@homeflare/config 0.10.0 → 0.11.1

package/README.md

@@ -83,7 +83,12 @@ cp node_modules/@homeflare/config/bunfig.toml  bunfig.toml
 ```
 
 ⚠️ `.oxfmtrc.json` needs the **leading dot**. Without it oxfmt silently uses its defaults,
-and the symptom is a formatter that rewrites your quotes.
+and the symptom is a formatter that rewrites your quotes. The same silent-defaults trap
+applies to `.oxfmtrc.mjs`/`.ts`/`.js`/`.cjs`/`.mts`/`.cts` in a bare `oxfmt`/`oxfmt .`
+invocation — `oxfmt`'s own auto-discovery finds only `.json`/`.jsonc`, even though `-c`
+accepts the rest. Prefer `.oxfmtrc.json`; the shared pre-commit hook resolves the other
+extensions and passes `--config` itself (`docs/hooks.md`), but your own `bun run format`
+script still needs to name the file explicitly if it isn't `.oxfmtrc.json`.
 
 ⛔ oxfmt has no `extends`. Extra `ignorePatterns` are a **merge**: generated OpenAPI,
 `vendor/`, `**/generated/**`, `**/*.gen.ts` stay out of the formatter. ⛔ Identity
@@ -145,50 +150,15 @@ Alchemy resource — see `docs/github-hygiene.md`.
 
 ## git hooks
 
-One hook layer for the whole estate. The behaviour ships here; a repo commits a
-delegating wrapper and nothing else.
+One hook layer for the whole estate: a secret scan and staged format/lint on commit, and
+the repo's own `check` narrowed to what a push can affect on push. They are active in
+every worktree of a clone. Adoption, what runs, and why:
+[docs/hooks.md](./docs/hooks.md).
 
 ```sh
-bun add -D @homeflare/config husky
-npm pkg set scripts.prepare=husky
-bun install                                          # husky writes .husky/_
-bun node_modules/@homeflare/config/bin/hooks.ts install
-git add .husky/pre-commit .husky/pre-push package.json
+bun node_modules/@homeflare/config/bin/hooks.ts install     # then "prepare": "bun node_modules/@homeflare/config/bin/hooks.ts activate"
 ```
 
-| hook         | runs                                            | cost              |
-| ------------ | ----------------------------------------------- | ----------------- |
-| `pre-commit` | `oxfmt` + `oxlint --deny-warnings`, staged only | sub-second        |
-| `pre-push`   | the repo's own `bun run check`                  | whatever CI costs |
-
-⚠️ **pre-commit rewrites files.** It formats the staged formattable files (`.md`
-included — house `oxfmt` formats markdown, and a hook that skipped it would let an
-unformatted changeset through), names the ones it changed, and restages exactly those.
-Without the restage the commit would capture the unformatted bytes and CI would fail a
-file that reads as clean locally.
-
-⛔ **A file with unstaged edits on top is checked, never rewritten.** Restaging it would
-sweep work in progress into a commit nobody asked for.
-
-⛔ **pre-push always calls `check`, never `verify`.** `verify` means the consumer smoke
-test in this repo and a _live_ adoption verifier in `homeflare-proxmox`; a hook that
-guessed would run credentials-backed live checks on a push.
-
-⚠️ **A hook is a local convenience, not a gate.** It is skippable with `--no-verify`,
-absent from a fresh clone until `bun install` runs `prepare`, and silently inert when
-`core.hooksPath` points at a `.husky/_` that no install has created yet. The required
-checks on `main` stay the gate; this makes the cheap mistakes cheap to find.
-
-```ts
-import { problemsInHooks } from '@homeflare/config/hooks';
-
-expect(await problemsInHooks(process.cwd())).toEqual([]);
-```
-
-⛔ `problemsInHooks` is deliberately **not** part of `checkProject`. Every repo runs that
-checker from a test, so folding hook conformance in would turn every repo that has not
-adopted yet red on `main` in one commit. A repo opts in by calling this.
-
 ## License
 
 MIT © Timothy Schneider

package/bin/hooks.ts

@@ -1,19 +1,23 @@
 #!/usr/bin/env bun
 /**
- * The entry a repo's `.husky/` wrapper calls.
+ * The entry a repo's `.husky/` wrapper calls, and its `prepare` script.
  *
  * ⚠️ IT IMPORTS `../src`, NOT `../dist`. `src` is published, Bun runs TypeScript
  *   directly, and a hook that depended on a build step would be dead in a fresh clone
  *   of the repo that HOSTS this package — the one place `dist/` does not exist yet.
+ * ⚠️ STDIN IS READ FOR `pre-push` ONLY, AND NEVER FROM A TERMINAL. git pipes the pushed refs
+ *   to that hook; a person running it by hand has a TTY there, and reading it would hang.
  */
 import { isCommand, runCommand } from '../src/hooks.ts';
 
-const command = process.argv[2] ?? '';
+const [command = '', ...args] = process.argv.slice(2);
 
 if (!isCommand(command)) {
   process.stderr.write(`homeflare hooks: unknown command ${JSON.stringify(command)}\n`);
-  process.stderr.write('  expected one of: pre-commit, pre-push, install\n');
+  process.stderr.write('  expected one of: pre-commit, pre-push, install, activate\n');
   process.exit(2);
 }
 
-await runCommand(command, process.cwd());
+const stdin = command === 'pre-push' && !process.stdin.isTTY ? await Bun.stdin.text() : '';
+
+await runCommand(command, process.cwd(), args, stdin);

package/dist/hooks/activate.d.ts

@@ -0,0 +1,7 @@
+export type Activation = {
+    /** The hooks path is set (now or already). */
+    readonly active: boolean;
+    readonly message: string;
+};
+export declare function activateHooks(root: string, env?: Readonly<Record<string, string | undefined>>): Promise<Activation>;
+//# sourceMappingURL=activate.d.ts.map

package/dist/hooks/activate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activate.d.ts","sourceRoot":"","sources":["../../src/hooks/activate.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,UAAU,GAAG;IACvB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAYF,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,OAAO,CAAC,UAAU,CAAC,CA+BrB"}

package/dist/hooks/gates.d.ts

@@ -1,19 +1,12 @@
-/**
- * Format and lint what is staged, restaging only what the formatter rewrote.
- *
- * ⚠️ THIS HOOK REWRITES FILES DURING A COMMIT, and it says so on the line where it
- *   happens. Without the restage, oxfmt would fix the worktree while the commit kept
- *   the unformatted bytes — CI then fails on a file that reads as correct locally.
- */
 export declare function preCommit(root: string): Promise<void>;
 /**
- * Run the repo's own declared gate before the push reaches the runner.
+ * Run the repository's own `check`, narrowed to what the push can affect.
  *
- * ★ IT CALLS `bun run check` RATHER THAN NAMING TOOLS. Every repo's `check` is the
- *   command CI runs; hard-coding `tsc` and `bun test` here would drift from whichever
- *   repo added a step, and the hook would certify a push CI rejects.
- * ⛔ It does not widen a narrow `check`. If a repo's gate only looks at part of the
- *   tree, this hook inherits exactly that blind spot — fix the script, not the hook.
+ * ★ `args` ARE GIT'S: the remote name and URL. `stdin` is git's ref list — see
+ *   push-range.ts for how the base is chosen and why it never narrows to nothing.
+ * ⛔ IT DOES NOT CERTIFY WHAT CI WILL SAY. It certifies that `check`'s own lint and type
+ *   lanes pass and that every test the pushed files can reach passes. The build, the smoke
+ *   test and the unreachable tests are CI's, and the success line says so.
  */
-export declare function prePush(root: string): Promise<void>;
+export declare function prePush(root: string, args: readonly string[], stdin: string): Promise<void>;
 //# sourceMappingURL=gates.d.ts.map

package/dist/hooks/gates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../src/hooks/gates.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8C3D;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBzD"}
+{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../src/hooks/gates.ts"],"names":[],"mappings":"AAqDA,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+F3D;AAWD;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDjG"}

package/dist/hooks/install.d.ts

@@ -1,10 +1,16 @@
 /** The hook files this package installs, in the order a contributor meets them. */
 export declare const HOOK_NAMES: readonly ['pre-commit', 'pre-push'];
+/** What a consumer's `prepare` script runs, so every `bun install` activates the hooks. */
+export declare const PREPARE: string;
 /**
- * ⚠️ IT EXITS 0 WHEN THE RUNNER IS ABSENT. A checkout with no `node_modules` would
+ * ⚠️ IT EXITS 0 WHEN THE RUNNER IS ABSENT. A worktree with no `node_modules` would
  *   otherwise fail every commit with a module-resolution error, and the first thing
  *   anyone would do is delete the hook. Failing open is the right trade for a
  *   convenience; the required checks on `main` are what must fail closed.
+ * ★ `"$@"` AND STDIN PASS THROUGH. `pre-push` reads the remote name from its first argument
+ *   and the pushed refs from stdin (push-range.ts); `exec` keeps both.
+ * ⚠️ NO SHEBANG, AND THAT IS MEASURED, NOT FORGOTTEN: git 2.55 runs an executable hook that
+ *   has none through `sh` (2026-09-23), and the husky-era files in the estate have none.
  */
 export declare const HUSKY_HOOK: string;
 /** Write the wrapper into `.husky/`. Returns the paths written, relative to the project. */

package/dist/hooks/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/hooks/install.ts"],"names":[],"mappings":"AAYA,mFAAmF;AACnF,eAAO,MAAM,UAAU,YAAI,YAAY,EAAE,UAAU,CAAU,CAAC;AAK9D;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,MAexB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAYjF;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA+BpF"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/hooks/install.ts"],"names":[],"mappings":"AAgBA,mFAAmF;AACnF,eAAO,MAAM,UAAU,YAAI,YAAY,EAAE,UAAU,CAAU,CAAC;AAK9D,2FAA2F;AAC3F,eAAO,MAAM,OAAO,EAAE,MAAiC,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,EAAE,MAexB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAYjF;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAuCpF"}

package/dist/hooks/oxfmt-config.d.ts

@@ -0,0 +1,25 @@
+export type OxfmtConfigResolution = 
+/** `.oxfmtrc.json` or `.oxfmtrc.jsonc` exists — bare oxfmt already finds it. */
+{
+    readonly kind: 'auto';
+}
+/** No `.oxfmtrc.*` at all — let oxfmt use its built-in defaults, as today. */
+ | {
+    readonly kind: 'none';
+}
+/** Exactly one config oxfmt would not find unaided — pass it with `-c`. */
+ | {
+    readonly kind: 'explicit';
+    readonly path: string;
+}
+/**
+ * Two or more configs, none of them auto-discovered — bare oxfmt (and a repo's own
+ * bare `bun run format`) would silently fall back to defaults too, honouring neither.
+ * Guessing which one the repo meant would just move the silent-defaults bug here.
+ */
+ | {
+    readonly kind: 'ambiguous';
+    readonly files: readonly string[];
+};
+export declare function resolveOxfmtConfig(root: string): Promise<OxfmtConfigResolution>;
+//# sourceMappingURL=oxfmt-config.d.ts.map

package/dist/hooks/oxfmt-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxfmt-config.d.ts","sourceRoot":"","sources":["../../src/hooks/oxfmt-config.ts"],"names":[],"mappings":"AAsCA,MAAM,MAAM,qBAAqB;AAC/B,gFAAgF;AAC9E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC3B,8EAA8E;GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC3B,2EAA2E;GACzE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACtD;;;;GAIG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAQtE,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAQrF"}

package/dist/hooks/push-plan.d.ts

@@ -0,0 +1,59 @@
+/**
+ * What `pre-push` runs: the repository's own `check`, with the expensive lanes narrowed to
+ * the push or left to CI.
+ *
+ * ★ IT READS `check` RATHER THAN NAMING TOOLS. `check` is the command CI runs, so the lanes
+ *   here are that command's lanes — a repository that adds a step to `check` gets it in the
+ *   hook with no change to this package. Hard-coding `tsc` and `bun test` would drift from
+ *   whichever repository added a step first, and certify a push CI rejects.
+ * ★ THREE THINGS CHANGE, AND ONLY THREE:
+ *   1. every `bun test …` becomes `bun test … --changed=<base>` — Bun's own import-graph
+ *      answer to "which test files can these changed files reach" (bun 1.4, measured
+ *      2026-09-23: 11 changed files ran 2 of 246 test files in homeflare-kit);
+ *   2. `build` and `smoke` scripts are skipped — minutes in a big workspace, and CI runs
+ *      both on every pull request;
+ *   3. everything else (lint, types, a `--check` script) runs exactly as `check` spells it.
+ *      They are seconds, whole-program by nature, and deterministic.
+ * ⛔ PURE. No git, no filesystem, no process: the whole contract is a function of the
+ *   scripts table and the base, so the estate's real `check` shapes are pinned by a table
+ *   test (tests/hooks-push-plan.test.ts) instead of by a live push.
+ */
+/** One step of the pre-push run. */
+export type Lane = 
+/** Run `command` through `sh -c` at the repository root. */
+{
+    readonly kind: 'run';
+    readonly label: string;
+    readonly command: string;
+}
+/** A test runner; `scoped` says whether it was narrowed to the push. */
+ | {
+    readonly kind: 'test';
+    readonly label: string;
+    readonly command: string;
+    readonly scoped: boolean;
+}
+/** Not run here, and why. */
+ | {
+    readonly kind: 'skip';
+    readonly label: string;
+    readonly why: string;
+};
+/**
+ * Split a script on top-level `&&`, or return undefined when it is anything else.
+ *
+ * ⛔ UNDEFINED MEANS "RUN IT WHOLE". `||`, `;`, a pipe, a redirect, a background `&` or a
+ *   substitution each change what the pieces mean together, and a hook that re-plumbed them
+ *   would run something the repository never wrote. Quoted text is left alone, so
+ *   `--path-ignore-patterns="homeflare-*\/**"` survives intact.
+ */
+export declare function andChain(script: string): readonly string[] | undefined;
+/**
+ * The lanes `pre-push` runs for this `scripts` table.
+ *
+ * `base` is the commit the push is measured from; `undefined` runs every test lane in full
+ * (an unknown base, or a push that changes what every test runs on).
+ * ⚠️ AN EMPTY LIST MEANS NO `check` SCRIPT — the caller reports that; it is not a pass.
+ */
+export declare function planLanes(scripts: Readonly<Record<string, string>>, base: string | undefined): readonly Lane[];
+//# sourceMappingURL=push-plan.d.ts.map

package/dist/hooks/push-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-plan.d.ts","sourceRoot":"","sources":["../../src/hooks/push-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,oCAAoC;AACpC,MAAM,MAAM,IAAI;AACd,4DAA4D;AAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC5E,wEAAwE;GACtE;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AACH,6BAA6B;GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAY5E;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CA4BtE;AA8DD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,SAAS,IAAI,EAAE,CAajB"}

package/dist/hooks/push-range.d.ts

@@ -0,0 +1,51 @@
+/** One line of git's pre-push stdin. */
+export type PushRef = {
+    readonly localRef: string;
+    readonly localSha: string;
+    readonly remoteRef: string;
+    readonly remoteSha: string;
+};
+export type PushScope = 
+/** The push changes no file (a deletion, or a branch at its base): nothing to check. */
+{
+    readonly kind: 'empty';
+    readonly why: string;
+}
+/** Measured from `base`: `changed` is every path that differs between it and the tip. */
+ | {
+    readonly kind: 'scoped';
+    readonly base: string;
+    readonly changed: readonly string[];
+    readonly why: string;
+}
+/** No usable base: run every lane, tests in full. */
+ | {
+    readonly kind: 'unscoped';
+    readonly why: string;
+}
+/** The pushed commit is not what is checked out, so the working tree cannot vouch for it. */
+ | {
+    readonly kind: 'elsewhere';
+    readonly why: string;
+};
+export declare function parsePushRefs(stdin: string): readonly PushRef[];
+/**
+ * Resolve the push git described on stdin. With no stdin (a manual run) the push is
+ * `HEAD` to a new branch — measured from the merge base with the default branch.
+ * 🔴 THE LANES RUN ON THE WORKING TREE, SO ONLY A PUSH OF `HEAD` CAN BE CHECKED HERE. Found
+ *   in review 2026-09-23 and reproduced: `git push origin broken` from a clean `main`
+ *   measured the right files, then ran `bun test --changed` against `main`'s tree, found
+ *   nothing, and printed "passed". A ref that is not checked out now comes back
+ *   `elsewhere`, which the caller reports as NOT CHECKED — never as a pass. (The old
+ *   whole-`check` hook had the same blind spot; it just ran unrelated tests while in it.)
+ * ⚠️ WITH SEVERAL REFS, THE ONE AT `HEAD` IS MEASURED and the rest are named as unchecked.
+ */
+export declare function pushScope(root: string, remote: string, refs: readonly PushRef[]): Promise<PushScope>;
+/**
+ * A path that changes what EVERY test runs on: a manifest, a lockfile, Bun's config, a
+ * tsconfig. Bun's `--changed` follows imports and none of these is imported — measured
+ * 2026-09-23, editing package.json selected 0 of 246 test files — so a push touching one
+ * runs the tests in full rather than none of them.
+ */
+export declare function changesEverything(path: string): boolean;
+//# sourceMappingURL=push-range.d.ts.map

package/dist/hooks/push-range.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-range.d.ts","sourceRoot":"","sources":["../../src/hooks/push-range.ts"],"names":[],"mappings":"AAiBA,wCAAwC;AACxC,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,SAAS;AACnB,wFAAwF;AACtF;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAClD,yFAAyF;GACvF;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AACH,qDAAqD;GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACrD,6FAA6F;GAC3F;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAKzD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,CAS/D;AA4DD;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,OAAO,EAAE,GACvB,OAAO,CAAC,SAAS,CAAC,CAsCpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGvD"}

package/dist/hooks/report.d.ts

@@ -10,6 +10,18 @@
  */
 /** The two hooks this package implements. Named exactly as the git hook files are. */
 export type Hook = 'pre-commit' | 'pre-push';
+/**
+ * 🔴 A GIT HOOK EXPORTS `GIT_DIR` AND `GIT_INDEX_FILE`, AND EVERYTHING IT SPAWNS
+ *   INHERITS THEM. Measured 2026-09-22 at the cost of two junk files and a stray commit
+ *   on this repository's `main`: `pre-push` runs `bun run check`, `check` runs the test
+ *   suite, and a test that builds a throwaway git repository and commits in it commits
+ *   into THIS repository instead — `cwd` is ignored once `GIT_DIR` is set. The estate's
+ *   own `packages/site/tests/checkout.test.ts` already carried a comment warning about
+ *   exactly this, which is how much a convention is worth.
+ * ⛔ So the hook strips them rather than trusting fourteen test suites to remember. The
+ *   gate must see the repository through `cwd`, the way CI does.
+ */
+export declare function withoutGitEnv(): Record<string, string | undefined>;
 /**
  * Run a command, streaming its output. Returns its exit code.
  * `isolated` drops the inherited `GIT_*` variables — see `withoutGitEnv`.
@@ -17,13 +29,38 @@ export type Hook = 'pre-commit' | 'pre-push';
 export declare function run(cmd: readonly string[], isolated?: boolean): Promise<number>;
 /** Capture a command's stdout. Used for git plumbing only. */
 export declare function capture(cmd: readonly string[]): Promise<string>;
+/**
+ * Run a command, relaying its stdout live-enough (after it exits) while also handing the
+ * caller the text — gates.ts reads oxfmt's own "on N files" summary from it. `stderr` stays
+ * `inherit`: diagnostics (a parse error, "no files matched") must show immediately, and nothing
+ * here needs to inspect them.
+ */
+export declare function runCaptured(cmd: readonly string[]): Promise<{
+    readonly code: number;
+    readonly stdout: string;
+}>;
+/** Capture a command's stdout AND its exit code — git plumbing that answers by status. */
+export declare function probe(cmd: readonly string[]): Promise<{
+    code: number;
+    stdout: string;
+}>;
+/**
+ * Run one pre-push lane through `sh -c` at `root`, as `bun run` would run a script line.
+ *
+ * ⚠️ `node_modules/.bin` FIRST ON PATH, because a lane opened up from a script is no longer
+ *   run by `bun run`, which is what used to put it there — `vitest` or `oxfmt` in an expanded
+ *   script would otherwise be "command not found" on a machine without a global copy.
+ * 🔴 AND WITHOUT THE HOOK'S `GIT_*` — see `withoutGitEnv`.
+ */
+export declare function runLane(command: string, root: string): Promise<number>;
 /**
  * Resolve a dev tool to the project's own copy.
  *
  * ⚠️ NOT `bunx` BY DEFAULT. On a cache miss `bunx` downloads from the registry, and a
  *   git hook that reaches the network mid-commit is a hang waiting for a flaky link.
- *   husky puts `node_modules/.bin` on PATH, but this runs outside husky in tests, so
- *   the local binary is named outright when it exists and `bunx` is only the fallback.
+ *   Git runs the hook with the caller's PATH, which has no `node_modules/.bin` (husky
+ *   used to add it; the hooks no longer run through husky), so the local binary is named
+ *   outright when it exists and `bunx` is only the fallback.
  */
 export declare function tool(root: string, name: string): readonly string[];
 export declare function ok(what: string): void;

package/dist/hooks/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/hooks/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,sFAAsF;AACtF,MAAM,MAAM,IAAI,GAAG,YAAY,GAAG,UAAU,CAAC;AAwB7C;;;GAGG;AACH,wBAAsB,GAAG,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAOnF;AAED,8DAA8D;AAC9D,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAKrE;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGlE;AAaD,wBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAErC;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEvC;AAED,8FAA8F;AAC9F,wBAAgB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAKjE"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/hooks/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,sFAAsF;AACtF,MAAM,MAAM,IAAI,GAAG,YAAY,GAAG,UAAU,CAAC;AAO7C;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAIlE;AAED;;;GAGG;AACH,wBAAsB,GAAG,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAOnF;AAED,8DAA8D;AAC9D,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,SAAS,MAAM,EAAE,GACrB,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK7D;AAED,0FAA0F;AAC1F,wBAAsB,KAAK,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAI7F;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGlE;AAaD,wBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAErC;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEvC;AAED,8FAA8F;AAC9F,wBAAgB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAKjE"}

package/dist/hooks/secrets.d.ts

@@ -0,0 +1,2 @@
+export declare function scanStagedSecrets(): Promise<void>;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/hooks/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/hooks/secrets.ts"],"names":[],"mappings":"AAoBA,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAqBvD"}

package/dist/hooks.d.ts

@@ -1,15 +1,39 @@
-import { HOOK_NAMES, HUSKY_HOOK, installHooks, problemsInHooks } from './hooks/install.ts';
+/**
+ * The HomeFlare git hooks, as a package.
+ *
+ * ★ WHY THIS IS NOT A SCRIPT IN EVERY REPO. Fourteen copies of a hook script is the
+ *   exact drift `@homeflare/config` exists to prevent: the copies diverge, nobody
+ *   notices, and two repos disagree about what a commit must satisfy. Here the repo
+ *   commits a delegating wrapper and the behaviour ships with the package, so changing
+ *   the rule is one release and a version bump rather than fourteen edits.
+ * ★ TRACKED `.husky/`, RUN BY GIT THROUGH `core.hooksPath` — NOT husky's `.husky/_`. Since
+ *   2026-09-23 the mechanism is the one that reaches every worktree; activate.ts has the
+ *   measurement. The files keep the directory name the estate already uses.
+ * ★ PRE-PUSH IS SCOPED TO THE PUSH (push-range.ts, push-plan.ts): the repository's own
+ *   `check`, with `bun test` narrowed to the tests the pushed files can reach and the build
+ *   and smoke test left to CI. Many agents push to many repositories at once; a pre-push
+ *   that re-ran every suite was the one people learned to skip.
+ *
+ * Usage from a hook file — see `HUSKY_HOOK`:
+ *
+ *     bun node_modules/@homeflare/config/bin/hooks.ts pre-commit
+ */
+import { activateHooks } from './hooks/activate.ts';
+import { HOOK_NAMES, HUSKY_HOOK, PREPARE, installHooks, problemsInHooks } from './hooks/install.ts';
+import { type Lane, planLanes } from './hooks/push-plan.ts';
 import { type Hook } from './hooks/report.ts';
-export { HOOK_NAMES, HUSKY_HOOK, installHooks, problemsInHooks };
-export type { Hook };
+export { HOOK_NAMES, HUSKY_HOOK, PREPARE, activateHooks, installHooks, planLanes, problemsInHooks };
+export type { Hook, Lane };
 /** The commands `bin/hooks.ts` accepts. */
-export type Command = Hook | 'install';
+export type Command = Hook | 'install' | 'activate';
 export declare function isCommand(value: string): value is Command;
 /**
- * Run one hook, or install the wrappers.
+ * Run one hook, write the wrappers, or activate them.
  *
+ * `args` are git's own hook arguments (for `pre-push`: the remote name and URL) and
+ * `stdin` is what git wrote to the hook (for `pre-push`: the refs being pushed).
  * ⛔ Never exits non-zero for a reason the caller cannot act on: an unknown command is a
  *   programming error in the wrapper and is reported as such, not as a failed commit.
  */
-export declare function runCommand(command: Command, root: string): Promise<void>;
+export declare function runCommand(command: Command, root: string, args?: readonly string[], stdin?: string): Promise<void>;
 //# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,KAAK,IAAI,EAAY,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,CAAC;AAErB,2CAA2C;AAC3C,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvC,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,OAAO,CAEzD;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS9E"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAE,KAAK,IAAI,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,KAAK,IAAI,EAAY,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;AACpG,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAE3B,2CAA2C;AAC3C,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,CAAC;AAEpD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,OAAO,CAEzD;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,KAAK,SAAK,GACT,OAAO,CAAC,IAAI,CAAC,CAcf"}