@rtorcato/repo-tooling 3.15.2 → 3.16.0

package/AGENTS.md

@@ -14,7 +14,7 @@ Every command supports `--json` and a non-interactive mode. Combine with `--yes`
 
 | Command | Non-interactive | JSON output | Use case |
 |---|---|---|---|
-| `setup --preset <name>` | ✅ | `--dry-run` only | Scaffold a new project. Presets: `library`, `web-app`, `node-api`, `nextjs-app`, `react-app`, `swift-library`. |
+| `setup --preset <name>` | ✅ (non-TTY, or with `--yes`) | `--dry-run` only | Scaffold a new project. Presets: `minimal`, `library`, `web-app`, `node-api`, `nextjs-app`, `react-app`, `swift-library`. In an interactive terminal it first prints the file list and lets you deselect; pass `--yes` for the one-shot behaviour. |
 | `setup --config <path>` | ✅ | `--dry-run` only | Scaffold with a full `ProjectConfig` JSON file. See `setup --config-schema`. |
 | `setup --config-schema` | ✅ | ✅ (JSON Schema) | Print the JSON Schema for `ProjectConfig`. Use to validate configs before scaffolding. |
 | `setup --dry-run` | ✅ | ✅ | Print resolved config + file list without writing. Pair with `--preset` or `--config`. |
@@ -110,7 +110,7 @@ A fixer may also **refuse** — the target file holds something the generator ca
 ## Conventions in this repo
 
 - Conventional commits enforced via commitlint; header max 100 chars, body/footer line length unenforced
-- Biome for lint + format (run via `pnpm exec biome check --config-path=tooling/biome/biome.json src scripts`)
+- Biome for lint + format (run via `pnpm run check`, i.e. `biome check .` over the whole repo — the same script this package emits to consumers)
 - Tests live alongside source in `tests/`; vitest with no separate config
 - semantic-release runs on push to `main`; `fix:` → patch, `feat:` → minor, `chore:` / `docs:` → no release
 

package/README.md

@@ -35,10 +35,16 @@ npx @rtorcato/repo-tooling setup
 Non-interactive — scaffold from a named preset in one shot (CI-friendly):
 
 ```bash
-npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install
-# presets: library | web-app | node-api | nextjs-app | react-app | swift-library
+npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install --yes
+# presets: minimal | library | web-app | node-api | nextjs-app | react-app | swift-library
 ```
 
+Run without `--yes` in a terminal and the preset first prints every file it would
+write and lets you uncheck the parts you don't want (git hooks, commitlint,
+releases, Dependabot/CodeQL, badges, AI agent rules). Piped or redirected — CI —
+it writes everything in one shot, exactly as before. `minimal` is tsconfig +
+Biome + Vitest and nothing else.
+
 `swift-library` scaffolds a SwiftPM package (manifest, sources, tests, SwiftLint,
 Periphery, macOS CI) instead of an npm one — see the
 [Swift guide](https://rtorcato.github.io/repo-tooling/guides/swift).

package/dist/base/checks.js

@@ -266,6 +266,12 @@ export async function checkDependabot(dir) {
                 if (!automerge.includes("steps.gate.outputs.safe == 'true'")) {
                     deltas.push('auto-merge workflow trusts the dev-minor group name (missing peerDependencies check)');
                 }
+                // #452: a repo that took the #423 pair has CI action bumps waiting on a
+                // human for no benefit — they reach no consumer. Drift in the
+                // convenience direction, not the safety one, but still drift.
+                if (!automerge.includes("package-ecosystem == 'github-actions'")) {
+                    deltas.push('auto-merge workflow leaves CI action bumps to a human (#452)');
+                }
             }
             else {
                 deltas.push('missing dependabot-automerge workflow');

package/dist/cli/commands/setup-presets.js

@@ -1,6 +1,7 @@
 import { swiftFileList } from '../../languages/swift/scaffold.js';
 import { BIOME_CONFIG } from '../generators/linting.js';
 export const PRESET_NAMES = [
+    'minimal',
     'library',
     'web-app',
     'node-api',
@@ -22,6 +23,33 @@ const BASE = {
 };
 export function buildPresetConfig(name, projectName) {
     switch (name) {
+        // tsconfig + biome + vitest, nothing else (#461). Deliberately not spread
+        // from BASE: BASE hardcodes git hooks, commitlint, security automation,
+        // badges and the AI agent files, and every other case only ever adds to
+        // it — so no preset built on BASE can produce a small repo.
+        //
+        // `node-api` is the only projectType that adds nothing of its own:
+        // `library` would pull in publint, attw, a size-limit budget and a
+        // dist/-rooted exports map that `bundler: 'none'` never builds, and the
+        // three app types each seed a framework. It says "plain Node package",
+        // which is what this preset scaffolds.
+        case 'minimal':
+            return {
+                projectName,
+                language: 'js',
+                projectType: 'node-api',
+                typescript: { enabled: true, config: 'base' },
+                linting: { tool: 'biome' },
+                formatting: { tool: 'biome' },
+                testing: { framework: 'vitest', environment: 'node' },
+                gitHooks: false,
+                commitLint: false,
+                semanticRelease: false,
+                securityAutomation: false,
+                bundler: 'none',
+                badges: false,
+                aiSetup: false,
+            };
         case 'library':
             return {
                 ...BASE,
@@ -208,7 +236,7 @@ export function computeFileList(config) {
     if (config.language === 'swift')
         return swiftFileList(config);
     const files = ['package.json', '.repo-tooling.json'];
-    files.push('.editorconfig', '.nvmrc', 'knip.json', '.vscode/extensions.json');
+    files.push('.editorconfig', '.nvmrc', '.gitignore', 'knip.json', '.vscode/extensions.json');
     if (config.typescript.enabled) {
         files.push('tsconfig.json', 'reset.d.ts');
     }
@@ -238,7 +266,7 @@ export function computeFileList(config) {
         files.push('cypress.config.ts', 'cypress/support/e2e.ts', 'cypress/support/commands.ts', 'tests/e2e/example.cy.ts');
     }
     if (config.gitHooks) {
-        files.push('.husky/pre-commit', '.gitignore');
+        files.push('.husky/pre-commit');
     }
     if (config.commitLint) {
         files.push('.husky/commit-msg', 'commitlint.config.mjs');

package/dist/cli/commands/setup.js

@@ -9,6 +9,60 @@ import { formatGeneratedFiles } from '../utils/format.js';
 import { installDependencies } from '../utils/install.js';
 import { LOCKFILE_NAME, writeLockfile } from '../utils/lockfile.js';
 import { buildPresetConfig, computeFileList, CONFIG_SCHEMA, PRESET_NAMES, validateProjectConfig, } from './setup-presets.js';
+/**
+ * The opinionated extras a preset turns on, in the order they're offered for
+ * review. Each one writes files (or a README block) the user never asked for by
+ * name, which is the complaint in #461.
+ */
+const REVIEWABLE_FEATURES = [
+    { key: 'gitHooks', label: 'Git hooks (Husky + lint-staged)' },
+    { key: 'commitLint', label: 'Conventional commit linting (commitlint)' },
+    { key: 'semanticRelease', label: 'Automated releases (semantic-release)' },
+    { key: 'securityAutomation', label: 'Security automation (Dependabot + CodeQL)' },
+    { key: 'badges', label: 'README status badges' },
+    { key: 'aiSetup', label: 'AI agent rules (AGENTS.md, CLAUDE.md, Cursor, Copilot)' },
+];
+/**
+ * A preset run may only ask questions when a human is on both ends of the pipe.
+ * Redirect either direction and this is CI — the case `--preset` exists for —
+ * where the one-shot behaviour has to stay exactly as it was.
+ */
+function isInteractiveTerminal() {
+    return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+/**
+ * Show what the preset resolved to and let the user drop parts of it before a
+ * single file is written (#461).
+ */
+async function reviewPresetConfig(config) {
+    const files = computeFileList(config);
+    console.log(chalk.cyan(`\n📄 This preset writes ${files.length} files:\n`));
+    for (const file of files)
+        console.log(chalk.gray(`   ${file}`));
+    console.log();
+    const enabled = REVIEWABLE_FEATURES.filter((feature) => config[feature.key] === true);
+    if (enabled.length === 0)
+        return config;
+    const { features } = await inquirer.prompt([
+        {
+            type: 'checkbox',
+            name: 'features',
+            message: '🧹 Uncheck anything you do not want:',
+            choices: enabled.map((feature) => ({
+                name: feature.label,
+                value: feature.key,
+                checked: true,
+            })),
+        },
+    ]);
+    const kept = new Set(features);
+    const reviewed = { ...config };
+    for (const feature of enabled) {
+        if (!kept.has(feature.key))
+            reviewed[feature.key] = false;
+    }
+    return reviewed;
+}
 /** `null` means the run was declined, not that it failed — see promptForConfig. */
 async function resolveConfig(options) {
     if (options.config && options.preset) {
@@ -38,7 +92,10 @@ async function resolveConfig(options) {
             throw new Error(`Unknown preset: ${options.preset}. Available: ${PRESET_NAMES.join(', ')}`);
         }
         const projectName = path.basename(path.resolve(options.directory));
-        return buildPresetConfig(options.preset, projectName);
+        const config = buildPresetConfig(options.preset, projectName);
+        if (options.dryRun || options.yes || !isInteractiveTerminal())
+            return config;
+        return reviewPresetConfig(config);
     }
     return promptForConfig(path.resolve(options.directory));
 }
@@ -110,7 +167,7 @@ async function promptForLanguage(targetDir) {
     const detected = await detectLanguage(targetDir);
     const { language } = await inquirer.prompt([
         {
-            type: 'list',
+            type: 'select',
             name: 'language',
             message: '🗣️  What is the primary language of this repo?',
             choices: Object.values(LANGUAGES).map((module) => ({
@@ -178,7 +235,7 @@ async function promptForConfig(targetDir) {
             validate: (input) => input.trim().length > 0 || 'Project name is required',
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'projectType',
             message: '🏗️  What type of project are you building?',
             choices: [
@@ -196,7 +253,7 @@ async function promptForConfig(targetDir) {
             default: true,
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'tsConfig',
             message: '⚙️  Which TypeScript configuration?',
             choices: (answers) => {
@@ -221,7 +278,7 @@ async function promptForConfig(targetDir) {
             when: (answers) => answers.useTypeScript,
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'lintingTool',
             message: '🔍 Which linting/formatting tool?',
             choices: [
@@ -233,7 +290,7 @@ async function promptForConfig(targetDir) {
             default: 'biome',
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'eslintConfig',
             message: '🔧 Which ESLint configuration?',
             choices: (answers) => {
@@ -253,7 +310,7 @@ async function promptForConfig(targetDir) {
             when: (answers) => answers.lintingTool !== 'none',
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'testingFramework',
             message: '🧪 Which testing framework?',
             choices: [
@@ -266,7 +323,7 @@ async function promptForConfig(targetDir) {
             default: 'vitest',
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'testEnvironment',
             message: '🌍 Test environment?',
             choices: [
@@ -291,7 +348,7 @@ async function promptForConfig(targetDir) {
             when: (answers) => answers.gitHooks,
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'releaseTool',
             message: '🚀 Automated release tool?',
             choices: [
@@ -336,7 +393,7 @@ async function promptForConfig(targetDir) {
             default: true,
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'orchestrator',
             message: '🚀 Monorepo task orchestrator?',
             choices: [
@@ -358,7 +415,7 @@ async function promptForConfig(targetDir) {
                 answers.projectType === 'nextjs-app',
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'bundler',
             message: '📦 Which bundler/build tool?',
             choices: (answers) => {

package/dist/cli/generators/index.js

@@ -53,10 +53,11 @@ export async function generateConfigs(config, targetDir) {
     if (config.testing.framework !== 'none') {
         await generateTestingConfigs(config, targetDir);
     }
-    // Generate git configurations
-    if (config.gitHooks || config.commitLint) {
-        await generateGitConfigs(config, targetDir);
-    }
+    // Unconditional: generateGitConfigs already gates husky and commitlint on
+    // their own flags, and the .gitignore it also writes has nothing to do with
+    // either. Gating the whole call meant any scaffold that declined git hooks —
+    // which is every `minimal` run (#461) — got no .gitignore at all.
+    await generateGitConfigs(config, targetDir);
     // Generate GitHub Actions workflow
     await generateGitHubActions(config, targetDir);
     // Generate security automation (Dependabot + CodeQL)

package/dist/cli/generators/security.js

@@ -123,13 +123,20 @@ export function dependabotIgnoreRules(content) {
     return rules;
 }
 /**
- * Auto-merges patch + minor Dependabot PRs **from the `dev-minor` group only**
- * once CI is green. Requires branch protection with required status checks on
- * the target branch — without it, \`gh pr merge --auto\` never fires.
+ * Auto-merges patch + minor Dependabot PRs from the \`dev-minor\` group **and the
+ * \`github-actions\` ecosystem** once CI is green. Requires branch protection with
+ * required status checks on the target branch — without it, \`gh pr merge --auto\`
+ * never fires.
  *
  * Everything else falls through to a human: production bumps ship to consumers
  * of a published package (#423), majors are breaking by definition, and an
- * ungrouped PR reports an empty \`dependency-group\`, so the gate fails closed.
+ * ungrouped npm PR reports an empty \`dependency-group\`, so the gate fails closed.
+ *
+ * CI action bumps are the one ungrouped case that is allowed through, matched on
+ * \`package-ecosystem\` (#452): they reach no consumer of the published package
+ * and land as \`ci(deps): …\`, which cuts no release. The counter-argument is real
+ * — a compromised action runs in CI holding \`GITHUB_TOKEN\` — so the majors
+ * exclusion and required status checks are doing the work here.
  *
  * The group name is the one \`dependabotConfig()\` writes — the two files are a
  * paired unit and have to move together.
@@ -201,10 +208,17 @@ jobs:
       # Belt and braces: the dev-minor group is already declared minor+patch in
       # dependabot.yml, but this workflow is the security gate and shouldn't
       # trust a config file a consumer repo can edit independently.
-      - name: Auto-merge dev-dependency patch and minor updates
+      #
+      # github-actions bumps are ungrouped, so they report an empty
+      # dependency-group and are matched by ecosystem instead (#452). They reach
+      # no consumer of the published package, and their squash subject is
+      # "ci(deps): …", which cuts no release. Majors still fall through to a
+      # human — the update-type clause below applies to them too.
+      - name: Auto-merge dev-dependency and CI action patch and minor updates
         if: |
           steps.gate.outputs.safe == 'true' &&
-          steps.metadata.outputs.dependency-group == 'dev-minor' &&
+          (steps.metadata.outputs.dependency-group == 'dev-minor' ||
+          steps.metadata.outputs.package-ecosystem == 'github-actions') &&
           (steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
           steps.metadata.outputs.update-type == 'version-update:semver-minor')
         run: gh pr merge --auto --squash "$PR_URL"

package/dist/cli/index.js

@@ -29,6 +29,7 @@ program
     .option('-d, --directory <path>', 'Target directory for setup', process.cwd())
     .option('--skip-install', 'Skip installing dependencies')
     .option('--preset <name>', 'Skip prompts; use defaults for a project type')
+    .option('-y, --yes', 'With --preset in a terminal, skip the file-list review and write everything')
     .option('--config <path>', 'Skip prompts; read a ProjectConfig or .repo-tooling.json lockfile from <path>')
     .option('--dry-run', 'Print the resolved config and file list, write nothing')
     .option('--config-schema', 'Print the JSON Schema for ProjectConfig and exit')

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.15.2",
+	"version": "3.16.0",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [
@@ -27,10 +27,10 @@
 		"dev": "pnpm --filter @rtorcato/docs dev",
 		"docs:build": "pnpm --filter @rtorcato/docs build",
 		"==================== Common ====================": "",
-		"lint": "pnpm exec biome lint --config-path=biome.json src scripts",
-		"format": "pnpm exec biome format --config-path=biome.json src scripts",
-		"check:fix": "pnpm exec biome check --config-path=biome.json --fix src scripts",
-		"check": "pnpm exec biome check --config-path=biome.json src scripts",
+		"lint": "pnpm exec biome lint .",
+		"format": "pnpm exec biome format .",
+		"check:fix": "pnpm exec biome check --fix .",
+		"check": "pnpm exec biome check .",
 		"prepare": "is-ci || husky",
 		"typecheck": "tsc --noEmit --project src/cli/tsconfig.json",
 		"test": "vitest",

package/skills/ai-issue-loop/SKILL.md

@@ -52,6 +52,20 @@ header names the agent *and* says why it is wearing a human's face:
 
 `🤖 *Automated — <which agent> via ai-issue-loop. Posted under the owner's account by an agent; not a human message. There is no separate GitHub account for AI agents, so this appears under @<owner>'s avatar.*`
 
+**Comment budget: ≤10 lines, and a clean outcome gets no comment at all.** A
+40-line comment on every PR trains the reader to skip all of them, including the
+one that matters — the same failure mode as `ai-notes` on every PR, below. Link
+the reviewer's `### Before merging` rather than restating it; a paraphrase is
+drift with a second copy to maintain.
+
+| Outcome | Comment |
+|---|---|
+| Clean and ready | **None.** `ai-ok-code, ai-ok-sec` + assigned + no `ai-review` already says it. |
+| `ai-notes` | ≤10 lines; link the reviewer's `### Before merging`. |
+| `ai-changes`, CI red, `ai-blocked` | ≤10 lines, action first, then the specific cause. |
+| Reviewer verdict | `### Before merging` plus at most 3 short paragraphs above it. |
+| Declining an issue | The one exception — a hard handoff needs its reasoning; see Pass 4. |
+
 ## Labels
 
 | Label | On | Meaning |
@@ -250,7 +264,10 @@ It lands in the user's *Assigned to you* view, and the labels then read as state
 than noise — `ai-ok-code, ai-ok-sec` with no `ai-review` means **waiting on you**. Both
 halves matter: Pass 3 only ever *adds* the `ai-ok-*` labels, so without the removal a
 finished PR keeps wearing `ai-review` forever and looks mid-review. Idempotent, so
-re-running a tick is harmless. Take no other action — do not merge.
+re-running a tick is harmless. Take no other action — do not merge, and **post no
+comment**: nothing is wrong, so those three labels are the whole message. A
+comment is how the loop records what a label cannot; a clean PR has nothing to
+record.
 
 **Never strip `ai-notes` here.** It is the whole point of the handoff: it has to
 survive to the moment of merging, which is the moment it is for. A ready PR reads
@@ -281,7 +298,8 @@ a required check, so nothing in the check list looked wrong either.
 
 Diff-scoped reviewers cannot catch this — they never see CI. So when a
 both-passed PR is not `CLEAN`, do not assign it as ready. Send it back, and
-**comment why**: the reviewers passed it, so the fix-round implementer would
+**comment why** — ≤10 lines, leading with what must change, then the failing
+check and its error. The reviewers passed it, so the fix-round implementer would
 otherwise read the comments and find no instruction to act on.
 
 ```bash
@@ -506,7 +524,10 @@ Reviewer prompt template:
 >
 > That section is what a human reads at merge time, so put anything you would
 > want them to know there rather than leaving it in the prose above — a finding
-> buried mid-paragraph does not survive the handoff. The bar is a finding that
+> buried mid-paragraph does not survive the handoff. For the same reason, **cap
+> the body at that section plus at most 3 short paragraphs above it**: no process
+> narration, no restating the diff, no listing what you checked and found fine.
+> The bar is a finding that
 > **changes what a human would do**: a semver implication, a deliberate
 > omission, a follow-up that must be filed. Not observations, not praise, not
 > restating the diff. Writing `Nothing.` is a real verdict and the common one —
@@ -543,7 +564,8 @@ Reviewer prompt template:
 > a Dependabot PR it suppresses auto-merge outright. Use `ai-changes` only when
 > you can name a concrete change an agent could make.
 >
-> Say nothing else and return a one-line summary.
+> Say nothing else and return a one-line summary — that governs your reply to the
+> orchestrator; the comment body is capped separately, above.
 
 **Dependabot PRs use a different prompt** — the one above would burn the tick on a
 lockfile. `js-common` #148 bumps 20 packages and its *entire* diff is
@@ -611,7 +633,8 @@ package/from/to table survives because it sits at the top; classify from that.
 > State in your comment which rule fired, name the packages that tripped it, and say
 > whether the body was truncated so the reader knows what you could and couldn't see.
 > Same `🤖 *Automated review — …*` header line, same closing `### Before merging`
-> section, and same one-verdict-label rule as above — **including clearing your
+> section, same 3-paragraph cap on the body, and same one-verdict-label rule as
+> above — **including clearing your
 > `<ai-reviewing-code|ai-reviewing-sec>` claim label in the same `gh pr edit`**.
 > Pass 3 claimed you with it before spawning you, and a claim left behind wedges
 > your half of the review until Pass 2 reaps it.
@@ -716,7 +739,9 @@ real work to reach is lost.
 
 The comment opens with the standard `🤖 *Automated …*` header — see the top of this
 file; it must state that no GitHub account exists for AI agents, so the comment
-wears the owner's avatar. Then, in the body:
+wears the owner's avatar. Then, in the body — **this is the one comment exempt
+from the ≤10-line budget, and only this one.** Declining is a hard handoff whose
+whole value is the reasoning; do not reach for this shape on a PR handoff:
 
 - **Why an agent cannot finish it**, concretely. "Not suitable" is useless. Name
   the blocker: binary assets it cannot author, a force-push past branch

package/skills/repo-tooling/SKILL.md

@@ -47,8 +47,9 @@ npx @rtorcato/repo-tooling fix <target> --diff           # unified diff before c
 ## Scaffolding a new project
 
 ```bash
-# Quick: from a named preset (library | web-app | node-api | nextjs-app | react-app | swift-library)
-npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install
+# Quick: from a named preset (minimal | library | web-app | node-api | nextjs-app | react-app | swift-library)
+# --yes skips the interactive file-list review; without it, a terminal lets you deselect.
+npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install --yes
 
 # Full control: validate a config against the schema, preview, then write
 npx @rtorcato/repo-tooling setup --config-schema > project-config.schema.json

package/tooling/biome/biome.json

@@ -1,63 +1,64 @@
 {
-	"$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
-	"vcs": {
-		"enabled": true,
-		"clientKind": "git",
-		"useIgnoreFile": true
-	},
-	"files": {
-		"ignoreUnknown": false,
-		"includes": [
-			"**",
-			"!**/node_modules",
-			"!**/package.json",
-			"!**/tsconfig*.json",
-			"!**/dist",
-			"!**/coverage",
-			"!**/.git",
-			"!**/.github",
-			"!**/.vscode"
-		]
-	},
-	"formatter": {
-		"enabled": true,
-		"indentStyle": "tab",
-		"lineWidth": 100
-	},
-	"linter": {
-		"enabled": true,
-		"rules": {
-			"preset": "recommended",
-			"style": {
-				"noInferrableTypes": "off"
-			},
-			"complexity": {
-				"useLiteralKeys": "off"
-			},
-			"suspicious": {
-				"noExplicitAny": "off",
-				"noTemplateCurlyInString": "off"
-			}
-		}
-	},
-	"assist": {
-		"actions": {
-			"source": {
-				"organizeImports": "off"
-			}
-		}
-	},
-	"javascript": {
-		"formatter": {
-			"quoteStyle": "single",
-			"trailingCommas": "es5",
-			"semicolons": "asNeeded"
-		}
-	},
-	"json": {
-		"formatter": {
-			"indentStyle": "space",
-			"indentWidth": 2
-		}
-	}
+  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
+  "root": false,
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "ignoreUnknown": false,
+    "includes": [
+      "**",
+      "!**/node_modules",
+      "!**/package.json",
+      "!**/tsconfig*.json",
+      "!**/dist",
+      "!**/coverage",
+      "!**/.git",
+      "!**/.github",
+      "!**/.vscode"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "tab",
+    "lineWidth": 100
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "preset": "recommended",
+      "style": {
+        "noInferrableTypes": "off"
+      },
+      "complexity": {
+        "useLiteralKeys": "off"
+      },
+      "suspicious": {
+        "noExplicitAny": "off",
+        "noTemplateCurlyInString": "off"
+      }
+    }
+  },
+  "assist": {
+    "actions": {
+      "source": {
+        "organizeImports": "off"
+      }
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "trailingCommas": "es5",
+      "semicolons": "asNeeded"
+    }
+  },
+  "json": {
+    "formatter": {
+      "indentStyle": "space",
+      "indentWidth": 2
+    }
+  }
 }

package/tooling/changesets/config.json

@@ -1,11 +1,11 @@
 {
-	"$schema": "https://unpkg.com/@changesets/config@3.0.5/schema.json",
-	"changelog": "@changesets/cli/changelog",
-	"commit": false,
-	"fixed": [],
-	"linked": [],
-	"access": "public",
-	"baseBranch": "main",
-	"updateInternalDependencies": "patch",
-	"ignore": []
+  "$schema": "https://unpkg.com/@changesets/config@3.0.5/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
 }

package/tooling/claude/repo-tooling.md

@@ -51,8 +51,9 @@ npx @rtorcato/repo-tooling fix <target> --diff           # unified diff before c
 ## Scaffolding a new project
 
 ```bash
-# Quick: from a named preset (library | web-app | node-api | nextjs-app | react-app | swift-library)
-npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install
+# Quick: from a named preset (minimal | library | web-app | node-api | nextjs-app | react-app | swift-library)
+# --yes skips the interactive file-list review; without it, a terminal lets you deselect.
+npx @rtorcato/repo-tooling setup --preset library -d ./my-lib --skip-install --yes
 
 # Full control: validate a config against the schema, preview, then write
 npx @rtorcato/repo-tooling setup --config-schema > project-config.schema.json

package/tooling/commitlint/commitlint.mjs

@@ -1,7 +1,7 @@
 export default {
-	extends: ["@commitlint/config-conventional"],
+	extends: ['@commitlint/config-conventional'],
 	ignores: [
-		(commit) => commit.includes("[skip ci]"),
+		(commit) => commit.includes('[skip ci]'),
 		// Bot commits are machine-written end to end, including headers long
 		// enough to trip header-max-length. Skipping them wholesale keeps bot
 		// PRs green — squash-merge uses the PR title, which is still linted on
@@ -12,43 +12,43 @@ export default {
 	],
 	rules: {
 		// Enforce strict type validation
-		"type-enum": [
+		'type-enum': [
 			2,
-			"always",
+			'always',
 			[
-				"build",
-				"chore",
-				"ci",
-				"docs",
-				"feat",
-				"fix",
-				"perf",
-				"refactor",
-				"revert",
-				"style",
-				"test",
+				'build',
+				'chore',
+				'ci',
+				'docs',
+				'feat',
+				'fix',
+				'perf',
+				'refactor',
+				'revert',
+				'style',
+				'test',
 			],
 		],
 		// 100 is the conventional-commits/semantic-release default. 72 was too
 		// tight: GitHub appends " (#NN)" to squash commits, overflowing the
 		// header on main and skipping the release.
-		"header-max-length": [2, "always", 100],
+		'header-max-length': [2, 'always', 100],
 		// Body/footer length is unenforced. Machine-written commits (agents,
 		// bots) don't wrap, and a `BREAKING CHANGE:` footer — the input
 		// semantic-release reads to cut a major — is the worst thing to make
 		// someone hand-rewrap. The subject rules below decide the release
 		// type and stay enforced.
-		"body-max-line-length": [0],
-		"footer-max-line-length": [0],
+		'body-max-line-length': [0],
+		'footer-max-line-length': [0],
 		// Enforce case rules (allow common patterns)
-		"subject-case": [0], // Disable case enforcement to allow flexibility
-		"type-case": [2, "always", "lower-case"],
+		'subject-case': [0], // Disable case enforcement to allow flexibility
+		'type-case': [2, 'always', 'lower-case'],
 		// Enforce required elements
-		"type-empty": [2, "never"],
-		"subject-empty": [2, "never"],
+		'type-empty': [2, 'never'],
+		'subject-empty': [2, 'never'],
 		// Enforce punctuation rules
-		"subject-full-stop": [2, "never", "."],
+		'subject-full-stop': [2, 'never', '.'],
 		// Enforce scope rules (optional but recommended)
-		"scope-case": [2, "always", "lower-case"],
+		'scope-case': [2, 'always', 'lower-case'],
 	},
-};
+}

package/tooling/nx/nx.json

@@ -1,24 +1,24 @@
 {
-	"$schema": "https://raw.githubusercontent.com/nrwl/nx/master/packages/nx/schemas/nx-schema.json",
-	"namedInputs": {
-		"default": ["{projectRoot}/**/*", "sharedGlobals"],
-		"production": ["default"],
-		"sharedGlobals": []
-	},
-	"targetDefaults": {
-		"build": {
-			"dependsOn": ["^build"],
-			"outputs": ["{projectRoot}/dist"],
-			"cache": true
-		},
-		"lint": { "cache": true },
-		"typecheck": {
-			"dependsOn": ["^build"],
-			"cache": true
-		},
-		"test": {
-			"dependsOn": ["^build"],
-			"cache": true
-		}
-	}
+  "$schema": "https://raw.githubusercontent.com/nrwl/nx/master/packages/nx/schemas/nx-schema.json",
+  "namedInputs": {
+    "default": ["{projectRoot}/**/*", "sharedGlobals"],
+    "production": ["default"],
+    "sharedGlobals": []
+  },
+  "targetDefaults": {
+    "build": {
+      "dependsOn": ["^build"],
+      "outputs": ["{projectRoot}/dist"],
+      "cache": true
+    },
+    "lint": { "cache": true },
+    "typecheck": {
+      "dependsOn": ["^build"],
+      "cache": true
+    },
+    "test": {
+      "dependsOn": ["^build"],
+      "cache": true
+    }
+  }
 }

package/tooling/oxlint/oxlintrc.json

@@ -1,28 +1,28 @@
 {
-	"$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
-	"categories": {
-		"correctness": "error",
-		"perf": "warn",
-		"suspicious": "warn",
-		"pedantic": "off",
-		"style": "off",
-		"restriction": "off",
-		"nursery": "off"
-	},
-	"plugins": ["typescript", "unicorn", "oxc", "import"],
-	"rules": {
-		"no-console": "warn",
-		"no-debugger": "error",
-		"no-empty": "warn",
-		"no-unused-vars": "off",
-		"@typescript-eslint/no-unused-vars": [
-			"warn",
-			{ "argsIgnorePattern": "^_", "varsIgnorePattern": "^_" }
-		],
-		"unicorn/filename-case": "off",
-		"unicorn/no-null": "off",
-		"unicorn/prevent-abbreviations": "off",
-		"import/no-default-export": "off"
-	},
-	"ignorePatterns": ["node_modules", "dist", "build", "coverage", ".next", "*.d.ts"]
+  "$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
+  "categories": {
+    "correctness": "error",
+    "perf": "warn",
+    "suspicious": "warn",
+    "pedantic": "off",
+    "style": "off",
+    "restriction": "off",
+    "nursery": "off"
+  },
+  "plugins": ["typescript", "unicorn", "oxc", "import"],
+  "rules": {
+    "no-console": "warn",
+    "no-debugger": "error",
+    "no-empty": "warn",
+    "no-unused-vars": "off",
+    "@typescript-eslint/no-unused-vars": [
+      "warn",
+      { "argsIgnorePattern": "^_", "varsIgnorePattern": "^_" }
+    ],
+    "unicorn/filename-case": "off",
+    "unicorn/no-null": "off",
+    "unicorn/prevent-abbreviations": "off",
+    "import/no-default-export": "off"
+  },
+  "ignorePatterns": ["node_modules", "dist", "build", "coverage", ".next", "*.d.ts"]
 }

package/tooling/release-please/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-	".": "0.0.0"
+  ".": "0.0.0"
 }

package/tooling/release-please/release-please-config.json

@@ -1,9 +1,9 @@
 {
-	"$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
-	"packages": {
-		".": {
-			"release-type": "node",
-			"changelog-path": "CHANGELOG.md"
-		}
-	}
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "changelog-path": "CHANGELOG.md"
+    }
+  }
 }

package/tooling/rolldown/rolldown.config.mjs

@@ -24,7 +24,12 @@ import { defineConfig } from 'rolldown'
  * @param {import('./rolldown.config.d.mts').GetConfigOptions} [options]
  */
 export function getConfig(options = {}) {
-	const { input = 'src/index.ts', outDir = 'dist', sourcemap = true, external = isBareImport } = options
+	const {
+		input = 'src/index.ts',
+		outDir = 'dist',
+		sourcemap = true,
+		external = isBareImport,
+	} = options
 
 	return defineConfig({
 		input,