@homeflare/config 0.3.0 → 0.5.0

package/README.md

@@ -14,7 +14,8 @@ bun add -D @homeflare/config
 | `tsconfig.base.json` | `extends` — owned code, full strictness          |
 | `tsconfig.app.json`  | `extends` — Worker apps (source-publishing deps) |
 | `tsconfig.lib.json`  | `extends` — packages that publish types          |
-| `oxlintrc.json`      | `extends` — 36 rules, 6 plugins                  |
+| `oxlintrc.json`      | `extends` — libraries                            |
+| `oxlintrc.app.json`  | `extends` — Worker / TanStack / Alchemy apps     |
 | `oxfmtrc.json`       | copy to `.oxfmtrc.json`                          |
 | `bunfig.toml`        | copy to `bunfig.toml`                            |
 
@@ -50,18 +51,28 @@ own. Override the flags back on in a project that does not import source-publish
 { "extends": ["./node_modules/@homeflare/config/oxlintrc.json"] }
 ```
 
+A Worker, TanStack Start, or Alchemy app:
+
+```json
+{ "extends": ["./node_modules/@homeflare/config/oxlintrc.app.json"] }
+```
+
 ⚠️ oxlint's `extends` takes **file paths**, not package names — there is no
 `eslint-config-*` style resolution, so the path into `node_modules` is written out.
 
-36 rules across `typescript`, `unicorn`, `oxc`, `import`, `react` and `jsx-a11y`. The ones
-worth knowing:
+The library preset is 36 rules across `typescript`, `unicorn`, `oxc`, `import`, `react`
+and `jsx-a11y`. The app preset extends it and turns off the collisions `--deny-warnings`
+hits on correct Worker/app code (measured 2026-09-16):
+
+- `no-console` off under `src/` — `console` _is_ Workers Logs.
+- `import/no-default-export` off — Alchemy, `Worker`, and TanStack entry files export
+  default.
+- `jsx-a11y/control-has-associated-label` off — Kumo initials triggers are labelled by
+  the design system, not a `htmlFor`.
+- `typescript/no-non-null-assertion` off in tests.
 
-- `no-console: error` — ⚠️ except where `console` _is_ the transport, as in a Worker
-  writing JSON for Workers Logs. Override it per file, not globally.
-- `typescript/no-non-null-assertion` — `!` hides exactly what `noUncheckedIndexedAccess`
-  is trying to surface.
-- `react/exhaustive-deps`, `jsx-a11y/click-events-have-key-events` — only bite in React
-  code; a Worker never sees them.
+⛔ Do not copy the library preset into an app and then disable those one by one. That is
+how every app grows a private oxlint.
 
 ## oxfmt and bunfig
 
@@ -73,8 +84,12 @@ cp node_modules/@homeflare/config/bunfig.toml  bunfig.toml
 ⚠️ `.oxfmtrc.json` needs the **leading dot**. Without it oxfmt silently uses its defaults,
 and the symptom is a formatter that rewrites your quotes.
 
-⛔ Neither format supports `extends`, so these two are copies. That means they can drift —
-which is what `@homeflare/config/check` exists to catch.
+⛔ oxfmt has no `extends`. Extra `ignorePatterns` are a **merge**: generated OpenAPI,
+`vendor/`, `**/generated/**`, `**/*.gen.ts` stay out of the formatter. ⛔ Identity
+comparison is the wrong gate — it rewrote 154 files to `singleQuote` and formatted
+vendor OpenAPI (measured 2026-09-16). Dropping a house ignore is still drift.
+
+`bunfig.toml` is still an exact copy.
 
 ## Keeping a project honest
 
@@ -86,8 +101,46 @@ if (problems.length > 0) throw new Error(problems.join('\n'));
 ```
 
 ★ Run it from a test. It asserts a project still extends the shared tsconfig and oxlint
-presets, and that its copied `.oxfmtrc.json` and `bunfig.toml` still match — so a project
-that quietly diverges fails its own suite rather than drifting for six months.
+presets, that `.oxfmtrc.json` keeps house style plus at least the house ignores, and that
+`bunfig.toml` still matches.
+
+## App releases (no npm)
+
+A HomeFlare app that does **not** publish a tarball still versions itself with Changesets
+and cuts a GitHub Release. It does not call `npm publish`.
+
+```ts
+import { runAppRelease } from '@homeflare/config/release';
+
+await runAppRelease(process.cwd());
+```
+
+`shouldRelease` proceeds only when `CHANGELOG.md` has `## <version>` (proof
+`changeset version` ran) AND no git tag `<name>@<version>` exists yet. A custom
+`publish-script` on changesets/action otherwise tags every changeset-less push to `main`
+(measured 2026-09-16/17; changesets/action#9).
+
+```ts
+import { runRequireReleaseConfig } from '@homeflare/config/require-release-config';
+
+await runRequireReleaseConfig();
+```
+
+⛔ A private `package.json` without `privatePackages.version: true` makes
+`changeset version` silently no-op. The guard fails that combination before the version
+command consumes the changeset file.
+
+⛔ A leftover `pnpm-workspace.yaml` that lists only nested packages hides the root.
+Measured 2026-09-17 on `homeflare-secrets`: `changeset version` exited 1 ("package
+homeflare-secrets which is not in the workspace") and no Version Packages PR opened.
+The workspace file must include `.` if it exists at all.
+
+⛔ Both helpers take the **app** cwd / paths. Defaulting from `import.meta.url` after
+publish would inspect `@homeflare/config` itself.
+
+Alchemy still owns `GitHub.Repository` (visibility, `deleteBranchOnMerge`, `hasWiki`) and
+`Cloudflare.state()`. The kit `main` ruleset is `scripts/apply-main-ruleset.ts`, not an
+Alchemy resource — see `docs/github-hygiene.md`.
 
 ## License
 

package/dist/changeset-workspace.d.ts

@@ -0,0 +1,5 @@
+export declare function workspacePackageNames(cwd: string): Promise<readonly string[]>;
+/** Package names in a changeset file's YAML frontmatter. */
+export declare function packagesNamedInChangeset(text: string): readonly string[];
+export declare function problemsFromPendingChangesets(cwd: string): Promise<readonly string[]>;
+//# sourceMappingURL=changeset-workspace.d.ts.map

package/dist/changeset-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changeset-workspace.d.ts","sourceRoot":"","sources":["../src/changeset-workspace.ts"],"names":[],"mappings":"AA0BA,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAcnF;AAkBD,4DAA4D;AAC5D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAMxE;AAED,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA2B3F"}

package/dist/check.d.ts

@@ -1,20 +1,3 @@
-/**
- * Assert that a project still stands on the shared config.
- *
- * ★ WHY THIS EXISTS. Two of the five presets — `.oxfmtrc.json` and `bunfig.toml` — have no
- *   `extends` mechanism, so adopting them means COPYING them. A copy drifts silently: the
- *   project keeps building, the rules quietly diverge, and nobody finds out until two
- *   repos disagree about how the same code should look.
- *
- * ⛔ IT REPORTS, IT DOES NOT REPAIR. A checker that rewrites a project's config would
- *   overwrite a deliberate local exception, and this cannot tell the difference between
- *   drift and a decision. It names what differs; a human decides which way to move.
- *
- * ⚠️ Every file it reads is parsed natively — `Bun.file().json()`, `Bun.TOML.parse`. No
- *   parsing dependency reaches a consumer.
- *   ⛔ NOT JSONC. Bun's `.json()` rejects comments (measured 2026-09-15), so a project
- *     whose tsconfig carries them is reported as unreadable rather than silently skipped.
- */
 /** One thing a project should fix, in the imperative. */
 export type Problem = string;
 /**

package/dist/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,yDAAyD;AACzD,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAkH7B;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CASlF"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAmBA,yDAAyD;AACzD,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAyI7B;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CASlF"}

package/dist/check.js

@@ -1,4 +1,22 @@
 // @bun
+// src/oxfmt.ts
+var STYLE_KEYS = ["printWidth", "useTabs", "singleQuote", "semi"];
+function problemsInOxfmt(preset, theirs) {
+  const problems = [];
+  for (const key of STYLE_KEYS) {
+    if (theirs[key] !== preset[key]) {
+      problems.push(`.oxfmtrc.json: ${key} differs from @homeflare/config \u2014 re-copy it, or say why it differs`);
+    }
+  }
+  const local = new Set(theirs.ignorePatterns ?? []);
+  for (const pattern of preset.ignorePatterns ?? []) {
+    if (!local.has(pattern)) {
+      problems.push(`.oxfmtrc.json: missing house ignore ${pattern} \u2014 generated files would be rewritten`);
+    }
+  }
+  return problems;
+}
+
 // src/check.ts
 function stripComments(text) {
   let out = "";
@@ -74,11 +92,27 @@ async function checkCopy(projectDir, file, parse, problems) {
     problems.push(`${file}: differs from @homeflare/config \u2014 re-copy it, or say why it differs`);
   }
 }
+async function checkOxfmt(projectDir, problems) {
+  const mine = Bun.file(`${projectDir}/.oxfmtrc.json`);
+  if (!await mine.exists()) {
+    problems.push(".oxfmtrc.json: missing \u2014 copy it from @homeflare/config");
+    return;
+  }
+  let theirs;
+  try {
+    theirs = JSON.parse(await mine.text());
+  } catch {
+    problems.push(".oxfmtrc.json: unparseable");
+    return;
+  }
+  const preset = JSON.parse(await Bun.file(`${presetDir()}oxfmtrc.json`).text());
+  problems.push(...problemsInOxfmt(preset, theirs));
+}
 async function checkProject(projectDir) {
   const problems = [];
   await checkExtends(projectDir, "tsconfig.json", "@homeflare/config/tsconfig", problems);
   await checkExtends(projectDir, ".oxlintrc.json", "@homeflare/config/oxlintrc", problems);
-  await checkCopy(projectDir, ".oxfmtrc.json", (t) => JSON.parse(t), problems);
+  await checkOxfmt(projectDir, problems);
   await checkCopy(projectDir, "bunfig.toml", (t) => Bun.TOML.parse(t), problems);
   return problems;
 }
@@ -86,5 +120,5 @@ export {
   checkProject
 };
 
-//# debugId=7F6869C495728F5464756E2164756E21
+//# debugId=550B779804E201AD64756E2164756E21
 //# sourceMappingURL=check.js.map

package/dist/check.js.map

@@ -1,10 +1,11 @@
 {
   "version": 3,
-  "sources": ["../src/check.ts"],
+  "sources": ["../src/oxfmt.ts", "../src/check.ts"],
   "sourcesContent": [
-    "/**\n * Assert that a project still stands on the shared config.\n *\n * ★ WHY THIS EXISTS. Two of the five presets — `.oxfmtrc.json` and `bunfig.toml` — have no\n *   `extends` mechanism, so adopting them means COPYING them. A copy drifts silently: the\n *   project keeps building, the rules quietly diverge, and nobody finds out until two\n *   repos disagree about how the same code should look.\n *\n * ⛔ IT REPORTS, IT DOES NOT REPAIR. A checker that rewrites a project's config would\n *   overwrite a deliberate local exception, and this cannot tell the difference between\n *   drift and a decision. It names what differs; a human decides which way to move.\n *\n * ⚠️ Every file it reads is parsed natively — `Bun.file().json()`, `Bun.TOML.parse`. No\n *   parsing dependency reaches a consumer.\n *   ⛔ NOT JSONC. Bun's `.json()` rejects comments (measured 2026-09-15), so a project\n *     whose tsconfig carries them is reported as unreadable rather than silently skipped.\n */\n\n/** One thing a project should fix, in the imperative. */\nexport type Problem = string;\n\ntype Json = Record<string, unknown>;\n\n/**\n * ⚠️ A tsconfig LEGITIMATELY carries comments — that is where the reasoning for a strict\n *   flag lives, and stripping them to satisfy a parser would be the wrong trade. Bun's\n *   `.json()` rejects them (measured 2026-09-15), so comments are removed before parsing\n *   rather than treated as a fault.\n * 🔴 A NAIVE REGEX CORRUPTS THE FILE IT IS READING. Measured while writing this: a\n *   `(^|[^:\"])//.*$` strip mangled `\"./node_modules/oxlint/...\"` — the `//` inside a\n *   STRING — turning valid JSON into a parse error reported as \"JSONC not supported\".\n *   So this walks the text and tracks whether it is inside a string, which is the\n *   smallest correct thing; a real JSONC parser would be a dependency every consumer\n *   inherits for one check.\n */\nfunction stripComments(text: string): string {\n  let out = '';\n  let inString = false;\n  let escaped = false;\n\n  for (let i = 0; i < text.length; i += 1) {\n    const ch = text[i] ?? '';\n    const next = text[i + 1] ?? '';\n\n    if (inString) {\n      out += ch;\n      if (escaped) escaped = false;\n      else if (ch === '\\\\') escaped = true;\n      else if (ch === '\"') inString = false;\n      continue;\n    }\n\n    if (ch === '\"') {\n      inString = true;\n      out += ch;\n    } else if (ch === '/' && next === '/') {\n      while (i < text.length && text[i] !== '\\n') i += 1;\n      out += '\\n';\n    } else if (ch === '/' && next === '*') {\n      i += 2;\n      while (i < text.length && !(text[i] === '*' && text[i + 1] === '/')) i += 1;\n      i += 1;\n    } else {\n      out += ch;\n    }\n  }\n\n  return out;\n}\n\nasync function readJson(path: string): Promise<Json | undefined> {\n  const file = Bun.file(path);\n  if (!(await file.exists())) return undefined;\n  try {\n    return JSON.parse(stripComments(await file.text())) as Json;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Where this package's own presets live, however it was installed. */\nfunction presetDir(): string {\n  return new URL('../', import.meta.url).pathname;\n}\n\nasync function checkExtends(\n  projectDir: string,\n  file: string,\n  needle: string,\n  problems: Problem[],\n): Promise<void> {\n  const config = await readJson(`${projectDir}/${file}`);\n  if (config === undefined) {\n    problems.push(`${file}: missing or unparseable (JSONC comments are not supported)`);\n    return;\n  }\n\n  const extended = JSON.stringify(config['extends'] ?? '');\n\n  // ⚠️ A WORKSPACE PATH COUNTS. Inside this repo the presets are referenced as\n  //   `./packages/config/...` rather than by package name, and reporting that as drift\n  //   would make the check fail in the one repo that defines the config.\n  const workspacePath = needle.replace('@homeflare/config/', 'packages/config/');\n  if (!extended.includes(needle) && !extended.includes(workspacePath)) {\n    problems.push(`${file}: does not extend ${needle} — it currently extends ${extended}`);\n  }\n}\n\n/**\n * Compare a copied file against the preset, ignoring formatting.\n * ⚠️ Structural comparison, not text: a project that reformats its copy has not drifted,\n *   and reporting that would train people to ignore this check.\n */\nasync function checkCopy(\n  projectDir: string,\n  file: string,\n  parse: (text: string) => unknown,\n  problems: Problem[],\n): Promise<void> {\n  const mine = Bun.file(`${projectDir}/${file}`);\n  if (!(await mine.exists())) {\n    problems.push(`${file}: missing — copy it from @homeflare/config`);\n    return;\n  }\n\n  const preset = parse(await Bun.file(`${presetDir()}${file.replace(/^\\./, '')}`).text());\n  const theirs = parse(await mine.text());\n\n  if (JSON.stringify(theirs) !== JSON.stringify(preset)) {\n    problems.push(`${file}: differs from @homeflare/config — re-copy it, or say why it differs`);\n  }\n}\n\n/**\n * Check a project directory. Returns an empty array when everything is in step.\n *\n *     const problems = await checkProject(process.cwd());\n *     expect(problems).toEqual([]);\n */\nexport async function checkProject(projectDir: string): Promise<readonly Problem[]> {\n  const problems: Problem[] = [];\n\n  await checkExtends(projectDir, 'tsconfig.json', '@homeflare/config/tsconfig', problems);\n  await checkExtends(projectDir, '.oxlintrc.json', '@homeflare/config/oxlintrc', problems);\n  await checkCopy(projectDir, '.oxfmtrc.json', (t) => JSON.parse(t) as unknown, problems);\n  await checkCopy(projectDir, 'bunfig.toml', (t) => Bun.TOML.parse(t), problems);\n\n  return problems;\n}\n"
+    "/**\n * House oxfmt is a COPY — the format has no `extends`.\n *\n * ⛔ IDENTITY WAS THE WRONG GATE. Measured 2026-09-16: a Worker/TanStack app that\n *   copied the preset verbatim would format vendor OpenAPI YAML, generated trees,\n *   TanStack routeTree files and openapi.json, and rewrite 154 files to singleQuote.\n *   Generated OpenAPI is an artefact; a quote flip there is a false diff, not style.\n *\n * ★ Extra `ignorePatterns` are therefore allowed. House style keys are not. Dropping\n *   a house ignore is still drift — that is how generated files get rewritten.\n */\n\nexport type OxfmtConfig = {\n  readonly printWidth?: number;\n  readonly useTabs?: boolean;\n  readonly singleQuote?: boolean;\n  readonly semi?: boolean;\n  readonly ignorePatterns?: readonly string[];\n  readonly [key: string]: unknown;\n};\n\nconst STYLE_KEYS = ['printWidth', 'useTabs', 'singleQuote', 'semi'] as const;\n\n/**\n * Problems in a project's `.oxfmtrc.json` against the house preset.\n * Empty means the copy still carries house style, and at least the house ignores.\n */\nexport function problemsInOxfmt(preset: OxfmtConfig, theirs: OxfmtConfig): readonly string[] {\n  const problems: string[] = [];\n\n  for (const key of STYLE_KEYS) {\n    if (theirs[key] !== preset[key]) {\n      problems.push(\n        `.oxfmtrc.json: ${key} differs from @homeflare/config — re-copy it, or say why it differs`,\n      );\n    }\n  }\n\n  const local = new Set(theirs.ignorePatterns ?? []);\n  for (const pattern of preset.ignorePatterns ?? []) {\n    if (!local.has(pattern)) {\n      problems.push(\n        `.oxfmtrc.json: missing house ignore ${pattern} — generated files would be rewritten`,\n      );\n    }\n  }\n\n  return problems;\n}\n",
+    "/**\n * Assert that a project still stands on the shared config.\n *\n * ★ WHY THIS EXISTS. Two of the five presets — `.oxfmtrc.json` and `bunfig.toml` — have no\n *   `extends` mechanism, so adopting them means COPYING them. A copy drifts silently: the\n *   project keeps building, the rules quietly diverge, and nobody finds out until two\n *   repos disagree about how the same code should look.\n *\n * ⛔ IT REPORTS, IT DOES NOT REPAIR. A checker that rewrites a project's config would\n *   overwrite a deliberate local exception, and this cannot tell the difference between\n *   drift and a decision. It names what differs; a human decides which way to move.\n *\n * ⚠️ Every file it reads is parsed natively — `Bun.file().json()`, `Bun.TOML.parse`. No\n *   parsing dependency reaches a consumer.\n *   ⛔ NOT JSONC. Bun's `.json()` rejects comments (measured 2026-09-15), so a project\n *     whose tsconfig carries them is reported as unreadable rather than silently skipped.\n */\nimport { type OxfmtConfig, problemsInOxfmt } from './oxfmt.ts';\n\n/** One thing a project should fix, in the imperative. */\nexport type Problem = string;\n\ntype Json = Record<string, unknown>;\n\n/**\n * ⚠️ A tsconfig LEGITIMATELY carries comments — that is where the reasoning for a strict\n *   flag lives, and stripping them to satisfy a parser would be the wrong trade. Bun's\n *   `.json()` rejects them (measured 2026-09-15), so comments are removed before parsing\n *   rather than treated as a fault.\n * 🔴 A NAIVE REGEX CORRUPTS THE FILE IT IS READING. Measured while writing this: a\n *   `(^|[^:\"])//.*$` strip mangled `\"./node_modules/oxlint/...\"` — the `//` inside a\n *   STRING — turning valid JSON into a parse error reported as \"JSONC not supported\".\n *   So this walks the text and tracks whether it is inside a string, which is the\n *   smallest correct thing; a real JSONC parser would be a dependency every consumer\n *   inherits for one check.\n */\nfunction stripComments(text: string): string {\n  let out = '';\n  let inString = false;\n  let escaped = false;\n\n  for (let i = 0; i < text.length; i += 1) {\n    const ch = text[i] ?? '';\n    const next = text[i + 1] ?? '';\n\n    if (inString) {\n      out += ch;\n      if (escaped) escaped = false;\n      else if (ch === '\\\\') escaped = true;\n      else if (ch === '\"') inString = false;\n      continue;\n    }\n\n    if (ch === '\"') {\n      inString = true;\n      out += ch;\n    } else if (ch === '/' && next === '/') {\n      while (i < text.length && text[i] !== '\\n') i += 1;\n      out += '\\n';\n    } else if (ch === '/' && next === '*') {\n      i += 2;\n      while (i < text.length && !(text[i] === '*' && text[i + 1] === '/')) i += 1;\n      i += 1;\n    } else {\n      out += ch;\n    }\n  }\n\n  return out;\n}\n\nasync function readJson(path: string): Promise<Json | undefined> {\n  const file = Bun.file(path);\n  if (!(await file.exists())) return undefined;\n  try {\n    return JSON.parse(stripComments(await file.text())) as Json;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Where this package's own presets live, however it was installed. */\nfunction presetDir(): string {\n  return new URL('../', import.meta.url).pathname;\n}\n\nasync function checkExtends(\n  projectDir: string,\n  file: string,\n  needle: string,\n  problems: Problem[],\n): Promise<void> {\n  const config = await readJson(`${projectDir}/${file}`);\n  if (config === undefined) {\n    problems.push(`${file}: missing or unparseable (JSONC comments are not supported)`);\n    return;\n  }\n\n  const extended = JSON.stringify(config['extends'] ?? '');\n\n  // ⚠️ A WORKSPACE PATH COUNTS. Inside this repo the presets are referenced as\n  //   `./packages/config/...` rather than by package name, and reporting that as drift\n  //   would make the check fail in the one repo that defines the config.\n  const workspacePath = needle.replace('@homeflare/config/', 'packages/config/');\n  if (!extended.includes(needle) && !extended.includes(workspacePath)) {\n    problems.push(`${file}: does not extend ${needle} — it currently extends ${extended}`);\n  }\n}\n\n/**\n * Compare a copied file against the preset, ignoring formatting.\n * ⚠️ Structural comparison, not text: a project that reformats its copy has not drifted,\n *   and reporting that would train people to ignore this check.\n */\nasync function checkCopy(\n  projectDir: string,\n  file: string,\n  parse: (text: string) => unknown,\n  problems: Problem[],\n): Promise<void> {\n  const mine = Bun.file(`${projectDir}/${file}`);\n  if (!(await mine.exists())) {\n    problems.push(`${file}: missing — copy it from @homeflare/config`);\n    return;\n  }\n\n  const preset = parse(await Bun.file(`${presetDir()}${file.replace(/^\\./, '')}`).text());\n  const theirs = parse(await mine.text());\n\n  if (JSON.stringify(theirs) !== JSON.stringify(preset)) {\n    problems.push(`${file}: differs from @homeflare/config — re-copy it, or say why it differs`);\n  }\n}\n\n/**\n * House oxfmt has no `extends`. Extra ignores are a merge; style keys are not.\n * ⛔ Identity comparison rewrote generated OpenAPI (measured 2026-09-16).\n */\nasync function checkOxfmt(projectDir: string, problems: Problem[]): Promise<void> {\n  const mine = Bun.file(`${projectDir}/.oxfmtrc.json`);\n  if (!(await mine.exists())) {\n    problems.push('.oxfmtrc.json: missing — copy it from @homeflare/config');\n    return;\n  }\n\n  let theirs: OxfmtConfig;\n  try {\n    theirs = JSON.parse(await mine.text()) as OxfmtConfig;\n  } catch {\n    problems.push('.oxfmtrc.json: unparseable');\n    return;\n  }\n\n  const preset = JSON.parse(await Bun.file(`${presetDir()}oxfmtrc.json`).text()) as OxfmtConfig;\n  problems.push(...problemsInOxfmt(preset, theirs));\n}\n\n/**\n * Check a project directory. Returns an empty array when everything is in step.\n *\n *     const problems = await checkProject(process.cwd());\n *     expect(problems).toEqual([]);\n */\nexport async function checkProject(projectDir: string): Promise<readonly Problem[]> {\n  const problems: Problem[] = [];\n\n  await checkExtends(projectDir, 'tsconfig.json', '@homeflare/config/tsconfig', problems);\n  await checkExtends(projectDir, '.oxlintrc.json', '@homeflare/config/oxlintrc', problems);\n  await checkOxfmt(projectDir, problems);\n  await checkCopy(projectDir, 'bunfig.toml', (t) => Bun.TOML.parse(t), problems);\n\n  return problems;\n}\n"
   ],
-  "mappings": ";;AAmCA,SAAS,aAAa,CAAC,MAAsB;AAAA,EAC3C,IAAI,MAAM;AAAA,EACV,IAAI,WAAW;AAAA,EACf,IAAI,UAAU;AAAA,EAEd,SAAS,IAAI,EAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AAAA,IACvC,MAAM,KAAK,KAAK,MAAM;AAAA,IACtB,MAAM,OAAO,KAAK,IAAI,MAAM;AAAA,IAE5B,IAAI,UAAU;AAAA,MACZ,OAAO;AAAA,MACP,IAAI;AAAA,QAAS,UAAU;AAAA,MAClB,SAAI,OAAO;AAAA,QAAM,UAAU;AAAA,MAC3B,SAAI,OAAO;AAAA,QAAK,WAAW;AAAA,MAChC;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,KAAK;AAAA,MACd,WAAW;AAAA,MACX,OAAO;AAAA,IACT,EAAO,SAAI,OAAO,OAAO,SAAS,KAAK;AAAA,MACrC,OAAO,IAAI,KAAK,UAAU,KAAK,OAAO;AAAA;AAAA,QAAM,KAAK;AAAA,MACjD,OAAO;AAAA;AAAA,IACT,EAAO,SAAI,OAAO,OAAO,SAAS,KAAK;AAAA,MACrC,KAAK;AAAA,MACL,OAAO,IAAI,KAAK,UAAU,EAAE,KAAK,OAAO,OAAO,KAAK,IAAI,OAAO;AAAA,QAAM,KAAK;AAAA,MAC1E,KAAK;AAAA,IACP,EAAO;AAAA,MACL,OAAO;AAAA;AAAA,EAEX;AAAA,EAEA,OAAO;AAAA;AAGT,eAAe,QAAQ,CAAC,MAAyC;AAAA,EAC/D,MAAM,OAAO,IAAI,KAAK,IAAI;AAAA,EAC1B,IAAI,CAAE,MAAM,KAAK,OAAO;AAAA,IAAI;AAAA,EAC5B,IAAI;AAAA,IACF,OAAO,KAAK,MAAM,cAAc,MAAM,KAAK,KAAK,CAAC,CAAC;AAAA,IAClD,MAAM;AAAA,IACN;AAAA;AAAA;AAKJ,SAAS,SAAS,GAAW;AAAA,EAC3B,OAAO,IAAI,IAAI,OAAO,YAAY,GAAG,EAAE;AAAA;AAGzC,eAAe,YAAY,CACzB,YACA,MACA,QACA,UACe;AAAA,EACf,MAAM,SAAS,MAAM,SAAS,GAAG,cAAc,MAAM;AAAA,EACrD,IAAI,WAAW,WAAW;AAAA,IACxB,SAAS,KAAK,GAAG,iEAAiE;AAAA,IAClF;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,KAAK,UAAU,OAAO,cAAc,EAAE;AAAA,EAKvD,MAAM,gBAAgB,OAAO,QAAQ,sBAAsB,kBAAkB;AAAA,EAC7E,IAAI,CAAC,SAAS,SAAS,MAAM,KAAK,CAAC,SAAS,SAAS,aAAa,GAAG;AAAA,IACnE,SAAS,KAAK,GAAG,yBAAyB,sCAAiC,UAAU;AAAA,EACvF;AAAA;AAQF,eAAe,SAAS,CACtB,YACA,MACA,OACA,UACe;AAAA,EACf,MAAM,OAAO,IAAI,KAAK,GAAG,cAAc,MAAM;AAAA,EAC7C,IAAI,CAAE,MAAM,KAAK,OAAO,GAAI;AAAA,IAC1B,SAAS,KAAK,GAAG,qDAAgD;AAAA,IACjE;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,MAAM,MAAM,IAAI,KAAK,GAAG,UAAU,IAAI,KAAK,QAAQ,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC;AAAA,EACtF,MAAM,SAAS,MAAM,MAAM,KAAK,KAAK,CAAC;AAAA,EAEtC,IAAI,KAAK,UAAU,MAAM,MAAM,KAAK,UAAU,MAAM,GAAG;AAAA,IACrD,SAAS,KAAK,GAAG,+EAA0E;AAAA,EAC7F;AAAA;AASF,eAAsB,YAAY,CAAC,YAAiD;AAAA,EAClF,MAAM,WAAsB,CAAC;AAAA,EAE7B,MAAM,aAAa,YAAY,iBAAiB,8BAA8B,QAAQ;AAAA,EACtF,MAAM,aAAa,YAAY,kBAAkB,8BAA8B,QAAQ;AAAA,EACvF,MAAM,UAAU,YAAY,iBAAiB,CAAC,MAAM,KAAK,MAAM,CAAC,GAAc,QAAQ;AAAA,EACtF,MAAM,UAAU,YAAY,eAAe,CAAC,MAAM,IAAI,KAAK,MAAM,CAAC,GAAG,QAAQ;AAAA,EAE7E,OAAO;AAAA;",
-  "debugId": "7F6869C495728F5464756E2164756E21",
+  "mappings": ";;AAqBA,IAAM,aAAa,CAAC,cAAc,WAAW,eAAe,MAAM;AAM3D,SAAS,eAAe,CAAC,QAAqB,QAAwC;AAAA,EAC3F,MAAM,WAAqB,CAAC;AAAA,EAE5B,WAAW,OAAO,YAAY;AAAA,IAC5B,IAAI,OAAO,SAAS,OAAO,MAAM;AAAA,MAC/B,SAAS,KACP,kBAAkB,6EACpB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,IAAI,IAAI,OAAO,kBAAkB,CAAC,CAAC;AAAA,EACjD,WAAW,WAAW,OAAO,kBAAkB,CAAC,GAAG;AAAA,IACjD,IAAI,CAAC,MAAM,IAAI,OAAO,GAAG;AAAA,MACvB,SAAS,KACP,uCAAuC,mDACzC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;;;ACXT,SAAS,aAAa,CAAC,MAAsB;AAAA,EAC3C,IAAI,MAAM;AAAA,EACV,IAAI,WAAW;AAAA,EACf,IAAI,UAAU;AAAA,EAEd,SAAS,IAAI,EAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AAAA,IACvC,MAAM,KAAK,KAAK,MAAM;AAAA,IACtB,MAAM,OAAO,KAAK,IAAI,MAAM;AAAA,IAE5B,IAAI,UAAU;AAAA,MACZ,OAAO;AAAA,MACP,IAAI;AAAA,QAAS,UAAU;AAAA,MAClB,SAAI,OAAO;AAAA,QAAM,UAAU;AAAA,MAC3B,SAAI,OAAO;AAAA,QAAK,WAAW;AAAA,MAChC;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,KAAK;AAAA,MACd,WAAW;AAAA,MACX,OAAO;AAAA,IACT,EAAO,SAAI,OAAO,OAAO,SAAS,KAAK;AAAA,MACrC,OAAO,IAAI,KAAK,UAAU,KAAK,OAAO;AAAA;AAAA,QAAM,KAAK;AAAA,MACjD,OAAO;AAAA;AAAA,IACT,EAAO,SAAI,OAAO,OAAO,SAAS,KAAK;AAAA,MACrC,KAAK;AAAA,MACL,OAAO,IAAI,KAAK,UAAU,EAAE,KAAK,OAAO,OAAO,KAAK,IAAI,OAAO;AAAA,QAAM,KAAK;AAAA,MAC1E,KAAK;AAAA,IACP,EAAO;AAAA,MACL,OAAO;AAAA;AAAA,EAEX;AAAA,EAEA,OAAO;AAAA;AAGT,eAAe,QAAQ,CAAC,MAAyC;AAAA,EAC/D,MAAM,OAAO,IAAI,KAAK,IAAI;AAAA,EAC1B,IAAI,CAAE,MAAM,KAAK,OAAO;AAAA,IAAI;AAAA,EAC5B,IAAI;AAAA,IACF,OAAO,KAAK,MAAM,cAAc,MAAM,KAAK,KAAK,CAAC,CAAC;AAAA,IAClD,MAAM;AAAA,IACN;AAAA;AAAA;AAKJ,SAAS,SAAS,GAAW;AAAA,EAC3B,OAAO,IAAI,IAAI,OAAO,YAAY,GAAG,EAAE;AAAA;AAGzC,eAAe,YAAY,CACzB,YACA,MACA,QACA,UACe;AAAA,EACf,MAAM,SAAS,MAAM,SAAS,GAAG,cAAc,MAAM;AAAA,EACrD,IAAI,WAAW,WAAW;AAAA,IACxB,SAAS,KAAK,GAAG,iEAAiE;AAAA,IAClF;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,KAAK,UAAU,OAAO,cAAc,EAAE;AAAA,EAKvD,MAAM,gBAAgB,OAAO,QAAQ,sBAAsB,kBAAkB;AAAA,EAC7E,IAAI,CAAC,SAAS,SAAS,MAAM,KAAK,CAAC,SAAS,SAAS,aAAa,GAAG;AAAA,IACnE,SAAS,KAAK,GAAG,yBAAyB,sCAAiC,UAAU;AAAA,EACvF;AAAA;AAQF,eAAe,SAAS,CACtB,YACA,MACA,OACA,UACe;AAAA,EACf,MAAM,OAAO,IAAI,KAAK,GAAG,cAAc,MAAM;AAAA,EAC7C,IAAI,CAAE,MAAM,KAAK,OAAO,GAAI;AAAA,IAC1B,SAAS,KAAK,GAAG,qDAAgD;AAAA,IACjE;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,MAAM,MAAM,IAAI,KAAK,GAAG,UAAU,IAAI,KAAK,QAAQ,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC;AAAA,EACtF,MAAM,SAAS,MAAM,MAAM,KAAK,KAAK,CAAC;AAAA,EAEtC,IAAI,KAAK,UAAU,MAAM,MAAM,KAAK,UAAU,MAAM,GAAG;AAAA,IACrD,SAAS,KAAK,GAAG,+EAA0E;AAAA,EAC7F;AAAA;AAOF,eAAe,UAAU,CAAC,YAAoB,UAAoC;AAAA,EAChF,MAAM,OAAO,IAAI,KAAK,GAAG,0BAA0B;AAAA,EACnD,IAAI,CAAE,MAAM,KAAK,OAAO,GAAI;AAAA,IAC1B,SAAS,KAAK,8DAAyD;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,MAAM,KAAK,KAAK,CAAC;AAAA,IACrC,MAAM;AAAA,IACN,SAAS,KAAK,4BAA4B;AAAA,IAC1C;AAAA;AAAA,EAGF,MAAM,SAAS,KAAK,MAAM,MAAM,IAAI,KAAK,GAAG,UAAU,eAAe,EAAE,KAAK,CAAC;AAAA,EAC7E,SAAS,KAAK,GAAG,gBAAgB,QAAQ,MAAM,CAAC;AAAA;AASlD,eAAsB,YAAY,CAAC,YAAiD;AAAA,EAClF,MAAM,WAAsB,CAAC;AAAA,EAE7B,MAAM,aAAa,YAAY,iBAAiB,8BAA8B,QAAQ;AAAA,EACtF,MAAM,aAAa,YAAY,kBAAkB,8BAA8B,QAAQ;AAAA,EACvF,MAAM,WAAW,YAAY,QAAQ;AAAA,EACrC,MAAM,UAAU,YAAY,eAAe,CAAC,MAAM,IAAI,KAAK,MAAM,CAAC,GAAG,QAAQ;AAAA,EAE7E,OAAO;AAAA;",
+  "debugId": "550B779804E201AD64756E2164756E21",
   "names": []
 }

package/dist/oxfmt.d.ts

@@ -0,0 +1,25 @@
+/**
+ * House oxfmt is a COPY — the format has no `extends`.
+ *
+ * ⛔ IDENTITY WAS THE WRONG GATE. Measured 2026-09-16: a Worker/TanStack app that
+ *   copied the preset verbatim would format vendor OpenAPI YAML, generated trees,
+ *   TanStack routeTree files and openapi.json, and rewrite 154 files to singleQuote.
+ *   Generated OpenAPI is an artefact; a quote flip there is a false diff, not style.
+ *
+ * ★ Extra `ignorePatterns` are therefore allowed. House style keys are not. Dropping
+ *   a house ignore is still drift — that is how generated files get rewritten.
+ */
+export type OxfmtConfig = {
+    readonly printWidth?: number;
+    readonly useTabs?: boolean;
+    readonly singleQuote?: boolean;
+    readonly semi?: boolean;
+    readonly ignorePatterns?: readonly string[];
+    readonly [key: string]: unknown;
+};
+/**
+ * Problems in a project's `.oxfmtrc.json` against the house preset.
+ * Empty means the copy still carries house style, and at least the house ignores.
+ */
+export declare function problemsInOxfmt(preset: OxfmtConfig, theirs: OxfmtConfig): readonly string[];
+//# sourceMappingURL=oxfmt.d.ts.map

package/dist/oxfmt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxfmt.d.ts","sourceRoot":"","sources":["../src/oxfmt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC,CAAC;AAIF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,MAAM,EAAE,CAqB3F"}

package/dist/release.d.ts

@@ -0,0 +1,54 @@
+/**
+ * No npm publish. Tag a GitHub Release — but ONLY when this version genuinely just
+ * came out of `changeset version`, never on an arbitrary changeset-less push to main.
+ *
+ * 🔴 MEASURED 2026-09-16/17 on homeflare-openbao, and documented upstream
+ *   (changesets/action's own README, changesets/action#9): a custom publish-script runs
+ *   on EVERY push to `main` that has zero pending changesets — not just the one push
+ *   right after a Version Packages PR merges. The README says so directly: "a commit
+ *   without any new changesets can always land on your base branch after a successful
+ *   publish... you need to figure out on your own how to skip." Unguarded, this would
+ *   tag `<name>@<version>` on every unrelated push to main once CHANGELOG.md exists.
+ *
+ * ★ THE CONDITION: proceed only if `CHANGELOG.md` has an entry for the current version
+ *   (proof `changeset version` really ran and wrote it) AND no git tag `<name>@<version>`
+ *   exists yet (proof this exact release was not already cut). Both checks are local —
+ *   no network, no GitHub API — and both work from the checkout `release.yml` already
+ *   has (`fetch-depth: 0`).
+ *
+ * ⛔ TELL changesets/action WHAT TO TAG. With a custom publish-script it learns what
+ *   shipped only from `CHANGESETS_OUTPUT`. Without it, the action warns "GitHub releases
+ *   and git tags cannot be created without this output" and creates neither.
+ */
+type Pkg = {
+    readonly name: string;
+    readonly version: string;
+};
+/**
+ * Does CHANGELOG.md have a heading for this exact version?
+ * @changesets/changelog-github writes `## <version>` for a single, non-monorepo package.
+ */
+export declare function changelogHasEntry(cwd: string, version: string): Promise<boolean>;
+/** Does this exact tag already exist? Local `git tag -l`, no network. */
+export declare function tagExists(cwd: string, tag: string): boolean;
+export type ReleaseDecision = {
+    readonly ok: boolean;
+    readonly reason: string;
+};
+export declare function shouldRelease(cwd: string, pkg: Pkg): Promise<ReleaseDecision>;
+/** One ndjson line changesets/action turns into a git tag and a GitHub Release. */
+export declare function tagEvent(pkg: Pkg): {
+    type: 'git-tag';
+    tag: string;
+    packageName: string;
+};
+/**
+ * App-repo publish-script. Reads `package.json` at `cwd`, gates on `shouldRelease`,
+ * and writes the tag event to `$CHANGESETS_OUTPUT` when this version is new.
+ *
+ * ⛔ `cwd` is the APP, never this package. Defaulting from `import.meta.url` after
+ *   publish would inspect `@homeflare/config` itself.
+ */
+export declare function runAppRelease(cwd: string): Promise<ReleaseDecision>;
+export {};
+//# sourceMappingURL=release.d.ts.map

package/dist/release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,KAAK,GAAG,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtF;AAED,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,CAanF;AAED,mFAAmF;AACnF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAExF;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAiBzE"}

package/dist/release.js

@@ -0,0 +1,59 @@
+// @bun
+// src/release.ts
+async function changelogHasEntry(cwd, version) {
+  const file = Bun.file(`${cwd}/CHANGELOG.md`);
+  if (!await file.exists())
+    return false;
+  const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^## ${escaped}$`, "m").test(await file.text());
+}
+function tagExists(cwd, tag) {
+  const result = Bun.spawnSync(["git", "tag", "-l", tag], { cwd });
+  return result.stdout.toString().trim() === tag;
+}
+async function shouldRelease(cwd, pkg) {
+  const tag = `${pkg.name}@${pkg.version}`;
+  if (!await changelogHasEntry(cwd, pkg.version)) {
+    return {
+      ok: false,
+      reason: `CHANGELOG.md has no "## ${pkg.version}" entry \u2014 changeset version has not run for this version`
+    };
+  }
+  if (tagExists(cwd, tag)) {
+    return { ok: false, reason: `${tag} already exists \u2014 this version was already released` };
+  }
+  return { ok: true, reason: `CHANGELOG.md has the entry and ${tag} does not exist yet` };
+}
+function tagEvent(pkg) {
+  return { type: "git-tag", tag: `${pkg.name}@${pkg.version}`, packageName: pkg.name };
+}
+async function runAppRelease(cwd) {
+  const pkg = await Bun.file(`${cwd}/package.json`).json();
+  const decision = await shouldRelease(cwd, pkg);
+  if (!decision.ok) {
+    process.stdout.write(`skip: ${decision.reason}
+`);
+    return decision;
+  }
+  const outputFile = process.env["CHANGESETS_OUTPUT"];
+  if (outputFile !== undefined) {
+    await Bun.write(outputFile, `${JSON.stringify(tagEvent(pkg))}
+`);
+  }
+  process.stdout.write(`${pkg.name}@${pkg.version} \u2014 no npm publish; tagged (${decision.reason}).
+`);
+  return decision;
+}
+if (import.meta.main) {
+  await runAppRelease(process.cwd());
+}
+export {
+  changelogHasEntry,
+  runAppRelease,
+  shouldRelease,
+  tagEvent,
+  tagExists
+};
+
+//# debugId=BB062728D267ADD364756E2164756E21
+//# sourceMappingURL=release.js.map

package/dist/release.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/release.ts"],
+  "sourcesContent": [
+    "/**\n * No npm publish. Tag a GitHub Release — but ONLY when this version genuinely just\n * came out of `changeset version`, never on an arbitrary changeset-less push to main.\n *\n * 🔴 MEASURED 2026-09-16/17 on homeflare-openbao, and documented upstream\n *   (changesets/action's own README, changesets/action#9): a custom publish-script runs\n *   on EVERY push to `main` that has zero pending changesets — not just the one push\n *   right after a Version Packages PR merges. The README says so directly: \"a commit\n *   without any new changesets can always land on your base branch after a successful\n *   publish... you need to figure out on your own how to skip.\" Unguarded, this would\n *   tag `<name>@<version>` on every unrelated push to main once CHANGELOG.md exists.\n *\n * ★ THE CONDITION: proceed only if `CHANGELOG.md` has an entry for the current version\n *   (proof `changeset version` really ran and wrote it) AND no git tag `<name>@<version>`\n *   exists yet (proof this exact release was not already cut). Both checks are local —\n *   no network, no GitHub API — and both work from the checkout `release.yml` already\n *   has (`fetch-depth: 0`).\n *\n * ⛔ TELL changesets/action WHAT TO TAG. With a custom publish-script it learns what\n *   shipped only from `CHANGESETS_OUTPUT`. Without it, the action warns \"GitHub releases\n *   and git tags cannot be created without this output\" and creates neither.\n */\ntype Pkg = { readonly name: string; readonly version: string };\n\n/**\n * Does CHANGELOG.md have a heading for this exact version?\n * @changesets/changelog-github writes `## <version>` for a single, non-monorepo package.\n */\nexport async function changelogHasEntry(cwd: string, version: string): Promise<boolean> {\n  const file = Bun.file(`${cwd}/CHANGELOG.md`);\n  if (!(await file.exists())) return false;\n\n  const escaped = version.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return new RegExp(`^## ${escaped}$`, 'm').test(await file.text());\n}\n\n/** Does this exact tag already exist? Local `git tag -l`, no network. */\nexport function tagExists(cwd: string, tag: string): boolean {\n  const result = Bun.spawnSync(['git', 'tag', '-l', tag], { cwd });\n  return result.stdout.toString().trim() === tag;\n}\n\nexport type ReleaseDecision = { readonly ok: boolean; readonly reason: string };\n\nexport async function shouldRelease(cwd: string, pkg: Pkg): Promise<ReleaseDecision> {\n  const tag = `${pkg.name}@${pkg.version}`;\n\n  if (!(await changelogHasEntry(cwd, pkg.version))) {\n    return {\n      ok: false,\n      reason: `CHANGELOG.md has no \"## ${pkg.version}\" entry — changeset version has not run for this version`,\n    };\n  }\n  if (tagExists(cwd, tag)) {\n    return { ok: false, reason: `${tag} already exists — this version was already released` };\n  }\n  return { ok: true, reason: `CHANGELOG.md has the entry and ${tag} does not exist yet` };\n}\n\n/** One ndjson line changesets/action turns into a git tag and a GitHub Release. */\nexport function tagEvent(pkg: Pkg): { type: 'git-tag'; tag: string; packageName: string } {\n  return { type: 'git-tag', tag: `${pkg.name}@${pkg.version}`, packageName: pkg.name };\n}\n\n/**\n * App-repo publish-script. Reads `package.json` at `cwd`, gates on `shouldRelease`,\n * and writes the tag event to `$CHANGESETS_OUTPUT` when this version is new.\n *\n * ⛔ `cwd` is the APP, never this package. Defaulting from `import.meta.url` after\n *   publish would inspect `@homeflare/config` itself.\n */\nexport async function runAppRelease(cwd: string): Promise<ReleaseDecision> {\n  const pkg = (await Bun.file(`${cwd}/package.json`).json()) as Pkg;\n  const decision = await shouldRelease(cwd, pkg);\n\n  if (!decision.ok) {\n    process.stdout.write(`skip: ${decision.reason}\\n`);\n    return decision;\n  }\n\n  const outputFile = process.env['CHANGESETS_OUTPUT'];\n  if (outputFile !== undefined) {\n    await Bun.write(outputFile, `${JSON.stringify(tagEvent(pkg))}\\n`);\n  }\n  process.stdout.write(\n    `${pkg.name}@${pkg.version} — no npm publish; tagged (${decision.reason}).\\n`,\n  );\n  return decision;\n}\n\nif (import.meta.main) {\n  await runAppRelease(process.cwd());\n}\n"
+  ],
+  "mappings": ";;AA4BA,eAAsB,iBAAiB,CAAC,KAAa,SAAmC;AAAA,EACtF,MAAM,OAAO,IAAI,KAAK,GAAG,kBAAkB;AAAA,EAC3C,IAAI,CAAE,MAAM,KAAK,OAAO;AAAA,IAAI,OAAO;AAAA,EAEnC,MAAM,UAAU,QAAQ,QAAQ,uBAAuB,MAAM;AAAA,EAC7D,OAAO,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,KAAK,MAAM,KAAK,KAAK,CAAC;AAAA;AAI3D,SAAS,SAAS,CAAC,KAAa,KAAsB;AAAA,EAC3D,MAAM,SAAS,IAAI,UAAU,CAAC,OAAO,OAAO,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC;AAAA,EAC/D,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,MAAM;AAAA;AAK7C,eAAsB,aAAa,CAAC,KAAa,KAAoC;AAAA,EACnF,MAAM,MAAM,GAAG,IAAI,QAAQ,IAAI;AAAA,EAE/B,IAAI,CAAE,MAAM,kBAAkB,KAAK,IAAI,OAAO,GAAI;AAAA,IAChD,OAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,2BAA2B,IAAI;AAAA,IACzC;AAAA,EACF;AAAA,EACA,IAAI,UAAU,KAAK,GAAG,GAAG;AAAA,IACvB,OAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,8DAAyD;AAAA,EAC1F;AAAA,EACA,OAAO,EAAE,IAAI,MAAM,QAAQ,kCAAkC,yBAAyB;AAAA;AAIjF,SAAS,QAAQ,CAAC,KAAiE;AAAA,EACxF,OAAO,EAAE,MAAM,WAAW,KAAK,GAAG,IAAI,QAAQ,IAAI,WAAW,aAAa,IAAI,KAAK;AAAA;AAUrF,eAAsB,aAAa,CAAC,KAAuC;AAAA,EACzE,MAAM,MAAO,MAAM,IAAI,KAAK,GAAG,kBAAkB,EAAE,KAAK;AAAA,EACxD,MAAM,WAAW,MAAM,cAAc,KAAK,GAAG;AAAA,EAE7C,IAAI,CAAC,SAAS,IAAI;AAAA,IAChB,QAAQ,OAAO,MAAM,SAAS,SAAS;AAAA,CAAU;AAAA,IACjD,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,QAAQ,IAAI;AAAA,EAC/B,IAAI,eAAe,WAAW;AAAA,IAC5B,MAAM,IAAI,MAAM,YAAY,GAAG,KAAK,UAAU,SAAS,GAAG,CAAC;AAAA,CAAK;AAAA,EAClE;AAAA,EACA,QAAQ,OAAO,MACb,GAAG,IAAI,QAAQ,IAAI,0CAAqC,SAAS;AAAA,CACnE;AAAA,EACA,OAAO;AAAA;AAGT,IAAI,kBAAkB;AAAA,EACpB,MAAM,cAAc,QAAQ,IAAI,CAAC;AACnC;",
+  "debugId": "BB062728D267ADD364756E2164756E21",
+  "names": []
+}

package/dist/require-release-config.d.ts

@@ -0,0 +1,11 @@
+export type ReleaseConfigPaths = {
+    readonly pkgPath: string;
+    readonly changesetConfigPath: string;
+};
+/** Resolve the two files a version command must see. Override in tests. */
+export declare function releaseConfigPaths(cwd?: string): ReleaseConfigPaths;
+/** One thing a project should fix, in the imperative. */
+export declare function problemsInReleaseConfig(paths: ReleaseConfigPaths): Promise<string[]>;
+/** Print and exit. App `version` scripts call this before `changeset version`. */
+export declare function runRequireReleaseConfig(paths?: Partial<ReleaseConfigPaths>): Promise<void>;
+//# sourceMappingURL=require-release-config.d.ts.map

package/dist/require-release-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-release-config.d.ts","sourceRoot":"","sources":["../src/require-release-config.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAsB,GAAG,kBAAkB,CAKlF;AAED,yDAAyD;AACzD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsB1F;AAED,kFAAkF;AAClF,wBAAsB,uBAAuB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhG"}

package/dist/require-release-config.js

@@ -0,0 +1,127 @@
+// @bun
+// src/changeset-workspace.ts
+import { readdir } from "fs/promises";
+function rootName(pkg) {
+  return typeof pkg.name === "string" ? [pkg.name] : [];
+}
+async function workspacePackageNames(cwd) {
+  const pnpm = Bun.file(`${cwd}/pnpm-workspace.yaml`);
+  if (await pnpm.exists()) {
+    const parsed = Bun.YAML.parse(await pnpm.text());
+    return namesFromPatterns(cwd, parsed.packages ?? []);
+  }
+  const pkg = await Bun.file(`${cwd}/package.json`).json();
+  if (pkg.workspaces !== undefined && pkg.workspaces.length > 0) {
+    return namesFromPatterns(cwd, pkg.workspaces);
+  }
+  return rootName(pkg);
+}
+async function namesFromPatterns(cwd, patterns) {
+  const names = [];
+  for (const pattern of patterns) {
+    if (pattern.includes("*"))
+      continue;
+    const pkgPath = pattern === "." ? `${cwd}/package.json` : `${cwd}/${pattern}/package.json`;
+    const file = Bun.file(pkgPath);
+    if (!await file.exists())
+      continue;
+    const name = (await file.json()).name;
+    if (typeof name === "string")
+      names.push(name);
+  }
+  return names;
+}
+function packagesNamedInChangeset(text) {
+  const match = /^---\n([\s\S]*?)\n---/m.exec(text);
+  if (match?.[1] === undefined)
+    return [];
+  const parsed = Bun.YAML.parse(match[1]);
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+    return [];
+  return Object.keys(parsed);
+}
+async function problemsFromPendingChangesets(cwd) {
+  let files;
+  try {
+    files = (await readdir(`${cwd}/.changeset`)).filter((name) => name.endsWith(".md") && name !== "README.md");
+  } catch {
+    return [];
+  }
+  if (files.length === 0)
+    return [];
+  const workspace = new Set(await workspacePackageNames(cwd));
+  const problems = [];
+  for (const name of files) {
+    const rel = `.changeset/${name}`;
+    for (const pkg of packagesNamedInChangeset(await Bun.file(`${cwd}/${rel}`).text())) {
+      if (!workspace.has(pkg)) {
+        problems.push(`${rel} names "${pkg}" which is not in the workspace \u2014 changeset version ` + "exits 1 (measured 2026-09-17: leftover pnpm-workspace.yaml listed nested " + "packages and hid the root)");
+      }
+    }
+  }
+  return problems;
+}
+
+// src/require-release-config.ts
+function releaseConfigPaths(cwd = process.cwd()) {
+  return {
+    pkgPath: `${cwd}/package.json`,
+    changesetConfigPath: `${cwd}/.changeset/config.json`
+  };
+}
+async function problemsInReleaseConfig(paths) {
+  const pkg = await Bun.file(paths.pkgPath).json();
+  const problems = [];
+  if (typeof pkg.version !== "string" || pkg.version.length === 0) {
+    problems.push(`${paths.pkgPath} has no "version" \u2014 changeset version would silently no-op`);
+  }
+  if (pkg.private === true) {
+    const changesetConfig = await Bun.file(paths.changesetConfigPath).json();
+    if (changesetConfig.privatePackages?.version !== true) {
+      problems.push(`${paths.changesetConfigPath} has no privatePackages.version: true \u2014 a private package ` + 'is excluded from versioning entirely, which reads as "nothing to release"');
+    }
+  }
+  const cwd = paths.pkgPath.replace(/\/package\.json$/, "");
+  problems.push(...await problemsFromPendingChangesets(cwd));
+  return problems;
+}
+async function runRequireReleaseConfig(paths) {
+  const defaults = releaseConfigPaths();
+  const resolved = {
+    pkgPath: paths?.pkgPath ?? defaults.pkgPath,
+    changesetConfigPath: paths?.changesetConfigPath ?? defaults.changesetConfigPath
+  };
+  const problems = await problemsInReleaseConfig(resolved);
+  if (problems.length > 0) {
+    process.stderr.write(`
+\u2717 changeset version would silently no-op:
+`);
+    for (const problem of problems)
+      process.stderr.write(`  - ${problem}
+`);
+    process.stderr.write(`
+  Fix the file(s) above in a reviewed commit, then re-run this.
+
+`);
+    process.exit(1);
+  }
+  const pkg = await Bun.file(resolved.pkgPath).json();
+  process.stdout.write(`ok: ${resolved.pkgPath} version is ${pkg.version}, privatePackages.version is set
+`);
+}
+if (import.meta.main) {
+  const pkgPath = process.argv[2];
+  const changesetConfigPath = process.argv[3];
+  await runRequireReleaseConfig({
+    ...pkgPath === undefined ? {} : { pkgPath },
+    ...changesetConfigPath === undefined ? {} : { changesetConfigPath }
+  });
+}
+export {
+  problemsInReleaseConfig,
+  releaseConfigPaths,
+  runRequireReleaseConfig
+};
+
+//# debugId=5B77C8600B7D3E7B64756E2164756E21
+//# sourceMappingURL=require-release-config.js.map

package/dist/require-release-config.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/changeset-workspace.ts", "../src/require-release-config.ts"],
+  "sourcesContent": [
+    "/**\n * Pending changesets must name a package Changesets actually considers a workspace\n * member. Otherwise `changeset version` exits 1 and no Version Packages PR opens.\n *\n * 🔴 MEASURED 2026-09-17 on homeflare-secrets. A leftover `pnpm-workspace.yaml`\n *   listed only `hfs` and `secret-vault`. `@changesets/cli` treats that file as the\n *   workspace, so the root package (`homeflare-secrets` — the GitHub Release) was\n *   \"not in the workspace\". The hygiene changeset named the root. Release on main\n *   failed; no Version PR, no tag.\n *\n * ★ Root is a member only when the workspace file says so (`.` or a package.json\n *   `workspaces` entry). Nested leftover packages keep their own package.json for\n *   their own tools; they are not this repo's release.\n */\nimport { readdir } from 'node:fs/promises';\n\ntype WorkspaceFile = { readonly packages?: readonly string[] };\ntype RootPkg = {\n  readonly name?: unknown;\n  readonly workspaces?: readonly string[];\n};\n\nfunction rootName(pkg: RootPkg): readonly string[] {\n  return typeof pkg.name === 'string' ? [pkg.name] : [];\n}\n\nexport async function workspacePackageNames(cwd: string): Promise<readonly string[]> {\n  const pnpm = Bun.file(`${cwd}/pnpm-workspace.yaml`);\n  if (await pnpm.exists()) {\n    const parsed = Bun.YAML.parse(await pnpm.text()) as WorkspaceFile;\n    return namesFromPatterns(cwd, parsed.packages ?? []);\n  }\n\n  const pkg = (await Bun.file(`${cwd}/package.json`).json()) as RootPkg;\n  // ★ Array form only. The yarn `{ packages: [] }` object is unused in this estate,\n  //   and `Array.isArray` does not narrow that union under exactOptionalPropertyTypes.\n  if (pkg.workspaces !== undefined && pkg.workspaces.length > 0) {\n    return namesFromPatterns(cwd, pkg.workspaces);\n  }\n  return rootName(pkg);\n}\n\nasync function namesFromPatterns(cwd: string, patterns: readonly string[]): Promise<string[]> {\n  const names: string[] = [];\n  for (const pattern of patterns) {\n    // ⛔ Full glob support is not the job. Changesets already expands globs; this\n    //   guard only needs `.` and literal directory members — the case that hid\n    //   the root. A `*` pattern is skipped rather than half-parsed.\n    if (pattern.includes('*')) continue;\n    const pkgPath = pattern === '.' ? `${cwd}/package.json` : `${cwd}/${pattern}/package.json`;\n    const file = Bun.file(pkgPath);\n    if (!(await file.exists())) continue;\n    const name = ((await file.json()) as { readonly name?: unknown }).name;\n    if (typeof name === 'string') names.push(name);\n  }\n  return names;\n}\n\n/** Package names in a changeset file's YAML frontmatter. */\nexport function packagesNamedInChangeset(text: string): readonly string[] {\n  const match = /^---\\n([\\s\\S]*?)\\n---/m.exec(text);\n  if (match?.[1] === undefined) return [];\n  const parsed = Bun.YAML.parse(match[1]);\n  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return [];\n  return Object.keys(parsed);\n}\n\nexport async function problemsFromPendingChangesets(cwd: string): Promise<readonly string[]> {\n  let files: string[];\n  try {\n    files = (await readdir(`${cwd}/.changeset`)).filter(\n      (name) => name.endsWith('.md') && name !== 'README.md',\n    );\n  } catch {\n    // Missing `.changeset` is not a fault — nothing pending.\n    return [];\n  }\n  if (files.length === 0) return [];\n\n  const workspace = new Set(await workspacePackageNames(cwd));\n  const problems: string[] = [];\n  for (const name of files) {\n    const rel = `.changeset/${name}`;\n    for (const pkg of packagesNamedInChangeset(await Bun.file(`${cwd}/${rel}`).text())) {\n      if (!workspace.has(pkg)) {\n        problems.push(\n          `${rel} names \"${pkg}\" which is not in the workspace — changeset version ` +\n            'exits 1 (measured 2026-09-17: leftover pnpm-workspace.yaml listed nested ' +\n            'packages and hid the root)',\n        );\n      }\n    }\n  }\n  return problems;\n}\n",
+    "/**\n * Refuse to let `changeset version` run against a config that would silently no-op.\n *\n * 🔴 MEASURED 2026-09-16 on homeflare-openbao, TWO INDEPENDENT WAYS TO GET THE SAME\n *   SILENT FAILURE. `@changesets/cli` 3.0.3 does neither of these things loudly:\n *   1. `package.json` with no \"version\" — `changeset version` consumes the pending\n *      changeset file, writes no `CHANGELOG.md`, leaves `package.json` untouched.\n *   2. `\"private\": true` with no `privatePackages.version: true` in\n *      `.changeset/config.json` — the package is excluded from versioning entirely;\n *      `changeset status` reports zero packages to bump even with a real version and a\n *      pending changeset file.\n *   Either gap alone reproduces the same no-op. Both are required together.\n *\n * ★ This is regression protection against either field being dropped — a bad merge, a\n *   hand-edit, a generator overwriting either file — not a bootstrap blocker.\n *\n * 🔴 A leftover `pnpm-workspace.yaml` that lists only nested packages hides the\n *   root. `changeset version` then exits 1 (\"package X is not in the workspace\") —\n *   measured 2026-09-17 on homeflare-secrets. `problemsFromPendingChangesets`\n *   fails that before the version command consumes the file.\n *\n * ⛔ Path defaults are `process.cwd()`, NEVER `import.meta.url`. After publish this\n *   file lives in `node_modules/@homeflare/config`; resolving next to it would check\n *   the published package, not the app that invoked it.\n */\nimport { problemsFromPendingChangesets } from './changeset-workspace.ts';\n\ntype Pkg = { readonly version?: unknown; readonly private?: unknown };\ntype ChangesetConfig = { readonly privatePackages?: { readonly version?: unknown } };\n\nexport type ReleaseConfigPaths = {\n  readonly pkgPath: string;\n  readonly changesetConfigPath: string;\n};\n\n/** Resolve the two files a version command must see. Override in tests. */\nexport function releaseConfigPaths(cwd: string = process.cwd()): ReleaseConfigPaths {\n  return {\n    pkgPath: `${cwd}/package.json`,\n    changesetConfigPath: `${cwd}/.changeset/config.json`,\n  };\n}\n\n/** One thing a project should fix, in the imperative. */\nexport async function problemsInReleaseConfig(paths: ReleaseConfigPaths): Promise<string[]> {\n  const pkg = (await Bun.file(paths.pkgPath).json()) as Pkg;\n  const problems: string[] = [];\n\n  if (typeof pkg.version !== 'string' || pkg.version.length === 0) {\n    problems.push(`${paths.pkgPath} has no \"version\" — changeset version would silently no-op`);\n  }\n\n  if (pkg.private === true) {\n    const changesetConfig = (await Bun.file(paths.changesetConfigPath).json()) as ChangesetConfig;\n    if (changesetConfig.privatePackages?.version !== true) {\n      problems.push(\n        `${paths.changesetConfigPath} has no privatePackages.version: true — a private package ` +\n          'is excluded from versioning entirely, which reads as \"nothing to release\"',\n      );\n    }\n  }\n\n  const cwd = paths.pkgPath.replace(/\\/package\\.json$/, '');\n  problems.push(...(await problemsFromPendingChangesets(cwd)));\n\n  return problems;\n}\n\n/** Print and exit. App `version` scripts call this before `changeset version`. */\nexport async function runRequireReleaseConfig(paths?: Partial<ReleaseConfigPaths>): Promise<void> {\n  // ⚠️ A spread of `{ pkgPath: undefined }` from `process.argv[2]` would overwrite the\n  //   cwd default. Only copy keys that are actually present.\n  const defaults = releaseConfigPaths();\n  const resolved: ReleaseConfigPaths = {\n    pkgPath: paths?.pkgPath ?? defaults.pkgPath,\n    changesetConfigPath: paths?.changesetConfigPath ?? defaults.changesetConfigPath,\n  };\n  const problems = await problemsInReleaseConfig(resolved);\n\n  if (problems.length > 0) {\n    process.stderr.write('\\n✗ changeset version would silently no-op:\\n');\n    for (const problem of problems) process.stderr.write(`  - ${problem}\\n`);\n    process.stderr.write('\\n  Fix the file(s) above in a reviewed commit, then re-run this.\\n\\n');\n    process.exit(1);\n  }\n\n  const pkg = (await Bun.file(resolved.pkgPath).json()) as Pkg;\n  process.stdout.write(\n    `ok: ${resolved.pkgPath} version is ${pkg.version}, privatePackages.version is set\\n`,\n  );\n}\n\nif (import.meta.main) {\n  const pkgPath = process.argv[2];\n  const changesetConfigPath = process.argv[3];\n  await runRequireReleaseConfig({\n    ...(pkgPath === undefined ? {} : { pkgPath }),\n    ...(changesetConfigPath === undefined ? {} : { changesetConfigPath }),\n  });\n}\n"
+  ],
+  "mappings": ";;AAcA;AAQA,SAAS,QAAQ,CAAC,KAAiC;AAAA,EACjD,OAAO,OAAO,IAAI,SAAS,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC;AAAA;AAGtD,eAAsB,qBAAqB,CAAC,KAAyC;AAAA,EACnF,MAAM,OAAO,IAAI,KAAK,GAAG,yBAAyB;AAAA,EAClD,IAAI,MAAM,KAAK,OAAO,GAAG;AAAA,IACvB,MAAM,SAAS,IAAI,KAAK,MAAM,MAAM,KAAK,KAAK,CAAC;AAAA,IAC/C,OAAO,kBAAkB,KAAK,OAAO,YAAY,CAAC,CAAC;AAAA,EACrD;AAAA,EAEA,MAAM,MAAO,MAAM,IAAI,KAAK,GAAG,kBAAkB,EAAE,KAAK;AAAA,EAGxD,IAAI,IAAI,eAAe,aAAa,IAAI,WAAW,SAAS,GAAG;AAAA,IAC7D,OAAO,kBAAkB,KAAK,IAAI,UAAU;AAAA,EAC9C;AAAA,EACA,OAAO,SAAS,GAAG;AAAA;AAGrB,eAAe,iBAAiB,CAAC,KAAa,UAAgD;AAAA,EAC5F,MAAM,QAAkB,CAAC;AAAA,EACzB,WAAW,WAAW,UAAU;AAAA,IAI9B,IAAI,QAAQ,SAAS,GAAG;AAAA,MAAG;AAAA,IAC3B,MAAM,UAAU,YAAY,MAAM,GAAG,qBAAqB,GAAG,OAAO;AAAA,IACpE,MAAM,OAAO,IAAI,KAAK,OAAO;AAAA,IAC7B,IAAI,CAAE,MAAM,KAAK,OAAO;AAAA,MAAI;AAAA,IAC5B,MAAM,QAAS,MAAM,KAAK,KAAK,GAAmC;AAAA,IAClE,IAAI,OAAO,SAAS;AAAA,MAAU,MAAM,KAAK,IAAI;AAAA,EAC/C;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,wBAAwB,CAAC,MAAiC;AAAA,EACxE,MAAM,QAAQ,yBAAyB,KAAK,IAAI;AAAA,EAChD,IAAI,QAAQ,OAAO;AAAA,IAAW,OAAO,CAAC;AAAA,EACtC,MAAM,SAAS,IAAI,KAAK,MAAM,MAAM,EAAE;AAAA,EACtC,IAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM;AAAA,IAAG,OAAO,CAAC;AAAA,EACpF,OAAO,OAAO,KAAK,MAAM;AAAA;AAG3B,eAAsB,6BAA6B,CAAC,KAAyC;AAAA,EAC3F,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,MAAM,QAAQ,GAAG,gBAAgB,GAAG,OAC3C,CAAC,SAAS,KAAK,SAAS,KAAK,KAAK,SAAS,WAC7C;AAAA,IACA,MAAM;AAAA,IAEN,OAAO,CAAC;AAAA;AAAA,EAEV,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO,CAAC;AAAA,EAEhC,MAAM,YAAY,IAAI,IAAI,MAAM,sBAAsB,GAAG,CAAC;AAAA,EAC1D,MAAM,WAAqB,CAAC;AAAA,EAC5B,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,MAAM,cAAc;AAAA,IAC1B,WAAW,OAAO,yBAAyB,MAAM,IAAI,KAAK,GAAG,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG;AAAA,MAClF,IAAI,CAAC,UAAU,IAAI,GAAG,GAAG;AAAA,QACvB,SAAS,KACP,GAAG,cAAc,iEACf,8EACA,4BACJ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACzDF,SAAS,kBAAkB,CAAC,MAAc,QAAQ,IAAI,GAAuB;AAAA,EAClF,OAAO;AAAA,IACL,SAAS,GAAG;AAAA,IACZ,qBAAqB,GAAG;AAAA,EAC1B;AAAA;AAIF,eAAsB,uBAAuB,CAAC,OAA8C;AAAA,EAC1F,MAAM,MAAO,MAAM,IAAI,KAAK,MAAM,OAAO,EAAE,KAAK;AAAA,EAChD,MAAM,WAAqB,CAAC;AAAA,EAE5B,IAAI,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,WAAW,GAAG;AAAA,IAC/D,SAAS,KAAK,GAAG,MAAM,wEAAmE;AAAA,EAC5F;AAAA,EAEA,IAAI,IAAI,YAAY,MAAM;AAAA,IACxB,MAAM,kBAAmB,MAAM,IAAI,KAAK,MAAM,mBAAmB,EAAE,KAAK;AAAA,IACxE,IAAI,gBAAgB,iBAAiB,YAAY,MAAM;AAAA,MACrD,SAAS,KACP,GAAG,MAAM,uFACP,2EACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,MAAM,QAAQ,QAAQ,oBAAoB,EAAE;AAAA,EACxD,SAAS,KAAK,GAAI,MAAM,8BAA8B,GAAG,CAAE;AAAA,EAE3D,OAAO;AAAA;AAIT,eAAsB,uBAAuB,CAAC,OAAoD;AAAA,EAGhG,MAAM,WAAW,mBAAmB;AAAA,EACpC,MAAM,WAA+B;AAAA,IACnC,SAAS,OAAO,WAAW,SAAS;AAAA,IACpC,qBAAqB,OAAO,uBAAuB,SAAS;AAAA,EAC9D;AAAA,EACA,MAAM,WAAW,MAAM,wBAAwB,QAAQ;AAAA,EAEvD,IAAI,SAAS,SAAS,GAAG;AAAA,IACvB,QAAQ,OAAO,MAAM;AAAA;AAAA,CAA+C;AAAA,IACpE,WAAW,WAAW;AAAA,MAAU,QAAQ,OAAO,MAAM,OAAO;AAAA,CAAW;AAAA,IACvE,QAAQ,OAAO,MAAM;AAAA;AAAA;AAAA,CAAuE;AAAA,IAC5F,QAAQ,KAAK,CAAC;AAAA,EAChB;AAAA,EAEA,MAAM,MAAO,MAAM,IAAI,KAAK,SAAS,OAAO,EAAE,KAAK;AAAA,EACnD,QAAQ,OAAO,MACb,OAAO,SAAS,sBAAsB,IAAI;AAAA,CAC5C;AAAA;AAGF,IAAI,kBAAkB;AAAA,EACpB,MAAM,UAAU,QAAQ,KAAK;AAAA,EAC7B,MAAM,sBAAsB,QAAQ,KAAK;AAAA,EACzC,MAAM,wBAAwB;AAAA,OACxB,YAAY,YAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,OACvC,wBAAwB,YAAY,CAAC,IAAI,EAAE,oBAAoB;AAAA,EACrE,CAAC;AACH;",
+  "debugId": "5B77C8600B7D3E7B64756E2164756E21",
+  "names": []
+}

package/oxfmtrc.json

@@ -3,5 +3,17 @@
   "useTabs": false,
   "singleQuote": true,
   "semi": true,
-  "ignorePatterns": ["**/node_modules/**", "**/dist/**", "**/coverage/**"]
+  "ignorePatterns": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/coverage/**",
+    "**/generated/**",
+    "**/*.gen.ts",
+    "**/vendor/**",
+    "**/*.openapi.yaml",
+    "**/*.openapi.yml",
+    "**/openapi.json",
+    "**/.wrangler/**",
+    "**/worker-configuration.d.ts"
+  ]
 }

package/oxlintrc.app.json

@@ -0,0 +1,32 @@
+{
+  "extends": ["./oxlintrc.json"],
+  "ignorePatterns": [
+    "dist/**",
+    "coverage/**",
+    "**/generated/**",
+    "**/*.gen.ts",
+    "**/vendor/**",
+    "**/*.openapi.yaml",
+    "**/*.openapi.yml",
+    "**/openapi.json"
+  ],
+  "rules": {
+    "import/no-default-export": "off",
+    "jsx-a11y/control-has-associated-label": "off"
+  },
+  "overrides": [
+    {
+      "files": ["src/**", "workers/**", "app/**"],
+      "rules": {
+        "no-console": "off"
+      }
+    },
+    {
+      "files": ["**/tests/**", "**/*.test.ts", "**/*.test.tsx", "**/*.spec.ts", "**/scripts/**"],
+      "rules": {
+        "no-console": "off",
+        "typescript/no-non-null-assertion": "off"
+      }
+    }
+  ]
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@homeflare/config",
-  "version": "0.3.0",
-  "description": "Shared tsconfig, oxlint and oxfmt configuration for HomeFlare projects.",
+  "version": "0.5.0",
+  "description": "Shared tsconfig, oxlint, oxfmt, and non-npm release helpers for HomeFlare projects.",
   "license": "MIT",
   "author": "Timothy Schneider",
   "repository": {
@@ -16,6 +16,7 @@
     "tsconfig.lib.json",
     "tsconfig.app.json",
     "oxlintrc.json",
+    "oxlintrc.app.json",
     "oxfmtrc.json",
     "bunfig.toml",
     "README.md",
@@ -27,12 +28,21 @@
     "./tsconfig.lib.json": "./tsconfig.lib.json",
     "./tsconfig.app.json": "./tsconfig.app.json",
     "./oxlintrc.json": "./oxlintrc.json",
+    "./oxlintrc.app.json": "./oxlintrc.app.json",
     "./oxfmtrc.json": "./oxfmtrc.json",
     "./bunfig.toml": "./bunfig.toml",
     "./check": {
       "types": "./dist/check.d.ts",
       "default": "./dist/check.js"
     },
+    "./release": {
+      "types": "./dist/release.d.ts",
+      "default": "./dist/release.js"
+    },
+    "./require-release-config": {
+      "types": "./dist/require-release-config.d.ts",
+      "default": "./dist/require-release-config.js"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {

package/src/changeset-workspace.ts

@@ -0,0 +1,95 @@
+/**
+ * Pending changesets must name a package Changesets actually considers a workspace
+ * member. Otherwise `changeset version` exits 1 and no Version Packages PR opens.
+ *
+ * 🔴 MEASURED 2026-09-17 on homeflare-secrets. A leftover `pnpm-workspace.yaml`
+ *   listed only `hfs` and `secret-vault`. `@changesets/cli` treats that file as the
+ *   workspace, so the root package (`homeflare-secrets` — the GitHub Release) was
+ *   "not in the workspace". The hygiene changeset named the root. Release on main
+ *   failed; no Version PR, no tag.
+ *
+ * ★ Root is a member only when the workspace file says so (`.` or a package.json
+ *   `workspaces` entry). Nested leftover packages keep their own package.json for
+ *   their own tools; they are not this repo's release.
+ */
+import { readdir } from 'node:fs/promises';
+
+type WorkspaceFile = { readonly packages?: readonly string[] };
+type RootPkg = {
+  readonly name?: unknown;
+  readonly workspaces?: readonly string[];
+};
+
+function rootName(pkg: RootPkg): readonly string[] {
+  return typeof pkg.name === 'string' ? [pkg.name] : [];
+}
+
+export async function workspacePackageNames(cwd: string): Promise<readonly string[]> {
+  const pnpm = Bun.file(`${cwd}/pnpm-workspace.yaml`);
+  if (await pnpm.exists()) {
+    const parsed = Bun.YAML.parse(await pnpm.text()) as WorkspaceFile;
+    return namesFromPatterns(cwd, parsed.packages ?? []);
+  }
+
+  const pkg = (await Bun.file(`${cwd}/package.json`).json()) as RootPkg;
+  // ★ Array form only. The yarn `{ packages: [] }` object is unused in this estate,
+  //   and `Array.isArray` does not narrow that union under exactOptionalPropertyTypes.
+  if (pkg.workspaces !== undefined && pkg.workspaces.length > 0) {
+    return namesFromPatterns(cwd, pkg.workspaces);
+  }
+  return rootName(pkg);
+}
+
+async function namesFromPatterns(cwd: string, patterns: readonly string[]): Promise<string[]> {
+  const names: string[] = [];
+  for (const pattern of patterns) {
+    // ⛔ Full glob support is not the job. Changesets already expands globs; this
+    //   guard only needs `.` and literal directory members — the case that hid
+    //   the root. A `*` pattern is skipped rather than half-parsed.
+    if (pattern.includes('*')) continue;
+    const pkgPath = pattern === '.' ? `${cwd}/package.json` : `${cwd}/${pattern}/package.json`;
+    const file = Bun.file(pkgPath);
+    if (!(await file.exists())) continue;
+    const name = ((await file.json()) as { readonly name?: unknown }).name;
+    if (typeof name === 'string') names.push(name);
+  }
+  return names;
+}
+
+/** Package names in a changeset file's YAML frontmatter. */
+export function packagesNamedInChangeset(text: string): readonly string[] {
+  const match = /^---\n([\s\S]*?)\n---/m.exec(text);
+  if (match?.[1] === undefined) return [];
+  const parsed = Bun.YAML.parse(match[1]);
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return [];
+  return Object.keys(parsed);
+}
+
+export async function problemsFromPendingChangesets(cwd: string): Promise<readonly string[]> {
+  let files: string[];
+  try {
+    files = (await readdir(`${cwd}/.changeset`)).filter(
+      (name) => name.endsWith('.md') && name !== 'README.md',
+    );
+  } catch {
+    // Missing `.changeset` is not a fault — nothing pending.
+    return [];
+  }
+  if (files.length === 0) return [];
+
+  const workspace = new Set(await workspacePackageNames(cwd));
+  const problems: string[] = [];
+  for (const name of files) {
+    const rel = `.changeset/${name}`;
+    for (const pkg of packagesNamedInChangeset(await Bun.file(`${cwd}/${rel}`).text())) {
+      if (!workspace.has(pkg)) {
+        problems.push(
+          `${rel} names "${pkg}" which is not in the workspace — changeset version ` +
+            'exits 1 (measured 2026-09-17: leftover pnpm-workspace.yaml listed nested ' +
+            'packages and hid the root)',
+        );
+      }
+    }
+  }
+  return problems;
+}

package/src/check.ts

@@ -15,6 +15,7 @@
  *   ⛔ NOT JSONC. Bun's `.json()` rejects comments (measured 2026-09-15), so a project
  *     whose tsconfig carries them is reported as unreadable rather than silently skipped.
  */
+import { type OxfmtConfig, problemsInOxfmt } from './oxfmt.ts';
 
 /** One thing a project should fix, in the imperative. */
 export type Problem = string;
@@ -131,6 +132,29 @@ async function checkCopy(
   }
 }
 
+/**
+ * House oxfmt has no `extends`. Extra ignores are a merge; style keys are not.
+ * ⛔ Identity comparison rewrote generated OpenAPI (measured 2026-09-16).
+ */
+async function checkOxfmt(projectDir: string, problems: Problem[]): Promise<void> {
+  const mine = Bun.file(`${projectDir}/.oxfmtrc.json`);
+  if (!(await mine.exists())) {
+    problems.push('.oxfmtrc.json: missing — copy it from @homeflare/config');
+    return;
+  }
+
+  let theirs: OxfmtConfig;
+  try {
+    theirs = JSON.parse(await mine.text()) as OxfmtConfig;
+  } catch {
+    problems.push('.oxfmtrc.json: unparseable');
+    return;
+  }
+
+  const preset = JSON.parse(await Bun.file(`${presetDir()}oxfmtrc.json`).text()) as OxfmtConfig;
+  problems.push(...problemsInOxfmt(preset, theirs));
+}
+
 /**
  * Check a project directory. Returns an empty array when everything is in step.
  *
@@ -142,7 +166,7 @@ export async function checkProject(projectDir: string): Promise<readonly Problem
 
   await checkExtends(projectDir, 'tsconfig.json', '@homeflare/config/tsconfig', problems);
   await checkExtends(projectDir, '.oxlintrc.json', '@homeflare/config/oxlintrc', problems);
-  await checkCopy(projectDir, '.oxfmtrc.json', (t) => JSON.parse(t) as unknown, problems);
+  await checkOxfmt(projectDir, problems);
   await checkCopy(projectDir, 'bunfig.toml', (t) => Bun.TOML.parse(t), problems);
 
   return problems;

package/src/oxfmt.ts

@@ -0,0 +1,49 @@
+/**
+ * House oxfmt is a COPY — the format has no `extends`.
+ *
+ * ⛔ IDENTITY WAS THE WRONG GATE. Measured 2026-09-16: a Worker/TanStack app that
+ *   copied the preset verbatim would format vendor OpenAPI YAML, generated trees,
+ *   TanStack routeTree files and openapi.json, and rewrite 154 files to singleQuote.
+ *   Generated OpenAPI is an artefact; a quote flip there is a false diff, not style.
+ *
+ * ★ Extra `ignorePatterns` are therefore allowed. House style keys are not. Dropping
+ *   a house ignore is still drift — that is how generated files get rewritten.
+ */
+
+export type OxfmtConfig = {
+  readonly printWidth?: number;
+  readonly useTabs?: boolean;
+  readonly singleQuote?: boolean;
+  readonly semi?: boolean;
+  readonly ignorePatterns?: readonly string[];
+  readonly [key: string]: unknown;
+};
+
+const STYLE_KEYS = ['printWidth', 'useTabs', 'singleQuote', 'semi'] as const;
+
+/**
+ * Problems in a project's `.oxfmtrc.json` against the house preset.
+ * Empty means the copy still carries house style, and at least the house ignores.
+ */
+export function problemsInOxfmt(preset: OxfmtConfig, theirs: OxfmtConfig): readonly string[] {
+  const problems: string[] = [];
+
+  for (const key of STYLE_KEYS) {
+    if (theirs[key] !== preset[key]) {
+      problems.push(
+        `.oxfmtrc.json: ${key} differs from @homeflare/config — re-copy it, or say why it differs`,
+      );
+    }
+  }
+
+  const local = new Set(theirs.ignorePatterns ?? []);
+  for (const pattern of preset.ignorePatterns ?? []) {
+    if (!local.has(pattern)) {
+      problems.push(
+        `.oxfmtrc.json: missing house ignore ${pattern} — generated files would be rewritten`,
+      );
+    }
+  }
+
+  return problems;
+}

package/src/release.ts

@@ -0,0 +1,93 @@
+/**
+ * No npm publish. Tag a GitHub Release — but ONLY when this version genuinely just
+ * came out of `changeset version`, never on an arbitrary changeset-less push to main.
+ *
+ * 🔴 MEASURED 2026-09-16/17 on homeflare-openbao, and documented upstream
+ *   (changesets/action's own README, changesets/action#9): a custom publish-script runs
+ *   on EVERY push to `main` that has zero pending changesets — not just the one push
+ *   right after a Version Packages PR merges. The README says so directly: "a commit
+ *   without any new changesets can always land on your base branch after a successful
+ *   publish... you need to figure out on your own how to skip." Unguarded, this would
+ *   tag `<name>@<version>` on every unrelated push to main once CHANGELOG.md exists.
+ *
+ * ★ THE CONDITION: proceed only if `CHANGELOG.md` has an entry for the current version
+ *   (proof `changeset version` really ran and wrote it) AND no git tag `<name>@<version>`
+ *   exists yet (proof this exact release was not already cut). Both checks are local —
+ *   no network, no GitHub API — and both work from the checkout `release.yml` already
+ *   has (`fetch-depth: 0`).
+ *
+ * ⛔ TELL changesets/action WHAT TO TAG. With a custom publish-script it learns what
+ *   shipped only from `CHANGESETS_OUTPUT`. Without it, the action warns "GitHub releases
+ *   and git tags cannot be created without this output" and creates neither.
+ */
+type Pkg = { readonly name: string; readonly version: string };
+
+/**
+ * Does CHANGELOG.md have a heading for this exact version?
+ * @changesets/changelog-github writes `## <version>` for a single, non-monorepo package.
+ */
+export async function changelogHasEntry(cwd: string, version: string): Promise<boolean> {
+  const file = Bun.file(`${cwd}/CHANGELOG.md`);
+  if (!(await file.exists())) return false;
+
+  const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`^## ${escaped}$`, 'm').test(await file.text());
+}
+
+/** Does this exact tag already exist? Local `git tag -l`, no network. */
+export function tagExists(cwd: string, tag: string): boolean {
+  const result = Bun.spawnSync(['git', 'tag', '-l', tag], { cwd });
+  return result.stdout.toString().trim() === tag;
+}
+
+export type ReleaseDecision = { readonly ok: boolean; readonly reason: string };
+
+export async function shouldRelease(cwd: string, pkg: Pkg): Promise<ReleaseDecision> {
+  const tag = `${pkg.name}@${pkg.version}`;
+
+  if (!(await changelogHasEntry(cwd, pkg.version))) {
+    return {
+      ok: false,
+      reason: `CHANGELOG.md has no "## ${pkg.version}" entry — changeset version has not run for this version`,
+    };
+  }
+  if (tagExists(cwd, tag)) {
+    return { ok: false, reason: `${tag} already exists — this version was already released` };
+  }
+  return { ok: true, reason: `CHANGELOG.md has the entry and ${tag} does not exist yet` };
+}
+
+/** One ndjson line changesets/action turns into a git tag and a GitHub Release. */
+export function tagEvent(pkg: Pkg): { type: 'git-tag'; tag: string; packageName: string } {
+  return { type: 'git-tag', tag: `${pkg.name}@${pkg.version}`, packageName: pkg.name };
+}
+
+/**
+ * App-repo publish-script. Reads `package.json` at `cwd`, gates on `shouldRelease`,
+ * and writes the tag event to `$CHANGESETS_OUTPUT` when this version is new.
+ *
+ * ⛔ `cwd` is the APP, never this package. Defaulting from `import.meta.url` after
+ *   publish would inspect `@homeflare/config` itself.
+ */
+export async function runAppRelease(cwd: string): Promise<ReleaseDecision> {
+  const pkg = (await Bun.file(`${cwd}/package.json`).json()) as Pkg;
+  const decision = await shouldRelease(cwd, pkg);
+
+  if (!decision.ok) {
+    process.stdout.write(`skip: ${decision.reason}\n`);
+    return decision;
+  }
+
+  const outputFile = process.env['CHANGESETS_OUTPUT'];
+  if (outputFile !== undefined) {
+    await Bun.write(outputFile, `${JSON.stringify(tagEvent(pkg))}\n`);
+  }
+  process.stdout.write(
+    `${pkg.name}@${pkg.version} — no npm publish; tagged (${decision.reason}).\n`,
+  );
+  return decision;
+}
+
+if (import.meta.main) {
+  await runAppRelease(process.cwd());
+}

package/src/require-release-config.ts

@@ -0,0 +1,100 @@
+/**
+ * Refuse to let `changeset version` run against a config that would silently no-op.
+ *
+ * 🔴 MEASURED 2026-09-16 on homeflare-openbao, TWO INDEPENDENT WAYS TO GET THE SAME
+ *   SILENT FAILURE. `@changesets/cli` 3.0.3 does neither of these things loudly:
+ *   1. `package.json` with no "version" — `changeset version` consumes the pending
+ *      changeset file, writes no `CHANGELOG.md`, leaves `package.json` untouched.
+ *   2. `"private": true` with no `privatePackages.version: true` in
+ *      `.changeset/config.json` — the package is excluded from versioning entirely;
+ *      `changeset status` reports zero packages to bump even with a real version and a
+ *      pending changeset file.
+ *   Either gap alone reproduces the same no-op. Both are required together.
+ *
+ * ★ This is regression protection against either field being dropped — a bad merge, a
+ *   hand-edit, a generator overwriting either file — not a bootstrap blocker.
+ *
+ * 🔴 A leftover `pnpm-workspace.yaml` that lists only nested packages hides the
+ *   root. `changeset version` then exits 1 ("package X is not in the workspace") —
+ *   measured 2026-09-17 on homeflare-secrets. `problemsFromPendingChangesets`
+ *   fails that before the version command consumes the file.
+ *
+ * ⛔ Path defaults are `process.cwd()`, NEVER `import.meta.url`. After publish this
+ *   file lives in `node_modules/@homeflare/config`; resolving next to it would check
+ *   the published package, not the app that invoked it.
+ */
+import { problemsFromPendingChangesets } from './changeset-workspace.ts';
+
+type Pkg = { readonly version?: unknown; readonly private?: unknown };
+type ChangesetConfig = { readonly privatePackages?: { readonly version?: unknown } };
+
+export type ReleaseConfigPaths = {
+  readonly pkgPath: string;
+  readonly changesetConfigPath: string;
+};
+
+/** Resolve the two files a version command must see. Override in tests. */
+export function releaseConfigPaths(cwd: string = process.cwd()): ReleaseConfigPaths {
+  return {
+    pkgPath: `${cwd}/package.json`,
+    changesetConfigPath: `${cwd}/.changeset/config.json`,
+  };
+}
+
+/** One thing a project should fix, in the imperative. */
+export async function problemsInReleaseConfig(paths: ReleaseConfigPaths): Promise<string[]> {
+  const pkg = (await Bun.file(paths.pkgPath).json()) as Pkg;
+  const problems: string[] = [];
+
+  if (typeof pkg.version !== 'string' || pkg.version.length === 0) {
+    problems.push(`${paths.pkgPath} has no "version" — changeset version would silently no-op`);
+  }
+
+  if (pkg.private === true) {
+    const changesetConfig = (await Bun.file(paths.changesetConfigPath).json()) as ChangesetConfig;
+    if (changesetConfig.privatePackages?.version !== true) {
+      problems.push(
+        `${paths.changesetConfigPath} has no privatePackages.version: true — a private package ` +
+          'is excluded from versioning entirely, which reads as "nothing to release"',
+      );
+    }
+  }
+
+  const cwd = paths.pkgPath.replace(/\/package\.json$/, '');
+  problems.push(...(await problemsFromPendingChangesets(cwd)));
+
+  return problems;
+}
+
+/** Print and exit. App `version` scripts call this before `changeset version`. */
+export async function runRequireReleaseConfig(paths?: Partial<ReleaseConfigPaths>): Promise<void> {
+  // ⚠️ A spread of `{ pkgPath: undefined }` from `process.argv[2]` would overwrite the
+  //   cwd default. Only copy keys that are actually present.
+  const defaults = releaseConfigPaths();
+  const resolved: ReleaseConfigPaths = {
+    pkgPath: paths?.pkgPath ?? defaults.pkgPath,
+    changesetConfigPath: paths?.changesetConfigPath ?? defaults.changesetConfigPath,
+  };
+  const problems = await problemsInReleaseConfig(resolved);
+
+  if (problems.length > 0) {
+    process.stderr.write('\n✗ changeset version would silently no-op:\n');
+    for (const problem of problems) process.stderr.write(`  - ${problem}\n`);
+    process.stderr.write('\n  Fix the file(s) above in a reviewed commit, then re-run this.\n\n');
+    process.exit(1);
+  }
+
+  const pkg = (await Bun.file(resolved.pkgPath).json()) as Pkg;
+  process.stdout.write(
+    `ok: ${resolved.pkgPath} version is ${pkg.version}, privatePackages.version is set\n`,
+  );
+}
+
+if (import.meta.main) {
+  const pkgPath = process.argv[2];
+  const changesetConfigPath = process.argv[3];
+  await runRequireReleaseConfig({
+    ...(pkgPath === undefined ? {} : { pkgPath }),
+    ...(changesetConfigPath === undefined ? {} : { changesetConfigPath }),
+  });
+}