@homeflare/config 0.5.1 → 0.7.0

package/README.md

@@ -142,6 +142,52 @@ Alchemy still owns `GitHub.Repository` (visibility, `deleteBranchOnMerge`, `hasW
 `Cloudflare.state()`. The kit `main` ruleset is `scripts/apply-main-ruleset.ts`, not an
 Alchemy resource — see `docs/github-hygiene.md`.
 
+## git hooks
+
+One hook layer for the whole estate. The behaviour ships here; a repo commits a
+delegating wrapper and nothing else.
+
+```sh
+bun add -D @homeflare/config husky
+npm pkg set scripts.prepare=husky
+bun install                                          # husky writes .husky/_
+bun node_modules/@homeflare/config/bin/hooks.ts install
+git add .husky/pre-commit .husky/pre-push package.json
+```
+
+| hook         | runs                                            | cost              |
+| ------------ | ----------------------------------------------- | ----------------- |
+| `pre-commit` | `oxfmt` + `oxlint --deny-warnings`, staged only | sub-second        |
+| `pre-push`   | the repo's own `bun run check`                  | whatever CI costs |
+
+⚠️ **pre-commit rewrites files.** It formats the staged formattable files (`.md`
+included — house `oxfmt` formats markdown, and a hook that skipped it would let an
+unformatted changeset through), names the ones it changed, and restages exactly those.
+Without the restage the commit would capture the unformatted bytes and CI would fail a
+file that reads as clean locally.
+
+⛔ **A file with unstaged edits on top is checked, never rewritten.** Restaging it would
+sweep work in progress into a commit nobody asked for.
+
+⛔ **pre-push always calls `check`, never `verify`.** `verify` means the consumer smoke
+test in this repo and a _live_ adoption verifier in `homeflare-proxmox`; a hook that
+guessed would run credentials-backed live checks on a push.
+
+⚠️ **A hook is a local convenience, not a gate.** It is skippable with `--no-verify`,
+absent from a fresh clone until `bun install` runs `prepare`, and silently inert when
+`core.hooksPath` points at a `.husky/_` that no install has created yet. The required
+checks on `main` stay the gate; this makes the cheap mistakes cheap to find.
+
+```ts
+import { problemsInHooks } from '@homeflare/config/hooks';
+
+expect(await problemsInHooks(process.cwd())).toEqual([]);
+```
+
+⛔ `problemsInHooks` is deliberately **not** part of `checkProject`. Every repo runs that
+checker from a test, so folding hook conformance in would turn every repo that has not
+adopted yet red on `main` in one commit. A repo opts in by calling this.
+
 ## License
 
 MIT © Timothy Schneider

package/bin/hooks.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env bun
+/**
+ * The entry a repo's `.husky/` wrapper calls.
+ *
+ * ⚠️ IT IMPORTS `../src`, NOT `../dist`. `src` is published, Bun runs TypeScript
+ *   directly, and a hook that depended on a build step would be dead in a fresh clone
+ *   of the repo that HOSTS this package — the one place `dist/` does not exist yet.
+ */
+import { isCommand, runCommand } from '../src/hooks.ts';
+
+const command = process.argv[2] ?? '';
+
+if (!isCommand(command)) {
+  process.stderr.write(`homeflare hooks: unknown command ${JSON.stringify(command)}\n`);
+  process.stderr.write('  expected one of: pre-commit, pre-push, install\n');
+  process.exit(2);
+}
+
+await runCommand(command, process.cwd());

package/dist/hooks/gates.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Format and lint what is staged, restaging only what the formatter rewrote.
+ *
+ * ⚠️ THIS HOOK REWRITES FILES DURING A COMMIT, and it says so on the line where it
+ *   happens. Without the restage, oxfmt would fix the worktree while the commit kept
+ *   the unformatted bytes — CI then fails on a file that reads as correct locally.
+ */
+export declare function preCommit(root: string): Promise<void>;
+/**
+ * Run the repo's own declared gate before the push reaches the runner.
+ *
+ * ★ IT CALLS `bun run check` RATHER THAN NAMING TOOLS. Every repo's `check` is the
+ *   command CI runs; hard-coding `tsc` and `bun test` here would drift from whichever
+ *   repo added a step, and the hook would certify a push CI rejects.
+ * ⛔ It does not widen a narrow `check`. If a repo's gate only looks at part of the
+ *   tree, this hook inherits exactly that blind spot — fix the script, not the hook.
+ */
+export declare function prePush(root: string): Promise<void>;
+//# sourceMappingURL=gates.d.ts.map

package/dist/hooks/gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../src/hooks/gates.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8C3D;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBzD"}

package/dist/hooks/install.d.ts

@@ -0,0 +1,20 @@
+/** The hook files this package installs, in the order a contributor meets them. */
+export declare const HOOK_NAMES: readonly ['pre-commit', 'pre-push'];
+/**
+ * ⚠️ IT EXITS 0 WHEN THE RUNNER IS ABSENT. A checkout with no `node_modules` would
+ *   otherwise fail every commit with a module-resolution error, and the first thing
+ *   anyone would do is delete the hook. Failing open is the right trade for a
+ *   convenience; the required checks on `main` are what must fail closed.
+ */
+export declare const HUSKY_HOOK: string;
+/** Write the wrapper into `.husky/`. Returns the paths written, relative to the project. */
+export declare function installHooks(projectDir: string): Promise<readonly string[]>;
+/**
+ * Report what stops this project's hooks from working. Empty means adopted.
+ *
+ * ⛔ DELIBERATELY NOT PART OF `checkProject`. Every repo in the estate runs that checker
+ *   from a test; folding hook conformance into it would turn every repo that has not
+ *   adopted yet red on `main` in the same commit. A repo opts in by calling this.
+ */
+export declare function problemsInHooks(projectDir: string): Promise<readonly string[]>;
+//# sourceMappingURL=install.d.ts.map

package/dist/hooks/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/hooks/install.ts"],"names":[],"mappings":"AAYA,mFAAmF;AACnF,eAAO,MAAM,UAAU,YAAI,YAAY,EAAE,UAAU,CAAU,CAAC;AAK9D;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,MAexB,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAYjF;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA+BpF"}

package/dist/hooks/report.d.ts

@@ -0,0 +1,30 @@
+/**
+ * How a hook talks to whoever triggered it.
+ *
+ * ★ EVERY FAILURE PRINTS BOTH COMMANDS — the one that fixes it and the one that skips
+ *   it. A hook that exits non-zero and says nothing teaches `--no-verify` as a reflex,
+ *   and that switch turns off every check rather than the one that was wrong.
+ *
+ * ⚠️ Output goes to STDERR. Git hooks share stdout with porcelain in some flows, and a
+ *   hook that writes there can corrupt what a caller is parsing.
+ */
+/** The two hooks this package implements. Named exactly as the git hook files are. */
+export type Hook = 'pre-commit' | 'pre-push';
+/** Run a command, streaming its output. Returns its exit code. */
+export declare function run(cmd: readonly string[]): Promise<number>;
+/** Capture a command's stdout. Used for git plumbing only. */
+export declare function capture(cmd: readonly string[]): Promise<string>;
+/**
+ * Resolve a dev tool to the project's own copy.
+ *
+ * ⚠️ NOT `bunx` BY DEFAULT. On a cache miss `bunx` downloads from the registry, and a
+ *   git hook that reaches the network mid-commit is a hang waiting for a flaky link.
+ *   husky puts `node_modules/.bin` on PATH, but this runs outside husky in tests, so
+ *   the local binary is named outright when it exists and `bunx` is only the fallback.
+ */
+export declare function tool(root: string, name: string): readonly string[];
+export declare function ok(what: string): void;
+export declare function note(what: string): void;
+/** ⛔ ALWAYS GIVE THE FIX. "lint failed" is a dead end; the command that repairs it is not. */
+export declare function fail(hook: Hook, what: string, fix: string): never;
+//# sourceMappingURL=report.d.ts.map

package/dist/hooks/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/hooks/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,sFAAsF;AACtF,MAAM,MAAM,IAAI,GAAG,YAAY,GAAG,UAAU,CAAC;AAO7C,kEAAkE;AAClE,wBAAsB,GAAG,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAGjE;AAED,8DAA8D;AAC9D,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAKrE;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGlE;AAaD,wBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAErC;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEvC;AAED,8FAA8F;AAC9F,wBAAgB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAKjE"}

package/dist/hooks/staged.d.ts

@@ -0,0 +1,19 @@
+export type Staged = {
+    /** Fully staged and formattable — safe to rewrite and restage. */
+    readonly formattable: readonly string[];
+    /** The subset of `formattable` that oxlint understands. */
+    readonly code: readonly string[];
+    /** Staged but also dirty in the worktree — checked, never rewritten. */
+    readonly partial: readonly string[];
+};
+/** Classify the index. Deletions are excluded — there is nothing to format in them. */
+export declare function staged(): Promise<Staged>;
+/**
+ * Content fingerprints, so only the files a formatter actually changed get restaged.
+ *
+ * ★ WHY NOT RESTAGE EVERYTHING. `git add` on an untouched file is harmless but noisy:
+ *   the hook would claim it rewrote files it left alone, and a hook that overstates
+ *   what it did is one nobody reads.
+ */
+export declare function fingerprints(files: readonly string[]): Promise<ReadonlyMap<string, string>>;
+//# sourceMappingURL=staged.d.ts.map

package/dist/hooks/staged.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staged.d.ts","sourceRoot":"","sources":["../../src/hooks/staged.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,MAAM,GAAG;IACnB,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAOF,uFAAuF;AACvF,wBAAsB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAU9C;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQjG"}

package/dist/hooks.d.ts

@@ -0,0 +1,15 @@
+import { HOOK_NAMES, HUSKY_HOOK, installHooks, problemsInHooks } from './hooks/install.ts';
+import { type Hook } from './hooks/report.ts';
+export { HOOK_NAMES, HUSKY_HOOK, installHooks, problemsInHooks };
+export type { Hook };
+/** The commands `bin/hooks.ts` accepts. */
+export type Command = Hook | 'install';
+export declare function isCommand(value: string): value is Command;
+/**
+ * Run one hook, or install the wrappers.
+ *
+ * ⛔ Never exits non-zero for a reason the caller cannot act on: an unknown command is a
+ *   programming error in the wrapper and is reported as such, not as a failed commit.
+ */
+export declare function runCommand(command: Command, root: string): Promise<void>;
+//# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,KAAK,IAAI,EAAY,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,CAAC;AAErB,2CAA2C;AAC3C,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvC,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,OAAO,CAEzD;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS9E"}

package/dist/hooks.js

@@ -0,0 +1,196 @@
+// @bun
+// src/hooks/report.ts
+var BYPASS = {
+  "pre-commit": "git commit --no-verify",
+  "pre-push": "git push --no-verify"
+};
+async function run(cmd) {
+  const proc = Bun.spawn([...cmd], { stdout: "inherit", stderr: "inherit" });
+  return await proc.exited;
+}
+async function capture(cmd) {
+  const proc = Bun.spawn([...cmd], { stdout: "pipe", stderr: "ignore" });
+  const text = await new Response(proc.stdout).text();
+  await proc.exited;
+  return text;
+}
+function tool(root, name) {
+  const local = `${root}/node_modules/.bin/${name}`;
+  return Bun.file(local).size > 0 ? [local] : ["bunx", name];
+}
+function line(text) {
+  process.stderr.write(`${text}
+`);
+}
+function ok(what) {
+  line(`\u2713 ${what}`);
+}
+function note(what) {
+  line(`  ${what}`);
+}
+function fail(hook, what, fix) {
+  line(`
+\u2717 ${hook}: ${what}`);
+  line(`  fix:    ${fix}`);
+  line(`  bypass: ${BYPASS[hook]}  \u2014 CI still runs the real gate
+`);
+  process.exit(1);
+}
+
+// src/hooks/staged.ts
+var FORMATTABLE = /\.(ts|tsx|js|jsx|mjs|cjs|json|jsonc|md)$/;
+var CODE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+async function names(args) {
+  const out = await capture(["git", ...args]);
+  return out.split(`
+`).filter((line2) => line2.length > 0);
+}
+async function staged() {
+  const indexed = await names(["diff", "--cached", "--name-only", "--diff-filter=ACMR"]);
+  const dirty = new Set(await names(["diff", "--name-only", "--diff-filter=ACMR"]));
+  const candidates = indexed.filter((file) => FORMATTABLE.test(file));
+  return {
+    formattable: candidates.filter((file) => !dirty.has(file)),
+    code: candidates.filter((file) => !dirty.has(file) && CODE.test(file)),
+    partial: candidates.filter((file) => dirty.has(file))
+  };
+}
+async function fingerprints(files) {
+  const out = new Map;
+  for (const file of files) {
+    const handle = Bun.file(file);
+    if (!await handle.exists())
+      continue;
+    out.set(file, String(Bun.hash(await handle.arrayBuffer())));
+  }
+  return out;
+}
+
+// src/hooks/gates.ts
+async function preCommit(root) {
+  const oxfmt = tool(root, "oxfmt");
+  const { formattable, code, partial } = await staged();
+  if (partial.length > 0) {
+    note(`${partial.length} staged file(s) also have unstaged edits; checking without rewriting`);
+    if (await run([...oxfmt, "--check", ...partial]) !== 0) {
+      fail("pre-commit", "those partially staged files are unformatted, and rewriting them would stage your unstaged work", "bun run format, then stage the files you meant to commit");
+    }
+  }
+  if (formattable.length === 0) {
+    ok("pre-commit: nothing staged to format");
+    return;
+  }
+  const before = await fingerprints(formattable);
+  if (await run([...oxfmt, ...formattable]) !== 0) {
+    fail("pre-commit", "oxfmt could not format the staged files", "bun run format");
+  }
+  const after = await fingerprints(formattable);
+  const rewritten = formattable.filter((file) => before.get(file) !== after.get(file));
+  if (rewritten.length > 0) {
+    note(`oxfmt rewrote and restaged ${rewritten.length} file(s): ${rewritten.join(", ")}`);
+    if (await run(["git", "add", "--", ...rewritten]) !== 0) {
+      fail("pre-commit", "could not restage the formatted files", "git add the listed files");
+    }
+  }
+  if (code.length > 0 && await run([...tool(root, "oxlint"), "--deny-warnings", ...code]) !== 0) {
+    fail("pre-commit", `oxlint found problems in ${code.length} staged file(s)`, "bun run lint:fix, then fix by hand what remains");
+  }
+  ok(`pre-commit: ${formattable.length} staged file(s) formatted and linted`);
+}
+async function prePush(root) {
+  const manifest = Bun.file(`${root}/package.json`);
+  const pkg = await manifest.exists() ? await manifest.json() : {};
+  if (pkg.scripts?.["check"] === undefined) {
+    note("pre-push: no `check` script declared in package.json; nothing to run");
+    return;
+  }
+  note("pre-push: running `bun run check` \u2014 the same gate CI runs");
+  const started = Bun.nanoseconds();
+  if (await run(["bun", "run", "check"]) !== 0) {
+    fail("pre-push", "bun run check failed \u2014 CI would fail the same way, on a shared runner", "bun run lint:fix, then bun run check until it is green");
+  }
+  ok(`pre-push: bun run check passed in ${((Bun.nanoseconds() - started) / 1e9).toFixed(1)}s`);
+}
+
+// src/hooks/install.ts
+import { chmod, mkdir } from "fs/promises";
+var HOOK_NAMES = ["pre-commit", "pre-push"];
+var RUNNER = "node_modules/@homeflare/config/bin/hooks.ts";
+var HUSKY_HOOK = `# HomeFlare shared git hook. The behaviour lives in @homeflare/config, not in this file,
+# and the same bytes are installed as .husky/pre-commit and .husky/pre-push \u2014 the hook
+# name comes from $0.
+#
+# \u26A0\uFE0F A hook is a local convenience, not a gate: it is skippable with --no-verify and does
+#   not exist in a fresh clone until \`bun install\` runs the \`prepare\` script. The
+#   required checks on main stay the gate.
+#
+# Regenerate this file with: bun ${RUNNER} install
+hook="${RUNNER}"
+if [ ! -f "$hook" ]; then
+  echo "husky: $hook is missing \u2014 run 'bun install' to enable the HomeFlare hooks; skipping"
+  exit 0
+fi
+exec bun "$hook" "$(basename "$0")"
+`;
+async function installHooks(projectDir) {
+  await mkdir(`${projectDir}/.husky`, { recursive: true });
+  const written = [];
+  for (const name of HOOK_NAMES) {
+    const path = `${projectDir}/.husky/${name}`;
+    await Bun.write(path, HUSKY_HOOK);
+    await chmod(path, 493);
+    written.push(`.husky/${name}`);
+  }
+  return written;
+}
+async function problemsInHooks(projectDir) {
+  const problems = [];
+  const manifest = Bun.file(`${projectDir}/package.json`);
+  if (!await manifest.exists())
+    return ["package.json: missing"];
+  const pkg = await manifest.json();
+  if (!(pkg.scripts?.["prepare"] ?? "").includes("husky")) {
+    problems.push('package.json: no "prepare": "husky" script \u2014 a fresh clone installs no hooks');
+  }
+  if (pkg.devDependencies?.["husky"] === undefined) {
+    problems.push("package.json: husky is not a devDependency");
+  }
+  for (const name of HOOK_NAMES) {
+    const file = Bun.file(`${projectDir}/.husky/${name}`);
+    if (!await file.exists()) {
+      problems.push(`.husky/${name}: missing \u2014 run \`bun ${RUNNER} install\``);
+      continue;
+    }
+    if (await file.text() !== HUSKY_HOOK) {
+      problems.push(`.husky/${name}: differs from the @homeflare/config wrapper \u2014 run \`bun ${RUNNER} install\`, or change it in the package`);
+    }
+  }
+  return problems;
+}
+
+// src/hooks.ts
+function isCommand(value) {
+  return value === "pre-commit" || value === "pre-push" || value === "install";
+}
+async function runCommand(command, root) {
+  if (command === "install") {
+    const written = await installHooks(root);
+    ok(`wrote ${written.join(", ")} \u2014 commit them`);
+    note("they do nothing until `bun install` runs `prepare` (husky)");
+    return;
+  }
+  if (command === "pre-commit")
+    return await preCommit(root);
+  return await prePush(root);
+}
+export {
+  HOOK_NAMES,
+  HUSKY_HOOK,
+  installHooks,
+  isCommand,
+  problemsInHooks,
+  runCommand
+};
+
+//# debugId=C234A537C7D6F0D364756E2164756E21
+//# sourceMappingURL=hooks.js.map

package/dist/hooks.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/hooks/report.ts", "../src/hooks/staged.ts", "../src/hooks/gates.ts", "../src/hooks/install.ts", "../src/hooks.ts"],
+  "sourcesContent": [
+    "/**\n * How a hook talks to whoever triggered it.\n *\n * ★ EVERY FAILURE PRINTS BOTH COMMANDS — the one that fixes it and the one that skips\n *   it. A hook that exits non-zero and says nothing teaches `--no-verify` as a reflex,\n *   and that switch turns off every check rather than the one that was wrong.\n *\n * ⚠️ Output goes to STDERR. Git hooks share stdout with porcelain in some flows, and a\n *   hook that writes there can corrupt what a caller is parsing.\n */\n\n/** The two hooks this package implements. Named exactly as the git hook files are. */\nexport type Hook = 'pre-commit' | 'pre-push';\n\nconst BYPASS: Record<Hook, string> = {\n  'pre-commit': 'git commit --no-verify',\n  'pre-push': 'git push --no-verify',\n};\n\n/** Run a command, streaming its output. Returns its exit code. */\nexport async function run(cmd: readonly string[]): Promise<number> {\n  const proc = Bun.spawn([...cmd], { stdout: 'inherit', stderr: 'inherit' });\n  return await proc.exited;\n}\n\n/** Capture a command's stdout. Used for git plumbing only. */\nexport async function capture(cmd: readonly string[]): Promise<string> {\n  const proc = Bun.spawn([...cmd], { stdout: 'pipe', stderr: 'ignore' });\n  const text = await new Response(proc.stdout).text();\n  await proc.exited;\n  return text;\n}\n\n/**\n * Resolve a dev tool to the project's own copy.\n *\n * ⚠️ NOT `bunx` BY DEFAULT. On a cache miss `bunx` downloads from the registry, and a\n *   git hook that reaches the network mid-commit is a hang waiting for a flaky link.\n *   husky puts `node_modules/.bin` on PATH, but this runs outside husky in tests, so\n *   the local binary is named outright when it exists and `bunx` is only the fallback.\n */\nexport function tool(root: string, name: string): readonly string[] {\n  const local = `${root}/node_modules/.bin/${name}`;\n  return Bun.file(local).size > 0 ? [local] : ['bunx', name];\n}\n\n/**\n * ⚠️ `process.stderr.write`, NOT `console`. Two reasons, and the lint rule is the lesser\n *   one: a hook shares stdout with git porcelain in some flows, and a synchronous write\n *   is the only kind guaranteed to land before `process.exit` below throws the buffer\n *   away. Using `console.error` here would also make every consumer of this package\n *   need a `no-console` exemption for code they never call directly.\n */\nfunction line(text: string): void {\n  process.stderr.write(`${text}\\n`);\n}\n\nexport function ok(what: string): void {\n  line(`✓ ${what}`);\n}\n\nexport function note(what: string): void {\n  line(`  ${what}`);\n}\n\n/** ⛔ ALWAYS GIVE THE FIX. \"lint failed\" is a dead end; the command that repairs it is not. */\nexport function fail(hook: Hook, what: string, fix: string): never {\n  line(`\\n✗ ${hook}: ${what}`);\n  line(`  fix:    ${fix}`);\n  line(`  bypass: ${BYPASS[hook]}  — CI still runs the real gate\\n`);\n  process.exit(1);\n}\n",
+    "/**\n * What git has staged, split by what the hook may safely touch.\n *\n * ⛔ A STAGED FILE THAT ALSO HAS UNSTAGED EDITS IS OFF LIMITS. Formatting it in place\n *   and running `git add` would sweep the contributor's work-in-progress into a commit\n *   they did not ask for — the single worst thing a hook can do. Those files are\n *   reported and checked, never rewritten.\n */\nimport { capture } from './report.ts';\n\n/**\n * ⚠️ `.md` IS IN THIS LIST ON PURPOSE. House `oxfmt` formats markdown, so a hook that\n *   skipped it would let an unformatted changeset through and CI would fail a commit\n *   that looked clean locally. A hook must check what CI checks or it trains distrust.\n */\nconst FORMATTABLE = /\\.(ts|tsx|js|jsx|mjs|cjs|json|jsonc|md)$/;\nconst CODE = /\\.(ts|tsx|js|jsx|mjs|cjs)$/;\n\nexport type Staged = {\n  /** Fully staged and formattable — safe to rewrite and restage. */\n  readonly formattable: readonly string[];\n  /** The subset of `formattable` that oxlint understands. */\n  readonly code: readonly string[];\n  /** Staged but also dirty in the worktree — checked, never rewritten. */\n  readonly partial: readonly string[];\n};\n\nasync function names(args: readonly string[]): Promise<readonly string[]> {\n  const out = await capture(['git', ...args]);\n  return out.split('\\n').filter((line) => line.length > 0);\n}\n\n/** Classify the index. Deletions are excluded — there is nothing to format in them. */\nexport async function staged(): Promise<Staged> {\n  const indexed = await names(['diff', '--cached', '--name-only', '--diff-filter=ACMR']);\n  const dirty = new Set(await names(['diff', '--name-only', '--diff-filter=ACMR']));\n  const candidates = indexed.filter((file) => FORMATTABLE.test(file));\n\n  return {\n    formattable: candidates.filter((file) => !dirty.has(file)),\n    code: candidates.filter((file) => !dirty.has(file) && CODE.test(file)),\n    partial: candidates.filter((file) => dirty.has(file)),\n  };\n}\n\n/**\n * Content fingerprints, so only the files a formatter actually changed get restaged.\n *\n * ★ WHY NOT RESTAGE EVERYTHING. `git add` on an untouched file is harmless but noisy:\n *   the hook would claim it rewrote files it left alone, and a hook that overstates\n *   what it did is one nobody reads.\n */\nexport async function fingerprints(files: readonly string[]): Promise<ReadonlyMap<string, string>> {\n  const out = new Map<string, string>();\n  for (const file of files) {\n    const handle = Bun.file(file);\n    if (!(await handle.exists())) continue;\n    out.set(file, String(Bun.hash(await handle.arrayBuffer())));\n  }\n  return out;\n}\n",
+    "/**\n * The two gates every HomeFlare repo gets, from one place.\n *\n * ★ THE SPLIT IS BY COST. `pre-commit` touches only the staged files and is measured in\n *   hundreds of milliseconds, so it can run on every commit without anyone resenting\n *   it. `pre-push` runs the repo's own `bun run check` — seconds, once, before the\n *   change costs a slot on the shared self-hosted runner.\n *\n * ⚠️ NEITHER IS A GATE. Both are skippable with `--no-verify` and neither exists in a\n *   fresh clone until `bun install` runs `prepare`. The required checks on `main` stay\n *   the gate; these only make the cheap mistakes cheap to find.\n */\nimport { fail, note, ok, run, tool } from './report.ts';\nimport { fingerprints, staged } from './staged.ts';\n\n/**\n * Format and lint what is staged, restaging only what the formatter rewrote.\n *\n * ⚠️ THIS HOOK REWRITES FILES DURING A COMMIT, and it says so on the line where it\n *   happens. Without the restage, oxfmt would fix the worktree while the commit kept\n *   the unformatted bytes — CI then fails on a file that reads as correct locally.\n */\nexport async function preCommit(root: string): Promise<void> {\n  const oxfmt = tool(root, 'oxfmt');\n  const { formattable, code, partial } = await staged();\n\n  // ⛔ Checked, never rewritten — see staged.ts for why `git add` here would be theft.\n  if (partial.length > 0) {\n    note(`${partial.length} staged file(s) also have unstaged edits; checking without rewriting`);\n    if ((await run([...oxfmt, '--check', ...partial])) !== 0) {\n      fail(\n        'pre-commit',\n        'those partially staged files are unformatted, and rewriting them would stage your unstaged work',\n        'bun run format, then stage the files you meant to commit',\n      );\n    }\n  }\n\n  if (formattable.length === 0) {\n    ok('pre-commit: nothing staged to format');\n    return;\n  }\n\n  const before = await fingerprints(formattable);\n  if ((await run([...oxfmt, ...formattable])) !== 0) {\n    fail('pre-commit', 'oxfmt could not format the staged files', 'bun run format');\n  }\n  const after = await fingerprints(formattable);\n  const rewritten = formattable.filter((file) => before.get(file) !== after.get(file));\n\n  if (rewritten.length > 0) {\n    note(`oxfmt rewrote and restaged ${rewritten.length} file(s): ${rewritten.join(', ')}`);\n    if ((await run(['git', 'add', '--', ...rewritten])) !== 0) {\n      fail('pre-commit', 'could not restage the formatted files', 'git add the listed files');\n    }\n  }\n\n  // ⚠️ `--deny-warnings` matches what CI runs. A hook that is laxer than CI is worse\n  //   than no hook: it certifies a change CI will reject.\n  if (code.length > 0 && (await run([...tool(root, 'oxlint'), '--deny-warnings', ...code])) !== 0) {\n    fail(\n      'pre-commit',\n      `oxlint found problems in ${code.length} staged file(s)`,\n      'bun run lint:fix, then fix by hand what remains',\n    );\n  }\n\n  ok(`pre-commit: ${formattable.length} staged file(s) formatted and linted`);\n}\n\n/**\n * Run the repo's own declared gate before the push reaches the runner.\n *\n * ★ IT CALLS `bun run check` RATHER THAN NAMING TOOLS. Every repo's `check` is the\n *   command CI runs; hard-coding `tsc` and `bun test` here would drift from whichever\n *   repo added a step, and the hook would certify a push CI rejects.\n * ⛔ It does not widen a narrow `check`. If a repo's gate only looks at part of the\n *   tree, this hook inherits exactly that blind spot — fix the script, not the hook.\n */\nexport async function prePush(root: string): Promise<void> {\n  const manifest = Bun.file(`${root}/package.json`);\n  const pkg = (await manifest.exists())\n    ? ((await manifest.json()) as { scripts?: Record<string, string> })\n    : {};\n\n  if (pkg.scripts?.['check'] === undefined) {\n    note('pre-push: no `check` script declared in package.json; nothing to run');\n    return;\n  }\n\n  note('pre-push: running `bun run check` — the same gate CI runs');\n  const started = Bun.nanoseconds();\n  if ((await run(['bun', 'run', 'check'])) !== 0) {\n    fail(\n      'pre-push',\n      'bun run check failed — CI would fail the same way, on a shared runner',\n      'bun run lint:fix, then bun run check until it is green',\n    );\n  }\n\n  ok(`pre-push: bun run check passed in ${((Bun.nanoseconds() - started) / 1e9).toFixed(1)}s`);\n}\n",
+    "/**\n * Adoption: the one wrapper every repo commits, and the check that it has not drifted.\n *\n * ★ WHY A WRAPPER AT ALL. husky can only run a file that is tracked in the repo, so\n *   something must be committed per repo. This keeps that something to a delegation\n *   whose text is owned HERE — the behaviour lives in one package, and a repo that\n *   edits its copy is reported as drift rather than quietly diverging.\n * ★ ONE FILE, TWO NAMES. The wrapper reads the hook name from `$0`, so `pre-commit`\n *   and `pre-push` are byte-identical and there is a single text to keep in step.\n */\nimport { chmod, mkdir } from 'node:fs/promises';\n\n/** The hook files this package installs, in the order a contributor meets them. */\nexport const HOOK_NAMES = ['pre-commit', 'pre-push'] as const;\n\n/** Where the runner lives once `bun install` has run. Relative: git runs hooks at the root. */\nconst RUNNER = 'node_modules/@homeflare/config/bin/hooks.ts';\n\n/**\n * ⚠️ IT EXITS 0 WHEN THE RUNNER IS ABSENT. A checkout with no `node_modules` would\n *   otherwise fail every commit with a module-resolution error, and the first thing\n *   anyone would do is delete the hook. Failing open is the right trade for a\n *   convenience; the required checks on `main` are what must fail closed.\n */\nexport const HUSKY_HOOK: string = `# HomeFlare shared git hook. The behaviour lives in @homeflare/config, not in this file,\n# and the same bytes are installed as .husky/pre-commit and .husky/pre-push — the hook\n# name comes from $0.\n#\n# ⚠️ A hook is a local convenience, not a gate: it is skippable with --no-verify and does\n#   not exist in a fresh clone until \\`bun install\\` runs the \\`prepare\\` script. The\n#   required checks on main stay the gate.\n#\n# Regenerate this file with: bun ${RUNNER} install\nhook=\"${RUNNER}\"\nif [ ! -f \"$hook\" ]; then\n  echo \"husky: $hook is missing — run 'bun install' to enable the HomeFlare hooks; skipping\"\n  exit 0\nfi\nexec bun \"$hook\" \"$(basename \"$0\")\"\n`;\n\n/** Write the wrapper into `.husky/`. Returns the paths written, relative to the project. */\nexport async function installHooks(projectDir: string): Promise<readonly string[]> {\n  await mkdir(`${projectDir}/.husky`, { recursive: true });\n  const written: string[] = [];\n  for (const name of HOOK_NAMES) {\n    const path = `${projectDir}/.husky/${name}`;\n    await Bun.write(path, HUSKY_HOOK);\n    // ⚠️ husky's own runner does `sh -e \"$s\"`, which does not need the execute bit, but\n    //   `core.hooksPath=.husky` without husky does. Set it so both mechanisms work.\n    await chmod(path, 0o755);\n    written.push(`.husky/${name}`);\n  }\n  return written;\n}\n\n/**\n * Report what stops this project's hooks from working. Empty means adopted.\n *\n * ⛔ DELIBERATELY NOT PART OF `checkProject`. Every repo in the estate runs that checker\n *   from a test; folding hook conformance into it would turn every repo that has not\n *   adopted yet red on `main` in the same commit. A repo opts in by calling this.\n */\nexport async function problemsInHooks(projectDir: string): Promise<readonly string[]> {\n  const problems: string[] = [];\n  const manifest = Bun.file(`${projectDir}/package.json`);\n\n  if (!(await manifest.exists())) return ['package.json: missing'];\n  const pkg = (await manifest.json()) as {\n    scripts?: Record<string, string>;\n    devDependencies?: Record<string, string>;\n  };\n\n  if (!(pkg.scripts?.['prepare'] ?? '').includes('husky')) {\n    problems.push('package.json: no \"prepare\": \"husky\" script — a fresh clone installs no hooks');\n  }\n  if (pkg.devDependencies?.['husky'] === undefined) {\n    problems.push('package.json: husky is not a devDependency');\n  }\n\n  for (const name of HOOK_NAMES) {\n    const file = Bun.file(`${projectDir}/.husky/${name}`);\n    if (!(await file.exists())) {\n      problems.push(`.husky/${name}: missing — run \\`bun ${RUNNER} install\\``);\n      continue;\n    }\n    if ((await file.text()) !== HUSKY_HOOK) {\n      problems.push(\n        `.husky/${name}: differs from the @homeflare/config wrapper — run \\`bun ${RUNNER} install\\`, or change it in the package`,\n      );\n    }\n  }\n\n  return problems;\n}\n",
+    "/**\n * The HomeFlare git hooks, as a package.\n *\n * ★ WHY THIS IS NOT A SCRIPT IN EVERY REPO. Fourteen copies of a hook script is the\n *   exact drift `@homeflare/config` exists to prevent: the copies diverge, nobody\n *   notices, and two repos disagree about what a commit must satisfy. Here the repo\n *   commits a delegating wrapper and the behaviour ships with the package, so changing\n *   the rule is one release and a version bump rather than fourteen edits.\n *\n * ⚠️ HUSKY, NOT lefthook OR A BARE `core.hooksPath`. It is already the estate's\n *   mechanism in the repos that have working hooks, it installs from `prepare` on a\n *   plain `bun install`, and it keeps the hook files tracked and reviewable. A second\n *   mechanism alongside it would mean two ways to answer \"are hooks on in this repo\".\n *\n * Usage from a hook file — see `HUSKY_HOOK`:\n *\n *     bun node_modules/@homeflare/config/bin/hooks.ts pre-commit\n */\nimport { preCommit, prePush } from './hooks/gates.ts';\nimport { HOOK_NAMES, HUSKY_HOOK, installHooks, problemsInHooks } from './hooks/install.ts';\nimport { type Hook, note, ok } from './hooks/report.ts';\n\nexport { HOOK_NAMES, HUSKY_HOOK, installHooks, problemsInHooks };\nexport type { Hook };\n\n/** The commands `bin/hooks.ts` accepts. */\nexport type Command = Hook | 'install';\n\nexport function isCommand(value: string): value is Command {\n  return value === 'pre-commit' || value === 'pre-push' || value === 'install';\n}\n\n/**\n * Run one hook, or install the wrappers.\n *\n * ⛔ Never exits non-zero for a reason the caller cannot act on: an unknown command is a\n *   programming error in the wrapper and is reported as such, not as a failed commit.\n */\nexport async function runCommand(command: Command, root: string): Promise<void> {\n  if (command === 'install') {\n    const written = await installHooks(root);\n    ok(`wrote ${written.join(', ')} — commit them`);\n    note('they do nothing until `bun install` runs `prepare` (husky)');\n    return;\n  }\n  if (command === 'pre-commit') return await preCommit(root);\n  return await prePush(root);\n}\n"
+  ],
+  "mappings": ";;AAcA,IAAM,SAA+B;AAAA,EACnC,cAAc;AAAA,EACd,YAAY;AACd;AAGA,eAAsB,GAAG,CAAC,KAAyC;AAAA,EACjE,MAAM,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,EAAE,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA,EACzE,OAAO,MAAM,KAAK;AAAA;AAIpB,eAAsB,OAAO,CAAC,KAAyC;AAAA,EACrE,MAAM,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,EAAE,QAAQ,QAAQ,QAAQ,SAAS,CAAC;AAAA,EACrE,MAAM,OAAO,MAAM,IAAI,SAAS,KAAK,MAAM,EAAE,KAAK;AAAA,EAClD,MAAM,KAAK;AAAA,EACX,OAAO;AAAA;AAWF,SAAS,IAAI,CAAC,MAAc,MAAiC;AAAA,EAClE,MAAM,QAAQ,GAAG,0BAA0B;AAAA,EAC3C,OAAO,IAAI,KAAK,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI;AAAA;AAU3D,SAAS,IAAI,CAAC,MAAoB;AAAA,EAChC,QAAQ,OAAO,MAAM,GAAG;AAAA,CAAQ;AAAA;AAG3B,SAAS,EAAE,CAAC,MAAoB;AAAA,EACrC,KAAK,UAAK,MAAM;AAAA;AAGX,SAAS,IAAI,CAAC,MAAoB;AAAA,EACvC,KAAK,KAAK,MAAM;AAAA;AAIX,SAAS,IAAI,CAAC,MAAY,MAAc,KAAoB;AAAA,EACjE,KAAK;AAAA,SAAO,SAAS,MAAM;AAAA,EAC3B,KAAK,aAAa,KAAK;AAAA,EACvB,KAAK,aAAa,OAAO;AAAA,CAAwC;AAAA,EACjE,QAAQ,KAAK,CAAC;AAAA;;;ACvDhB,IAAM,cAAc;AACpB,IAAM,OAAO;AAWb,eAAe,KAAK,CAAC,MAAqD;AAAA,EACxE,MAAM,MAAM,MAAM,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;AAAA,EAC1C,OAAO,IAAI,MAAM;AAAA,CAAI,EAAE,OAAO,CAAC,UAAS,MAAK,SAAS,CAAC;AAAA;AAIzD,eAAsB,MAAM,GAAoB;AAAA,EAC9C,MAAM,UAAU,MAAM,MAAM,CAAC,QAAQ,YAAY,eAAe,oBAAoB,CAAC;AAAA,EACrF,MAAM,QAAQ,IAAI,IAAI,MAAM,MAAM,CAAC,QAAQ,eAAe,oBAAoB,CAAC,CAAC;AAAA,EAChF,MAAM,aAAa,QAAQ,OAAO,CAAC,SAAS,YAAY,KAAK,IAAI,CAAC;AAAA,EAElE,OAAO;AAAA,IACL,aAAa,WAAW,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC;AAAA,IACzD,MAAM,WAAW,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC;AAAA,IACrE,SAAS,WAAW,OAAO,CAAC,SAAS,MAAM,IAAI,IAAI,CAAC;AAAA,EACtD;AAAA;AAUF,eAAsB,YAAY,CAAC,OAAgE;AAAA,EACjG,MAAM,MAAM,IAAI;AAAA,EAChB,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,SAAS,IAAI,KAAK,IAAI;AAAA,IAC5B,IAAI,CAAE,MAAM,OAAO,OAAO;AAAA,MAAI;AAAA,IAC9B,IAAI,IAAI,MAAM,OAAO,IAAI,KAAK,MAAM,OAAO,YAAY,CAAC,CAAC,CAAC;AAAA,EAC5D;AAAA,EACA,OAAO;AAAA;;;ACrCT,eAAsB,SAAS,CAAC,MAA6B;AAAA,EAC3D,MAAM,QAAQ,KAAK,MAAM,OAAO;AAAA,EAChC,QAAQ,aAAa,MAAM,YAAY,MAAM,OAAO;AAAA,EAGpD,IAAI,QAAQ,SAAS,GAAG;AAAA,IACtB,KAAK,GAAG,QAAQ,4EAA4E;AAAA,IAC5F,IAAK,MAAM,IAAI,CAAC,GAAG,OAAO,WAAW,GAAG,OAAO,CAAC,MAAO,GAAG;AAAA,MACxD,KACE,cACA,mGACA,0DACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,YAAY,WAAW,GAAG;AAAA,IAC5B,GAAG,sCAAsC;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,MAAM,aAAa,WAAW;AAAA,EAC7C,IAAK,MAAM,IAAI,CAAC,GAAG,OAAO,GAAG,WAAW,CAAC,MAAO,GAAG;AAAA,IACjD,KAAK,cAAc,2CAA2C,gBAAgB;AAAA,EAChF;AAAA,EACA,MAAM,QAAQ,MAAM,aAAa,WAAW;AAAA,EAC5C,MAAM,YAAY,YAAY,OAAO,CAAC,SAAS,OAAO,IAAI,IAAI,MAAM,MAAM,IAAI,IAAI,CAAC;AAAA,EAEnF,IAAI,UAAU,SAAS,GAAG;AAAA,IACxB,KAAK,8BAA8B,UAAU,mBAAmB,UAAU,KAAK,IAAI,GAAG;AAAA,IACtF,IAAK,MAAM,IAAI,CAAC,OAAO,OAAO,MAAM,GAAG,SAAS,CAAC,MAAO,GAAG;AAAA,MACzD,KAAK,cAAc,yCAAyC,0BAA0B;AAAA,IACxF;AAAA,EACF;AAAA,EAIA,IAAI,KAAK,SAAS,KAAM,MAAM,IAAI,CAAC,GAAG,KAAK,MAAM,QAAQ,GAAG,mBAAmB,GAAG,IAAI,CAAC,MAAO,GAAG;AAAA,IAC/F,KACE,cACA,4BAA4B,KAAK,yBACjC,iDACF;AAAA,EACF;AAAA,EAEA,GAAG,eAAe,YAAY,4CAA4C;AAAA;AAY5E,eAAsB,OAAO,CAAC,MAA6B;AAAA,EACzD,MAAM,WAAW,IAAI,KAAK,GAAG,mBAAmB;AAAA,EAChD,MAAM,MAAO,MAAM,SAAS,OAAO,IAC7B,MAAM,SAAS,KAAK,IACtB,CAAC;AAAA,EAEL,IAAI,IAAI,UAAU,aAAa,WAAW;AAAA,IACxC,KAAK,sEAAsE;AAAA,IAC3E;AAAA,EACF;AAAA,EAEA,KAAK,gEAA2D;AAAA,EAChE,MAAM,UAAU,IAAI,YAAY;AAAA,EAChC,IAAK,MAAM,IAAI,CAAC,OAAO,OAAO,OAAO,CAAC,MAAO,GAAG;AAAA,IAC9C,KACE,YACA,8EACA,wDACF;AAAA,EACF;AAAA,EAEA,GAAG,uCAAuC,IAAI,YAAY,IAAI,WAAW,KAAK,QAAQ,CAAC,IAAI;AAAA;;;AC1F7F;AAGO,IAAM,aAAa,CAAC,cAAc,UAAU;AAGnD,IAAM,SAAS;AAQR,IAAM,aAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mCAQC;AAAA,QAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASR,eAAsB,YAAY,CAAC,YAAgD;AAAA,EACjF,MAAM,MAAM,GAAG,qBAAqB,EAAE,WAAW,KAAK,CAAC;AAAA,EACvD,MAAM,UAAoB,CAAC;AAAA,EAC3B,WAAW,QAAQ,YAAY;AAAA,IAC7B,MAAM,OAAO,GAAG,qBAAqB;AAAA,IACrC,MAAM,IAAI,MAAM,MAAM,UAAU;AAAA,IAGhC,MAAM,MAAM,MAAM,GAAK;AAAA,IACvB,QAAQ,KAAK,UAAU,MAAM;AAAA,EAC/B;AAAA,EACA,OAAO;AAAA;AAUT,eAAsB,eAAe,CAAC,YAAgD;AAAA,EACpF,MAAM,WAAqB,CAAC;AAAA,EAC5B,MAAM,WAAW,IAAI,KAAK,GAAG,yBAAyB;AAAA,EAEtD,IAAI,CAAE,MAAM,SAAS,OAAO;AAAA,IAAI,OAAO,CAAC,uBAAuB;AAAA,EAC/D,MAAM,MAAO,MAAM,SAAS,KAAK;AAAA,EAKjC,IAAI,EAAE,IAAI,UAAU,cAAc,IAAI,SAAS,OAAO,GAAG;AAAA,IACvD,SAAS,KAAK,mFAA8E;AAAA,EAC9F;AAAA,EACA,IAAI,IAAI,kBAAkB,aAAa,WAAW;AAAA,IAChD,SAAS,KAAK,4CAA4C;AAAA,EAC5D;AAAA,EAEA,WAAW,QAAQ,YAAY;AAAA,IAC7B,MAAM,OAAO,IAAI,KAAK,GAAG,qBAAqB,MAAM;AAAA,IACpD,IAAI,CAAE,MAAM,KAAK,OAAO,GAAI;AAAA,MAC1B,SAAS,KAAK,UAAU,kCAA6B,kBAAkB;AAAA,MACvE;AAAA,IACF;AAAA,IACA,IAAK,MAAM,KAAK,KAAK,MAAO,YAAY;AAAA,MACtC,SAAS,KACP,UAAU,qEAAgE,+CAC5E;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;;;ACjEF,SAAS,SAAS,CAAC,OAAiC;AAAA,EACzD,OAAO,UAAU,gBAAgB,UAAU,cAAc,UAAU;AAAA;AASrE,eAAsB,UAAU,CAAC,SAAkB,MAA6B;AAAA,EAC9E,IAAI,YAAY,WAAW;AAAA,IACzB,MAAM,UAAU,MAAM,aAAa,IAAI;AAAA,IACvC,GAAG,SAAS,QAAQ,KAAK,IAAI,sBAAiB;AAAA,IAC9C,KAAK,4DAA4D;AAAA,IACjE;AAAA,EACF;AAAA,EACA,IAAI,YAAY;AAAA,IAAc,OAAO,MAAM,UAAU,IAAI;AAAA,EACzD,OAAO,MAAM,QAAQ,IAAI;AAAA;",
+  "debugId": "C234A537C7D6F0D364756E2164756E21",
+  "names": []
+}

package/dist/repo-shape/ci.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `.github/workflows/ci.yml`, rendered.
+ *
+ * ★ THE COMMENTS ARE PART OF THE RENDER, NOT DECORATION. Thirteen repositories carried
+ *   thirteen hand-edited copies of the same reasoning; measured 2026-09-22, the header
+ *   comment alone had four different wordings and the actionlint block had three. Written
+ *   here once, every repository gets the same explanation, and correcting it is one edit.
+ *
+ * ⛔ THE AGGREGATE `ci` JOB IS THE ONLY REQUIRED CHECK. Every other job feeds it through
+ *   `needs`, so adding a job never means editing a branch ruleset. `repoShapeChecks()`
+ *   returns exactly `['ci', 'secret scan']`, which is what `declareRepoPolicy` requires.
+ */
+import type { RepoShape } from './shape.ts';
+/** Bun the whole estate is pinned to. One line, one place. */
+export declare const BUN_VERSION = "1.4.0";
+/** actionlint the `workflow lint` job runs, and the mini's job image preloads. */
+export declare const ACTIONLINT_VERSION = "1.7.12";
+/** The whole `ci.yml` for a shape. */
+export declare function renderCi(shape: RepoShape): string;
+//# sourceMappingURL=ci.d.ts.map

package/dist/repo-shape/ci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../../src/repo-shape/ci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAY,SAAS,EAAE,MAAM,YAAY,CAAC;AAItD,8DAA8D;AAC9D,eAAO,MAAM,WAAW,UAAU,CAAC;AACnC,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAgK3C,sCAAsC;AACtC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAkCjD"}

package/dist/repo-shape/companions.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The three smaller rendered files: actionlint's config, the changeset config, and
+ * Dependabot.
+ *
+ * ★ EACH ONE WAS MEASURED BEFORE IT WAS RENDERED (2026-09-22, across 13 repositories):
+ *     · `.changeset/config.json` — byte-identical apart from the repository name in 11 of
+ *       13. The three that differed did so by accident: two pinned an older `$schema`
+ *       (3.1.4 against 4.0.1) and one used `@changesets/cli/changelog` instead of the
+ *       GitHub changelog everyone else had, which silently drops PR links from releases.
+ *     · `.github/actionlint.yaml` — 12 of 13 had it, with three wordings of one comment.
+ *       The one without it is the one repository still on `ubuntu-latest`, which is the
+ *       only case where it is genuinely not needed. That is an input, not an exception.
+ *     · `.github/dependabot.yml` — 1 of 14. Twelve repositories take no dependency or
+ *       Action updates at all, and nothing said so. Rendering it is the fix.
+ */
+import type { RepoShape } from './shape.ts';
+/**
+ * `.changeset/config.json`.
+ *
+ * ⛔ `privatePackages` IS WRITTEN ONLY FOR A REPOSITORY THAT DOES NOT PUBLISH, AND BOTH
+ *   OF ITS FIELDS ARE REQUIRED. `@changesets/cli` silently versions nothing when
+ *   `version` is absent, so a private repository without this key opens a Version
+ *   Packages PR that changes no version and tags no release — a release pipeline that
+ *   reports success and ships nothing.
+ */
+export declare function renderChangesetConfig(shape: RepoShape): string;
+/**
+ * `.github/actionlint.yaml` — rendered only for a self-hosted runner.
+ *
+ * ★ DECLARED, NOT SUPPRESSED. actionlint's `runner-label` rule stays on, so a typo'd
+ *   label (`homeflare-mnii`) still fails the `workflow lint` job rather than silently
+ *   queueing a job no runner ever claims. Measured 2026-09-22 with actionlint 1.7.12: an
+ *   undeclared `homeflare-mini` is an error, not a warning, so this file is the reason
+ *   twelve repositories are green rather than a nicety.
+ */
+export declare function renderActionlintConfig(shape: RepoShape): string | undefined;
+/** `.github/dependabot.yml`. */
+export declare function renderDependabot(shape: RepoShape): string;
+//# sourceMappingURL=companions.d.ts.map

package/dist/repo-shape/companions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"companions.d.ts","sourceRoot":"","sources":["../../src/repo-shape/companions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAS5C;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAiB9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB3E;AAED,gCAAgC;AAChC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAsEzD"}

package/dist/repo-shape/drift.d.ts

@@ -0,0 +1,29 @@
+import type { RepoShape, RepoShapeException } from './shape.ts';
+/** One thing to fix, in the imperative — the same `Problem` shape `./check` reports. */
+export type Problem = string;
+/** The command that makes a difference go away. Printed with every drift problem. */
+export declare const REFRESH_COMMAND = "bun run repo-shape:refresh";
+export interface DriftReport {
+    /** Empty when the committed files are the rendered ones. */
+    readonly problems: readonly Problem[];
+    /** Paths whose committed text differs from the render, excluding excepted files. */
+    readonly drifted: readonly string[];
+    /** Paths the repository declared it owns, with the reason it gave. */
+    readonly excepted: readonly RepoShapeException[];
+}
+/**
+ * Compare a repository's committed tooling files against its declared shape.
+ *
+ *     const report = await driftInRepoShape(process.cwd(), shape);
+ *     expect(report.problems).toEqual([]);
+ *
+ * A declared exception passes. An undeclared difference fails, and so does a missing file.
+ */
+export declare function driftInRepoShape(projectDir: string, shape: RepoShape): Promise<DriftReport>;
+/**
+ * Every rendered path that is NOT compared, with why. For a report, not for a gate.
+ * ★ Printed by `refresh --check` so a passing run still names what it did not check.
+ *   An exception that stops being visible is an exception that stops being reconsidered.
+ */
+export declare function exceptionSummary(shape: RepoShape): readonly string[];
+//# sourceMappingURL=drift.d.ts.map

package/dist/repo-shape/drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift.d.ts","sourceRoot":"","sources":["../../src/repo-shape/drift.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAgB,SAAS,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9E,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,qFAAqF;AACrF,eAAO,MAAM,eAAe,+BAA+B,CAAC;AA6C5D,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CA6BjG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAKpE"}

package/dist/repo-shape/refresh.d.ts

@@ -0,0 +1,18 @@
+import { type RepoShape } from './shape.ts';
+export interface RefreshResult {
+    /** Paths written because their content changed or they were absent. */
+    readonly written: readonly string[];
+    /** Paths already correct. */
+    readonly unchanged: readonly string[];
+    /** Paths skipped because the shape declares an exception for them. */
+    readonly skipped: readonly string[];
+}
+/** Write a repository's rendered files into `projectDir`. */
+export declare function refreshRepoShape(projectDir: string, shape: RepoShape): Promise<RefreshResult>;
+/**
+ * The `repo-shape:refresh` entry point. `--check` reports drift and exits non-zero
+ * instead of writing, which is what a repository puts in CI when it does not want the
+ * check inside `bun test`.
+ */
+export declare function repoShapeCli(projectDir: string, shape: RepoShape, argv: readonly string[]): Promise<number>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/repo-shape/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/repo-shape/refresh.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,SAAS,EAAc,MAAM,YAAY,CAAC;AAGxD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,6DAA6D;AAC7D,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,aAAa,CAAC,CAsBxB;AAiBD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CA+BjB"}

package/dist/repo-shape/render.d.ts

@@ -0,0 +1,39 @@
+import type { RenderedPath, RepoShape } from './shape.ts';
+/** The status-check contexts a rendered repository reports. */
+export interface RepoShapePolicy {
+    readonly owner: string;
+    readonly repository: string;
+    /**
+     * ⛔ EXACTLY THE AGGREGATES, NEVER THE LEAF JOBS. `ci` is `if: always()` and fails when
+     *   any job it needs did not succeed, so requiring it requires all of them. Requiring a
+     *   leaf job instead would mean a ruleset edit every time a job is added, and a context
+     *   that stops reporting leaves every pull request pending rather than failing.
+     */
+    readonly checks: readonly string[];
+}
+export interface RenderedRepo {
+    /** Every rendered file, by its path relative to the repository root. */
+    readonly files: Readonly<Record<string, string>>;
+    /**
+     * The options `declareRepoPolicy(id, { ...rendered.policy, settings })` takes.
+     * Squash-only, auto-merge, delete-branch-on-merge and the `main` ruleset come from
+     * there; the check names come from here.
+     */
+    readonly policy: RepoShapePolicy;
+}
+/**
+ * Render a repository's tooling files and the policy that matches them.
+ *
+ *     const rendered = renderRepoShape(shape);
+ *     rendered.files['.github/workflows/ci.yml']   // the file
+ *     rendered.policy.checks                        // ['ci', 'secret scan']
+ *
+ * ⚠️ EXCEPTED FILES ARE STILL RENDERED. `files` is what the standard says this repository
+ *   should have; `drift.ts` is what decides which of them are compared. Keeping them here
+ *   means `--show` can print the standard version of an excepted file, which is how
+ *   anyone judges whether the exception is still worth its reason.
+ */
+export declare function renderRepoShape(shape: RepoShape): RenderedRepo;
+/** Every path this renderer can emit, whatever a given shape asks for. */
+export declare const RENDERED_PATHS: readonly RenderedPath[];
+//# sourceMappingURL=render.d.ts.map

package/dist/repo-shape/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/repo-shape/render.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE1D,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,CAe9D;AAED,0EAA0E;AAC1E,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAMjD,CAAC"}