@jabrown93/dev-config 0.0.0-development

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jared Brown
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,130 @@
+# @jabrown93/dev-config
+
+Shared JS/TS dev-tooling config for `jabrown93` repos: TypeScript, ESLint, Prettier,
+commitlint, lint-staged, and semantic-release. One published package instead of six
+hand-copied config files per repo — bump this package's version and Renovate proposes the
+same bump everywhere it's used, the same way runtime dependency bumps already flow.
+
+This is the npm-package analog of [`jabrown93/.github`](https://github.com/jabrown93/.github),
+which centralizes reusable GitHub Actions workflows the same way. That repo is deliberately
+unpublished (`private: true`, consumed via `uses:`); this one is a real published package
+because its configs are consumed at author/commit time via `devDependency` + `extends`, not
+by Actions.
+
+## Usage
+
+Add the package:
+
+```sh
+npm install --save-dev @jabrown93/dev-config
+```
+
+### TypeScript
+
+```json
+// tsconfig.json
+{
+  "extends": "@jabrown93/dev-config/tsconfig",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist"
+  },
+  "include": ["src"]
+}
+```
+
+`rootDir`/`outDir` must stay in the **consumer's own** `tsconfig.json`, not the shared base:
+TypeScript resolves an extended config's relative paths against _that config file's own
+location_, so a `rootDir`/`outDir` baked into this package would resolve to paths inside
+`node_modules/@jabrown93/dev-config/`, not the consumer's own `src`/`dist` — breaking every
+consumer with a `TS6059` "not under rootDir" error.
+
+### ESLint (flat config)
+
+```js
+// eslint.config.mjs
+import base from '@jabrown93/dev-config/eslint';
+
+export default [...base, { ignores: ['**/dist'] }];
+```
+
+The only thing that's ever differed across the fleet is `ignores` — add repo-specific entries
+after the shared base.
+
+### Prettier
+
+```json
+// package.json
+{
+  "prettier": "@jabrown93/dev-config/prettier"
+}
+```
+
+Delete any local `.prettierrc.json` — Prettier uses one config source, not both.
+
+### commitlint
+
+```js
+// commitlint.config.js
+export default { extends: ['@jabrown93/dev-config/commitlint'] };
+```
+
+### lint-staged
+
+```js
+// .lintstagedrc.js
+export { default } from '@jabrown93/dev-config/lint-staged';
+```
+
+Delete any local `.lintstagedrc.json` or an inline `lint-staged` key in `package.json` — only
+one lint-staged config source should exist per repo.
+
+### semantic-release
+
+```json
+// .releaserc.json
+{ "extends": "@jabrown93/dev-config/release" }
+```
+
+`extends` is a resolver string, not code — this works from a `.releaserc.json` even though the
+referenced module runs code at load time.
+
+This config suppresses routine `fix(deps)` commits on ordinary pushes and promotes them into a
+single weekly patch release when the caller's workflow sets `RELEASE_DEPS=true` (see
+`jabrown93/.github`'s README, "Weekly dependency releases"). **A consumer's `release.yml` must
+add a `schedule` (and ideally `workflow_dispatch`) trigger for this to ever fire** — without
+one, `fix(deps)` commits are suppressed forever, not just batched. See this repo's own
+`.github/workflows/release.yml`, or `homebridge-smartrent`'s, for the trigger shape to copy.
+
+### What stays per-repo
+
+No npm-`extends` mechanism exists for `.prettierignore` or `.nvmrc` — those stay hand-maintained
+per repo.
+
+## What's exported
+
+| Subpath                             | Contents                                                                                                                                                             |
+| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `@jabrown93/dev-config/tsconfig`    | Shared `compilerOptions` (target/module/strict/etc.) — no `rootDir`/`outDir`/`include`/`exclude`, those must stay in the consumer's own tsconfig (see above)         |
+| `@jabrown93/dev-config/eslint`      | Flat-config array (parser, `eslint:recommended` + `@typescript-eslint/recommended`, the fleet's stylistic rules)                                                     |
+| `@jabrown93/dev-config/prettier`    | The 5 shared Prettier options                                                                                                                                        |
+| `@jabrown93/dev-config/commitlint`  | `@commitlint/config-conventional` + 4 rule overrides                                                                                                                 |
+| `@jabrown93/dev-config/lint-staged` | `eslint --fix` on staged js/mjs/ts + `prettier --write` on staged js/mjs/ts/json/md/yml                                                                              |
+| `@jabrown93/dev-config/release`     | semantic-release config: branches `main`/`next`/`beta`/`alpha`, conventionalcommits preset, CHANGELOG trim, CycloneDX SBOM release asset, `fix(deps)` weekly roll-up |
+
+## Dependency split
+
+Tools whose **bin** a consumer invokes directly (`eslint`, `prettier`, `typescript`, `husky`,
+`lint-staged`, `semantic-release`, `@commitlint/cli`, plus each repo's own test runner) stay as
+**direct devDependencies in the consumer**. Packages this config resolves internally at
+runtime and a consumer never invokes directly (`@typescript-eslint/*`, `@eslint/js`,
+`@eslint/eslintrc`, `@commitlint/config-conventional`, every `@semantic-release/*` plugin,
+`conventional-changelog-conventionalcommits`) are `dependencies` **of this package** — they
+arrive in a consumer's tree via normal npm hoisting when this package installs, and a version
+bump here is the only place those need touching.
+
+## Versioning
+
+Released automatically by semantic-release from Conventional Commits on `main` — see
+`.releaserc.js` (a relative re-export of `release.js`; this repo can't `extends` its own
+published package). Don't hand-edit `package.json`'s version.

package/commitlint.config.js

@@ -0,0 +1,14 @@
+// Shared commitlint configuration for jabrown93 repos. This file doubles as
+// dev-config's own active commitlint config (auto-discovered by commitlint's
+// standard filename search) and the shareable module consumers reference:
+//
+//   export default { extends: ['@jabrown93/dev-config/commitlint'] };
+export default {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    'body-max-line-length': [2, 'never', '500'],
+    'body-max-length': [2, 'never', '2000'],
+    'footer-max-line-length': [2, 'never', '500'],
+    'subject-case': [2, 'never', ['upper-case', 'pascal-case', 'start-case']],
+  },
+};

package/eslint.js

@@ -0,0 +1,111 @@
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import tsParser from '@typescript-eslint/parser';
+import js from '@eslint/js';
+import { FlatCompat } from '@eslint/eslintrc';
+import globals from 'globals';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const compat = new FlatCompat({
+  baseDirectory: __dirname,
+  recommendedConfig: js.configs.recommended,
+  allConfig: js.configs.all,
+});
+
+// Shared ESLint flat-config base for jabrown93 TypeScript projects. Import
+// this array and append repo-specific entries -- historically the only thing
+// that's ever differed across the fleet is `ignores`:
+//
+//   import base from '@jabrown93/dev-config/eslint';
+//   export default [...base, { ignores: ['**/homebridge-ui', '**/dist', 'package-lock.json', 'package.json'] }];
+//
+// Note: `compat.extends()` resolves plugin packages (e.g.
+// @typescript-eslint/eslint-plugin) via Node module resolution starting at
+// this file's own directory, which after install is inside the consumer's
+// node_modules/@jabrown93/dev-config -- resolution walks up to the
+// consumer's top-level node_modules, so this depends on npm hoisting
+// @typescript-eslint/eslint-plugin from this package's own `dependencies`.
+// That's the standard shareable-eslint-config pattern; verify with
+// `npx eslint --print-config <file>` after adopting if something doesn't
+// resolve.
+export default [
+  ...compat.extends(
+    'eslint:recommended',
+    'plugin:@typescript-eslint/eslint-recommended',
+    'plugin:@typescript-eslint/recommended'
+  ),
+  {
+    languageOptions: {
+      parser: tsParser,
+      // 2022 to match the shared tsconfig's own `target`/`lib` -- the fleet's
+      // original 2018 left ES2020+ built-in globals (AggregateError, WeakRef,
+      // FinalizationRegistry, ...) out of ESLint's recognized-globals set, so
+      // `eslint:recommended`'s no-undef flagged valid, runtime-supported code
+      // as undefined.
+      ecmaVersion: 2022,
+      sourceType: 'module',
+      // The fleet's original config never set `globals`, so flat config
+      // assumed no runtime environment -- `no-undef` would flag bare
+      // `console`/`process` as undefined. This never surfaced because no
+      // fleet src/*.ts file happened to reference either through the actual
+      // matched lint glob; it's a real gap for Node-targeted TS, not
+      // intentional. Fixed here rather than carried forward.
+      globals: { ...globals.node },
+    },
+
+    rules: {
+      // avoidEscape: prettier picks whichever quote style needs fewer
+      // escapes for a given string (e.g. a shell one-liner containing
+      // single quotes gets double-quoted); without avoidEscape, this rule
+      // and prettier fight over any string like that forever. The fleet's
+      // original config lacked this option -- never surfaced because no
+      // fleet string needed it, until this package's own release.js did.
+      quotes: ['warn', 'single', { avoidEscape: true }],
+
+      indent: [
+        'warn',
+        2,
+        {
+          SwitchCase: 1,
+        },
+      ],
+
+      semi: ['off'],
+      'comma-dangle': ['warn', 'only-multiline'],
+      'dot-notation': 'off',
+      eqeqeq: 'warn',
+      curly: ['warn', 'all'],
+      'brace-style': ['warn'],
+      'prefer-arrow-callback': ['warn'],
+      'max-len': ['warn', 140],
+      'no-console': ['warn'],
+      'comma-spacing': ['error'],
+
+      'no-multi-spaces': [
+        'warn',
+        {
+          ignoreEOLComments: true,
+        },
+      ],
+
+      'no-trailing-spaces': ['warn'],
+
+      'lines-between-class-members': [
+        'warn',
+        'always',
+        {
+          exceptAfterSingleLine: true,
+        },
+      ],
+
+      // The fleet's original config also listed a core `no-non-null-assertion`
+      // rule -- there is no such core ESLint rule (only the
+      // @typescript-eslint-prefixed one below exists), so it was a no-op.
+      // Dropped here rather than carried forward.
+      '@typescript-eslint/explicit-function-return-type': 'off',
+      '@typescript-eslint/no-non-null-assertion': 'off',
+      '@typescript-eslint/explicit-module-boundary-types': 'off',
+    },
+  },
+];

package/lint-staged.js

@@ -0,0 +1,27 @@
+// Shared lint-staged configuration for jabrown93 repos.
+//
+//   export { default } from '@jabrown93/dev-config/lint-staged';
+//
+// Fixes vs. the fleet's prior per-repo copies:
+//   - eslint is scoped to the actually-staged js/mjs/ts files (lint-staged
+//     appends staged filenames as arguments) instead of a hardcoded
+//     `src/**.ts` glob that ran regardless of what was staged.
+//   - No `bash -c` wrapper -- that swallowed the staged filenames lint-staged
+//     appends (they became unreferenced bash positional args), so eslint
+//     fell back to linting the whole repo instead of just staged files.
+//   - eslint and prettier are ordered commands under the SAME glob key for
+//     js/mjs/ts, not two separate keys that both match those files: distinct
+//     glob-key groups run concurrently by default, so two separate keys both
+//     matching the same file let eslint and prettier read/write it at the
+//     same time -- e.g. prettier can clobber an eslint-only fix while both
+//     processes still exit 0, staging code that passes the hook but would
+//     fail a real lint run. json/md/yml don't overlap with the first key at
+//     all (eslint has no parser configured for them anyway), so they're a
+//     second, disjoint key rather than sharing one with js/mjs/ts.
+export default {
+  '*.{js,mjs,ts}': [
+    'eslint --fix --max-warnings=0 --no-warn-ignored',
+    'prettier --write',
+  ],
+  '*.{json,md,yml}': 'prettier --write',
+};

package/package.json

@@ -0,0 +1,88 @@
+{
+  "name": "@jabrown93/dev-config",
+  "version": "0.0.0-development",
+  "description": "Shared JS/TS dev-tooling config (tsconfig, eslint, prettier, commitlint, lint-staged, semantic-release) for jabrown93 repos",
+  "keywords": [
+    "eslint-config",
+    "tsconfig",
+    "prettier-config",
+    "commitlint-config",
+    "lint-staged-config",
+    "semantic-release-config"
+  ],
+  "homepage": "https://github.com/jabrown93/dev-config#readme",
+  "bugs": {
+    "url": "https://github.com/jabrown93/dev-config/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jabrown93/dev-config.git"
+  },
+  "license": "MIT",
+  "author": {
+    "name": "Jared Brown",
+    "email": "npm@jaredbrown.io",
+    "url": "https://github.com/jabrown93"
+  },
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": "^22.14.0 || ^24.11.0 || ^26.0.0"
+  },
+  "files": [
+    "tsconfig.base.json",
+    "eslint.js",
+    "prettier.json",
+    "commitlint.config.js",
+    "lint-staged.js",
+    "release.js"
+  ],
+  "exports": {
+    "./tsconfig": "./tsconfig.base.json",
+    "./eslint": "./eslint.js",
+    "./prettier": "./prettier.json",
+    "./commitlint": "./commitlint.config.js",
+    "./lint-staged": "./lint-staged.js",
+    "./release": "./release.js"
+  },
+  "prettier": "./prettier.json",
+  "scripts": {
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "prettier": "prettier --check .",
+    "build": "echo \"no build step -- plain JS/JSON config package\"",
+    "test": "node scripts/verify-exports.mjs",
+    "semantic-release": "cross-env semantic-release --no-ci",
+    "release": "npm-run-all build semantic-release",
+    "prepare": "husky"
+  },
+  "dependencies": {
+    "@commitlint/config-conventional": "21.2.0",
+    "@eslint/eslintrc": "3.3.6",
+    "@eslint/js": "10.0.1",
+    "@semantic-release/changelog": "6.0.3",
+    "@semantic-release/commit-analyzer": "13.0.1",
+    "@semantic-release/exec": "7.1.0",
+    "@semantic-release/git": "10.0.1",
+    "@semantic-release/github": "12.0.9",
+    "@semantic-release/npm": "13.1.5",
+    "@semantic-release/release-notes-generator": "14.1.1",
+    "@typescript-eslint/eslint-plugin": "8.64.0",
+    "@typescript-eslint/parser": "8.64.0",
+    "conventional-changelog-conventionalcommits": "9.3.1",
+    "globals": "17.7.0"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "21.2.1",
+    "cross-env": "10.1.0",
+    "eslint": "10.7.0",
+    "husky": "9.1.7",
+    "lint-staged": "17.0.8",
+    "npm-run-all2": "9.0.2",
+    "prettier": "3.9.5",
+    "semantic-release": "25.0.7"
+  }
+}

package/prettier.json

@@ -0,0 +1,7 @@
+{
+  "semi": true,
+  "singleQuote": true,
+  "tabWidth": 2,
+  "trailingComma": "es5",
+  "arrowParens": "avoid"
+}

package/release.js

@@ -0,0 +1,138 @@
+// Shared semantic-release configuration for jabrown93 npm packages.
+//
+// Consumers reference this with a one-line `.releaserc.json` (or `.js`):
+//   { "extends": "@jabrown93/dev-config/release" }
+// "extends" is just a resolver string -- semantic-release/cosmiconfig loads
+// and executes this module regardless of the local file's own extension, so
+// a plain JSON local file works fine even though this module runs code.
+//
+// Versioning is automated from Conventional Commits:
+//   * push to `main`/`next` -> stable release (feat -> minor, fix/perf -> patch, ! -> major)
+//   * push to `beta`/`alpha` -> prerelease (vX.Y.Z-beta.N / -alpha.N)
+//
+// Routine runtime dependency bumps (fix(deps), from Renovate via the shared
+// preset in jabrown93/.github) do NOT cut a release on ordinary pushes --
+// they would otherwise publish a new npm version per merged Renovate PR. A
+// weekly scheduled run (see jabrown93/.github's README, "Weekly dependency
+// releases") sets RELEASE_DEPS=true, which promotes the accumulated bumps
+// into one patch release. Vulnerability fixes are typed fix(security) by the
+// preset, not fix(deps), so they are unaffected by the suppression and still
+// release immediately.
+//
+// IMPORTANT for adopters: a consumer's release.yml caller must add a
+// `schedule` (and ideally `workflow_dispatch`) trigger for RELEASE_DEPS to
+// ever become true -- without it, fix(deps) commits are suppressed forever,
+// not just batched. See jabrown93/homebridge-smartrent's release.yml for the
+// trigger shape to copy.
+const releaseDeps = process.env.RELEASE_DEPS === 'true';
+
+const depReleaseRules = [
+  // Required: commit-analyzer evaluates every matching custom rule and keeps
+  // the highest release type, so without this a breaking fix(deps)! would
+  // match ONLY the suppression rule below and never release. Listed first so
+  // the analyzer short-circuits on major.
+  { type: 'fix', scope: 'deps', breaking: true, release: 'major' },
+  releaseDeps
+    ? { type: 'fix', scope: 'deps', release: 'patch' }
+    : { type: 'fix', scope: 'deps', release: false },
+];
+
+const noteKeywords = ['BREAKING CHANGE', 'BREAKING CHANGES', 'BREAKING'];
+
+export default {
+  // NOTE: `branches` (plural) -- this is the key semantic-release actually
+  // reads. Two of the fleet's original per-repo .releaserc.json files had
+  // this as `"branch"` (singular), so that array was silently ignored and
+  // semantic-release fell back to its own default (`main` + `next` +
+  // `beta`/`alpha` prereleases, close to but not verified identical to what
+  // was intended) -- fixed by centralizing.
+  branches: [
+    'main',
+    'next',
+    { name: 'beta', prerelease: true },
+    { name: 'alpha', prerelease: true },
+  ],
+  plugins: [
+    [
+      '@semantic-release/commit-analyzer',
+      {
+        // `preset` is not a semantic-release core option -- there is no
+        // top-level fallback; each plugin reads it only from its own tuple's
+        // options (verified against @semantic-release/commit-analyzer's and
+        // release-notes-generator's own loaders, and semantic-release core
+        // itself has zero references to "preset" anywhere). A top-level
+        // `preset` key here would be silently ignored, and both plugins
+        // would fall back to the Angular preset instead -- the fleet's
+        // original per-repo configs all had exactly that silent bug.
+        preset: 'conventionalcommits',
+        parserOpts: { noteKeywords },
+        releaseRules: depReleaseRules,
+      },
+    ],
+    [
+      '@semantic-release/exec',
+      {
+        // Trims a duplicate leading "Unreleased"-style CHANGELOG heading on
+        // release branches. Present in 3 of the 4 fleet repos; the 4th
+        // (philips-hue-sync-box) was missing it -- restored here.
+        //
+        // Guarded on the file existing: this step runs before
+        // @semantic-release/changelog's own `prepare` hook (the one that
+        // creates CHANGELOG.md), so on a repo's very first-ever release --
+        // this package's own included -- there's no file yet and a bare
+        // `sed -i` would exit nonzero and abort the release.
+        prepareCmd:
+          "test ${branch.type} != release || test ! -f CHANGELOG.md || sed -i '/^## \\[/h;x;/^[^]]*-/{x;d};x' CHANGELOG.md",
+      },
+    ],
+    [
+      '@semantic-release/release-notes-generator',
+      {
+        preset: 'conventionalcommits',
+        parserOpts: { noteKeywords },
+        writerOpts: { commitsSort: ['subject', 'scope'] },
+      },
+    ],
+    [
+      '@semantic-release/changelog',
+      {
+        changelogTitle:
+          '# Changelog\n\nAll notable changes to this project will be documented ' +
+          'in this file. See\n[Conventional Commits](https://conventionalcommits.org) ' +
+          'for commit guidelines.',
+      },
+    ],
+    ['@semantic-release/npm', { tarballDir: 'dist' }],
+    [
+      '@semantic-release/exec',
+      {
+        prepareCmd:
+          'npx --yes @cyclonedx/cyclonedx-npm@4.2.1 --ignore-npm-errors --output-format JSON --output-file sbom.cdx.json',
+      },
+    ],
+    [
+      '@semantic-release/github',
+      {
+        assets: [
+          { path: 'sbom.cdx.json', label: 'CycloneDX SBOM (sbom.cdx.json)' },
+        ],
+      },
+    ],
+    [
+      '@semantic-release/git',
+      {
+        // `chore(release): ... [skip ci]` -- 3 of the 4 fleet repos used
+        // `ci(release): ...` with no `[skip ci]`. GitHub Actions natively
+        // skips ALL workflows (build.yml + release.yml) for a push whose
+        // HEAD commit message contains `[skip ci]`, so omitting it means the
+        // version-bump commit this plugin creates re-triggers a full
+        // lint/build/test matrix and a whole redundant semantic-release run
+        // for nothing (semantic-release itself no-ops since there's nothing
+        // new to release, but the CI run still executes). Standardized on
+        // the more efficient form (already used by philips-hue-sync-box).
+        message:
+          'chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}',
+      },
+    ],
+  ],
+};

package/tsconfig.base.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "lib": ["ES2022"],
+    "module": "nodenext",
+    "target": "ES2022",
+    "moduleResolution": "nodenext",
+    "strict": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "noImplicitAny": false,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true
+  }
+}