migrane 1.0.0

package/dist/seeds.js

@@ -0,0 +1,132 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { DEFAULTS } from './defaults.js';
+import { checksumOf, filesIn, indexIn } from './discover.js';
+import { consoleReporter } from './runner.js';
+import { refuse } from './safety.js';
+import { quoteIdent, sqlOver } from './sql.js';
+const ensure = async (db, table) => {
+    await db.query(`
+    CREATE TABLE IF NOT EXISTS ${quoteIdent(table)} (
+      name      TEXT PRIMARY KEY,
+      checksum  TEXT NOT NULL DEFAULT '',
+      run_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+  `);
+};
+/**
+ * Every directory under the seeds root holding something runnable — the seed
+ * half of `discover()`, and the only part of this file that touches a disk.
+ *
+ * A unit composes exactly like a directory migration, `index.ts` rule included.
+ * `discover()` cannot find it because that enforces a `<number>-<slug>` name,
+ * and a unit has no number: you pick it by name, so `sequence` is `0` for all
+ * of them. A directory holding nothing runnable is skipped, as `discover` does.
+ */
+export const unitsIn = (dir) => existsSync(dir)
+    ? readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .flatMap((entry) => {
+        const path = join(dir, entry.name);
+        const files = filesIn(path, true);
+        if (!files.length)
+            return [];
+        const index = indexIn(path, files);
+        return [
+            {
+                name: entry.name,
+                sequence: 0,
+                path,
+                run: index ? [index] : files,
+                files,
+                checksum: checksumOf(files),
+            },
+        ];
+    })
+        .sort((a, b) => a.name.localeCompare(b.name))
+    : [];
+/**
+ * A seed plan from a config and units already loaded — `planFrom`'s twin, and
+ * defaulting its table from the same constant for the same reason.
+ */
+export const seedPlanFrom = (config, units) => ({
+    units,
+    table: config.seedTable ?? DEFAULTS.seedTable,
+    guard: config.guard,
+});
+/**
+ * Picking the named unit out of the plan.
+ *
+ * The message says *does not exist* rather than naming a directory, because by
+ * here there is no directory to name — only the units this plan was handed.
+ */
+const chosen = (plan, unit) => {
+    const found = plan.units.find(({ name }) => name === unit);
+    if (!found)
+        throw new Error(`seed unit "${unit}" does not exist.`);
+    return found;
+};
+export const seed = async (driver, plan, unit, reporter = consoleReporter) => {
+    // Guarded like `reset`, and for the same reason rather than a lesser one: a
+    // unit is allowed to truncate before it inserts, so "it only adds rows" is
+    // not something the runner can promise about somebody's fixtures.
+    await (plan.guard ?? refuse)(driver, 'seed writes fixtures');
+    const loaded = chosen(plan, unit);
+    await driver.session(async (session) => {
+        await ensure(session, plan.table);
+        await session.transaction(async (tx) => {
+            await loaded.module.up({ sql: sqlOver(tx), db: tx });
+            // Upserted, not inserted: seeding the same unit twice is expected, and
+            // should move the timestamp rather than fail on the primary key.
+            await tx.query(`INSERT INTO ${quoteIdent(plan.table)} (name, checksum) VALUES ($1, $2)
+           ON CONFLICT (name) DO UPDATE
+              SET checksum = excluded.checksum, run_at = now()`, [unit, loaded.checksum]);
+        });
+    });
+    reporter.line(`seeded ${unit}`);
+};
+export const unseed = async (driver, plan, unit, reporter = consoleReporter) => {
+    await (plan.guard ?? refuse)(driver, 'unseed deletes rows a fixture set made');
+    const loaded = chosen(plan, unit);
+    const revert = loaded.module.down;
+    if (!revert)
+        throw new Error(`seed unit "${unit}" has no "down".`);
+    await driver.session(async (session) => {
+        await ensure(session, plan.table);
+        await session.transaction(async (tx) => {
+            await revert({ sql: sqlOver(tx), db: tx });
+            await tx.query(`DELETE FROM ${quoteIdent(plan.table)} WHERE name = $1`, [
+                unit,
+            ]);
+        });
+    });
+    reporter.line(`unseeded ${unit}`);
+};
+/**
+ * What this database was seeded with, and whether that unit still matches disk.
+ *
+ * Read from the database rather than inferred from a checkout, which is the
+ * point: the plan tells you which units exist, only the row tells you which one
+ * you are looking at. A unit the plan no longer carries still reports — it is
+ * how a database seeded from a deleted branch explains itself, and how an image
+ * explains fixtures that were dropped from a later build.
+ */
+export const seedStatus = async (driver, plan, reporter = consoleReporter) => {
+    await ensure(driver, plan.table);
+    const rows = await driver.query(`SELECT name, checksum, run_at FROM ${quoteIdent(plan.table)} ORDER BY run_at DESC`);
+    const present = new Map(plan.units.map(({ name, checksum }) => [name, checksum]));
+    for (const row of rows) {
+        const held = present.get(row.name);
+        const state = held === undefined
+            ? 'unit is gone'
+            : held === row.checksum
+                ? 'current'
+                : 'changed since';
+        const on = new Date(row.run_at)
+            .toISOString()
+            .slice(0, 16)
+            .replace('T', ' ');
+        reporter.line(`  seeded   ${row.name}  ${on}  (${state})`);
+    }
+    return rows;
+};

package/dist/sql.d.ts

@@ -0,0 +1,43 @@
+import type { Fragment, Queryable, Sql } from './types.js';
+/**
+ * Splice text into a statement verbatim.
+ *
+ * DDL is mostly things that cannot be bind parameters — table names, types,
+ * defaults, whole constraint bodies — so this has to exist. Making it a
+ * function call rather than the default behaviour means every unescaped
+ * interpolation is visible in a diff.
+ */
+export declare const raw: (text: string) => Fragment;
+/**
+ * Quote an identifier as a plain string.
+ *
+ * Separate from {@link id} because the package builds statements of its own —
+ * the bookkeeping table — where a `Fragment` would have to be unwrapped again
+ * to reach the text.
+ */
+export declare const quoteIdent: (name: string) => string;
+/** Quote an identifier. `id('user table')` is `"user table"`. */
+export declare const id: (name: string) => Fragment;
+/** Join fragments — a column list, a set of constraints. */
+export declare const join: (parts: readonly Fragment[], separator?: string) => Fragment;
+export interface Statement {
+    text: string;
+    params: unknown[];
+}
+/**
+ * Turns a template into a statement and its bind parameters.
+ *
+ * Anything that is not a {@link Fragment} becomes a `$n` placeholder, so the
+ * ordinary way to interpolate a value is also the safe one and injecting SQL
+ * takes a deliberate `sql.raw`.
+ */
+export declare const build: (strings: TemplateStringsArray, values: readonly unknown[]) => Statement;
+/**
+ * The tagged template bound to one connection.
+ *
+ * A template with no interpolated values sends no bind parameters, which is
+ * what lets a migration write several statements in one template: PostgreSQL
+ * only restricts a request to a single statement once the extended protocol is
+ * in play, and that starts at the first parameter.
+ */
+export declare const sqlOver: (db: Queryable) => Sql;

package/dist/sql.js

@@ -0,0 +1,66 @@
+/**
+ * The runtime half of {@link Fragment}'s brand.
+ *
+ * `types.ts` declares the property with a `unique symbol` that has no value, so
+ * the brand costs nothing at run time and cannot be forged by writing an object
+ * literal. This is the only place that gap is bridged.
+ */
+const MARK = Symbol('migrane.fragment');
+const isFragment = (value) => typeof value === 'object' && value !== null && MARK in value;
+/**
+ * Splice text into a statement verbatim.
+ *
+ * DDL is mostly things that cannot be bind parameters — table names, types,
+ * defaults, whole constraint bodies — so this has to exist. Making it a
+ * function call rather than the default behaviour means every unescaped
+ * interpolation is visible in a diff.
+ */
+export const raw = (text) => ({ [MARK]: text });
+/**
+ * Quote an identifier as a plain string.
+ *
+ * Separate from {@link id} because the package builds statements of its own —
+ * the bookkeeping table — where a `Fragment` would have to be unwrapped again
+ * to reach the text.
+ */
+export const quoteIdent = (name) => `"${name.replaceAll('"', '""')}"`;
+/** Quote an identifier. `id('user table')` is `"user table"`. */
+export const id = (name) => raw(quoteIdent(name));
+/** Join fragments — a column list, a set of constraints. */
+export const join = (parts, separator = ', ') => raw(parts.map((part) => part[MARK]).join(separator));
+/**
+ * Turns a template into a statement and its bind parameters.
+ *
+ * Anything that is not a {@link Fragment} becomes a `$n` placeholder, so the
+ * ordinary way to interpolate a value is also the safe one and injecting SQL
+ * takes a deliberate `sql.raw`.
+ */
+export const build = (strings, values) => {
+    let text = strings[0] ?? '';
+    const params = [];
+    for (const [index, value] of values.entries()) {
+        if (isFragment(value))
+            text += value[MARK];
+        else {
+            params.push(value);
+            text += `$${params.length}`;
+        }
+        text += strings[index + 1] ?? '';
+    }
+    return { text, params };
+};
+/**
+ * The tagged template bound to one connection.
+ *
+ * A template with no interpolated values sends no bind parameters, which is
+ * what lets a migration write several statements in one template: PostgreSQL
+ * only restricts a request to a single statement once the extended protocol is
+ * in play, and that starts at the first parameter.
+ */
+export const sqlOver = (db) => {
+    const tag = (strings, ...values) => {
+        const { text, params } = build(strings, values);
+        return db.query(text, params.length ? params : undefined);
+    };
+    return Object.assign(tag, { raw, id, join });
+};

package/dist/storage.d.ts

@@ -0,0 +1,52 @@
+import type { Queryable, Row } from './types.js';
+/**
+ * The bookkeeping table, and the two questions it answers: what has run, and
+ * whether what ran is still what is on disk.
+ */
+export interface Applied extends Row {
+    name: string;
+    checksum: string;
+    run_at: string;
+}
+/**
+ * A migration was edited after it was applied.
+ *
+ * A class rather than a plain `Error` so a caller that *knows* its database is
+ * disposable — a test lane, a scratch container — can recover from exactly this
+ * and nothing else. Matching on the message would catch the next error whose
+ * wording happened to look similar, which is how a recovery path ends up
+ * dropping a schema it was never meant to touch.
+ */
+export declare class ChangedError extends Error {
+    readonly migration: string;
+    constructor(migration: string);
+}
+/**
+ * Written on first contact rather than by a setup command, so a database that
+ * has never been migrated needs no preparation — `status` against an empty one
+ * answers "everything is pending" instead of failing on a missing table.
+ */
+export declare const ensure: (db: Queryable, table: string) => Promise<void>;
+export declare const applied: (db: Queryable, table: string) => Promise<Applied[]>;
+/**
+ * Refuses a migration that changed after it was applied.
+ *
+ * A migration already run is a fact about the database, and editing one makes
+ * the file stop describing what the database actually holds — silently, and
+ * only on the machines that already ran it. So it is caught before anything
+ * else runs.
+ *
+ * A name recorded but absent from disk is *not* an error: deleting or renaming
+ * migrations is what squashing them into one looks like, and refusing that
+ * would make a legitimate operation impossible.
+ */
+export declare const verify: (rows: readonly Applied[], migrations: readonly {
+    name: string;
+    checksum: string;
+}[]) => void;
+export declare const record: (db: Queryable, table: string, entry: {
+    name: string;
+    checksum: string;
+    duration: number;
+}) => Promise<void>;
+export declare const forget: (db: Queryable, table: string, name: string) => Promise<void>;

package/dist/storage.js

@@ -0,0 +1,65 @@
+import { quoteIdent } from './sql.js';
+/**
+ * A migration was edited after it was applied.
+ *
+ * A class rather than a plain `Error` so a caller that *knows* its database is
+ * disposable — a test lane, a scratch container — can recover from exactly this
+ * and nothing else. Matching on the message would catch the next error whose
+ * wording happened to look similar, which is how a recovery path ends up
+ * dropping a schema it was never meant to touch.
+ */
+export class ChangedError extends Error {
+    migration;
+    constructor(migration) {
+        super(`"${migration}" changed after it was applied.\n` +
+            `  Reset the database if it is disposable, or add a new migration if it is not.`);
+        this.migration = migration;
+        this.name = 'ChangedError';
+    }
+}
+/**
+ * Written on first contact rather than by a setup command, so a database that
+ * has never been migrated needs no preparation — `status` against an empty one
+ * answers "everything is pending" instead of failing on a missing table.
+ */
+export const ensure = async (db, table) => {
+    await db.query(`
+    CREATE TABLE IF NOT EXISTS ${quoteIdent(table)} (
+      name         TEXT PRIMARY KEY,
+      checksum     TEXT NOT NULL DEFAULT '',
+      run_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+      duration_ms  INTEGER
+    )
+  `);
+};
+export const applied = async (db, table) => {
+    await ensure(db, table);
+    return db.query(`SELECT name, checksum, run_at FROM ${quoteIdent(table)} ORDER BY run_at, name`);
+};
+/**
+ * Refuses a migration that changed after it was applied.
+ *
+ * A migration already run is a fact about the database, and editing one makes
+ * the file stop describing what the database actually holds — silently, and
+ * only on the machines that already ran it. So it is caught before anything
+ * else runs.
+ *
+ * A name recorded but absent from disk is *not* an error: deleting or renaming
+ * migrations is what squashing them into one looks like, and refusing that
+ * would make a legitimate operation impossible.
+ */
+export const verify = (rows, migrations) => {
+    const disk = new Map(migrations.map(({ name, checksum }) => [name, checksum]));
+    for (const row of rows) {
+        const current = disk.get(row.name);
+        if (current === undefined || current === row.checksum)
+            continue;
+        throw new ChangedError(row.name);
+    }
+};
+export const record = async (db, table, entry) => {
+    await db.query(`INSERT INTO ${quoteIdent(table)} (name, checksum, duration_ms) VALUES ($1, $2, $3)`, [entry.name, entry.checksum, entry.duration]);
+};
+export const forget = async (db, table, name) => {
+    await db.query(`DELETE FROM ${quoteIdent(table)} WHERE name = $1`, [name]);
+};

package/dist/types.d.ts

@@ -0,0 +1,198 @@
+/**
+ * The vocabulary everything downstream is written against. Nothing here names a
+ * database, an ORM or an application: a consumer supplies a {@link Driver} and
+ * the runner never learns what it is talking to.
+ */
+/** A result row. */
+export type Row = Record<string, unknown>;
+/**
+ * Anything a statement can be sent to — a pool, a pinned connection, or a
+ * connection inside a transaction. A migration body cannot tell them apart.
+ *
+ * Omitting `values` is meaningful: with no bind parameters PostgreSQL uses the
+ * simple query protocol, which is what lets one template carry several
+ * statements separated by `;`. Pass a parameter and exactly one is legal.
+ */
+export interface Queryable {
+    query<R extends Row = Row>(text: string, values?: readonly unknown[]): Promise<R[]>;
+}
+/**
+ * One pinned connection.
+ *
+ * Separate from {@link Driver} because a transaction and a session-level lock
+ * are only meaningful on a connection that stays the same between statements,
+ * and a pool hands out whichever is free.
+ */
+export interface Session extends Queryable {
+    transaction<T>(run: (tx: Queryable) => Promise<T>): Promise<T>;
+    /**
+     * Hold an exclusive lock named by `key` for the length of `run`, releasing it
+     * however `run` ends.
+     *
+     * Must **block** rather than fail when the lock is held: whoever holds it is
+     * applying the migrations this process wants applied, so waiting is correct
+     * and failing fast turns a wait into a red deploy.
+     */
+    lock<T>(key: number, run: () => Promise<T>): Promise<T>;
+}
+/**
+ * How the runner reaches a database. Implement these and everything else in
+ * this package works — `drivers/pg.ts` is the reference, at under a hundred
+ * lines.
+ */
+export interface Driver extends Queryable {
+    /**
+     * The machine these coordinates reach: a hostname, an address, or `''` for a
+     * unix socket.
+     *
+     * Required rather than optional, because it is what the destructive commands
+     * refuse on. A driver that could omit it would silently opt out of that
+     * refusal. State it even when it is `'localhost'`.
+     */
+    readonly host: string;
+    /** Pin one connection for the length of `run`. */
+    session<T>(run: (session: Session) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+/**
+ * SQL spliced verbatim rather than bound as a parameter.
+ *
+ * A branded object rather than a string, so reaching for the escape is visible
+ * in a diff instead of being what happens by default.
+ */
+declare const FRAGMENT: unique symbol;
+export interface Fragment {
+    readonly [FRAGMENT]: string;
+}
+/**
+ * The tagged template a migration writes against. Interpolations become bind
+ * parameters unless they are {@link Fragment}s, so the ordinary way to write a
+ * value is also the safe one.
+ */
+export interface Sql {
+    <R extends Row = Row>(strings: TemplateStringsArray, ...values: readonly unknown[]): Promise<R[]>;
+    /** Splice text in unescaped, for DDL the template cannot express. */
+    raw: (text: string) => Fragment;
+    /** Quote an identifier — `sql.id('user table')` is `"user table"`. */
+    id: (name: string) => Fragment;
+    /** Join fragments — a column list, a set of constraints. */
+    join: (parts: readonly Fragment[], separator?: string) => Fragment;
+}
+/** What every migration and seed part receives. */
+export interface Context {
+    sql: Sql;
+    /** The connection underneath, for what the template cannot say. */
+    db: Queryable;
+}
+/**
+ * What a migration file exports.
+ *
+ * `down` is optional: many migrations have no honest reverse, and requiring one
+ * only ever produces an empty body that lies about being reversible.
+ */
+export interface Part {
+    up: (context: Context) => Promise<void>;
+    down?: (context: Context) => Promise<void>;
+}
+/**
+ * Export `transaction = false` to opt out of the wrapping transaction, for
+ * statements PostgreSQL refuses to run inside one such as
+ * `CREATE INDEX CONCURRENTLY`.
+ *
+ * The cost is stated where it is taken: an untransacted migration that fails
+ * half way leaves the schema changed and its row unwritten.
+ */
+export interface Transacted {
+    transaction?: boolean;
+}
+/** A migration file's module, once loaded. */
+export type Module = Part & Transacted;
+/** One migration, found on disk but not yet loaded. */
+export interface Discovered {
+    /** The storage key — the file or directory name, without extension. */
+    name: string;
+    /** The leading number, which orders it. */
+    sequence: number;
+    /** Absolute path of the file, or of the directory. */
+    path: string;
+    /**
+     * What actually runs, in order: one entry for a file or a directory with an
+     * `index.ts`, every part in path order for a directory without one.
+     */
+    run: readonly string[];
+    /**
+     * Every file the migration is made of, including parts reached only through
+     * an `index.ts` — the checksum has to cover what it *executes*, not what
+     * discovery happened to open.
+     */
+    files: readonly string[];
+    /** Hash of all of {@link files}, so editing an applied migration is refused. */
+    checksum: string;
+}
+/**
+ * A migration, loaded and ready to run. Carries no paths: the same runner
+ * applies it from a laptop and from an image where the files no longer exist.
+ */
+export interface Migration extends Omit<Discovered, 'files' | 'path' | 'run'> {
+    module: Module;
+}
+/** Run before any pending migration, in declaration order. */
+export type Hook = (context: Context) => Promise<void>;
+/**
+ * What every destructive command runs through before it touches anything.
+ *
+ * **Throws to refuse** — the same shape `refuse()` has, so a policy wanting the
+ * default plus one more rule can call it rather than reimplement it:
+ *
+ * ```ts
+ * guard: async (driver, what) => {
+ *   if (await isDisposable(driver)) return;
+ *
+ *   refuse(driver, what);
+ * },
+ * ```
+ *
+ * @param what what the command does, as a clause — `reset drops every table`.
+ */
+export type Policy = (driver: Driver, what: string) => void | Promise<void>;
+/** What a consumer's `database/config.ts` exports. */
+export interface Config {
+    /**
+     * Directories holding migrations, in order. Inside a root, a `.ts` or `.sql`
+     * file is one migration and so is a directory.
+     */
+    dirs: readonly string[];
+    /** How to reach the database. A factory, so `status` can skip opening one. */
+    driver: () => Driver | Promise<Driver>;
+    /** Where seed units live, one directory per unit. Omit for no seeds. */
+    seeds?: string;
+    /**
+     * Where `migrane manifest` writes. Omit it and the command says so rather
+     * than inventing a path — `entryFor` writes every specifier relative to this
+     * destination, so guessing where it goes would guess what is in it.
+     */
+    manifest?: string;
+    /** Bookkeeping table names. Default to `migrations` and `seeds`. */
+    table?: string;
+    seedTable?: string;
+    /** The schema `reset` drops and recreates. Defaults to `public`. */
+    schema?: string;
+    /**
+     * Who may run a destructive command against this database.
+     *
+     * Omit it and the built-in refusal applies. Declare one and it replaces both
+     * built-in rules, `NODE_ENV=production` included — which is how a deployed
+     * environment that can prove it is disposable rebuilds its own fixtures.
+     */
+    guard?: Policy;
+    /**
+     * Run once before pending migrations, and even when none are pending. Not
+     * before `status` or `reset`, neither of which has business writing DDL.
+     *
+     * The seam for anything you want true *before* a migration but do not want to
+     * write as one: a synced type, a search path, an extension. Also the only
+     * place the runner executes code it did not discover.
+     */
+    before?: readonly Hook[];
+}
+export {};

package/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * The vocabulary everything downstream is written against. Nothing here names a
+ * database, an ORM or an application: a consumer supplies a {@link Driver} and
+ * the runner never learns what it is talking to.
+ */
+export {};

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "migrane",
+  "version": "1.0.0",
+  "description": "A SQL migration runner that knows nothing about your application.",
+  "keywords": [
+    "sql",
+    "migration",
+    "migrations",
+    "migrate",
+    "postgres",
+    "postgresql",
+    "database",
+    "schema",
+    "seed"
+  ],
+  "author": {
+    "name": "eishexac",
+    "url": "https://existin.space",
+    "email": "hexac@existin.space"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/eishexac/migrane.git"
+  },
+  "homepage": "https://github.com/eishexac/migrane",
+  "bugs": "https://github.com/eishexac/migrane/issues",
+  "type": "module",
+  "sideEffects": false,
+  "bin": {
+    "migrane": "./bin/migrane.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./drivers/pg": {
+      "types": "./dist/drivers/pg.d.ts",
+      "default": "./dist/drivers/pg.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "pg": "^8.23.0"
+  },
+  "peerDependenciesMeta": {
+    "pg": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.18.5",
+    "@changesets/changelog-github": "^1.0.0",
+    "@changesets/cli": "^3.0.1",
+    "@eslint/js": "^10.0.1",
+    "@testcontainers/postgresql": "^12.1.0",
+    "@types/node": "^24.10.15",
+    "@types/pg": "^8.23.1",
+    "@vitest/coverage-v8": "^4.1.9",
+    "eslint": "^10.5.0",
+    "eslint-config-prettier": "^10.1.8",
+    "globals": "^17.6.0",
+    "pg": "^8.23.0",
+    "prettier": "^3.8.4",
+    "publint": "^0.3.24",
+    "rimraf": "^6.1.3",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.61.1",
+    "vitest": "^4.1.9"
+  },
+  "engines": {
+    "node": ">=22.18",
+    "bun": ">=1.0"
+  },
+  "scripts": {
+    "build": "rimraf dist && tsc -p tsconfig.build.json",
+    "format": "prettier --write .",
+    "lint": "eslint .",
+    "type:check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "pack:check": "pnpm pack --out package.tgz && publint package.tgz && attw package.tgz --profile esm-only && rimraf package.tgz"
+  }
+}