@milesroxas/design-hub 0.0.0-stage → 0.1.1

package/dist/scripts/bootstrap.js

@@ -0,0 +1,278 @@
+#!/usr/bin/env node
+/// <reference types="node" />
+// The mechanical setup of a project: what a prose step would skip or
+// improvise on some runs, where the failure is silent (a port another project
+// owns, a missing env var). Judgment stays in the skills.
+import { execFileSync, spawnSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { readEnv, writeEnv } from '../server/env.js';
+import { ROOT, TEMPLATES } from '../server/paths.js';
+import { CliError } from './lib/cli.js';
+import { holderOf, pickPort, readClaims, writeClaim } from './lib/ports.js';
+import { ENVIRONMENTS, envNames, linkedProject, STORE_ENV, setEnv, vercel, } from './lib/vercel.js';
+export const spec = {
+    name: 'bootstrap',
+    summary: 'Set the project up on this machine, and optionally on Vercel. Safe to run again.',
+    flags: {
+        port: {
+            type: 'number',
+            description: 'Use this port. Refused when another process holds it or another project claims it.',
+        },
+        'no-install': { type: 'boolean', description: 'Skip pnpm install.' },
+        'typesafe-key': { type: 'string', description: "Turn TypeSafe's Jev checks on with this API key." },
+        conductor: { type: 'boolean', description: 'Write .conductor/settings.toml for Conductor workspaces.' },
+        branch: { type: 'string', default: 'main', description: 'The branch Conductor workspaces land on.' },
+        vercel: { type: 'string', description: 'Link this Vercel project and set the password gate env on it.' },
+        'gate-password': {
+            type: 'string',
+            description: 'The share password (8+ characters). Given again, it rotates.',
+        },
+        review: {
+            type: 'boolean',
+            description: 'Provision the review store (Upstash Redis) on the Vercel project.',
+        },
+    },
+    output: '{ ok, node, port, install, typesafe, conductor?, vercel?, share?, review?, warnings }',
+};
+const MIN_NODE = [22, 18];
+const UPSTASH = 'upstash/upstash-kv';
+function run(cmd, argv, cwd = ROOT) {
+    const out = spawnSync(cmd, argv, { cwd, encoding: 'utf8', env: process.env });
+    if (out.error)
+        throw new CliError(`${cmd} is not installed.`, { command: [cmd, ...argv].join(' ') });
+    if (out.status !== 0)
+        throw new CliError(`${cmd} ${argv[0]} failed.`, {
+            command: [cmd, ...argv].join(' '),
+            stderr: out.stderr.trim(),
+        });
+    return out.stdout;
+}
+function checkNode() {
+    const [major, minor] = process.versions.node.split('.').map(Number);
+    if (major < MIN_NODE[0] || (major === MIN_NODE[0] && minor < MIN_NODE[1]))
+        throw new CliError(`Node ${MIN_NODE.join('.')} or newer is needed.`, {
+            found: process.versions.node,
+            fix: 'Install the current LTS from https://nodejs.org or `brew install node`.',
+        });
+    return process.versions.node;
+}
+function choosePort(wanted, current, warnings) {
+    const conductor = process.env.CONDUCTOR_PORT;
+    if (conductor) {
+        // Conductor owns its workspace ports; they never go in the machine registry.
+        const port = Number(conductor);
+        const held = holderOf(port);
+        if (held && held.cwd !== ROOT)
+            throw new CliError(`Conductor's port ${port} is taken.`, {
+                holder: held,
+                fix: 'Stop that server; never use another port.',
+            });
+        return port;
+    }
+    const choice = pickPort({ dir: ROOT, wanted, current, claims: readClaims(), holder: holderOf });
+    if (!choice.ok)
+        throw new CliError(choice.error, choice.detail);
+    warnings.push(...choice.warnings);
+    writeClaim(ROOT, choice.port);
+    return choice.port;
+}
+/** Keeps .claude/launch.json on the same port, when the project has one. */
+function writeLaunch(port) {
+    const file = join(ROOT, '.claude', 'launch.json');
+    if (!existsSync(file))
+        return;
+    const launch = JSON.parse(readFileSync(file, 'utf8'));
+    for (const c of launch.configurations) {
+        if ('port' in c)
+            c.port = port;
+        if (c.url)
+            c.url = c.url.replace(/localhost:\d+/, `localhost:${port}`);
+    }
+    writeFileSync(file, `${JSON.stringify(launch, null, 2)}\n`);
+}
+function writeConductor(branch, warnings) {
+    if (!/^[\w./-]+$/.test(branch))
+        throw new CliError('--branch takes a branch name.', { got: branch });
+    const file = join(ROOT, '.conductor', 'settings.toml');
+    const text = readFileSync(join(TEMPLATES, 'conductor', 'settings.toml'), 'utf8').replaceAll('{{branch}}', branch);
+    if (existsSync(file)) {
+        if (readFileSync(file, 'utf8') !== text)
+            warnings.push('.conductor/settings.toml differs from the template; kept as is.');
+        return 'kept';
+    }
+    mkdirSync(join(ROOT, '.conductor'), { recursive: true });
+    writeFileSync(file, text);
+    return 'written';
+}
+function cli(args, input) {
+    const out = vercel(ROOT, args, input);
+    if (!out)
+        throw new CliError('The Vercel CLI is not installed.', { fix: 'npm i -g vercel, then vercel login.' });
+    if (out.status !== 0)
+        throw new CliError(`vercel ${args.slice(0, 2).join(' ')} failed.`, {
+            stderr: out.stderr.trim().slice(-600),
+            fix: /log ?in|credentials|token/i.test(out.stderr)
+                ? 'Ask the user to run `vercel login` in their terminal.'
+                : undefined,
+        });
+    return out.stdout;
+}
+function link(project, warnings) {
+    const current = linkedProject(ROOT);
+    if (current === project)
+        return 'kept';
+    if (current)
+        warnings.push(`.vercel/project.json pointed at ${current}; relinked to ${project}.`);
+    cli(['link', '--yes', '--project', project]);
+    return 'ran';
+}
+/** Sets each value where it is missing; `rotate` names the ones given again, which replace what is there. */
+function ensureEnv(values, rotate) {
+    const state = {};
+    for (const target of ENVIRONMENTS) {
+        const names = envNames(ROOT, target);
+        if (!names)
+            throw new CliError(`vercel env ls ${target} failed.`, { fix: 'vercel login, then run this again.' });
+        for (const [name, value] of Object.entries(values)) {
+            const key = `${name}:${target}`;
+            const exists = names.has(name);
+            if (exists && !rotate.has(name)) {
+                state[key] = 'kept';
+                continue;
+            }
+            const out = setEnv(ROOT, name, target, value, exists);
+            if (out?.status !== 0)
+                throw new CliError(`vercel env add ${name} ${target} failed.`, { stderr: out?.stderr.trim() });
+            state[key] = exists ? 'rotated' : 'set';
+        }
+    }
+    return state;
+}
+// A password a reviewer can type from a message: lowercase letters and digits, no look-alikes.
+function readablePassword() {
+    const alphabet = 'abcdefghjkmnpqrstuvwxyz23456789';
+    return Array.from(randomBytes(12), (b) => alphabet[b % alphabet.length]).join('');
+}
+/** Reads one environment's values into memory and deletes the file, keeping only `names`. */
+function pullValues(target, names) {
+    const dir = mkdtempSync(join(tmpdir(), 'hub-env-'));
+    try {
+        const file = join(dir, '.env');
+        cli(['env', 'pull', file, `--environment=${target}`, '--yes']);
+        const pulled = readEnv(dir);
+        return Object.fromEntries(names.filter((n) => pulled[n]).map((n) => [n, pulled[n]]));
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+function provisionReview(project, warnings) {
+    const names = envNames(ROOT, 'production');
+    let store = 'kept';
+    if (!names || !STORE_ENV.every((n) => names.has(n))) {
+        const out = vercel(ROOT, [
+            'integration',
+            'add',
+            UPSTASH,
+            '--name',
+            `${project}-review`,
+            '-e',
+            'production',
+            '-e',
+            'preview',
+            '-e',
+            'development',
+            '--no-env-pull',
+        ]);
+        if (out?.status !== 0)
+            throw new CliError('Could not add the Upstash for Redis store.', {
+                stderr: out?.stderr.trim().slice(-600),
+                fix: `Ask the user to run \`vercel integration add ${UPSTASH}\` once in their terminal (it accepts the Marketplace terms), then run this again.`,
+            });
+        store = 'created';
+    }
+    // The local commands (design-hub people, design-hub comments) read the same store.
+    const values = pullValues('production', STORE_ENV);
+    const missing = STORE_ENV.filter((n) => !values[n]);
+    if (missing.length)
+        warnings.push(`Could not read ${missing.join(', ')} back; copy them from the store's page on Vercel into .env.`);
+    writeEnv(ROOT, values);
+    return { store, local: missing.length ? 'partial' : 'written' };
+}
+function install(skip) {
+    if (skip)
+        return 'skipped';
+    run('pnpm', existsSync(join(ROOT, 'pnpm-lock.yaml')) ? ['install', '--frozen-lockfile'] : ['install']);
+    return 'ran';
+}
+/** The key in use after this run: the one given, else the one already in .env. */
+function typesafe(given, current) {
+    if (given === undefined)
+        return current ?? '';
+    if (!/^[\w.-]{16,}$/.test(given))
+        throw new CliError('--typesafe-key does not look like an API key.');
+    writeEnv(ROOT, { TYPESAFE_API_KEY: given });
+    return given;
+}
+/** The gate's values: the password given, kept, or made, and the secret kept or made. */
+export function gateValues(given, env) {
+    const password = given ?? env.GATE_PASSWORD ?? readablePassword();
+    if (password.length < 8)
+        throw new CliError('--gate-password needs 8 characters or more.');
+    const secret = env.GATE_SECRET || randomBytes(32).toString('base64');
+    return { password, secret, rotated: given !== undefined && given !== env.GATE_PASSWORD };
+}
+function setUpVercel(project, flags, env, typesafeKey, warnings) {
+    const linked = link(project, warnings);
+    const { password, secret, rotated } = gateValues(flags['gate-password'], env);
+    writeEnv(ROOT, { GATE_PASSWORD: password, GATE_SECRET: secret });
+    const values = { GATE_PASSWORD: password, GATE_SECRET: secret };
+    // Comment triage runs on the server, so with the review store on, the key goes to Vercel too.
+    if (flags.review && typesafeKey)
+        values.TYPESAFE_API_KEY = typesafeKey;
+    if (rotated)
+        warnings.push('The password changed: every visitor signs in again.');
+    const result = {
+        vercel: { project, linked, env: ensureEnv(values, new Set(rotated ? ['GATE_PASSWORD'] : [])) },
+        share: { password },
+    };
+    if (!flags.review)
+        return result;
+    warnings.push('Redeploy so the new env reaches the site; then design-hub people invite --name "<you>" --role editor.');
+    return { ...result, review: provisionReview(project, warnings) };
+}
+function envIgnored(warnings) {
+    try {
+        execFileSync('git', ['-C', ROOT, 'check-ignore', '-q', '.env']);
+    }
+    catch {
+        warnings.push('.env is not gitignored; it holds secrets. Add `.env` to .gitignore before committing.');
+    }
+}
+export function main({ flags }) {
+    if (flags.review && !flags.vercel)
+        throw new CliError('--review needs --vercel <project>.');
+    const warnings = [];
+    const node = checkNode();
+    const env = readEnv(ROOT);
+    const port = choosePort(flags.port, env.PORT ? Number(env.PORT) : undefined, warnings);
+    writeEnv(ROOT, { PORT: String(port) });
+    writeLaunch(port);
+    const installed = install(flags['no-install']);
+    const typesafeKey = typesafe(flags['typesafe-key'], env.TYPESAFE_API_KEY);
+    const result = {
+        node,
+        port,
+        install: installed,
+        typesafe: typesafeKey ? 'on' : 'off',
+    };
+    if (flags.conductor)
+        result.conductor = writeConductor(flags.branch, warnings);
+    if (flags.vercel)
+        Object.assign(result, setUpVercel(flags.vercel, flags, env, typesafeKey, warnings));
+    envIgnored(warnings);
+    return { ...result, warnings };
+}

package/dist/scripts/calibrate.d.ts

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+import { type Args } from './lib/cli.ts';
+export declare const spec: {
+    readonly name: 'calibrate';
+    readonly summary: 'Label logged Jev judgments and derive the checks.json thresholds from the labels.';
+    readonly flags: {
+        readonly yes: {
+            readonly type: 'list';
+            readonly description: 'A judgment id that was right to flag: the rule really was broken.';
+        };
+        readonly no: {
+            readonly type: 'list';
+            readonly description: 'A judgment id that should not have flagged.';
+        };
+        readonly unlabeled: {
+            readonly type: 'boolean';
+            readonly description: 'List judgments without a label, newest first.';
+        };
+        readonly limit: {
+            readonly type: 'number';
+            readonly default: 20;
+            readonly description: 'How many --unlabeled to list.';
+        };
+        readonly write: {
+            readonly type: 'boolean';
+            readonly description: 'Write the suggested thresholds into checks.json.';
+        };
+    };
+    readonly output: '{ ok, thresholds: [{ threshold, current, suggested, labelled, positives, reason }] } or { judgments }';
+};
+export declare const MIN_LABELS = 20;
+export declare const MIN_POSITIVES = 5;
+export type Entry = {
+    id: string;
+    check: string;
+    question: string;
+    subject: string;
+    p?: number;
+    excerpt?: string;
+    at: string;
+};
+export type Point = {
+    p: number;
+    truth: boolean;
+};
+/**
+ * What each threshold is for decides how it is chosen. A block must be right
+ * almost every time it fires (precision). A warning may be wrong more often.
+ * The private-contact threshold must miss almost nothing (recall), because a
+ * miss puts a person's details behind a forwarded link.
+ */
+export declare const TARGETS: {
+    readonly 'fidelity.warnAt': {
+        readonly checks: readonly ['fidelity'];
+        readonly questions: null;
+        readonly goal: 'precision';
+        readonly at: 0.6;
+    };
+    readonly 'fidelity.blockAt': {
+        readonly checks: readonly ['fidelity'];
+        readonly questions: null;
+        readonly goal: 'precision';
+        readonly at: 0.95;
+    };
+    readonly 'states.blockAt': {
+        readonly checks: readonly ['states'];
+        readonly questions: null;
+        readonly goal: 'precision';
+        readonly at: 0.95;
+    };
+    readonly 'contacts.privateAt': {
+        readonly checks: readonly ['contacts'];
+        readonly questions: null;
+        readonly goal: 'recall';
+        readonly at: 0.95;
+    };
+    readonly 'skillHint.fitsAt': {
+        readonly checks: readonly ['skillHint'];
+        readonly questions: RegExp;
+        readonly goal: 'precision';
+        readonly at: 0.8;
+    };
+    readonly 'visual.warnAt': {
+        readonly checks: readonly ['visual'];
+        readonly questions: null;
+        readonly goal: 'precision';
+        readonly at: 0.6;
+    };
+};
+export declare function rates(points: Point[], t: number): {
+    precision: number;
+    recall: number;
+};
+/** The threshold that meets the goal, or null when the labels cannot support one. */
+export declare function suggestThreshold(points: Point[], goal: 'precision' | 'recall', at: number): number | null;
+type Current = Record<string, Record<string, unknown>>;
+export type Row = {
+    threshold: string;
+    current: unknown;
+    suggested: number | null;
+    labelled: number;
+    positives: number;
+    reason: string;
+};
+/** One row per threshold: what it is, what the labels suggest, and why. */
+export declare function report(judged: Entry[], truth: Map<string, boolean>, current: Current): Row[];
+export declare function main({ flags }: Args<typeof spec>): {
+    labelled: number;
+} | {
+    judgments: {
+        id: string;
+        check: string;
+        question: string;
+        subject: string;
+        p: number | undefined;
+        excerpt: string | undefined;
+    }[];
+    labelled?: undefined;
+    thresholds?: undefined;
+    written?: undefined;
+} | {
+    judgments: number;
+    labelled: number;
+    thresholds: Row[];
+    written: boolean;
+};
+export {};

package/dist/scripts/calibrate.js

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+/// <reference types="node" />
+// Every Jev judgment lands in .design-hub/jev.jsonl with an id. A person
+// labels some; this turns the labels into thresholds, so a check blocks only
+// where the data says it is right. A threshold moves only with enough
+// labels behind it; otherwise it stays as it is and the report says why.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { DEFAULT_CHECKS, validateChecks } from '../core/checks.js';
+import { CHECKS_FILE } from '../server/paths.js';
+import { CliError } from './lib/cli.js';
+import { appendJsonl, JEV_LOG, LABELS } from './lib/judge.js';
+export const spec = {
+    name: 'calibrate',
+    summary: 'Label logged Jev judgments and derive the checks.json thresholds from the labels.',
+    flags: {
+        yes: { type: 'list', description: 'A judgment id that was right to flag: the rule really was broken.' },
+        no: { type: 'list', description: 'A judgment id that should not have flagged.' },
+        unlabeled: { type: 'boolean', description: 'List judgments without a label, newest first.' },
+        limit: { type: 'number', default: 20, description: 'How many --unlabeled to list.' },
+        write: { type: 'boolean', description: 'Write the suggested thresholds into checks.json.' },
+    },
+    output: '{ ok, thresholds: [{ threshold, current, suggested, labelled, positives, reason }] } or { judgments }',
+};
+export const MIN_LABELS = 20;
+export const MIN_POSITIVES = 5;
+const CANDIDATES = Array.from({ length: 19 }, (_, i) => Math.round((0.05 + i * 0.05) * 100) / 100);
+/**
+ * What each threshold is for decides how it is chosen. A block must be right
+ * almost every time it fires (precision). A warning may be wrong more often.
+ * The private-contact threshold must miss almost nothing (recall), because a
+ * miss puts a person's details behind a forwarded link.
+ */
+export const TARGETS = {
+    'fidelity.warnAt': { checks: ['fidelity'], questions: null, goal: 'precision', at: 0.6 },
+    'fidelity.blockAt': { checks: ['fidelity'], questions: null, goal: 'precision', at: 0.95 },
+    'states.blockAt': { checks: ['states'], questions: null, goal: 'precision', at: 0.95 },
+    'contacts.privateAt': { checks: ['contacts'], questions: null, goal: 'recall', at: 0.95 },
+    'skillHint.fitsAt': { checks: ['skillHint'], questions: /^fits:/, goal: 'precision', at: 0.8 },
+    'visual.warnAt': { checks: ['visual'], questions: null, goal: 'precision', at: 0.6 },
+};
+export function rates(points, t) {
+    const flagged = points.filter((x) => x.p >= t);
+    const positives = points.filter((x) => x.truth);
+    const hits = flagged.filter((x) => x.truth).length;
+    return {
+        precision: flagged.length ? hits / flagged.length : 1,
+        recall: positives.length ? hits / positives.length : 1,
+    };
+}
+/** The threshold that meets the goal, or null when the labels cannot support one. */
+export function suggestThreshold(points, goal, at) {
+    if (points.length < MIN_LABELS || points.filter((x) => x.truth).length < MIN_POSITIVES)
+        return null;
+    // Precision: the lowest threshold that is precise enough, so the check fires as often as it can.
+    // Recall: the highest threshold that still catches enough, so it stops as little as it can.
+    const ok = CANDIDATES.filter((t) => rates(points, t)[goal] >= at);
+    if (!ok.length)
+        return null;
+    return goal === 'precision' ? Math.min(...ok) : Math.max(...ok);
+}
+const readJsonl = (file) => existsSync(file)
+    ? readFileSync(file, 'utf8')
+        .split('\n')
+        .filter(Boolean)
+        .flatMap((l) => {
+        try {
+            return [JSON.parse(l)];
+        }
+        catch {
+            // A line cut short when a process died mid-append; the rest of the log still counts.
+            return [];
+        }
+    })
+    : [];
+function labels() {
+    // The last label for an id wins, so a mistake is fixed by labelling again.
+    const out = new Map();
+    for (const l of readJsonl(LABELS))
+        out.set(l.id, l.truth);
+    return out;
+}
+function reason(target, points, suggested) {
+    const positives = points.filter((x) => x.truth).length;
+    if (suggested !== null)
+        return `${target.goal === 'recall' ? 'highest' : 'lowest'} threshold with ${target.goal} ≥ ${target.at}`;
+    if (points.length < MIN_LABELS || positives < MIN_POSITIVES)
+        return `needs ${MIN_LABELS} labels with ${MIN_POSITIVES} yes; has ${points.length} with ${positives}`;
+    return `no threshold reaches ${target.goal} ${target.at}`;
+}
+/** One row per threshold: what it is, what the labels suggest, and why. */
+export function report(judged, truth, current) {
+    return Object.entries(TARGETS).map(([path, target]) => {
+        const points = judged
+            .filter((e) => target.checks.includes(e.check))
+            .filter((e) => !target.questions || target.questions.test(e.question))
+            .flatMap((e) => (truth.has(e.id) ? [{ p: e.p, truth: truth.get(e.id) === true }] : []));
+        const [group, key] = path.split('.');
+        const suggested = suggestThreshold(points, target.goal, target.at);
+        return {
+            threshold: path,
+            current: current[group]?.[key] ?? null,
+            suggested,
+            labelled: points.length,
+            positives: points.filter((x) => x.truth).length,
+            reason: reason(target, points, suggested),
+        };
+    });
+}
+function label(marks, known) {
+    const unknown = marks.filter(([id]) => !known.has(id)).map(([id]) => id);
+    if (unknown.length)
+        throw new CliError('No judgment has these ids.', { unknown, fix: 'design-hub calibrate --unlabeled' });
+    for (const [id, truth] of marks)
+        appendJsonl(LABELS, { id, truth, at: new Date().toISOString() });
+    return { labelled: marks.length };
+}
+function write(current, rows) {
+    for (const { threshold, suggested } of rows) {
+        if (suggested === null)
+            continue;
+        const [group, key] = threshold.split('.');
+        current[group] = { ...current[group], [key]: suggested };
+    }
+    const problems = validateChecks(current);
+    if (problems.length)
+        throw new CliError('The result would not validate; checks.json is unchanged.', { problems });
+    mkdirSync(dirname(CHECKS_FILE), { recursive: true });
+    writeFileSync(CHECKS_FILE, `${JSON.stringify(current, null, 2)}\n`);
+}
+/** The project's checks.json as written, or the defaults when the project has none yet. */
+const currentChecks = () => existsSync(CHECKS_FILE)
+    ? JSON.parse(readFileSync(CHECKS_FILE, 'utf8'))
+    : JSON.parse(JSON.stringify(DEFAULT_CHECKS));
+export function main({ flags }) {
+    const judged = readJsonl(JEV_LOG).filter((e) => e.id && typeof e.p === 'number');
+    const marks = [
+        ...flags.yes.map((id) => [id, true]),
+        ...flags.no.map((id) => [id, false]),
+    ];
+    if (marks.length)
+        return label(marks, new Set(judged.map((e) => e.id)));
+    const truth = labels();
+    if (flags.unlabeled)
+        return {
+            judgments: judged
+                .filter((e) => !truth.has(e.id))
+                .reverse()
+                .slice(0, flags.limit)
+                .map(({ id, check, question, subject, p, excerpt }) => ({
+                id,
+                check,
+                question,
+                subject,
+                p,
+                excerpt,
+            })),
+        };
+    const current = currentChecks();
+    const thresholds = report(judged, truth, current);
+    if (flags.write)
+        write(current, thresholds);
+    return { judgments: judged.length, labelled: truth.size, thresholds, written: flags.write };
+}

package/dist/scripts/check.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import type { Args } from './lib/cli.ts';
+export declare const spec: {
+    readonly name: 'check';
+    readonly summary: 'TypeScript and Biome over the project. Must pass before a change is done.';
+    readonly flags: {
+        readonly fix: {
+            readonly type: 'boolean';
+            readonly description: 'Let Biome format and apply its safe fixes first.';
+        };
+    };
+    readonly output: '{ ok, types: { ok, output? }, lint: { ok, output? } }';
+};
+type Run = {
+    ok: boolean;
+    output?: string;
+};
+export declare const typecheck: () => Run;
+export declare function lint(fix: boolean): Run;
+export declare function main({ flags }: Args<typeof spec>): {
+    ok: boolean;
+    types: Run;
+    lint: Run;
+};
+export {};

package/dist/scripts/check.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+/// <reference types="node" />
+// `design-hub check`: TypeScript over the project, then Biome. Both binaries
+// come with this package, so a project installs neither; Biome runs on the
+// package's config, so every project is checked the same way.
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+import { PACKAGE, ROOT } from '../server/paths.js';
+import { biomeBin, tscBin } from './lib/bin.js';
+export const spec = {
+    name: 'check',
+    summary: 'TypeScript and Biome over the project. Must pass before a change is done.',
+    flags: { fix: { type: 'boolean', description: 'Let Biome format and apply its safe fixes first.' } },
+    output: '{ ok, types: { ok, output? }, lint: { ok, output? } }',
+};
+const BIOME_CONFIG = join(PACKAGE, 'configs', 'biome');
+function node(script, args) {
+    const out = spawnSync(process.execPath, [script, ...args], { cwd: ROOT, encoding: 'utf8' });
+    const output = `${out.stdout}${out.stderr}`.trim();
+    return out.status === 0 ? { ok: true } : { ok: false, output: output.split('\n').slice(-40).join('\n') };
+}
+export const typecheck = () => node(tscBin(), ['--noEmit', '-p', ROOT]);
+export function lint(fix) {
+    return node(biomeBin(), ['check', ...(fix ? ['--write'] : []), '--config-path', BIOME_CONFIG, ROOT]);
+}
+export function main({ flags }) {
+    const lintRun = lint(flags.fix);
+    const types = typecheck();
+    return { ok: types.ok && lintRun.ok, types, lint: lintRun };
+}

package/dist/scripts/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function cli([name, ...rest]: string[]): Promise<void>;