chore(deps): bump sharp from 0.35.4 to 0.35.5

.claude/hooks/decision-nudge.js → .agents/hooks/decision-nudge.js

@@ -32,10 +32,10 @@ process.stdin.on("end", () => {
 
   const nudge = {
     additionalContext:
-      "REMINDER: Run `deno fmt` and `deno lint` after TS edits. " +
-      "Run `cd apps/services && make fix` after Go edits. " +
+      "REMINDER: Run `pnpm fmt` (oxfmt), `pnpm lint` (oxlint) and `pnpm check` (tsc) after TS edits. " +
+      "Run `make fix` at the repository root after Go edits. " +
       "If this change is an architectural decision (technology choice, API design, " +
-      "approach preference), consider logging it in an ADR under etc/adrs/.",
+      "approach preference), consider logging it in an ADR under docs/adr/.",
   };
 
   process.stdout.write(JSON.stringify(nudge));

.agents/settings.json

@@ -0,0 +1,78 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(cat:*)",
+      "Bash(docker:*)",
+      "Bash(docker compose:*)",
+      "Bash(find:*)",
+      "Bash(gh:*)",
+      "Bash(head:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git show:*)",
+      "Bash(git status:*)",
+      "Bash(grep:*)",
+      "Bash(ls:*)",
+      "Bash(make:*)",
+      "Bash(node:*)",
+      "Bash(oxfmt:*)",
+      "Bash(oxlint:*)",
+      "Bash(pnpm bench:*)",
+      "Bash(pnpm check:*)",
+      "Bash(pnpm cli:*)",
+      "Bash(pnpm exec oxfmt:*)",
+      "Bash(pnpm exec oxlint:*)",
+      "Bash(pnpm exec tsc:*)",
+      "Bash(pnpm fmt:*)",
+      "Bash(pnpm lint:*)",
+      "Bash(pnpm run:*)",
+      "Bash(pnpm test:*)",
+      "Bash(sort:*)",
+      "Bash(tail:*)",
+      "Bash(test:*)",
+      "Bash(tree:*)",
+      "Bash(tsc:*)",
+      "Bash(uniq:*)",
+      "Bash(wc:*)",
+      "mcp__plugin_context7_context7__get-library-docs",
+      "mcp__plugin_context7_context7__query-docs",
+      "mcp__plugin_context7_context7__resolve-library-id",
+      "Skill(architecture-guidelines)",
+      "Skill(coding-practices)",
+      "Skill(design-principles)",
+      "Skill(enrichment)",
+      "Skill(eser-rules-manager)",
+      "Skill(frontend-practices)",
+      "Skill(go-practices)",
+      "Skill(javascript-practices)",
+      "Skill(release-and-ci)",
+      "Skill(security-practices)",
+      "Skill(tooling-standards)",
+      "Skill(workflow-practices)",
+      "WebFetch(domain:api.github.com)",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "WebSearch"
+    ],
+    "deny": [
+      "Bash(git add:*)",
+      "Bash(git branch:*)",
+      "Bash(git checkout:*)",
+      "Bash(git commit:*)",
+      "Bash(git fetch:*)",
+      "Bash(git merge:*)",
+      "Bash(git pull:*)",
+      "Bash(git push:*)",
+      "Bash(git rebase:*)",
+      "Bash(git reset:*)",
+      "Bash(git revert:*)",
+      "Bash(git stash:*)",
+      "Bash(git tag:*)"
+    ]
+  },
+  "enabledPlugins": {
+    "context7@claude-plugins-official": true,
+    "frontend-design@claude-plugins-official": true
+  },
+  "alwaysThinkingEnabled": true
+}

.agents/skills/architecture-guidelines/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: architecture-guidelines
+description: "Design conventions of this codebase for TypeScript and Go packages and services: double-layered hexagonal architecture, explicit adapter composition, runtime access as an adapter, public API and CLI surface, request metadata, testing strategy, ADRs. Use when designing a package or service, adding options or flags, planning tests or writing an ADR. Not for file naming (use tooling-standards)."
+---
+
+# Architecture Guidelines
+
+How packages and services in this codebase are structured, composed, tested and
+documented as decisions.
+
+## Always
+
+- Domain logic and its port types live together in `domain/`; adapters live in
+  `adapters/`. No `ports/` directory.
+- Callers import adapters explicitly and pass them in. No string-selected
+  adapters, no convenience factories, no dynamic imports inside a package.
+- Library code reaches the runtime through an adapter
+  (`@eserstack/standards/cross-runtime`), never `process.*` or `node:fs`
+  directly.
+- Every option has a safe default; add an option only for a named case; no
+  positional booleans.
+- Request ids and trace state travel in the request context, never as extra
+  parameters.
+- Unit tests with fakes for logic, integration tests for adapters; failure paths
+  tested; coverage never drops.
+- A lasting architectural decision gets an ADR, written with the change.
+
+## References
+
+| File                                                              | Read when                                                                   |
+| ----------------------------------------------------------------- | --------------------------------------------------------------------------- |
+| [hexagonal-architecture.md](references/hexagonal-architecture.md) | Structuring a package, adding an adapter, adding options, flags or env vars |
+| [testing.md](references/testing.md)                               | Deciding what and how to test, choosing the runner, coverage                |
+| [adrs.md](references/adrs.md)                                     | Recording an architectural decision                                         |

.agents/skills/architecture-guidelines/evals/triggers.json

@@ -0,0 +1,62 @@
+[
+  {
+    "query": "design a new package for background jobs, where do ports and adapters go",
+    "should_trigger": true
+  },
+  {
+    "query": "should this CLI flag be public or hidden",
+    "should_trigger": true
+  },
+  {
+    "query": "write an ADR for switching the bundler",
+    "should_trigger": true
+  },
+  {
+    "query": "what should we unit test vs integration test for the http package",
+    "should_trigger": true
+  },
+  {
+    "query": "how do request ids travel between the noskills server and worker",
+    "should_trigger": true
+  },
+  {
+    "query": "yeni bir servis tasarlıyorum, katmanları nasıl ayırayım",
+    "should_trigger": true
+  },
+  {
+    "query": "we're adding an option to the public API of @eserstack/config, is that ok",
+    "should_trigger": true
+  },
+  {
+    "query": "the Go tests fail with a data race",
+    "should_trigger": false
+  },
+  {
+    "query": "use namespace import here",
+    "should_trigger": false
+  },
+  {
+    "query": "bump all packages to the next minor",
+    "should_trigger": false
+  },
+  {
+    "query": "write a README for laroux",
+    "should_trigger": false
+  },
+  {
+    "query": "set the GitHub workflow timeout",
+    "should_trigger": false
+  },
+  {
+    "query": "should this function take a pointer or a value",
+    "should_trigger": false
+  },
+  {
+    "query": "secret key is in the logs, fix it",
+    "should_trigger": false
+  },
+  {
+    "query": "commit and push",
+    "should_trigger": false
+  }
+]

.agents/skills/architecture-guidelines/references/adrs.md

@@ -0,0 +1,28 @@
+# Architectural Decision Records
+
+When to write an ADR and what it contains.
+
+---
+
+## Architectural Decision Records
+
+Scope: Decisions that change a package's architecture, a public contract, a
+dependency with lasting cost, or a product target
+
+Rule: Record the decision in this codebase's ADR directory (`docs/adr/` by
+default) as `NNNN-kebab-title.md`, numbered after the highest existing file. An
+ADR is written before or with the change, not after. It states:
+
+- `## Status`: Proposed, Accepted, or Superseded by a named ADR.
+- `## Context and Problem Statement`: the forces and the question being decided.
+- `## Decision Drivers`: what the decision optimizes for.
+- `## Considered Options`, with the trade-offs of each.
+- `## Decision Outcome`: the choice and why it beat the others.
+- `## Consequences`: what becomes easier and what becomes harder.
+- `## Links` and related files, when there are any.
+
+An accepted ADR is not rewritten to match a later decision. A new ADR supersedes
+it, and the old one's status names the new one.
+
+**Why:** the reasoning behind a structure is what a later change needs, and it
+is the part the code cannot show.