[ci] release

[bombshell-bot]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@bomb.sh/tools@0.6.0

Minor Changes

• 23997e5: Runs publint as a publish gate in bsh build and generates types by default

  • After a successful build, bsh build now runs publint (strict mode) against the emitted dist/ and fails on errors — publishing mistakes like missing declaration files or broken exports targets are caught at build time instead of at publish.
  • Type declarations (.d.mts) are now generated by default; pass --no-dts to opt out. If your package.json declares types but they aren't emitted, the build now fails.
  • Entry globs that match nothing now fail with a clear message (No entry files matched: …) instead of tsdown's opaque Error: undefined Cannot find entry.
  • bsh publint output now renders full messages (e.g. which exports target is broken) instead of bare rule codes.

• e4ad9d2: Makes bsh pass its own lint and widens the test fixture API

  • The shared oxlint config now exempts *.config.* files and oxlint JS plugins (rules/**) from import/no-default-export — config files and plugins legitimately require default exports.
  • Fixture.write() and Fixture.append() in @bomb.sh/tools/test-utils now accept plain strings (previously typed Uint8Array-only, which contradicted the runtime behavior).
  • bsh test raises the default vitest testTimeout to 15s — integration tests spawn real oxlint/knip binaries, which can exceed 5s on a loaded machine.
  • Internal: replaces all node:path usage with URL APIs, consolidates the duplicate knip config (package.json#knip was silently ignored in favor of knip.jsonc), and throws a coded ToolsError instead of a generic Error.

• f66e1df: Makes bsh lint --fix fix far more than it used to

  • --fix now chains knip --fix after oxlint: unused dependencies and devDependencies are removed from package.json automatically. Dead-code fixes (unused exports/types) additionally run with --fix --strict; unused files are never deleted automatically. knip fixes respect your knip config — keep ignoreDependencies accurate, since untraceable deps (e.g. binaries referenced by path) will otherwise be removed.
  • The stock no-console rule is replaced by bombshell-dev/no-console-log, which auto-fixes console.log → console.info (semantically neutral in Node — they're the same stdout write). Other unlisted console methods are still flagged but not auto-fixed.

• 74356f7: Scopes the bombshell-dev/exported-function-async and bombshell-dev/require-export-jsdoc lint rules to a package's public API surface

  bsh lint now derives the public surface from package.json (exports, bin, and main/module, mapping dist/ paths back to src/), including conventional packages/*/ workspace members. These two rules no longer fire on internal modules — only on files consumers can actually import. Packages without a publish surface (apps, examples) are exempt entirely, and wildcard passthrough exports ("./*": "./dist/*") don't designate surface.

• c276677: Restructures bsh lint output and tiers knip's dead-code checks behind --strict

  • Errors are now always shown in full; warnings collapse to a per-rule count (pass --warnings to see them). Warnings never affect the exit code, so this keeps actual failures visible.
  • Adds --format json for a machine-readable report ({ summary, violations }). Use pnpm -s run lint -- --format json to keep stdout clean.
  • Knip's dead-code issues (unused exports, types, and files) now only run with --strict — they fire constantly mid-implementation and are only meaningful as a commit-time gate. Dependency hygiene issues (unused dependencies/devDependencies) still always run.
  • Fixes tsgo silently type-checking nothing: file arguments made it skip the project tsconfig (TS5112), so default runs reported zero type errors. Type checking now always runs in project mode and explicit targets filter the report instead. This may surface previously hidden type errors.
  • Widens the default oxlint target from ./src to the whole project (gitignored paths like dist/ are respected), matching the scope of knip and tsgo.
  • Turns off unicorn/consistent-function-scoping and no-underscore-dangle, which fired frequently but were never deliberately enabled.
  • --fix now only exits non-zero when errors remain (previously any warning failed the run).

• 83c20f7: Replaces the stock max-params lint rule with a Bombshell-aware version

  The 2-parameter limit (use an options bag beyond that) now only applies to signatures we author. Functions conforming to APIs we don't control are exempt: override methods, members of classes that extends or implements (e.g. Node streams, platform-shaped interfaces), and inline callbacks passed to other functions.

• 7a80756: Updates the shared tsconfig.json baseline for modern Node packages

  • target and lib move from es2022 to es2024, so modern APIs like Array.prototype.toSorted and Promise.withResolvers type-check without shims.
  • Adds "types": ["node"]. Packages must now have @types/node installed — missing it previously surfaced as dozens of Cannot find name 'process'/'Buffer' (TS2591) errors; now it's a single actionable Cannot find type definition file for 'node' (TS2688). Remedy: pnpm add -D @types/node.

Patch Changes

• 7fe9353: Updates the lint, build, and lifecycle skills to match current bsh behavior

  The lint skill no longer claims publint runs in pnpm run lint (it gates pnpm run build), documents --strict, --warnings, and --format json, and adds a remedies table mapping common violations to their sanctioned fixes. The lifecycle skill moves the knip dead-code gate (lint --strict) to the PR handoff step.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@bomb.sh/tools@58

commit: 10a4f7b