@savvy-web/silk-core 0.1.0

package/pr-body/region.js

@@ -0,0 +1,105 @@
+//#region src/pr-body/region.ts
+/**
+* The generic marker-delimited region grammar every silk-managed document
+* uses: `<!-- token:start -->` … `<!-- token:end -->`.
+*
+* @remarks
+* Extracted from `silk-release-action` (its `pr-body.ts` and
+* `managed-sections.ts` both carried a private copy) so the grammar has one
+* owner. **Every marker is a pair.** A lone opening marker can only be located
+* by scanning forward to whatever happens to follow it, which makes the
+* region's extent a function of its neighbours rather than of itself — moving
+* anything nearby silently redefines it. The token is free-form; `:start` and
+* `:end` are the whole contract, so pairs nest and a region can contain
+* sub-regions without either needing to know about the other.
+*/
+/**
+* Pure helpers over the `<!-- token:start -->` / `<!-- token:end -->` region
+* grammar.
+*
+* @remarks
+* Every operation is total: a body with no region (or a broken pair) degrades
+* to the documented fail-safe result rather than failing, because the callers
+* are regenerating actions that must still produce a body when the prior one
+* is malformed. Use `PrBodyDiagnostic.scan` when a caller wants to be told
+* about a broken pair instead of silently tolerating it.
+*
+* @public
+*/
+var Region = class Region {
+	constructor() {}
+	/**
+	* The opening delimiter for a named region.
+	*
+	* @public
+	*/
+	static start(token) {
+		return `<!-- ${token}:start -->`;
+	}
+	/**
+	* The closing delimiter for a named region.
+	*
+	* @public
+	*/
+	static end(token) {
+		return `<!-- ${token}:end -->`;
+	}
+	/**
+	* The content between a region's delimiters, or `undefined` when absent.
+	*
+	* @remarks
+	* Finds the FIRST opening marker and the matching close after it, so a
+	* nested region of a different token is returned as part of the content
+	* rather than truncating it.
+	*
+	* @public
+	*/
+	static read(body, token) {
+		const from = body.indexOf(Region.start(token));
+		const to = body.indexOf(Region.end(token), from === -1 ? 0 : from);
+		if (from === -1 || to === -1 || to < from) return void 0;
+		return body.slice(from + Region.start(token).length, to);
+	}
+	/**
+	* Everything outside a region, with the region and its delimiters removed.
+	*
+	* @remarks
+	* A body without the region comes back unchanged — removal of an absent
+	* region is a no-op, not an error.
+	*
+	* @public
+	*/
+	static strip(body, token) {
+		const from = body.indexOf(Region.start(token));
+		const to = body.indexOf(Region.end(token), from === -1 ? 0 : from);
+		if (from === -1 || to === -1 || to < from) return body;
+		return `${body.slice(0, from)}${body.slice(to + Region.end(token).length)}`;
+	}
+	/**
+	* Put `rendered` (a fully rendered region, its own markers included) into
+	* `body`, replacing a previous region of the same token and leaving
+	* everything else alone.
+	*
+	* @remarks
+	* **Human edits outside the markers survive.** A predecessor spliced on a
+	* markdown heading, which silently ate any content a human happened to put
+	* under a heading of that name and could not tell generated text from
+	* theirs. An explicit marker pair can.
+	*
+	* A body with no markers keeps its content and gains the region **below**
+	* it, so an existing hand-written document is not displaced. The result is
+	* trimmed.
+	*
+	* @public
+	*/
+	static upsert(body, token, rendered) {
+		const start = body.indexOf(Region.start(token));
+		const end = body.indexOf(Region.end(token));
+		if (start !== -1 && end !== -1 && end > start) return `${body.slice(0, start)}${rendered}${body.slice(end + Region.end(token).length)}`.trim();
+		const trimmed = body.trim();
+		return trimmed === "" ? rendered : `${trimmed}\n\n${rendered}`;
+	}
+};
+
+//#endregion
+export { Region };

package/schemas/BiomeConfig.js

@@ -0,0 +1,36 @@
+import { Effect, Schema } from "effect";
+
+//#region src/schemas/BiomeConfig.ts
+/**
+* Result of a Biome schema URL sync or check operation.
+*
+* @remarks
+* - `updated` — paths of config files whose `$schema` URL was changed (or would be changed on `check`).
+* - `skipped` — paths of config files with no `$schema` field or a non-biomejs.dev URL.
+* - `current` — paths of config files already pointing to the expected schema URL.
+*
+* @since 0.1.0
+* @public
+*/
+const BiomeSyncResult = Schema.Struct({
+	updated: Schema.Array(Schema.String),
+	skipped: Schema.Array(Schema.String),
+	current: Schema.Array(Schema.String)
+});
+/**
+* Options for `BiomeSchemaSync` operations.
+*
+* @remarks
+* `cwd` overrides the working directory used to locate `biome.json` / `biome.jsonc`.
+* `gitignore` is reserved for future use to skip gitignored config files (defaults to `true`).
+*
+* @since 0.1.0
+* @public
+*/
+const BiomeSyncOptions = Schema.Struct({
+	cwd: Schema.optional(Schema.String),
+	gitignore: Schema.Boolean.pipe(Schema.withDecodingDefaultType(Effect.succeed(true)), Schema.withConstructorDefault(Effect.succeed(true)))
+});
+
+//#endregion
+export { BiomeSyncOptions, BiomeSyncResult };

package/schemas/ConfigDiscoverySchemas.js

@@ -0,0 +1,50 @@
+import { Schema } from "effect";
+
+//#region src/schemas/ConfigDiscoverySchemas.ts
+/**
+* The discovery strategy used to locate a config file.
+*
+* @remarks
+* - `"lib"` — found under `lib/configs/{name}` relative to the workspace root.
+* - `"root"` — found directly in the workspace root as `{name}`.
+* - `"cosmiconfig"` — reserved for future cosmiconfig-based discovery.
+*
+* @since 0.1.0
+* @public
+*/
+const ConfigSource = Schema.Literals([
+	"lib",
+	"root",
+	"cosmiconfig"
+]);
+/**
+* The resolved location of a discovered config file.
+*
+* @remarks
+* Produced by `ConfigDiscovery.find` and `ConfigDiscovery.findAll`.
+* `path` is the absolute file path; `source` indicates how it was discovered.
+*
+* @since 0.1.0
+* @public
+*/
+const ConfigLocation = Schema.Struct({
+	path: Schema.String,
+	source: ConfigSource
+});
+/**
+* Options passed to config discovery methods.
+*
+* @remarks
+* `cwd` overrides the working directory for path resolution (defaults to the current working directory).
+* `tool` is reserved for future use as a tool-specific discovery hint.
+*
+* @since 0.1.0
+* @public
+*/
+const ConfigDiscoveryOptions = Schema.Struct({
+	cwd: Schema.optional(Schema.String),
+	tool: Schema.optional(Schema.String)
+});
+
+//#endregion
+export { ConfigDiscoveryOptions, ConfigLocation, ConfigSource };

package/schemas/SavvyInstallSection.js

@@ -0,0 +1,232 @@
+import { CommentStyle, SectionId } from "@effected/templates";
+
+//#region src/schemas/SavvyInstallSection.ts
+/**
+* Section identity for the dependency auto-install block.
+*
+* `toolName` is `"savvy-install"`; pair with {@link savvyInstallDeps}.
+*
+* @since 7.5.0
+* @public
+*/
+const SavvyInstallSection = SectionId.make({
+	key: "SAVVY-INSTALL",
+	commentStyle: CommentStyle.hash
+});
+/**
+* Pathspecs whose change across a checkout or merge means `node_modules` is stale.
+*
+* @remarks
+* Git's default pathspec globbing does not stop a wildcard at a slash, so the
+* one nested-manifest entry below covers every workspace manifest at any depth
+* without needing a recursive spelling. Manifests are listed alongside lockfiles
+* because a dependency edit that has not been installed yet moves the manifest
+* first and the lockfile not at all.
+*/
+const DEPENDENCY_PATHS = [
+	"package.json",
+	"*/package.json",
+	"pnpm-lock.yaml",
+	"pnpm-workspace.yaml",
+	"package-lock.json",
+	"npm-shrinkwrap.json",
+	"yarn.lock",
+	"bun.lock",
+	"bun.lockb"
+].map((path) => `'${path}'`).join(" ");
+/**
+* Dependency auto-install shared across Silk Suite hook files.
+*
+* @remarks
+* Brings `node_modules` back in line after a branch switch or a pull, so a batch
+* of repos pulled to align their dependencies does not each need a manual
+* install. Installs with lifecycle scripts skipped — `--ignore-scripts`, or
+* `--mode=skip-build` for Yarn Berry, which dropped the former — because the goal
+* is to get the dependency tree on disk, not to run a full postinstall.
+*
+* **That flag has a cost, and one shape of repo cannot pay it.** Where a package
+* publishes through a built link directory — `publishConfig.directory` with
+* `linkDirectory: true`, which is how this monorepo wires `dist/dev/pkg` — the
+* workspace resolves its own dependencies through a directory that a `prepare`
+* script has to build, and skipping scripts yields a populated `node_modules`
+* pointing at nothing.
+*
+* Those repos ask for a full install through the LOCAL git config key
+* `savvy.installLifecycleScripts`, which `savvy init` sets when it finds the
+* shape. The decision deliberately does NOT read the checked-out tree. Doing so
+* failed in both directions at once: a branch that merely declared the shape
+* could turn lifecycle scripts back on just by being checked out, making
+* `git checkout` of an untrusted revision a code-execution path; and the `jq`
+* the scan needed is absent on stock macOS and Ubuntu, where the missing answer
+* silently skipped scripts in precisely the repos that cannot survive it.
+* `.git/config` is neither checked out nor parsed with `jq`, so it has neither
+* failure mode.
+*
+* The package managers gate dependency scripts themselves on top of this —
+* pnpm's `strictDepBuilds` with an `allowBuilds` allowlist being the case in
+* point — but workspace and root lifecycle scripts still run, which is why the
+* opt-in is local rather than inferred. With the flag on, the hook says on the
+* way out that scripts were skipped rather than leaving it to be discovered.
+*
+* Deliberately self-contained, like `savvyToolchainCheck`: its homes carry
+* `SavvyHooksSection` but no `SavvyBaseSection`, so it defines its own root, CI
+* and package-manager lookups rather than depending on `ROOT`, `in_ci` or `PM`.
+*
+* Four guards keep it from firing on the many checkouts that are not dependency
+* events, each a silent no-op:
+*
+* - CI, where the runtime action owns installation by construction.
+* - `SAVVY_SKIP_INSTALL`, the escape hatch for a bisect or a scripted sweep that
+*   does not want an install between steps.
+* - `post-checkout` only: a branch-flag of `0`, which is `git checkout -- <file>`
+*   and not a move between commits.
+* - **The gate that makes this affordable:** nothing dependency-related actually
+*   changed across the move. Without it every branch switch would pay for a full
+*   install. A missing `node_modules` overrides it, since there is nothing to be
+*   stale.
+*
+* A fresh clone is not among the cases it handles, and cannot be: husky sets
+* `core.hooksPath` from its own `prepare` script, so until the first manual
+* install has run there is no hook installed to fire.
+*
+* The install's exit status is swallowed and its output goes to stderr. Git
+* ignores what `post-checkout` and `post-merge` return, so a failure here must
+* not look like a failed checkout; the hint names the escape hatch instead.
+*
+* Every probe that can legitimately fail — no `ORIG_HEAD` to compare against, an
+* unresolvable range — is neutralised with `|| true` rather than left to its own
+* status. These blocks are co-owned and consumer content can sit below them, so
+* under a hook running `set -e` a bare failing substitution would abort the whole
+* file and take those later sections with it.
+*
+* @param hook - Which hook the block is being generated for; decides the
+*   argument guard and how the comparison range is recovered.
+* @returns The install shell, with no surrounding markers or trailing newline.
+*
+* @since 7.5.0
+* @public
+*/
+function savvyInstallDeps(hook) {
+	const skip = `! { [ -n "$CI" ] || [ -n "$GITHUB_ACTIONS" ] || [ -n "$SAVVY_SKIP_INSTALL" ]; }`;
+	return `if ${hook === "post-checkout" ? `${skip} && [ "$3" = "1" ]` : skip}; then
+  install_root=$(git rev-parse --show-toplevel 2>/dev/null) || true
+${hook === "post-checkout" ? `  install_from="$1"
+  install_to="$2"` : `  install_from=$(git rev-parse --verify --quiet ORIG_HEAD 2>/dev/null) || true
+  install_to="HEAD"`}
+  install_pm=""
+  if [ -n "$install_root" ] && [ -f "$install_root/package.json" ]; then
+    if command -v jq >/dev/null 2>&1; then
+      install_pm=$(jq -r '.packageManager // empty' "$install_root/package.json" 2>/dev/null | cut -d'@' -f1)
+    fi
+    if [ -z "$install_pm" ]; then
+      if   [ -f "$install_root/pnpm-lock.yaml" ]; then install_pm="pnpm"
+      elif [ -f "$install_root/yarn.lock" ];      then install_pm="yarn"
+      elif [ -f "$install_root/bun.lock" ] || [ -f "$install_root/bun.lockb" ]; then install_pm="bun"
+      else install_pm="npm"; fi
+    fi
+  fi
+  # packageManager comes from the checked-out revision, so it names an executable
+  # the tree controls. 'command -v' proves a binary exists, not that it is a
+  # package manager, so the name is checked against the supported four first.
+  case "$install_pm" in
+    npm|pnpm|yarn|bun) ;;
+    *) install_pm="" ;;
+  esac
+  # Nothing to bring up to date unless a manifest or lockfile actually moved.
+  # A missing node_modules skips the diff outright: there is no tree to be stale.
+  install_stale=""
+  if [ -n "$install_pm" ]; then
+    if [ ! -d "$install_root/node_modules" ]; then
+      install_stale=1
+    elif [ -n "$install_from" ] && [ -n "$install_to" ]; then
+      install_stale=$(git diff --name-only "$install_from" "$install_to" -- ${DEPENDENCY_PATHS} 2>/dev/null | head -n 1) || true
+    fi
+  fi
+  if [ -n "$install_stale" ] && command -v "$install_pm" >/dev/null 2>&1; then
+    # Whether lifecycle scripts run is a LOCAL decision, read from .git/config,
+    # which no checkout can rewrite. Default off. 'savvy init' turns it on for a
+    # workspace that publishes through built link directories, where the links
+    # point at directories a prepare script has to produce.
+    install_scripts=$(git -C "$install_root" config --bool --get savvy.installLifecycleScripts 2>/dev/null) || true
+    if [ "$install_scripts" = "true" ]; then
+      install_flag=""
+    else
+      # Berry dropped --ignore-scripts for the install mode; Classic never knew the
+      # mode. An unreadable major reads as Berry, the likelier of the two today.
+      install_flag="--ignore-scripts"
+      if [ "$install_pm" = "yarn" ]; then
+        case "$(yarn --version 2>/dev/null | cut -d. -f1)" in
+          1) ;;
+          *) install_flag="--mode=skip-build" ;;
+        esac
+      fi
+    fi
+    # ':+' so a full install announces itself as "pnpm install", not "pnpm install ".
+    printf '↻ dependencies changed, running %s install%s\\n' "$install_pm" "\${install_flag:+ $install_flag}" >&2
+    # Unquoted on purpose: empty must expand to NO argument rather than an empty
+    # one. Safe because every value is a static flag literal from this generator.
+    if ( cd "$install_root" && "$install_pm" install $install_flag ) >&2; then
+      if [ -n "$install_flag" ]; then
+        printf '  Lifecycle scripts were skipped. Run a full install if you need build outputs.\\n' >&2
+      fi
+    else
+      printf '⚠ %s install failed; run it yourself to see why.\\n' "$install_pm" >&2
+      printf '  Set SAVVY_SKIP_INSTALL=1 to stop this hook from trying.\\n' >&2
+    fi
+  fi
+  unset install_root install_from install_to install_pm install_stale install_scripts install_flag
+fi`;
+}
+/**
+* The local git config key that authorizes lifecycle scripts during a hook install.
+*
+* @remarks
+* Local scope only. It lives in `.git/config`, which is never checked out, so no
+* incoming revision can set it — that is the whole point of reading the decision
+* from here rather than from a manifest in the tree.
+*
+* @since 7.5.0
+* @public
+*/
+const LIFECYCLE_SCRIPTS_CONFIG_KEY = "savvy.installLifecycleScripts";
+/**
+* Whether `manifest` publishes through a built link directory.
+*
+* @remarks
+* `publishConfig.directory` with `linkDirectory: true` means consumers of this
+* package resolve it through a directory that a `prepare` script has to produce,
+* so an install that skips lifecycle scripts leaves the link pointing at nothing.
+* A workspace containing any such package is one whose owner probably wants
+* {@link LIFECYCLE_SCRIPTS_CONFIG_KEY} set.
+*
+* Reporting the shape is deliberately separate from acting on it: this answers
+* "does this repo need scripts", and a human still decides whether hook-time
+* installs may run them.
+*
+* @param manifest - A parsed `package.json`; any non-object reads as `false`.
+*
+* @since 7.5.0
+* @public
+*/
+function publishesBuiltLinkDirectory(manifest) {
+	if (typeof manifest !== "object" || manifest === null) return false;
+	const { publishConfig } = manifest;
+	if (typeof publishConfig !== "object" || publishConfig === null) return false;
+	const { directory, linkDirectory } = publishConfig;
+	return typeof directory === "string" && directory.length > 0 && linkDirectory === true;
+}
+/**
+* Build the dependency auto-install block for `hook`.
+*
+* @param hook - Which hook the section is destined for.
+* @returns A shell `Section` (`commentStyle: hash`) keyed `SAVVY-INSTALL`.
+*
+* @since 7.5.0
+* @public
+*/
+function savvyInstallBlock(hook) {
+	return SavvyInstallSection.section(savvyInstallDeps(hook));
+}
+
+//#endregion
+export { LIFECYCLE_SCRIPTS_CONFIG_KEY, SavvyInstallSection, publishesBuiltLinkDirectory, savvyInstallBlock, savvyInstallDeps };

package/schemas/SavvySections.js

@@ -0,0 +1,194 @@
+import { CommentStyle, SectionId } from "@effected/templates";
+
+//#region src/schemas/SavvySections.ts
+/**
+* Build a shell-hook section identity from a Silk tool name.
+*
+* @remarks
+* **The key is uppercased here, and that is load-bearing.** The kit renders a
+* key verbatim into its markers (`# --- BEGIN <key> MANAGED SECTION ---`),
+* while the section model this replaces uppercased `toolName` on the way in. A
+* lowercase key would therefore emit `# --- BEGIN savvy-base MANAGED SECTION ---`
+* and no longer match the `SAVVY-BASE` markers already written into every
+* consumer repo's hook files — `check` would report the section absent and
+* `sync` would append a second copy beside the first. Uppercasing keeps the
+* marker bytes identical across the migration.
+*/
+const shellSection = (toolName) => SectionId.make({
+	key: toolName.toUpperCase(),
+	commentStyle: CommentStyle.hash
+});
+/**
+* Section identity for the shared package-manager preamble.
+*
+* `toolName` is `"savvy-base"`; pair with {@link savvyBasePreamble} to build the block:
+*
+* @example
+* ```ts
+* const section = SavvyBaseSection.section(savvyBasePreamble());
+* ```
+*
+* @since 0.5.0
+* @public
+*/
+const SavvyBaseSection = shellSection("savvy-base");
+/**
+* Section identity for the shared repo-hygiene block.
+*
+* `toolName` is `"savvy-hooks"`; pair with {@link savvyHooksHygiene}.
+*
+* @since 0.5.0
+* @public
+*/
+const SavvyHooksSection = shellSection("savvy-hooks");
+/**
+* Package-manager detection preamble shared across Silk Suite hook files.
+*
+* @remarks
+* Side-effect-free definitions meant to run unconditionally — no markers, no outer CI
+* guard. Defines `ROOT`, the `in_ci` predicate, `PM` (via `detect_pm`), and `pm_exec`.
+* `pm_exec` uses local/exec semantics for every package manager and `bun x` (space form),
+* which works regardless of how bun was installed (the `bunx` shim is not always on PATH).
+*
+* @returns The preamble shell, with no surrounding markers or trailing newline.
+*
+* @since 0.5.0
+* @public
+*/
+function savvyBasePreamble() {
+	return `ROOT=$(git rev-parse --show-toplevel)
+
+in_ci() { [ -n "$CI" ] || [ -n "$GITHUB_ACTIONS" ]; }
+
+detect_pm() {
+  if [ -f "$ROOT/package.json" ]; then
+    pm=$(jq -r '.packageManager // empty' "$ROOT/package.json" 2>/dev/null | cut -d'@' -f1)
+    if [ -n "$pm" ]; then echo "$pm"; return; fi
+  fi
+  if   [ -f "$ROOT/pnpm-lock.yaml" ]; then echo "pnpm"
+  elif [ -f "$ROOT/yarn.lock" ];      then echo "yarn"
+  elif [ -f "$ROOT/bun.lock" ];       then echo "bun"
+  else echo "npm"; fi
+}
+PM=$(detect_pm)
+
+pm_exec() {
+  case "$PM" in
+    pnpm) pnpm exec "$@" ;;
+    yarn) yarn exec "$@" ;;
+    bun)  bun x "$@" ;;
+    *)    npx --no -- "$@" ;;
+  esac
+}`;
+}
+/**
+* Repo-hygiene block shared across Silk Suite hook files.
+*
+* @remarks
+* Self-guarded against CI and needs no package manager: disables Git's `core.fileMode`
+* tracking and marks tracked shell scripts executable.
+*
+* @returns The hygiene shell, with no surrounding markers or trailing newline.
+*
+* @since 0.5.0
+* @public
+*/
+function savvyHooksHygiene() {
+	return `if ! { [ -n "$CI" ] || [ -n "$GITHUB_ACTIONS" ]; }; then
+  git config core.fileMode false
+  git ls-files -z '*.sh' | xargs -0 chmod +x 2>/dev/null || true
+fi`;
+}
+/**
+* Build a consumer's one-line tool section so every consumer calls the shared base
+* helpers identically.
+*
+* @remarks
+* The returned block's content is exactly `in_ci || pm_exec <command>` with `command`
+* appended verbatim — it is not parsed, quoted, or interpolated, so shell tokens like
+* `$ROOT` and `$1` survive into the generated literal.
+*
+* **Precondition:** a {@link SavvyBaseSection} block must precede this section in the same
+* hook file so `in_ci` and `pm_exec` are defined. Consumers guarantee this by passing both
+* to `ManagedSection.syncAll` in order:
+*
+* @example
+* ```ts
+* yield* sections.syncAll(".husky/commit-msg", [
+*   SavvyBaseSection.section(savvyBasePreamble()),
+*   savvyToolSection("savvy-commit", 'commitlint --config "$ROOT/lib/configs/commitlint.config.ts" --edit "$1"'),
+* ]);
+* ```
+*
+* @param toolName - Section identity; also drives the marker names (uppercased).
+* @param command - The command passed verbatim to `pm_exec`, run only outside CI.
+* @returns A shell `Section` (`commentStyle: hash`) for `toolName`.
+*
+* @since 0.5.0
+* @public
+*/
+function savvyToolSection(toolName, command) {
+	return shellSection(toolName).section(`in_ci || pm_exec ${command}`);
+}
+/**
+* Section identity for the package-manager toolchain drift check.
+*
+* `toolName` is `"savvy-toolchain"`; pair with {@link savvyToolchainCheck}.
+*
+* @since 7.3.0
+* @public
+*/
+const SavvyToolchainSection = shellSection("savvy-toolchain");
+/**
+* Package-manager drift check shared across Silk Suite hook files.
+*
+* @remarks
+* Compares the running package manager's version against the repo's
+* `devEngines.packageManager` pin and prints a warning on mismatch. **Warn only** —
+* it never blocks the hook and never installs anything, so nobody mid-bisect or
+* mid-rebase on an older pin is stranded.
+*
+* Deliberately self-contained: its homes are `.husky/post-checkout` and
+* `.husky/post-merge`, which carry {@link SavvyHooksSection} but no
+* {@link SavvyBaseSection}, so it defines its own root/CI/pin lookups rather than
+* depending on `ROOT`, `in_ci` or `PM`. It honours the `name` recorded in the pin
+* rather than assuming pnpm.
+*
+* Every input is treated as optional: no `git` root, no `jq`, no `devEngines` block,
+* or a package manager that is not on `PATH` all mean "say nothing". Only an exact
+* pin is comparable, so ranges (`^1.2.3`, `>=1 || <2`) and wildcards (`1.x`) are
+* skipped, and the `+sha512…` integrity tail `devEngines` versions routinely carry is
+* stripped before comparison. Skipped under CI, where the runtime action installs the
+* pin by construction.
+*
+* @returns The drift-check shell, with no surrounding markers or trailing newline.
+*
+* @since 7.3.0
+* @public
+*/
+function savvyToolchainCheck() {
+	return `if ! { [ -n "$CI" ] || [ -n "$GITHUB_ACTIONS" ]; }; then
+  toolchain_root=$(git rev-parse --show-toplevel 2>/dev/null)
+  toolchain_pm=""
+  toolchain_pin=""
+  if [ -n "$toolchain_root" ] && [ -f "$toolchain_root/package.json" ] && command -v jq >/dev/null 2>&1; then
+    toolchain_pm=$(jq -r '.devEngines.packageManager.name // empty' "$toolchain_root/package.json" 2>/dev/null)
+    toolchain_pin=$(jq -r '.devEngines.packageManager.version // empty' "$toolchain_root/package.json" 2>/dev/null | cut -d'+' -f1)
+  fi
+  # Only an exact pin is comparable: drop ranges (^ ~ >= ||) and wildcards (x, *).
+  case "$toolchain_pin" in ""|[!0-9]*|*[!0-9A-Za-z.-]*|*x*|*X*) toolchain_pin="" ;; esac
+  if [ -n "$toolchain_pm" ] && [ -n "$toolchain_pin" ] && command -v "$toolchain_pm" >/dev/null 2>&1; then
+    toolchain_have=$("$toolchain_pm" --version 2>/dev/null | head -n 1 | tr -d '[:space:]')
+    # A manager that failed or answered with prose says nothing about drift.
+    case "$toolchain_have" in [!0-9]*|*[!0-9A-Za-z.-]*) toolchain_have="" ;; esac
+    if [ -n "$toolchain_have" ] && [ "$toolchain_have" != "$toolchain_pin" ]; then
+      printf '⚠ %s %s does not match %s, the version pinned in devEngines.packageManager.\\n' "$toolchain_pm" "$toolchain_have" "$toolchain_pin" >&2
+      printf '  Lockfiles written by this version may differ from CI. Fix: corepack use %s@%s\\n' "$toolchain_pm" "$toolchain_pin" >&2
+    fi
+  fi
+  unset toolchain_root toolchain_pm toolchain_pin toolchain_have
+fi`;
+}
+
+//#endregion
+export { SavvyBaseSection, SavvyHooksSection, SavvyToolchainSection, savvyBasePreamble, savvyHooksHygiene, savvyToolSection, savvyToolchainCheck };