@homeflare/config 0.12.0 → 0.13.0

package/dist/repo-shape/ci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../../src/repo-shape/ci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAqB,SAAS,EAAE,MAAM,YAAY,CAAC;AAI/D,8DAA8D;AAC9D,eAAO,MAAM,WAAW,UAAU,CAAC;AACnC,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAmL3C,sCAAsC;AACtC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAkCjD"}
+{"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../../src/repo-shape/ci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAqB,SAAS,EAAE,MAAM,YAAY,CAAC;AAI/D,8DAA8D;AAC9D,eAAO,MAAM,WAAW,UAAU,CAAC;AACnC,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAkM3C,sCAAsC;AACtC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAkCjD"}

package/dist/repo-shape/drift.d.ts

@@ -4,7 +4,7 @@ export type Problem = string;
 /** The command that makes a difference go away. Printed with every drift problem. */
 export declare const REFRESH_COMMAND = "bun run repo-shape:refresh";
 export interface DriftReport {
-    /** Empty when the committed files are the rendered ones. */
+    /** Empty when the committed files are the rendered ones and no retired path lingers. */
     readonly problems: readonly Problem[];
     /** Paths whose committed text differs from the render, excluding excepted files. */
     readonly drifted: readonly string[];

package/dist/repo-shape/drift.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drift.d.ts","sourceRoot":"","sources":["../../src/repo-shape/drift.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAgB,SAAS,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9E,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,qFAAqF;AACrF,eAAO,MAAM,eAAe,+BAA+B,CAAC;AA6C5D,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CA6BjG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAKpE"}
+{"version":3,"file":"drift.d.ts","sourceRoot":"","sources":["../../src/repo-shape/drift.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAgB,SAAS,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9E,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,qFAAqF;AACrF,eAAO,MAAM,eAAe,+BAA+B,CAAC;AA6D5D,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BjG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAKpE"}

package/dist/repo-shape/guards.d.ts

@@ -13,6 +13,11 @@
 export declare function requireNonEmpty(field: string, value: string): string;
 export declare function requireSentence(field: string, value: string): string;
 export declare function requireIsoDate(value: string): string;
+/**
+ * A retired file names the `@homeflare/config` release that stopped rendering it, so
+ * anyone reading `retired.ts` can find the changeset that made the call.
+ */
+export declare function requireSemver(value: string): string;
 /**
  * ⛔ A MAJOR, NOT A RANGE, AND NOT A FLOAT. `actions/setup-node` takes `node-version: 24`
  *   and resolves the newest 24.x; a fractional or negative value renders YAML the action

package/dist/repo-shape/guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/repo-shape/guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIpE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQpE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASlD"}
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/repo-shape/guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIpE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQpE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKnD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASlD"}

package/dist/repo-shape/refresh.d.ts

@@ -6,8 +6,12 @@ export interface RefreshResult {
     readonly unchanged: readonly string[];
     /** Paths skipped because the shape declares an exception for them. */
     readonly skipped: readonly string[];
+    /** Retired paths deleted because they still carried the generated-file header. */
+    readonly removed: readonly string[];
+    /** Retired paths left alone because they did not — provably hand-written, not ours. */
+    readonly refused: readonly string[];
 }
-/** Write a repository's rendered files into `projectDir`. */
+/** Write a repository's rendered files into `projectDir`, and clear its rendered fossils. */
 export declare function refreshRepoShape(projectDir: string, shape: RepoShape): Promise<RefreshResult>;
 /**
  * The `repo-shape:refresh` entry point. `--check` reports drift and exits non-zero

package/dist/repo-shape/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/repo-shape/refresh.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,SAAS,EAAc,MAAM,YAAY,CAAC;AAGxD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,6DAA6D;AAC7D,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,aAAa,CAAC,CAsBxB;AAiBD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CA+BjB"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/repo-shape/refresh.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,KAAK,SAAS,EAAc,MAAM,YAAY,CAAC;AAGxD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,6FAA6F;AAC7F,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,aAAa,CAAC,CAwBxB;AA4CD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CA2CjB"}

package/dist/repo-shape/retired.d.ts

@@ -0,0 +1,54 @@
+/**
+ * A path `@homeflare/config` no longer renders, but may still find committed in a
+ * repository that refreshed before the retirement. Extend this union at the same time a
+ * path is added to `RETIRED_FILES` below — never reuse one already there.
+ */
+export type RetiredPath = '.github/workflows/dependabot-automerge.yml';
+export interface RetiredFile {
+    /** The path this package rendered, once. */
+    readonly path: RetiredPath;
+    /** The `@homeflare/config` version whose release stopped rendering it. */
+    readonly retiredIn: string;
+    /** Why, and which kit change did it — written at the retirement, like `except()`'s reason. */
+    readonly reason: string;
+}
+/** Every path `@homeflare/config` used to render, oldest retirement first. */
+export declare const RETIRED_FILES: readonly RetiredFile[];
+/**
+ * The substring every generated file's header has carried since this package's first
+ * renderer. Kept independent of the four current renderers' own copies of this text
+ * (`ci.ts`, `security.ts`, `dependabot.ts`, `companions.ts`) on purpose: a future wording
+ * change to the live header must not stop this module recognising a file rendered under
+ * the old one.
+ */
+export declare const GENERATED_FILE_MARKER = "\uD83E\uDD16 RENDERED BY @homeflare/config";
+/**
+ * Whether `content` is provably a file this package once wrote.
+ *
+ * ⚠️ THE MARKER HAS TO START A LINE OF ITS OWN, NOT MERELY OCCUR SOMEWHERE IN THE TEXT.
+ *   Every real header carries it as a whole comment line — `# 🤖 RENDERED BY
+ *   @homeflare/config — DO NOT EDIT…`, third line in every renderer in this directory, so
+ *   this does not require it to be the FIRST line — but a bare `content.includes(...)`
+ *   would also match a hand-written file that merely *talks about* the marker, e.g. a
+ *   comment reading "this file used to be 🤖 RENDERED BY @homeflare/config before it was
+ *   retired; keeping it by hand now" — adversarial review, 2026-09-24, caught this exact
+ *   case before it shipped. Requiring the marker at the start of a trimmed line is what a
+ *   sentence built around it, rather than a header line consisting of it, cannot satisfy.
+ *   `repo-shape-retired.test.ts` asserts the mid-sentence form stays refused.
+ *
+ * ⚠️ STILL A PREFIX CHECK ON THAT LINE, NOT A FULL-LINE EXACT MATCH. The retired renderer
+ *   varied its trailing header prose by `shape.runner` and by repository name, and a
+ *   future wording change to what follows the marker on a live renderer's header must not
+ *   stop this recognising a file rendered under the old wording — only the marker itself,
+ *   `🤖 RENDERED BY @homeflare/config`, has been constant across every renderer this
+ *   package has ever shipped.
+ */
+export declare function wasRenderedByUs(content: string): boolean;
+/**
+ * The message `driftInRepoShape` reports for a retired path that is still present, and
+ * `repoShapeCli --check` prints verbatim. Names the fix command either way — whether that
+ * command can actually remove the file depends on `wasRenderedByUs`, which only
+ * `refreshRepoShape` (holding the file's contents) can decide.
+ */
+export declare function retiredFileProblem(file: RetiredFile): string;
+//# sourceMappingURL=retired.d.ts.map

package/dist/repo-shape/retired.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retired.d.ts","sourceRoot":"","sources":["../../src/repo-shape/retired.ts"],"names":[],"mappings":"AA8BA;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,4CAA4C,CAAC;AAEvE,MAAM,WAAW,WAAW;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAUD,8EAA8E;AAC9E,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAQ/C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,+CAAqC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIxD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAK5D"}

package/dist/repo-shape.d.ts

@@ -39,6 +39,7 @@ export { HOMEFLARE_PATTERN, renderDependabot, THIRD_PARTY_COOLDOWN_DAYS, } from
 export { type DriftReport, type Problem, driftInRepoShape, exceptionSummary, REFRESH_COMMAND, } from './repo-shape/drift.ts';
 export { type RefreshResult, refreshRepoShape, repoShapeCli } from './repo-shape/refresh.ts';
 export { type RenderedRepo, type RepoShapePolicy, RENDERED_PATHS, renderRepoShape, } from './repo-shape/render.ts';
+export { type RetiredFile, type RetiredPath, GENERATED_FILE_MARKER, RETIRED_FILES, retiredFileProblem, wasRenderedByUs, } from './repo-shape/retired.ts';
 export { renderSecurity } from './repo-shape/security.ts';
 export { type ExtraJob, type JobStep, type RenderedPath, type RepoRunner, type RepoShape, type RepoShapeException, type Stated, except, extraJob, isExcepted, runsOn, } from './repo-shape/shape.ts';
 //# sourceMappingURL=repo-shape.d.ts.map

package/dist/repo-shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-shape.d.ts","sourceRoot":"","sources":["../src/repo-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACX,MAAM,EACN,QAAQ,EACR,UAAU,EACV,MAAM,GACP,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"repo-shape.d.ts","sourceRoot":"","sources":["../src/repo-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACX,MAAM,EACN,QAAQ,EACR,UAAU,EACV,MAAM,GACP,MAAM,uBAAuB,CAAC"}

package/dist/repo-shape.js

@@ -20,6 +20,12 @@ function requireIsoDate(value) {
   }
   return value;
 }
+function requireSemver(value) {
+  if (!/^\d+\.\d+\.\d+$/.test(value)) {
+    throw new Error(`repo-shape: retiredIn must be a released x.y.z, got ${JSON.stringify(value)}`);
+  }
+  return value;
+}
 function requireMajor(value) {
   if (!Number.isInteger(value) || value <= 0) {
     throw new Error(`repo-shape: node must be a positive integer major, got ${value}`);
@@ -179,6 +185,21 @@ permissions:
 concurrency:
   group: ci-\${{ github.ref }}
   cancel-in-progress: true
+
+# \u26D4 SECOND GUARD, NOT THE FIRST ONE. The estate's primary Alchemy telemetry opt-out is the
+#   persisted \`~/.alchemy/telemetry-disabled\` file (Tim, 2026-09-26), which a CI runner never
+#   has \u2014 a self-hosted job starts a fresh container per run and a GitHub-hosted one is a fresh
+#   VM every time, so neither has read the file even if this estate's account somehow wrote it
+#   there. \`DO_NOT_TRACK\` is the opt-out alchemy's telemetry layer actually reads
+#   (\`!!process.env.DO_NOT_TRACK\`, alchemy \`src/Telemetry/Attributes.ts:126-129\`); this env
+#   applies to every job and step in this workflow. No repository's \`check\` invokes the Alchemy
+#   CLI today, measured 2026-09-26 (grepped every ci/security/release workflow for
+#   \`alchemy\`/\`bin/cli.js\`, zero hits), but alchemy's own \`Test\` helpers wire \`TelemetryLive\`
+#   into top-level \`deploy\`/\`destroy\` (\`src/Test/Core.ts:470,482\`), so a future kit test built on
+#   those (today's kit tests use only \`test.provider\` scratch stacks, which don't) would send
+#   telemetry from \`bun test\` without this guard \u2014 this closes that gap in advance.
+env:
+  DO_NOT_TRACK: '1'
 `;
 var CHECK_NOTE = `  # \u2500\u2500 One job, one install \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   # \u2605 WAS 3 SEPARATE JOBS: lint and format, types, tests. They shared an identical
@@ -549,6 +570,30 @@ var RENDERED_PATHS = [
   ".github/workflows/security.yml"
 ];
 
+// src/repo-shape/retired.ts
+function retire(file) {
+  return {
+    path: file.path,
+    reason: requireSentence("retired reason", file.reason),
+    retiredIn: requireSemver(file.retiredIn)
+  };
+}
+var RETIRED_FILES = [
+  retire({
+    path: ".github/workflows/dependabot-automerge.yml",
+    reason: "kit PR 199 retired the Dependabot @homeflare group; taslabs-net/homeflare-bumper " + "carries a kit release into each consumer now, over the kit's own release workflow",
+    retiredIn: "0.12.0"
+  })
+];
+var GENERATED_FILE_MARKER = "\uD83E\uDD16 RENDERED BY @homeflare/config";
+function wasRenderedByUs(content) {
+  return content.split(`
+`).some((line) => line.trimStart().startsWith(`# ${GENERATED_FILE_MARKER}`));
+}
+function retiredFileProblem(file) {
+  return `${file.path}: retired in @homeflare/config@${file.retiredIn} (${file.reason}) ` + "but still present \u2014 run `bun run repo-shape:refresh` to remove it";
+}
+
 // src/repo-shape/drift.ts
 var REFRESH_COMMAND = "bun run repo-shape:refresh";
 function normalize(text) {
@@ -573,13 +618,23 @@ function duplicateExceptions(exceptions) {
   }
   return [...duplicated].map((file) => `${file}: declared as an exception more than once \u2014 keep one, with one reason`);
 }
+async function retiredFilesPresent(projectDir) {
+  const problems = [];
+  for (const file of RETIRED_FILES) {
+    if (await readIfPresent(`${projectDir}/${file.path}`) !== undefined) {
+      problems.push(retiredFileProblem(file));
+    }
+  }
+  return problems;
+}
 async function driftInRepoShape(projectDir, shape) {
   const rendered = renderRepoShape(shape);
   const exceptions = shape.exceptions ?? [];
   const excepted = new Map(exceptions.map((exception) => [exception.file, exception]));
   const problems = [
     ...duplicateExceptions(exceptions),
-    ...staleExceptions(rendered, exceptions)
+    ...staleExceptions(rendered, exceptions),
+    ...await retiredFilesPresent(projectDir)
   ];
   const drifted = [];
   for (const [path, expected] of Object.entries(rendered.files)) {
@@ -621,7 +676,25 @@ async function refreshRepoShape(projectDir, shape) {
     await Bun.write(target, contents);
     written.push(path);
   }
-  return { skipped, unchanged, written };
+  const { refused, removed } = await clearRetiredFiles(projectDir);
+  return { refused, removed, skipped, unchanged, written };
+}
+async function clearRetiredFiles(projectDir) {
+  const removed = [];
+  const refused = [];
+  for (const retiredFile of RETIRED_FILES) {
+    const target = `${projectDir}/${retiredFile.path}`;
+    const file = Bun.file(target);
+    if (!await file.exists())
+      continue;
+    if (wasRenderedByUs(await file.text())) {
+      await file.delete();
+      removed.push(retiredFile.path);
+    } else {
+      refused.push(retiredFile.path);
+    }
+  }
+  return { refused, removed };
 }
 async function say(stream, lines) {
   if (lines.length === 0)
@@ -652,16 +725,20 @@ async function repoShapeCli(projectDir, shape, argv) {
   await say(Bun.stdout, [
     ...result.written.map((path) => `wrote    ${path}`),
     ...result.unchanged.map((path) => `ok       ${path}`),
-    ...result.skipped.map((path) => `excepted ${path}`)
+    ...result.skipped.map((path) => `excepted ${path}`),
+    ...result.removed.map((path) => `removed  ${path} (retired; carried our header)`)
   ]);
+  await say(Bun.stderr, result.refused.map((path) => `refused  ${path} \u2014 present but not provably ours; not deleted. See docs/repo-shape-retired.md.`));
   return 0;
 }
 export {
   ACTIONLINT_VERSION,
   BUN_VERSION,
+  GENERATED_FILE_MARKER,
   HOMEFLARE_PATTERN,
   REFRESH_COMMAND,
   RENDERED_PATHS,
+  RETIRED_FILES,
   THIRD_PARTY_COOLDOWN_DAYS,
   driftInRepoShape,
   except,
@@ -676,8 +753,10 @@ export {
   renderRepoShape,
   renderSecurity,
   repoShapeCli,
-  runsOn
+  retiredFileProblem,
+  runsOn,
+  wasRenderedByUs
 };
 
-//# debugId=27828123E35E339964756E2164756E21
+//# debugId=DCEF4CB7F22E842764756E2164756E21
 //# sourceMappingURL=repo-shape.js.map