@casomoltd/tooling 0.37.0 → 0.39.0

package/README.md

@@ -15,6 +15,7 @@ Shared linting, formatting, commit config, and CLI tools for Casomo Ltd's repos.
 | `@casomoltd/tooling/knip` | Knip config for unused exports/dependencies |
 | `@casomoltd/tooling/jscpd` | Copy-paste detection config |
 | `@casomoltd/tooling/readability` | `scoreText()` — readability scoring for page content |
+| `@casomoltd/tooling/identity` | `CASOMO_ORGANIZATION`, the schema.org `Organization`, logo included, that every Casomo site names as publisher in its JSON-LD. App code imports it at build time, so a site that installs only production dependencies at runtime lists the package under `dependencies` |
 | `@casomoltd/tooling/buttondown` | For a repo using the `buttondown` command: the shared email blocks and skins (`createEmailBlocks`, `emailBaseCss`, `composeWebSkin`), `tokenReader()`, `loadSettings()` and `buildPayload()`, and `EMAIL_CHROME_HIDES` and `WEB_CHROME_HIDES` ([docs/buttondown.md](docs/buttondown.md)) |
 
 ### Bin commands
@@ -23,7 +24,8 @@ Shared linting, formatting, commit config, and CLI tools for Casomo Ltd's repos.
 |---|---|
 | `check-version` | Pre-push guard — rejects push if `package.json` version hasn't changed vs `origin/main` |
 | `check-linear` | Pre-push guard — rejects a push that would put a merge commit on the remote. History is linear; a branch catches up by rebasing. Only what the push adds is judged, so merges already on the remote stay |
-| `pre-push` | Husky pre-push hook — runs check, then the version, tag and linear-history guards |
+| `pre-push` | Husky pre-push hook — runs check, then `check:routes` where a repo defines it, then the version, tag and linear-history guards |
+| `check-routes` | Pre-push gate for a Next.js site — starts `next start` against the build `check` made, requests every page in `/sitemap.xml`, and fails if any is not a 200. Run it as `"check:routes": "check-routes"`; [why it runs on push](#quality-gates) |
 | `pre-commit` | Husky pre-commit hook — runs `npm run check` |
 | `commit-msg` | Husky commit-msg hook — runs commitlint, then `check-listed-files` |
 | `check-listed-files` | Refuse a commit that changes a file still listed in `eslint-suppressions.json`, unless a `Lint-deferred:` trailer says why ([docs/lint.md](docs/lint.md)) |
@@ -286,13 +288,17 @@ the local hooks are the gate, CI is the backstop.
 
 - **pre-commit**: `npm run check` — the repo's full health gate.
 - **commit-msg**: commitlint (house rules + the AI-attribution ban).
-- **pre-push**: `npm run check`, then the version and tag guards.
+- **pre-push**: `npm run check`, then `check:routes` where the repo
+  defines it, then the version, tag and linear-history guards.
 
 **`check` owns the build.** A repo whose build fails is not
 healthy, and any assertion that reads build output has to run
 after the build in the same script — so `build` belongs in
 `check`, and appears nowhere else. Declaring it in the pre-push
 gate as well would give it two owners and build twice.
+Exception: `check:routes` reads the build outside `check`. It
+starts a server, which belongs to a push rather than to every
+commit, so the pre-push hook runs it after `check`.
 
 ### What every repo's `check` must contain
 

package/bin/check-gates.mjs

@@ -9,8 +9,10 @@
 //
 // So this does not orchestrate the gates; it checks the composition:
 //   1. every REQUIRED gate is defined and actually run by `check`
-//   2. no gate-shaped script is defined but left unreferenced (a dead gate)
+//   2. no gate-shaped script is defined but left unreferenced (a dead gate),
+//      other than a pre-push gate, which the hook runs instead
 //   3. no exception outlives the problem it was written for
+//   4. no pre-push gate is run by `check`, which every commit pays for
 //
 // A repo opts out by declaring a reason in its own package.json. A blank
 // reason fails, so an opt-out can never be silent:
@@ -38,6 +40,11 @@ export const REQUIRED = [
 /** Gate-shaped but not mandatory: still dead if defined and never run. */
 export const OPTIONAL = ["check:readability"];
 
+/** Gates the pre-push hook runs after `check`, never `check` itself: they
+ * start a server against the build, which a commit should not pay for.
+ * bin/pre-push.sh runs each by name, so the two lists must match. */
+export const PRE_PUSH = ["check:routes"];
+
 /** A script is a gate only by exact membership or the `check:` prefix — never
  * by heuristic, so `dev`, `start`, `clean`, `lint:fix`, `test:watch`,
  * `build:clean` and `indexnow` need no denylist to be ignored. */
@@ -54,45 +61,57 @@ export const referencedGates = (check) =>
       .filter(Boolean),
   );
 
+/** Each required gate that is not defined, or defined but never run. */
+const requiredFailures = (scripts, run) =>
+  REQUIRED.flatMap((gate) => {
+    if (!(gate in scripts)) return [[gate, `required gate is not defined`]];
+    if (!run.has(gate)) {
+      return [[gate, `required gate is defined but \`check\` never runs it`]];
+    }
+    return [];
+  });
+
+/** Each other gate-shaped script that `check` never runs. `check` itself is
+ * the chain, not a step within it, and the hook runs a pre-push gate. */
+const deadGates = (scripts, run) =>
+  Object.keys(scripts)
+    .filter((n) => isGate(n) && n !== "check" && !REQUIRED.includes(n))
+    .filter((gate) => !PRE_PUSH.includes(gate))
+    .filter((gate) => !run.has(gate))
+    .map((gate) => [gate, `defined but \`check\` never runs it — a dead gate`]);
+
+/** Each pre-push gate that `check` runs, so every commit starts a server. */
+const prePushInCheck = (run) =>
+  PRE_PUSH.filter((gate) => run.has(gate)).map((gate) => [
+    gate,
+    `a pre-push gate: \`check\` runs on every commit`,
+  ]);
+
+/** Sort the failures by their exception: none, a blank reason, or a reason. */
+const byException = (failures, exceptions) => {
+  const sorted = {live: [], excused: [], unreasoned: []};
+  for (const [gate, reason] of failures) {
+    if (!(gate in exceptions)) sorted.live.push([gate, reason]);
+    else if (!String(exceptions[gate] ?? "").trim()) sorted.unreasoned.push(gate);
+    else sorted.excused.push([gate, exceptions[gate]]);
+  }
+  return sorted;
+};
+
 export const evaluate = (pkg) => {
   const scripts = pkg.scripts ?? {};
   const exceptions = pkg.casomo?.gates ?? {};
   const run = referencedGates(scripts.check);
-
-  // `check` itself is the chain, not a step within it.
-  const defined = Object.keys(scripts).filter((n) => isGate(n) && n !== "check");
-
-  const failures = [];
-  for (const gate of REQUIRED) {
-    if (!(gate in scripts)) failures.push([gate, `required gate is not defined`]);
-    else if (!run.has(gate))
-      failures.push([gate, `required gate is defined but \`check\` never runs it`]);
-  }
-  for (const gate of defined) {
-    if (run.has(gate)) continue;
-    if (failures.some(([g]) => g === gate)) continue; // already reported above
-    failures.push([gate, `defined but \`check\` never runs it — a dead gate`]);
-  }
-
-  const excused = [];
-  const unreasoned = [];
-  const live = [];
-  for (const [gate, reason] of failures) {
-    if (!(gate in exceptions)) {
-      live.push([gate, reason]);
-    } else if (!String(exceptions[gate] ?? "").trim()) {
-      unreasoned.push(gate);
-    } else {
-      excused.push([gate, exceptions[gate]]);
-    }
-  }
-
+  const failures = [
+    ...requiredFailures(scripts, run),
+    ...deadGates(scripts, run),
+    ...prePushInCheck(run),
+  ];
   // An exception whose failure has gone away is the same rot in reverse.
   const stale = Object.keys(exceptions).filter(
     (gate) => !failures.some(([g]) => g === gate),
   );
-
-  return {live, excused, unreasoned, stale};
+  return {...byException(failures, exceptions), stale};
 };
 
 const main = () => {

package/bin/check-routes.mjs

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+/**
+ * Request every page a built Next.js site lists in its sitemap from
+ * `next start` on a local port, and fail if any answers anything but 200.
+ *
+ * A build can pass while a page still fails at request time: a server
+ * component that throws, or a fetch that breaks only when the page renders.
+ * The pre-push hook runs this after `npm run check`, against the build
+ * `check` has just made; it makes no build of its own. It stays out of
+ * `check` because the pre-commit hook runs `check`, and starting a server
+ * belongs to a push, not to every commit.
+ *
+ * It reads the sitemap Next emits: plain `<loc>` elements, in a urlset or a
+ * sitemap index one level deep, with `&amp;` the only entity in a URL.
+ *
+ * Usage, in the site's root after `next build`:
+ *   check-routes
+ *
+ * Exit codes:
+ *   0  every listed page answered 200
+ *   1  a page did not, the sitemap failed or listed none, or the server
+ *      never started
+ */
+
+import {spawn} from "node:child_process";
+import {existsSync, realpathSync} from "node:fs";
+import {createServer} from "node:net";
+import {setTimeout as sleep} from "node:timers/promises";
+import {pathToFileURL} from "node:url";
+
+const HOST = "127.0.0.1";
+const SITEMAP = "/sitemap.xml";
+// The default distDir; a site that moves it is not supported.
+const BUILD_ID = ".next/BUILD_ID";
+// The site's own `next`, never one `npx` would offer to download.
+const NEXT_BIN = "node_modules/.bin/next";
+const HTTP_OK = 200;
+const READY_POLL_MS = 250;
+const READY_TIMEOUT_MS = 60_000;
+// A page waiting on a dead upstream must fail the push, not hang it.
+const REQUEST_TIMEOUT_MS = 30_000;
+// Enough to keep a few hundred pages quick without starving the server.
+const CONCURRENCY = 8;
+
+/** Probe every path, CONCURRENCY at a time; return the ones not 200. */
+export const failingPages = async (base, paths) => {
+  const queue = [...paths];
+  const failures = [];
+  const worker = async () => {
+    for (let path = queue.shift(); path !== undefined; path = queue.shift()) {
+      const result = await probe(base, path);
+      if (result.status !== HTTP_OK) failures.push(result);
+    }
+  };
+  await Promise.all(Array.from({length: CONCURRENCY}, worker));
+  return failures;
+};
+
+/** The path and query of every `<loc>` in a sitemap or sitemap index. The
+ * sitemap names the production host; the check asks the local server. */
+const sitemapPaths = (xml) =>
+  [...xml.matchAll(/<loc>([^<]+)<\/loc>/g)].map(([, loc]) => {
+    const url = new URL(loc.trim().replaceAll("&amp;", "&"));
+    return url.pathname + url.search;
+  });
+
+/** A sitemap index lists other sitemaps, not pages. */
+const isSitemapIndex = (xml) => /<sitemapindex[\s>]/.test(xml);
+
+const message = (err) => (err instanceof Error ? err.message : String(err));
+
+const get = (url, init = {}) =>
+  fetch(url, {...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)});
+
+/** A sitemap's text; any answer but 200 is the failure, not a retry. */
+const readSitemap = async (base, path) => {
+  const res = await get(base + path);
+  if (res.status !== HTTP_OK) throw new Error(`${path} answered ${res.status}`);
+  return res.text();
+};
+
+/** Every page path, once each, following a sitemap index one level down. */
+const collectPaths = async (base, rootXml) => {
+  if (!isSitemapIndex(rootXml)) return [...new Set(sitemapPaths(rootXml))];
+  const children = await Promise.all(
+    sitemapPaths(rootXml).map((path) => readSitemap(base, path)),
+  );
+  return [...new Set(children.flatMap(sitemapPaths))];
+};
+
+/** One page's status, or the error that stopped the request. A redirect
+ * counts as a failure: a sitemap should list where a page lives. */
+const probe = async (base, path) => {
+  try {
+    const res = await get(base + path, {redirect: "manual"});
+    await res.arrayBuffer();
+    return {path, status: res.status};
+  } catch (err) {
+    return {path, error: message(err)};
+  }
+};
+
+/** A free local port, so a dev server already on 3000 is never in the way. */
+const freePort = () =>
+  new Promise((resolve, reject) => {
+    const listener = createServer();
+    listener.on("error", reject);
+    listener.listen(0, HOST, () => {
+      const {port} = listener.address();
+      listener.close(() => resolve(port));
+    });
+  });
+
+/** `next start` in its own process group, so the stop reaches `next-server`
+ * and not only its launcher. `died` rejects the moment the server fails to
+ * spawn or exits, so a dead server fails the check now, not at the timeout. */
+const startServer = (port) => {
+  const server = spawn(NEXT_BIN, ["start", "-p", String(port), "-H", HOST], {
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: true,
+  });
+  const output = [];
+  server.stdout.on("data", (d) => output.push(String(d)));
+  server.stderr.on("data", (d) => output.push(String(d)));
+  const died = new Promise((_, reject) => {
+    server.on("error", (err) => reject(new Error(`could not start next: ${err}`)));
+    server.on("exit", (code) =>
+      reject(new Error(`next start exited (${code})\n${output.join("")}`)),
+    );
+  });
+  // The exit the stop itself causes is expected, so nothing awaits it then.
+  died.catch(() => {});
+  return {server, output, died};
+};
+
+/** Stop the server's process group; one that has already exited is fine. */
+const stopServer = (server) => {
+  if (server.pid === undefined) return;
+  try {
+    process.kill(-server.pid, "SIGTERM");
+  } catch (err) {
+    if (err?.code !== "ESRCH") throw err;
+  }
+};
+
+/** The root sitemap once the server answers; keep polling only while the
+ * connection is refused. */
+const waitForSitemap = async (base, output) => {
+  const deadline = Date.now() + READY_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    try {
+      return await readSitemap(base, SITEMAP);
+    } catch (err) {
+      if (!(err instanceof TypeError)) throw err;
+    }
+    await sleep(READY_POLL_MS);
+  }
+  throw new Error(`the server never answered ${SITEMAP}\n${output.join("")}`);
+};
+
+const report = (count, failures) => {
+  if (count === 0) {
+    console.error(`✗ check-routes: ${SITEMAP} lists no pages`);
+    return 1;
+  }
+  if (failures.length > 0) {
+    console.error(`✗ check-routes: ${failures.length} of ${count} pages failed`);
+    for (const {path, status, error} of failures) {
+      console.error(`  ${status ?? error}  ${path}`);
+    }
+    return 1;
+  }
+  console.log(`✓ check-routes: ${count} pages answered 200`);
+  return 0;
+};
+
+/** Start the server, check every page, stop it; the exit code. */
+const run = async () => {
+  const port = await freePort();
+  const base = `http://${HOST}:${port}`;
+  const {server, output, died} = startServer(port);
+  try {
+    const rootXml = await Promise.race([waitForSitemap(base, output), died]);
+    const paths = await collectPaths(base, rootXml);
+    return report(paths.length, await failingPages(base, paths));
+  } catch (err) {
+    console.error(`✗ check-routes: ${message(err)}`);
+    return 1;
+  } finally {
+    stopServer(server);
+  }
+};
+
+const main = async () => {
+  if (!existsSync(BUILD_ID)) {
+    console.error(
+      `✗ check-routes: no ${BUILD_ID}; run \`next build\` first`
+        + " (a custom distDir is not supported)",
+    );
+    process.exit(1);
+  }
+  const code = await run();
+  // The server's pipes can keep node alive past the stop; the check is done.
+  process.exit(code);
+};
+
+/** True only when this file is the entry point. npm installs a bin as a
+ * symlink, so `process.argv[1]` is the link while `import.meta.url` is the
+ * target it resolves to: resolve before comparing, or `main` never runs. */
+const isEntryPoint = () => {
+  try {
+    return import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
+  } catch {
+    return false;
+  }
+};
+
+if (isEntryPoint()) await main();

package/bin/pre-push.sh

@@ -14,7 +14,12 @@ export PRE_PUSH_REFS
 # owners and run it twice wherever `check` builds. A repo that needs a build
 # gate adds `npm run build` to its own `check`; one that produces no artifact
 # simply doesn't.
+#
+# `check:routes` runs after `check`, not in it: see the README, "Quality
+# gates". Repos without it skip it. Every gate in PRE_PUSH
+# (bin/check-gates.mjs) must be run here.
 npm run check \
+  && npm run --if-present check:routes \
   && echo "$PRE_PUSH_REFS" | check-version \
   && echo "$PRE_PUSH_REFS" | check-tags \
   && echo "$PRE_PUSH_REFS" | check-linear

package/bin/verify-pack.mjs

@@ -4,7 +4,8 @@
 // the allowlist and never look like a secret. Defence-in-depth on top of
 // package.json "files" — this fails CI if that allowlist is ever loosened
 // or a secret-bearing file sneaks in. The tooling repo is public, so the
-// published/installed surface must stay configs + CLI only.
+// published/installed surface must stay configs, CLIs and the build-time
+// data sites import, and nothing private.
 import {execSync} from "node:child_process";
 
 // Dirs/files a consumer is allowed to receive. npm always adds
@@ -20,12 +21,21 @@ const ALLOWED_PREFIXES = [
   "report/",
   "styles/",
   "buttondown/",
+  "identity/",
 ];
 const ALLOWED_FILES = ["README.md", "package.json", "LICENSE", "LICENSE.md"];
 
-// Anything matching these must never ship, even from an allowed dir.
-const SECRET_PATTERN =
-  /(^|\/)(\.env(\..*)?|.*settings\.local\.json|.*\.pem|id_[rd]sa|.*\.key|\.npmrc)$/i;
+// A file whose name alone marks it as a secret must never ship, even from an
+// allowed dir: an env file, local settings, a key, or an npm token file.
+const SECRET_NAMES = new Set([".env", ".npmrc", "id_rsa", "id_dsa"]);
+const SECRET_ENDINGS = [".pem", ".key", "settings.local.json"];
+
+function looksSecret(path) {
+  const name = path.slice(path.lastIndexOf("/") + 1).toLowerCase();
+  return SECRET_NAMES.has(name)
+    || name.startsWith(".env.")
+    || SECRET_ENDINGS.some((ending) => name.endsWith(ending));
+}
 
 // Tests live beside what they test, which puts them inside an allowed dir —
 // so the allowlist alone would ship them. Consumers get the tool, not its
@@ -40,7 +50,7 @@ const escaped = files.filter(
     !ALLOWED_FILES.includes(f) &&
     !ALLOWED_PREFIXES.some((prefix) => f.startsWith(prefix)),
 );
-const secrets = files.filter((f) => SECRET_PATTERN.test(f));
+const secrets = files.filter(looksSecret);
 const tests = files.filter((f) => TEST_PATTERN.test(f));
 
 if (escaped.length || secrets.length || tests.length) {

package/identity/index.d.mts

@@ -0,0 +1,15 @@
+/** Casomo Ltd as a schema.org `Organization`, for a page's JSON-LD.
+ *
+ *  Every field is read-only because the value is frozen: spread it into an
+ *  untyped object literal, or type a JSON-LD field that holds it as
+ *  `readonly string[]`, never as `string[]`. */
+export interface CasomoOrganization {
+  readonly "@type": "Organization";
+  readonly "@id": string;
+  readonly name: string;
+  readonly url: string;
+  readonly logo: string;
+  readonly sameAs: readonly string[];
+}
+
+export declare const CASOMO_ORGANIZATION: CasomoOrganization;

package/identity/index.mjs

@@ -0,0 +1,6 @@
+/**
+ * The public face of the identity entry: what a site imports. The value
+ * lives in organization.mjs, where the typecheck can read it against the
+ * declaration here; beside a .d.mts, TypeScript would skip it.
+ */
+export {CASOMO_ORGANIZATION} from "./organization.mjs";

package/identity/organization.mjs

@@ -0,0 +1,27 @@
+/**
+ * Casomo Ltd as search engines should see it: the one schema.org
+ * `Organization` every Casomo site names in its JSON-LD. Each site imports
+ * this rather than typing its own, so no two sites can disagree about who
+ * publishes them, and `sameAs` ties them all to the same profiles.
+ *
+ * Public facts only: the company's name, its mark and the public addresses it
+ * is known by. A person, such as an article's author, stays with the site.
+ */
+const SITE = "https://casomoltd.com";
+
+/** @type {import("./index.d.mts").CasomoOrganization} */
+export const CASOMO_ORGANIZATION = Object.freeze({
+  "@type": "Organization",
+  // One id across every site, so a crawler merges them into one entity.
+  "@id": `${SITE}/#organization`,
+  name: "Casomo Ltd",
+  url: SITE,
+  // The company's mark, as its own site serves it. Each site keeps its own
+  // favicon and palette; this is the one logo the company is known by.
+  logo: `${SITE}/assets/icon.svg`,
+  sameAs: Object.freeze([
+    "https://casomo.co.uk",
+    "https://www.facebook.com/casomouk",
+    "https://www.linkedin.com/company/111967567/",
+  ]),
+});

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@casomoltd/tooling",
-  "version": "0.37.0",
-  "description": "Casomo's shared dev config: ESLint, Prettier, commitlint, knip & jscpd presets and dev CLIs (git hooks, readability, screenshots, design specs)",
+  "version": "0.39.0",
+  "description": "Casomo's shared dev config: ESLint, Prettier, commitlint, knip & jscpd presets, dev CLIs (git hooks, readability, screenshots, design specs), and the build-time data and helpers sites import (the Buttondown engine, the shared Organization)",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/casomoltd/tooling.git"
+    "url": "git+https://github.com/casomoltd/tooling.git"
   },
   "files": [
     "bin/",
@@ -18,14 +18,16 @@
     "report/",
     "styles/",
     "buttondown/",
+    "identity/",
     "README.md",
-    "!**/*.test.mjs"
+    "!**/*.test.mjs",
+    "!identity/tsconfig.json"
   ],
   "scripts": {
     "check": "node bin/check-gates.mjs && node bin/verify-pack.mjs && npm run check:private-refs && npm run check:personal-data && npm run lint && npm run typecheck && npm run test && npm run lint:md",
     "lint": "eslint .",
-    "typecheck": "tsc --noEmit -p hooks/tsconfig.json",
-    "test": "node hooks/test.mts && node bin/check-gates.test.mjs && node bin/check-listed-files.test.mjs && node bin/check-personal-data.test.mjs && node bin/casomo-config.test.mjs && node bin/buttondown.test.mjs && node commitlint/index.test.mjs && node readability/index.test.mjs",
+    "typecheck": "tsc --noEmit -p hooks/tsconfig.json && tsc --noEmit -p identity/tsconfig.json",
+    "test": "node hooks/test.mts && node bin/check-gates.test.mjs && node bin/check-listed-files.test.mjs && node bin/check-personal-data.test.mjs && node bin/check-routes.test.mjs && node bin/casomo-config.test.mjs && node bin/buttondown.test.mjs && node commitlint/index.test.mjs && node readability/index.test.mjs && node identity/index.test.mjs",
     "lint:md": "remark --frail --quiet --no-stdout --rc-path bin/skills-lint.config.mjs skills agents docs",
     "build": "echo 'no-op: source-only repo, nothing to build'",
     "prepare": "husky || true",
@@ -51,26 +53,31 @@
     "./buttondown": {
       "types": "./buttondown/index.d.mts",
       "default": "./buttondown/index.mjs"
+    },
+    "./identity": {
+      "types": "./identity/index.d.mts",
+      "default": "./identity/index.mjs"
     }
   },
   "bin": {
-    "build-report": "./bin/build-report.mjs",
-    "buttondown": "./bin/buttondown.mjs",
-    "check-gates": "./bin/check-gates.mjs",
-    "check-hooks": "./bin/check-hooks.sh",
-    "check-listed-files": "./bin/check-listed-files.mjs",
-    "check-linear": "./bin/check-linear.sh",
-    "check-personal-data": "./bin/check-personal-data.mjs",
-    "check-private-refs": "./bin/check-private-refs.mjs",
-    "check-tags": "./bin/check-tags.sh",
-    "check-version": "./bin/check-version.sh",
-    "commit-msg": "./bin/commit-msg.sh",
-    "pre-commit": "./bin/pre-commit.sh",
-    "pre-push": "./bin/pre-push.sh",
-    "readability": "./bin/readability.mjs",
-    "render-figures": "./bin/render-figures.mjs",
-    "screenshot": "./bin/screenshot.mjs",
-    "spec-check": "./bin/spec-check.mjs"
+    "build-report": "bin/build-report.mjs",
+    "buttondown": "bin/buttondown.mjs",
+    "check-gates": "bin/check-gates.mjs",
+    "check-hooks": "bin/check-hooks.sh",
+    "check-listed-files": "bin/check-listed-files.mjs",
+    "check-linear": "bin/check-linear.sh",
+    "check-personal-data": "bin/check-personal-data.mjs",
+    "check-private-refs": "bin/check-private-refs.mjs",
+    "check-routes": "bin/check-routes.mjs",
+    "check-tags": "bin/check-tags.sh",
+    "check-version": "bin/check-version.sh",
+    "commit-msg": "bin/commit-msg.sh",
+    "pre-commit": "bin/pre-commit.sh",
+    "pre-push": "bin/pre-push.sh",
+    "readability": "bin/readability.mjs",
+    "render-figures": "bin/render-figures.mjs",
+    "screenshot": "bin/screenshot.mjs",
+    "spec-check": "bin/spec-check.mjs"
   },
   "publishConfig": {
     "access": "public"