@homeflare/config 0.11.1 → 0.12.1

package/dist/repo-shape.js

@@ -1,106 +1,4 @@
 // @bun
-// src/repo-shape/dependabot.ts
-var HOMEFLARE_GROUP = "homeflare";
-var HOMEFLARE_PATTERN = "@homeflare/*";
-var THIRD_PARTY_COOLDOWN_DAYS = 7;
-function renderDependabot(shape) {
-  const bunDirs = shape.publishes ? ["/", "/packages/*"] : ["/"];
-  return `# Dependabot for ${shape.repository}.
-#
-# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
-#    Refresh with \`bun run repo-shape:refresh\`.
-#
-# \u26D4 THIS FILE LIVES AT .github/dependabot.yml, NOT IN .github/workflows/. Dependabot is a
-#   platform feature, not an Action \u2014 a config placed among the workflows is silently
-#   ignored, and the symptom is simply that no pull requests ever arrive. Measured
-#   2026-09-22: 13 of 14 HomeFlare repositories had no dependabot config at all, so their
-#   Actions and their toolchain went stale invisibly, which is exactly how nothing fails.
-#
-# \u2605 WHY GROUPED RATHER THAN ONE PR PER DEPENDENCY. The default opens a pull request per
-#   outdated package; that is a trickle nobody reviews properly. Each group below is a set
-#   that is either safe to take together or needs deciding together.
-#
-# \u2605 THE BILLING LOCK DOES NOT STOP THIS FILE. Dependabot runs as a GitHub-hosted "dynamic"
-#   workflow that GitHub's docs say "does not count towards your included GitHub Actions
-#   minutes"; measured 2026-09-22, a private estate repository's Dependabot job got a hosted
-#   runner 86 minutes after that account's ordinary hosted jobs were refused for billing.
-#   It cannot use the mini anyway: a self-hosted Dependabot runner must be Linux x64 with
-#   Docker, and the mini's runners are arm64 containers with no Docker socket.
-version: 2
-
-updates:
-  # \u2500\u2500 The toolchain (bun.lock) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  # \u26A0\uFE0F BLOCKED UPSTREAM, 2026-09-22: bun 1.4 writes bun.lock \`lockfileVersion\` 2 and
-  #   Dependabot's updater bundles bun 1.3.14, which reads up to 1, so this block fails in
-  #   every estate repository with "Unsupported bun.lock 'lockfileVersion' 2". The fix is
-  #   dependabot/dependabot-core pull request 16071. The github-actions block is unaffected.
-  # \u26D4 ONE BUN BLOCK, SO ONE SCHEDULE. Dependabot refuses two blocks for one ecosystem and
-  #   target branch whose directories overlap, so the \`homeflare\` group cannot be daily
-  #   while the rest stays weekly. The block is daily; \`cooldown\` slows the rest.
-  - package-ecosystem: bun
-    directories:
-${bunDirs.map((dir) => `      - ${dir}`).join(`
-`)}
-    schedule:
-      # \u26A0\uFE0F Dependabot's \`daily\` is Monday to Friday; a weekend kit release lands on Monday.
-      interval: daily
-      time: '09:00'
-      timezone: America/New_York
-    # \u26D4 THE EXCLUDE IS NOT OPTIONAL. Dependabot applies a 3-day cooldown to every version
-    #   update even when this key is absent, so without it a kit release would wait three
-    #   days before its bump opened \u2014 and "daily" would quietly mean "three days late".
-    cooldown:
-      default-days: ${THIRD_PARTY_COOLDOWN_DAYS}
-      exclude: ['${HOMEFLARE_PATTERN}']
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: 'chore'
-      include: scope
-    labels: [dependencies]
-    groups:
-      # \u2605 FIRST, AND EVERY UPDATE TYPE. A kit release is one set of packages built to work
-      #   together, so they move as one pull request; \`bun run check\` is what reads it, and
-      #   .github/workflows/dependabot-automerge.yml merges it when that is green.
-      #   \u26A0\uFE0F A release that changes what @homeflare/config renders fails the drift test here
-      #   by design; \`bun run repo-shape:refresh\` on the branch is the one-command fix.
-      ${HOMEFLARE_GROUP}:
-        patterns: ['${HOMEFLARE_PATTERN}']
-
-      # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
-      # noise unless they fail CI, which is what CI is for.
-      lint-and-format:
-        patterns: ['oxfmt', 'oxlint']
-        update-types: [minor, patch]
-
-      # \u26A0\uFE0F MAJORS EXCLUDED DELIBERATELY. TypeScript majors change what typechecks;
-      #   changesets majors have renamed inputs and dropped compatibility (the action's v2
-      #   did both). These want reading, not merging on green.
-      build-tooling:
-        patterns: ['typescript', '@changesets/*', '@types/bun']
-        update-types: [minor, patch]
-
-  # \u2500\u2500 The workflows themselves \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  # \u2605 Actions go stale invisibly: nothing fails, they just keep running old code. The
-  #   estate's first workflows pinned checkout@v5 (current: v7) and changesets/action@v1
-  #   (current: v2, with every input renamed) \u2014 measured 2026-09-15.
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: '09:00'
-      timezone: America/New_York
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: 'ci'
-    labels: [dependencies, github-actions]
-    groups:
-      actions:
-        patterns: ['*']
-        update-types: [minor, patch]
-`;
-}
-
 // src/repo-shape/guards.ts
 var SENTENCE = 12;
 function requireNonEmpty(field, value) {
@@ -122,6 +20,12 @@ function requireIsoDate(value) {
   }
   return value;
 }
+function requireSemver(value) {
+  if (!/^\d+\.\d+\.\d+$/.test(value)) {
+    throw new Error(`repo-shape: retiredIn must be a released x.y.z, got ${JSON.stringify(value)}`);
+  }
+  return value;
+}
 function requireMajor(value) {
   if (!Number.isInteger(value) || value <= 0) {
     throw new Error(`repo-shape: node must be a positive integer major, got ${value}`);
@@ -227,92 +131,6 @@ function renderSteps(steps, depth) {
 `);
 }
 
-// src/repo-shape/automerge.ts
-var GROUP_BRANCH_PREFIX = `dependabot/bun/${HOMEFLARE_GROUP}-`;
-var GROUP_BRANCH = `^${GROUP_BRANCH_PREFIX}[0-9a-f]{10}$`;
-var HEADER = `# Arms auto-merge on Dependabot's @homeflare/* group, and on nothing else.
-#
-# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
-#    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
-#
-# \u2605 HOW A KIT RELEASE ARRIVES: the \`${HOMEFLARE_GROUP}\` group in .github/dependabot.yml opens one
-#   pull request; this arms GitHub's auto-merge on it; the ruleset's required checks decide.
-#   Nothing here merges anything itself, and merging deploys nothing.
-# \u26D4 NO THIRD-PARTY ACTION. GitHub's own example uses dependabot/fetch-metadata, which its
-#   docs mark "not certified by GitHub"; the group is recognised by its branch name instead.
-# \u26D4 NO REQUIRED CHECK ON THE BASE BRANCH, NO ARMING: there \`gh pr merge --auto\` would merge
-#   at once, unchecked. The job fails instead, so the pull request waits for a person.
-# \u26A0\uFE0F A RENDERER CHANGE STILL NEEDS A PERSON. When a kit release changes what @homeflare/config
-#   renders, the bump fails \`check\` (the drift test) and never goes green. Run
-#   \`bun run repo-shape:refresh\` on Dependabot's branch and push. \u26D4 This workflow does not do
-#   it for you: a push made with GITHUB_TOKEN starts no workflow run, so a refreshed commit
-#   would never get the required checks and the pull request would wait forever.
-`;
-var TRIGGER = `name: dependabot auto-merge
-
-on:
-  pull_request:
-
-# \u26D4 NOTHING AT THE TOP; the one job asks for exactly what \`gh pr merge --auto\` needs.
-permissions: {}
-
-concurrency:
-  group: automerge-\${{ github.ref }}
-  cancel-in-progress: true
-`;
-var JOB_NOTE = `  # \u26D4 BOTH LOGINS, NOT EITHER. \`user.login\` is who opened the pull request; \`github.actor\` is
-  #   who started this run. A person pushing to Dependabot's branch changes the actor, so
-  #   their commit never arms anything; only Dependabot's own rebases do.`;
-var PERMISSIONS_NOTE = `    # \u2605 WHAT GitHub'S OWN EXAMPLE GRANTS FOR THIS STEP, AND NO MORE. A run Dependabot starts gets
-    #   a read-only GITHUB_TOKEN unless the workflow raises it ("Troubleshooting Dependabot on
-    #   GitHub Actions" \u2192 "Changing GITHUB_TOKEN permissions").`;
-var ARM = `set -euo pipefail
-if [[ ! "$HEAD_REF" =~ ${GROUP_BRANCH} ]]; then
-  echo "::notice::$HEAD_REF is not the ${HOMEFLARE_GROUP} group's branch; auto-merge not armed"
-  exit 0
-fi
-# \u26D4 gh merges a CLEAN or UNSTABLE pull request at once rather than arming it. Only a branch
-#   rule that requires a status check keeps it BLOCKED until the checks have passed.
-required=$(gh api "repos/$GITHUB_REPOSITORY/rules/branches/$BASE_REF" \\
-  --jq '[.[] | select(.type == "required_status_checks")] | length')
-if [ "$required" = 0 ]; then
-  echo "::error::$BASE_REF requires no status check, so gh would merge at once; auto-merge not armed"
-  exit 1
-fi
-# \u2605 --squash: the house repositories allow squash merges only (declareRepoPolicy).
-gh pr merge --auto --squash "$PR_URL"`;
-function renderAutomerge(shape) {
-  const headRef = "${{ github.head_ref }}";
-  const baseRef = "${{ github.base_ref }}";
-  const prUrl = "${{ github.event.pull_request.html_url }}";
-  const token = "${{ secrets.GITHUB_TOKEN }}";
-  const condition = [
-    "github.event.pull_request.user.login == 'dependabot[bot]'",
-    "github.actor == 'dependabot[bot]'",
-    `startsWith(github.head_ref, '${GROUP_BRANCH_PREFIX}')`
-  ].join(" && ");
-  return `${HEADER}
-${TRIGGER}
-jobs:
-${JOB_NOTE}
-  arm:
-    name: arm auto-merge
-    if: ${condition}
-    runs-on: ${runsOn(shape.runner)}
-${PERMISSIONS_NOTE}
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-${renderSteps([
-    {
-      env: { BASE_REF: baseRef, GH_TOKEN: token, HEAD_REF: headRef, PR_URL: prUrl },
-      name: "Arm auto-merge on the homeflare group",
-      run: ARM
-    }
-  ], 3)}
-`;
-}
 // src/repo-shape/ci.ts
 var BUN_VERSION = "1.4.0";
 var ACTIONLINT_VERSION = "1.7.12";
@@ -333,7 +151,7 @@ function runnerNote(shape) {
   ].join(`
 `);
 }
-var HEADER2 = `# Pull requests: is this code correct?
+var HEADER = `# Pull requests: is this code correct?
 #
 # \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
 #    Its input is this repository's \`repo-shape.ts\`. Change that, then:
@@ -346,7 +164,7 @@ var HEADER2 = `# Pull requests: is this code correct?
 #   share a prologue are steps inside \`check\`, so the install is paid once.
 # \u26D4 EVERY ACTION IS FIRST-PARTY OR THE VENDOR'S OWN, PINNED TO A MAJOR TAG.
 `;
-var TRIGGER2 = `name: ci
+var TRIGGER = `name: ci
 
 on:
   # \u26D4 NO \`push: branches: [main]\`. Every commit reaches main through a pull request whose
@@ -477,7 +295,7 @@ function renderCi(shape) {
   const on = runsOn(shape.runner);
   const extras = shape.extraJobs ?? [];
   const needs = ["check", "workflows", ...extras.map((job) => job.id)];
-  return `${HEADER2}${runnerNote(shape)}${TRIGGER2}
+  return `${HEADER}${runnerNote(shape)}${TRIGGER}
 jobs:
 ${CHECK_NOTE}
   check:
@@ -544,9 +362,101 @@ self-hosted-runner:
     - homeflare-mini
 `;
 }
+// src/repo-shape/dependabot.ts
+var HOMEFLARE_PATTERN = "@homeflare/*";
+var THIRD_PARTY_COOLDOWN_DAYS = 7;
+function renderDependabot(shape) {
+  const bunDirs = shape.publishes ? ["/", "/packages/*"] : ["/"];
+  return `# Dependabot for ${shape.repository}.
+#
+# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
+#    Refresh with \`bun run repo-shape:refresh\`.
+#
+# \u26D4 THIS FILE LIVES AT .github/dependabot.yml, NOT IN .github/workflows/. Dependabot is a
+#   platform feature, not an Action \u2014 a config placed among the workflows is silently
+#   ignored, and the symptom is simply that no pull requests ever arrive. Measured
+#   2026-09-22: 13 of 14 HomeFlare repositories had no dependabot config at all, so their
+#   Actions and their toolchain went stale invisibly, which is exactly how nothing fails.
+#
+# \u2605 WHY GROUPED RATHER THAN ONE PR PER DEPENDENCY. The default opens a pull request per
+#   outdated package; that is a trickle nobody reviews properly. Each group below is a set
+#   that is either safe to take together or needs deciding together.
+#
+# \u2605 THE BILLING LOCK DOES NOT STOP THIS FILE. Dependabot runs as a GitHub-hosted "dynamic"
+#   workflow that GitHub's docs say "does not count towards your included GitHub Actions
+#   minutes"; measured 2026-09-22, a private estate repository's Dependabot job got a hosted
+#   runner 86 minutes after that account's ordinary hosted jobs were refused for billing.
+#   It cannot use the mini anyway: a self-hosted Dependabot runner must be Linux x64 with
+#   Docker, and the mini's runners are arm64 containers with no Docker socket.
+version: 2
+
+updates:
+  # \u2500\u2500 The toolchain (bun.lock) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # \u26A0\uFE0F STILL BLOCKED UPSTREAM, 2026-09-22 \u2014 unrelated to the ignore below. bun 1.4 writes
+  #   bun.lock \`lockfileVersion\` 2 and Dependabot's updater bundles bun 1.3.14, which reads
+  #   up to 1, so this whole block fails in every estate repository with "Unsupported
+  #   bun.lock 'lockfileVersion' 2" before it reads a single manifest. The fix is
+  #   dependabot/dependabot-core pull request 16071. The github-actions block is unaffected.
+  - package-ecosystem: bun
+    directories:
+${bunDirs.map((dir) => `      - ${dir}`).join(`
+`)}
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:00'
+      timezone: America/New_York
+    cooldown:
+      default-days: ${THIRD_PARTY_COOLDOWN_DAYS}
+    # \u26D4 NEVER PROPOSED HERE. \`homeflare-bumper\` opens the one pull request that bumps
+    #   \`@homeflare/*\` (kit auto-bumper design, Tim 2026-09-23) \u2014 a Dependabot
+    #   update for the same package would race it and, on the weeks they disagree, leave
+    #   two open pull requests fighting over the same \`package.json\` line.
+    ignore:
+      - dependency-name: '${HOMEFLARE_PATTERN}'
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: 'chore'
+      include: scope
+    labels: [dependencies]
+    groups:
+      # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
+      # noise unless they fail CI, which is what CI is for.
+      lint-and-format:
+        patterns: ['oxfmt', 'oxlint']
+        update-types: [minor, patch]
+
+      # \u26A0\uFE0F MAJORS EXCLUDED DELIBERATELY. TypeScript majors change what typechecks;
+      #   changesets majors have renamed inputs and dropped compatibility (the action's v2
+      #   did both). These want reading, not merging on green.
+      build-tooling:
+        patterns: ['typescript', '@changesets/*', '@types/bun']
+        update-types: [minor, patch]
+
+  # \u2500\u2500 The workflows themselves \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # \u2605 Actions go stale invisibly: nothing fails, they just keep running old code. The
+  #   estate's first workflows pinned checkout@v5 (current: v7) and changesets/action@v1
+  #   (current: v2, with every input renamed) \u2014 measured 2026-09-15.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:00'
+      timezone: America/New_York
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: 'ci'
+    labels: [dependencies, github-actions]
+    groups:
+      actions:
+        patterns: ['*']
+        update-types: [minor, patch]
+`;
+}
 // src/repo-shape/security.ts
 var CRON = "41 6 * * 1";
-var HEADER3 = `# Secret scanning, on its own schedule and its own check.
+var HEADER2 = `# Secret scanning, on its own schedule and its own check.
 #
 # \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
 #    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
@@ -556,7 +466,7 @@ var HEADER3 = `# Secret scanning, on its own schedule and its own check.
 #   tomorrow can find a secret committed today), and it needs full history, which the CI
 #   jobs deliberately do not fetch.
 `;
-var TRIGGER3 = `name: security
+var TRIGGER2 = `name: security
 
 on:
   # \u26D4 NO \`push: branches: [main]\`, for the reason ci.yml gives: main only moves by
@@ -607,7 +517,7 @@ function renderSecurity(shape) {
     # \u26D4 THE SCHEDULED RUN GOES TO THE MINI TOO: if the runner daemon is down this queues
     #   rather than failing, so a missed weekly scan is silent. homeflare-mini's
     #   \`ci-runner\` vmalert group is what notices that, not this workflow.` : "";
-  return `${HEADER3}${TRIGGER3}
+  return `${HEADER2}${TRIGGER2}
 jobs:
   secrets:
     name: secret scan${scheduled}
@@ -627,7 +537,6 @@ function renderRepoShape(shape) {
     ".changeset/config.json": renderChangesetConfig(shape),
     ".github/dependabot.yml": renderDependabot(shape),
     ".github/workflows/ci.yml": renderCi(shape),
-    ".github/workflows/dependabot-automerge.yml": renderAutomerge(shape),
     ".github/workflows/security.yml": renderSecurity(shape)
   };
   const actionlint = renderActionlintConfig(shape);
@@ -643,10 +552,33 @@ var RENDERED_PATHS = [
   ".github/actionlint.yaml",
   ".github/dependabot.yml",
   ".github/workflows/ci.yml",
-  ".github/workflows/dependabot-automerge.yml",
   ".github/workflows/security.yml"
 ];
 
+// src/repo-shape/retired.ts
+function retire(file) {
+  return {
+    path: file.path,
+    reason: requireSentence("retired reason", file.reason),
+    retiredIn: requireSemver(file.retiredIn)
+  };
+}
+var RETIRED_FILES = [
+  retire({
+    path: ".github/workflows/dependabot-automerge.yml",
+    reason: "kit PR 199 retired the Dependabot @homeflare group; taslabs-net/homeflare-bumper " + "carries a kit release into each consumer now, over the kit's own release workflow",
+    retiredIn: "0.12.0"
+  })
+];
+var GENERATED_FILE_MARKER = "\uD83E\uDD16 RENDERED BY @homeflare/config";
+function wasRenderedByUs(content) {
+  return content.split(`
+`).some((line) => line.trimStart().startsWith(`# ${GENERATED_FILE_MARKER}`));
+}
+function retiredFileProblem(file) {
+  return `${file.path}: retired in @homeflare/config@${file.retiredIn} (${file.reason}) ` + "but still present \u2014 run `bun run repo-shape:refresh` to remove it";
+}
+
 // src/repo-shape/drift.ts
 var REFRESH_COMMAND = "bun run repo-shape:refresh";
 function normalize(text) {
@@ -671,13 +603,23 @@ function duplicateExceptions(exceptions) {
   }
   return [...duplicated].map((file) => `${file}: declared as an exception more than once \u2014 keep one, with one reason`);
 }
+async function retiredFilesPresent(projectDir) {
+  const problems = [];
+  for (const file of RETIRED_FILES) {
+    if (await readIfPresent(`${projectDir}/${file.path}`) !== undefined) {
+      problems.push(retiredFileProblem(file));
+    }
+  }
+  return problems;
+}
 async function driftInRepoShape(projectDir, shape) {
   const rendered = renderRepoShape(shape);
   const exceptions = shape.exceptions ?? [];
   const excepted = new Map(exceptions.map((exception) => [exception.file, exception]));
   const problems = [
     ...duplicateExceptions(exceptions),
-    ...staleExceptions(rendered, exceptions)
+    ...staleExceptions(rendered, exceptions),
+    ...await retiredFilesPresent(projectDir)
   ];
   const drifted = [];
   for (const [path, expected] of Object.entries(rendered.files)) {
@@ -719,7 +661,25 @@ async function refreshRepoShape(projectDir, shape) {
     await Bun.write(target, contents);
     written.push(path);
   }
-  return { skipped, unchanged, written };
+  const { refused, removed } = await clearRetiredFiles(projectDir);
+  return { refused, removed, skipped, unchanged, written };
+}
+async function clearRetiredFiles(projectDir) {
+  const removed = [];
+  const refused = [];
+  for (const retiredFile of RETIRED_FILES) {
+    const target = `${projectDir}/${retiredFile.path}`;
+    const file = Bun.file(target);
+    if (!await file.exists())
+      continue;
+    if (wasRenderedByUs(await file.text())) {
+      await file.delete();
+      removed.push(retiredFile.path);
+    } else {
+      refused.push(retiredFile.path);
+    }
+  }
+  return { refused, removed };
 }
 async function say(stream, lines) {
   if (lines.length === 0)
@@ -750,19 +710,20 @@ async function repoShapeCli(projectDir, shape, argv) {
   await say(Bun.stdout, [
     ...result.written.map((path) => `wrote    ${path}`),
     ...result.unchanged.map((path) => `ok       ${path}`),
-    ...result.skipped.map((path) => `excepted ${path}`)
+    ...result.skipped.map((path) => `excepted ${path}`),
+    ...result.removed.map((path) => `removed  ${path} (retired; carried our header)`)
   ]);
+  await say(Bun.stderr, result.refused.map((path) => `refused  ${path} \u2014 present but not provably ours; not deleted. See docs/repo-shape-retired.md.`));
   return 0;
 }
 export {
   ACTIONLINT_VERSION,
   BUN_VERSION,
-  GROUP_BRANCH,
-  GROUP_BRANCH_PREFIX,
-  HOMEFLARE_GROUP,
+  GENERATED_FILE_MARKER,
   HOMEFLARE_PATTERN,
   REFRESH_COMMAND,
   RENDERED_PATHS,
+  RETIRED_FILES,
   THIRD_PARTY_COOLDOWN_DAYS,
   driftInRepoShape,
   except,
@@ -771,15 +732,16 @@ export {
   isExcepted,
   refreshRepoShape,
   renderActionlintConfig,
-  renderAutomerge,
   renderChangesetConfig,
   renderCi,
   renderDependabot,
   renderRepoShape,
   renderSecurity,
   repoShapeCli,
-  runsOn
+  retiredFileProblem,
+  runsOn,
+  wasRenderedByUs
 };
 
-//# debugId=C9A5F54A65373F0A64756E2164756E21
+//# debugId=B40D338DD6A7FD1664756E2164756E21
 //# sourceMappingURL=repo-shape.js.map