@xemahq/repo-build-tooling 0.26.5 → 0.27.0

package/README.md

@@ -34,7 +34,6 @@ pnpm exec xema-scrub-swagger-paths dist
 | `xema-arm64-supplement-needed` | Decides whether an arm64 supplement is still owed at `REGISTRY/IMAGE:CONTENT_TAG` (env: `REGISTRY`, `IMAGE`, `CONTENT_TAG`, `REGISTRY_USER`, `REGISTRY_TOKEN`). `needed=false` only when the coordinate serves an index whose linux/arm64 child is proven by its own image config; any other resolvable state is `needed=true`; a 401/403/5xx or an unresolvable child is an error. Writes `needed=true\|false` to `$GITHUB_OUTPUT`. Replaces the generated `arm64-supplement-needed.mjs` copy. |
 | `xema-promote-image --service <name> --dev-ref <repo> --release-ref <repo> --tag <tag> --commit <sha> --main-ref <ref> --signer-repository <owner/repo> --develop-workflow <file> --release-workflow <file>... [--release-index-workflow <file>] --promotion-predicate-out <path> -- <tag command>` | Publishes the develop image's digest under the release tag instead of rebuilding: `reused` (the release digest carries an `image-promotion/v1` attestation signed by a `--release-workflow` identity on main, with exactly one verified statement about the digest and a `ghcr.io/<owner>/dev/<name>` source; no dev-ref probe), `copied` (the proven develop digest, digest-preserving; fails closed if the release digest differs) or `miss` (build it; a reuse whose release digest has no `image-promotion/v1` attestation, a legacy image, is a miss with `reason=reuse-no-promotion` on the stdout line; with `--release-index-workflow`, a release tag that names an image index signed by that workflow on main, with exactly one `linux/amd64` child whose own digest passes that same reuse check, is instead `reused` with `evidence=release-index`, `digest` = the amd64 child A, `index_digest` = the index D and no predicate, but only when A's selected promotion statement promotes `--commit` itself (a rerun; a later commit with the same content takes the existing miss and attests its own promotion). On `evidence=release-index` the caller skips sign/attest, tags `:<sha>` and `main-<sha>` to the amd64 subject `digest` (release-arm64 resolves `:<sha>` to it and verifies its promotion), and points only the content tag (and `latest`, if it moves it) at the index `index_digest`. Any failed step keeps the miss, and two amd64 children are an error; a signature or identity failure, or a source outside `dev/`, is an error; a copy whose dev digest carries no SLSA v1 provenance at all, an image reused on develop from before provenance, is a miss with `reason=copy-no-develop-provenance`, while provenance that is present but fails a leg is an error). A develop digest is proven only if its SLSA v1 provenance is signed by the develop workflow at `refs/heads/develop`, its revision is an ancestor of the main ref, and the tag command prints the same tag at that revision and at `--commit`; any failed leg is an error, never a miss. On every non-miss result it writes the `https://xema.dev/attestations/image-promotion/v1` predicate for the caller to attest: a copy states the facts just proved; a reuse states this run's `release` and `promotedCommit` and carries `source` and `developProvenance` from the earlier promotion. Writes `result`, `digest`, `source`, `revision`, `evidence`, `provenance_digest`, `promotion_predicate`, `promotion_predicate_type` to `$GITHUB_OUTPUT`. Needs `docker`, `cosign` (major v2, the same as the develop attest step and xema-deploy's verify; it runs `cosign version` first and refuses any other major or an unparsable version), `git` and full history. It does not sign |
 | `xema-check-no-vendored-deps` | Fails on a `workspace:` range for a package the repository does not own |
-| `xema-prepush-sanity` | Lefthook `pre-push`: turbo `lint` and `typecheck` on what the push changes plus dependents, and `test` and `openapi:current` (where defined) only on the packages the push changed; a fleet-wide change runs only `lint` and `typecheck` on the full graph; root `lint` only without turbo; a park-only push (`refs/xema-session/*`) skips |
 | `xema-check-workspace-ranges` | Fails on a `workspace:` range the local package does not satisfy |
 
 `xema-composed-image members --write|--check` accepts `--manifests <glob>` (repeatable, default `**/xema-biome.json`), `--canonical-dockerfile <path>` and `--cross-repo-manifest <path>`. `xema-composed-image dockerfile` requires `--copy`, `--cache-id` and `--build-source`; it pins the version of this tool itself, and there is no flag for it (`--tooling-version` is refused as an unknown option).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.26.5",
+  "version": "0.27.0",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -25,8 +25,6 @@
     "xema-check-no-vendored-deps": "src/check-no-vendored-deps.mjs",
     "xema-check-workspace-ranges": "src/check-workspace-range-matches-local.mjs",
     "xema-composed-image": "src/composed-image.mjs",
-    "xema-install-git-hooks": "src/install-git-hooks.mjs",
-    "xema-prepush-sanity": "src/prepush-sanity.mjs",
     "xema-promote-image": "src/promote-image.mjs",
     "xema-readiness": "src/readiness.mjs",
     "xema-scrub-swagger-paths": "src/scrub-swagger-plugin-paths.mjs",
@@ -38,9 +36,7 @@
     "./check-no-vendored-deps": "./src/check-no-vendored-deps.mjs",
     "./check-workspace-range-matches-local": "./src/check-workspace-range-matches-local.mjs",
     "./composed-image": "./src/composed-image.mjs",
-    "./install-git-hooks": "./src/install-git-hooks.mjs",
     "./package.json": "./package.json",
-    "./prepush-sanity": "./src/prepush-sanity.mjs",
     "./promote-image": "./src/promote-image.mjs",
     "./readiness": "./src/readiness.mjs",
     "./scrub-swagger-plugin-paths": "./src/scrub-swagger-plugin-paths.mjs",
@@ -51,9 +47,9 @@
     "@xemahq/release-policy": "^16.0.0"
   },
   "scripts": {
-    "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/prepush-sanity.test.mjs && node --test src/service-image.test.mjs && node --test src/install-git-hooks.test.mjs && node --test src/image-cpu-arch.test.mjs"
+    "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/service-image.test.mjs && node --test src/image-cpu-arch.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:f0df75e0b53e7d061fca29cca85baadc3e8d20ac245220164fe16d5e3f051adc"
+    "sourceDigest": "sha256:4a2cf6b565691b2837d7562f58925a40e3ad2284eded9395b72a74312788d417"
   }
 }

package/src/scrub-swagger-plugin-paths.mjs

@@ -129,7 +129,7 @@
 
 import { createRequire } from 'node:module';
 import { readFileSync, realpathSync } from 'node:fs';
-import { mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, readdir, readFile, rm, stat, symlink, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import process from 'node:process';
@@ -168,14 +168,14 @@ const FLAT_LEAK_REGEX = new RegExp(
 // and down into the contracts package.  There is no `node_modules/` segment
 // so shapes 1 and 2 above never fire.
 // Capture group 1: relative path from the scrubbed file to the package directory.
-// Capture group 2: first path segment after dist/ = the subpath export name.
+// Capture group 2: everything after dist/ (the physical subpath inside the package).
 // The public package name is NOT derived from the directory name or a fixed
 // scope: it is read from the target package's own package.json `name`, so
 // unscoped and differently-named workspace packages resolve correctly.
 // Scoped to paths that pass through `packages/`, `biomes/`, or `kernel/` to
 // avoid false-positive matches on intra-service relative requires.
 const RELATIVE_WORKSPACE_REGEX = new RegExp(
-  `require\\("((?:\\.\\./)+(?:packages|biomes|kernel)/(?:[a-z0-9][a-z0-9.-]*/)*[a-z0-9][a-z0-9.-]*)/dist/([a-z0-9][a-z0-9-]*)(?:/[^"]*)?"\\)`,
+  `require\\("((?:\\.\\./)+(?:packages|biomes|kernel)/(?:[a-z0-9][a-z0-9.-]*/)*[a-z0-9][a-z0-9.-]*)/dist/([a-z0-9][a-z0-9-]*(?:/[^"]*)?)"\\)`,
   'g',
 );
 
@@ -323,6 +323,7 @@ function reExportsReach(entry, target, depth = 6, seen = new Set()) {
  * @param {string} pkg      e.g. `@xemahq/kernel-contracts`
  * @param {string} subpath  physical path inside the package, e.g. `dist/agent-composition/lib/x`
  * @param {string} original the full leaked specifier, for the proof and the error
+ * @param {string} [importer] the file holding the require, named in the refusal
  */
 // NUL is the separator in the cache key because it cannot occur in a package
 // name or a subpath, so no two distinct specifiers can collide on a
@@ -332,7 +333,7 @@ function reExportsReach(entry, target, depth = 6, seen = new Set()) {
 // silently, and a file no search can read is a file no audit, no review and no
 // boundary check covers. Enforced by the aggregator boundary gate
 // `grep-readable-sources`.
-function publicSpecifierFor(resolveFrom, pkg, subpath, original) {
+function publicSpecifierFor(resolveFrom, pkg, subpath, original, importer) {
   const cacheKey = `${pkg}\u0000${subpath}`;
   if (specifierCache.has(cacheKey)) return specifierCache.get(cacheKey);
 
@@ -412,6 +413,7 @@ function publicSpecifierFor(resolveFrom, pkg, subpath, original) {
   throw new ScrubFailure(
     `no public specifier of ${pkg} resolves to the same file as\n` +
       `  ${original}\n` +
+      (importer ? `  required by ${importer}\n` : '') +
       `  tried: ${candidates.length > 0 ? candidates.join(', ') : '(none — the exports map admits no matching form)'}\n` +
       `  Add the needed entry to that package's "exports", or export the symbol from a\n` +
       `  path that is public. Rewriting to a specifier that resolves elsewhere would\n` +
@@ -586,10 +588,16 @@ async function scrubFile(path) {
         `  rather than reaching through dist/.`,
     );
   }
-  out = out.replace(RELATIVE_WORKSPACE_REGEX, (match, relPackageDir, subpath) => {
+  out = out.replace(RELATIVE_WORKSPACE_REGEX, (match, relPackageDir, rest) => {
     count += 1;
     const name = packageNameAt(resolve(dirname(path), relPackageDir), match);
-    return `require("${name}/${subpath}")`;
+    // Through the target's own `exports` map, never a hardcoded `<name>/<seg>`:
+    // a package that exports only "." has no such subpath, and the old form
+    // crashed at runtime with ERR_PACKAGE_PATH_NOT_EXPORTED. When the root
+    // barrel re-exports the file, the root is the proved public form; when no
+    // exported subpath reaches it, the build refuses.
+    const original = match.slice('require("'.length, -2);
+    return `require("${publicSpecifierFor(resolveFrom, name, `dist/${rest}`, original, path)}")`;
   });
   if (count > 0) {
     await writeFile(path, out, 'utf8');
@@ -712,6 +720,13 @@ async function expectFailure(label, fn) {
   return threw;
 }
 
+/** Make `name` resolvable from `consumerDir` the way a workspace install does. */
+async function linkWorkspacePackage(consumerDir, name, packageDir) {
+  const link = join(consumerDir, 'node_modules', name);
+  await mkdir(dirname(link), { recursive: true });
+  await symlink(packageDir, link, 'dir');
+}
+
 async function selfTest() {
   const root = await mkdtemp(join(tmpdir(), 'scrub-swagger-selftest-'));
   try {
@@ -830,11 +845,18 @@ async function selfTest() {
       ['packages/contracts/plain-dir', 'plain-contract'],
       ['packages/contracts/other-dir', '@xemahq/renamed'],
     ];
+    await mkdir(join(ws, 'services/svc/dist'), { recursive: true });
     for (const [dir, name] of pkgs) {
       await mkdir(join(ws, dir, 'dist/lib'), { recursive: true });
-      await writeFile(join(ws, dir, 'package.json'), JSON.stringify({ name }), 'utf8');
+      await writeFile(
+        join(ws, dir, 'package.json'),
+        JSON.stringify({ name, exports: { './*': './dist/*/index.js' } }),
+        'utf8',
+      );
+      await writeFile(join(ws, dir, 'dist/lib/index.js'), 'module.exports = require("./x");\n', 'utf8');
+      await writeFile(join(ws, dir, 'dist/lib/x.js'), 'module.exports = {};\n', 'utf8');
+      await linkWorkspacePackage(join(ws, 'services/svc'), name, join(ws, dir));
     }
-    await mkdir(join(ws, 'services/svc/dist'), { recursive: true });
     const wsFile = join(ws, 'services/svc/dist/dto.js');
     const relOf = (dir) => `../../../${dir}/dist/lib/x`;
     await writeFile(
@@ -851,6 +873,42 @@ async function selfTest() {
         throw new Error(`self-test: relative-workspace rewrite missing ${expected}: ${wsAfter}`);
       }
     }
+
+    // 4c. A package that exports ONLY "." (xema-base authorization-nest). The
+    // swagger plugin requires the enum's declaring file; `<name>/<file>` is not
+    // exported and crashed at runtime with ERR_PACKAGE_PATH_NOT_EXPORTED.
+    //   - root barrel re-exports the file -> the root is the proved form;
+    //   - no exported subpath reaches the file -> the build refuses, naming the
+    //     package, the file and the importing module.
+    const dot = join(root, 'dot');
+    const dotPkg = join(dot, 'packages/sdks/dot-only');
+    await mkdir(join(dotPkg, 'dist'), { recursive: true });
+    await mkdir(join(dot, 'svc/dist'), { recursive: true });
+    await writeFile(
+      join(dotPkg, 'package.json'),
+      JSON.stringify({ name: '@xemahq/dot-only', exports: { '.': './dist/index.js' } }),
+      'utf8',
+    );
+    await writeFile(join(dotPkg, 'dist/index.js'), 'module.exports = require("./grant-wire");\n', 'utf8');
+    await writeFile(join(dotPkg, 'dist/grant-wire.js'), 'module.exports = { Kind: {} };\n', 'utf8');
+    await writeFile(join(dotPkg, 'dist/internal-only.js'), 'module.exports = { Hidden: {} };\n', 'utf8');
+    await linkWorkspacePackage(join(dot, 'svc'), '@xemahq/dot-only', dotPkg);
+    const dotDto = (file) =>
+      `class Dto {\n  static _OPENAPI_METADATA_FACTORY() {\n    return { kind: { type: () => require("../../packages/sdks/dot-only/dist/${file}").Kind } };\n  }\n}\n`;
+    const dotFile = join(dot, 'svc/dist/dto.js');
+    await writeFile(dotFile, dotDto('grant-wire'), 'utf8');
+    await run([join(dot, 'svc/dist')]);
+    const dotAfter = await readFile(dotFile, 'utf8');
+    if (!dotAfter.includes('require("@xemahq/dot-only").Kind') || dotAfter.includes('dot-only/')) {
+      throw new Error(`self-test: a "."-only package must map to its root, got: ${dotAfter}`);
+    }
+    await writeFile(dotFile, dotDto('internal-only'), 'utf8');
+    const dotRefusal = await expectFailure('unexported file no exported subpath reaches', () => run([join(dot, 'svc/dist')]));
+    for (const named of ['@xemahq/dot-only', 'internal-only', dotFile]) {
+      if (!dotRefusal.message.includes(named)) {
+        throw new Error(`self-test: the refusal must name ${named}; got: ${dotRefusal.message}`);
+      }
+    }
     // A target directory without its own package.json is a hard failure.
     const orphan = join(root, 'orphan');
     await mkdir(join(orphan, 'svc/dist'), { recursive: true });

package/src/install-git-hooks.mjs

@@ -1,323 +0,0 @@
-#!/usr/bin/env node
-// ═══════════════════════════════════════════════════════════════════════════
-// `xema-install-git-hooks` — run from `prepare`: install the lefthook git hooks, but only where hooks can exist.
-//
-// `prepare` runs on EVERY `pnpm install`, and one of those installs happens
-// inside the service Docker image build, which has neither a `.git` directory
-// (the build context excludes it) nor a `git` binary. A bare
-// `"prepare": "lefthook install"` therefore fails the image build outright:
-//
-//     . prepare: Error: exec: "git": executable file not found in $PATH
-//     ERROR: failed to solve: process "... pnpm install --offline
-//            --filter ${SERVICE}... --frozen-lockfile" exit code: 1
-//
-// That is not a hook problem to work around — it is a category error. Git
-// hooks are a property of a developer's WORKING TREE; an image build has no
-// working tree to hook, so there is nothing to install and nothing has gone
-// wrong. This script says exactly that, out loud, and exits 0.
-//
-// What it does NOT do is swallow a real failure. In an actual git work tree
-// the install must succeed: a non-zero `lefthook install` propagates, because
-// a developer whose pre-push hook silently failed to install is a developer
-// who finds out from CI instead. The two outcomes are distinguished by a
-// deterministic fact — "is there a git work tree here" — never by an `|| true`.
-//
-// ── WHY THIS SCRIPT RESOLVES THE BINARY ITSELF ────────────────────────────
-//
-// It used to `spawnSync('lefthook', …)`, i.e. rely on PATH / the caller's
-// `.bin/`. Inside the AGGREGATOR checkout that is unreachable for a carved
-// repository, and the failure was silent in both halves:
-//
-//   1. `lefthook install` bakes an ABSOLUTE path to the binary that ran it
-//      into the generated hook (measured: re-running `install` from a
-//      different binary rewrites that line). A carved repo's hook was baked by
-//      a `pnpm install` run INSIDE that repo — the escape hatch — so it points
-//      at `repos/<repo>/node_modules/.pnpm/lefthook-*/bin/lefthook`.
-//   2. That store is exactly what `.claude/rules/package-store-ownership.md`
-//      forbids and `tooling/dev/repair-package-stores.mjs` deletes. Afterwards
-//      the baked path dangles, and every remaining fallback in lefthook's
-//      generated hook misses too: lefthook is not on PATH, and a carved repo
-//      root is not an aggregator workspace member, so it has no `node_modules`
-//      and no `.bin/` at all.
-//   3. lefthook's generated hook ends its search with
-//      `echo "Can't find lefthook in PATH"` — and NO non-zero exit. So the
-//      hook printed a warning and returned 0. Measured 2026-08-17: every one
-//      of the ten carved repositories' `pre-push` hooks was in this state, so
-//      every local push in this checkout was unguarded while LOOKING guarded.
-//
-// The fix is the pattern `package-store-ownership.md` already documents for
-// carved root scripts: resolve by PATH-INDEPENDENT node resolution instead of
-// a binary name. `createRequire(...).resolve('lefthook/bin/index.js')` walks up
-// from this file — `repos/<repo>/node_modules` (absent) → the aggregator's
-// `node_modules` (present) — and in a standalone clone it finds the repo's own
-// copy on the first hop. Same script, both topologies, no per-machine config.
-//
-// ── AND WHY IT HARDENS THE GENERATED HOOK ─────────────────────────────────
-//
-// Resolving the binary fixes today's breakage. It does not fix the SHAPE of
-// the defect: a baked absolute path can dangle again — another store repair,
-// a `pnpm store prune`, a different machine, a moved checkout — and lefthook's
-// template would once more warn-and-return-0. A gate whose only failure mode
-// is a message nobody reads is the failure this repository names most often.
-//
-// So after installing, every generated hook's dead-end branch is rewritten to
-// print the reason and `exit 1`. An unresolvable lefthook now REFUSES the
-// push instead of waving it through; `git push --no-verify` remains the
-// deliberate, visible bypass.
-//
-// The rewrite ASSERTS rather than assumes: the marker must be present exactly
-// once in freshly generated content, and if lefthook's template ever changes
-// so it is not, this fails loudly instead of leaving hooks quietly unhardened.
-//
-// ── AND WHY IT SWEEPS SUBMODULES ──────────────────────────────────────────
-//
-// A carved repository's root is not an aggregator workspace member, so its own
-// `prepare` NEVER runs from an aggregator install — which is why the fix above
-// would otherwise be inert in the only checkout that has the bug. The
-// aggregator install already owns every `node_modules` beneath `repos/`
-// (`package-store-ownership.md`); it therefore owns the hooks baked against
-// them. Each submodule that carries a lefthook config gets the same install +
-// hardening, from the same resolved binary.
-//
-// In a standalone carved clone this loop is naturally inert — those
-// repositories have no submodules — so one byte-identical script serves both.
-// ═══════════════════════════════════════════════════════════════════════════
-
-import { spawnSync } from 'node:child_process';
-import { createRequire } from 'node:module';
-import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-
-/** Printed with a stable prefix so the reason is greppable in build logs. */
-const TAG = '[prepare:git-hooks]';
-
-/** The directory `prepare` runs in: the repository (or aggregator) root. */
-const ROOT = process.cwd();
-
-function skip(reason) {
-  console.log(`${TAG} skipped — ${reason}. Nothing to install here.`);
-  process.exit(0);
-}
-
-function die(message) {
-  console.error(`${TAG} ${message}`);
-  process.exit(1);
-}
-
-// ── 1. Is there anything to hook at all? ──────────────────────────────────
-//
-// `git rev-parse --git-dir` is the cheapest total answer to "is this a git
-// work tree": it is non-zero outside one, and ENOENT when git is absent
-// entirely. Both are the same verdict — no tree, no hooks.
-// This is a dev tool, not service code, so it may read the process env.
-if (process.env.CI === 'true' || process.env.GITHUB_ACTIONS === 'true') {
-  skip("CI runner: git hooks belong to a developer's working tree");
-}
-
-const probe = spawnSync('git', ['rev-parse', '--git-dir'], { stdio: 'ignore' });
-
-if (probe.error?.code === 'ENOENT') {
-  skip('no `git` executable on PATH (image build / CI container)');
-}
-if (probe.error) {
-  skip(`could not probe for a git work tree (${probe.error.message})`);
-}
-if (probe.status !== 0) {
-  skip('not inside a git work tree (installed as a dependency or tarball)');
-}
-
-// ── 2. One-time migration off the hand-rolled `.husky/` directory ─────────
-//
-// This repository used to point `core.hooksPath` at a tracked `.husky/`, wired
-// up by every developer running `git config core.hooksPath .husky` BY HAND —
-// which is why almost nobody was wired up. lefthook writes into `.git/hooks`,
-// and a stale `core.hooksPath` silently wins over it, so the install would
-// report success while no hook ever fired.
-//
-// Cleared ONLY when it points at a directory that no longer exists. A
-// `core.hooksPath` someone set deliberately, to somewhere real, is left alone.
-const hooksPath = spawnSync('git', ['config', '--get', 'core.hooksPath'], {
-  encoding: 'utf8',
-});
-const configured = (hooksPath.stdout ?? '').trim();
-if (configured.length > 0 && !existsSync(configured)) {
-  console.log(
-    `${TAG} clearing core.hooksPath -> ${configured} (that directory is gone; ` +
-      'it would silently win over the hooks installed below)',
-  );
-  const unset = spawnSync('git', ['config', '--unset', 'core.hooksPath'], {
-    stdio: 'inherit',
-  });
-  if (unset.status !== 0) {
-    die(
-      'could not clear core.hooksPath. Run `git config --unset core.hooksPath` ' +
-        'yourself, or the hooks below will not fire.',
-    );
-  }
-}
-
-// ── 3. Resolve the lefthook launcher, PATH-independently ──────────────────
-//
-// See the header. `lefthook`'s npm package exposes `bin/index.js`, a Node
-// launcher that execs the platform binary; the binary reports its OWN absolute
-// path to `lefthook install`, which is the path that gets baked into the hook.
-// So resolving the launcher is enough to fix what gets baked.
-//
-// Resolved from the repository root, not from this file: when installed as a
-// dependency this file lives in a package store that cannot see the repo's
-// own `lefthook` devDependency.
-const require = createRequire(join(ROOT, 'package.json'));
-
-let launcher;
-try {
-  launcher = require.resolve('lefthook/bin/index.js');
-} catch {
-  // Reachable when the tree was installed with `--ignore-scripts` semantics or
-  // a filtered/production install that omits root devDependencies. Loud, but
-  // not fatal: the hooks are a dev affordance, and the install itself is fine.
-  skip('`lefthook` is not installed (root devDependencies were not installed)');
-}
-
-// ── 4. Hardening the generated hook ───────────────────────────────────────
-
-/**
- * lefthook's dead end. Present verbatim in every hook it generates (2.1.10),
- * as the `else` arm of the binary search in `call_lefthook`. It prints and
- * falls out of the function, so the hook exits 0 and the operation proceeds
- * completely unverified.
- */
-const DEAD_END = '      echo "Can\'t find lefthook in PATH"\n';
-
-/** Proof our rewrite is already applied — makes the pass idempotent. */
-const SENTINEL = '# xema:lefthook-unresolved-is-fatal';
-
-/**
- * The replacement. Single-quoted so nothing in it is expanded by `sh`, and
- * written to stderr because that is where a refusal belongs. `exit 1` inside a
- * shell function exits the whole hook, which is exactly the intent.
- */
-const REFUSAL = [
-  `      ${SENTINEL}`,
-  "      echo 'lefthook is installed as a git hook here, but its binary cannot' >&2",
-  "      echo 'be found — so THIS HOOK JUST VERIFIED NOTHING.' >&2",
-  "      echo '' >&2",
-  "      echo 'Refusing the operation rather than letting it through unguarded.' >&2",
-  "      echo '' >&2",
-  "      echo '  Fix: run `pnpm install` in the checkout that owns this tree' >&2",
-  "      echo '       node_modules. That re-runs prepare, which re-bakes this' >&2",
-  "      echo '       hook against a binary that exists.' >&2",
-  "      echo '  Deliberate bypass: git push --no-verify' >&2",
-  '      exit 1',
-  '',
-].join('\n');
-
-/**
- * Rewrite one generated hook so an unresolvable lefthook is fatal.
- * @returns {'hardened'|'already'} never silently "nothing to do".
- */
-function hardenHookFile(file) {
-  const source = readFileSync(file, 'utf8');
-
-  if (source.includes(SENTINEL)) return 'already';
-
-  const occurrences = source.split(DEAD_END).length - 1;
-  if (occurrences !== 1) {
-    die(
-      `cannot harden ${file}: expected lefthook's "can't find" branch exactly ` +
-        `once, found ${occurrences}. lefthook's hook template has changed — ` +
-        're-derive this rewrite rather than leaving hooks unhardened.',
-    );
-  }
-
-  writeFileSync(file, source.replace(DEAD_END, REFUSAL), { mode: 0o755 });
-  return 'hardened';
-}
-
-// ── 5. Install + harden, here and in every hooked submodule ───────────────
-
-/** Absolute path to a work tree's hooks directory, per git itself. */
-function hooksDirOf(cwd) {
-  const out = spawnSync(
-    'git',
-    ['rev-parse', '--path-format=absolute', '--git-path', 'hooks'],
-    { cwd, encoding: 'utf8' },
-  );
-  if (out.status !== 0) return null;
-  const dir = (out.stdout ?? '').trim();
-  return dir.length > 0 ? dir : null;
-}
-
-function installIn(cwd, label) {
-  const install = spawnSync(process.execPath, [launcher, 'install'], {
-    cwd,
-    stdio: 'inherit',
-  });
-
-  if (install.error) {
-    die(`failed to run \`lefthook install\` in ${label}: ${install.error.message}`);
-  }
-  if (install.status !== 0) {
-    die(
-      `\`lefthook install\` exited ${install.status} in ${label}. Git hooks are ` +
-        'NOT installed; fix this rather than pushing without them.',
-    );
-  }
-
-  const dir = hooksDirOf(cwd);
-  if (dir === null || !existsSync(dir)) {
-    die(`\`lefthook install\` reported success in ${label} but ${dir ?? 'its hooks directory'} does not exist.`);
-  }
-
-  // Harden every hook lefthook generated — identified by the search function
-  // it writes, so a pre-existing hand-written hook is never touched.
-  let hardened = 0;
-  for (const name of readdirSync(dir)) {
-    if (name.endsWith('.sample')) continue;
-    const file = join(dir, name);
-    if (!statSync(file).isFile()) continue;
-    const body = readFileSync(file, 'utf8');
-    if (!body.includes('call_lefthook')) continue;
-    if (hardenHookFile(file) === 'hardened') hardened += 1;
-  }
-
-  if (hardened > 0) {
-    console.log(`${TAG} ${label}: hardened ${hardened} hook(s) — an unresolvable lefthook now exits 1.`);
-  }
-}
-
-installIn(ROOT, '.');
-
-// Submodules that carry their own lefthook config. Read from `.gitmodules`
-// rather than `git submodule foreach`, which would spawn a shell per entry
-// across a 28-submodule tree for a question two greps answer.
-const CONFIGS = ['lefthook.yml', 'lefthook.yaml', '.lefthook.yml', '.lefthook.yaml'];
-
-const gitmodules = resolve(ROOT, '.gitmodules');
-if (existsSync(gitmodules)) {
-  const listed = spawnSync(
-    'git',
-    ['config', '--file', gitmodules, '--get-regexp', String.raw`^submodule\..*\.path$`],
-    { encoding: 'utf8' },
-  );
-
-  // Exit 1 means "no matching keys", which is a legitimate empty answer.
-  if (listed.status !== 0 && listed.status !== 1) {
-    die(`could not read submodule paths from ${gitmodules} (exit ${listed.status}).`);
-  }
-
-  const paths = (listed.stdout ?? '')
-    .split('\n')
-    .map((line) => line.split(' ').slice(1).join(' ').trim())
-    .filter((p) => p.length > 0);
-
-  for (const rel of paths) {
-    const dir = resolve(dirname(gitmodules), rel);
-    if (!CONFIGS.some((name) => existsSync(join(dir, name)))) continue;
-    // An uninitialised submodule is an empty directory, not a work tree.
-    if (spawnSync('git', ['rev-parse', '--git-dir'], { cwd: dir, stdio: 'ignore' }).status !== 0) {
-      console.log(`${TAG} ${rel}: not initialised — skipping (run \`git submodule update --init\`).`);
-      continue;
-    }
-    installIn(dir, rel);
-  }
-}

package/src/install-git-hooks.test.mjs

@@ -1,85 +0,0 @@
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { after, describe, it } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const SCRIPT = join(dirname(fileURLToPath(import.meta.url)), 'install-git-hooks.mjs');
-const made = [];
-
-after(() => {
-  for (const dir of made) rmSync(dir, { recursive: true, force: true });
-});
-
-function tempDir() {
-  const dir = mkdtempSync(join(tmpdir(), 'xema-hooks-'));
-  made.push(dir);
-  return dir;
-}
-
-function run(cwd, env = {}) {
-  const base = { ...process.env, CI: '', GITHUB_ACTIONS: '' };
-  return spawnSync(process.execPath, [SCRIPT], { cwd, env: { ...base, ...env }, encoding: 'utf8' });
-}
-
-/** A git work tree whose `lefthook` is a stub that writes a lefthook-shaped hook. */
-function repoWithFakeLefthook() {
-  const dir = tempDir();
-  spawnSync('git', ['init', '-q'], { cwd: dir });
-  writeFileSync(join(dir, 'package.json'), '{}');
-  const bin = join(dir, 'node_modules', 'lefthook', 'bin');
-  mkdirSync(bin, { recursive: true });
-  writeFileSync(join(dir, 'node_modules', 'lefthook', 'package.json'), '{"name":"lefthook"}');
-  writeFileSync(
-    join(bin, 'index.js'),
-    [
-      "const fs = require('node:fs');",
-      "fs.mkdirSync('.git/hooks', { recursive: true });",
-      "fs.writeFileSync('.git/hooks/pre-push', 'call_lefthook() {\\n  if x; then\\n    :\\n  else\\n      echo \"Can\\'t find lefthook in PATH\"\\n  fi\\n}\\n');",
-    ].join('\n'),
-  );
-  return dir;
-}
-
-describe('xema-install-git-hooks', () => {
-  for (const env of [{ CI: 'true' }, { GITHUB_ACTIONS: 'true' }]) {
-    it(`is a no-op on CI (${Object.keys(env)[0]})`, () => {
-      const dir = repoWithFakeLefthook();
-      const out = run(dir, env);
-      assert.equal(out.status, 0);
-      assert.match(out.stdout, /skipped — CI runner/);
-      assert.equal(existsSync(join(dir, '.git', 'hooks', 'pre-push')), false);
-    });
-  }
-
-  it('is a no-op outside a git work tree', () => {
-    const dir = tempDir();
-    const out = run(dir, { GIT_CEILING_DIRECTORIES: dirname(dir) });
-    assert.equal(out.status, 0);
-    assert.match(out.stdout, /not inside a git work tree/);
-  });
-
-  it('skips when lefthook is not installed', () => {
-    const dir = tempDir();
-    spawnSync('git', ['init', '-q'], { cwd: dir });
-    writeFileSync(join(dir, 'package.json'), '{}');
-    const out = run(dir);
-    assert.equal(out.status, 0);
-    assert.match(out.stdout, /`lefthook` is not installed/);
-  });
-
-  it('installs and hardens the hook outside CI, idempotently', () => {
-    const dir = repoWithFakeLefthook();
-    const first = run(dir);
-    assert.equal(first.status, 0, first.stderr);
-    assert.match(first.stdout, /hardened 1 hook/);
-    const hook = readFileSync(join(dir, '.git', 'hooks', 'pre-push'), 'utf8');
-    assert.match(hook, /xema:lefthook-unresolved-is-fatal/);
-    assert.match(hook, /exit 1/);
-    // Re-running regenerates then re-hardens; the stub rewrites the hook each time.
-    const second = run(dir);
-    assert.equal(second.status, 0, second.stderr);
-  });
-});

package/src/prepush-sanity.mjs

@@ -1,473 +0,0 @@
-#!/usr/bin/env node
-// ═══════════════════════════════════════════════════════════════════════════
-// Pre-push: cheap sanity on what the push changes. CI is the proof (owner
-// 10-13/10-14). One verb for every repository's lefthook `pre-push`, so the
-// logic is not copied per repo.
-//
-// With turbo (a `turbo.json` and a turbo dependency): turbo `lint`, `typecheck`,
-// `test` (unit) and `openapi:current`, each where turbo.json defines it (D136: a cheap
-// pre-push let a stale openapi spec through, and every red costs ~1h of CI). `lint` and
-// `typecheck` run on the packages the pushed commits change plus their dependents; `test`
-// and `openapi:current` only on the packages the push itself changes, and one line names the
-// dependents whose tests are left to CI (an affected-set run took 36 min for a widely used package). A change to the lockfile,
-// turbo.json, or anything in the root package.json other than its `scripts`
-// table invalidates everything and runs the full graph. A repo whose turbo carries no `lint` task also runs its root `lint`
-// script. Without turbo: the root `lint` script only (typecheck needs a build, which the hook never runs; CI has it).
-//
-// The pushed SHA is what is graded. In place when the tree is clean and the SHA
-// is HEAD, or when no differing path lies in a package the run reads or at the
-// repository root; otherwise from a `git archive` export. A delete-only push
-// (or no ref on stdin) grades nothing. A push whose every remote ref is a
-// session park (`refs/xema-session/*`) grades nothing either: a park is not a
-// landing, and the work is graded when it lands on a branch.
-//
-// A fleet-wide change runs `lint` and `typecheck` on the full graph and says it
-// leaves `test` and `openapi:current` to CI: never the full suite. Never builds
-// for its own sake, never runs docker, image builds or `pnpm check`.
-//
-// Usage (lefthook `pre-push` with `use_stdin: true`):
-//   xema-prepush-sanity
-// ═══════════════════════════════════════════════════════════════════════════
-import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, delimiter } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const ZERO_SHA = /^0+$/;
-const GIT_ENV = [
-  'GIT_DIR',
-  'GIT_WORK_TREE',
-  'GIT_COMMON_DIR',
-  'GIT_INDEX_FILE',
-  'GIT_OBJECT_DIRECTORY',
-  'GIT_ALTERNATE_OBJECT_DIRECTORIES',
-  'GIT_PREFIX',
-];
-
-/** turbo.json is JSONC: strip comments outside strings. */
-export function stripJsonc(text) {
-  let out = '';
-  for (let i = 0; i < text.length; i++) {
-    const c = text[i];
-    if (c === '"') {
-      let j = i + 1;
-      while (j < text.length && text[j] !== '"') j += text[j] === '\\' ? 2 : 1;
-      out += text.slice(i, j + 1);
-      i = j;
-    } else if (c === '/' && text[i + 1] === '/') {
-      while (i < text.length && text[i] !== '\n') i++;
-      out += '\n';
-    } else if (c === '/' && text[i + 1] === '*') {
-      const end = text.indexOf('*/', i + 2);
-      i = end === -1 ? text.length : end + 1;
-    } else {
-      out += c;
-    }
-  }
-  return out;
-}
-
-/** The tasks pre-push runs on the affected packages, in this order, where turbo.json defines them. */
-export const SANITY_TASKS = ['lint', 'typecheck', 'test', 'openapi:current'];
-/** The subset that also runs on the full graph and on dependents; the rest would be the full suite, which is CI's. */
-export const FULL_GRAPH_TASKS = ['lint', 'typecheck'];
-
-/** Package directories (a package.json below the root) among tracked file paths; node_modules never counts. */
-export function packageDirs(files) {
-  return [...new Set(files.filter((f) => f.endsWith('/package.json') && !f.includes('node_modules/')).map((f) => f.slice(0, -'/package.json'.length)))];
-}
-
-/** Paths no task reads: root-level markdown and changesets. */
-export function isInert(path) {
-  return /^[^/]*\.md$/.test(path) || path.startsWith('.changeset/');
-}
-
-/** Changed paths that sit in no workspace package and that some task may read (tsconfig.base.json, biome.json, tooling/**). They invalidate every package. */
-export function outsidePackages(changed, dirs) {
-  return changed.filter((p) => !isInert(p) && !dirs.some((d) => p.startsWith(`${d}/`)));
-}
-
-/** A push with changes whose plan holds no task checked nothing, and must say so rather than pass; null when it is fine. */
-export function emptyPlanFailure(changed, plannedTasks) {
-  if (changed.length === 0 || plannedTasks > 0) return null;
-  return `no task was planned for a push that changes ${changed.slice(0, 10).join(', ')}${changed.length > 10 ? ` (+${changed.length - 10} more)` : ''} — nothing was checked`;
-}
-
-/**
- * The turbo runs for a push. `range` '' is the full graph: lint and typecheck only. Otherwise lint and
- * typecheck run on the affected set (changed packages plus dependents), while test and openapi:current
- * run only on the packages the push itself changed: a widely used package has dozens of dependents and
- * their tests cost ~36 min (authorization-nest: 78 packages, 195 tasks). CI runs those.
- */
-export function planRuns(tasks, range) {
-  if (!range) {
-    const full = tasks.filter((t) => FULL_GRAPH_TASKS.includes(t));
-    return { runs: full.length > 0 ? [{ tasks: full, filter: null }] : [], leftToCi: tasks.filter((t) => !FULL_GRAPH_TASKS.includes(t)) };
-  }
-  const affected = tasks.filter((t) => FULL_GRAPH_TASKS.includes(t));
-  const changedOnly = tasks.filter((t) => !FULL_GRAPH_TASKS.includes(t));
-  const runs = [];
-  if (affected.length > 0) runs.push({ tasks: affected, filter: `...[${range}]` });
-  if (changedOnly.length > 0) runs.push({ tasks: changedOnly, filter: `[${range}]` });
-  return { runs, leftToCi: [] };
-}
-
-/** Package names in `affected` that are not in `changed`, sorted; the root workspace `//` is never a package. */
-export function dependentsOnly(affected, changed) {
-  const own = new Set(changed);
-  return [...new Set(affected)].filter((n) => n !== '//' && !own.has(n)).sort();
-}
-
-/** The one line naming the dependents whose test and openapi:current are left to CI. */
-export function dependentsLine(dependents, tasks) {
-  if (dependents.length === 0 || tasks.length === 0) return '';
-  return `pre-push: ${tasks.join(' ')} ran only on the changed packages; ${dependents.length} dependent(s) are left to CI: ${dependents.join(', ')}`;
-}
-
-/** The sanity tasks a turbo.json defines. An unparsable file throws: "no tasks" would report green. */
-export function turboTasks(text) {
-  const cfg = JSON.parse(stripJsonc(text));
-  const defined = cfg.tasks ?? cfg.pipeline ?? {};
-  return SANITY_TASKS.filter((t) => t in defined);
-}
-
-/** The refs git writes on a pre-push hook's stdin, one sha graded once, deletes dropped. */
-export function parseRefs(stdin) {
-  const seen = new Set();
-  const refs = [];
-  for (const line of stdin.split('\n')) {
-    const [, sha, remoteRef, remoteSha] = line.trim().split(/\s+/);
-    if (!sha || !/^[0-9a-f]+$/.test(sha) || ZERO_SHA.test(sha) || seen.has(sha)) continue;
-    seen.add(sha);
-    refs.push({ sha, remoteRef: remoteRef ?? '', remoteSha: remoteSha ?? '' });
-  }
-  return refs;
-}
-
-/** Remote refs under this prefix are session parks, not landings. */
-export const PARK_REF_PREFIX = 'refs/xema-session/';
-
-/** True when stdin names at least one ref and every remote ref is a session park. A branch anywhere in the push grades the push. */
-export function parkOnly(stdin) {
-  const remoteRefs = stdin
-    .split('\n')
-    .map((line) => line.trim().split(/\s+/)[2])
-    .filter(Boolean);
-  return remoteRefs.length > 0 && remoteRefs.every((ref) => ref.startsWith(PARK_REF_PREFIX));
-}
-
-/** True when two root package.json texts differ only in the top-level `scripts` key; a missing side or unparseable JSON is false. */
-export function scriptsOnlyChange(baseText, tipText) {
-  try {
-    const { scripts: _baseScripts, ...base } = JSON.parse(baseText);
-    const { scripts: _tipScripts, ...tip } = JSON.parse(tipText);
-    return JSON.stringify(base) === JSON.stringify(tip);
-  } catch {
-    return false;
-  }
-}
-
-/** True when a changed path invalidates every package. `rootScriptsOnly`: the root package.json change is the `scripts` table alone. */
-export function isFleetWide(changedPaths, rootScriptsOnly = false) {
-  return changedPaths.some((p) => p === 'pnpm-lock.yaml' || p === 'turbo.json' || (p === 'package.json' && !rootScriptsOnly));
-}
-
-/**
- * First differing path that stops the working tree standing in for the pushed
- * SHA, or null. `taskDirs` are the package directories the run reads;
- * `isOwned(path)` says a package.json sits above the path. Root-level *.md files
- * are the one root exception: no task reads them.
- */
-export function blockingPath(paths, taskDirs, isOwned) {
-  const dirs = taskDirs.filter((d) => d && d !== '.');
-  for (const p of paths) {
-    if (dirs.some((d) => p === d || p.startsWith(`${d}/`))) return { path: p, why: 'is in a package this run reads' };
-    if (!isOwned(p) && !/^[^/]*\.md$/.test(p)) return { path: p, why: 'is at the repository root' };
-  }
-  return null;
-}
-
-/** One turbo cache for the in-place run and every scratch export; an inherited value wins. */
-export function turboCacheDir(inherited, root) {
-  return inherited || join(root, '.turbo', 'cache');
-}
-
-function cleanEnv(root) {
-  const env = { ...process.env };
-  for (const k of GIT_ENV) delete env[k];
-  env.TURBO_CACHE_DIR = turboCacheDir(env.TURBO_CACHE_DIR, root);
-  // Appended, never prepended: it only fills a gap (the aggregator owns node_modules).
-  const sup = spawnSync('git', ['rev-parse', '--show-superproject-working-tree'], { cwd: root, env, encoding: 'utf8' });
-  const superproject = sup.status === 0 ? sup.stdout.trim() : '';
-  if (superproject && existsSync(join(superproject, 'node_modules', '.bin'))) {
-    env.PATH = `${env.PATH ?? ''}${delimiter}${join(superproject, 'node_modules', '.bin')}`;
-  }
-  return env;
-}
-
-function createContext(root) {
-  const env = cleanEnv(root);
-  const git = (args, cwd = root) => spawnSync('git', args, { cwd, env, encoding: 'utf8', maxBuffer: 1 << 28 });
-  const gitOut = (args, cwd = root) => {
-    const r = git(args, cwd);
-    return r.status === 0 ? r.stdout : null;
-  };
-  const inherit = (cmd, args, cwd) => spawnSync(cmd, args, { cwd, env, stdio: ['ignore', 'inherit', 'inherit'] }).status === 0;
-  return { root, env, git, gitOut, inherit };
-}
-
-function pickBase(ctx, { remoteSha, remoteRef }) {
-  if (remoteSha && /^[0-9a-f]+$/.test(remoteSha) && !ZERO_SHA.test(remoteSha) && ctx.git(['cat-file', '-e', `${remoteSha}^{commit}`]).status === 0) {
-    return remoteSha;
-  }
-  const target = remoteRef.replace(/^refs\/heads\//, '');
-  for (const cand of [`origin/${target}`, 'origin/develop']) {
-    const out = ctx.gitOut(['rev-parse', '--verify', '-q', `${cand}^{commit}`]);
-    if (out) return out.trim();
-  }
-  return '';
-}
-
-/** `A...B` naming the change, or '' for the full graph. */
-function rangeFor(ctx, base, sha) {
-  if (!base) {
-    console.error('pre-push: no base to diff against — running the FULL graph.');
-    return '';
-  }
-  const changed = (ctx.gitOut(['diff', '--name-only', `${base}...${sha}`]) ?? '').split('\n').filter(Boolean);
-  const rootScriptsOnly = changed.includes('package.json') && scriptsOnlyChange(ctx.gitOut(['show', `${base}:package.json`]) ?? '', ctx.gitOut(['show', `${sha}:package.json`]) ?? '');
-  if (isFleetWide(changed, rootScriptsOnly)) {
-    console.error('pre-push: lockfile, turbo.json or root package.json beyond its scripts changed — fleet-wide, running the FULL graph.');
-    return '';
-  }
-  const files = (rev) => (ctx.gitOut(['ls-tree', '-r', '--name-only', rev]) ?? '').split('\n').filter(Boolean);
-  const outside = outsidePackages(changed, packageDirs([...files(base), ...files(sha)]));
-  if (outside.length > 0) {
-    console.error(`pre-push: ${outside.slice(0, 10).join(', ')}${outside.length > 10 ? ` (+${outside.length - 10} more)` : ''} sit outside any workspace package — fleet-wide, running the FULL graph.`);
-    return '';
-  }
-  return `${base}...${sha}`;
-}
-
-function changedPaths(ctx, base, sha) {
-  return base ? (ctx.gitOut(['diff', '--name-only', `${base}...${sha}`]) ?? '').split('\n').filter(Boolean) : [];
-}
-
-function turboBin(root, env) {
-  const local = join(root, 'node_modules', '.bin', 'turbo');
-  if (existsSync(local)) return local;
-  const r = spawnSync('sh', ['-c', 'command -v turbo'], { env, encoding: 'utf8' });
-  return r.status === 0 ? r.stdout.trim() : '';
-}
-
-function declaresTurbo(dir) {
-  try {
-    const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
-    return Boolean(pkg.dependencies?.turbo ?? pkg.devDependencies?.turbo);
-  } catch {
-    return false;
-  }
-}
-
-function hasRootLint(dir) {
-  try {
-    return Boolean(JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).scripts?.lint);
-  } catch {
-    return false;
-  }
-}
-
-/** How many tasks turbo plans for `tasks` under `filter`. */
-function dryTaskCount(ctx, bin, dir, tasks, filter) {
-  const dry = spawnSync(bin, ['run', ...tasks, `--filter=${filter}`, '--dry=json'], { cwd: dir, env: ctx.env, encoding: 'utf8', maxBuffer: 1 << 28 });
-  if (dry.status !== 0) throw new Error(`turbo --dry=json failed for --filter=${filter}`);
-  return (JSON.parse(dry.stdout).tasks ?? []).length;
-}
-
-/** Package names turbo would run `tasks` for under `filter`; an unreadable plan throws rather than hide a dependent. */
-function dryPackages(ctx, bin, dir, tasks, filter) {
-  const dry = spawnSync(bin, ['run', ...tasks, `--filter=${filter}`, '--dry=json'], { cwd: dir, env: ctx.env, encoding: 'utf8', maxBuffer: 1 << 28 });
-  if (dry.status !== 0) throw new Error(`turbo --dry=json failed for --filter=${filter}`);
-  return JSON.parse(dry.stdout).packages ?? [];
-}
-
-/** Run the sanity tasks in `dir`; `range` '' is the full graph. Returns the verdict. */
-function runHere(ctx, dir, range, bin, changed) {
-  if (!bin) {
-    // Without turbo nothing orders the builds a workspace typecheck needs, and the hook never
-    // builds: typecheck there is CI's.
-    console.log('pre-push: pnpm run lint (this repository declares no turbo; typecheck is CI-only)');
-    return ctx.inherit('pnpm', ['run', 'lint'], dir);
-  }
-  let tasks;
-  try {
-    tasks = turboTasks(readFileSync(join(dir, 'turbo.json'), 'utf8'));
-  } catch (error) {
-    console.log(`pre-push: could not read the tasks from turbo.json (${error.message}) — FAILED`);
-    return false;
-  }
-  if (tasks.length === 0) {
-    console.log(`pre-push: turbo.json defines none of ${SANITY_TASKS.join(', ')} — FAILED`);
-    return false;
-  }
-  if (range) {
-    const failure = emptyPlanFailure(changed, dryTaskCount(ctx, bin, dir, tasks, `...[${range}]`));
-    if (failure) {
-      console.log(`pre-push: ${failure} — FAILED`);
-      return false;
-    }
-  }
-  const { runs, leftToCi } = planRuns(tasks, range);
-  if (leftToCi.length > 0) console.log(`pre-push: ${leftToCi.join(' ')} not run on the full graph — that is the full suite, CI runs it.`);
-  let ok = true;
-  for (const run of runs) {
-    const where = run.filter ? (run.filter.startsWith('...') ? `affected by ${range}, plus dependents` : `only the packages ${range} changes`) : 'full graph';
-    console.log(`pre-push: turbo run ${run.tasks.join(' ')} (${where})`);
-    const filterArgs = run.filter ? [`--filter=${run.filter}`] : [];
-    ok = ctx.inherit(bin, ['run', ...run.tasks, ...filterArgs, '--continue=dependencies-successful'], dir) && ok;
-  }
-  if (range) {
-    const changedOnly = tasks.filter((t) => !FULL_GRAPH_TASKS.includes(t));
-    const line = dependentsLine(dependentsOnly(dryPackages(ctx, bin, dir, tasks, `...[${range}]`), dryPackages(ctx, bin, dir, tasks, `[${range}]`)), changedOnly);
-    if (line) console.log(line);
-  }
-  // Lint that turbo does not carry is the root `lint` script CI runs.
-  if (!tasks.includes('lint') && hasRootLint(dir)) {
-    console.log('pre-push: pnpm run lint');
-    ok = ctx.inherit('pnpm', ['run', 'lint'], dir) && ok;
-  }
-  return ok;
-}
-
-function inPlaceSafe(ctx, sha, range, tasks, bin) {
-  if (!range || !bin) return false;
-  const dry = spawnSync(bin, ['run', ...tasks, `--filter=...[${range}]`, '--dry=json'], { cwd: ctx.root, env: ctx.env, encoding: 'utf8', maxBuffer: 1 << 28 });
-  if (dry.status !== 0) return false;
-  let taskDirs;
-  try {
-    taskDirs = (JSON.parse(dry.stdout).tasks ?? []).map((t) => t.directory);
-  } catch {
-    return false;
-  }
-  const paths = [
-    ctx.gitOut(['diff', '--name-only', '-z', 'HEAD']) ?? '',
-    ctx.gitOut(['ls-files', '-z', '--others', '--exclude-standard']) ?? '',
-    ctx.gitOut(['diff', '--name-only', '-z', 'HEAD', sha]) ?? '',
-  ].flatMap((s) => s.split('\0').filter(Boolean));
-  const isOwned = (p) => {
-    let dir = dirname(p);
-    while (dir !== '.' && dir !== '/') {
-      if (existsSync(join(ctx.root, dir, 'package.json'))) return true;
-      dir = dirname(dir);
-    }
-    return false;
-  };
-  const blocked = blockingPath(paths, taskDirs, isOwned);
-  if (blocked) console.error(`pre-push: ${blocked.path} ${blocked.why}`);
-  return blocked === null;
-}
-
-function exportTo(ctx, rev, dir) {
-  return spawnSync('sh', ['-c', 'git archive "$1" | tar -x -C "$2"', 'sh', rev, dir], { cwd: ctx.root, env: ctx.env }).status === 0;
-}
-
-function gradeFromExport(ctx, sha, base, range, bin, changed) {
-  const scratch = mkdtempSync(join(tmpdir(), 'xema-prepush-'));
-  try {
-    const sh = (args) => ctx.git(['-c', 'user.email=gate@local', '-c', 'user.name=gate', ...args], scratch).status === 0;
-    if (!sh(['init', '-q', '.'])) return false;
-    let exportRange = '';
-    if (range) {
-      // Two commits (base, then the graded tree) so turbo can diff them as it would a checkout.
-      if (!exportTo(ctx, base, scratch) || !sh(['add', '-A']) || !sh(['commit', '-qm', 'base'])) return false;
-      for (const name of readdirSync(scratch)) if (name !== '.git') rmSync(join(scratch, name), { recursive: true, force: true });
-      exportRange = 'HEAD~1...HEAD';
-    }
-    if (!exportTo(ctx, sha, scratch) || !sh(['add', '-A']) || !sh(['commit', '-qm', 'graded', '--allow-empty'])) return false;
-    if (!ctx.inherit('pnpm', ['install', '--frozen-lockfile', '--prefer-offline'], scratch)) {
-      console.log('pre-push: install of the export failed');
-      return false;
-    }
-    return runHere(ctx, scratch, exportRange, bin, changed);
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
-  }
-}
-
-function gradeSha(ctx, ref, bin) {
-  const { sha } = ref;
-  const base = pickBase(ctx, ref);
-  const range = rangeFor(ctx, base, sha);
-  const changed = changedPaths(ctx, base, sha);
-  if (range && changed.length > 0 && changed.every(isInert)) {
-    console.log(`pre-push: only paths no task reads changed (${changed.slice(0, 10).join(', ')}) — nothing to grade.`);
-    return true;
-  }
-  const head = (ctx.gitOut(['rev-parse', 'HEAD']) ?? '').trim();
-  const short = (rev) => (ctx.gitOut(['rev-parse', '--short', rev]) ?? rev).trim();
-  const clean = (ctx.gitOut(['status', '--porcelain']) ?? '') === '';
-  if (sha === head && clean) {
-    console.log(`pre-push: grading HEAD ${short(head)} in place (clean tree).`);
-    return runHere(ctx, ctx.root, range, bin, changed);
-  }
-  if (bin) {
-    let tasks = [];
-    try {
-      tasks = turboTasks(readFileSync(join(ctx.root, 'turbo.json'), 'utf8'));
-    } catch {
-      // runHere reports an unreadable turbo.json as the failure it is.
-    }
-    if (tasks.length > 0 && inPlaceSafe(ctx, sha, range, tasks, bin)) {
-      console.log(`pre-push: grading ${short(sha)} in place — no differing path is in a package this run reads.`);
-      return runHere(ctx, ctx.root, range, bin, changed);
-    }
-  }
-  console.log(
-    sha === head
-      ? `pre-push: grading ${short(sha)} from an export — the tree is dirty, so it is not what is being pushed.`
-      : `pre-push: grading ${short(sha)} from an export — the commit being PUSHED, which is not HEAD ${short(head)}.`,
-  );
-  return gradeFromExport(ctx, sha, base, bin ? range : '', bin, changed);
-}
-
-export function main(stdin) {
-  const top = spawnSync('git', ['rev-parse', '--show-toplevel'], { encoding: 'utf8', env: Object.fromEntries(Object.entries(process.env).filter(([k]) => !GIT_ENV.includes(k))) });
-  if (top.status !== 0) {
-    console.error('pre-push: not inside a git repository — FAILED');
-    return 1;
-  }
-  if (parkOnly(stdin)) {
-    console.log(`pre-push: skipped — every ref is a session park under ${PARK_REF_PREFIX}; parks are not landings, the gate runs when the work lands.`);
-    return 0;
-  }
-  const ctx = createContext(top.stdout.trim());
-  const refs = parseRefs(stdin);
-  if (refs.length === 0) {
-    console.log('pre-push: no ref on stdin — this push updates nothing, nothing to grade.');
-    return 0;
-  }
-  // Turbo is used only where the repository declares it; a declared turbo that does not
-  // resolve is an uninstalled checkout, and fails rather than skipping the proof.
-  let bin = '';
-  if (existsSync(join(ctx.root, 'turbo.json')) && declaresTurbo(ctx.root)) {
-    bin = turboBin(ctx.root, ctx.env);
-    if (!bin) {
-      console.log('pre-push: no turbo binary resolves — run `pnpm install --frozen-lockfile` — FAILED');
-      console.log('::error::pre-push FAILED — turbo:unavailable');
-      return 1;
-    }
-  }
-  const failed = refs.filter((ref) => !gradeSha(ctx, ref, bin)).map((ref) => ctx.gitOut(['rev-parse', '--short', ref.sha])?.trim() ?? ref.sha);
-  if (failed.length === 0) {
-    console.log(`pre-push: GREEN — sanity passed on ${refs.length} pushed commit(s).`);
-    return 0;
-  }
-  console.log(`::error::pre-push FAILED — ${failed.join(' ')}`);
-  console.log(`pre-push: FAILED — ${failed.join(' ')}`);
-  return 1;
-}
-
-if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  process.exitCode = main(process.stdin.isTTY ? '' : readFileSync(0, 'utf8'));
-}

package/src/prepush-sanity.test.mjs

@@ -1,205 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync, spawnSync } from 'node:child_process';
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-import { blockingPath, dependentsLine, emptyPlanFailure, isInert, outsidePackages, packageDirs, dependentsOnly, isFleetWide, planRuns, parkOnly, parseRefs, scriptsOnlyChange, stripJsonc, turboCacheDir, turboTasks } from './prepush-sanity.mjs';
-
-const VERB = fileURLToPath(new URL('./prepush-sanity.mjs', import.meta.url));
-const SHA_A = 'a'.repeat(40);
-const SHA_B = 'b'.repeat(40);
-
-test('stripJsonc drops comments outside strings only', () => {
-  const text = '{ // c\n "a": "x//y", /* b */ "b": 1 }';
-  assert.deepEqual(JSON.parse(stripJsonc(text)), { a: 'x//y', b: 1 });
-});
-
-test('turboTasks keeps lint and typecheck, and throws on unparsable turbo.json', () => {
-  assert.deepEqual(turboTasks('{"tasks":{"build":{},"typecheck":{},"lint":{}}}'), ['lint', 'typecheck']);
-  assert.deepEqual(turboTasks('{"tasks":{"openapi:current":{},"test":{},"build":{},"typecheck":{},"lint":{}}}'), ['lint', 'typecheck', 'test', 'openapi:current']);
-  assert.deepEqual(turboTasks('{"pipeline":{"typecheck":{}}}'), ['typecheck']);
-  assert.throws(() => turboTasks('{ nope'));
-});
-
-test('parseRefs dedupes shas and drops deletes and junk', () => {
-  const zero = '0'.repeat(40);
-  const stdin = [`refs/heads/x ${SHA_A} refs/heads/develop ${SHA_B}`, `refs/heads/y ${SHA_A} refs/heads/z ${SHA_B}`, `(delete) ${zero} refs/heads/old ${SHA_B}`, ''].join('\n');
-  assert.deepEqual(parseRefs(stdin), [{ sha: SHA_A, remoteRef: 'refs/heads/develop', remoteSha: SHA_B }]);
-  assert.deepEqual(parseRefs(''), []);
-});
-
-test('isFleetWide flags the lockfile, turbo.json and a root package.json change beyond scripts', () => {
-  assert.equal(isFleetWide(['pnpm-lock.yaml']), true);
-  assert.equal(isFleetWide(['turbo.json']), true);
-  assert.equal(isFleetWide(['package.json']), true);
-  assert.equal(isFleetWide(['package.json'], true), false);
-  assert.equal(isFleetWide(['package.json', 'pnpm-lock.yaml'], true), true);
-  assert.equal(isFleetWide(['packages/a/package.json', 'src/x.ts']), false);
-});
-
-test('scriptsOnlyChange: only the scripts key may differ; anything else or unreadable is fleet-wide', () => {
-  const base = { name: 't', scripts: { a: '1' }, dependencies: { x: '1' }, packageManager: 'pnpm@10.0.0' };
-  const text = (o) => JSON.stringify(o);
-  assert.equal(scriptsOnlyChange(text(base), text({ ...base, scripts: { a: '2', b: '3' } })), true);
-  for (const change of [{ dependencies: { x: '2' } }, { packageManager: 'pnpm@10.1.0' }, { pnpm: { overrides: {} } }, { engines: { node: '22' } }]) {
-    assert.equal(scriptsOnlyChange(text(base), text({ ...base, ...change })), false, Object.keys(change)[0]);
-  }
-  assert.equal(scriptsOnlyChange('', text(base)), false);
-  assert.equal(scriptsOnlyChange(text(base), '{ nope'), false);
-});
-
-test('blockingPath: package reads and repo-root files block, root markdown does not', () => {
-  const owned = (p) => p.startsWith('packages/');
-  assert.equal(blockingPath(['packages/a/src/x.ts'], ['packages/a'], owned)?.why, 'is in a package this run reads');
-  assert.equal(blockingPath(['packages/b/src/x.ts'], ['packages/a'], owned), null);
-  assert.equal(blockingPath(['tsconfig.base.json'], [], owned)?.why, 'is at the repository root');
-  assert.equal(blockingPath(['README.md'], [], owned), null);
-});
-
-function repo(scripts) {
-  const dir = mkdtempSync(join(tmpdir(), 'prepush-sanity-test-'));
-  const run = (...args) => execFileSync('git', args, { cwd: dir, stdio: 'pipe' });
-  run('init', '-q', '-b', 'develop');
-  run('config', 'user.email', 't@t');
-  run('config', 'user.name', 't');
-  writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: 't', private: true, scripts }));
-  run('add', '-A');
-  run('commit', '-qm', 'init');
-  const sha = run('rev-parse', 'HEAD').toString().trim();
-  return { dir, sha };
-}
-
-function hook(dir, stdin) {
-  return spawnSync('node', [VERB], { cwd: dir, input: stdin, encoding: 'utf8' });
-}
-
-test('no turbo: lint only. A failing lint refuses the push; a failing typecheck is CI-only', () => {
-  const badLint = repo({ typecheck: 'exit 0', lint: 'exit 1' });
-  const badTypecheck = repo({ typecheck: 'exit 1', lint: 'exit 0' });
-  try {
-    const refused = hook(badLint.dir, `refs/heads/x ${badLint.sha} refs/heads/develop ${'0'.repeat(40)}\n`);
-    assert.equal(refused.status, 1, refused.stdout + refused.stderr);
-    assert.match(refused.stdout, /pre-push: FAILED/);
-    const green = hook(badTypecheck.dir, `refs/heads/x ${badTypecheck.sha} refs/heads/develop ${'0'.repeat(40)}\n`);
-    assert.equal(green.status, 0, green.stdout + green.stderr);
-    assert.match(green.stdout, /GREEN/);
-  } finally {
-    rmSync(badLint.dir, { recursive: true, force: true });
-    rmSync(badTypecheck.dir, { recursive: true, force: true });
-  }
-});
-
-test('a delete-only push and a manual run grade nothing', () => {
-  const r = repo({ typecheck: 'exit 1', lint: 'exit 1' });
-  try {
-    const del = hook(r.dir, `(delete) ${'0'.repeat(40)} refs/heads/old ${r.sha}\n`);
-    assert.equal(del.status, 0, del.stdout + del.stderr);
-    assert.match(del.stdout, /nothing to grade/);
-    assert.equal(hook(r.dir, '').status, 0);
-  } finally {
-    rmSync(r.dir, { recursive: true, force: true });
-  }
-});
-
-test('turboCacheDir defaults to the repo root and keeps an inherited value', () => {
-  assert.equal(turboCacheDir('', '/r'), '/r/.turbo/cache');
-  assert.equal(turboCacheDir(undefined, '/r'), '/r/.turbo/cache');
-  assert.equal(turboCacheDir('/shared', '/r'), '/shared');
-});
-
-test('the turbo invocation receives TURBO_CACHE_DIR', () => {
-  const r = repo({});
-  try {
-    writeFileSync(join(r.dir, 'package.json'), JSON.stringify({ name: 't', private: true, devDependencies: { turbo: '^2' } }));
-    writeFileSync(join(r.dir, 'turbo.json'), JSON.stringify({ tasks: { typecheck: {} } }));
-    mkdirSync(join(r.dir, 'node_modules', '.bin'), { recursive: true });
-    const fake = join(r.dir, 'node_modules', '.bin', 'turbo');
-    const seen = join(r.dir, 'seen.txt');
-    writeFileSync(fake, `#!/bin/sh\nprintf '%s' "$TURBO_CACHE_DIR" > '${seen}'\n`);
-    chmodSync(fake, 0o755);
-    writeFileSync(join(r.dir, '.gitignore'), 'node_modules\nseen.txt\n');
-    execFileSync('git', ['add', '-A'], { cwd: r.dir });
-    execFileSync('git', ['commit', '-qm', 'turbo'], { cwd: r.dir });
-    const sha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: r.dir }).toString().trim();
-    const stdin = `refs/heads/x ${sha} refs/heads/develop ${'0'.repeat(40)}\n`;
-    const env = { ...process.env };
-    delete env.TURBO_CACHE_DIR;
-    const run = (e) => spawnSync('node', [VERB], { cwd: r.dir, input: stdin, encoding: 'utf8', env: e });
-    const first = run(env);
-    assert.equal(first.status, 0, first.stdout + first.stderr);
-    assert.equal(readFileSync(seen, 'utf8'), join(realpathSync(r.dir), '.turbo', 'cache'));
-    const second = run({ ...env, TURBO_CACHE_DIR: '/inherited/cache' });
-    assert.equal(second.status, 0, second.stdout + second.stderr);
-    assert.equal(readFileSync(seen, 'utf8'), '/inherited/cache');
-  } finally {
-    rmSync(r.dir, { recursive: true, force: true });
-  }
-});
-
-test('parkOnly: only a push whose every remote ref is a session park', () => {
-  const park = `refs/heads/x ${SHA_A} refs/xema-session/lead/T1/x ${'0'.repeat(40)}`;
-  const dev = `refs/heads/x ${SHA_A} refs/heads/develop ${SHA_B}`;
-  assert.equal(parkOnly(`${park}\n`), true);
-  assert.equal(parkOnly(`(delete) ${'0'.repeat(40)} refs/xema-session/lead/T1/x ${SHA_A}\n`), true);
-  assert.equal(parkOnly(`${park}\n${dev}\n`), false);
-  assert.equal(parkOnly(`${dev}\n`), false);
-  assert.equal(parkOnly(`refs/heads/x ${SHA_A} refs/heads/main ${SHA_B}\n`), false);
-  assert.equal(parkOnly(`refs/heads/x ${SHA_A} refs/heads/xema-session/x ${SHA_B}\n`), false);
-  assert.equal(parkOnly(''), false);
-});
-
-test('a park-only push skips and says why; a park beside develop still grades', () => {
-  const r = repo({ typecheck: 'exit 1', lint: 'exit 1' });
-  try {
-    const parked = hook(r.dir, `refs/heads/x ${r.sha} refs/xema-session/lead/T1/x ${'0'.repeat(40)}\n`);
-    assert.equal(parked.status, 0, parked.stdout + parked.stderr);
-    assert.match(parked.stdout, /skipped — every ref is a session park/);
-    const mixed = hook(r.dir, `refs/heads/x ${r.sha} refs/xema-session/lead/T1/x ${'0'.repeat(40)}\nrefs/heads/x ${r.sha} refs/heads/develop ${'0'.repeat(40)}\n`);
-    assert.equal(mixed.status, 1, mixed.stdout + mixed.stderr);
-    assert.match(mixed.stdout, /pre-push: FAILED/);
-  } finally {
-    rmSync(r.dir, { recursive: true, force: true });
-  }
-});
-
-test('planRuns: affected set for lint and typecheck, changed packages only for test and openapi:current', () => {
-  const tasks = ['lint', 'typecheck', 'test', 'openapi:current'];
-  assert.deepEqual(planRuns(tasks, 'A...B'), {
-    runs: [
-      { tasks: ['lint', 'typecheck'], filter: '...[A...B]' },
-      { tasks: ['test', 'openapi:current'], filter: '[A...B]' },
-    ],
-    leftToCi: [],
-  });
-  assert.deepEqual(planRuns(['test'], 'A...B').runs, [{ tasks: ['test'], filter: '[A...B]' }]);
-});
-
-test('planRuns: a root-file change runs lint and typecheck on all and leaves the rest to CI', () => {
-  assert.deepEqual(planRuns(['lint', 'typecheck', 'test'], ''), { runs: [{ tasks: ['lint', 'typecheck'], filter: null }], leftToCi: ['test'] });
-  assert.deepEqual(planRuns(['test'], ''), { runs: [], leftToCi: ['test'] });
-});
-
-test('dependentsOnly and dependentsLine name the dependents left to CI', () => {
-  const dependents = dependentsOnly(['//', 'b', 'a', 'c', 'a'], ['c']);
-  assert.deepEqual(dependents, ['a', 'b']);
-  assert.match(dependentsLine(dependents, ['test', 'openapi:current']), /test openapi:current ran only on the changed packages; 2 dependent\(s\) are left to CI: a, b/);
-  assert.equal(dependentsLine([], ['test']), '');
-  assert.equal(dependentsLine(['a'], []), '');
-});
-
-test('a path outside every workspace package is fleet-wide; package files and inert files are not', () => {
-  const dirs = packageDirs(['package.json', 'packages/a/package.json', 'packages/a/node_modules/x/package.json', 'apps/b/package.json']);
-  assert.deepEqual(dirs.sort(), ['apps/b', 'packages/a']);
-  assert.deepEqual(outsidePackages(['tsconfig.base.json', 'biome.json', 'tooling/ci/x.mjs'], dirs), ['tsconfig.base.json', 'biome.json', 'tooling/ci/x.mjs']);
-  assert.deepEqual(outsidePackages(['packages/a/src/x.ts', 'apps/b/package.json', 'README.md', '.changeset/x.md'], dirs), []);
-  assert.equal(isInert('README.md'), true);
-  assert.equal(isInert('tooling/README.md'), false);
-});
-
-test('zero planned tasks for a push with changes is a failure naming the paths, never green', () => {
-  assert.match(emptyPlanFailure(['tsconfig.base.json'], 0), /tsconfig\.base\.json.*nothing was checked/);
-  assert.equal(emptyPlanFailure(['packages/a/x.ts'], 3), null);
-  assert.equal(emptyPlanFailure([], 0), null);
-});