alpha-gate 0.1.0

package/src/views/admin/setup-page.tsx

@@ -0,0 +1,108 @@
+import type { FC } from "hono/jsx";
+import { AdminLayout, type Chrome } from "./layout";
+
+// §6/§7/§14 — the admin "App setup" page: a personalized, copy-paste guide for wiring a macOS app to
+// THIS instance (its activate scheme + saved Sparkle public key + its per-user feed URL). Pure: the
+// route loads the values from `meta` and derives the App Worker origin. The public key is non-secret
+// (it ships in the app); the private key never reaches the Worker.
+
+export interface SetupInfo {
+  appName: string;
+  activateScheme: string;
+  publicKey: string | null;
+  /** The public App Worker origin, or a placeholder when it can't be derived (custom domain). */
+  appOrigin: string;
+}
+
+export const SetupPage: FC<{ info: SetupInfo; chrome?: Chrome }> = ({ info, chrome }) => {
+  const key = info.publicKey ?? "PASTE_SUPublicEDKey_FROM_generate_keys";
+  const plist = `<key>SUPublicEDKey</key>
+<string>${key}</string>
+
+<key>CFBundleURLTypes</key>
+<array><dict>
+  <key>CFBundleURLSchemes</key>
+  <array><string>${info.activateScheme}</string></array>
+</dict></array>`;
+  const feed = `${info.appOrigin}/appcast?token=<TOKEN>&installed=<CFBundleVersion>`;
+
+  return (
+    <AdminLayout title="App setup" chrome={chrome}>
+      <p class="sub" style="margin-top:6px">
+        How to wire <strong>{info.appName}</strong> to this instance. To publish builds see{" "}
+        <a href="/admin/ci">CI publishing</a>; full runbook in <code>docs/operate/publish.md</code>.
+      </p>
+
+      {info.publicKey === null ? (
+        <p class="callout warn">
+          No Sparkle public key saved yet — run <code>generate_keys</code> and paste{" "}
+          <code>SUPublicEDKey</code> on the <a href="/admin/settings">Settings</a> page; it then
+          fills in below.
+        </p>
+      ) : null}
+
+      <section>
+        <div class="slab">
+          <h2>1 · Sparkle EdDSA key (once)</h2>
+        </div>
+        <pre>
+          <code>./bin/generate_keys</code>
+        </pre>
+        <p class="muted">
+          Prints the public key (save it in Settings). The private key stays in your Keychain —
+          <code>sign_update</code> uses it at publish time; the Worker never holds it.
+        </p>
+      </section>
+
+      <section>
+        <div class="slab">
+          <h2>2 · Info.plist</h2>
+        </div>
+        <pre>
+          <code>{plist}</code>
+        </pre>
+        <p class="muted">
+          Leave <code>SUFeedURL</code> unset and <code>SURequireSignedFeed</code> off — the feed is
+          per-user (step 3). The scheme above must match the Activate URL scheme in Settings.
+        </p>
+      </section>
+
+      <section>
+        <div class="slab">
+          <h2>3 · Per-user feed (runtime)</h2>
+        </div>
+        <p class="muted">
+          Your SPUUpdaterDelegate builds the feed from the token stored on activation:
+        </p>
+        <pre>
+          <code>{feed}</code>
+        </pre>
+        <p class="muted">
+          The token reaches the app via <code>{`${info.activateScheme}://activate?token=…`}</code>{" "}
+          or by pasting the key from the user's <code>/get</code> page.
+        </p>
+      </section>
+
+      <section>
+        <div class="slab">
+          <h2>4 · Publish</h2>
+        </div>
+        <p class="muted">
+          Build → sign → notarize → staple on macOS, then publish with one command — it reads the
+          version from the app and signs with <code>sign_update</code> (the Worker never signs):
+        </p>
+        <pre>
+          <code>{`./publish.sh MyApp.dmg --channel <name>        # from a clone
+npx alpha-gate publish MyApp.dmg --channel <name>   # from npm`}</code>
+        </pre>
+        <p class="muted">
+          It takes a <code>.dmg</code> or a signed <code>.app</code> <code>.zip</code>, picks the
+          instance automatically when only one is deployed, and pre-checks the build number. Or use
+          the browser <a href="/admin/upload">Upload</a> page; headless CI is on{" "}
+          <a href="/admin/ci">CI publishing</a>. Each build's <code>build_number</code> must
+          increase.
+        </p>
+      </section>
+    </AdminLayout>
+  );
+};

package/src/views/admin/table-enhance.ts

@@ -0,0 +1,176 @@
+// Progressive-enhancement for the admin list tables: click-to-sort columns and instant client-side
+// filtering, with NO framework. The server always renders the complete table, so without JavaScript the
+// page is a fully readable static table (graceful degradation) — the script below only reorders/hides
+// rows already present. Tables opt in declaratively:
+//
+//   <table data-enhance>
+//     <thead><tr>
+//       <th data-key="email"  data-sort="text">Email</th>   ← sortable; data-sort = "text" | "num"
+//       <th data-key="build"  data-sort="num">Build</th>
+//       <th>Actions</th>                                    ← no data-sort → not sortable
+//     </tr></thead>
+//     <tbody>
+//       <tr><td>a@x</td><td>1500</td><td>…</td></tr>
+//     </tbody>
+//   </table>
+//
+// A cell's sort/filter value is `data-value` when present, else its trimmed text — so badges and "—"
+// placeholders can carry a canonical value (e.g. <td data-value="yes">). Filter controls live anywhere
+// on the page and target a column by its header key:
+//
+//   <select data-filter-col="status">…</select>                 exact match (default)
+//   <input  data-filter-col="email"  data-filter-match="contains">
+//   <input type="checkbox" data-filter-col="nobuild" data-filter-value="nobuild">
+//
+// compareCells / cellPasses are PURE and unit-tested (no DOM); the script serialises them via toString()
+// so the exact tested logic ships to the browser. Keep them self-contained (no external references).
+
+/**
+ * Comparator for one column's two cell values, direction included. Blank/"—" cells always sort LAST in
+ * both directions (so empty rows never crowd the top of a descending sort). "num" compares numerically;
+ * "text" is a case-insensitive, numeric-aware locale compare. Returns the usual negative/zero/positive.
+ */
+export function compareCells(
+  a: string,
+  b: string,
+  type: "text" | "num",
+  dir: "asc" | "desc",
+): number {
+  // No inner named functions here: those get wrapped in esbuild's `__name` keep-names helper, which is
+  // absent in the browser and would throw when this is serialised via toString() (see TABLE_ENHANCE_SCRIPT).
+  const ta = a.trim();
+  const tb = b.trim();
+  const ea = ta === "" || ta === "—";
+  const eb = tb === "" || tb === "—";
+  if (ea && eb) return 0;
+  if (ea) return 1;
+  if (eb) return -1;
+  let base: number;
+  if (type === "num") {
+    const na = Number.parseFloat(a);
+    const nb = Number.parseFloat(b);
+    base = (Number.isNaN(na) ? 0 : na) - (Number.isNaN(nb) ? 0 : nb);
+  } else {
+    base = a.localeCompare(b, undefined, { numeric: true, sensitivity: "base" });
+  }
+  return dir === "asc" ? base : -base;
+}
+
+/**
+ * Whether a cell value passes one filter control. An empty filter value is "no constraint" (passes).
+ * "contains" is a case-insensitive substring; "exact" a case-insensitive equality. Both trim first.
+ */
+export function cellPasses(
+  cellValue: string,
+  filterValue: string,
+  match: "exact" | "contains",
+): boolean {
+  if (filterValue === "") return true;
+  const c = cellValue.trim().toLowerCase();
+  const v = filterValue.trim().toLowerCase();
+  return match === "contains" ? c.includes(v) : c === v;
+}
+
+// The browser glue. Reads the declarative markup, wires sort + filter, and calls the pure functions
+// above (injected verbatim). No-ops cleanly on pages with no [data-enhance] table.
+const GLUE = `
+(function () {
+  function val(tr, i) {
+    var td = tr.cells[i];
+    if (!td) return "";
+    return td.getAttribute("data-value") != null ? td.getAttribute("data-value") : td.textContent.trim();
+  }
+  document.querySelectorAll("table[data-enhance]").forEach(function (table) {
+    var head = table.tHead && table.tHead.rows[0];
+    var body = table.tBodies[0];
+    if (!head || !body) return;
+    var heads = Array.prototype.slice.call(head.cells);
+    var keyIndex = {};
+    heads.forEach(function (th, i) { var k = th.getAttribute("data-key"); if (k) keyIndex[k] = i; });
+    function rows() { return Array.prototype.slice.call(body.rows); }
+
+    heads.forEach(function (th, i) {
+      var type = th.getAttribute("data-sort");
+      if (type == null) return;
+      th.classList.add("th-sort");
+      // No role override: a <th> is an implicit columnheader, which is what makes aria-sort meaningful
+      // and keeps the cells associated with it. tabindex + keydown make it keyboard-operable.
+      th.setAttribute("tabindex", "0");
+      function sort() {
+        var dir = th.getAttribute("aria-sort") === "ascending" ? "desc" : "asc";
+        heads.forEach(function (h) { h.removeAttribute("aria-sort"); });
+        th.setAttribute("aria-sort", dir === "asc" ? "ascending" : "descending");
+        rows()
+          .sort(function (a, b) { return compareCells(val(a, i), val(b, i), type || "text", dir); })
+          .forEach(function (tr) { body.appendChild(tr); });
+      }
+      th.addEventListener("click", sort);
+      th.addEventListener("keydown", function (e) {
+        if (e.key === "Enter" || e.key === " ") { e.preventDefault(); sort(); }
+      });
+    });
+
+    var controls = Array.prototype.slice
+      .call(document.querySelectorAll("[data-filter-col]"))
+      .filter(function (c) { return keyIndex[c.getAttribute("data-filter-col")] != null; });
+    if (!controls.length) return;
+    // Scope the status/empty nodes to THIS table's container, not document-wide, so two enhanced tables
+    // with filters on one page don't write each other's count.
+    var scope = table.parentElement || document;
+    var status = scope.querySelector("[data-table-status]");
+    var empty = scope.querySelector("[data-table-empty]");
+    function apply() {
+      var specs = controls.map(function (c) {
+        var v = c.type === "checkbox" ? (c.checked ? (c.getAttribute("data-filter-value") || "on") : "") : c.value;
+        return { i: keyIndex[c.getAttribute("data-filter-col")], value: v, match: c.getAttribute("data-filter-match") || "exact" };
+      });
+      var all = rows(), shown = 0;
+      all.forEach(function (tr) {
+        var ok = specs.every(function (s) { return cellPasses(val(tr, s.i), s.value, s.match); });
+        tr.hidden = !ok;
+        if (ok) shown++;
+      });
+      if (status) status.textContent = shown === all.length ? "" : "Showing " + shown + " of " + all.length;
+      if (empty) empty.hidden = shown !== 0;
+    }
+    controls.forEach(function (c) { c.addEventListener("input", apply); c.addEventListener("change", apply); });
+    apply();
+  });
+
+  // Bulk-selection enhancement: a [data-check-all] header checkbox toggles every row checkbox in the
+  // same table (respecting filtered-out rows), and [data-selected-count] mirrors the live count.
+  // Without JS the header checkbox does nothing and the count stays blank — the bulk form still works.
+  document.querySelectorAll("[data-check-all]").forEach(function (all) {
+    var table = all.closest("table");
+    if (!table) return;
+    function boxes() {
+      return Array.prototype.slice
+        .call(table.querySelectorAll('tbody input[type="checkbox"]'))
+        .filter(function (b) { var tr = b.closest("tr"); return !(tr && tr.hidden); });
+    }
+    function counts() {
+      var n = boxes().filter(function (b) { return b.checked; }).length;
+      document.querySelectorAll("[data-selected-count]").forEach(function (el) {
+        el.textContent = n > 0 ? " " + n + " " + (n === 1 ? "build" : "builds") : " builds";
+      });
+    }
+    all.addEventListener("change", function () {
+      boxes().forEach(function (b) { b.checked = all.checked; });
+      counts();
+    });
+    table.addEventListener("change", function (e) {
+      if (e.target !== all) counts();
+    });
+    counts();
+  });
+})();
+`;
+
+// The full inline script: the pure functions (tested) plus the DOM glue. Injected once by AdminLayout.
+// `__name` is an identity shim for esbuild's keep-names helper: when the bundler wraps a named function
+// with __name(fn, "name"), the serialised source below would reference a helper the browser doesn't have.
+// Shimming it to return its first argument makes the toString()-injected functions self-contained.
+export const TABLE_ENHANCE_SCRIPT = `var __name = function (t) { return t; };
+var compareCells = ${compareCells.toString()};
+var cellPasses = ${cellPasses.toString()};
+${GLUE}`;

package/src/views/admin/ui.tsx

@@ -0,0 +1,159 @@
+import type { FC } from "hono/jsx";
+import type { Build } from "../../core/types";
+import { formatWhen, type Verdict } from "../../core/verdict";
+
+// Quiet-instrument primitives shared by every admin page: the canonical version lockup, state tags,
+// state dots, timestamps, and the verdict rendered in operator words. Pure JSX over props (§23).
+
+/**
+ * The one canonical way a build is written anywhere in the back office: `#1500 · v1.2.1` — mono,
+ * number carrying the weight. Never a raw DB row id. `href` makes it the link to the build page.
+ */
+export const Lk: FC<{
+  build: Pick<Build, "buildNumber" | "shortVersion">;
+  href?: string | undefined;
+  /** Muted variant — "nothing will change" (up-to-date verdicts, secondary mentions). */
+  dim?: boolean | undefined;
+  /** Omit the version half (tight cells, second mentions). */
+  short?: boolean | undefined;
+}> = ({ build, href, dim, short }) => {
+  const body = (
+    <>
+      <b>#{build.buildNumber}</b>
+      {short ? null : <i> · v{build.shortVersion}</i>}
+    </>
+  );
+  const cls = dim ? "lk dim" : "lk";
+  return href ? (
+    <a class={cls} href={href}>
+      {body}
+    </a>
+  ) : (
+    <span class={cls}>{body}</span>
+  );
+};
+
+/**
+ * Exception-only state tag. Healthy states render nothing — silence is the ok state. `crit` is the
+ * single filled tag in the system.
+ */
+export const Tag: FC<{
+  kind: "warn" | "mut" | "acc" | "crit";
+  label: string;
+  title?: string;
+}> = ({ kind, label, title }) => (
+  <span class={`tag ${kind}`} title={title}>
+    {label}
+  </span>
+);
+
+/** Build state tags for one build — exceptions only (an available, ordinary build shows nothing). */
+export const BuildTags: FC<{ build: Build }> = ({ build }) => (
+  <>
+    {build.status === "withdrawn" ? (
+      <Tag kind="mut" label="withdrawn" title="Not offered to anyone; restore to serve it again" />
+    ) : null}
+    {build.critical ? (
+      <Tag kind="crit" label="critical" title="Sparkle treats this update as required" />
+    ) : null}
+    {build.rollbackTarget ? (
+      <Tag kind="acc" label="rollback target" title="Old code republished above the bad build" />
+    ) : null}
+    {build.hidden ? <Tag kind="mut" label="hidden" title="Hidden from the list only" /> : null}
+  </>
+);
+
+/** 8px state dot: ok (serving) · warn (faults) · off (serving nothing) · req (requests). */
+export const Dot: FC<{ kind: "ok" | "warn" | "off" | "req"; title?: string }> = ({
+  kind,
+  title,
+}) => <span class={`dot ${kind}`} title={title} aria-hidden="true" />;
+
+/** The one timestamp form: `Jul 09 08:30` with the full ISO in the title (and datetime). */
+export const When: FC<{ iso: string | null; now: string }> = ({ iso, now }) =>
+  iso === null ? (
+    <span class="mut">—</span>
+  ) : (
+    <time class="t" datetime={iso} title={iso}>
+      {formatWhen(iso, now)}
+    </time>
+  );
+
+/**
+ * The verdict in operator words — the Users list's "Next check" cell and every detail page's strip.
+ * Faults carry the cause; remedies live in the surrounding page (attention list, detail actions).
+ */
+export const VerdictCell: FC<{ verdict: Verdict }> = ({ verdict }) => {
+  switch (verdict.kind) {
+    case "offered":
+      return (
+        <span class="vd">
+          gets <Lk build={verdict.build} />
+          {verdict.via === "pin" ? (
+            <Tag kind="mut" label="pinned" title="The pin decides — channels are ignored" />
+          ) : null}
+          {verdict.build.critical ? (
+            <Tag kind="crit" label="critical" title="Sparkle treats this update as required" />
+          ) : null}
+        </span>
+      );
+    case "up-to-date":
+      return (
+        <span class="vd mut">
+          up to date · <Lk build={verdict.build} dim short />
+          {verdict.via === "pin" ? (
+            <Tag kind="mut" label="pinned" title="Held here by the pin" />
+          ) : null}
+        </span>
+      );
+    case "revoked":
+      return <span class="vd mut">— not served while revoked</span>;
+    case "no-channel":
+      return (
+        <span class="vd">
+          <Tag kind="warn" label="no channel" title="Resolves to nothing — assign a channel" />{" "}
+          <span class="mut">assign one to serve them</span>
+        </span>
+      );
+    case "empty-channel":
+      return (
+        <span class="vd">
+          <Tag kind="warn" label="no build" title="Their channels carry no available build" />{" "}
+          <span class="mut">their channels serve nothing</span>
+        </span>
+      );
+    case "pin-unavailable":
+      return (
+        <span class="vd">
+          <Tag kind="warn" label="pin serves nothing" title="The pinned build was withdrawn" />{" "}
+          <span class="mut">pinned build is withdrawn — unpin or re-pin</span>
+        </span>
+      );
+    case "pin-below-installed":
+      return (
+        <span class="vd">
+          <Tag
+            kind="warn"
+            label="pin below installed"
+            title="Sparkle can't downgrade — the pin serves nothing"
+          />{" "}
+          <span class="mut">
+            pinned <Lk build={verdict.pinned} dim short /> under installed #{verdict.installed}
+          </span>
+        </span>
+      );
+    case "stranded":
+      return (
+        <span class="vd">
+          <Tag
+            kind="warn"
+            label="stranded"
+            title="Installed above everything their channels offer"
+          />{" "}
+          <span class="mut">
+            nothing above <b class="num">#{verdict.installed}</b> — roll forward
+          </span>
+        </span>
+      );
+  }
+};

package/src/views/get-page.tsx

@@ -0,0 +1,39 @@
+import type { FC } from "hono/jsx";
+import type { Branding } from "../core/invite-template";
+import { Layout } from "./layout";
+
+// §6 — the one token-gated page each user receives. Carries every action in order: download,
+// activate (deep link), the token as a paste fallback, and short instructions. The route computes the
+// URLs (download with via=install; the myapp:// activate link) and the branding model; this is view.
+
+export const GetPage: FC<{
+  branding: Branding;
+  token: string;
+  downloadUrl: string;
+  activateUrl: string;
+}> = ({ branding, token, downloadUrl, activateUrl }) => (
+  <Layout title={branding.appName} accent={branding.accent}>
+    {branding.headerUrl ? <img class="header" src={branding.headerUrl} alt="" /> : null}
+    {branding.iconUrl ? <img class="icon" src={branding.iconUrl} alt="" /> : null}
+    <h1>{branding.appName}</h1>
+    {branding.blurb ? <p class="blurb">{branding.blurb}</p> : null}
+
+    <a class="btn primary" href={downloadUrl}>
+      Download
+    </a>
+    <a class="btn" href={activateUrl}>
+      Activate
+    </a>
+
+    <p class="hint">Access key — paste it in the app if Activate doesn’t open it:</p>
+    <code class="token">{token}</code>
+
+    <ol class="steps">
+      <li>Download and install the app.</li>
+      <li>Launch it.</li>
+      <li>
+        Click <strong>Activate</strong> (or paste the key) to connect updates.
+      </li>
+    </ol>
+  </Layout>
+);

package/src/views/layout.tsx

@@ -0,0 +1,57 @@
+import type { Child, FC } from "hono/jsx";
+
+// Shared HTML shell for the public pages. Pure: props in, markup out. The accent color is the one
+// branding knob that reaches the chrome (§6); everything else is page content. renderPage prepends
+// the doctype so route handlers don't hand-concatenate strings.
+
+const baseStyles = (accent: string) => `
+  :root { --accent: ${accent}; }
+  * { box-sizing: border-box; }
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
+    background: #f5f5f7; color: #1d1d1f; padding: 2rem; }
+  .card { width: 100%; max-width: 28rem; background: #fff; border-radius: 16px;
+    padding: 2.5rem; box-shadow: 0 1px 3px rgba(0,0,0,.08); text-align: center; }
+  .header { display: block; width: 100%; border-radius: 12px; margin-bottom: 1rem; }
+  .icon { width: 72px; height: 72px; border-radius: 16px; }
+  h1 { font-size: 1.5rem; margin: 1rem 0 .25rem; }
+  .blurb { color: #6e6e73; margin: 0 0 1.5rem; }
+  .btn { display: block; width: 100%; padding: .75rem 1rem; margin: .5rem 0; border-radius: 10px;
+    border: 1px solid #d2d2d7; background: #fff; color: #1d1d1f; font-size: 1rem; font-weight: 500;
+    text-decoration: none; cursor: pointer; }
+  .btn.primary { background: var(--accent); border-color: var(--accent); color: #fff; }
+  .input { display: block; width: 100%; padding: .75rem 1rem; margin: .5rem 0; border-radius: 10px;
+    border: 1px solid #d2d2d7; font-size: 1rem; }
+  .hint { color: #6e6e73; font-size: .85rem; margin: 1.5rem 0 .25rem; }
+  .token { display: block; font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+    background: #f5f5f7; border-radius: 8px; padding: .6rem; word-break: break-all; user-select: all; }
+  .steps { text-align: left; color: #424245; font-size: .9rem; margin-top: 1.5rem; padding-left: 1.25rem; }
+  .muted { color: #6e6e73; }
+`;
+
+export const Layout: FC<{ title: string; accent: string; children?: Child }> = ({
+  title,
+  accent,
+  children,
+}) => (
+  <html lang="en">
+    <head>
+      <meta charset="utf-8" />
+      <meta name="viewport" content="width=device-width, initial-scale=1" />
+      <title>{title}</title>
+      {/* CSS is raw, not escaped */}
+      <style dangerouslySetInnerHTML={{ __html: baseStyles(accent) }} />
+    </head>
+    <body>
+      <main class="card">{children}</main>
+    </body>
+  </html>
+);
+
+/**
+ * Renders a full page element to an HTML string with the doctype prepended. Our pages are synchronous
+ * hono/jsx components, so the element stringifies directly (a hono JSX.Element is a string subtype).
+ */
+export function renderPage(element: string | Promise<string>): string {
+  return `<!DOCTYPE html>\n${String(element)}`;
+}

package/src/worker.ts

@@ -0,0 +1,23 @@
+import { runScheduled } from "./cron";
+import { type Env, readEnv } from "./env";
+import { createAdminApp } from "./routes/admin";
+import { createAppApp } from "./routes/app";
+
+// §17 — the single entrypoint, deployed twice and switched by env.ROLE. The app/admin Hono apps are
+// built once at module scope; fetch dispatches to one by role, scheduled() runs the cron (admin only).
+// This is the only file that knows about both surfaces; it holds no logic of its own.
+
+const appWorker = createAppApp();
+const adminWorker = createAdminApp();
+
+export default {
+  fetch(request: Request, env: Env, ctx: ExecutionContext): Response | Promise<Response> {
+    readEnv(env); // fail fast on a misconfigured ROLE
+    const worker = env.ROLE === "admin" ? adminWorker : appWorker;
+    return worker.fetch(request, env, ctx);
+  },
+
+  scheduled(_controller: ScheduledController, env: Env, ctx: ExecutionContext): void {
+    ctx.waitUntil(runScheduled(env).catch((error) => console.error("scheduled run failed", error)));
+  },
+};

package/tsconfig.json

@@ -0,0 +1,35 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "moduleDetection": "force",
+    "lib": ["ESNext"],
+    "types": ["@cloudflare/workers-types"],
+    "jsx": "react-jsx",
+    "jsxImportSource": "hono/jsx",
+
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "noImplicitOverride": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src", "test"],
+  "//": "src/deploy + test/deploy are the Node CLI — typechecked separately via tsconfig.deploy.json (Node types, not workers-types).",
+  "exclude": [
+    "node_modules",
+    "test/vitest.config.ts",
+    "test/vitest.deploy.config.ts",
+    "src/deploy",
+    "test/deploy"
+  ]
+}