@volcanicminds/backend 3.0.1 → 3.2.0

package/lib/loader/router.ts

@@ -65,7 +65,7 @@ async function loadMiddlewares(base: string, middlewares: string[] = []) {
 }
 
 
-function processRoute(
+export function processRoute(
   route: Route,
   index: number,
   file: string,
@@ -90,6 +90,9 @@ function processRoute(
   let requiredRoles: Role[] = []
 
   try {
+    // `admin` is a global superuser: it is appended to EVERY route's allowed roles,
+    // so an admin can access any endpoint (even ones restricted to e.g. backoffice).
+    // This is intentional. Remove this append if admin should NOT be a universal role.
     requiredRoles = rsp.some((r) => r.code === roles.admin.code) ? rsp : [...rsp, roles.admin]
   } catch (err) {
     if (log.e) log.error(`Error in loading roles for ${methodCase} ${pathName} (${handler})`)
@@ -132,7 +135,10 @@ function processRoute(
     if (!methods.includes(method)) errors.push(`Error in [${file}] bad method [${method}] at route n. ${num}`)
     if (handlerParts.length !== 2) errors.push(`Error in [${file}] bad handler [${handler}] at route n. ${num}`)
 
-    const key = method + endpoint + version
+    // Stored routes keep a leading slash in `path` ('/' + endpoint), so the key
+    // must include it too — otherwise 'GETusers' never equals 'GET/users' and the
+    // duplicate check silently never fires.
+    const key = `${method}/${endpoint}${version}`
     if (validRoutes.some((r) => `${r.method}${r.path}${r.doc?.version}` === key)) {
       errors.push(`Error in [${file}] duplicated path [${pathName}] at route n. ${num}`)
     }
@@ -183,7 +189,11 @@ function processRoute(
       base,
       file: path.join(base, defaultConfig.controller || 'controller', handlerParts[0]),
       func: handlerParts[1],
-      doc: doc
+      doc: doc,
+      // Structural hints (manifest L1): resource-level, taken from the file-level
+      // `config` (defaultConfig) with optional per-route override.
+      group: config?.group ?? defaultConfig?.group,
+      resource: config?.resource ?? defaultConfig?.resource
     }
   }
 
@@ -287,5 +297,8 @@ async function applyRoutes(server: any, routes: ConfiguredRoute[]): Promise<void
 
 export async function apply(server: any): Promise<void> {
   const routes = await load()
+  // Expose the mounted routes (enabled + valid) for introspection — e.g. the admin
+  // manifest generator. Read-only by convention; rebuilt on every apply().
+  global.routes = routes
   return await applyRoutes(server, routes)
 }

package/lib/loader/tracking.ts

@@ -25,7 +25,16 @@ export async function load() {
 
       if (enableAll) {
         changes.forEach((change) => {
-          const tc: TrackChanges = { primaryKey: primaryKey, changeEntity: changeEntity, ...change } as TrackChanges
+          // `enable: true` default must be PERSISTED: the runtime gate
+          // (getTrackingConfigIfEnabled) checks `tc.enable`, so a change entry
+          // without an explicit `enable` would otherwise never track despite
+          // isValid() treating it as enabled.
+          const tc: TrackChanges = {
+            primaryKey: primaryKey,
+            changeEntity: changeEntity,
+            enable: true,
+            ...change
+          } as TrackChanges
           const code = getCodeBy(tc.method, tc.path)
 
           if (code in trackChangesList) {

package/lib/manifest/generator.ts

@@ -0,0 +1,345 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/**
+ * Admin Manifest generator (v2) — schema-only, core, no data-layer access.
+ *
+ * Composes a Manifest from `global.routes` (BE-1/BE-2) + the registered JSON Schemas
+ * (`server.getSchemas()`). Contract: `manifest.v2.schema.json` in @volcanicminds/admin
+ * (see MANIFEST_DESIGN.md §2/§3). Relations are emitted "magre" (no kind/foreignKey:
+ * enriched via admin overrides). First cut — type breadth/relation detection is hardened
+ * by BE-7 tests.
+ */
+import type { ConfiguredRoute, ResourceHints } from '../../types/global.js'
+
+// ── Output types (mirror the v2 JSON Schema; the engine owns the canonical TS type) ──
+type CapabilityKind = 'list' | 'read' | 'create' | 'update' | 'delete' | 'action'
+type FieldType =
+  | 'string' | 'text' | 'richtext' | 'integer' | 'number' | 'boolean' | 'date' | 'datetime'
+  | 'enum' | 'relation' | 'email' | 'url' | 'uuid' | 'json' | 'image' | 'file'
+
+export interface CapabilitySpec {
+  name: string
+  kind: CapabilityKind
+  method: string
+  path: string
+  roles: string[]
+  label?: string
+  target?: ('row' | 'bulk' | 'collection')[]
+}
+export interface FieldSpec {
+  name: string
+  type: FieldType
+  required?: boolean
+  readOnly?: boolean
+  enum?: { value: string; label: string }[]
+  validation?: Record<string, any>
+}
+export interface ResourceSpec {
+  name: string
+  path: string
+  label: { singular: string; plural: string }
+  group?: string
+  titleField?: string | string[]
+  subtitleField?: string | string[]
+  capabilities: CapabilitySpec[]
+  search?: { fields: string[]; operator?: string }
+  fields: FieldSpec[]
+}
+export interface Manifest {
+  version: 2
+  generatedAt: string
+  i18n: { defaultLocale: string; locales: string[] }
+  auth: { mode: 'cookie' | 'bearer'; endpoints: { login: string; refresh: string; logout: string; [k: string]: string } }
+  tenancy: { mode: 'single' | 'multi'; switchable?: boolean; header?: string; listEndpoint?: string }
+  groups: { name: string; label: string }[]
+  enums: Record<string, { value: string; label: string }[]>
+  resources: ResourceSpec[]
+  capabilities?: CapabilitySpec[]
+}
+
+// Sensitive fields: never exposed vs write-only (form only, never read/list).
+const SENSITIVE_ALWAYS = ['token', 'externalId', 'mfaSecret', 'refreshToken', 'resetPasswordToken', 'confirmationToken']
+const SENSITIVE_WRITE_ONLY = ['password']
+
+export interface BuildOptions {
+  authMode?: 'cookie' | 'bearer'
+  tenancy?: Manifest['tenancy']
+  i18n?: Manifest['i18n']
+  authEndpoints?: Manifest['auth']['endpoints']
+  generatedAt?: string
+  sensitiveAlways?: string[]
+  sensitiveWriteOnly?: string[]
+}
+
+function segments(p: string): string[] {
+  return (p || '').split('/').filter(Boolean)
+}
+
+function rolesOf(route: ConfiguredRoute): string[] {
+  const rs = (route.roles || []) as any[]
+  return [...new Set(rs.map((r) => (r && typeof r === 'object' ? r.code : String(r))).filter(Boolean))]
+}
+
+/** Resolve a (possibly $ref) schema against the registered schema map. */
+function deref(schema: any, schemas: Record<string, any>, depth = 0): any {
+  if (!schema || depth > 10) return schema || null
+  if (typeof schema === 'object' && schema.$ref) {
+    const id = String(schema.$ref).replace(/#.*$/, '')
+    const found =
+      schemas[id] || schemas[`${id}#`] || Object.values(schemas).find((s: any) => s && (s.$id === id || s.$id === `${id}#`))
+    return found ? deref(found, schemas, depth + 1) : null
+  }
+  // list responses: unwrap arrays to their item schema
+  if (schema.type === 'array' && schema.items) return deref(schema.items, schemas, depth + 1)
+  return schema
+}
+
+function mapType(ps: any): FieldType {
+  if (!ps) return 'string'
+  if (Array.isArray(ps.enum) && ps.enum.length) return 'enum'
+  switch (ps.type) {
+    case 'integer':
+      return 'integer'
+    case 'number':
+      return 'number'
+    case 'boolean':
+      return 'boolean'
+    case 'array':
+    case 'object':
+      return 'json'
+    case 'string':
+      switch (ps.format) {
+        case 'email':
+          return 'email'
+        case 'uri':
+        case 'url':
+          return 'url'
+        case 'uuid':
+          return 'uuid'
+        case 'date-time':
+          return 'datetime'
+        case 'date':
+          return 'date'
+        default:
+          return 'string'
+      }
+    default:
+      return 'string'
+  }
+}
+
+function validationOf(ps: any): Record<string, any> | undefined {
+  const v: Record<string, any> = {}
+  if (typeof ps.minimum === 'number') v.min = ps.minimum
+  if (typeof ps.maximum === 'number') v.max = ps.maximum
+  if (typeof ps.minLength === 'number') v.minLength = ps.minLength
+  if (typeof ps.maxLength === 'number') v.maxLength = ps.maxLength
+  if (typeof ps.pattern === 'string') v.pattern = ps.pattern
+  return Object.keys(v).length ? v : undefined
+}
+
+interface FieldAcc extends FieldSpec {
+  _read?: boolean
+  _write?: boolean
+}
+
+/** Map a CRUD verb (or null for a custom action) from method + relative path. */
+function crudKind(method: string, rest: string[]): CapabilityKind | null {
+  if (rest.length === 0) {
+    if (method === 'GET') return 'list'
+    if (method === 'POST') return 'create'
+    if (method === 'DELETE') return 'delete'
+    return null
+  }
+  if (rest.length === 1 && rest[0].startsWith(':')) {
+    if (method === 'GET') return 'read'
+    if (method === 'PUT' || method === 'PATCH') return 'update'
+    if (method === 'DELETE') return 'delete'
+    return null
+  }
+  return null
+}
+
+export function buildManifest(input: {
+  routes: ConfiguredRoute[]
+  schemas: Record<string, any>
+  options?: BuildOptions
+}): Manifest {
+  const { routes = [], schemas = {}, options = {} } = input
+  const sensitiveAlways = options.sensitiveAlways ?? SENSITIVE_ALWAYS
+  const sensitiveWriteOnly = options.sensitiveWriteOnly ?? SENSITIVE_WRITE_ONLY
+
+  // group routes by URL base segment
+  const bySegment = new Map<string, ConfiguredRoute[]>()
+  for (const r of routes) {
+    const segs = segments(r.path)
+    if (!segs.length) continue
+    const base = segs[0]
+    if (!bySegment.has(base)) bySegment.set(base, [])
+    bySegment.get(base)!.push(r)
+  }
+
+  const resources: ResourceSpec[] = []
+  const topCapabilities: CapabilitySpec[] = []
+  const groupNames = new Set<string>()
+
+  for (const [base, segRoutes] of bySegment) {
+    const hint: ResourceHints | undefined = segRoutes.find((r) => r.resource)?.resource
+    const name = hint?.name || base
+    const group = segRoutes.find((r) => r.group)?.group
+    if (group) groupNames.add(group)
+
+    // capabilities (CRUD deduped by kind + custom actions)
+    const crud = new Map<CapabilityKind, CapabilitySpec>()
+    const actions: CapabilitySpec[] = []
+    const usedNames = new Set<string>()
+    let hasItemDelete = false
+    let hasCollDelete = false
+    for (const r of segRoutes) {
+      const rest = segments(r.path).slice(1)
+      if (rest[rest.length - 1] === 'count') continue // internal pagination helper
+      const kind = crudKind(r.method, rest)
+      if (kind) {
+        if (kind === 'delete') {
+          if (rest.length === 0) hasCollDelete = true
+          else hasItemDelete = true
+        }
+        // prefer the item path (/:id) for the delete capability binding
+        if (!crud.has(kind) || (kind === 'delete' && rest.length === 1)) {
+          crud.set(kind, { name: kind, kind, method: r.method, path: r.path, roles: rolesOf(r) })
+        }
+      } else {
+        const lastNamed = [...rest].reverse().find((s) => !s.startsWith(':'))
+        let actName = lastNamed || r.method.toLowerCase()
+        while (usedNames.has(actName)) actName = `${actName}_${r.method.toLowerCase()}`
+        usedNames.add(actName)
+        actions.push({
+          name: actName,
+          kind: 'action',
+          method: r.method,
+          path: r.path,
+          roles: rolesOf(r),
+          label: `action.${name}.${actName}`,
+          target: rest.some((s) => s.startsWith(':')) ? ['row'] : ['collection']
+        })
+      }
+    }
+    const del = crud.get('delete')
+    if (del) {
+      const t: ('row' | 'bulk')[] = []
+      if (hasItemDelete) t.push('row')
+      if (hasCollDelete) t.push('bulk')
+      if (t.length) del.target = t
+    }
+    const caps: CapabilitySpec[] = [...crud.values(), ...actions]
+
+    const isResource = crud.size > 0
+    if (!isResource) {
+      topCapabilities.push(...caps)
+      continue
+    }
+
+    // fields — collapse body (writable) + response (readable) onto (resource, field)
+    const fields = collectFields(segRoutes, schemas, sensitiveAlways, sensitiveWriteOnly)
+
+    const resource: ResourceSpec = {
+      name,
+      path: base,
+      label: { singular: `res.${name}.singular`, plural: `res.${name}.plural` },
+      capabilities: caps,
+      fields
+    }
+    if (group) resource.group = group
+    if (hint?.titleField) resource.titleField = hint.titleField
+    if (hint?.subtitleField) resource.subtitleField = hint.subtitleField
+    if (hint?.globalSearch?.length) resource.search = { fields: hint.globalSearch, operator: 'containsi' }
+    resources.push(resource)
+  }
+
+  const manifest: Manifest = {
+    version: 2,
+    generatedAt: options.generatedAt || '1970-01-01T00:00:00.000Z',
+    i18n: options.i18n || { defaultLocale: 'en', locales: ['en'] },
+    auth: {
+      mode: options.authMode || 'bearer',
+      endpoints: options.authEndpoints || { login: '/auth/login', refresh: '/auth/refresh-token', logout: '/auth/logout' }
+    },
+    tenancy: options.tenancy || { mode: 'single' },
+    groups: [...groupNames].map((n) => ({ name: n, label: `group.${n}` })),
+    enums: {},
+    resources
+  }
+  if (topCapabilities.length) manifest.capabilities = topCapabilities
+  return manifest
+}
+
+function collectFields(
+  segRoutes: ConfiguredRoute[],
+  schemas: Record<string, any>,
+  sensitiveAlways: string[],
+  sensitiveWriteOnly: string[]
+): FieldSpec[] {
+  const byName = new Map<string, FieldAcc>()
+
+  const addSide = (schema: any, side: 'read' | 'write') => {
+    const s = deref(schema, schemas)
+    const props = s?.properties
+    if (!props) return
+    const required: string[] = Array.isArray(s.required) ? s.required : []
+    for (const [fname, ps] of Object.entries<any>(props)) {
+      if (sensitiveAlways.includes(fname)) continue
+      if (side === 'read' && sensitiveWriteOnly.includes(fname)) continue // never readable
+      let f = byName.get(fname)
+      if (!f) {
+        f = { name: fname, type: mapType(ps) }
+        byName.set(fname, f)
+      }
+      // a typed side wins over a bare 'string' fallback; merge validation/enum from either side
+      if (f.type === 'string' && mapType(ps) !== 'string') f.type = mapType(ps)
+      if (!f.validation) {
+        const val = validationOf(ps)
+        if (val) f.validation = val
+      }
+      if (!f.enum && Array.isArray(ps.enum) && ps.enum.length) {
+        f.enum = ps.enum.map((v: any) => ({ value: String(v), label: `enum.${fname}.${v}` }))
+      }
+      if (required.includes(fname)) f.required = true
+      if (side === 'read') f._read = true
+      if (side === 'write') f._write = true
+    }
+  }
+
+  for (const r of segRoutes) {
+    const rest = segments(r.path).slice(1)
+    const kind = crudKind(r.method, rest)
+    if (kind === 'create' || kind === 'update') addSide(r.doc?.body, 'write')
+    if (kind === 'read' || kind === 'list') {
+      const resp = r.doc?.response
+      const schema = resp && typeof resp === 'object' && !resp.type && !resp.$ref ? resp['200'] || resp[200] || Object.values(resp)[0] : resp
+      addSide(schema, 'read')
+    }
+  }
+
+  const out: FieldSpec[] = []
+  for (const f of byName.values()) {
+    const { _read, _write, ...rest } = f
+    if (_read && !_write) rest.readOnly = true
+    out.push(rest)
+  }
+  return out
+}
+
+/** Build the manifest from the live server (`global.routes` + registered schemas). */
+export function generateManifest(server: any, options: BuildOptions = {}): Manifest {
+  const routes: ConfiguredRoute[] = ((global as any).routes as ConfiguredRoute[]) || []
+  const schemas: Record<string, any> = typeof server?.getSchemas === 'function' ? server.getSchemas() : {}
+  const authMode: 'cookie' | 'bearer' = process.env.AUTH_MODE === 'COOKIE' ? 'cookie' : 'bearer'
+  const mt = (global as any).config?.options?.multi_tenant
+  const tenancy: Manifest['tenancy'] = mt?.enabled
+    ? { mode: 'multi', switchable: true, header: mt.header_key || 'x-tenant-id', listEndpoint: '/tenants' }
+    : { mode: 'single' }
+  return buildManifest({
+    routes,
+    schemas,
+    options: { authMode, tenancy, generatedAt: new Date().toISOString(), ...options }
+  })
+}

package/lib/middleware/isAdmin.ts

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import { FastifyReply, FastifyRequest } from 'fastify'
+import { httpError } from '../util/httpError.js'
 
 export function preHandler(req: FastifyRequest, res: FastifyReply, done: any) {
   try {
@@ -10,6 +11,7 @@ export function preHandler(req: FastifyRequest, res: FastifyReply, done: any) {
     throw new Error('User without this privilege')
   } catch (err) {
     if (log.e) log.error(`Upps, something just happened ${err}`)
-    res.code(403).send(new Error('User without this privilege'))
+    // Structured body so the 403 status is preserved (see isAuthenticated note).
+    res.code(403).send(httpError(403, 'User without this privilege', 'FORBIDDEN'))
   }
 }

package/lib/middleware/isAuthenticated.ts

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import { FastifyReply, FastifyRequest } from 'fastify'
+import { httpError } from '../util/httpError.js'
 
 export function preHandler(req: FastifyRequest, res: FastifyReply, done: any) {
   try {
@@ -10,6 +11,8 @@ export function preHandler(req: FastifyRequest, res: FastifyReply, done: any) {
     throw new Error('Unauthorized')
   } catch (err) {
     if (log.e) log.error(`Upps, something just happened ${err}`)
-    return res.code(401).send(new Error('Unauthorized')) // must be authorized first
+    // Send a structured body (not a raw Error): `reply.code(x).send(new Error())`
+    // loses the status in Fastify's async error path and collapses to 500/403.
+    return res.code(401).send(httpError(401, 'Unauthorized', 'UNAUTHORIZED')) // must be authorized first
   }
 }

package/lib/schemas/user.ts

@@ -2,8 +2,15 @@ export const currentUserBodySchema = {
   $id: 'currentUserBodySchema',
   type: 'object',
   nullable: true,
+  // Self-service profile edit only. `additionalProperties: false` rejects any other
+  // field (roles, blocked, confirmed, password, externalId, mfa*) so a user cannot
+  // mass-assign their way to privilege escalation. The controller also whitelists
+  // these same fields as the real security boundary (defense in depth).
+  additionalProperties: false,
   properties: {
-    username: { type: 'string' }
+    username: { type: 'string' },
+    firstName: { type: 'string' },
+    lastName: { type: 'string' }
   }
 }
 
@@ -11,9 +18,18 @@ export const userBodySchema = {
   $id: 'userBodySchema',
   type: 'object',
   nullable: true,
+  // Admin create/update surface. `additionalProperties: false` drops anything not
+  // listed (e.g. externalId, mfaSecret, passwordChangedAt). `password` is allowed
+  // for CREATE (createUser hashes it); on UPDATE it is dropped in updateUserById so
+  // it can never be stored in plaintext — credential changes go through the
+  // dedicated hashed flows (change-password / reset-password).
+  additionalProperties: false,
   properties: {
     username: { type: 'string' },
     email: { type: 'string' },
+    password: { type: 'string' },
+    firstName: { type: 'string' },
+    lastName: { type: 'string' },
     blocked: { type: 'boolean' },
     blockedReason: { type: 'string' },
     blockedAt: { type: 'string' },

package/lib/util/errors.ts

@@ -12,8 +12,10 @@ export class TranslatedError extends Error {
     this.locale = locale
     this.status = status
     this.translationCode = translationCode
-    this.translatedMessage = global.t.__({ phrase: translationCode || defaultMessage, locale: locale || 'en' }, data)
-    this.message = this.translatedMessage || defaultMessage || 'generic error'
+    const phrase = translationCode || defaultMessage
+    this.translatedMessage = phrase ? global.t.__({ phrase, locale: locale || 'en' }, data) : null
+    // fallback: tradotto -> code grezzo -> defaultMessage -> catch-all
+    this.message = this.translatedMessage || translationCode || defaultMessage || 'generic error'
     this.data = data
 
     Error.captureStackTrace(this, this.constructor || TranslatedError)

package/lib/util/httpError.ts

@@ -0,0 +1,37 @@
+// Standard error response body for the whole framework.
+//
+//   { statusCode, error, code?, message? }
+//
+//   statusCode : HTTP status
+//   error      : HTTP reason phrase ('Bad Request', 'Unauthorized', ...)
+//   code       : optional machine-readable code ('TENANT_MISMATCH', 'MFA_REQUIRED', ...)
+//   message    : optional human-readable message
+//
+// Use this instead of `reply.send(new Error(...))`, which loses the status in
+// Fastify's async error path (collapses to 500/403).
+const REASON: Record<number, string> = {
+  400: 'Bad Request',
+  401: 'Unauthorized',
+  403: 'Forbidden',
+  404: 'Not Found',
+  409: 'Conflict',
+  422: 'Unprocessable Entity',
+  429: 'Too Many Requests',
+  500: 'Internal Server Error'
+}
+
+export interface HttpErrorBody {
+  statusCode: number
+  error: string
+  code?: string
+  message?: string
+}
+
+export function httpError(statusCode: number, message?: string, code?: string): HttpErrorBody {
+  return {
+    statusCode,
+    error: REASON[statusCode] || 'Error',
+    ...(code ? { code } : {}),
+    ...(message ? { message } : {})
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volcanicminds/backend",
-  "version": "3.0.1",
+  "version": "3.2.0",
   "type": "module",
   "codename": "rome",
   "license": "MIT",
@@ -59,8 +59,18 @@
     "start": "tsx --env-file .env server.ts",
     "dev": "tsx watch --env-file .env server.ts",
     "test": "npm run test:core && npm run test:typeorm",
-    "test:core": "cross-env PORT=2231 NODE_ENV=memory BROWSER=false mocha --import=tsx ./test/index.spec.ts -t 100000 --exit",
+    "test:core": "cross-env AUTH_RATELIMIT_MAX=100000 PORT=2231 NODE_ENV=memory BROWSER=false JWT_SECRET=tEst0nly_k7Qx2mNp9vLrT4wYbE6sH1jD8fG3aZ5c JWT_REFRESH_SECRET=tEst0nly_R3frsh9vLrT4wYbE6sH1jD8fG3aZ5cK7 mocha --import=tsx ./test/index.spec.ts -t 100000 --exit",
     "test:typeorm": "cross-env NODE_ENV=memory MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/typeorm/**/*.spec.ts -t 20000 --exit",
+    "test:pglite": "cross-env NODE_ENV=memory MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/pglite/**/*.spec.ts -t 60000 --exit",
+    "test:perf": "cross-env PORT=2233 NODE_ENV=memory LOG_LEVEL=error LOG_FASTIFY=false MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/perf/**/*.spec.ts -t 120000 --exit",
+    "test:e2e:pglite": "cross-env AUTH_RATELIMIT_MAX=100000 PORT=2234 NODE_ENV=memory LOG_LEVEL=silent JWT_SECRET=e2e-test-secret-please-change-32-chars MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/e2e/**/*.e2e.spec.ts -t 60000 --exit",
+    "test:e2e:mt:pglite": "cross-env AUTH_RATELIMIT_MAX=100000 PORT=2235 NODE_ENV=memory LOG_LEVEL=silent JWT_SECRET=e2e-test-secret-please-change-32-chars MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/e2e-mt/**/*.e2e.spec.ts -t 60000 --exit",
+    "test:e2e:cookie:pglite": "cross-env AUTH_RATELIMIT_MAX=100000 PORT=2236 NODE_ENV=memory LOG_LEVEL=silent AUTH_MODE=COOKIE COOKIE_SECRET=e2e-cookie-secret-please-change-32xyz JWT_SECRET=e2e-test-secret-please-change-32-chars MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/e2e-cookie/**/*.e2e.spec.ts -t 60000 --exit",
+    "test:e2e:norefresh:pglite": "cross-env AUTH_RATELIMIT_MAX=100000 PORT=2237 NODE_ENV=memory LOG_LEVEL=silent JWT_REFRESH=false JWT_SECRET=e2e-test-secret-please-change-32-chars MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/e2e-norefresh/**/*.e2e.spec.ts -t 60000 --exit",
+    "test:e2e:mfa:pglite": "cross-env AUTH_RATELIMIT_MAX=100000 PORT=2238 NODE_ENV=memory LOG_LEVEL=silent JWT_SECRET=e2e-test-secret-please-change-32-chars MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/e2e-mfa/**/*.e2e.spec.ts -t 60000 --exit",
+    "test:e2e:ratelimit:pglite": "cross-env AUTH_RATELIMIT_MAX=3 AUTH_RATELIMIT_WINDOW=60000 PORT=2239 NODE_ENV=memory LOG_LEVEL=silent JWT_SECRET=e2e-test-secret-please-change-32-chars MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/e2e-ratelimit/**/*.e2e.spec.ts -t 60000 --exit",
+    "test:e2e:fixture:pglite": "cross-env AUTH_RATELIMIT_MAX=100000 PORT=2240 NODE_ENV=memory LOG_LEVEL=silent JWT_SECRET=e2e-test-secret-please-change-32-chars MFA_DB_SECRET=unit-test-secret-please-change-32xyz mocha --import=tsx ./test/e2e-fixture/**/*.e2e.spec.ts -t 60000 --exit",
+    "test:lib": "cross-env NODE_ENV=memory mocha --import=tsx ./test/lib/**/*.spec.ts -t 20000 --exit",
     "test:full": "npm run test:core",
     "reset": "npm install && npm update && npm run build",
     "upgrade-deps": "npx npm-check-updates -u",
@@ -98,16 +108,28 @@
     "toad-scheduler": "^3.1.0"
   },
   "peerDependencies": {
+    "@electric-sql/pglite": "0.5.3",
+    "@electric-sql/pglite-pgvector": "^0.0.4",
     "bcrypt": "^6.0.0",
     "pg": "^8.13.0",
     "pluralize": "^8.0.0",
     "reflect-metadata": "^0.2.2",
-    "typeorm": "^0.3.28"
+    "typeorm": "^0.3.28",
+    "typeorm-pglite": "^0.3.4"
   },
   "peerDependenciesMeta": {
     "typeorm": {
       "optional": true
     },
+    "typeorm-pglite": {
+      "optional": true
+    },
+    "@electric-sql/pglite": {
+      "optional": true
+    },
+    "@electric-sql/pglite-pgvector": {
+      "optional": true
+    },
     "bcrypt": {
       "optional": true
     },
@@ -122,6 +144,8 @@
     }
   },
   "devDependencies": {
+    "@electric-sql/pglite": "0.5.3",
+    "@electric-sql/pglite-pgvector": "^0.0.4",
     "@eslint/js": "^9.39.2",
     "@types/bcrypt": "^6.0.0",
     "@types/mocha": "^10.0.10",
@@ -129,6 +153,7 @@
     "@types/pg": "^8.11.10",
     "@types/pluralize": "^0.0.33",
     "@types/semver": "^7.7.1",
+    "autocannon": "^8.0.0",
     "bcrypt": "^6.0.0",
     "cross-env": "^10.1.0",
     "dependency-cruiser": "^18.0.0",
@@ -136,13 +161,13 @@
     "expect": "^30.2.0",
     "globals": "^16.5.0",
     "mocha": "^8.1.3",
-    "npm-upgrade": "^0.3.0",
     "pg": "^8.13.0",
     "pluralize": "^8.0.0",
     "reflect-metadata": "^0.2.2",
     "ts-node": "^10.9.2",
     "tsx": "^4.21.0",
     "typeorm": "^0.3.28",
+    "typeorm-pglite": "^0.3.4",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.50.0"
   },