@homeflare/config 0.11.0 → 0.12.0

package/docs/repo-shape-dependabot.md

@@ -1,39 +1,42 @@
 # Dependabot, and how a kit release reaches a consumer
 
-`repo-shape` renders `.github/dependabot.yml` and `.github/workflows/dependabot-automerge.yml`
-together. The first opens one pull request per kit release in each consumer (the
-`homeflare` group); the second arms GitHub's auto-merge on that pull request and on nothing
-else. The branch ruleset's required checks decide whether it merges.
+`repo-shape` renders `.github/dependabot.yml`. It watches everything EXCEPT the packages
+this kit publishes: an `ignore` entry names `@homeflare/*` in the bun block, so Dependabot
+never proposes them.
 
-**Status (2026-09-22): the Actions half works; the bun half is blocked upstream.** See
-[the blocker](#the-blocker-bunlock-lockfileversion-2) — it is the trigger for everything
-below doing anything.
+**Retired 2026-09-23 (kit auto-bumper design, Tim): the `homeflare` group and the
+rendered `dependabot-automerge.yml`.** They used to be how a kit release reached a
+consumer — grouped, checked daily, merged on green. `taslabs-net/homeflare-bumper` does
+that job now, dispatched from this repo's own `release.yml` (`notify-consumers`) with a
+schedule backstop. The `ignore` below exists **so the two never compete**: without it, a
+Dependabot bump and a bumper bump could open two pull requests for the same version at
+once.
+
+**Status (2026-09-22): the Actions half works; the bun half is blocked upstream regardless
+of the ignore.** See [the blocker](#the-blocker-bunlock-lockfileversion-2).
 
 ## Why
 
 Merging and releasing a kit change are automated. Bumping a consumer was not, and it is the
 leg that silently stops: measured 2026-09-22, `homeflare-proxmox` and `homeflare-mini`
 pinned `@homeflare/alchemy` 0.13.0 and `@homeflare/config` 0.5.1 while the kit had published
-0.19.1 and 0.8.0. Tim's decision (2026-09-23): kit releases reach consumers by Dependabot,
-grouped, checked daily, merged on green; no GitHub organization and no tokens.
+0.19.1 and 0.8.0. Tim's decision (2026-09-23): `homeflare-bumper` carries a kit release into
+every consumer; Dependabot's job is everything else.
 
 ## What each rendered choice rests on
 
 Read on 2026-09-22 from GitHub's docs and from dependabot-core's source at v0.397.0.
 
-| Choice                                                     | Why                                                                                                                                                           | Source                                                                                                 |
-| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
-| One bun block, daily                                       | Two blocks for one ecosystem and target branch must have "no overlap in directories defined", so a group cannot have its own schedule                         | [options reference: `directories`][options]                                                            |
-| `cooldown.exclude: ['@homeflare/*']`                       | Dependabot applies a 3-day cooldown "even when `cooldown` is not configured"; without the exclude, a release waits three days                                 | [options reference: `cooldown`][options]                                                               |
-| `cooldown.default-days: 7`                                 | Keeps third-party updates to roughly the weekly pace they had, by age rather than by calendar                                                                 | same                                                                                                   |
-| `homeflare` group first, no `update-types`                 | "If a dependency matches more than one rule, it's included in the first group that it matches"; a kit release moves as one set                                | [options reference: `groups`][options]                                                                 |
-| `daily` means Monday–Friday                                | "Use `daily` to run on every weekday, Monday to Friday"                                                                                                       | [options reference: `schedule`][options]                                                               |
-| Auto-merge by `gh pr merge --auto`                         | GitHub's documented pattern for Dependabot pull requests                                                                                                      | [Automating Dependabot with GitHub Actions][automating]                                                |
-| Refuse when the base branch requires no check              | `gh pr merge --auto` merges a CLEAN or UNSTABLE pull request at once instead of arming it, so only a required status check keeps the bump waiting for `check` | cli/cli `pkg/cmd/pr/merge/merge.go`, `isImmediatelyMergeable` (v2.101.0)                               |
-| No `dependabot/fetch-metadata`                             | The same page labels it "not certified by GitHub"; the house CI is first-party only                                                                           | same                                                                                                   |
-| Group recognised by branch name                            | `dependabot/bun/homeflare-<10 hex>`: prefix, package manager, directory (root collapses), then group name and the first 10 hex of an MD5 digest               | dependabot-core `common/lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb` |
-| `contents: write` + `pull-requests: write` on the job only | A Dependabot-started run gets a read-only `GITHUB_TOKEN` unless the `permissions` key raises it; these two are what GitHub's own example grants               | [Troubleshooting Dependabot on GitHub Actions][troubleshoot]                                           |
-| `--squash`                                                 | The house policy (`declareRepoPolicy`) allows squash merges only                                                                                              | `@homeflare/alchemy` `repo-policy-form.ts`                                                             |
+| Choice                                        | Why                                                                                                                                           | Source                                      |
+| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
+| `ignore: [{dependency-name: '@homeflare/*'}]` | `dependency-name`, "optionally using `*` to match zero or more characters" — stops Dependabot proposing what the bumper owns                  | [options reference: `ignore`][options]      |
+| `cooldown.default-days: 7`                    | Third-party updates are proposed once a release is a week old, by age rather than by calendar                                                 | [options reference: `cooldown`][options]    |
+| One bun block, weekly                         | Two blocks for one ecosystem and target branch must have "no overlap in directories defined" — moot now, kept for the directories split below | [options reference: `directories`][options] |
+
+The bumper's own citations — `gh pr merge --auto`'s CLEAN/UNSTABLE trap, the App's token
+scoping, and everything else that used to live in this repo's now-deleted
+`dependabot-automerge.yml` — moved with it, to `taslabs-net/homeflare-bumper` (not
+measured here whether its docs have landed yet; check that repo directly).
 
 ## Where Dependabot runs, and the billing lock
 
@@ -82,27 +85,14 @@ and rejects unsafe git tags. Downgrading the lockfile to suit Dependabot gives b
 
 ## What still needs a person
 
-- **A kit release that changes what `@homeflare/config` renders.** The group's pull
-  request fails the drift test by design ([repo-shape.md](repo-shape.md), "Bumping
-  `@homeflare/config` will go red before it goes green"). Run `bun run repo-shape:refresh`
-  on the Dependabot branch and push; the push starts CI as any person's push does.
-  ⛔ The workflow cannot do it: "events triggered by the `GITHUB_TOKEN` will not create a
-  new workflow run" ([GITHUB_TOKEN][token]), so a refreshed commit pushed with it would
-  never get its checks.
-- **A repository whose base branch requires no status check.** The arming job fails on
-  purpose there (measured 2026-09-22: `homeflare-builds`, whose ruleset is not deployed yet,
-  and `homeflare-desktop`). `gh pr merge --auto` would otherwise merge the bump at once,
-  before `check` ran. Deploy the repository's ruleset; the next Dependabot rebase arms it.
-- **A release whose plan changes.** A merged bump deploys nothing, but the next deploy of
-  that consumer applies whatever the new kit plans. Read the plan before deploying.
-
-⚠️ **The merge itself starts no workflow on `main`.** Auto-merge armed with `GITHUB_TOKEN`
-merges as that token, and its push triggers nothing. The rendered `ci.yml` has no push
-trigger anyway, and a bump carries no changeset, so nothing is lost — but a repository that
-adds a `push: main` workflow should know it will not run for these merges.
+- **A kit release whose plan changes.** A merged bump — from either path — deploys
+  nothing, but the next deploy of that consumer applies whatever the new kit plans. Read
+  the plan before deploying.
+- **Whatever the bumper itself hands off.** Its own auto-merge refusals, App setup, and
+  key rotation are documented where it lives, `taslabs-net/homeflare-bumper` — not here.
 
 ⚠️ **`open-pull-requests-limit: 5` is per block.** Five stale third-party pull requests
-could, in principle, hold the group back. dependabot-core runs grouped updates before
+could, in principle, crowd out a new one. dependabot-core runs grouped updates before
 ungrouped ones in each job (`group_update_all_versions.rb`), but the limit is enforced by
 the service, whose code is not public — so this is reasoned, not measured.
 
@@ -119,8 +109,6 @@ which only says "The updater encountered one or more errors".
 
 [options]: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
 [automating]: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
-[troubleshoot]: https://docs.github.com/en/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions
 [concepts]: https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-on-actions
 [reference]: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-on-actions
 [selfhosted]: https://docs.github.com/en/code-security/dependabot/maintain-dependencies/managing-dependabot-on-self-hosted-runners
-[token]: https://docs.github.com/en/actions/concepts/security/github_token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/config",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Shared tsconfig, oxlint, oxfmt, and non-npm release helpers for HomeFlare projects.",
   "license": "MIT",
   "author": "Timothy Schneider",

package/src/hooks/gates.ts

@@ -10,12 +10,25 @@
  *   runs the whole `check`, every test, the build and the smoke test on every pull request.
  */
 import { existsSync } from 'node:fs';
+import { resolveOxfmtConfig } from './oxfmt-config.ts';
 import { type Lane, planLanes } from './push-plan.ts';
 import { changesEverything, parsePushRefs, pushScope } from './push-range.ts';
-import { fail, note, ok, run, runLane, tool } from './report.ts';
+import { fail, note, ok, run, runCaptured, runLane, tool } from './report.ts';
 import { scanStagedSecrets } from './secrets.ts';
 import { fingerprints, staged } from './staged.ts';
 
+/**
+ * oxfmt's own summary line ("Finished in 2ms on 0 files using 10 threads.") is how the hook
+ * learns whether `--no-error-on-unmatched-pattern` turned a real run into a no-op — oxfmt has
+ * no flag that answers this more directly. `null` (unparsable — a future oxfmt wording change)
+ * is treated as "something ran": that is the safe direction, since it only ever suppresses the
+ * new "no formattable staged files" message, never a real failure.
+ */
+function matchedFileCount(stdout: string): number | null {
+  const match = /\bon (\d+) files? using/.exec(stdout);
+  return match?.[1] === undefined ? null : Number(match[1]);
+}
+
 /**
  * Format and lint what is staged, restaging only what the formatter rewrote.
  *
@@ -43,9 +56,41 @@ export async function preCommit(root: string): Promise<void> {
   //   gitleaks binary, so it runs even in a worktree nobody has installed yet.
   await scanStagedSecrets();
   if (!installed(root, 'pre-commit')) return;
-  const oxfmt = tool(root, 'oxfmt');
+
   const { formattable, code, partial } = await staged();
 
+  // ⚠️ BEFORE RESOLVING A CONFIG: if oxfmt would never run (nothing formattable staged, not
+  //   even a partially-staged one to `--check`), a config problem — even an unresolved
+  //   ambiguous one — must not block the commit. That is the exact shape of BUG 1: don't
+  //   fail on "there is nothing to do here".
+  if (formattable.length === 0 && partial.length === 0) {
+    ok('pre-commit: nothing staged to format');
+    return;
+  }
+
+  const config = await resolveOxfmtConfig(root);
+  if (config.kind === 'ambiguous') {
+    fail(
+      'pre-commit',
+      `${String(config.files.length)} oxfmt configs found (${config.files.join(', ')}) and oxfmt auto-discovers none of them`,
+      'keep exactly one .oxfmtrc.* file at the repo root (.oxfmtrc.json is auto-discovered)',
+    );
+  }
+  // ⛔ BUG, MEASURED 2026-09-23: bare `oxfmt` only finds `.oxfmtrc.json`/`.oxfmtrc.jsonc` on
+  //   its own — see oxfmt-config.ts. `--config` is added only when the repo's config needs it.
+  const oxfmt = [
+    ...tool(root, 'oxfmt'),
+    ...(config.kind === 'explicit' ? ['--config', config.path] : []),
+    // ⛔ BUG, MEASURED 2026-09-23: a staged file wholly excluded by oxfmt's OWN
+    //   `ignorePatterns` (house `packages/distilled-*/src/**`, say) made oxfmt exit non-zero
+    //   with "Expected at least one target file" — `staged()` classifies by extension only,
+    //   blind to the repo's ignore rules, so `formattable`/`code` can be 100% ignored files.
+    //   This flag is oxfmt's own documented answer (`--help`, oxfmt 0.68.0): still fail on a
+    //   real formatting problem, but not on "everything here was excluded".
+    '--no-error-on-unmatched-pattern',
+  ];
+  const oxlint = [...tool(root, 'oxlint'), '--no-error-on-unmatched-pattern'];
+
   // ⛔ Checked, never rewritten — see staged.ts for why `git add` here would be theft.
   if (partial.length > 0) {
     note(`${partial.length} staged file(s) also have unstaged edits; checking without rewriting`);
@@ -64,22 +109,28 @@ export async function preCommit(root: string): Promise<void> {
   }
 
   const before = await fingerprints(formattable);
-  if ((await run([...oxfmt, ...formattable])) !== 0) {
+  const { code: fmtExit, stdout: fmtOut } = await runCaptured([...oxfmt, ...formattable]);
+  if (fmtExit !== 0) {
     fail('pre-commit', 'oxfmt could not format the staged files', 'bun run format');
   }
-  const after = await fingerprints(formattable);
-  const rewritten = formattable.filter((file) => before.get(file) !== after.get(file));
+  const matched = matchedFileCount(fmtOut);
+
+  if (matched !== 0) {
+    const after = await fingerprints(formattable);
+    const rewritten = formattable.filter((file) => before.get(file) !== after.get(file));
 
-  if (rewritten.length > 0) {
-    note(`oxfmt rewrote and restaged ${rewritten.length} file(s): ${rewritten.join(', ')}`);
-    if ((await run(['git', 'add', '--', ...rewritten])) !== 0) {
-      fail('pre-commit', 'could not restage the formatted files', 'git add the listed files');
+    if (rewritten.length > 0) {
+      note(`oxfmt rewrote and restaged ${rewritten.length} file(s): ${rewritten.join(', ')}`);
+      if ((await run(['git', 'add', '--', ...rewritten])) !== 0) {
+        fail('pre-commit', 'could not restage the formatted files', 'git add the listed files');
+      }
     }
   }
 
   // ⚠️ `--deny-warnings` matches what CI runs. A hook that is laxer than CI is worse
-  //   than no hook: it certifies a change CI will reject.
-  if (code.length > 0 && (await run([...tool(root, 'oxlint'), '--deny-warnings', ...code])) !== 0) {
+  //   than no hook: it certifies a change CI will reject. Same ignore-rules shape as oxfmt
+  //   above: `code` can be entirely excluded by oxlint's own `ignorePatterns`.
+  if (code.length > 0 && (await run([...oxlint, '--deny-warnings', ...code])) !== 0) {
     fail(
       'pre-commit',
       `oxlint found problems in ${code.length} staged file(s)`,
@@ -87,7 +138,14 @@ export async function preCommit(root: string): Promise<void> {
     );
   }
 
-  ok(`pre-commit: ${formattable.length} staged file(s) formatted and linted`);
+  if (matched === 0) {
+    note(
+      `${String(formattable.length)} staged file(s) matched a formattable extension, but all are excluded by ignore rules`,
+    );
+    ok('pre-commit: no formattable staged files');
+  } else {
+    ok(`pre-commit: ${formattable.length} staged file(s) formatted and linted`);
+  }
 }
 
 /** The one-line reason a lane is in the run, printed before it starts. */

package/src/hooks/oxfmt-config.ts

@@ -0,0 +1,67 @@
+/**
+ * Which `.oxfmtrc.*` file governs this repo — so the hook can name it explicitly.
+ *
+ * ⛔ BUG, MEASURED 2026-09-23 (homeflare-desktop docs agent): the shared pre-commit ran
+ *   bare `oxfmt`, and bare `oxfmt` auto-discovers only `.oxfmtrc.json` and `.oxfmtrc.jsonc`.
+ *   Checked against the pinned oxfmt 0.68.0 directly: a repo with only `.oxfmtrc.mjs` and
+ *   no `-c` prints "No config found, using defaults" and formats with oxfmt's built-in
+ *   style, silently — even though `oxfmt --help` lists `.ts/.mts/.cts/.js/.mjs/.cjs` as
+ *   valid `--config` targets. Desktop's fix was renaming to `.oxfmtrc.json`; this fixes the
+ *   hook so a repo does not have to.
+ * ★ WHY A FILE SCAN, NOT A PACKAGE.JSON READ. The repo's own `format`/`check` script names
+ *   the config it wants (or relies on auto-discovery finding `.oxfmtrc.json`), but its exact
+ *   invocation shape varies per repo. Finding the config file on disk and handing it to
+ *   oxfmt directly gets the same result without parsing an arbitrary shell command.
+ * ⛔ EVERY `.oxfmtrc.*` LIVES AT THE REPO ROOT TODAY (checked: every repo in the estate has
+ *   exactly one, at root — no nested per-package overrides). Explicit `-c` disables oxfmt's
+ *   own nested-config search (measured: a nested `.oxfmtrc.json` was ignored once `-c` named
+ *   the root one), so this only scans `root` itself — it would misfire on a repo that added a
+ *   package-level override, which none currently do.
+ */
+import { readdir } from 'node:fs/promises';
+
+/** Auto-discovered by bare `oxfmt` — nothing for the hook to pass. */
+const AUTO_DISCOVERED = ['.oxfmtrc.json', '.oxfmtrc.jsonc'];
+
+/**
+ * Accepted by `oxfmt -c/--config` (per `oxfmt --help`, oxfmt 0.68.0) but never found on its
+ * own — checked empirically for each extension. Listed in the order `--help` documents them.
+ */
+const NEEDS_EXPLICIT_CONFIG = [
+  '.oxfmtrc.ts',
+  '.oxfmtrc.mts',
+  '.oxfmtrc.cts',
+  '.oxfmtrc.js',
+  '.oxfmtrc.mjs',
+  '.oxfmtrc.cjs',
+];
+
+export type OxfmtConfigResolution =
+  /** `.oxfmtrc.json` or `.oxfmtrc.jsonc` exists — bare oxfmt already finds it. */
+  | { readonly kind: 'auto' }
+  /** No `.oxfmtrc.*` at all — let oxfmt use its built-in defaults, as today. */
+  | { readonly kind: 'none' }
+  /** Exactly one config oxfmt would not find unaided — pass it with `-c`. */
+  | { readonly kind: 'explicit'; readonly path: string }
+  /**
+   * Two or more configs, none of them auto-discovered — bare oxfmt (and a repo's own
+   * bare `bun run format`) would silently fall back to defaults too, honouring neither.
+   * Guessing which one the repo meant would just move the silent-defaults bug here.
+   */
+  | { readonly kind: 'ambiguous'; readonly files: readonly string[] };
+
+/** Every `.oxfmtrc.*` file actually present at `root`, in a fixed, deterministic order. */
+async function present(root: string, names: readonly string[]): Promise<readonly string[]> {
+  const entries = new Set(await readdir(root).catch(() => []));
+  return names.filter((name) => entries.has(name));
+}
+
+export async function resolveOxfmtConfig(root: string): Promise<OxfmtConfigResolution> {
+  if ((await present(root, AUTO_DISCOVERED)).length > 0) return { kind: 'auto' };
+
+  const explicit = await present(root, NEEDS_EXPLICIT_CONFIG);
+  const [only, ...rest] = explicit;
+  if (only === undefined) return { kind: 'none' };
+  if (rest.length === 0) return { kind: 'explicit', path: `${root}/${only}` };
+  return { kind: 'ambiguous', files: explicit };
+}

package/src/hooks/report.ts

@@ -52,6 +52,21 @@ export async function capture(cmd: readonly string[]): Promise<string> {
   return (await probe(cmd)).stdout;
 }
 
+/**
+ * Run a command, relaying its stdout live-enough (after it exits) while also handing the
+ * caller the text — gates.ts reads oxfmt's own "on N files" summary from it. `stderr` stays
+ * `inherit`: diagnostics (a parse error, "no files matched") must show immediately, and nothing
+ * here needs to inspect them.
+ */
+export async function runCaptured(
+  cmd: readonly string[],
+): Promise<{ readonly code: number; readonly stdout: string }> {
+  const proc = Bun.spawn([...cmd], { stdout: 'pipe', stderr: 'inherit' });
+  const stdout = await new Response(proc.stdout).text();
+  process.stdout.write(stdout);
+  return { code: await proc.exited, stdout };
+}
+
 /** Capture a command's stdout AND its exit code — git plumbing that answers by status. */
 export async function probe(cmd: readonly string[]): Promise<{ code: number; stdout: string }> {
   const proc = Bun.spawn([...cmd], { stdout: 'pipe', stderr: 'ignore' });

package/src/repo-shape/dependabot.ts

@@ -1,36 +1,29 @@
 /**
- * `.github/dependabot.yml`, rendered — and the one group that carries kit releases.
+ * `.github/dependabot.yml`, rendered.
  *
  * ★ MEASURED BEFORE IT WAS RENDERED (2026-09-22): 1 of 14 repositories had a Dependabot
  *   config. Twelve took no dependency or Action updates at all, and nothing said so.
  *
- * ★ THE `homeflare` GROUP IS HOW A KIT RELEASE REACHES A CONSUMER (Tim, 2026-09-23:
- *   "Dependabot, grouped", checked daily, merged on green). Measured the same day, the
- *   leg nobody automated had drifted: proxmox and mini pinned `@homeflare/alchemy` 0.13.0
- *   while the kit had published 0.19.1. `automerge.ts` renders the workflow that arms
- *   auto-merge on this group's pull request and on nothing else.
+ * ⛔ `@homeflare/*` IS IGNORED HERE, NOT GROUPED (retired 2026-09-23, kit auto-bumper
+ *   design, Tim). A `homeflare` group and a rendered `dependabot-automerge.yml`
+ *   used to carry kit releases into a consumer; both are gone. `homeflare-bumper` does
+ *   that job now, over `workflow_dispatch` from this repo's own release, with a schedule
+ *   backstop — a Dependabot bump running at the same time would open a SECOND, competing
+ *   pull request for the same version bump. The `ignore` entry below is what stops that:
+ *   Dependabot never proposes `@homeflare/*` at all, so there is only ever one bump PR.
  *
  * Every Dependabot claim below was read from GitHub's docs or dependabot-core's source on
  * 2026-09-22 (dependabot-core v0.397.0); `docs/repo-shape-dependabot.md` has the citations.
  */
 import type { RepoShape } from './shape.ts';
 
-/**
- * The group's identifier. ⛔ IT IS ALSO HALF OF A BRANCH NAME the auto-merge workflow
- *   matches — dependabot-core names a group's branch `dependabot/bun/<group>-<10 hex>`
- *   (branch_namer/dependency_group_strategy.rb) — so it is exported, not retyped there.
- *   Dependabot requires an identifier that starts and ends with a letter.
- */
-export const HOMEFLARE_GROUP = 'homeflare';
-
 /** The first-party scope. Every package the kit publishes is under it. */
 export const HOMEFLARE_PATTERN = '@homeflare/*';
 
 /**
- * ★ SEVEN DAYS FOR THIRD-PARTY VERSIONS. The bun block has to run daily for the kit's sake
- *   (see below), so the weekly pace the estate had for everything else is kept by age
- *   instead of by calendar: a third-party release is proposed once it is a week old. That
- *   is also the supply-chain half — a compromised release is usually yanked within days.
+ * ★ SEVEN DAYS. A third-party release is proposed once it is a week old rather than on
+ *   Dependabot's undocumented-but-real 3-day default — that is also the supply-chain
+ *   half, since a compromised release is usually yanked within days.
  */
 export const THIRD_PARTY_COOLDOWN_DAYS = 7;
 
@@ -65,41 +58,33 @@ version: 2
 
 updates:
   # ── The toolchain (bun.lock) ────────────────────────────────────────────────
-  # ⚠️ BLOCKED UPSTREAM, 2026-09-22: bun 1.4 writes bun.lock \`lockfileVersion\` 2 and
-  #   Dependabot's updater bundles bun 1.3.14, which reads up to 1, so this block fails in
-  #   every estate repository with "Unsupported bun.lock 'lockfileVersion' 2". The fix is
+  # ⚠️ STILL BLOCKED UPSTREAM, 2026-09-22 — unrelated to the ignore below. bun 1.4 writes
+  #   bun.lock \`lockfileVersion\` 2 and Dependabot's updater bundles bun 1.3.14, which reads
+  #   up to 1, so this whole block fails in every estate repository with "Unsupported
+  #   bun.lock 'lockfileVersion' 2" before it reads a single manifest. The fix is
   #   dependabot/dependabot-core pull request 16071. The github-actions block is unaffected.
-  # ⛔ ONE BUN BLOCK, SO ONE SCHEDULE. Dependabot refuses two blocks for one ecosystem and
-  #   target branch whose directories overlap, so the \`homeflare\` group cannot be daily
-  #   while the rest stays weekly. The block is daily; \`cooldown\` slows the rest.
   - package-ecosystem: bun
     directories:
 ${bunDirs.map((dir) => `      - ${dir}`).join('\n')}
     schedule:
-      # ⚠️ Dependabot's \`daily\` is Monday to Friday; a weekend kit release lands on Monday.
-      interval: daily
+      interval: weekly
+      day: monday
       time: '09:00'
       timezone: America/New_York
-    # ⛔ THE EXCLUDE IS NOT OPTIONAL. Dependabot applies a 3-day cooldown to every version
-    #   update even when this key is absent, so without it a kit release would wait three
-    #   days before its bump opened — and "daily" would quietly mean "three days late".
     cooldown:
       default-days: ${THIRD_PARTY_COOLDOWN_DAYS}
-      exclude: ['${HOMEFLARE_PATTERN}']
+    # ⛔ NEVER PROPOSED HERE. \`homeflare-bumper\` opens the one pull request that bumps
+    #   \`@homeflare/*\` (kit auto-bumper design, Tim 2026-09-23) — a Dependabot
+    #   update for the same package would race it and, on the weeks they disagree, leave
+    #   two open pull requests fighting over the same \`package.json\` line.
+    ignore:
+      - dependency-name: '${HOMEFLARE_PATTERN}'
     open-pull-requests-limit: 5
     commit-message:
       prefix: 'chore'
       include: scope
     labels: [dependencies]
     groups:
-      # ★ FIRST, AND EVERY UPDATE TYPE. A kit release is one set of packages built to work
-      #   together, so they move as one pull request; \`bun run check\` is what reads it, and
-      #   .github/workflows/dependabot-automerge.yml merges it when that is green.
-      #   ⚠️ A release that changes what @homeflare/config renders fails the drift test here
-      #   by design; \`bun run repo-shape:refresh\` on the branch is the one-command fix.
-      ${HOMEFLARE_GROUP}:
-        patterns: ['${HOMEFLARE_PATTERN}']
-
       # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
       # noise unless they fail CI, which is what CI is for.
       lint-and-format:

package/src/repo-shape/render.ts

@@ -20,7 +20,6 @@
  *     test lives in `packages/alchemy/tests/repo-shape-policy.test.ts`, which is the one
  *     place that imports both.
  */
-import { renderAutomerge } from './automerge.ts';
 import { renderCi } from './ci.ts';
 import { renderActionlintConfig, renderChangesetConfig } from './companions.ts';
 import { renderDependabot } from './dependabot.ts';
@@ -68,7 +67,6 @@ export function renderRepoShape(shape: RepoShape): RenderedRepo {
     '.changeset/config.json': renderChangesetConfig(shape),
     '.github/dependabot.yml': renderDependabot(shape),
     '.github/workflows/ci.yml': renderCi(shape),
-    '.github/workflows/dependabot-automerge.yml': renderAutomerge(shape),
     '.github/workflows/security.yml': renderSecurity(shape),
   };
 
@@ -87,6 +85,5 @@ export const RENDERED_PATHS: readonly RenderedPath[] = [
   '.github/actionlint.yaml',
   '.github/dependabot.yml',
   '.github/workflows/ci.yml',
-  '.github/workflows/dependabot-automerge.yml',
   '.github/workflows/security.yml',
 ];

package/src/repo-shape/shape.ts

@@ -86,7 +86,6 @@ export type RenderedPath =
   | '.github/actionlint.yaml'
   | '.github/dependabot.yml'
   | '.github/workflows/ci.yml'
-  | '.github/workflows/dependabot-automerge.yml'
   | '.github/workflows/security.yml';
 
 export interface RepoShapeException {

package/src/repo-shape/yaml.ts

@@ -6,9 +6,15 @@
  *   this house are the product. The rendered workflows are written as text with holes;
  *   only the step lists, whose shape varies per repository, go through here.
  *
- * ⚠️ Bun can PARSE YAML natively (`Bun.YAML.parse`) but does not stringify it, measured
- *   against Bun 1.4.0 on 2026-09-22. The tests parse what this writes with `Bun.YAML.parse`
- *   and compare structures, so a malformed emission fails rather than shipping.
+ * ⚠️ Bun.YAML.stringify EXISTS (`Object.keys(Bun.YAML)` is `["parse", "stringify"]`,
+ *   measured against Bun 1.4.0 on 2026-09-23) but its output does not fit these rules:
+ *   (a) a multi-line `run:` comes out as a double-quoted string with `\n` escapes, e.g.
+ *   `run: "echo a\necho b\n"`, not a `|` block scalar; (b) `09:00` comes out UNQUOTED,
+ *   e.g. `cron: 09:00`, the YAML 1.1 sexagesimal trap the `scalar()` comment below guards
+ *   against; (c) a mapping key is followed by a trailing space, e.g. `"steps: \n  - ..."`;
+ *   and (d) a plain JS object has nowhere to attach a comment, so it cannot carry one. The
+ *   tests parse what this writes with `Bun.YAML.parse` and compare structures, so a
+ *   malformed emission fails rather than shipping.
  */
 import type { JobStep } from './shape.ts';
 
@@ -53,13 +59,29 @@ function renderMapping(
   return Object.entries(entries).map(([key, value]) => `${indent(depth)}${key}: ${scalar(value)}`);
 }
 
+/**
+ * Trim trailing `\n` characters the way `command.replace(/\n+$/, '')` used to, but
+ * linear instead of backtracking — the same pattern as `normalizeBaseUrl` in
+ * `packages/distilled-netbox/src/credentials.ts`. Exported so a test can compare it
+ * against the old regex directly.
+ *
+ * ⚠️ Linear on purpose: a `/\n+$/` regex backtracks polynomially on a long run of
+ *   "\n" that is not at the end (CodeQL js/polynomial-redos), and `command` here is
+ *   repository-configured step text.
+ */
+export function trimTrailingNewlines(value: string): string {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 10) end--;
+  return value.slice(0, end);
+}
+
 /**
  * ★ BLOCK SCALAR FOR EVERY MULTI-LINE `run:`. A folded or quoted form would join the
  *   lines, and a shell script whose `if` and `then` end up on one line is a syntax error
  *   at job time rather than at lint time. `|` keeps them exactly as written.
  */
 function renderRun(command: string, depth: number): string[] {
-  const lines = command.replace(/\n+$/, '').split('\n');
+  const lines = trimTrailingNewlines(command).split('\n');
   if (lines.length === 1) return [`${indent(depth)}run: ${scalar(lines[0] ?? '')}`];
   return [`${indent(depth)}run: |`, ...lines.map((line) => `${indent(depth + 1)}${line}`)];
 }

package/src/repo-shape.ts

@@ -17,8 +17,7 @@
  * That one file gives the repository:
  *
  *   · its FILES     — `bun run repo-shape:refresh` writes ci.yml, security.yml,
- *                     dependabot-automerge.yml, actionlint.yaml, dependabot.yml and
- *                     the changeset config;
+ *                     actionlint.yaml, dependabot.yml and the changeset config;
  *   · its DRIFT GATE — a `bun:test` calling `driftInRepoShape` fails on a hand edit;
  *   · its SETTINGS  — `renderRepoShape(shape).policy` is the options object
  *                     `@homeflare/alchemy`'s `declareRepoPolicy` takes, so the ruleset
@@ -34,11 +33,9 @@
  *   including the ones with no Alchemy stack, so it belongs to the package they all
  *   already have — and it takes no dependency on Alchemy or Effect to get there.
  */
-export { GROUP_BRANCH, GROUP_BRANCH_PREFIX, renderAutomerge } from './repo-shape/automerge.ts';
 export { renderCi, ACTIONLINT_VERSION, BUN_VERSION } from './repo-shape/ci.ts';
 export { renderActionlintConfig, renderChangesetConfig } from './repo-shape/companions.ts';
 export {
-  HOMEFLARE_GROUP,
   HOMEFLARE_PATTERN,
   renderDependabot,
   THIRD_PARTY_COOLDOWN_DAYS,

package/dist/repo-shape/automerge.d.ts

@@ -1,17 +0,0 @@
-import type { RepoShape } from './shape.ts';
-/**
- * The branch prefix a job-level `if:` can test with `startsWith`. GitHub's expression
- * language has no regex, so this is the cheap filter that keeps every other pull request
- * from taking a runner slot; `GROUP_BRANCH` is the exact test inside the step.
- */
-export declare const GROUP_BRANCH_PREFIX: string;
-/**
- * ⛔ EXACT, AND FAILS CLOSED. A solo update of `@homeflare/config` is
- *   `dependabot/bun/homeflare/config-0.9.0` and a package named `homeflare-x` would be
- *   `dependabot/bun/homeflare-x-1.2.3`; neither matches. If Dependabot ever changes its
- *   format, the symptom is a bump that waits for a person — never one merged by mistake.
- */
-export declare const GROUP_BRANCH: string;
-/** The whole `dependabot-automerge.yml` for a shape. */
-export declare function renderAutomerge(shape: RepoShape): string;
-//# sourceMappingURL=automerge.d.ts.map

package/dist/repo-shape/automerge.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"automerge.d.ts","sourceRoot":"","sources":["../../src/repo-shape/automerge.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAA6C,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,MAA+C,CAAC;AA0D3E,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAyCxD"}