diff --git a/README.md b/README.md
index b5d0dc0..f7aea61 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,10 @@
# @btravstack/tools
+
+
+ 
+
+
Shared configuration packages for [btravstack](https://github.com/btravstack)
repositories. Each repo used to hand-copy a near-identical `tools/tsconfig`,
`tools/typedoc`, oxlint, oxfmt, commitlint, and lefthook setup; this monorepo
diff --git a/branding/README.md b/branding/README.md
new file mode 100644
index 0000000..05bb811
--- /dev/null
+++ b/branding/README.md
@@ -0,0 +1,12 @@
+# Tools identity
+
+The smiling pink beetroot keeps the approved illustrated style of the
+btravstack family, with green leaves and soft shading; its silver open-end wrench
+has a straight handle and distinct jaws, and identifies the shared build and
+release toolchain. Its hands float independently of its body, without arms. Use `logo-light.svg` on light
+surfaces, `logo-dark.svg` on dark surfaces, and `logo-mono.svg` for grayscale
+print. `social-card.png` is the 1200 × 630 repository preview asset.
+
+Canonical SVG source: [generate-brand.mjs](https://github.com/btravstack/btravstack.github.io/blob/main/scripts/generate-brand.mjs).
+Social source: [social-card.html](https://github.com/btravstack/btravstack.github.io/blob/main/branding/social-card.html), with `?project=tools`.
+These are committed local copies; displaying them requires no external service.
diff --git a/branding/logo-dark.svg b/branding/logo-dark.svg
new file mode 100644
index 0000000..b9d21eb
--- /dev/null
+++ b/branding/logo-dark.svg
@@ -0,0 +1,17 @@
+
diff --git a/branding/logo-favicon.svg b/branding/logo-favicon.svg
new file mode 100644
index 0000000..5d7e10d
--- /dev/null
+++ b/branding/logo-favicon.svg
@@ -0,0 +1,17 @@
+
diff --git a/branding/logo-light.svg b/branding/logo-light.svg
new file mode 100644
index 0000000..cf06096
--- /dev/null
+++ b/branding/logo-light.svg
@@ -0,0 +1,17 @@
+
diff --git a/branding/logo-mono.svg b/branding/logo-mono.svg
new file mode 100644
index 0000000..cfd263f
--- /dev/null
+++ b/branding/logo-mono.svg
@@ -0,0 +1,17 @@
+
diff --git a/branding/social-card.png b/branding/social-card.png
new file mode 100644
index 0000000..cedd5ba
Binary files /dev/null and b/branding/social-card.png differ
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 9611c01..a929d4d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -184,7 +184,8 @@ catalogs:
version: 1.73.0
overrides:
- fast-uri@<3.1.6: 3.1.6
+ fast-uri@<3.1.8: 3.1.8
+ tinypool@<2.1.2: 2.1.2
js-yaml@4: 4.3.2
importers:
@@ -750,8 +751,8 @@ packages:
fast-string-width@3.0.2:
resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
- fast-uri@3.1.6:
- resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==}
+ fast-uri@3.1.8:
+ resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}
fast-wrap-ansi@0.2.2:
resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -943,8 +944,8 @@ packages:
engines: {node: '>=10'}
hasBin: true
- shell-quote@1.10.0:
- resolution: {integrity: sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==}
+ shell-quote@1.11.0:
+ resolution: {integrity: sha512-JdxDPD0DBTyu08pq0kPC0xSNet/qsU07qT6IsX1AS8oO2ICNRY4ldNa8OAI6PuwAH8tG3lxEhbqmyp4Dw4036g==}
engines: {node: '>= 0.4'}
sisteransi@1.0.5:
@@ -970,8 +971,8 @@ packages:
resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
engines: {node: '>=12.0.0'}
- tinypool@2.1.0:
- resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==}
+ tinypool@2.1.2:
+ resolution: {integrity: sha512-9YodfrxS9g9IbFr/KOjE5bAeJ0p61n3bW6mqvy0jtoeKd1kTW1Cxm0oulm6KX2lyM9Gl6WIe8nEbY7LWv5ZJww==}
engines: {node: ^20.0.0 || >=22.0.0}
wrap-ansi@9.0.2:
@@ -1380,7 +1381,7 @@ snapshots:
ajv@8.20.0:
dependencies:
fast-deep-equal: 3.1.3
- fast-uri: 3.1.6
+ fast-uri: 3.1.8
json-schema-traverse: 1.0.0
require-from-string: 2.0.2
@@ -1447,7 +1448,7 @@ snapshots:
dependencies:
fast-string-truncated-width: 3.0.3
- fast-uri@3.1.6: {}
+ fast-uri@3.1.8: {}
fast-wrap-ansi@0.2.2:
dependencies:
@@ -1499,7 +1500,7 @@ snapshots:
launch-editor@2.14.1:
dependencies:
picocolors: 1.1.1
- shell-quote: 1.10.0
+ shell-quote: 1.11.0
lefthook-darwin-arm64@2.1.10:
optional: true
@@ -1548,7 +1549,7 @@ snapshots:
oxfmt@0.58.0:
dependencies:
- tinypool: 2.1.0
+ tinypool: 2.1.2
optionalDependencies:
'@oxfmt/binding-android-arm-eabi': 0.58.0
'@oxfmt/binding-android-arm64': 0.58.0
@@ -1617,7 +1618,7 @@ snapshots:
semver@7.8.5: {}
- shell-quote@1.10.0: {}
+ shell-quote@1.11.0: {}
sisteransi@1.0.5: {}
@@ -1640,7 +1641,7 @@ snapshots:
fdir: 6.5.0(picomatch@4.0.7)
picomatch: 4.0.7
- tinypool@2.1.0: {}
+ tinypool@2.1.2: {}
wrap-ansi@9.0.2:
dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index cd01193..18913b9 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -20,14 +20,14 @@ allowBuilds:
lefthook: true
overrides:
- # GHSA-7p8r-x3mc-p8w7 (High, supersedes GHSA-v2hh-gcrm-f6hx), then four more
- # in the same parser — GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc,
- # GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp — all ReDoS or parsing confusion
- # below 3.1.6. Transitive only (via @commitlint/cli > ajv); dev-tooling only.
- # The floor moves rather than a second entry being added: two overlapping
- # ranges for one package is how a floor stops applying unnoticed. 3.1.6
- # published 2026-08-23, past the 7-day cutoff.
- "fast-uri@<3.1.6": "3.1.6"
+ # GHSA-qw65-cvwx-89v3, GHSA-58mr-gqgx-xq4g and GHSA-hrr3-gc8f-f4qj,
+ # plus earlier parser advisories: keep one security floor for commitlint's
+ # transitive URI parser. 3.1.8 published 2026-09-15, past the 7-day cutoff.
+ "fast-uri@<3.1.8": "3.1.8"
+ # oxfmt pins 2.1.0. These worker-option fixes address GHSA-5gmw-xhrv-c9v3
+ # and GHSA-85c8-ppgw-ccpr without upgrading the formatter. 2.1.2 published
+ # 2026-08-23, past the 7-day cutoff; its Node floor is compatible with oxfmt.
+ "tinypool@<2.1.2": "2.1.2"
# GHSA-2883-xcg3-v3hh (High): js-yaml maxTotalMergeKeys does not limit CPU use
# for empty merge sources, below 4.3.2. Transitive only (via @commitlint/cli >
# cosmiconfig); dev-tooling only. 4.3.2 published 2026-08-26, past the 7-day
+