidatedRouter,
+  formatValidationDiagnostic,
+  normalizeRoutes,
+  validationDiagnosticResult,
+  z
+} from "./chunk-CAPFDC25.js";
+import "./chunk-53TZY5YP.js";
+import "./chunk-LNJDFJGT.js";
+import "./chunk-5WRI5ZAA.js";
+export {
+  SchemaNormalizationError,
+  createValidatedRouter,
+  formatValidationDiagnostic,
+  normalizeRoutes,
+  validationDiagnosticResult,
+  z
+};
+//# sourceMappingURL=validation.js.map

package/dist/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -0,0 +1,84 @@
+{
+  "name": "@sleepy-hollow/framework",
+  "version": "0.3.0",
+  "description": "A specification-governed Node and Bun framework for HTTP services.",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/coryfail/SleepyHollow"
+  },
+  "type": "module",
+  "imports": {
+    "#platform": "./platform.ts"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./database": {
+      "types": "./dist/database.d.ts",
+      "import": "./dist/database.js"
+    },
+    "./routing": {
+      "types": "./dist/routing.d.ts",
+      "import": "./dist/routing.js"
+    },
+    "./validation": {
+      "types": "./dist/validation.d.ts",
+      "import": "./dist/validation.js"
+    },
+    "./security": {
+      "types": "./dist/security.d.ts",
+      "import": "./dist/security.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.js"
+    },
+    "./cli": {
+      "types": "./dist/cli.d.ts",
+      "import": "./dist/cli.js"
+    }
+  },
+  "bin": {
+    "hollow": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "prepack": "npm run build",
+    "check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:node": "npm run build && vitest run",
+    "test:bun": "npm run build && bunx vitest run",
+    "test:baseline": "node --test tests/platform-migration-baseline.test.mjs",
+    "verify": "npm run check && npm run test:node && npm run test:bun && npm run test:baseline",
+    "pack:check": "npm pack --dry-run"
+  },
+  "dependencies": {
+    "better-sqlite3": "13.0.3",
+    "drizzle-orm": "0.45.2",
+    "pg": "8.23.0",
+    "yaml": "2.9.0",
+    "zod": "4.4.3"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "9.6.0",
+    "@types/node": "26.2.0",
+    "@types/pg": "8.23.1",
+    "bun": "^1.3.14",
+    "drizzle-kit": "0.31.10",
+    "tsup": "8.5.1",
+    "typescript": "5.9.3",
+    "vitest": "4.1.11"
+  }
+}