@nanobpm/nano-workforce 0.35.2 → 0.37.0

package/app/service.ts

@@ -8,6 +8,7 @@
 // Data access goes through the record-oriented gateway (`data.table<T>(name, pk)` — the RAD
 // `Table<T>` surface), not hand-written SQL. Row shapes are declared inline here.
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
+import { abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
 import {
   classifyMergeability,
   ensureFreshHeadRun,
@@ -18,13 +19,12 @@ import {
   type MergeMethod,
   requestCopilotReview,
 } from "./github.ts";
-import { planTaskDeps, planTasks, plans } from "./plan.ts";
-import { abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
+import { mergeLanes, readExclusions } from "./mergeExclusion.ts";
 import { freshHeadRunAction, loadMergeProtocol } from "./mergeProtocol.ts";
+import { type PrLaneDecision, planPrLane, taskDependencyDepths } from "./mergeTrain.ts";
+import { plans, planTaskDeps, planTasks } from "./plan.ts";
 import { clampNudgeMinutes, reviewWaitTimeout } from "./reviewWait.ts";
 import { waveMergeTargets } from "./waves.ts";
-import { mergeLanes, readExclusions } from "./mergeExclusion.ts";
-import { planPrLane, type PrLaneDecision, taskDependencyDepths } from "./mergeTrain.ts";
 
 /** The BPMN process that drives review convergence (`resources/processes/convergence-loop.bpmn`). */
 export const PROCESS_ID = "convergence-loop";
@@ -34,10 +34,12 @@ export const MERGE_PROCESS_ID = "merge-loop";
  * in convergence-loop.bpmn). Deliberately NOT hosted here — an external harness services it; the
  * activation poll keys off it to tell "agent working" from "queued". */
 const REVIEW_JOB_TYPE = "senior:pr-review";
+
 /** Default round cap before the loop escalates to a human. A per-submit override (submit form /
  * webhook / start action) takes precedence; this env var sets the fleet-wide default. The cap
  * coercion + ceiling live in the pure `./rounds.ts` module (re-exported for callers). */
 export { clampCiFixBudget, clampRounds, MAX_CI_FIX_CEILING, MAX_ROUNDS_CEILING } from "./rounds.ts";
+
 import { clampCiFixBudget, clampRounds } from "./rounds.ts";
 export const MAX_ROUNDS = clampRounds(process.env.NANO_PR_MAX_ROUNDS, 20);
 
@@ -830,6 +832,7 @@ async function pollJobActivation(
         }),
       });
       if (!res.ok) continue; // engine unhappy → keep last-known, retry next pass
+      // biome-ignore lint/plugin: runtime/framework contract boundary for external data shape
       const body = (await res.json()) as { items?: JobSearchItem[] };
       // An open job with a leasing worker means an agent has activated it. Prefer the one with
       // the latest deadline if several are open (there is normally at most one).
@@ -929,6 +932,7 @@ export async function pollIncidentsImpl(
         }),
       });
       if (!res.ok) continue; // engine unhappy → keep last-known, retry next pass
+      // biome-ignore lint/plugin: runtime/framework contract boundary for external data shape
       const body = (await res.json()) as { items?: IncidentSearchItem[] };
       // Surface the oldest ACTIVE incident (the first thing that broke — a stable choice if the
       // instance somehow parks more than one). Re-filter on state defensively in case the wire

package/app/taskDelta.test.ts

@@ -1,5 +1,6 @@
 // Unit tests for the structured scope/impl-change report (D5, issue #55 / #49).
-import { assert, assertEquals } from "jsr:@std/assert@1";
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
 import {
   aggregateEpicDeltas,
@@ -11,49 +12,39 @@ import {
 
 // A tiny in-memory stand-in for the record gateway (insert/find/findOne/update/delete), mirroring
 // the fake-app style used across the app tests (see app/blackboard.test.ts).
-// deno-lint-ignore no-explicit-any
 function memData(): { data: DataLayer; stores: Record<string, any[]> } {
-  // deno-lint-ignore no-explicit-any
   const stores: Record<string, any[]> = {};
   const seq: Record<string, number> = {};
   function tbl(name: string, pk = "id") {
-    // deno-lint-ignore no-explicit-any
     const rows = (stores[name] ??= [] as any[]);
-    // deno-lint-ignore no-explicit-any
     const match = (r: any, where: any) => Object.entries(where).every(([k, v]) => r[k] === v);
     return {
-      // deno-lint-ignore no-explicit-any require-await
       async insert(row: any) {
         const id = (seq[name] = (seq[name] ?? 0) + 1);
         rows.push(pk === "id" ? { id, ...row } : { ...row });
         return pk === "id" ? id : row[pk];
       },
-      // deno-lint-ignore no-explicit-any require-await
       async find(where: any = {}) {
         return rows.filter((r) => match(r, where));
       },
-      // deno-lint-ignore no-explicit-any require-await
       async findOne(where: any = {}) {
         return rows.find((r) => match(r, where));
       },
-      // deno-lint-ignore no-explicit-any require-await
       async update(id: any, patch: any) {
         const r = rows.find((row) => row[pk] === id);
         if (r) Object.assign(r, patch);
       },
-      // deno-lint-ignore no-explicit-any require-await
       async delete(id: any) {
         const i = rows.findIndex((row) => row[pk] === id);
         if (i >= 0) rows.splice(i, 1);
       },
     };
   }
-  // deno-lint-ignore no-explicit-any
   const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
   return { data, stores };
 }
 
-Deno.test("parseTaskDelta: trims, dedupes arrays, and drops empties", () => {
+test("parseTaskDelta: trims, dedupes arrays, and drops empties", () => {
   const d = parseTaskDelta({
     contractChange: "  new signature  ",
     newlyTouches: ["a.rs", " a.rs ", "", "b.rs"],
@@ -67,14 +58,14 @@ Deno.test("parseTaskDelta: trims, dedupes arrays, and drops empties", () => {
   assertEquals(d.constraint, undefined, "a blank constraint is dropped");
 });
 
-Deno.test("parseTaskDelta: a delta with nothing actionable is null", () => {
+test("parseTaskDelta: a delta with nothing actionable is null", () => {
   assertEquals(parseTaskDelta(undefined), null);
   assertEquals(parseTaskDelta({}), null);
   assertEquals(parseTaskDelta({ newlyTouches: [], affectsTasks: [], contractChange: "  " }), null);
   assertEquals(parseTaskDelta("not an object"), null);
 });
 
-Deno.test("recordTaskDelta: upserts per (plan, task) — a resume overwrites, not duplicates", async () => {
+test("recordTaskDelta: upserts per (plan, task) — a resume overwrites, not duplicates", async () => {
   const { data, stores } = memData();
   const first = await recordTaskDelta(data, "o/r#1", "gap-2", {
     newlyTouches: ["a.rs"],
@@ -99,7 +90,7 @@ Deno.test("recordTaskDelta: upserts per (plan, task) — a resume overwrites, no
   assertEquals(entry.wave, 1);
 });
 
-Deno.test("readTaskDeltas: scoped to a plan, in write order, arrays decoded", async () => {
+test("readTaskDeltas: scoped to a plan, in write order, arrays decoded", async () => {
   const { data } = memData();
   await recordTaskDelta(data, "o/r#1", "gap-2", { newlyTouches: ["a.rs"], affectsTasks: [] });
   await recordTaskDelta(data, "o/r#1", "gap-8", { newlyTouches: [], affectsTasks: ["gap-2"], constraint: "x" });
@@ -111,7 +102,7 @@ Deno.test("readTaskDeltas: scoped to a plan, in write order, arrays decoded", as
   assertEquals(entries[1].affectsTasks, ["gap-2"]);
 });
 
-Deno.test("aggregateEpicDeltas: unions touched files + affected tasks, lists changes/constraints", async () => {
+test("aggregateEpicDeltas: unions touched files + affected tasks, lists changes/constraints", async () => {
   const { data } = memData();
   await recordTaskDelta(data, "p", "gap-2", {
     newlyTouches: ["engine/state.rs"],
@@ -132,7 +123,7 @@ Deno.test("aggregateEpicDeltas: unions touched files + affected tasks, lists cha
   assertEquals(report.deltas.length, 2);
 });
 
-Deno.test("clearTaskDeltas: drops a plan's whole set (re-plan cleanup), leaving other plans intact", async () => {
+test("clearTaskDeltas: drops a plan's whole set (re-plan cleanup), leaving other plans intact", async () => {
   const { data, stores } = memData();
   await recordTaskDelta(data, "p", "gap-2", { newlyTouches: ["a.rs"], affectsTasks: [] });
   await recordTaskDelta(data, "p", "gap-8", { newlyTouches: ["b.rs"], affectsTasks: [] });

package/app/taskDelta.ts

@@ -71,6 +71,7 @@ function decodeArray(raw: string | null): string[] {
  * nothing actionable (so callers persist/broadcast only real deltas, never empty noise). */
 export function parseTaskDelta(raw: unknown): TaskDelta | null {
   if (!raw || typeof raw !== "object") return null;
+  // biome-ignore lint/plugin: runtime/framework contract boundary for external data shape
   const o = raw as Record<string, unknown>;
   const delta: TaskDelta = {
     contractChange: trimStr(o.contractChange),

package/app/trialMerge.test.ts

@@ -1,13 +1,14 @@
-import { assertEquals } from "jsr:@std/assert@1";
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
 import { shouldRunTrialMerge, trialMergeDecision } from "./trialMerge.ts";
 
-Deno.test("trialMergeDecision only escalates clean-merge suite failures", () => {
+test("trialMergeDecision only escalates clean-merge suite failures", () => {
   assertEquals(trialMergeDecision("clean"), "proceed");
   assertEquals(trialMergeDecision("merge-conflict"), "proceed");
   assertEquals(trialMergeDecision("suite-failed"), "escalate");
 });
 
-Deno.test("shouldRunTrialMerge skips lone heads and mergify queues", () => {
+test("shouldRunTrialMerge skips lone heads and mergify queues", () => {
   assertEquals(shouldRunTrialMerge(0, { land: { method: "gh-merge" } }), false);
   assertEquals(shouldRunTrialMerge(1, { land: { method: "gh-merge" } }), false);
   assertEquals(shouldRunTrialMerge(2, { land: { method: "mergify-queue" } }), false);

package/app/version.ts

@@ -5,14 +5,14 @@
 // inspecting the working tree at runtime. This module gathers that identity — the app's package
 // version, the resolved `@nanobpm/urban` version, the git commit (read from `.git`, handling both
 // an ordinary `.git` directory and the `gitdir:` file pointer used by worktrees/submodules, with
-// an env override for detached deploys), plus the Node/Deno runtime, pid and start time — so an operator
+// an env override for detached deploys), plus the Node runtime, pid and start time — so an operator
 // debugging a stuck instance can confirm the process is on the code they think it is.
 //
 // Every probe is best-effort: a missing file or unavailable `.git` yields `null` for that field
 // rather than throwing, so `/app/api/version` never fails just because one source is absent.
 import { readFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { dirname, join, resolve, isAbsolute } from "node:path";
 
 // Captured once, at module load — i.e. when the running process booted this code.
 const STARTED_AT = new Date();
@@ -31,6 +31,7 @@ function readJson(path: string): Record<string, unknown> | null {
   const text = readText(path);
   if (text == null) return null;
   try {
+    // biome-ignore lint/plugin: runtime/framework contract boundary for external data shape
     return JSON.parse(text) as Record<string, unknown>;
   } catch {
     return null;
@@ -38,19 +39,11 @@ function readJson(path: string): Record<string, unknown> | null {
 }
 
 /**
- * Read an env var across runtimes: Node exposes `process.env`; Deno may not populate it, so fall
- * back to `Deno.env.get` (guarded — reading env can throw without `--allow-env`).
+ * Read an env var from `process.env`, trimmed; returns null when unset or blank.
  */
 export function envVar(name: string): string | null {
-  const fromProcess = globalThis.process?.env?.[name];
+  const fromProcess = process.env[name];
   if (typeof fromProcess === "string" && fromProcess.trim()) return fromProcess.trim();
-  const deno = (globalThis as { Deno?: { env?: { get?(k: string): string | undefined } } }).Deno;
-  try {
-    const fromDeno = deno?.env?.get?.(name);
-    if (typeof fromDeno === "string" && fromDeno.trim()) return fromDeno.trim();
-  } catch {
-    // Env access denied — treat as unset.
-  }
   return null;
 }
 
@@ -129,7 +122,7 @@ function gitSha(): string | null {
   const refPath = ref.slice(4).trim(); // e.g. "refs/heads/main"
   // A loose ref may live in the per-worktree dir or the common dir; check both.
   const loose = readText(join(dirs.gitDir, refPath)) ?? readText(join(dirs.commonDir, refPath));
-  if (loose != null && loose.trim()) return loose.trim();
+  if (loose?.trim()) return loose.trim();
 
   // Packed refs fallback (always in the common dir): lines of "<sha> <refname>".
   const packed = readText(join(dirs.commonDir, "packed-refs"));
@@ -157,12 +150,8 @@ function gitBranch(): string | null {
 }
 
 function runtime(): string {
-  const proc = globalThis.process;
-  // Deno exposes `Deno.version.deno`; Node exposes `process.version` (e.g. "v24.15.0").
-  const deno = (globalThis as { Deno?: { version?: { deno?: string } } }).Deno;
-  if (deno?.version?.deno) return `deno ${deno.version.deno}`;
-  if (proc?.version) return `node ${proc.version}`;
-  return "unknown";
+  // Node exposes `process.version` (e.g. "v24.15.0").
+  return process.version ? `node ${process.version}` : "unknown";
 }
 
 export interface VersionInfo {
@@ -182,7 +171,6 @@ export interface VersionInfo {
  * tree ONCE at module load rather than re-reading files (`.git`, package.jsons) on every request.
  */
 const STATIC: Omit<VersionInfo, "uptimeSeconds"> = (() => {
-  const proc = globalThis.process;
   const pkg = appPackage();
   return Object.freeze({
     name: appName(pkg),
@@ -191,7 +179,7 @@ const STATIC: Omit<VersionInfo, "uptimeSeconds"> = (() => {
     gitSha: gitSha(),
     gitBranch: gitBranch(),
     runtime: runtime(),
-    pid: typeof proc?.pid === "number" ? proc.pid : null,
+    pid: typeof process.pid === "number" ? process.pid : null,
     startedAt: STARTED_AT.toISOString(),
   });
 })();

package/app/waves.test.ts

@@ -1,20 +1,21 @@
-// Red/green regression for the plan levelizer (issue #20). Run with `deno test`.
+// Red/green regression for the plan levelizer (issue #20). Run with `node --test`.
 //
-// One `Deno.test` = one named property of computeWaves. These encode the wave
+// One `test` = one named property of computeWaves. These encode the wave
 // contract: independent tasks share wave 0 (all-parallel), a chain steps 0,1,2…
 // (all-sequential), a diamond re-converges, and a malformed graph is rejected
 // rather than silently mis-levelized.
-import { assertEquals, assertThrows } from "jsr:@std/assert@1";
+import { test } from "node:test";
+import { assertEquals, assertThrows } from "#test-assert";
 import { computeWaves, WaveError, type WaveGateTask, type WaveTask, waveMergeTargets } from "./waves.ts";
 
-Deno.test("no dependencies → every task in wave 0 (fully parallel)", () => {
+test("no dependencies → every task in wave 0 (fully parallel)", () => {
   const tasks: WaveTask[] = [{ id: "a" }, { id: "b" }, { id: "c" }];
   const { waves, waveCount } = computeWaves(tasks);
   assertEquals(waveCount, 1);
   assertEquals(waves, [["a", "b", "c"]]);
 });
 
-Deno.test("linear chain → one task per wave (fully sequential)", () => {
+test("linear chain → one task per wave (fully sequential)", () => {
   const tasks: WaveTask[] = [
     { id: "a" },
     { id: "b", dependsOn: ["a"] },
@@ -26,7 +27,7 @@ Deno.test("linear chain → one task per wave (fully sequential)", () => {
   assertEquals([waveOf.get("a"), waveOf.get("b"), waveOf.get("c")], [0, 1, 2]);
 });
 
-Deno.test("diamond → longest-path level; join waits for both arms", () => {
+test("diamond → longest-path level; join waits for both arms", () => {
   const tasks: WaveTask[] = [
     { id: "a" },
     { id: "b", dependsOn: ["a"] },
@@ -38,7 +39,7 @@ Deno.test("diamond → longest-path level; join waits for both arms", () => {
   assertEquals(waves, [["a"], ["b", "c"], ["d"]]);
 });
 
-Deno.test("mixed graph → level is 1 + max(dep level), not 1 + min", () => {
+test("mixed graph → level is 1 + max(dep level), not 1 + min", () => {
   // e depends on a (wave 0) and d (wave 2) → must land in wave 3, behind the deeper dep.
   const tasks: WaveTask[] = [
     { id: "a" },
@@ -52,20 +53,20 @@ Deno.test("mixed graph → level is 1 + max(dep level), not 1 + min", () => {
   assertEquals(waveOf.get("e"), 4);
 });
 
-Deno.test("empty plan → zero waves", () => {
+test("empty plan → zero waves", () => {
   const { waves, waveCount } = computeWaves([]);
   assertEquals(waveCount, 0);
   assertEquals(waves, []);
 });
 
-Deno.test("blank / whitespace dependsOn entries are ignored", () => {
+test("blank / whitespace dependsOn entries are ignored", () => {
   const tasks: WaveTask[] = [{ id: "a", dependsOn: ["", "  "] }];
   const { waves, waveCount } = computeWaves(tasks);
   assertEquals(waveCount, 1);
   assertEquals(waves, [["a"]]);
 });
 
-Deno.test("dependency cycle → WaveError", () => {
+test("dependency cycle → WaveError", () => {
   const tasks: WaveTask[] = [
     { id: "a", dependsOn: ["b"] },
     { id: "b", dependsOn: ["a"] },
@@ -73,11 +74,11 @@ Deno.test("dependency cycle → WaveError", () => {
   assertThrows(() => computeWaves(tasks), WaveError, "cycle");
 });
 
-Deno.test("self-dependency → WaveError", () => {
+test("self-dependency → WaveError", () => {
   assertThrows(() => computeWaves([{ id: "a", dependsOn: ["a"] }]), WaveError, "itself");
 });
 
-Deno.test("unknown dependency id → WaveError", () => {
+test("unknown dependency id → WaveError", () => {
   assertThrows(
     () => computeWaves([{ id: "a", dependsOn: ["ghost"] }]),
     WaveError,
@@ -85,7 +86,7 @@ Deno.test("unknown dependency id → WaveError", () => {
   );
 });
 
-Deno.test("duplicate task id → WaveError", () => {
+test("duplicate task id → WaveError", () => {
   assertThrows(
     () => computeWaves([{ id: "a" }, { id: "a" }]),
     WaveError,
@@ -98,7 +99,7 @@ Deno.test("duplicate task id → WaveError", () => {
 // opened/waiting-with-a-PR tasks of the gate wave, ignore other waves, and treat blocked/skipped
 // and keyless tasks as nothing-to-wait-on so no non-mergeable PR state can wedge the barrier.
 
-Deno.test("waveMergeTargets → only opened PRs of the gate wave", () => {
+test("waveMergeTargets → only opened PRs of the gate wave", () => {
   const tasks: WaveGateTask[] = [
     { wave: 0, status: "opened", pr_key: "o/r#1" },
     { wave: 0, status: "opened", pr_key: "o/r#2" },
@@ -107,7 +108,7 @@ Deno.test("waveMergeTargets → only opened PRs of the gate wave", () => {
   assertEquals(waveMergeTargets(tasks, 0), ["o/r#1", "o/r#2"]);
 });
 
-Deno.test("waveMergeTargets → mergeable waiting tasks are waited on; failed/keyless tasks are not", () => {
+test("waveMergeTargets → mergeable waiting tasks are waited on; failed/keyless tasks are not", () => {
   const tasks: WaveGateTask[] = [
     { wave: 0, status: "opened", pr_key: "o/r#1" },
     { wave: 0, status: "blocked", pr_key: null },
@@ -119,7 +120,7 @@ Deno.test("waveMergeTargets → mergeable waiting tasks are waited on; failed/ke
   assertEquals(waveMergeTargets(tasks, 0), ["o/r#1", "o/r#2"]);
 });
 
-Deno.test("waveMergeTargets → a wave with no opened PRs clears vacuously (empty)", () => {
+test("waveMergeTargets → a wave with no opened PRs clears vacuously (empty)", () => {
   const tasks: WaveGateTask[] = [
     { wave: 0, status: "blocked", pr_key: null },
     { wave: 0, status: "skipped", pr_key: null },

package/biome.json

@@ -0,0 +1,143 @@
+{
+  "$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
+  "files": {
+    "includes": [
+      "app/**/*.ts",
+      "operations/**/*.ts",
+      "actions/**/*.ts",
+      "workers/**/*.ts",
+      "pages/**/*.ts",
+      "components/**/*.ts",
+      "scripts/**/*.ts",
+      "main.ts",
+      "!**/*.test.ts",
+      "!nano-generated/**",
+      "!node_modules/**"
+    ]
+  },
+  "linter": {
+    "enabled": true,
+    "includes": [
+      "app/**/*.ts",
+      "operations/**/*.ts",
+      "actions/**/*.ts",
+      "workers/**/*.ts",
+      "pages/**/*.ts",
+      "components/**/*.ts",
+      "scripts/**/*.ts",
+      "main.ts",
+      "!**/*.test.ts",
+      "!nano-generated/**",
+      "!node_modules/**"
+    ],
+    "rules": {
+      "recommended": true,
+      "complexity": {
+        "noAdjacentSpacesInRegex": "error",
+        "noArguments": "error",
+        "noBannedTypes": "error",
+        "noCommaOperator": "error",
+        "noEmptyTypeParameters": "error",
+        "noExtraBooleanCast": "error",
+        "noFlatMapIdentity": "error",
+        "noImportantStyles": "error",
+        "noStaticOnlyClass": "error",
+        "noThisInStatic": "error",
+        "noUselessCatch": "error",
+        "noUselessConstructor": "error",
+        "noUselessContinue": "error",
+        "noUselessEmptyExport": "error",
+        "noUselessEscapeInRegex": "error",
+        "noUselessFragments": "error",
+        "noUselessLabel": "error",
+        "noUselessLoneBlockStatements": "error",
+        "noUselessRename": "error",
+        "noUselessStringRaw": "error",
+        "noUselessSwitchCase": "error",
+        "noUselessTernary": "error",
+        "noUselessThisAlias": "error",
+        "noUselessTypeConstraint": "error",
+        "noUselessUndefinedInitialization": "error",
+        "useArrowFunction": "error",
+        "useDateNow": "error",
+        "useFlatMap": "error",
+        "useIndexOf": "error",
+        "useLiteralKeys": "error",
+        "useNumericLiterals": "error",
+        "useOptionalChain": "error",
+        "useRegexLiterals": "error",
+        "useSimpleNumberKeys": "error"
+      },
+      "correctness": {
+        "noUnusedFunctionParameters": "error",
+        "noUnusedImports": "error",
+        "noUnusedLabels": "error",
+        "noUnusedPrivateClassMembers": "error",
+        "noUnusedVariables": "error",
+        "useParseIntRadix": "error"
+      },
+      "performance": {
+        "noAccumulatingSpread": "error",
+        "noDynamicNamespaceImportAccess": "error"
+      },
+      "style": {
+        "noDescendingSpecificity": "error",
+        "noNonNullAssertion": "error",
+        "useArrayLiterals": "error",
+        "useConst": "error",
+        "useDeprecatedReason": "error",
+        "useExponentiationOperator": "error",
+        "useExportType": "error",
+        "useImportType": "error",
+        "useLiteralEnumMembers": "error",
+        "useNodejsImportProtocol": "error",
+        "useShorthandFunctionType": "error",
+        "useTemplate": "error"
+      },
+      "suspicious": {
+        "noApproximativeNumericConstant": "error",
+        "noCatchAssign": "error",
+        "noConfusingLabels": "error",
+        "noConfusingVoidType": "error",
+        "noConstEnum": "error",
+        "noDocumentCookie": "error",
+        "noDuplicateFields": "error",
+        "noEmptyBlock": "error",
+        "noEvolvingTypes": "error",
+        "noExplicitAny": "error",
+        "noExtraNonNullAssertion": "error",
+        "noGlobalIsFinite": "error",
+        "noGlobalIsNan": "error",
+        "noImplicitAnyLet": "error",
+        "noIrregularWhitespace": "error",
+        "noOctalEscape": "error",
+        "noPrototypeBuiltins": "error",
+        "noQuickfixBiome": "error",
+        "noRedundantUseStrict": "error",
+        "noSuspiciousSemicolonInJsx": "error",
+        "noTemplateCurlyInString": "error",
+        "noTsIgnore": "error",
+        "noUselessEscapeInString": "error",
+        "noUselessRegexBackrefs": "error",
+        "useAdjacentOverloadSignatures": "error",
+        "useBiomeIgnoreFolder": "error",
+        "useDefaultSwitchClauseLast": "error",
+        "useGoogleFontDisplay": "error",
+        "useIsArray": "error"
+      }
+    },
+    "domains": {
+      "react": "none",
+      "solid": "none",
+      "next": "none",
+      "qwik": "none",
+      "vue": "none"
+    }
+  },
+  "plugins": [
+    "./plugins/no-unsafe-type-assertion.grit"
+  ],
+  "formatter": {
+    "enabled": false
+  }
+}

package/operations/getVersion.test.ts

@@ -1,11 +1,11 @@
 // Tests for GET /app/api/version → operation `getVersion` (ADR 0058 OpenAPI surface).
 // Ported from the previous actions/version.test.ts. Method handling now belongs to the router
 // (only GET is routed here), so there is no 405 case to test at the delegate level.
-import { assert, assertEquals } from "jsr:@std/assert@1";
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import handler from "./getVersion.ts";
 
-// deno-lint-ignore no-explicit-any
 const app = {} as any as AppApi;
 
 function input(headers: Record<string, string> = {}) {
@@ -16,7 +16,6 @@ function input(headers: Record<string, string> = {}) {
       query: new URLSearchParams(),
       headers: new Headers(headers),
       text: async () => "",
-      // deno-lint-ignore no-explicit-any
     } as any,
     params: {},
     query: {},
@@ -24,9 +23,8 @@ function input(headers: Record<string, string> = {}) {
   };
 }
 
-Deno.test("returns 200 with the app identity", async () => {
+test("returns 200 with the app identity", async () => {
   const res = await handler(input(), app);
-  // deno-lint-ignore no-explicit-any
   const r = res as any;
   assertEquals(r.status, 200);
   assertEquals(r.body.name, "nano-workforce");
@@ -40,21 +38,19 @@ Deno.test("returns 200 with the app identity", async () => {
   assert(typeof r.body.uptimeSeconds === "number");
 });
 
-Deno.test("shared-secret guard rejects a missing/wrong secret when configured", async () => {
-  const prev = Deno.env.get("NANO_PR_WEBHOOK_SECRET");
-  Deno.env.set("NANO_PR_WEBHOOK_SECRET", "s3cr3t");
+test("shared-secret guard rejects a missing/wrong secret when configured", async () => {
+  const prev = process.env["NANO_PR_WEBHOOK_SECRET"];
+  process.env["NANO_PR_WEBHOOK_SECRET"] = "s3cr3t";
   try {
     // SECRET is bound at import time, so import a cache-busted copy to observe the guard.
     const mod = await import(`./getVersion.ts?guard=${Date.now()}`);
     const guarded = mod.default as typeof handler;
-    // deno-lint-ignore no-explicit-any
     const bad = (await guarded(input(), app)) as any;
     assertEquals(bad.status, 401);
-    // deno-lint-ignore no-explicit-any
     const ok = (await guarded(input({ "x-hook-secret": "s3cr3t" }), app)) as any;
     assertEquals(ok.status, 200);
   } finally {
-    if (prev === undefined) Deno.env.delete("NANO_PR_WEBHOOK_SECRET");
-    else Deno.env.set("NANO_PR_WEBHOOK_SECRET", prev);
+    if (prev === undefined) delete process.env["NANO_PR_WEBHOOK_SECRET"];
+    else process.env["NANO_PR_WEBHOOK_SECRET"] = prev;
   }
 });

package/operations/getVersion.ts

@@ -9,9 +9,8 @@
 import { defineOperation } from "@nanobpm/urban";
 import { buildVersionInfo, envVar, type VersionInfo } from "../app/version.ts";
 
-// Cross-runtime env read (Node `process.env` OR Deno `Deno.env`): reading via `process.env` alone
-// would silently disable the guard under Deno/compiled runtimes where `process` is absent, leaving
-// the endpoint open even when NANO_PR_WEBHOOK_SECRET is set. Captured once, at module load.
+// The optional shared-secret guard: when NANO_PR_WEBHOOK_SECRET is set, callers must present it via
+// the x-hook-secret header. Captured once, at module load.
 const SECRET = envVar("NANO_PR_WEBHOOK_SECRET") ?? "";
 
 export default defineOperation<