code-foundry 1.2.0 → 1.3.0

package/src/commands/ci.mjs

@@ -39,24 +39,46 @@ export function manageCiBilling(root, action) {
   if (action === 'pause') {
     const rulesets = activeBranchRulesets(repository)
     const candidates = rulesets.filter((ruleset) => requiredChecks(ruleset).some(isManagedCheck))
-    const inherited = candidates.filter((ruleset) => ruleset.source_type !== 'Repository' || ruleset.source !== repository)
+    const inherited = candidates.filter(
+      (ruleset) => ruleset.source_type !== 'Repository' || ruleset.source !== repository
+    )
     if (inherited.length) {
-      throw new Error(`${CI_BILLING_REQUIRED_CHECK} is enforced by an inherited ruleset that this repository cannot safely edit.`)
+      throw new Error(
+        `${CI_BILLING_REQUIRED_CHECK} is enforced by an inherited ruleset that this repository cannot safely edit.`
+      )
     }
     if (!candidates.length) {
       if (paused && backup) {
         const cancelledRuns = cancelActiveRuns(repository)
-        const result = { repository, paused: true, changed: false, cancelledRuns, rulesets: backup.rulesets.map((/** @type {any} */ ruleset) => ruleset.rulesetName) }
+        const result = {
+          repository,
+          paused: true,
+          changed: false,
+          cancelledRuns,
+          rulesets: backup.rulesets.map((/** @type {any} */ ruleset) => ruleset.rulesetName),
+        }
         console.log(JSON.stringify(result, null, 2))
         return result
       }
-      throw new Error(`No active branch ruleset requires ${CI_BILLING_REQUIRED_CHECK}; refusing to pause without a restorable managed gate.`)
+      throw new Error(
+        `No active branch ruleset requires ${CI_BILLING_REQUIRED_CHECK}; refusing to pause without a restorable managed gate.`
+      )
     }
     if (backup && !paused) {
-      throw new Error(`${CI_BILLING_BACKUP_VARIABLE} already exists while CI is active; inspect or remove the stale backup before pausing.`)
+      throw new Error(
+        `${CI_BILLING_BACKUP_VARIABLE} already exists while CI is active; inspect or remove the stale backup before pausing.`
+      )
     }
-    if (backup && candidates.some((ruleset) => !backup.rulesets.some((/** @type {any} */ saved) => saved.rulesetId === ruleset.id))) {
-      throw new Error(`${CI_BILLING_BACKUP_VARIABLE} does not cover every managed ruleset; refusing to overwrite the recovery state.`)
+    if (
+      backup &&
+      candidates.some(
+        (ruleset) =>
+          !backup.rulesets.some((/** @type {any} */ saved) => saved.rulesetId === ruleset.id)
+      )
+    ) {
+      throw new Error(
+        `${CI_BILLING_BACKUP_VARIABLE} does not cover every managed ruleset; refusing to overwrite the recovery state.`
+      )
     }
 
     const changes = candidates.map(buildPausedRuleset)
@@ -65,7 +87,13 @@ export function manageCiBilling(root, action) {
     setVariable(repository, CI_BILLING_PAUSED_VARIABLE, 'true')
     const cancelledRuns = cancelActiveRuns(repository)
     for (const change of changes) updateRuleset(repository, change.ruleset)
-    const result = { repository, paused: true, changed: true, cancelledRuns, rulesets: changes.map((change) => change.ruleset.name) }
+    const result = {
+      repository,
+      paused: true,
+      changed: true,
+      cancelledRuns,
+      rulesets: changes.map((change) => change.ruleset.name),
+    }
     console.log(JSON.stringify(result, null, 2))
     return result
   }
@@ -76,14 +104,18 @@ export function manageCiBilling(root, action) {
       console.log(JSON.stringify(result, null, 2))
       return result
     }
-    throw new Error(`${CI_BILLING_PAUSED_VARIABLE} is true but ${CI_BILLING_BACKUP_VARIABLE} is missing; refusing an unsafe resume.`)
+    throw new Error(
+      `${CI_BILLING_PAUSED_VARIABLE} is true but ${CI_BILLING_BACKUP_VARIABLE} is missing; refusing an unsafe resume.`
+    )
   }
 
   let changed = paused
   for (const saved of backup.rulesets) {
     const current = apiJson(repository, `repos/${repository}/rulesets/${saved.rulesetId}`)
     if (!current || current.name !== saved.rulesetName) {
-      throw new Error(`The backed-up ruleset ${saved.rulesetName} (${saved.rulesetId}) is unavailable; refusing an unsafe resume.`)
+      throw new Error(
+        `The backed-up ruleset ${saved.rulesetName} (${saved.rulesetId}) is unavailable; refusing an unsafe resume.`
+      )
     }
     const restored = buildResumedRuleset(current, saved)
     if (restored.changed) updateRuleset(repository, restored.ruleset)
@@ -91,27 +123,44 @@ export function manageCiBilling(root, action) {
   }
   setVariable(repository, CI_BILLING_PAUSED_VARIABLE, 'false')
   deleteVariable(repository, CI_BILLING_BACKUP_VARIABLE)
-  const result = { repository, paused: false, changed, rulesets: backup.rulesets.map((/** @type {any} */ ruleset) => ruleset.rulesetName) }
+  const result = {
+    repository,
+    paused: false,
+    changed,
+    rulesets: backup.rulesets.map((/** @type {any} */ ruleset) => ruleset.rulesetName),
+  }
   console.log(JSON.stringify(result, null, 2))
   return result
 }
 
 /** @param {any} ruleset */
 export function buildPausedRuleset(ruleset) {
-  const requiredRuleIndexes = (ruleset.rules ?? []).flatMap((/** @type {any} */ rule, /** @type {number} */ index) =>
-    rule?.type === 'required_status_checks' && (rule.parameters?.required_status_checks ?? []).some(isManagedCheck) ? [index] : [],
+  const requiredRuleIndexes = (ruleset.rules ?? []).flatMap(
+    (/** @type {any} */ rule, /** @type {number} */ index) =>
+      rule?.type === 'required_status_checks' &&
+      (rule.parameters?.required_status_checks ?? []).some(isManagedCheck)
+        ? [index]
+        : []
   )
-  if (requiredRuleIndexes.length > 1) throw new Error(`${CI_BILLING_REQUIRED_CHECK} appears in multiple rules; refusing an ambiguous pause.`)
+  if (requiredRuleIndexes.length > 1)
+    throw new Error(
+      `${CI_BILLING_REQUIRED_CHECK} appears in multiple rules; refusing an ambiguous pause.`
+    )
   const requiredRuleIndex = requiredRuleIndexes[0]
   const requiredRule = ruleset.rules?.[requiredRuleIndex]
   const matches = (requiredRule?.parameters?.required_status_checks ?? []).filter(isManagedCheck)
-  if (!matches.length) throw new Error(`${CI_BILLING_REQUIRED_CHECK} is not present in the selected ruleset.`)
-  const remaining = (requiredRule.parameters?.required_status_checks ?? []).filter((/** @type {any} */ check) => !isManagedCheck(check))
-  const rules = (ruleset.rules ?? []).flatMap((/** @type {any} */ rule, /** @type {number} */ index) => {
-    if (index !== requiredRuleIndex) return [rule]
-    if (!remaining.length) return []
-    return [{ ...rule, parameters: { ...rule.parameters, required_status_checks: remaining } }]
-  })
+  if (!matches.length)
+    throw new Error(`${CI_BILLING_REQUIRED_CHECK} is not present in the selected ruleset.`)
+  const remaining = (requiredRule.parameters?.required_status_checks ?? []).filter(
+    (/** @type {any} */ check) => !isManagedCheck(check)
+  )
+  const rules = (ruleset.rules ?? []).flatMap(
+    (/** @type {any} */ rule, /** @type {number} */ index) => {
+      if (index !== requiredRuleIndex) return [rule]
+      if (!remaining.length) return []
+      return [{ ...rule, parameters: { ...rule.parameters, required_status_checks: remaining } }]
+    }
+  )
   return {
     ruleset: { ...ruleset, rules },
     backup: {
@@ -119,7 +168,9 @@ export function buildPausedRuleset(ruleset) {
       rulesetName: ruleset.name,
       checks: matches,
       parameters: {
-        strict_required_status_checks_policy: Boolean(requiredRule?.parameters?.strict_required_status_checks_policy),
+        strict_required_status_checks_policy: Boolean(
+          requiredRule?.parameters?.strict_required_status_checks_policy
+        ),
         do_not_enforce_on_create: Boolean(requiredRule?.parameters?.do_not_enforce_on_create),
       },
     },
@@ -151,34 +202,46 @@ export function buildResumedRuleset(ruleset, backup) {
 
 /** @param {any} backup */
 function validateBackup(backup) {
-  return backup?.version === 1 &&
+  return (
+    backup?.version === 1 &&
     Array.isArray(backup.rulesets) &&
     backup.rulesets.length > 0 &&
-    backup.rulesets.every((/** @type {any} */ ruleset) =>
-      Number.isInteger(ruleset?.rulesetId) &&
-      typeof ruleset.rulesetName === 'string' &&
-      Array.isArray(ruleset.checks) &&
-      ruleset.checks.length > 0 &&
-      ruleset.checks.every(isManagedCheck) &&
-      ruleset.parameters && typeof ruleset.parameters === 'object',
+    backup.rulesets.every(
+      (/** @type {any} */ ruleset) =>
+        Number.isInteger(ruleset?.rulesetId) &&
+        typeof ruleset.rulesetName === 'string' &&
+        Array.isArray(ruleset.checks) &&
+        ruleset.checks.length > 0 &&
+        ruleset.checks.every(isManagedCheck) &&
+        ruleset.parameters &&
+        typeof ruleset.parameters === 'object'
     )
+  )
 }
 
 /** @param {string} value */
 function parseBackup(value) {
   let backup
-  try { backup = JSON.parse(value) }
-  catch { throw new Error(`${CI_BILLING_BACKUP_VARIABLE} is not valid JSON; refusing to change CI state.`) }
-  if (!validateBackup(backup)) throw new Error(`${CI_BILLING_BACKUP_VARIABLE} is invalid; refusing to change CI state.`)
+  try {
+    backup = JSON.parse(value)
+  } catch {
+    throw new Error(`${CI_BILLING_BACKUP_VARIABLE} is not valid JSON; refusing to change CI state.`)
+  }
+  if (!validateBackup(backup))
+    throw new Error(`${CI_BILLING_BACKUP_VARIABLE} is invalid; refusing to change CI state.`)
   return backup
 }
 
 /** @param {any} check */
-function isManagedCheck(check) { return check?.context === CI_BILLING_REQUIRED_CHECK }
+function isManagedCheck(check) {
+  return check?.context === CI_BILLING_REQUIRED_CHECK
+}
 
 /** @param {any} ruleset @returns {any[]} */
 function requiredChecks(ruleset) {
-  return (ruleset?.rules ?? []).flatMap((/** @type {any} */ rule) => rule?.type === 'required_status_checks' ? rule.parameters?.required_status_checks ?? [] : [])
+  return (ruleset?.rules ?? []).flatMap((/** @type {any} */ rule) =>
+    rule?.type === 'required_status_checks' ? (rule.parameters?.required_status_checks ?? []) : []
+  )
 }
 
 /** @param {string} repository @returns {any[]} */
@@ -187,7 +250,10 @@ function activeBranchRulesets(repository) {
   if (!Array.isArray(summaries)) throw new Error('Unable to read repository rulesets.')
   return summaries
     .map((ruleset) => apiJson(repository, `repos/${repository}/rulesets/${ruleset.id}`))
-    .filter((/** @type {any} */ ruleset) => ruleset && ruleset.enforcement === 'active' && ruleset.target === 'branch')
+    .filter(
+      (/** @type {any} */ ruleset) =>
+        ruleset && ruleset.enforcement === 'active' && ruleset.target === 'branch'
+    )
 }
 
 /** @param {string} repository @param {any} ruleset */
@@ -200,26 +266,42 @@ function updateRuleset(repository, ruleset) {
     conditions: ruleset.conditions,
     rules: ruleset.rules,
   }
-  const result = spawnSync('gh', ['api', '--method', 'PUT', `repos/${repository}/rulesets/${ruleset.id}`, '--input', '-'], {
-    encoding: 'utf8',
-    input: JSON.stringify(payload),
-  })
-  if (result.status !== 0) throw new Error(`Unable to update ruleset ${ruleset.name}: ${result.stderr.trim() || 'GitHub API request failed'}`)
+  const result = spawnSync(
+    'gh',
+    ['api', '--method', 'PUT', `repos/${repository}/rulesets/${ruleset.id}`, '--input', '-'],
+    {
+      encoding: 'utf8',
+      input: JSON.stringify(payload),
+    }
+  )
+  if (result.status !== 0)
+    throw new Error(
+      `Unable to update ruleset ${ruleset.name}: ${result.stderr.trim() || 'GitHub API request failed'}`
+    )
 }
 
 /** @param {string} repository @returns {number[]} */
 function cancelActiveRuns(repository) {
   const ids = new Set()
   for (const status of ['queued', 'in_progress', 'requested', 'waiting', 'pending']) {
-    const response = apiJson(repository, `repos/${repository}/actions/runs?status=${status}&per_page=100`)
+    const response = apiJson(
+      repository,
+      `repos/${repository}/actions/runs?status=${status}&per_page=100`
+    )
     for (const run of response?.workflow_runs ?? []) {
       if (Number.isInteger(run?.id)) ids.add(run.id)
     }
   }
   for (const id of ids) {
-    const result = spawnSync('gh', ['api', '--method', 'POST', `repos/${repository}/actions/runs/${id}/cancel`], { encoding: 'utf8' })
+    const result = spawnSync(
+      'gh',
+      ['api', '--method', 'POST', `repos/${repository}/actions/runs/${id}/cancel`],
+      { encoding: 'utf8' }
+    )
     if (result.status !== 0 && !/409|cannot be cancelled/i.test(result.stderr)) {
-      throw new Error(`Unable to cancel workflow run ${id}: ${result.stderr.trim() || 'GitHub API request failed'}`)
+      throw new Error(
+        `Unable to cancel workflow run ${id}: ${result.stderr.trim() || 'GitHub API request failed'}`
+      )
     }
   }
   return [...ids]
@@ -227,42 +309,69 @@ function cancelActiveRuns(repository) {
 
 /** @param {string} repository @param {string} name @returns {string|null} */
 function readVariable(repository, name) {
-  const result = spawnSync('gh', ['api', `repos/${repository}/actions/variables/${name}`], { encoding: 'utf8' })
+  const result = spawnSync('gh', ['api', `repos/${repository}/actions/variables/${name}`], {
+    encoding: 'utf8',
+  })
   if (result.status !== 0) {
     if (/404|not found/i.test(result.stderr)) return null
-    throw new Error(`Unable to read repository variable ${name}: ${result.stderr.trim() || 'GitHub API request failed'}`)
+    throw new Error(
+      `Unable to read repository variable ${name}: ${result.stderr.trim() || 'GitHub API request failed'}`
+    )
+  }
+  try {
+    return JSON.parse(result.stdout)?.value ?? null
+  } catch {
+    throw new Error(`GitHub returned invalid JSON for repository variable ${name}.`)
   }
-  try { return JSON.parse(result.stdout)?.value ?? null }
-  catch { throw new Error(`GitHub returned invalid JSON for repository variable ${name}.`) }
 }
 
 /** @param {string} repository @param {string} name @param {string} value */
 function setVariable(repository, name, value) {
-  const result = spawnSync('gh', ['variable', 'set', name, '--repo', repository, '--body', value], { encoding: 'utf8' })
-  if (result.status !== 0) throw new Error(`Unable to set repository variable ${name}: ${result.stderr.trim() || 'GitHub CLI request failed'}`)
+  const result = spawnSync('gh', ['variable', 'set', name, '--repo', repository, '--body', value], {
+    encoding: 'utf8',
+  })
+  if (result.status !== 0)
+    throw new Error(
+      `Unable to set repository variable ${name}: ${result.stderr.trim() || 'GitHub CLI request failed'}`
+    )
 }
 
 /** @param {string} repository @param {string} name */
 function deleteVariable(repository, name) {
-  const result = spawnSync('gh', ['variable', 'delete', name, '--repo', repository], { encoding: 'utf8' })
-  if (result.status !== 0) throw new Error(`Unable to delete repository variable ${name}: ${result.stderr.trim() || 'GitHub CLI request failed'}`)
+  const result = spawnSync('gh', ['variable', 'delete', name, '--repo', repository], {
+    encoding: 'utf8',
+  })
+  if (result.status !== 0)
+    throw new Error(
+      `Unable to delete repository variable ${name}: ${result.stderr.trim() || 'GitHub CLI request failed'}`
+    )
 }
 
 /** @param {string} repository @param {string} endpoint @returns {any} */
 function apiJson(repository, endpoint) {
   const result = spawnSync('gh', ['api', endpoint], { encoding: 'utf8' })
-  if (result.status !== 0) throw new Error(`Unable to read ${endpoint} for ${repository}: ${result.stderr.trim() || 'GitHub API request failed'}`)
-  try { return JSON.parse(result.stdout) }
-  catch { throw new Error(`GitHub returned invalid JSON for ${endpoint}.`) }
+  if (result.status !== 0)
+    throw new Error(
+      `Unable to read ${endpoint} for ${repository}: ${result.stderr.trim() || 'GitHub API request failed'}`
+    )
+  try {
+    return JSON.parse(result.stdout)
+  } catch {
+    throw new Error(`GitHub returned invalid JSON for ${endpoint}.`)
+  }
 }
 
 /** @param {string} root @returns {string} */
 function remoteRepository(root) {
   const result = spawnSync('git', ['remote', 'get-url', 'origin'], { cwd: root, encoding: 'utf8' })
   const value = result.status === 0 ? result.stdout.trim() : ''
-  return value.replace(/^git@github\.com:/, '').replace(/^https?:\/\/github\.com\//, '').replace(/\.git$/, '')
+  return value
+    .replace(/^git@github\.com:/, '')
+    .replace(/^https?:\/\/github\.com\//, '')
+    .replace(/\.git$/, '')
 }
 
 function requireGh() {
-  if (spawnSync('gh', ['--version'], { stdio: 'ignore' }).status !== 0) throw new Error('CI billing controls require the `gh` CLI.')
+  if (spawnSync('gh', ['--version'], { stdio: 'ignore' }).status !== 0)
+    throw new Error('CI billing controls require the `gh` CLI.')
 }

package/src/commands/doctor.mjs

@@ -16,56 +16,97 @@ export function doctor(root, options = {}) {
   const recommendations = recommendRunners(target)
   let errors = 0
   /** @param {string} message */
-  const error = (message) => { console.error(`ERROR: ${message}`); errors += 1 }
+  const error = (message) => {
+    console.error(`ERROR: ${message}`)
+    errors += 1
+  }
   /** @param {string} message */
   const warn = (message) => console.warn(`WARN: ${message}`)
 
   const toolchain = config.toolchain ?? 'auto'
   if (!['auto', 'native', 'mise'].includes(toolchain)) error(`unsupported toolchain: ${toolchain}`)
-  if (toolchain === 'mise' && !existsSync(join(target, '.mise.toml'))) error('.mise.toml is required when toolchain: mise')
+  if (toolchain === 'mise' && !existsSync(join(target, '.mise.toml')))
+    error('.mise.toml is required when toolchain: mise')
   if (toolchain === 'auto') {
-    console.log(existsSync(join(target, '.mise.toml'))
-      ? 'Toolchain: mise (detected from existing .mise.toml).'
-      : 'Toolchain: native (mise not configured).')
+    console.log(
+      existsSync(join(target, '.mise.toml'))
+        ? 'Toolchain: mise (detected from existing .mise.toml).'
+        : 'Toolchain: native (mise not configured).'
+    )
   }
   const hooks = git(target, ['config', '--get', 'core.hooksPath'])
   if (hooks !== '.githooks') warn('Git hooks are not enabled; run `npx code-foundry init`')
-  if (['rust', 'python', 'solidity'].some((language) => profile.languages.split(',').includes(language)) && (config.unit_runner ?? recommendations.unit_runner) === 'ubuntu-slim') {
-    warn('unit_runner is ubuntu-slim for a native-toolchain repository; ubuntu-latest is recommended.')
+  if (
+    ['rust', 'python', 'solidity'].some((language) =>
+      profile.languages.split(',').includes(language)
+    ) &&
+    (config.unit_runner ?? recommendations.unit_runner) === 'ubuntu-slim'
+  ) {
+    warn(
+      'unit_runner is ubuntu-slim for a native-toolchain repository; ubuntu-latest is recommended.'
+    )
   }
 
   const packageFile = join(target, 'package.json')
   if (existsSync(packageFile)) {
     let packageJson
-    try { packageJson = JSON.parse(readFileSync(packageFile, 'utf8')) }
-    catch { error('package.json is not valid JSON'); packageJson = {} }
-    const lockfiles = ['bun.lock', 'bun.lockb', 'pnpm-lock.yaml', 'yarn.lock', 'package-lock.json'].filter((file) => existsSync(join(target, file)))
+    try {
+      packageJson = JSON.parse(readFileSync(packageFile, 'utf8'))
+    } catch {
+      error('package.json is not valid JSON')
+      packageJson = {}
+    }
+    const lockfiles = [
+      'bun.lock',
+      'bun.lockb',
+      'pnpm-lock.yaml',
+      'yarn.lock',
+      'package-lock.json',
+    ].filter((file) => existsSync(join(target, file)))
     const groups = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
-    if (!lockfiles.length && groups.some((key) => Object.keys(packageJson[key] ?? {}).length)) error('package.json exists but no supported lockfile was found')
+    if (!lockfiles.length && groups.some((key) => Object.keys(packageJson[key] ?? {}).length))
+      error('package.json exists but no supported lockfile was found')
     if (lockfiles.length > 1) error('multiple JavaScript lockfiles found; keep one package manager')
     if (packageJson.packageManager && lockfiles.length) {
       const declared = String(packageJson.packageManager).split('@')[0]
-      const actual = lockfiles[0]?.startsWith('bun') ? 'bun' : lockfiles[0]?.split('-')[0].replace('.yaml', '')
-      if (actual && declared !== actual) error(`packageManager (${declared}) does not match ${actual} lockfile`)
+      const actual = lockfiles[0]?.startsWith('bun')
+        ? 'bun'
+        : lockfiles[0]?.split('-')[0].replace('.yaml', '')
+      if (actual && declared !== actual)
+        error(`packageManager (${declared}) does not match ${actual} lockfile`)
     }
   }
 
-  if (profile.languages.split(',').includes('rust') && !commandExists('cargo')) error('Cargo is required for this repository')
+  if (profile.languages.split(',').includes('rust') && !commandExists('cargo'))
+    error('Cargo is required for this repository')
   if (profile.languages.split(',').includes('rust')) {
-    const metadata = spawnSync('cargo', ['metadata', '--no-deps', '--format-version', '1'], { cwd: target, stdio: 'ignore' })
+    const metadata = spawnSync('cargo', ['metadata', '--no-deps', '--format-version', '1'], {
+      cwd: target,
+      stdio: 'ignore',
+    })
     if (metadata.status !== 0) error('cargo metadata failed')
   }
-  if (profile.languages.split(',').includes('python') && !commandExists('python') && !existsSync(join(target, '.venv/bin/python'))) error('Python is required for this repository')
+  if (
+    profile.languages.split(',').includes('python') &&
+    !commandExists('python') &&
+    !existsSync(join(target, '.venv/bin/python'))
+  )
+    error('Python is required for this repository')
 
   const releaseConfigPath = join(target, 'release-please-config.json')
   if (existsSync(releaseConfigPath)) {
     /** @type {Record<string, any>} */
     let releaseConfig = {}
-    try { releaseConfig = JSON.parse(readFileSync(releaseConfigPath, 'utf8')) }
-    catch { error('release-please-config.json is not valid JSON') }
+    try {
+      releaseConfig = JSON.parse(readFileSync(releaseConfigPath, 'utf8'))
+    } catch {
+      error('release-please-config.json is not valid JSON')
+    }
     const manifestMode = Boolean(releaseConfig.packages || releaseConfig['release-type'])
     if (manifestMode && !existsSync(join(target, '.release-please-manifest.json'))) {
-      error('release-please-config.json requires .release-please-manifest.json; run code-foundry sync to bootstrap it')
+      error(
+        'release-please-config.json requires .release-please-manifest.json; run code-foundry sync to bootstrap it'
+      )
     }
   }
 
@@ -76,17 +117,24 @@ export function doctor(root, options = {}) {
   }
   const mergeStrategy = config.merge_strategy ?? 'rebase'
   if (workflow === 'staging-release' && mergeStrategy !== 'rebase') {
-    error(`merge_strategy must be "rebase" for the staging-release promotion topology; got "${mergeStrategy}".`)
+    error(
+      `merge_strategy must be "rebase" for the staging-release promotion topology; got "${mergeStrategy}".`
+    )
   }
   const releaseMergeStrategy = config.release_merge_strategy ?? ''
   if (includesValue(features, 'release') && releaseMergeStrategy !== 'rebase') {
-    error(`release_merge_strategy must be "rebase" for automated release merges; got "${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}".`)
+    error(
+      `release_merge_strategy must be "rebase" for automated release merges; got "${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}".`
+    )
   }
   for (const name of ['validation', 'draft-pr', 'release-pr', 'release']) {
     if (name === 'release-pr' && workflow !== 'staging-release') continue
-    if (includesValue(features, name) && !existsSync(join(target, `.github/workflows/${name}.yml`))) error(`missing enabled workflow: ${name}.yml`)
+    if (includesValue(features, name) && !existsSync(join(target, `.github/workflows/${name}.yml`)))
+      error(`missing enabled workflow: ${name}.yml`)
   }
-  const validationEnabled = includesValue(features, 'validation') || ['ci', 'test', 'security', 'codeql'].some((legacy) => includesValue(features, legacy))
+  const validationEnabled =
+    includesValue(features, 'validation') ||
+    ['ci', 'test', 'security', 'codeql'].some((legacy) => includesValue(features, legacy))
   const validationCaller = ['validation.yml', 'validation_self-ci.yml']
     .map((file) => join(target, `.github/workflows/${file}`))
     .find((file) => existsSync(file) && /pull_request:/.test(readFileSync(file, 'utf8')))
@@ -95,15 +143,23 @@ export function doctor(root, options = {}) {
   } else if (validationCaller) {
     const caller = readFileSync(validationCaller, 'utf8')
     if (!/^  validation:\n    name: Validation/m.test(caller)) {
-      error('validation caller is missing the Validation job; the Validation / Gate aggregate check cannot form.')
+      error(
+        'validation caller is missing the Validation job; the Validation / Gate aggregate check cannot form.'
+      )
     }
-    if (!/uses:\s+(?:\.\/\.github\/workflows\/validation\.yml|\S+\/\.github\/workflows\/validation\.yml@)/.test(caller)) {
+    if (
+      !/uses:\s+(?:\.\/\.github\/workflows\/validation\.yml|\S+\/\.github\/workflows\/validation\.yml@)/.test(
+        caller
+      )
+    ) {
       error('validation caller does not reference the validation orchestrator.')
     }
     const runtimeRef = caller.match(/^\s+runtime-ref:\s+(.+?)\s*$/m)?.[1]
     const checkoutRef = caller.match(/^\s+ref:\s+(.+?)\s*$/m)?.[1]
     if (!runtimeRef || !checkoutRef) {
-      error('validation caller is missing runtime ref wiring (mode checkout or orchestrator input).')
+      error(
+        'validation caller is missing runtime ref wiring (mode checkout or orchestrator input).'
+      )
     } else if (runtimeRef !== checkoutRef) {
       error(`validation caller pins mismatched runtime refs (${runtimeRef} vs ${checkoutRef}).`)
     } else if (runtimeRef !== '${{ github.sha }}' && !/^v\d+\.\d+\.\d+$/.test(runtimeRef)) {
@@ -113,11 +169,18 @@ export function doctor(root, options = {}) {
   const runtimeRepository = config.runtime_repository ?? '0xPlayerOne/code-foundry'
   for (const stem of ['ci', 'test', 'security', 'codeql']) {
     const legacy = join(target, `.github/workflows/${stem}.yml`)
-    if (existsSync(legacy) && isGeneratedEventCaller(readFileSync(legacy, 'utf8'), stem, runtimeRepository)) {
-      warn(`stale generated legacy caller ${stem}.yml still triggers canonical suites; run code-foundry sync to migrate to validation.yml.`)
+    if (
+      existsSync(legacy) &&
+      isGeneratedEventCaller(readFileSync(legacy, 'utf8'), stem, runtimeRepository)
+    ) {
+      warn(
+        `stale generated legacy caller ${stem}.yml still triggers canonical suites; run code-foundry sync to migrate to validation.yml.`
+      )
     }
   }
-  console.log('Remote CI, Test, Security, CodeQL, and release runtimes are loaded by the tiered validation orchestrator.')
+  console.log(
+    'Remote CI, Test, Security, CodeQL, and release runtimes are loaded by the tiered validation orchestrator.'
+  )
   if (options.github) {
     const github = doctorGithub(target)
     /** @type {{ codeFoundryTokenPresent?: boolean, stagingDeployKeyPresent?: boolean }} */
@@ -127,9 +190,13 @@ export function doctor(root, options = {}) {
     console.log(`GitHub doctor inspected ${github.details.repository}.`)
     const codeFoundryToken = secrets.codeFoundryTokenPresent ? 'present' : 'absent'
     const stagingDeployKey = secrets.stagingDeployKeyPresent ? 'present' : 'absent'
-    console.log(`GitHub secrets: CODE_FOUNDRY_TOKEN=${codeFoundryToken}, STAGING_DEPLOY_KEY=${stagingDeployKey}`)
+    console.log(
+      `GitHub secrets: CODE_FOUNDRY_TOKEN=${codeFoundryToken}, STAGING_DEPLOY_KEY=${stagingDeployKey}`
+    )
     if (!secrets.codeFoundryTokenPresent) {
-      warn('GitHub token routing fallback: PR creation will remain draft and requires manual ready-for-review to trigger validation.')
+      warn(
+        'GitHub token routing fallback: PR creation will remain draft and requires manual ready-for-review to trigger validation.'
+      )
     }
   }
   if (errors) throw new Error(`Repository doctor found ${errors} error(s).`)