@homeflare/config 0.10.0 → 0.11.1

package/dist/versions.js

@@ -89,8 +89,14 @@ function scalar(value) {
 function renderMapping(entries, depth) {
   return Object.entries(entries).map(([key, value]) => `${indent(depth)}${key}: ${scalar(value)}`);
 }
+function trimTrailingNewlines(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 10)
+    end--;
+  return value.slice(0, end);
+}
 function renderRun(command, depth) {
-  const lines = command.replace(/\n+$/, "").split(`
+  const lines = trimTrailingNewlines(command).split(`
 `);
   if (lines.length === 1)
     return [`${indent(depth)}run: ${scalar(lines[0] ?? "")}`];
@@ -330,5 +336,5 @@ export {
   ESTATE_VERSIONS
 };
 
-//# debugId=B457A8EBCFEA8F5F64756E2164756E21
+//# debugId=613673276BC65A5864756E2164756E21
 //# sourceMappingURL=versions.js.map

package/dist/versions.js.map

@@ -4,11 +4,11 @@
   "sourcesContent": [
     "/**\n * The runtime guards `repo-shape` needs and its types cannot express.\n *\n * ★ EXTRACTED FROM `shape.ts`, NOT INVENTED HERE. The types carry one half of the\n *   contract — `Stated<R>` refuses an empty or computed reason at compile time — and\n *   these carry the other half: the cases a literal type still lets through. Keeping\n *   them in one file is what lets `shape.ts` stay the declaration and nothing else.\n *\n * ⚠️ EVERY MESSAGE STARTS `repo-shape:` AND NAMES THE FIELD. These throw at render or at\n *   declaration, far from the workflow file they would otherwise break at job time, so\n *   the message is the only thing pointing back at the call that caused it.\n */\n\nconst SENTENCE = 12;\n\nexport function requireNonEmpty(field: string, value: string): string {\n  const trimmed = value.trim();\n  if (trimmed.length === 0) throw new Error(`repo-shape: ${field} must not be blank`);\n  return trimmed;\n}\n\nexport function requireSentence(field: string, value: string): string {\n  const trimmed = value.trim();\n  // ⚠️ THE TYPE CANNOT CATCH `reason: '   '`. `'   '` is a non-empty literal, so `Stated`\n  //   lets it through and only this does not. Type and guard cover different halves.\n  if (trimmed.length < SENTENCE) {\n    throw new Error(`repo-shape: ${field} must be a sentence, got ${JSON.stringify(value)}`);\n  }\n  return trimmed;\n}\n\nexport function requireIsoDate(value: string): string {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(value)) {\n    throw new Error(`repo-shape: since must be YYYY-MM-DD, got ${JSON.stringify(value)}`);\n  }\n  return value;\n}\n\n/**\n * ⛔ A MAJOR, NOT A RANGE, AND NOT A FLOAT. `actions/setup-node` takes `node-version: 24`\n *   and resolves the newest 24.x; a fractional or negative value renders YAML the action\n *   accepts and then fails to resolve, mid-job, on the runner.\n */\nexport function requireMajor(value: number): number {\n  if (!Number.isInteger(value) || value <= 0) {\n    throw new Error(`repo-shape: node must be a positive integer major, got ${value}`);\n  }\n  return value;\n}\n\n/** `timeout-minutes` must be a positive whole number of minutes. */\nexport function requireMinutes(value: number): number {\n  if (!Number.isInteger(value) || value <= 0) {\n    throw new Error(`repo-shape: timeout must be a positive whole minute count, got ${value}`);\n  }\n  return value;\n}\n\nexport function requireJobId(value: string): string {\n  // ⛔ The id becomes a YAML key and a `needs:` entry. Anything else renders a workflow\n  //   GitHub rejects at parse time, which reports as \"workflow file issue\" with no line.\n  if (!/^[a-z][a-z0-9_-]*$/.test(value)) {\n    throw new Error(\n      `repo-shape: job id must match /^[a-z][a-z0-9_-]*$/, got ${JSON.stringify(value)}`,\n    );\n  }\n  return value;\n}\n",
     "/**\n * `RepoShape` — one HomeFlare repository's tooling, as a value.\n *\n * ★ WHY THIS TYPE EXISTS. Measured across the estate on 2026-09-22: 13 repositories each\n *   carry a hand-written `.github/workflows/ci.yml`, `security.yml`, `.github/actionlint.yaml`\n *   and `.changeset/config.json`. The changeset configs were byte-identical apart from the\n *   repository name in 11 of 13. The security workflows were not: five still carried\n *   `push: branches: [main]` that the other eight had removed, five were missing the\n *   `concurrency:` block entirely, two were missing `pull-requests: read` (whose absence\n *   makes every pull-request scan fail 403), the gitleaks action was pinned at `@v2` in\n *   five and `@v3` in eight, and the weekly cron minute took three different values. Not\n *   one of those differences was a decision. They are what happens when the same edit is\n *   applied by hand thirteen times.\n *\n * ⛔ SO: A DIFFERENCE IS EITHER AN INPUT OR AN EXCEPTION. Nothing else. A repository that\n *   needs something the standard does not give it either widens this type — and every\n *   repository gets the widening — or declares an exception with a stated reason. There\n *   is no third option where a file is quietly edited, because `drift.ts` fails on it.\n *\n * ⚠️ THE REASON IS ENFORCED BY THE COMPILER, NOT BY REVIEW. `except()` and `extraJob()`\n *   below refuse an empty reason and refuse a reason read out of a variable, so the text\n *   has to be written at the exception. See `Stated`.\n */\n\nimport {\n  requireIsoDate,\n  requireJobId,\n  requireMajor,\n  requireMinutes,\n  requireNonEmpty,\n  requireSentence,\n} from './guards.ts';\n\n/** Where a repository's jobs run. */\nexport type RepoRunner =\n  /**\n   * `[self-hosted, homeflare-mini]` — the interim Linux arm64 runner on the Mac mini.\n   * ⚠️ GitHub-hosted runners are refused for this account (billing lock, 2026-09-22).\n   */\n  | 'mini'\n  /** `ubuntu-latest`. Public repositories, where GitHub-hosted minutes are free. */\n  | 'github';\n\n/** One step in a rendered job. Either a `uses:` or a `run:`, never both. */\nexport type JobStep = {\n  readonly name?: string;\n  /**\n   * The step's `if:` condition, verbatim.\n   *\n   * ★ WIDENED RATHER THAN EXCEPTED, 2026-09-22. homeflare-kit's `consumer smoke test`\n   *   ends with a step that renders the packed tarball sizes onto the run summary, and\n   *   it carries `if: always()` on purpose — a FAILED smoke test is exactly when the\n   *   sizes are worth reading. Without this field kit had two options and both were\n   *   worse: drop the condition, losing the summary on the only runs that need it, or\n   *   `except('.github/workflows/ci.yml')`, which buys one repository its file back and\n   *   costs the estate the guarantee on it. One optional key gives every repository the\n   *   same freedom, which is the order of preference this module documents.\n   * ⚠️ NOT VALIDATED. GitHub's expression grammar is the vendor's; a bad condition is\n   *   caught by `actionlint` in the `workflow lint` job, which is where it belongs.\n   */\n  readonly if?: string;\n  readonly env?: Readonly<Record<string, string>>;\n} & (\n  | {\n      readonly uses: string;\n      readonly with?: Readonly<Record<string, string | number>>;\n      readonly run?: never;\n    }\n  | { readonly run: string; readonly uses?: never; readonly with?: never }\n);\n\n/**\n * ⛔ A REASON MUST BE WRITTEN, NOT COMPUTED. `'' extends R` is true for the empty literal\n *   AND for the wide `string` type, so both collapse to `never` and fail to typecheck:\n *   `reason: ''` is refused, and so is `reason: someVariable`. Only a string literal\n *   written at the call site survives — which is the whole point, because a reason\n *   assembled at runtime is a reason nobody reads in the diff.\n *   Verified against TypeScript 7.0.2 on 2026-09-22; `tests/repo-shape-reason.test.ts`\n *   compiles the refusals and asserts they still fail.\n */\nexport type Stated<R extends string> = '' extends R ? never : R;\n\n/** Paths this package renders. A deviation names one of these, not an arbitrary file. */\nexport type RenderedPath =\n  | '.changeset/config.json'\n  | '.github/actionlint.yaml'\n  | '.github/dependabot.yml'\n  | '.github/workflows/ci.yml'\n  | '.github/workflows/dependabot-automerge.yml'\n  | '.github/workflows/security.yml';\n\nexport interface RepoShapeException {\n  /** The rendered file this repository does not take from the renderer. */\n  readonly file: RenderedPath;\n  /** Why — written at the exception, in a sentence a stranger can act on. */\n  readonly reason: string;\n  /** `YYYY-MM-DD` the exception was taken, so a stale one is visible. */\n  readonly since: string;\n}\n\ninterface ExceptionInput {\n  readonly file: RenderedPath;\n  readonly reason: string;\n  readonly since: string;\n}\n\n/**\n * Declare that this repository keeps its own copy of a rendered file.\n *\n *     except({\n *       file: '.github/workflows/ci.yml',\n *       reason: 'Payload needs Node >=24.15, which the rendered job does not install',\n *       since: '2026-09-22',\n *     })\n *\n * ⛔ THE DRIFT CHECK STOPS CHECKING THAT FILE. That is the trade: an exception buys the\n *   freedom to hand-edit one file and pays for it by losing the guarantee on that file.\n *   Prefer widening `RepoShape` — then every repository benefits and nothing is lost.\n */\nexport function except<const E extends ExceptionInput>(\n  exception: E & { readonly reason: Stated<E['reason']> },\n): RepoShapeException {\n  return {\n    file: exception.file,\n    reason: requireSentence('reason', exception.reason),\n    since: requireIsoDate(exception.since),\n  };\n}\n\nexport interface ExtraJob {\n  /** The job key in `jobs:`, e.g. `package`. Lower-case, dashes allowed. */\n  readonly id: string;\n  /**\n   * The job's `name:`, which is also the status-check context. It joins the `ci`\n   * aggregate's `needs`, so the branch ruleset still requires exactly one check.\n   */\n  readonly name: string;\n  /** Why this repository has a job the other twelve do not. */\n  readonly reason: string;\n  /** Steps after checkout. The prologue (checkout, bun, install) is rendered for you. */\n  readonly steps: readonly JobStep[];\n  /** Job ids this one waits for. Default: none, so it runs beside `check`. */\n  readonly needs?: readonly string[];\n  /** `false` skips the rendered bun prologue — for a job that needs another toolchain. */\n  readonly bun?: boolean;\n  /**\n   * `timeout-minutes:` for this job. Omitted takes GitHub's 360-minute default.\n   *\n   * ⚠️ AN INPUT BECAUSE A HUNG JOB IS NOT A FAILED JOB. Measured 2026-09-22:\n   *   homeflare-blog's `runtime` job drives Playwright against a local workerd, and a\n   *   browser that never reaches its first paint holds a self-hosted slot for six hours\n   *   rather than reporting red. On a 3-slot pool that is the whole pool. Only a job\n   *   that starts something with its own wait — a browser, a server, a container — needs\n   *   this; `check` does not, because `bun run check` exits.\n   */\n  readonly timeout?: number;\n}\n\ninterface ExtraJobInput extends Omit<ExtraJob, 'needs' | 'bun' | 'timeout'> {\n  readonly needs?: readonly string[];\n  readonly bun?: boolean;\n  readonly timeout?: number;\n}\n\n/**\n * Declare a job this repository needs and the standard does not have.\n * ⛔ Same rule as `except`: the reason is a written literal or it does not compile.\n */\nexport function extraJob<const J extends ExtraJobInput>(\n  job: J & { readonly reason: Stated<J['reason']> },\n): ExtraJob {\n  if (job.steps.length === 0) {\n    throw new Error(`repo-shape: extra job \"${job.id}\" has no steps`);\n  }\n  return {\n    bun: job.bun ?? true,\n    id: requireJobId(job.id),\n    // ⚠️ A DISPLAY NAME IS NOT A SENTENCE. `build` and `consumer smoke test` are both\n    //   correct job names; only the REASON has to be prose, because only the reason is\n    //   there for a reader rather than for the checks list.\n    name: requireNonEmpty('name', job.name),\n    needs: [...(job.needs ?? [])],\n    reason: requireSentence('reason', job.reason),\n    steps: [...job.steps],\n    ...(job.timeout === undefined ? {} : { timeout: requireMinutes(job.timeout) }),\n  };\n}\n\nexport interface RepoShape {\n  /** Repository owner — a user or organization login. */\n  readonly owner: string;\n  /** Repository name, which is also the checkout directory name. */\n  readonly repository: string;\n  /** Where its jobs run. */\n  readonly runner: RepoRunner;\n  /**\n   * `true` when the repository publishes an npm tarball. It decides `access` in the\n   * changeset config and whether `privatePackages` is written at all — the two keys\n   * that differ between `homeflare-kit` and every other repository.\n   */\n  readonly publishes: boolean;\n  /**\n   * Node major to install before Bun, for a repository whose own gate needs a real\n   * `node` on `PATH`. Omit it — twelve of fourteen repositories are Bun-only.\n   *\n   * ⛔ AN INPUT, NOT AN EXCEPTION, AND THE MEASUREMENT SAYS WHY. The mini's job image\n   *   carries no node at all (ubuntu-latest always did), so a Bun-only prologue is right\n   *   for most of the estate and *silently wrong* for two repositories:\n   *     · homeflare-alerts — tests/alchemy-import.test.ts spawns `node` to prove the\n   *       modules load the way the Alchemy CLI (`node …/cli.js`) loads them. Without it,\n   *       three tests fail with `Executable not found in $PATH: \"node\"` (measured on the\n   *       runner, 2026-09-22).\n   *     · homeflare-blog — Payload requires Node >= 24.15, so every lane needs it.\n   *   Both repositories carried the same hand-written `actions/setup-node@v6` block\n   *   before this existed. Excepting `ci.yml` instead would hand the estate's two most\n   *   complicated CI files back to hand-editing, which is the opposite of the point.\n   *\n   * ⚠️ `package-manager-cache: false` IS RENDERED WITH IT. Bun does the installing here;\n   *   letting setup-node prime an npm cache costs time and caches nothing anyone reads.\n   */\n  readonly node?: number;\n  /** Jobs beyond `check` and `workflows`. Each carries its own stated reason. */\n  readonly extraJobs?: readonly ExtraJob[];\n  /** Rendered files this repository keeps its own copy of, each with a reason. */\n  readonly exceptions?: readonly RepoShapeException[];\n}\n\n/**\n * The validated Node major this shape asks for, or `undefined` for a Bun-only prologue.\n * ★ `RepoShape` is a plain object, so this is where `node:` is checked — at render, not\n *   at declaration. A bad value fails the refresh rather than the job.\n */\nexport function nodeMajor(shape: RepoShape): number | undefined {\n  return shape.node === undefined ? undefined : requireMajor(shape.node);\n}\n\n/** `runs-on:` for a runner. */\nexport function runsOn(runner: RepoRunner): string {\n  return runner === 'mini' ? '[self-hosted, homeflare-mini]' : 'ubuntu-latest';\n}\n\n/** Whether a rendered path is excepted by this shape. */\nexport function isExcepted(shape: RepoShape, file: RenderedPath): boolean {\n  return (shape.exceptions ?? []).some((exception) => exception.file === file);\n}\n",
-    "/**\n * The smallest YAML writer that renders a job's steps, and nothing else.\n *\n * ★ NOT A YAML LIBRARY, DELIBERATELY. A general serializer would take a dependency every\n *   consumer of `@homeflare/config` inherits, and it would strip the comments — which in\n *   this house are the product. The rendered workflows are written as text with holes;\n *   only the step lists, whose shape varies per repository, go through here.\n *\n * ⚠️ Bun can PARSE YAML natively (`Bun.YAML.parse`) but does not stringify it, measured\n *   against Bun 1.4.0 on 2026-09-22. The tests parse what this writes with `Bun.YAML.parse`\n *   and compare structures, so a malformed emission fails rather than shipping.\n */\nimport type { JobStep } from './shape.ts';\n\n/** Two spaces per level, the house indent and GitHub's own. */\nconst INDENT = '  ';\n\nfunction indent(depth: number): string {\n  return INDENT.repeat(depth);\n}\n\n/**\n * ⛔ QUOTE ANYTHING YAML WOULD RE-READ AS SOMETHING ELSE. `09:00` is a sexagesimal number\n *   in YAML 1.1 and `on`/`no` are booleans; an unquoted value that looks like either\n *   reaches GitHub as the wrong type, and the symptom is a schedule that never fires\n *   rather than an error.\n */\nconst PLAIN = /^[A-Za-z0-9_./][A-Za-z0-9_ ./@:+-]*$/;\nconst YAML_KEYWORD =\n  /^(y|Y|n|N|on|On|ON|no|No|NO|yes|Yes|YES|true|True|TRUE|false|False|FALSE|null|Null|NULL|~)$/;\n\nfunction scalar(value: string | number): string {\n  if (typeof value === 'number') return String(value);\n  if (value === '') return \"''\";\n  const plain =\n    PLAIN.test(value) &&\n    !YAML_KEYWORD.test(value) &&\n    !value.includes(': ') &&\n    !value.includes(' #') &&\n    // ⚠️ A LEADING DIGIT PLUS A COLON IS A YAML 1.1 SEXAGESIMAL NUMBER, not a string:\n    //   `09:00` would reach GitHub as an integer, and a schedule set to an integer\n    //   simply never fires. `bun run build:web` is safe because it does not start with\n    //   a digit, which is why this is narrower than \"contains a colon\".\n    !/^\\d.*:/.test(value) &&\n    value.trimEnd() === value;\n  return plain ? value : `'${value.replaceAll(\"'\", \"''\")}'`;\n}\n\nfunction renderMapping(\n  entries: Readonly<Record<string, string | number>>,\n  depth: number,\n): string[] {\n  return Object.entries(entries).map(([key, value]) => `${indent(depth)}${key}: ${scalar(value)}`);\n}\n\n/**\n * ★ BLOCK SCALAR FOR EVERY MULTI-LINE `run:`. A folded or quoted form would join the\n *   lines, and a shell script whose `if` and `then` end up on one line is a syntax error\n *   at job time rather than at lint time. `|` keeps them exactly as written.\n */\nfunction renderRun(command: string, depth: number): string[] {\n  const lines = command.replace(/\\n+$/, '').split('\\n');\n  if (lines.length === 1) return [`${indent(depth)}run: ${scalar(lines[0] ?? '')}`];\n  return [`${indent(depth)}run: |`, ...lines.map((line) => `${indent(depth + 1)}${line}`)];\n}\n\n/** One step, as the lines of a `steps:` list item at `depth`. */\nexport function renderStep(step: JobStep, depth: number): string[] {\n  const lines: string[] = [];\n  const body =\n    step.uses === undefined\n      ? renderRun(step.run ?? '', depth + 1)\n      : [`${indent(depth + 1)}uses: ${step.uses}`];\n\n  // ★ `name:` then `if:` then the body, because that is the order a reader scans: what\n  //   this step is, whether it runs, what it does. All three are ordinary mapping keys\n  //   to GitHub, so the order is for the person reading the diff, not the parser.\n  const head: string[] = [];\n  if (step.name !== undefined) head.push(`${indent(depth + 1)}name: ${scalar(step.name)}`);\n  if (step.if !== undefined) head.push(`${indent(depth + 1)}if: ${scalar(step.if)}`);\n\n  // ⚠️ The first line of the item carries the dash, whichever key it turns out to be —\n  //   an unnamed, unconditional step still inlines its `run:` or `uses:` after the dash\n  //   and lets any block body follow at its own indent.\n  const [first = '', ...rest] = [...head, ...body];\n  lines.push(`${indent(depth)}- ${first.trimStart()}`, ...rest);\n\n  if (step.with !== undefined && Object.keys(step.with).length > 0) {\n    lines.push(`${indent(depth + 1)}with:`, ...renderMapping(step.with, depth + 2));\n  }\n  if (step.env !== undefined && Object.keys(step.env).length > 0) {\n    lines.push(`${indent(depth + 1)}env:`, ...renderMapping(step.env, depth + 2));\n  }\n  return lines;\n}\n\n/** A whole `steps:` list, already indented for a job at `depth`. */\nexport function renderSteps(steps: readonly JobStep[], depth: number): string {\n  return steps.flatMap((step) => renderStep(step, depth)).join('\\n');\n}\n",
+    "/**\n * The smallest YAML writer that renders a job's steps, and nothing else.\n *\n * ★ NOT A YAML LIBRARY, DELIBERATELY. A general serializer would take a dependency every\n *   consumer of `@homeflare/config` inherits, and it would strip the comments — which in\n *   this house are the product. The rendered workflows are written as text with holes;\n *   only the step lists, whose shape varies per repository, go through here.\n *\n * ⚠️ Bun.YAML.stringify EXISTS (`Object.keys(Bun.YAML)` is `[\"parse\", \"stringify\"]`,\n *   measured against Bun 1.4.0 on 2026-09-23) but its output does not fit these rules:\n *   (a) a multi-line `run:` comes out as a double-quoted string with `\\n` escapes, e.g.\n *   `run: \"echo a\\necho b\\n\"`, not a `|` block scalar; (b) `09:00` comes out UNQUOTED,\n *   e.g. `cron: 09:00`, the YAML 1.1 sexagesimal trap the `scalar()` comment below guards\n *   against; (c) a mapping key is followed by a trailing space, e.g. `\"steps: \\n  - ...\"`;\n *   and (d) a plain JS object has nowhere to attach a comment, so it cannot carry one. The\n *   tests parse what this writes with `Bun.YAML.parse` and compare structures, so a\n *   malformed emission fails rather than shipping.\n */\nimport type { JobStep } from './shape.ts';\n\n/** Two spaces per level, the house indent and GitHub's own. */\nconst INDENT = '  ';\n\nfunction indent(depth: number): string {\n  return INDENT.repeat(depth);\n}\n\n/**\n * ⛔ QUOTE ANYTHING YAML WOULD RE-READ AS SOMETHING ELSE. `09:00` is a sexagesimal number\n *   in YAML 1.1 and `on`/`no` are booleans; an unquoted value that looks like either\n *   reaches GitHub as the wrong type, and the symptom is a schedule that never fires\n *   rather than an error.\n */\nconst PLAIN = /^[A-Za-z0-9_./][A-Za-z0-9_ ./@:+-]*$/;\nconst YAML_KEYWORD =\n  /^(y|Y|n|N|on|On|ON|no|No|NO|yes|Yes|YES|true|True|TRUE|false|False|FALSE|null|Null|NULL|~)$/;\n\nfunction scalar(value: string | number): string {\n  if (typeof value === 'number') return String(value);\n  if (value === '') return \"''\";\n  const plain =\n    PLAIN.test(value) &&\n    !YAML_KEYWORD.test(value) &&\n    !value.includes(': ') &&\n    !value.includes(' #') &&\n    // ⚠️ A LEADING DIGIT PLUS A COLON IS A YAML 1.1 SEXAGESIMAL NUMBER, not a string:\n    //   `09:00` would reach GitHub as an integer, and a schedule set to an integer\n    //   simply never fires. `bun run build:web` is safe because it does not start with\n    //   a digit, which is why this is narrower than \"contains a colon\".\n    !/^\\d.*:/.test(value) &&\n    value.trimEnd() === value;\n  return plain ? value : `'${value.replaceAll(\"'\", \"''\")}'`;\n}\n\nfunction renderMapping(\n  entries: Readonly<Record<string, string | number>>,\n  depth: number,\n): string[] {\n  return Object.entries(entries).map(([key, value]) => `${indent(depth)}${key}: ${scalar(value)}`);\n}\n\n/**\n * Trim trailing `\\n` characters the way `command.replace(/\\n+$/, '')` used to, but\n * linear instead of backtracking — the same pattern as `normalizeBaseUrl` in\n * `packages/distilled-netbox/src/credentials.ts`. Exported so a test can compare it\n * against the old regex directly.\n *\n * ⚠️ Linear on purpose: a `/\\n+$/` regex backtracks polynomially on a long run of\n *   \"\\n\" that is not at the end (CodeQL js/polynomial-redos), and `command` here is\n *   repository-configured step text.\n */\nexport function trimTrailingNewlines(value: string): string {\n  let end = value.length;\n  while (end > 0 && value.charCodeAt(end - 1) === 10) end--;\n  return value.slice(0, end);\n}\n\n/**\n * ★ BLOCK SCALAR FOR EVERY MULTI-LINE `run:`. A folded or quoted form would join the\n *   lines, and a shell script whose `if` and `then` end up on one line is a syntax error\n *   at job time rather than at lint time. `|` keeps them exactly as written.\n */\nfunction renderRun(command: string, depth: number): string[] {\n  const lines = trimTrailingNewlines(command).split('\\n');\n  if (lines.length === 1) return [`${indent(depth)}run: ${scalar(lines[0] ?? '')}`];\n  return [`${indent(depth)}run: |`, ...lines.map((line) => `${indent(depth + 1)}${line}`)];\n}\n\n/** One step, as the lines of a `steps:` list item at `depth`. */\nexport function renderStep(step: JobStep, depth: number): string[] {\n  const lines: string[] = [];\n  const body =\n    step.uses === undefined\n      ? renderRun(step.run ?? '', depth + 1)\n      : [`${indent(depth + 1)}uses: ${step.uses}`];\n\n  // ★ `name:` then `if:` then the body, because that is the order a reader scans: what\n  //   this step is, whether it runs, what it does. All three are ordinary mapping keys\n  //   to GitHub, so the order is for the person reading the diff, not the parser.\n  const head: string[] = [];\n  if (step.name !== undefined) head.push(`${indent(depth + 1)}name: ${scalar(step.name)}`);\n  if (step.if !== undefined) head.push(`${indent(depth + 1)}if: ${scalar(step.if)}`);\n\n  // ⚠️ The first line of the item carries the dash, whichever key it turns out to be —\n  //   an unnamed, unconditional step still inlines its `run:` or `uses:` after the dash\n  //   and lets any block body follow at its own indent.\n  const [first = '', ...rest] = [...head, ...body];\n  lines.push(`${indent(depth)}- ${first.trimStart()}`, ...rest);\n\n  if (step.with !== undefined && Object.keys(step.with).length > 0) {\n    lines.push(`${indent(depth + 1)}with:`, ...renderMapping(step.with, depth + 2));\n  }\n  if (step.env !== undefined && Object.keys(step.env).length > 0) {\n    lines.push(`${indent(depth + 1)}env:`, ...renderMapping(step.env, depth + 2));\n  }\n  return lines;\n}\n\n/** A whole `steps:` list, already indented for a job at `depth`. */\nexport function renderSteps(steps: readonly JobStep[], depth: number): string {\n  return steps.flatMap((step) => renderStep(step, depth)).join('\\n');\n}\n",
     "/**\n * `.github/workflows/ci.yml`, rendered.\n *\n * ★ THE COMMENTS ARE PART OF THE RENDER, NOT DECORATION. Thirteen repositories carried\n *   thirteen hand-edited copies of the same reasoning; measured 2026-09-22, the header\n *   comment alone had four different wordings and the actionlint block had three. Written\n *   here once, every repository gets the same explanation, and correcting it is one edit.\n *\n * ⛔ THE AGGREGATE `ci` JOB IS THE ONLY REQUIRED CHECK. Every other job feeds it through\n *   `needs`, so adding a job never means editing a branch ruleset. `repoShapeChecks()`\n *   returns exactly `['ci', 'secret scan']`, which is what `declareRepoPolicy` requires.\n */\nimport type { ExtraJob, JobStep, RepoShape } from './shape.ts';\nimport { nodeMajor, runsOn } from './shape.ts';\nimport { renderSteps } from './yaml.ts';\n\n/** Bun the whole estate is pinned to. One line, one place. */\nexport const BUN_VERSION = '1.4.0';\n/** actionlint the `workflow lint` job runs, and the mini's job image preloads. */\nexport const ACTIONLINT_VERSION = '1.7.12';\n\nconst CHECKOUT = 'actions/checkout@v7';\nconst SETUP_BUN = 'oven-sh/setup-bun@v2';\nconst SETUP_NODE = 'actions/setup-node@v6';\n\nfunction runnerNote(shape: RepoShape): string {\n  if (shape.runner !== 'mini') {\n    return \"# ⚠️ RUNS ON GitHub-HOSTED `ubuntu-latest`. Only a public repository should: hosted minutes\\n#   are refused for this account's private repos (billing lock, 2026-09-22).\\n\";\n  }\n  return [\n    '# ⚠️ RUNS ON THE MINI (`[self-hosted, homeflare-mini]`): GitHub-hosted runners are refused for',\n    '#   this account (billing lock, 2026-09-22), so every job here runs in a one-job Linux arm64',\n    \"#   container started by homeflare-mini's src/ci-runner (docs/ci-runner.md there). Each action\",\n    `#   below was checked for linux/arm64. The job image preloads bun ${\n      BUN_VERSION\n    } where setup-bun`,\n    '#   looks, gh, actionlint, gitleaks, typos and shfmt; no node on PATH.',\n    '',\n  ].join('\\n');\n}\n\nconst HEADER = `# Pull requests: is this code correct?\n#\n# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.\n#    Its input is this repository's \\`repo-shape.ts\\`. Change that, then:\n#        bun run repo-shape:refresh\n#    A hand edit is reverted by the next refresh and fails \\`bun run check\\` before that.\n#    A file this repository must own outright is declared as an \\`except({...})\\` with a\n#    reason, which stops the check from comparing it — see @homeflare/config/repo-shape.\n#\n# ★ SPLIT BY CONCERN, NOT ONE BIG JOB — AND NOT ONE JOB PER COMMAND EITHER: lanes that\n#   share a prologue are steps inside \\`check\\`, so the install is paid once.\n# ⛔ EVERY ACTION IS FIRST-PARTY OR THE VENDOR'S OWN, PINNED TO A MAJOR TAG.\n`;\n\nconst TRIGGER = `name: ci\n\non:\n  # ⛔ NO \\`push: branches: [main]\\`. Every commit reaches main through a pull request whose\n  #   \\`ci\\` had to be green — the branch ruleset requires it and carries no bypass actors —\n  #   so a second run on the squash commit recomputed an answer it already had. Measured\n  #   2026-09-15..22 across the estate: 613 of 619 main-push runs had a head_sha identical\n  #   to the merge_commit_sha of an already-green PR. That duplication was ~41% of the Mac\n  #   mini's entire CI load.\n  # ⚠️ WHAT THIS GIVES UP, SAID OUT LOUD: the ~4% of merges whose base DID move between the\n  #   PR run and the squash no longer get a post-merge re-test. That run gated nothing — it\n  #   reported after main already had the commit — and the next PR, which branches from the\n  #   merged main, is what actually catches a semantic conflict.\n  pull_request:\n\npermissions:\n  contents: read\n\nconcurrency:\n  group: ci-\\${{ github.ref }}\n  cancel-in-progress: true\n`;\n\nconst CHECK_NOTE = `  # ── One job, one install ────────────────────────────────────────────────────\n  # ★ WAS 3 SEPARATE JOBS: lint and format, types, tests. They shared an identical\n  #   prologue — checkout, setup-bun, \\`bun install --frozen-lockfile\\` — and the install,\n  #   not the check, was the cost: measured on the mini 2026-09-22, install p50 51s /\n  #   p90 81s against 1-3s for the command the install existed to enable. 3 jobs meant 3\n  #   installs and 3 containers to compute one answer, and on a 3-slot pool that was one\n  #   pull request asking for every slot to answer a single question.\n  # ⛔ ONE STEP: \\`bun run check\\`, THE REPOSITORY'S OWN GATE, NOT A COPY OF ITS LANES.\n  #   The house rule is that CI runs the same command a person runs, and a workflow that\n  #   re-lists \\`lint\\`, \\`types\\`, \\`test\\` is a second copy of that command which can quietly\n  #   check LESS than the local gate. Measured 2026-09-22: \\`bun run check\\` in homeflare-kit\n  #   is \\`lint && types && build && test\\`, and its tests/dist.test.ts SKIPS ITSELF when\n  #   dist/ is absent — so a workflow running lint/types/test without the build would drop\n  #   that test silently and still report green. homeflare-alerts' check runs\n  #   \\`check:types\\` and \\`build:web\\`; homeflare-subnet-calc's delegates to \\`verify\\`. All\n  #   fourteen repositories have a \\`check\\` script and every one is local-only — no network,\n  #   no deploy. Checked, not assumed.\n  # ★ THE SPLIT OF RESPONSIBILITY: this renderer owns the PLUMBING — triggers, permissions,\n  #   concurrency, runner, action versions, the aggregate gate — and the repository owns\n  #   WHAT ITS GATE RUNS, in package.json, where a change to it shows up in that\n  #   repository's own diff rather than in a workflow nobody reads.\n  # ⚠️ THE TRADE, STATED: a red X says \\`check\\` rather than naming the lane. \\`bun run check\\`\n  #   short-circuits on the first failure and its output names the lane, which is the same\n  #   signal a person gets locally.`;\n\nconst WORKFLOWS_NOTE = `  # ★ \\`workflow lint\\` STAYS ITS OWN JOB on purpose: it needs no \\`bun install\\` at all\n  #   (actionlint is preloaded on the mini's job image — measured 5s end to end), so\n  #   folding it into \\`check\\` would make a YAML-only change pay the install for nothing.`;\n\nconst ACTIONLINT_NOTE = `      # ⛔ THERE IS NO FIRST-PARTY actionlint ACTION, and the npm package by that name is\n      #   an unrelated wasm port with no \\`bin\\`. The vendor's own documented CI path is\n      #   \\`download-actionlint.bash\\` — but that script does NOT verify a checksum (read at\n      #   the v${ACTIONLINT_VERSION} tag, 2026-09-16: \\`curl -L \"$url\" | tar xvz\\`, no sha256sum anywhere).\n      #   rhysd's releases DO publish a \\`_checksums.txt\\` per version; this verifies against\n      #   that instead of trusting the tarball on receipt.\n      # ⚠️ ARCH FROM THE RUNNER, NOT HARD-CODED: the mini's runners are arm64, and an amd64\n      #   binary fails with \"exec format error\" (the checksum file lists both).`;\n\nconst INSTALL_ACTIONLINT = `set -euo pipefail\nversion=${ACTIONLINT_VERSION}\nif command -v actionlint >/dev/null 2>&1 &&\n  [ \"$(actionlint -version 2>/dev/null | sed -n 1p)\" = \"\\${version}\" ]; then\n  cp \"$(command -v actionlint)\" ./actionlint\n  exit 0\nfi\ncase \"$(uname -m)\" in\n  x86_64) arch=amd64 ;;\n  aarch64 | arm64) arch=arm64 ;;\n  *) echo \"unsupported architecture $(uname -m)\" >&2; exit 1 ;;\nesac\nfile=\"actionlint_\\${version}_linux_\\${arch}.tar.gz\"\nbase=\"https://github.com/rhysd/actionlint/releases/download/v\\${version}\"\ncurl -sSfLO \"\\${base}/\\${file}\"\ncurl -sSfLO \"\\${base}/actionlint_\\${version}_checksums.txt\"\ngrep \" \\${file}\\\\$\" \"actionlint_\\${version}_checksums.txt\" | sha256sum -c -\ntar xzf \"\\${file}\" actionlint`;\n\nconst AGGREGATE_NOTE = `  # ── The one check a branch rule can require ─────────────────────────────────\n  # ★ A single required check that depends on all of them. Without this, adding a job\n  #   means editing the branch ruleset too, and forgetting to means the new job is\n  #   advisory without anyone noticing.\n  # ⛔ FAILS ON ANYTHING OTHER THAN success, INCLUDING skipped. A job result has exactly\n  #   four values: success, failure, cancelled, skipped. Checking only the first two lets\n  #   a skipped job — a bad \\`if:\\` condition, a misconfigured dependency, a runner picking\n  #   up nothing — report this aggregate green with a required job never having run.`;\n\nconst VERIFY = `if [ \"\\${{ contains(needs.*.result, 'failure') }}\" = \"true\" ] || \\\\\n   [ \"\\${{ contains(needs.*.result, 'cancelled') }}\" = \"true\" ] || \\\\\n   [ \"\\${{ contains(needs.*.result, 'skipped') }}\" = \"true\" ]; then\n  echo \"one or more required jobs did not succeed: \\${{ toJSON(needs.*.result) }}\" >&2\n  exit 1\nfi`;\n\nconst NODE_NOTE = `      # ⛔ REAL NODE, NOT BUN'S SHIM, AND ONLY WHERE THE GATE NEEDS IT. The mini's job\n      #   image has no node on PATH (ubuntu-latest always did), so a repository whose own\n      #   \\`check\\` spawns \\`node\\` — or whose framework demands a Node runtime — fails with\n      #   \\`Executable not found in $PATH: \"node\"\\` without this. Declared as \\`node:\\` in\n      #   repo-shape.ts, so it is one input rather than a hand-edited block per repository.\n      # ⚠️ NO PACKAGE-MANAGER CACHE: bun does the installing, so priming npm's cache costs\n      #   time and caches nothing anything here reads.`;\n\nfunction prologue(shape: RepoShape): string {\n  const node = nodeMajor(shape);\n  const bun: JobStep[] = [\n    { uses: SETUP_BUN, with: { 'bun-version': BUN_VERSION } },\n    { run: 'bun install --frozen-lockfile' },\n  ];\n  if (node === undefined) return renderSteps([{ uses: CHECKOUT }, ...bun], 3);\n  return [\n    renderSteps([{ uses: CHECKOUT }], 3),\n    NODE_NOTE,\n    renderSteps(\n      [{ uses: SETUP_NODE, with: { 'node-version': node, 'package-manager-cache': 'false' } }],\n      3,\n    ),\n    renderSteps(bun, 3),\n  ].join('\\n');\n}\n\nfunction renderExtraJob(job: ExtraJob, shape: RepoShape, on: string): string {\n  const needs =\n    (job.needs ?? []).length === 0 ? '' : `    needs: [${(job.needs ?? []).join(', ')}]\\n`;\n  // ★ A TIMEOUT IS THE JOB'S, NOT THE SHAPE'S. Only a job that starts something with its\n  //   own wait needs one, and it is rendered where a reader looks for it.\n  const timeout = job.timeout === undefined ? '' : `    timeout-minutes: ${job.timeout}\\n`;\n  const steps =\n    job.bun === false\n      ? renderSteps([{ uses: CHECKOUT }, ...job.steps], 3)\n      : [prologue(shape), renderSteps(job.steps, 3)].join('\\n');\n  // ★ The stated reason is rendered into the file. A job nobody can explain is a job\n  //   nobody dares delete, so the explanation travels with it.\n  return `  # ★ NOT PART OF THE STANDARD SHAPE — ${job.reason}\n  ${job.id}:\n    name: ${job.name}\n${needs}    runs-on: ${on}\n${timeout}    steps:\n${steps}\n`;\n}\n\n/** The whole `ci.yml` for a shape. */\nexport function renderCi(shape: RepoShape): string {\n  const on = runsOn(shape.runner);\n  const extras = shape.extraJobs ?? [];\n  const needs = ['check', 'workflows', ...extras.map((job) => job.id)];\n\n  return `${HEADER}${runnerNote(shape)}${TRIGGER}\njobs:\n${CHECK_NOTE}\n  check:\n    name: check\n    runs-on: ${on}\n    steps:\n${prologue(shape)}\n${renderSteps([{ run: 'bun run check' }], 3)}\n\n${WORKFLOWS_NOTE}\n  workflows:\n    name: workflow lint\n    runs-on: ${on}\n    steps:\n${renderSteps([{ uses: CHECKOUT }], 3)}\n${ACTIONLINT_NOTE}\n${renderSteps([{ name: 'Install actionlint (checksum-verified)', run: INSTALL_ACTIONLINT }], 3)}\n${renderSteps([{ name: 'Lint workflows', run: './actionlint -color' }], 3)}\n\n${extras.map((job) => `${renderExtraJob(job, shape, on)}\\n`).join('')}${AGGREGATE_NOTE}\n  ci:\n    name: ci\n    if: always()\n    needs: [${needs.join(', ')}]\n    runs-on: ${on}\n    steps:\n${renderSteps([{ name: 'Verify every job succeeded', run: VERIFY }], 3)}\n`;\n}\n",
     "/**\n * `@homeflare/config/versions`: the one aligned set of versions the estate runs.\n *\n *     import { ESTATE_VERSIONS } from '@homeflare/config/versions';\n *     ESTATE_VERSIONS.alchemy; // '2.0.0-beta.79'\n *\n * ★ WHY IT LIVES HERE. Until this file, the set had two homes and neither was reachable from\n *   outside the kit. Bun was `BUN_VERSION` in repo-shape/ci.ts. Every other pin sat in\n *   homeflare-kit's root `catalog`, which is authoritative but never published. Measured\n *   2026-09-22, read-only, from each repository's lockfile: seven app repositories resolve\n *   `alchemy` 2.0.0-beta.78, the monorepo resolves beta.77 with `effect` rc.112, and one app\n *   resolves TypeScript 5.9.3. None of them had anything to compare against.\n *   `@homeflare/config` is the one package almost every estate repository already depends\n *   on (repo-shape.ts header: 13 of 14), so the set goes here.\n *\n * ⛔ THE KIT'S ROOT CATALOG STAYS AUTHORITATIVE. `tests/estate-versions.test.ts` fails when any\n *   value below differs from it, and it also fails when `bun` differs from `BUN_VERSION` or\n *   from the root's `packageManager`. A catalog bump that does not reach this file is\n *   therefore a red test in the same PR. Otherwise the estate would drift from a published\n *   source that looks correct.\n *\n * ★ RUNTIME PINS FOLLOW THE PINNED ALCHEMY RELEASE, NEVER THE OTHER WAY. `effect` and\n *   `@distilled.cloud/cloudflare` are the versions `alchemy@2.0.0-beta.79` was built and\n *   tested against. That release's own `dependencies` pin every `@distilled.cloud/*` at\n *   exactly 1.0.0-rc.12, and its workspace overrides pin `effect` 4.0.0-rc.115\n *   (alchemy-run/alchemy `pnpm-workspace.yaml@v2.0.0-beta.79#overrides`). The test reads the\n *   installed `alchemy/package.json` to prove the distilled pin. These values move only in\n *   the same PR as the `alchemy` bump.\n *\n * ⚠️ PUBLISHING THE SET ENFORCES NOTHING. No consumer check reads it yet. Wiring it into\n *   `checkProject`, so that each repository's lockfile is compared with it, is a separate,\n *   estate-wide rollout. Doing that here would turn the next bump into thirteen red CIs at\n *   once.\n */\nimport { BUN_VERSION } from './repo-shape/ci.ts';\n\n/** The package names the set pins. One entry per tool or runtime the whole estate shares. */\nexport type EstatePackage =\n  | 'bun'\n  | 'alchemy'\n  | 'effect'\n  | '@distilled.cloud/cloudflare'\n  | 'typescript'\n  | 'oxfmt'\n  | 'oxlint'\n  | '@types/bun';\n\n/**\n * Exact versions, never ranges. A range is what lets two repositories resolve two different\n * versions from one line, which is exactly the drift this set exists to name.\n */\nexport const ESTATE_VERSIONS: Readonly<Record<EstatePackage, string>> = {\n  bun: BUN_VERSION,\n  alchemy: '2.0.0-beta.79',\n  effect: '4.0.0-rc.115',\n  '@distilled.cloud/cloudflare': '1.0.0-rc.12',\n  typescript: '7.0.2',\n  oxfmt: '0.68.0',\n  oxlint: '1.83.0',\n  '@types/bun': '1.4.2',\n};\n"
   ],
-  "mappings": ";;AAaA,IAAM,WAAW;AAEV,SAAS,eAAe,CAAC,OAAe,OAAuB;AAAA,EACpE,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,IAAI,QAAQ,WAAW;AAAA,IAAG,MAAM,IAAI,MAAM,eAAe,yBAAyB;AAAA,EAClF,OAAO;AAAA;AAGF,SAAS,eAAe,CAAC,OAAe,OAAuB;AAAA,EACpE,MAAM,UAAU,MAAM,KAAK;AAAA,EAG3B,IAAI,QAAQ,SAAS,UAAU;AAAA,IAC7B,MAAM,IAAI,MAAM,eAAe,iCAAiC,KAAK,UAAU,KAAK,GAAG;AAAA,EACzF;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,cAAc,CAAC,OAAuB;AAAA,EACpD,IAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG;AAAA,IACtC,MAAM,IAAI,MAAM,6CAA6C,KAAK,UAAU,KAAK,GAAG;AAAA,EACtF;AAAA,EACA,OAAO;AAAA;AAQF,SAAS,YAAY,CAAC,OAAuB;AAAA,EAClD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AAAA,IAC1C,MAAM,IAAI,MAAM,0DAA0D,OAAO;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,cAAc,CAAC,OAAuB;AAAA,EACpD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AAAA,IAC1C,MAAM,IAAI,MAAM,kEAAkE,OAAO;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,YAAY,CAAC,OAAuB;AAAA,EAGlD,IAAI,CAAC,qBAAqB,KAAK,KAAK,GAAG;AAAA,IACrC,MAAM,IAAI,MACR,2DAA2D,KAAK,UAAU,KAAK,GACjF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACqDF,SAAS,MAAsC,CACpD,WACoB;AAAA,EACpB,OAAO;AAAA,IACL,MAAM,UAAU;AAAA,IAChB,QAAQ,gBAAgB,UAAU,UAAU,MAAM;AAAA,IAClD,OAAO,eAAe,UAAU,KAAK;AAAA,EACvC;AAAA;AA0CK,SAAS,QAAuC,CACrD,KACU;AAAA,EACV,IAAI,IAAI,MAAM,WAAW,GAAG;AAAA,IAC1B,MAAM,IAAI,MAAM,0BAA0B,IAAI,kBAAkB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA,IACL,KAAK,IAAI,OAAO;AAAA,IAChB,IAAI,aAAa,IAAI,EAAE;AAAA,IAIvB,MAAM,gBAAgB,QAAQ,IAAI,IAAI;AAAA,IACtC,OAAO,CAAC,GAAI,IAAI,SAAS,CAAC,CAAE;AAAA,IAC5B,QAAQ,gBAAgB,UAAU,IAAI,MAAM;AAAA,IAC5C,OAAO,CAAC,GAAG,IAAI,KAAK;AAAA,OAChB,IAAI,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,eAAe,IAAI,OAAO,EAAE;AAAA,EAC9E;AAAA;AA+CK,SAAS,SAAS,CAAC,OAAsC;AAAA,EAC9D,OAAO,MAAM,SAAS,YAAY,YAAY,aAAa,MAAM,IAAI;AAAA;AAIhE,SAAS,MAAM,CAAC,QAA4B;AAAA,EACjD,OAAO,WAAW,SAAS,kCAAkC;AAAA;AAIxD,SAAS,UAAU,CAAC,OAAkB,MAA6B;AAAA,EACxE,QAAQ,MAAM,cAAc,CAAC,GAAG,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI;AAAA;;;ACpO7E,IAAM,SAAS;AAEf,SAAS,MAAM,CAAC,OAAuB;AAAA,EACrC,OAAO,OAAO,OAAO,KAAK;AAAA;AAS5B,IAAM,QAAQ;AACd,IAAM,eACJ;AAEF,SAAS,MAAM,CAAC,OAAgC;AAAA,EAC9C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,OAAO,KAAK;AAAA,EAClD,IAAI,UAAU;AAAA,IAAI,OAAO;AAAA,EACzB,MAAM,QACJ,MAAM,KAAK,KAAK,KAChB,CAAC,aAAa,KAAK,KAAK,KACxB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,MAAM,SAAS,IAAI,KAKpB,CAAC,SAAS,KAAK,KAAK,KACpB,MAAM,QAAQ,MAAM;AAAA,EACtB,OAAO,QAAQ,QAAQ,IAAI,MAAM,WAAW,KAAK,IAAI;AAAA;AAGvD,SAAS,aAAa,CACpB,SACA,OACU;AAAA,EACV,OAAO,OAAO,QAAQ,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,KAAK,IAAI,QAAQ,OAAO,KAAK,GAAG;AAAA;AAQjG,SAAS,SAAS,CAAC,SAAiB,OAAyB;AAAA,EAC3D,MAAM,QAAQ,QAAQ,QAAQ,QAAQ,EAAE,EAAE,MAAM;AAAA,CAAI;AAAA,EACpD,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO,CAAC,GAAG,OAAO,KAAK,SAAS,OAAO,MAAM,MAAM,EAAE,GAAG;AAAA,EAChF,OAAO,CAAC,GAAG,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,GAAG,OAAO,QAAQ,CAAC,IAAI,MAAM,CAAC;AAAA;AAIlF,SAAS,UAAU,CAAC,MAAe,OAAyB;AAAA,EACjE,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OACJ,KAAK,SAAS,YACV,UAAU,KAAK,OAAO,IAAI,QAAQ,CAAC,IACnC,CAAC,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,MAAM;AAAA,EAK/C,MAAM,OAAiB,CAAC;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAW,KAAK,KAAK,GAAG,OAAO,QAAQ,CAAC,UAAU,OAAO,KAAK,IAAI,GAAG;AAAA,EACvF,IAAI,KAAK,OAAO;AAAA,IAAW,KAAK,KAAK,GAAG,OAAO,QAAQ,CAAC,QAAQ,OAAO,KAAK,EAAE,GAAG;AAAA,EAKjF,OAAO,QAAQ,OAAO,QAAQ,CAAC,GAAG,MAAM,GAAG,IAAI;AAAA,EAC/C,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,MAAM,UAAU,KAAK,GAAG,IAAI;AAAA,EAE5D,IAAI,KAAK,SAAS,aAAa,OAAO,KAAK,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,IAChE,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,UAAU,GAAG,cAAc,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EAChF;AAAA,EACA,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,GAAG,EAAE,SAAS,GAAG;AAAA,IAC9D,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,SAAS,GAAG,cAAc,KAAK,KAAK,QAAQ,CAAC,CAAC;AAAA,EAC9E;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,WAAW,CAAC,OAA2B,OAAuB;AAAA,EAC5E,OAAO,MAAM,QAAQ,CAAC,SAAS,WAAW,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA;;;ACjF5D,IAAM,cAAc;AAEpB,IAAM,qBAAqB;AAElC,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,aAAa;AAEnB,SAAS,UAAU,CAAC,OAA0B;AAAA,EAC5C,IAAI,MAAM,WAAW,QAAQ;AAAA,IAC3B,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEACE;AAAA,IAEF;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcf,IAAM,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBhB,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyBnB,IAAM,iBAAiB;AAAA;AAAA;AAIvB,IAAM,kBAAkB;AAAA;AAAA;AAAA,iBAGP;AAAA;AAAA;AAAA;AAAA;AAMjB,IAAM,qBAAqB;AAAA,UACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBV,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASvB,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAOf,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQlB,SAAS,QAAQ,CAAC,OAA0B;AAAA,EAC1C,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,MAAM,MAAiB;AAAA,IACrB,EAAE,MAAM,WAAW,MAAM,EAAE,eAAe,YAAY,EAAE;AAAA,IACxD,EAAE,KAAK,gCAAgC;AAAA,EACzC;AAAA,EACA,IAAI,SAAS;AAAA,IAAW,OAAO,YAAY,CAAC,EAAE,MAAM,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC;AAAA,EAC1E,OAAO;AAAA,IACL,YAAY,CAAC,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;AAAA,IACnC;AAAA,IACA,YACE,CAAC,EAAE,MAAM,YAAY,MAAM,EAAE,gBAAgB,MAAM,yBAAyB,QAAQ,EAAE,CAAC,GACvF,CACF;AAAA,IACA,YAAY,KAAK,CAAC;AAAA,EACpB,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,SAAS,cAAc,CAAC,KAAe,OAAkB,IAAoB;AAAA,EAC3E,MAAM,SACH,IAAI,SAAS,CAAC,GAAG,WAAW,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,GAAG,KAAK,IAAI;AAAA;AAAA,EAGlF,MAAM,UAAU,IAAI,YAAY,YAAY,KAAK,wBAAwB,IAAI;AAAA;AAAA,EAC7E,MAAM,QACJ,IAAI,QAAQ,QACR,YAAY,CAAC,EAAE,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,IACjD,CAAC,SAAS,KAAK,GAAG,YAAY,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA,EAG5D,OAAO,oDAA0C,IAAI;AAAA,IACnD,IAAI;AAAA,YACI,IAAI;AAAA,EACd,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA;AAAA;AAKK,SAAS,QAAQ,CAAC,OAA0B;AAAA,EACjD,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EAC9B,MAAM,SAAS,MAAM,aAAa,CAAC;AAAA,EACnC,MAAM,QAAQ,CAAC,SAAS,aAAa,GAAG,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAAA,EAEnE,OAAO,GAAG,SAAS,WAAW,KAAK,IAAI;AAAA;AAAA,EAEvC;AAAA;AAAA;AAAA,eAGa;AAAA;AAAA,EAEb,SAAS,KAAK;AAAA,EACd,YAAY,CAAC,EAAE,KAAK,gBAAgB,CAAC,GAAG,CAAC;AAAA;AAAA,EAEzC;AAAA;AAAA;AAAA,eAGa;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;AAAA,EACnC;AAAA,EACA,YAAY,CAAC,EAAE,MAAM,0CAA0C,KAAK,mBAAmB,CAAC,GAAG,CAAC;AAAA,EAC5F,YAAY,CAAC,EAAE,MAAM,kBAAkB,KAAK,sBAAsB,CAAC,GAAG,CAAC;AAAA;AAAA,EAEvE,OAAO,IAAI,CAAC,QAAQ,GAAG,eAAe,KAAK,OAAO,EAAE;AAAA,CAAK,EAAE,KAAK,EAAE,IAAI;AAAA;AAAA;AAAA;AAAA,cAI1D,MAAM,KAAK,IAAI;AAAA,eACd;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,8BAA8B,KAAK,OAAO,CAAC,GAAG,CAAC;AAAA;AAAA;;;ACpL/D,IAAM,kBAA2D;AAAA,EACtE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,+BAA+B;AAAA,EAC/B,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,cAAc;AAChB;",
-  "debugId": "B457A8EBCFEA8F5F64756E2164756E21",
+  "mappings": ";;AAaA,IAAM,WAAW;AAEV,SAAS,eAAe,CAAC,OAAe,OAAuB;AAAA,EACpE,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,IAAI,QAAQ,WAAW;AAAA,IAAG,MAAM,IAAI,MAAM,eAAe,yBAAyB;AAAA,EAClF,OAAO;AAAA;AAGF,SAAS,eAAe,CAAC,OAAe,OAAuB;AAAA,EACpE,MAAM,UAAU,MAAM,KAAK;AAAA,EAG3B,IAAI,QAAQ,SAAS,UAAU;AAAA,IAC7B,MAAM,IAAI,MAAM,eAAe,iCAAiC,KAAK,UAAU,KAAK,GAAG;AAAA,EACzF;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,cAAc,CAAC,OAAuB;AAAA,EACpD,IAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG;AAAA,IACtC,MAAM,IAAI,MAAM,6CAA6C,KAAK,UAAU,KAAK,GAAG;AAAA,EACtF;AAAA,EACA,OAAO;AAAA;AAQF,SAAS,YAAY,CAAC,OAAuB;AAAA,EAClD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AAAA,IAC1C,MAAM,IAAI,MAAM,0DAA0D,OAAO;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,cAAc,CAAC,OAAuB;AAAA,EACpD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AAAA,IAC1C,MAAM,IAAI,MAAM,kEAAkE,OAAO;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,YAAY,CAAC,OAAuB;AAAA,EAGlD,IAAI,CAAC,qBAAqB,KAAK,KAAK,GAAG;AAAA,IACrC,MAAM,IAAI,MACR,2DAA2D,KAAK,UAAU,KAAK,GACjF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACqDF,SAAS,MAAsC,CACpD,WACoB;AAAA,EACpB,OAAO;AAAA,IACL,MAAM,UAAU;AAAA,IAChB,QAAQ,gBAAgB,UAAU,UAAU,MAAM;AAAA,IAClD,OAAO,eAAe,UAAU,KAAK;AAAA,EACvC;AAAA;AA0CK,SAAS,QAAuC,CACrD,KACU;AAAA,EACV,IAAI,IAAI,MAAM,WAAW,GAAG;AAAA,IAC1B,MAAM,IAAI,MAAM,0BAA0B,IAAI,kBAAkB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA,IACL,KAAK,IAAI,OAAO;AAAA,IAChB,IAAI,aAAa,IAAI,EAAE;AAAA,IAIvB,MAAM,gBAAgB,QAAQ,IAAI,IAAI;AAAA,IACtC,OAAO,CAAC,GAAI,IAAI,SAAS,CAAC,CAAE;AAAA,IAC5B,QAAQ,gBAAgB,UAAU,IAAI,MAAM;AAAA,IAC5C,OAAO,CAAC,GAAG,IAAI,KAAK;AAAA,OAChB,IAAI,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,eAAe,IAAI,OAAO,EAAE;AAAA,EAC9E;AAAA;AA+CK,SAAS,SAAS,CAAC,OAAsC;AAAA,EAC9D,OAAO,MAAM,SAAS,YAAY,YAAY,aAAa,MAAM,IAAI;AAAA;AAIhE,SAAS,MAAM,CAAC,QAA4B;AAAA,EACjD,OAAO,WAAW,SAAS,kCAAkC;AAAA;AAIxD,SAAS,UAAU,CAAC,OAAkB,MAA6B;AAAA,EACxE,QAAQ,MAAM,cAAc,CAAC,GAAG,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI;AAAA;;;AC9N7E,IAAM,SAAS;AAEf,SAAS,MAAM,CAAC,OAAuB;AAAA,EACrC,OAAO,OAAO,OAAO,KAAK;AAAA;AAS5B,IAAM,QAAQ;AACd,IAAM,eACJ;AAEF,SAAS,MAAM,CAAC,OAAgC;AAAA,EAC9C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,OAAO,KAAK;AAAA,EAClD,IAAI,UAAU;AAAA,IAAI,OAAO;AAAA,EACzB,MAAM,QACJ,MAAM,KAAK,KAAK,KAChB,CAAC,aAAa,KAAK,KAAK,KACxB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,MAAM,SAAS,IAAI,KAKpB,CAAC,SAAS,KAAK,KAAK,KACpB,MAAM,QAAQ,MAAM;AAAA,EACtB,OAAO,QAAQ,QAAQ,IAAI,MAAM,WAAW,KAAK,IAAI;AAAA;AAGvD,SAAS,aAAa,CACpB,SACA,OACU;AAAA,EACV,OAAO,OAAO,QAAQ,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,KAAK,IAAI,QAAQ,OAAO,KAAK,GAAG;AAAA;AAa1F,SAAS,oBAAoB,CAAC,OAAuB;AAAA,EAC1D,IAAI,MAAM,MAAM;AAAA,EAChB,OAAO,MAAM,KAAK,MAAM,WAAW,MAAM,CAAC,MAAM;AAAA,IAAI;AAAA,EACpD,OAAO,MAAM,MAAM,GAAG,GAAG;AAAA;AAQ3B,SAAS,SAAS,CAAC,SAAiB,OAAyB;AAAA,EAC3D,MAAM,QAAQ,qBAAqB,OAAO,EAAE,MAAM;AAAA,CAAI;AAAA,EACtD,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO,CAAC,GAAG,OAAO,KAAK,SAAS,OAAO,MAAM,MAAM,EAAE,GAAG;AAAA,EAChF,OAAO,CAAC,GAAG,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,GAAG,OAAO,QAAQ,CAAC,IAAI,MAAM,CAAC;AAAA;AAIlF,SAAS,UAAU,CAAC,MAAe,OAAyB;AAAA,EACjE,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OACJ,KAAK,SAAS,YACV,UAAU,KAAK,OAAO,IAAI,QAAQ,CAAC,IACnC,CAAC,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,MAAM;AAAA,EAK/C,MAAM,OAAiB,CAAC;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAW,KAAK,KAAK,GAAG,OAAO,QAAQ,CAAC,UAAU,OAAO,KAAK,IAAI,GAAG;AAAA,EACvF,IAAI,KAAK,OAAO;AAAA,IAAW,KAAK,KAAK,GAAG,OAAO,QAAQ,CAAC,QAAQ,OAAO,KAAK,EAAE,GAAG;AAAA,EAKjF,OAAO,QAAQ,OAAO,QAAQ,CAAC,GAAG,MAAM,GAAG,IAAI;AAAA,EAC/C,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,MAAM,UAAU,KAAK,GAAG,IAAI;AAAA,EAE5D,IAAI,KAAK,SAAS,aAAa,OAAO,KAAK,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,IAChE,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,UAAU,GAAG,cAAc,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EAChF;AAAA,EACA,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,GAAG,EAAE,SAAS,GAAG;AAAA,IAC9D,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,SAAS,GAAG,cAAc,KAAK,KAAK,QAAQ,CAAC,CAAC;AAAA,EAC9E;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,WAAW,CAAC,OAA2B,OAAuB;AAAA,EAC5E,OAAO,MAAM,QAAQ,CAAC,SAAS,WAAW,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA;;;ACvG5D,IAAM,cAAc;AAEpB,IAAM,qBAAqB;AAElC,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,aAAa;AAEnB,SAAS,UAAU,CAAC,OAA0B;AAAA,EAC5C,IAAI,MAAM,WAAW,QAAQ;AAAA,IAC3B,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEACE;AAAA,IAEF;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcf,IAAM,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBhB,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyBnB,IAAM,iBAAiB;AAAA;AAAA;AAIvB,IAAM,kBAAkB;AAAA;AAAA;AAAA,iBAGP;AAAA;AAAA;AAAA;AAAA;AAMjB,IAAM,qBAAqB;AAAA,UACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBV,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASvB,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAOf,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQlB,SAAS,QAAQ,CAAC,OAA0B;AAAA,EAC1C,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,MAAM,MAAiB;AAAA,IACrB,EAAE,MAAM,WAAW,MAAM,EAAE,eAAe,YAAY,EAAE;AAAA,IACxD,EAAE,KAAK,gCAAgC;AAAA,EACzC;AAAA,EACA,IAAI,SAAS;AAAA,IAAW,OAAO,YAAY,CAAC,EAAE,MAAM,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC;AAAA,EAC1E,OAAO;AAAA,IACL,YAAY,CAAC,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;AAAA,IACnC;AAAA,IACA,YACE,CAAC,EAAE,MAAM,YAAY,MAAM,EAAE,gBAAgB,MAAM,yBAAyB,QAAQ,EAAE,CAAC,GACvF,CACF;AAAA,IACA,YAAY,KAAK,CAAC;AAAA,EACpB,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,SAAS,cAAc,CAAC,KAAe,OAAkB,IAAoB;AAAA,EAC3E,MAAM,SACH,IAAI,SAAS,CAAC,GAAG,WAAW,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,GAAG,KAAK,IAAI;AAAA;AAAA,EAGlF,MAAM,UAAU,IAAI,YAAY,YAAY,KAAK,wBAAwB,IAAI;AAAA;AAAA,EAC7E,MAAM,QACJ,IAAI,QAAQ,QACR,YAAY,CAAC,EAAE,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,IACjD,CAAC,SAAS,KAAK,GAAG,YAAY,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA,EAG5D,OAAO,oDAA0C,IAAI;AAAA,IACnD,IAAI;AAAA,YACI,IAAI;AAAA,EACd,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA;AAAA;AAKK,SAAS,QAAQ,CAAC,OAA0B;AAAA,EACjD,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EAC9B,MAAM,SAAS,MAAM,aAAa,CAAC;AAAA,EACnC,MAAM,QAAQ,CAAC,SAAS,aAAa,GAAG,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAAA,EAEnE,OAAO,GAAG,SAAS,WAAW,KAAK,IAAI;AAAA;AAAA,EAEvC;AAAA;AAAA;AAAA,eAGa;AAAA;AAAA,EAEb,SAAS,KAAK;AAAA,EACd,YAAY,CAAC,EAAE,KAAK,gBAAgB,CAAC,GAAG,CAAC;AAAA;AAAA,EAEzC;AAAA;AAAA;AAAA,eAGa;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;AAAA,EACnC;AAAA,EACA,YAAY,CAAC,EAAE,MAAM,0CAA0C,KAAK,mBAAmB,CAAC,GAAG,CAAC;AAAA,EAC5F,YAAY,CAAC,EAAE,MAAM,kBAAkB,KAAK,sBAAsB,CAAC,GAAG,CAAC;AAAA;AAAA,EAEvE,OAAO,IAAI,CAAC,QAAQ,GAAG,eAAe,KAAK,OAAO,EAAE;AAAA,CAAK,EAAE,KAAK,EAAE,IAAI;AAAA;AAAA;AAAA;AAAA,cAI1D,MAAM,KAAK,IAAI;AAAA,eACd;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,8BAA8B,KAAK,OAAO,CAAC,GAAG,CAAC;AAAA;AAAA;;;ACpL/D,IAAM,kBAA2D;AAAA,EACtE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,+BAA+B;AAAA,EAC/B,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,cAAc;AAChB;",
+  "debugId": "613673276BC65A5864756E2164756E21",
   "names": []
 }

package/docs/hooks.md

@@ -0,0 +1,118 @@
+# git hooks
+
+One hook layer for the whole estate. The behaviour ships in `@homeflare/config`; a repo
+commits a two-file delegating wrapper and a `prepare` line, and nothing else.
+
+## Adopt
+
+```sh
+bun add -D @homeflare/config
+bun node_modules/@homeflare/config/bin/hooks.ts install     # writes .husky/pre-commit, .husky/pre-push
+npm pkg set scripts.prepare="bun node_modules/@homeflare/config/bin/hooks.ts activate"
+bun install                                                  # prepare → core.hooksPath=.husky
+git add .husky/pre-commit .husky/pre-push package.json
+```
+
+A repo that used husky drops it: remove `husky` from `prepare` and from
+`devDependencies`. `problemsInHooks` reports a `prepare` that still runs it.
+
+## What runs
+
+| hook         | runs                                                                                  | cost       |
+| ------------ | ------------------------------------------------------------------------------------- | ---------- |
+| `pre-commit` | `gitleaks git --staged`, then `oxfmt` + `oxlint --deny-warnings` on staged files      | sub-second |
+| `pre-push`   | the repo's own `check`, with `bun test` narrowed to the push, `build`/`smoke` skipped | seconds    |
+
+⛔ **The secret scan is first and fails closed.** A missing `gitleaks` fails the commit
+with the install line (`brew install gitleaks`). It does not skip: a scan that quietly
+does nothing reads as coverage.
+
+⚠️ **pre-commit rewrites files.** It formats the staged formattable files (`.md` too,
+since house `oxfmt` formats markdown), names the ones it changed, and restages exactly
+those. A file with unstaged edits on top is checked, never rewritten.
+
+⛔ **A staged file entirely excluded by oxfmt's or oxlint's own `ignorePatterns` is not a
+failure.** Measured 2026-09-23: committing only a vendored, ignored file (`staged()`
+classifies by extension only, not by ignore rules) made oxfmt exit non-zero with
+"Expected at least one target file. All matched files may have been excluded by ignore
+rules." Both tools run with `--no-error-on-unmatched-pattern` (their own documented
+answer — `oxfmt --help` / `oxlint --help`, pinned versions checked directly) so "nothing
+here was formattable" passes and says so: `✓ pre-commit: no formattable staged files`. A
+real formatting or lint problem still fails exactly as before — the flag only changes the
+all-excluded case.
+
+⛔ **The hook resolves `.oxfmtrc.*` itself instead of trusting bare `oxfmt` to find it.**
+Measured 2026-09-23 against the pinned version: bare `oxfmt` auto-discovers only
+`.oxfmtrc.json` and `.oxfmtrc.jsonc`. A repo configured with `.oxfmtrc.mjs` (or `.ts`,
+`.js`, `.cjs`, `.mts`, `.cts` — all valid `-c/--config` targets per `oxfmt --help`, none
+auto-discovered) got formatted with oxfmt's built-in defaults instead of its own style,
+silently. The hook now scans the repo root for exactly one such file and passes it with
+`--config`; two or more (none of them `.json`/`.jsonc`) fails the commit loudly rather
+than guess which one governs — see `src/hooks/oxfmt-config.ts`.
+
+## pre-push, scoped to the push
+
+The base comes from git. The hook reads the pushed refs on stdin:
+
+- **Second push to a branch**: measured from what the remote already has, so only
+  the new commits are checked.
+- **New branch**: measured from where it left `<remote>/HEAD`, `main` or `master`.
+- **Force-push**, or a remote sha that was never fetched: also measured from where the
+  branch left the default branch.
+- **Deletion**, or no file changed: nothing is checked.
+- **No usable base** (no remote-tracking branch, no merge base, a shallow clone): every
+  lane runs and the tests run in full. The run gets wider, never empty.
+
+The lanes are the repo's own `check`, read as an `&&` chain:
+
+- `bun test …` becomes `bun test … --changed=<base>`. Bun follows the import graph
+  and runs only the test files the changed files can reach.
+- `build*` and `smoke*` scripts are skipped. CI runs them on every pull request.
+- A script that hides a `bun test` or a build is expanded. For example
+  `check → verify → bun test` becomes a narrowed test lane. Any other script runs
+  under its own name, exactly as written.
+- A test script that is not a plain `bun test`, such as vitest with coverage thresholds
+  or `node --test`, runs in full and is labelled `(IN FULL)`.
+- A push that changes a `package.json`, `bun.lock`, `bunfig.toml` or `tsconfig*.json`
+  runs the tests in full. Imports cannot see those files, but every test runs on them.
+
+⛔ **It never calls `verify` by name.** In `homeflare-proxmox`, `verify` is a live
+adoption verifier. The hook follows `verify` only when `check` itself delegates to it,
+because then `verify` is what CI runs.
+
+⚠️ **The hook no longer certifies that CI will pass.** It certifies that `check`'s lint
+and type lanes pass and that every test the push can reach passes. The build, the smoke
+test and the tests the push cannot reach are left to CI, and the success line says so.
+
+## Every worktree
+
+`activate` sets `core.hooksPath=.husky`. The path is relative and lives in the clone's
+shared config, so each worktree runs its own checked-out `.husky/`, including a fresh
+`git worktree add` that has never been installed.
+
+husky's `.husky/_` only existed where husky had run, so every other worktree of the clone
+had no hooks at all. In an uninstalled worktree, the wrapper prints that `bun install` is
+needed and exits 0. It fails open, because the required checks on `main` are the gate.
+
+`activate` does nothing under `CI`, or outside a git work tree. It never fails, because it
+runs inside `bun install`.
+
+⚠️ **While the rollout is in progress, husky can undo it.** `core.hooksPath` is one
+value for the whole clone. If a worktree on a branch from before adoption runs
+`bun install`, husky runs and resets it to `.husky/_`. That is the behaviour before this
+change: installed worktrees keep their hooks, because husky's runner calls the same
+tracked files, and never-installed worktrees have none. To restore it, run `bun install`
+on an adopted branch, or `bun node_modules/@homeflare/config/bin/hooks.ts activate`.
+
+⚠️ **Only a push of the checked-out commit can be checked.** The lanes run on the working
+tree. Pushing another ref, as in `git push origin other-branch`, is reported as
+**NOT CHECKED** and left to CI. It is never reported as passed.
+
+```ts
+import { problemsInHooks } from '@homeflare/config/hooks';
+
+expect(await problemsInHooks(process.cwd())).toEqual([]);
+```
+
+⛔ `problemsInHooks` is deliberately **not** part of `checkProject`: folding it in would turn
+every repo that has not adopted yet red on `main` in one commit. A repo opts in by calling it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/config",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Shared tsconfig, oxlint, oxfmt, and non-npm release helpers for HomeFlare projects.",
   "license": "MIT",
   "author": "Timothy Schneider",

package/src/hooks/activate.ts

@@ -0,0 +1,71 @@
+/**
+ * Turn the hooks on for a clone and EVERY worktree of it, from `prepare`.
+ *
+ * 🔴 THE GAP THIS CLOSES, measured 2026-09-23. husky sets `core.hooksPath=.husky/_`, and
+ *   `.husky/_` is generated and gitignored: it exists only in the worktree where `bun
+ *   install` ran husky. `core.hooksPath` lives in the clone's SHARED config, so every other
+ *   worktree — every `git worktree add` an agent makes — points at a directory it does not
+ *   have, and git runs no hooks there, silently. In homeflare-kit that was every worktree
+ *   until `bun install` had run husky inside it.
+ * ★ THE FIX IS A TRACKED PATH. `core.hooksPath=.husky` is relative, and git resolves a
+ *   relative hooks path against the worktree running the hook — so each worktree runs its
+ *   OWN checked-out `.husky/`, present from the moment the worktree exists. Measured on git
+ *   2.55: a fresh `git worktree add` ran the tracked hook with no install at all. (The
+ *   wrapper then needs that worktree's `node_modules` to do its work — install.ts says so
+ *   out loud rather than failing.)
+ * ⛔ IT NEVER FAILS. `prepare` runs inside `bun install`; a hook problem must not break an
+ *   install. Every outcome, including "did nothing", is a message and exit 0.
+ */
+import { probe } from './report.ts';
+
+export type Activation = {
+  /** The hooks path is set (now or already). */
+  readonly active: boolean;
+  readonly message: string;
+};
+
+/**
+ * ⚠️ CI IS SKIPPED ON PURPOSE. Hooks are a local convenience and CI runs the real gate; a
+ *   runner with hooks on would run them on the commits it makes itself (a release's
+ *   "Version Packages" commit) on a machine that may have no gitleaks.
+ */
+function inCi(env: Readonly<Record<string, string | undefined>>): boolean {
+  const ci = env['CI'];
+  return ci !== undefined && ci !== '' && ci !== '0' && ci.toLowerCase() !== 'false';
+}
+
+export async function activateHooks(
+  root: string,
+  env: Readonly<Record<string, string | undefined>> = process.env,
+): Promise<Activation> {
+  if (inCi(env)) return { active: false, message: 'CI is set — hooks stay off; CI runs the gate' };
+
+  // ★ `--show-prefix` answers two questions at once: whether this is a work tree at all
+  //   (it fails outside one — a tarball install), and where `root` sits inside it.
+  const where = await probe(['git', '-C', root, 'rev-parse', '--show-prefix']);
+  if (where.code !== 0) return { active: false, message: 'not a git work tree — nothing to do' };
+
+  const tracked = await Promise.all(
+    ['pre-commit', 'pre-push'].map((name) => Bun.file(`${root}/.husky/${name}`).exists()),
+  );
+  if (!tracked.some(Boolean)) {
+    return { active: false, message: 'no .husky/pre-commit or .husky/pre-push to point git at' };
+  }
+
+  // ⚠️ RELATIVE TO THE TOP OF THE WORK TREE, which is where git resolves it — a package
+  //   below the root (`<prefix>.husky`) still points at its own directory.
+  const want = `${where.stdout.trim()}.husky`;
+  const current = (
+    await probe(['git', '-C', root, 'config', '--get', 'core.hooksPath'])
+  ).stdout.trim();
+  if (current === want) return { active: true, message: `core.hooksPath is already ${want}` };
+
+  // ★ NO `--worktree`: the clone's shared config, so ONE install covers every worktree.
+  const set = await probe(['git', '-C', root, 'config', 'core.hooksPath', want]);
+  if (set.code !== 0) return { active: false, message: 'git config core.hooksPath failed' };
+  const was = current === '' ? 'unset' : current;
+  return {
+    active: true,
+    message: `core.hooksPath ${was} → ${want}, for every worktree of this clone`,
+  };
+}

package/src/hooks/gates.ts

@@ -1,18 +1,34 @@
 /**
  * The two gates every HomeFlare repo gets, from one place.
  *
- * ★ THE SPLIT IS BY COST. `pre-commit` touches only the staged files and is measured in
- *   hundreds of milliseconds, so it can run on every commit without anyone resenting
- *   it. `pre-push` runs the repo's own `bun run check` — seconds, once, before the
- *   change costs a slot on the shared self-hosted runner.
- *
- * ⚠️ NEITHER IS A GATE. Both are skippable with `--no-verify` and neither exists in a
- *   fresh clone until `bun install` runs `prepare`. The required checks on `main` stay
- *   the gate; these only make the cheap mistakes cheap to find.
+ * ★ THE SPLIT IS BY COST. `pre-commit` touches only the staged files — a secret scan, then
+ *   format and lint — and is measured in hundreds of milliseconds, so it can run on every
+ *   commit without anyone resenting it. `pre-push` runs the repository's own `check`
+ *   narrowed to what the push can affect (push-plan.ts): seconds, once per push.
+ * ⚠️ NEITHER IS A GATE. Both are skippable with `--no-verify`, and a worktree has them only
+ *   once `bun install` has run there. The required checks on `main` stay the gate — CI
+ *   runs the whole `check`, every test, the build and the smoke test on every pull request.
  */
-import { fail, note, ok, run, tool } from './report.ts';
+import { existsSync } from 'node:fs';
+import { resolveOxfmtConfig } from './oxfmt-config.ts';
+import { type Lane, planLanes } from './push-plan.ts';
+import { changesEverything, parsePushRefs, pushScope } from './push-range.ts';
+import { fail, note, ok, run, runCaptured, runLane, tool } from './report.ts';
+import { scanStagedSecrets } from './secrets.ts';
 import { fingerprints, staged } from './staged.ts';
 
+/**
+ * oxfmt's own summary line ("Finished in 2ms on 0 files using 10 threads.") is how the hook
+ * learns whether `--no-error-on-unmatched-pattern` turned a real run into a no-op — oxfmt has
+ * no flag that answers this more directly. `null` (unparsable — a future oxfmt wording change)
+ * is treated as "something ran": that is the safe direction, since it only ever suppresses the
+ * new "no formattable staged files" message, never a real failure.
+ */
+function matchedFileCount(stdout: string): number | null {
+  const match = /\bon (\d+) files? using/.exec(stdout);
+  return match?.[1] === undefined ? null : Number(match[1]);
+}
+
 /**
  * Format and lint what is staged, restaging only what the formatter rewrote.
  *
@@ -20,10 +36,61 @@ import { fingerprints, staged } from './staged.ts';
  *   happens. Without the restage, oxfmt would fix the worktree while the commit kept
  *   the unformatted bytes — CI then fails on a file that reads as correct locally.
  */
+/**
+ * Has `bun install` run in this worktree?
+ *
+ * ⚠️ WITHOUT IT, SKIP — LOUDLY — RATHER THAN IMPROVISE. A fresh worktree now runs its hooks
+ *   (activate.ts), and in the repo that HOSTS this package they are reached by workspace
+ *   path, not through node_modules. There `tool()` would fall back to `bunx`, fetching an
+ *   unpinned oxfmt mid-commit, and a pre-push lane would die on "command not found". The
+ *   wrapper every other repo commits makes the same call one step earlier (install.ts).
+ */
+function installed(root: string, hook: 'pre-commit' | 'pre-push'): boolean {
+  if (existsSync(`${root}/node_modules`)) return true;
+  note(`${hook}: no node_modules in this worktree — run 'bun install'; skipping the rest`);
+  return false;
+}
+
 export async function preCommit(root: string): Promise<void> {
-  const oxfmt = tool(root, 'oxfmt');
+  // ⛔ SECRETS FIRST, before anything can rewrite or pass — see secrets.ts. It needs only the
+  //   gitleaks binary, so it runs even in a worktree nobody has installed yet.
+  await scanStagedSecrets();
+  if (!installed(root, 'pre-commit')) return;
+
   const { formattable, code, partial } = await staged();
 
+  // ⚠️ BEFORE RESOLVING A CONFIG: if oxfmt would never run (nothing formattable staged, not
+  //   even a partially-staged one to `--check`), a config problem — even an unresolved
+  //   ambiguous one — must not block the commit. That is the exact shape of BUG 1: don't
+  //   fail on "there is nothing to do here".
+  if (formattable.length === 0 && partial.length === 0) {
+    ok('pre-commit: nothing staged to format');
+    return;
+  }
+
+  const config = await resolveOxfmtConfig(root);
+  if (config.kind === 'ambiguous') {
+    fail(
+      'pre-commit',
+      `${String(config.files.length)} oxfmt configs found (${config.files.join(', ')}) and oxfmt auto-discovers none of them`,
+      'keep exactly one .oxfmtrc.* file at the repo root (.oxfmtrc.json is auto-discovered)',
+    );
+  }
+  // ⛔ BUG, MEASURED 2026-09-23: bare `oxfmt` only finds `.oxfmtrc.json`/`.oxfmtrc.jsonc` on
+  //   its own — see oxfmt-config.ts. `--config` is added only when the repo's config needs it.
+  const oxfmt = [
+    ...tool(root, 'oxfmt'),
+    ...(config.kind === 'explicit' ? ['--config', config.path] : []),
+    // ⛔ BUG, MEASURED 2026-09-23: a staged file wholly excluded by oxfmt's OWN
+    //   `ignorePatterns` (house `packages/distilled-*/src/**`, say) made oxfmt exit non-zero
+    //   with "Expected at least one target file" — `staged()` classifies by extension only,
+    //   blind to the repo's ignore rules, so `formattable`/`code` can be 100% ignored files.
+    //   This flag is oxfmt's own documented answer (`--help`, oxfmt 0.68.0): still fail on a
+    //   real formatting problem, but not on "everything here was excluded".
+    '--no-error-on-unmatched-pattern',
+  ];
+  const oxlint = [...tool(root, 'oxlint'), '--no-error-on-unmatched-pattern'];
+
   // ⛔ Checked, never rewritten — see staged.ts for why `git add` here would be theft.
   if (partial.length > 0) {
     note(`${partial.length} staged file(s) also have unstaged edits; checking without rewriting`);
@@ -42,22 +109,28 @@ export async function preCommit(root: string): Promise<void> {
   }
 
   const before = await fingerprints(formattable);
-  if ((await run([...oxfmt, ...formattable])) !== 0) {
+  const { code: fmtExit, stdout: fmtOut } = await runCaptured([...oxfmt, ...formattable]);
+  if (fmtExit !== 0) {
     fail('pre-commit', 'oxfmt could not format the staged files', 'bun run format');
   }
-  const after = await fingerprints(formattable);
-  const rewritten = formattable.filter((file) => before.get(file) !== after.get(file));
+  const matched = matchedFileCount(fmtOut);
+
+  if (matched !== 0) {
+    const after = await fingerprints(formattable);
+    const rewritten = formattable.filter((file) => before.get(file) !== after.get(file));
 
-  if (rewritten.length > 0) {
-    note(`oxfmt rewrote and restaged ${rewritten.length} file(s): ${rewritten.join(', ')}`);
-    if ((await run(['git', 'add', '--', ...rewritten])) !== 0) {
-      fail('pre-commit', 'could not restage the formatted files', 'git add the listed files');
+    if (rewritten.length > 0) {
+      note(`oxfmt rewrote and restaged ${rewritten.length} file(s): ${rewritten.join(', ')}`);
+      if ((await run(['git', 'add', '--', ...rewritten])) !== 0) {
+        fail('pre-commit', 'could not restage the formatted files', 'git add the listed files');
+      }
     }
   }
 
   // ⚠️ `--deny-warnings` matches what CI runs. A hook that is laxer than CI is worse
-  //   than no hook: it certifies a change CI will reject.
-  if (code.length > 0 && (await run([...tool(root, 'oxlint'), '--deny-warnings', ...code])) !== 0) {
+  //   than no hook: it certifies a change CI will reject. Same ignore-rules shape as oxfmt
+  //   above: `code` can be entirely excluded by oxlint's own `ignorePatterns`.
+  if (code.length > 0 && (await run([...oxlint, '--deny-warnings', ...code])) !== 0) {
     fail(
       'pre-commit',
       `oxlint found problems in ${code.length} staged file(s)`,
@@ -65,40 +138,84 @@ export async function preCommit(root: string): Promise<void> {
     );
   }
 
-  ok(`pre-commit: ${formattable.length} staged file(s) formatted and linted`);
+  if (matched === 0) {
+    note(
+      `${String(formattable.length)} staged file(s) matched a formattable extension, but all are excluded by ignore rules`,
+    );
+    ok('pre-commit: no formattable staged files');
+  } else {
+    ok(`pre-commit: ${formattable.length} staged file(s) formatted and linted`);
+  }
+}
+
+/** The one-line reason a lane is in the run, printed before it starts. */
+function describe(lane: Lane): string {
+  if (lane.kind === 'skip') return `skip ${lane.label} — ${lane.why}`;
+  if (lane.kind === 'test' && lane.scoped)
+    return `run  ${lane.command}  (only the tests the push can reach)`;
+  if (lane.kind === 'test') return `run  ${lane.command}  (IN FULL)`;
+  return `run  ${lane.command}`;
 }
 
 /**
- * Run the repo's own declared gate before the push reaches the runner.
+ * Run the repository's own `check`, narrowed to what the push can affect.
  *
- * ★ IT CALLS `bun run check` RATHER THAN NAMING TOOLS. Every repo's `check` is the
- *   command CI runs; hard-coding `tsc` and `bun test` here would drift from whichever
- *   repo added a step, and the hook would certify a push CI rejects.
- * ⛔ It does not widen a narrow `check`. If a repo's gate only looks at part of the
- *   tree, this hook inherits exactly that blind spot — fix the script, not the hook.
+ * ★ `args` ARE GIT'S: the remote name and URL. `stdin` is git's ref list — see
+ *   push-range.ts for how the base is chosen and why it never narrows to nothing.
+ * ⛔ IT DOES NOT CERTIFY WHAT CI WILL SAY. It certifies that `check`'s own lint and type
+ *   lanes pass and that every test the pushed files can reach passes. The build, the smoke
+ *   test and the unreachable tests are CI's, and the success line says so.
  */
-export async function prePush(root: string): Promise<void> {
+export async function prePush(root: string, args: readonly string[], stdin: string): Promise<void> {
   const manifest = Bun.file(`${root}/package.json`);
   const pkg = (await manifest.exists())
     ? ((await manifest.json()) as { scripts?: Record<string, string> })
     : {};
-
-  if (pkg.scripts?.['check'] === undefined) {
+  const scripts = pkg.scripts ?? {};
+  if (scripts['check'] === undefined) {
     note('pre-push: no `check` script declared in package.json; nothing to run');
     return;
   }
+  if (!installed(root, 'pre-push')) return;
 
-  note('pre-push: running `bun run check` — the same gate CI runs');
-  const started = Bun.nanoseconds();
-  // 🔴 `isolated`: strip the GIT_* this hook inherited before running the test suite.
-  //   See report.ts — without it a test's throwaway git repository commits into this one.
-  if ((await run(['bun', 'run', 'check'], true)) !== 0) {
-    fail(
-      'pre-push',
-      'bun run check failed — CI would fail the same way, on a shared runner',
-      'bun run lint:fix, then bun run check until it is green',
+  const scope = await pushScope(root, args[0] ?? 'origin', parsePushRefs(stdin));
+  if (scope.kind === 'empty') {
+    ok(`pre-push: ${scope.why} — nothing to check`);
+    return;
+  }
+  if (scope.kind === 'elsewhere') {
+    // ⛔ NOT A PASS, AND IT DOES NOT SAY ONE. The working tree is another commit; running the
+    //   lanes would certify content nobody checked. Failing would teach `--no-verify` for an
+    //   ordinary push, so it says what it did not do, and CI checks the ref.
+    note(`pre-push: ${scope.why} — the working tree is not what is being pushed`);
+    note(
+      '  NOT CHECKED here; CI checks it. To check it locally, check it out and push from there.',
     );
+    return;
+  }
+  let base: string | undefined;
+  if (scope.kind === 'unscoped') {
+    note(`pre-push: ${scope.why} — every lane runs, tests in full`);
+  } else {
+    const global = scope.changed.filter(changesEverything);
+    note(`pre-push: ${String(scope.changed.length)} file(s) changed ${scope.why}`);
+    if (global.length > 0)
+      note(`  ${global.join(', ')} changes what every test runs on — tests in full`);
+    else base = scope.base;
   }
 
-  ok(`pre-push: bun run check passed in ${((Bun.nanoseconds() - started) / 1e9).toFixed(1)}s`);
+  const lanes = planLanes(scripts, base);
+  const started = Bun.nanoseconds();
+  let ran = 0;
+  for (const lane of lanes) {
+    note(describe(lane));
+    if (lane.kind === 'skip') continue;
+    // 🔴 `runLane` strips the GIT_* this hook inherited — see report.ts.
+    if ((await runLane(lane.command, root)) !== 0) {
+      fail('pre-push', `\`${lane.label}\` failed`, `${lane.command} — until it is green`);
+    }
+    ran += 1;
+  }
+  const seconds = ((Bun.nanoseconds() - started) / 1e9).toFixed(1);
+  ok(`pre-push: ${String(ran)} lane(s) of \`check\` passed in ${seconds}s — CI runs the full gate`);
 }