@kb-labs/devkit 2.94.0 → 2.96.0

package/assets/claude/skills/kb-labs-create-plugin/SKILL.md

@@ -111,14 +111,14 @@ The CLI caches plugin manifests. After building a new plugin, always clear the
 cache — otherwise the new commands will not be discovered.
 
 ```bash
-pnpm kb marketplace clear-cache
+pnpm kb marketplace plugins refresh
 pnpm kb <name>:hello --help
 ```
 
 If the command is not found, clear the cache deeply and retry:
 
 ```bash
-pnpm kb marketplace clear-cache --deep
+pnpm kb marketplace plugins refresh
 ```
 
 ## Step 8: Register in the workspace (only if needed)

package/assets/claude/skills/kb-labs-troubleshoot/SKILL.md

@@ -22,14 +22,10 @@ git status of key files. Most problems surface here.
 
 Most common cause: **stale plugin registry cache after building a plugin**.
 
-```bash
-pnpm kb marketplace clear-cache
-```
-
-If that does not help, deep clear:
+The cache auto-invalidates on rebuild. If commands are still missing, force-reset:
 
 ```bash
-pnpm kb marketplace clear-cache --deep
+pnpm kb marketplace plugins refresh
 ```
 
 Then retry the command. If it is still missing:
@@ -53,7 +49,7 @@ Fix:
 ```bash
 pkill -9 -f "host-agent-app/dist/index.js"
 ps aux | grep host-agent | grep -v grep   # must be empty
-pnpm kb marketplace clear-cache --deep
+pnpm kb marketplace plugins refresh
 ```
 
 Then retry the command.

package/assets/claude/skills/kb-labs-update/SKILL.md

@@ -61,10 +61,11 @@ pnpm kb-dev status
 
 ## Step 5: Clear stale caches
 
-After an update, plugin manifests may have changed:
+After an update, plugin manifests may have changed. The cache auto-invalidates,
+but you can force-reset if needed:
 
 ```bash
-pnpm kb marketplace clear-cache
+pnpm kb marketplace plugins refresh
 ```
 
 ## If the update fails partway

package/bin/devkit-check-plugins.mjs

@@ -0,0 +1,293 @@
+#!/usr/bin/env node
+
+/**
+ * KB Labs DevKit - Plugin Entry Checker
+ *
+ * Validates plugin entry packages against the reference structure (devlink-entry).
+ * A package is considered a plugin entry if it has a "kb.manifest" field.
+ *
+ * Checks:
+ *   1. sideEffects: false
+ *   2. description field
+ *   3. main + types top-level fields
+ *   4. ./plugin-manifest in exports
+ *   5. kb.manifest field
+ *
+ * Usage:
+ *   kb-devkit-check-plugins                    # Check all plugin entries
+ *   kb-devkit-check-plugins --fix              # Auto-fix what's possible
+ *   kb-devkit-check-plugins --package @kb-labs/review-entry
+ *   kb-devkit-check-plugins --verbose
+ *   kb-devkit-check-plugins --json
+ *   kb-devkit-check-plugins --ci
+ */
+
+import { writeFile, readFile } from 'node:fs/promises';
+import { join, dirname, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// ─── discovery ───────────────────────────────────────────────────────────────
+
+function findWorkspaceRoot(cwd = process.cwd()) {
+  let current = cwd;
+  while (current !== '/') {
+    if (existsSync(join(current, 'pnpm-workspace.yaml'))) return current;
+    current = dirname(current);
+  }
+  return cwd;
+}
+
+function collectPackages(root) {
+  const packages = [];
+
+  const walk = (dir) => {
+    if (dir.includes('node_modules') || dir.includes('/dist')) return;
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name.startsWith('.') || entry.name === 'node_modules') continue;
+      const fullPath = join(dir, entry.name);
+      const pkgJsonPath = join(fullPath, 'package.json');
+      if (existsSync(pkgJsonPath)) {
+        try {
+          const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));
+          if (pkgJson.name?.startsWith('@kb-labs/')) {
+            packages.push({ name: pkgJson.name, path: fullPath, pkgJson, pkgJsonPath });
+          }
+        } catch {}
+      }
+      walk(fullPath);
+    }
+  };
+
+  walk(root);
+  return packages;
+}
+
+// Plugin entries live in plugins/*/entry/ (not adapters, not app-packages, not daemons).
+// Adapter packages also carry kb.manifest but are a separate category.
+function isPluginEntry(pkg) {
+  if (!pkg.pkgJson.kb?.manifest) return false;
+  const normalised = pkg.path.replace(/\\/g, '/');
+  return /\/plugins\/[^/]+\/entry$/.test(normalised);
+}
+
+// ─── checker ─────────────────────────────────────────────────────────────────
+
+function checkPlugin(pkg) {
+  const issues = [];
+  const warnings = [];
+  const { pkgJson } = pkg;
+
+  // 1. sideEffects: false
+  if (!('sideEffects' in pkgJson)) {
+    issues.push({
+      type: 'missing-sideEffects',
+      severity: 'error',
+      message: 'Missing "sideEffects": false — required for tree-shaking',
+      fix: () => { pkgJson.sideEffects = false; },
+    });
+  } else if (pkgJson.sideEffects !== false) {
+    warnings.push({
+      type: 'wrong-sideEffects',
+      severity: 'warning',
+      message: `"sideEffects" is ${JSON.stringify(pkgJson.sideEffects)}, expected false`,
+    });
+  }
+
+  // 2. description
+  if (!pkgJson.description) {
+    issues.push({
+      type: 'missing-description',
+      severity: 'error',
+      message: 'Missing "description" field',
+    });
+  }
+
+  // 3. main + types (top-level, for older tooling compatibility)
+  if (!pkgJson.main) {
+    issues.push({
+      type: 'missing-main',
+      severity: 'error',
+      message: 'Missing top-level "main" field',
+      fix: () => { pkgJson.main = './dist/index.js'; },
+    });
+  }
+  if (!pkgJson.types) {
+    issues.push({
+      type: 'missing-types',
+      severity: 'error',
+      message: 'Missing top-level "types" field',
+      fix: () => { pkgJson.types = './dist/index.d.ts'; },
+    });
+  }
+
+  // 4. ./plugin-manifest in exports
+  const exports_ = pkgJson.exports || {};
+  if (!('./plugin-manifest' in exports_)) {
+    issues.push({
+      type: 'missing-plugin-manifest-export',
+      severity: 'error',
+      message: 'Missing "./plugin-manifest" in exports — required for plugin discovery',
+      fix: () => {
+        if (!pkgJson.exports) pkgJson.exports = {};
+        pkgJson.exports['./plugin-manifest'] = {
+          types: './dist/manifest.d.ts',
+          import: './dist/manifest.js',
+        };
+      },
+    });
+  }
+
+  // 5. kb.manifest
+  if (!pkgJson.kb?.manifest) {
+    issues.push({
+      type: 'missing-kb-manifest',
+      severity: 'error',
+      message: 'Missing "kb.manifest" field — required for plugin registration',
+      fix: () => {
+        pkgJson.kb = { ...(pkgJson.kb || {}), manifest: './dist/manifest.js' };
+      },
+    });
+  }
+
+  return { issues, warnings };
+}
+
+// ─── fixer ───────────────────────────────────────────────────────────────────
+
+async function fixPlugin(pkg, issues) {
+  const fixable = issues.filter((i) => typeof i.fix === 'function');
+  if (fixable.length === 0) return false;
+
+  for (const issue of fixable) issue.fix();
+
+  await writeFile(pkg.pkgJsonPath, JSON.stringify(pkg.pkgJson, null, 2) + '\n', 'utf-8');
+  return true;
+}
+
+// ─── main ────────────────────────────────────────────────────────────────────
+
+async function main() {
+  const args = process.argv.slice(2);
+  const flags = {
+    fix: args.includes('--fix'),
+    verbose: args.includes('--verbose'),
+    json: args.includes('--json'),
+    ci: args.includes('--ci'),
+    package: args.find((a) => a.startsWith('--package='))?.split('=')[1],
+  };
+
+  const root = findWorkspaceRoot();
+  let packages = collectPackages(root).filter(isPluginEntry);
+
+  if (flags.package) {
+    packages = packages.filter((p) => p.name === flags.package);
+    if (packages.length === 0) {
+      console.error(`\n❌ Plugin entry package "${flags.package}" not found\n`);
+      process.exit(1);
+    }
+  }
+
+  if (!flags.json && !flags.ci) {
+    console.log('\n🔌 KB Labs Plugin Entry Checker\n');
+    console.log(`Found ${packages.length} plugin entry package(s)\n`);
+  }
+
+  const results = [];
+  let totalIssues = 0;
+  let totalWarnings = 0;
+
+  for (const pkg of packages) {
+    const { issues, warnings } = checkPlugin(pkg);
+    totalIssues += issues.length;
+    totalWarnings += warnings.length;
+
+    let fixed = false;
+    if (flags.fix && issues.length > 0) {
+      fixed = await fixPlugin(pkg, issues);
+    }
+    results.push({ pkg, issues, warnings, fixed });
+  }
+
+  // ── json output ────────────────────────────────────────────────────────────
+  if (flags.json) {
+    console.log(JSON.stringify({
+      packages: results.map((r) => ({
+        name: r.pkg.name,
+        path: relative(root, r.pkg.path),
+        issues: r.issues.length,
+        warnings: r.warnings.length,
+        fixed: r.fixed,
+        details: {
+          issues: r.issues.map(({ fix: _fix, ...rest }) => rest),
+          warnings: r.warnings,
+        },
+      })),
+      summary: {
+        total: packages.length,
+        withIssues: results.filter((r) => r.issues.length > 0).length,
+        withWarnings: results.filter((r) => r.warnings.length > 0).length,
+        fixed: results.filter((r) => r.fixed).length,
+      },
+    }, null, 2));
+    if (flags.ci && totalIssues > 0) process.exit(1);
+    return;
+  }
+
+  // ── human output ───────────────────────────────────────────────────────────
+  if (totalIssues > 0) {
+    const affected = results.filter((r) => r.issues.length > 0);
+    console.log(`🔴 Issues: ${totalIssues} error(s) in ${affected.length} package(s)\n`);
+    for (const { pkg, issues } of affected) {
+      console.log(`   ${pkg.name}`);
+      for (const issue of issues) {
+        const fixable = typeof issue.fix === 'function' ? ' [auto-fixable]' : ' [manual]';
+        console.log(`      ${issue.message}${flags.verbose ? fixable : ''}`);
+      }
+      console.log();
+    }
+  }
+
+  if (totalWarnings > 0 && flags.verbose) {
+    console.log(`⚠️  Warnings: ${totalWarnings} non-critical issue(s)\n`);
+    for (const { pkg, warnings } of results.filter((r) => r.warnings.length > 0)) {
+      console.log(`   ${pkg.name}`);
+      for (const w of warnings) console.log(`      ${w.message}`);
+      console.log();
+    }
+  }
+
+  if (totalIssues === 0 && totalWarnings === 0) {
+    console.log('✅ All plugin entry packages are compliant!\n');
+  } else if (flags.fix) {
+    const fixedCount = results.filter((r) => r.fixed).length;
+    const unfixable = results.filter((r) =>
+      r.issues.some((i) => typeof i.fix !== 'function')
+    );
+    console.log(`✅ Fixed ${fixedCount} package(s)\n`);
+    if (unfixable.length > 0) {
+      console.log('⚠️  Manual fixes still required:\n');
+      for (const { pkg, issues } of unfixable) {
+        const manual = issues.filter((i) => typeof i.fix !== 'function');
+        if (manual.length === 0) continue;
+        console.log(`   ${pkg.name}`);
+        for (const issue of manual) console.log(`      ${issue.message}`);
+        console.log();
+      }
+    }
+  } else {
+    console.log('\n💡 Run with --fix to automatically fix auto-fixable issues\n');
+    console.log('   Note: "description" requires a manual fix\n');
+  }
+
+  if (flags.ci && totalIssues > 0) process.exit(1);
+}
+
+main().catch((err) => {
+  console.error('Error:', err.message);
+  process.exit(1);
+});

package/bin/devkit-ci.mjs

@@ -93,6 +93,11 @@ const CHECKS = {
     command: 'devkit-check-types.mjs',
     emoji: '📝',
   },
+  plugins: {
+    name: 'Plugin Entry Structure',
+    command: 'devkit-check-plugins.mjs',
+    emoji: '🔌',
+  },
 };
 
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kb-labs/devkit",
   "description": "Shared developer toolkit for KB Labs projects: TS/ESLint/Prettier/Vitest/Tsup presets and reusable GitHub Actions.",
-  "version": "2.94.0",
+  "version": "2.96.0",
   "type": "module",
   "license": "MIT",
   "exports": {
@@ -26,8 +26,10 @@
     "./vitest/": "./vitest/",
     "./vitest/node.js": "./vitest/node.js",
     "./vitest/react.js": "./vitest/react.js",
+    "./vitest/cli.js": "./vitest/cli.js",
     "./vitest/node": "./vitest/node.js",
     "./vitest/react": "./vitest/react.js",
+    "./vitest/cli": "./vitest/cli.js",
     "./vite/": "./vite/",
     "./vite/react-app.js": "./vite/react-app.js",
     "./vite/react-app": "./vite/react-app.js",
@@ -56,35 +58,36 @@
     "./sync": "./sync/index.mjs"
   },
   "bin": {
-    "kb-devkit-sync": "./bin/devkit-sync.mjs",
-    "kb-devkit-paths": "./bin/devkit-paths.mjs",
-    "kb-devkit-tsup-external": "./bin/devkit-tsup-external.mjs",
-    "kb-devkit-validate-naming": "./bin/devkit-validate-naming.mjs",
-    "kb-devkit-check-imports": "./bin/devkit-check-imports.mjs",
-    "kb-devkit-check-exports": "./bin/devkit-check-exports.mjs",
-    "kb-devkit-check-duplicates": "./bin/devkit-check-duplicates.mjs",
-    "kb-devkit-check-structure": "./bin/devkit-check-structure.mjs",
+    "kb-devkit-architecture": "./bin/devkit-architecture.mjs",
+    "kb-devkit-build-order": "./bin/devkit-build-order.mjs",
+    "kb-devkit-check-build-readiness": "./bin/devkit-check-build-readiness.mjs",
     "kb-devkit-check-commands": "./bin/devkit-check-commands.mjs",
-    "kb-devkit-check-types": "./bin/devkit-check-types.mjs",
     "kb-devkit-check-configs": "./bin/devkit-check-configs.mjs",
+    "kb-devkit-check-deprecated": "./bin/devkit-check-deprecated.mjs",
+    "kb-devkit-check-duplicates": "./bin/devkit-check-duplicates.mjs",
+    "kb-devkit-check-exports": "./bin/devkit-check-exports.mjs",
+    "kb-devkit-check-imports": "./bin/devkit-check-imports.mjs",
+    "kb-devkit-check-paths": "./bin/devkit-check-paths.mjs",
+    "kb-devkit-check-plugins": "./bin/devkit-check-plugins.mjs",
     "kb-devkit-check-scripts": "./bin/devkit-check-scripts.mjs",
-    "kb-devkit-migrate-configs": "./bin/devkit-migrate-configs.mjs",
-    "kb-devkit-types-audit": "./bin/devkit-types-audit.mjs",
-    "kb-devkit-build-order": "./bin/devkit-build-order.mjs",
-    "kb-devkit-types-order": "./bin/devkit-types-order.mjs",
-    "kb-devkit-visualize": "./bin/devkit-visualize.mjs",
+    "kb-devkit-check-structure": "./bin/devkit-check-structure.mjs",
+    "kb-devkit-check-types": "./bin/devkit-check-types.mjs",
     "kb-devkit-ci": "./bin/devkit-ci.mjs",
+    "kb-devkit-core-gate": "./bin/devkit-core-gate.mjs",
     "kb-devkit-fix-deps": "./bin/devkit-fix-deps.mjs",
-    "kb-devkit-stats": "./bin/devkit-stats.mjs",
-    "kb-devkit-check-paths": "./bin/devkit-check-paths.mjs",
-    "kb-devkit-architecture": "./bin/devkit-architecture.mjs",
     "kb-devkit-freshness": "./bin/devkit-freshness.mjs",
-    "kb-devkit-check-deprecated": "./bin/devkit-check-deprecated.mjs",
-    "kb-devkit-check-build-readiness": "./bin/devkit-check-build-readiness.mjs",
     "kb-devkit-health": "./bin/devkit-health.mjs",
+    "kb-devkit-migrate-configs": "./bin/devkit-migrate-configs.mjs",
+    "kb-devkit-paths": "./bin/devkit-paths.mjs",
     "kb-devkit-qa": "./bin/kb-devkit-qa.mjs",
     "kb-devkit-qa-history": "./bin/kb-devkit-qa-history.mjs",
-    "kb-devkit-core-gate": "./bin/devkit-core-gate.mjs"
+    "kb-devkit-stats": "./bin/devkit-stats.mjs",
+    "kb-devkit-sync": "./bin/devkit-sync.mjs",
+    "kb-devkit-tsup-external": "./bin/devkit-tsup-external.mjs",
+    "kb-devkit-types-audit": "./bin/devkit-types-audit.mjs",
+    "kb-devkit-types-order": "./bin/devkit-types-order.mjs",
+    "kb-devkit-validate-naming": "./bin/devkit-validate-naming.mjs",
+    "kb-devkit-visualize": "./bin/devkit-visualize.mjs"
   },
   "files": [
     "agents",
@@ -127,8 +130,8 @@
     "tsup": "^8.5.0",
     "typescript": "^5.9.2",
     "typescript-eslint": "^8.44.0",
-    "vitest": "^3.2.4",
-    "@kb-labs/devkit": "2.94.0"
+    "vitest": "^3.2.6",
+    "@kb-labs/devkit": "2.96.0"
   },
   "engines": {
     "node": ">=20.0.0",
@@ -140,7 +143,7 @@
     "tsup": "^8.5.0",
     "typescript": "^5.9.2",
     "typescript-eslint": "^8.44.0",
-    "vitest": "^3.2.4"
+    "vitest": "^3.2.6"
   },
   "peerDependenciesMeta": {
     "eslint-plugin-import": {

package/tsup/node.js

@@ -1,6 +1,6 @@
 import { defineConfig } from 'tsup'
 import { readTsupExternalSync } from './external-sync.mjs'
-import { readFileSync, existsSync } from 'node:fs'
+import { readFileSync, writeFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 
 /**
@@ -40,6 +40,61 @@ function resolveEntryFromExports() {
   }
 }
 
+/**
+ * Resolve the built manifest JS path from `pkg.kb.manifest`.
+ * e.g. pkg.kb.manifest = "./dist/manifest.js" → "<cwd>/dist/manifest.js"
+ */
+function resolveManifestDistPath() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(process.cwd(), 'package.json'), 'utf8'))
+    if (typeof pkg.kb?.manifest === 'string') {
+      return join(process.cwd(), pkg.kb.manifest.replace(/^\.\//, ''))
+    }
+  } catch { /* nothing to emit */ }
+  return null
+}
+
+/**
+ * tsup `onSuccess`: emit dist/manifest.json by reading the compiled
+ * dist/manifest.js as TEXT and evaluating the exported object.
+ *
+ * Why not dynamic `import()`?
+ * In multi-entry tsup builds `onSuccess` fires while Node's module cache may
+ * still hold a stale (empty) version of dist/manifest.js from an earlier
+ * watch-mode iteration, or the file descriptors may not be fully flushed.
+ * Using `import()` with a cache-bust URL is unreliable in those cases —
+ * it returned an empty module in CI, producing a 0-byte manifest.json that
+ * kb-create rejected with "unexpected end of JSON input".
+ *
+ * Reading the COMPILED JS as text is safe: tsup has already written the file
+ * before invoking `onSuccess`, and we're parsing plain JavaScript (no type
+ * annotations) with a small Function() eval — controlled, no user input.
+ */
+function emitManifestJson() {
+  const distPath = resolveManifestDistPath()
+  if (!distPath || !existsSync(distPath)) return
+  try {
+    const js = readFileSync(distPath, 'utf8')
+    // tsup ESM output pattern (from inspecting actual built files):
+    //   var manifest = { schema: "kb.service/1", id: "...", ... };
+    //   var manifest_default = manifest;
+    //   export { manifest_default as default, manifest };
+    // Capture everything between `var manifest =` and the next `var manifest_default`.
+    const match = js.match(/var\s+manifest\s*=\s*(\{[\s\S]*?\n\});\s*\nvar\s+manifest_default/)
+    if (!match) return
+    // eslint-disable-next-line no-new-func
+    const obj = new Function(`"use strict"; return (${match[1]})`)()
+    if (!obj || typeof obj !== 'object') return
+    // Scope to SERVICE manifests only — plugin/adapter manifests are loaded as
+    // JS by the runtime and don't need a sibling .json.
+    if (typeof obj.schema !== 'string' || !obj.schema.startsWith('kb.service/')) return
+    const jsonPath = distPath.replace(/\.js$/, '.json')
+    writeFileSync(jsonPath, JSON.stringify(obj, null, 2) + '\n')
+  } catch {
+    // Never fail the build over manifest emission.
+  }
+}
+
 function resolveExternalDependencies() {
   try {
     const pkgPath = join(process.cwd(), 'package.json')
@@ -86,6 +141,9 @@ export default defineConfig({
   splitting: false,
   skipNodeModulesBundle: true,
   shims: false,
+  // Emit dist/manifest.json from the built manifest module so Go installers
+  // (kb-create) can register the service. No-op for packages without a manifest.
+  onSuccess: emitManifestJson,
   ignoreWatch: [
     '**/node_modules/**',
     '**/dist/**',

package/vitest/cli.js

@@ -0,0 +1,18 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    globals: false,
+    reporters: ['default'],
+    include: ['src/__tests__/cli/**/*.cli.test.ts'],
+    exclude: [
+      '**/node_modules/**',
+      '**/dist/**',
+    ],
+    testTimeout: 5_000,
+    coverage: {
+      enabled: false,
+    },
+  },
+})

package/vitest/node.js

@@ -1,10 +1,20 @@
 import { defineConfig } from 'vitest/config'
+import { cpus } from 'os'
+
+const defaultForks = Math.max(1, Math.ceil(cpus().length / 2))
+const maxForks = process.env.VITEST_MAX_FORKS
+  ? parseInt(process.env.VITEST_MAX_FORKS, 10)
+  : defaultForks
 
 export default defineConfig({
   test: {
     environment: 'node',
     globals: false,
     reporters: ['default'],
+    pool: 'forks',
+    poolOptions: {
+      forks: { maxForks, minForks: 1 },
+    },
     include: ['**/*.{test,spec}.?(c|m)[jt]s?(x)'],
     exclude: [
       '**/node_modules/**',
@@ -12,6 +22,13 @@ export default defineConfig({
       '**/cypress/**',
       '**/.{idea,git,cache,output,temp}/**'
     ],
+    // The first test in an import-heavy suite pays the cold ESM transform +
+    // module-graph load. Under the forks pool on a CPU-constrained CI runner
+    // that occasionally spikes past Vitest's 5s default and flakes a healthy
+    // test (e.g. one whose body does `await import('../heavy-module.js')`).
+    // 30s gives generous headroom for cold-start latency while still catching a
+    // genuine hang; logic-level slowness is not a concern for these unit suites.
+    testTimeout: 30_000,
     coverage: {
       enabled: false,
       provider: 'v8',
@@ -30,14 +47,11 @@ export default defineConfig({
         '**/constants.ts',
         '**/constants/**',
         '**/*.config.ts',
-        '**/*.config.js'
+        '**/*.config.js',
+        '**/bootstrap.ts',
+        '**/bin.ts'
       ],
-      thresholds: {
-        statements: 90,
-        branches: 85,
-        functions: 90,
-        lines: 90
-      }
+      thresholds: {}
     }
   }
 })

package/vitest/react.js

@@ -33,12 +33,11 @@ export default defineConfig({
         '**/*.config.ts',
         '**/*.config.js'
       ],
-      thresholds: {
-        statements: 90,
-        branches: 85,
-        functions: 90,
-        lines: 90
-      }
+      // No global thresholds in the preset — enforce per-package via
+      // devkit.yaml coverage.categories/thresholds (current floors,
+      // raised quarterly). The previous 90/85/90/90 values broke every
+      // consumer that wasn't already at target, with no migration path.
+      thresholds: {}
     }
   }
 })