[ci] release

CHANGELOG.md

@@ -1,5 +1,57 @@
 # @bomb.sh/tools
 
+## 0.6.0
+
+### Minor Changes
+
+- 23997e5: Runs `publint` as a publish gate in `bsh build` and generates types by default
+
+  - After a successful build, `bsh build` now runs `publint` (strict mode) against the emitted `dist/` and fails on errors — publishing mistakes like missing declaration files or broken `exports` targets are caught at build time instead of at publish.
+  - Type declarations (`.d.mts`) are now generated by default; pass `--no-dts` to opt out. If your `package.json` declares types but they aren't emitted, the build now fails.
+  - Entry globs that match nothing now fail with a clear message (`No entry files matched: …`) instead of tsdown's opaque `Error: undefined Cannot find entry`.
+  - `bsh publint` output now renders full messages (e.g. which `exports` target is broken) instead of bare rule codes.
+
+- e4ad9d2: Makes `bsh` pass its own lint and widens the test fixture API
+
+  - The shared oxlint config now exempts `*.config.*` files and oxlint JS plugins (`rules/**`) from `import/no-default-export` — config files and plugins legitimately require default exports.
+  - `Fixture.write()` and `Fixture.append()` in `@bomb.sh/tools/test-utils` now accept plain strings (previously typed `Uint8Array`-only, which contradicted the runtime behavior).
+  - `bsh test` raises the default vitest `testTimeout` to 15s — integration tests spawn real oxlint/knip binaries, which can exceed 5s on a loaded machine.
+  - Internal: replaces all `node:path` usage with URL APIs, consolidates the duplicate knip config (`package.json#knip` was silently ignored in favor of `knip.jsonc`), and throws a coded `ToolsError` instead of a generic `Error`.
+
+- f66e1df: Makes `bsh lint --fix` fix far more than it used to
+
+  - `--fix` now chains `knip --fix` after oxlint: unused dependencies and devDependencies are removed from `package.json` automatically. Dead-code fixes (unused exports/types) additionally run with `--fix --strict`; unused files are never deleted automatically. knip fixes respect your knip config — keep `ignoreDependencies` accurate, since untraceable deps (e.g. binaries referenced by path) will otherwise be removed.
+  - The stock `no-console` rule is replaced by `bombshell-dev/no-console-log`, which auto-fixes `console.log` → `console.info` (semantically neutral in Node — they're the same stdout write). Other unlisted console methods are still flagged but not auto-fixed.
+
+- 74356f7: Scopes the `bombshell-dev/exported-function-async` and `bombshell-dev/require-export-jsdoc` lint rules to a package's public API surface
+
+  `bsh lint` now derives the public surface from `package.json` (`exports`, `bin`, and `main`/`module`, mapping `dist/` paths back to `src/`), including conventional `packages/*/` workspace members. These two rules no longer fire on internal modules — only on files consumers can actually import. Packages without a publish surface (apps, examples) are exempt entirely, and wildcard passthrough exports (`"./*": "./dist/*"`) don't designate surface.
+
+- c276677: Restructures `bsh lint` output and tiers knip's dead-code checks behind `--strict`
+
+  - Errors are now always shown in full; warnings collapse to a per-rule count (pass `--warnings` to see them). Warnings never affect the exit code, so this keeps actual failures visible.
+  - Adds `--format json` for a machine-readable report (`{ summary, violations }`). Use `pnpm -s run lint -- --format json` to keep stdout clean.
+  - Knip's dead-code issues (unused exports, types, and files) now only run with `--strict` — they fire constantly mid-implementation and are only meaningful as a commit-time gate. Dependency hygiene issues (unused dependencies/devDependencies) still always run.
+  - Fixes `tsgo` silently type-checking nothing: file arguments made it skip the project `tsconfig` (TS5112), so default runs reported zero type errors. Type checking now always runs in project mode and explicit targets filter the report instead. This may surface previously hidden type errors.
+  - Widens the default oxlint target from `./src` to the whole project (gitignored paths like `dist/` are respected), matching the scope of knip and tsgo.
+  - Turns off `unicorn/consistent-function-scoping` and `no-underscore-dangle`, which fired frequently but were never deliberately enabled.
+  - `--fix` now only exits non-zero when errors remain (previously any warning failed the run).
+
+- 83c20f7: Replaces the stock `max-params` lint rule with a Bombshell-aware version
+
+  The 2-parameter limit (use an options bag beyond that) now only applies to signatures we author. Functions conforming to APIs we don't control are exempt: `override` methods, members of classes that `extends` or `implements` (e.g. Node streams, platform-shaped interfaces), and inline callbacks passed to other functions.
+
+- 7a80756: Updates the shared `tsconfig.json` baseline for modern Node packages
+
+  - `target` and `lib` move from `es2022` to `es2024`, so modern APIs like `Array.prototype.toSorted` and `Promise.withResolvers` type-check without shims.
+  - Adds `"types": ["node"]`. Packages must now have `@types/node` installed — missing it previously surfaced as dozens of `Cannot find name 'process'/'Buffer'` (TS2591) errors; now it's a single actionable `Cannot find type definition file for 'node'` (TS2688). Remedy: `pnpm add -D @types/node`.
+
+### Patch Changes
+
+- 7fe9353: Updates the `lint`, `build`, and `lifecycle` skills to match current `bsh` behavior
+
+  The lint skill no longer claims publint runs in `pnpm run lint` (it gates `pnpm run build`), documents `--strict`, `--warnings`, and `--format json`, and adds a remedies table mapping common violations to their sanctioned fixes. The lifecycle skill moves the knip dead-code gate (`lint --strict`) to the PR handoff step.
+
 ## 0.5.6
 
 ### Patch Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bomb.sh/tools",
-  "version": "0.5.6",
+  "version": "0.6.0",
   "description": "The internal dev, build, and lint CLI for Bombshell projects",
   "keywords": [
     "bombshell",