Krzysztof kuhy Rudnicki
0e78c8b752
Finishes the last two of the eleven manifests in this repo. Exact-pins every devDependency and takes three majors -- @testing-library/jest-dom 6 -> 7, jsdom 29 -> 30, pnpm 10.13.1 -> 11.24.0 -- with lint and coverage green in both (ts_core 42/42, web_ui 102/102, 100% branches). **TypeScript stays at 6.0.3, and this is the campaign's first real unsatisfiable conflict.** TS 7.0.2 is latest, but typescript-eslint 8.68.0 -- itself the latest release -- declares `typescript: ">=4.8.4 <6.1.0"` and throws "does not support TS 7.0" as eslint loads its config. There is no 9.x. Taking TS 7 would mean dropping every type-aware lint rule from both packages, so the compiler waits for the linter. Recorded as a `transitive:` allowlist entry, which is a predicate rather than a date: the gate re-checks the blocker each run and the entry clears itself when upstream ships support. First use of the allowlist, and the loud banner now prints on every run here. **pnpm 11 also made the gate wrong, and the gate was fixed rather than pnpm.** pnpm 11 quarantines packages published inside a 24h window -- a supply-chain measure against the period when a compromised publish is live -- and refused @testing-library/react 16.3.3, published 18h earlier. Reporting a repo as behind a version its package manager will not install is a finding nobody can act on: the hook fails, and so does the fix it asks for. `quarantine.py` now narrows npm's "latest" to the newest release old enough to install, bounded above by `dist-tags.latest` so a maintenance-line release never outranks the tag. It fetches the FULL packument (7MB for react, 16MB for typescript) and so runs only after a finding already exists -- a clean run pays nothing, which a test asserts by making the fetch raise. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK |
||
|---|---|---|
| .github/workflows | ||
| aur-publish | ||
| crdt_sync_dart | ||
| crdt_sync_flutter | ||
| crdt-sync | ||
| dep_freshness | ||
| design_system | ||
| dopamine-ux | ||
| file_length | ||
| firebase | ||
| gatelock | ||
| github_device_auth | ||
| guard-lib | ||
| md_naming | ||
| prompts | ||
| scripts | ||
| sync_settings_ui | ||
| ts_core | ||
| unified-design-system | ||
| vmbox | ||
| web_ui | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| dependency-freshness.allowlist.yaml | ||
| LICENSE | ||
| README.md | ||
utils
Shared libraries used across kuhyx's other projects. Each subdirectory is a
formerly-standalone repo, folded in here with full commit history preserved
(see each subdirectory's own git log for its pre-merge history).
crdt_sync_dart/
Dart/Flutter CRDT sync library (pub package name: crdt_sync, not published
to pub.dev — consumed via a git dependency). Mirrors crdt-sync (below)
module-for-module and test-for-test. Consumed by diet_guard's app,
screen-locker's workout_app, wake_alarm's phone_app, and todo (whose
notes are stored in the v0.2.0 LogStore).
Consume via:
dependencies:
crdt_sync:
git:
url: https://github.com/kuhyx/utils
ref: crdt_sync_dart-v0.10.0
path: crdt_sync_dart
sync_settings_ui/
Shared Flutter "Sync settings" screen (pub package name: sync_settings_ui,
not published to pub.dev). Firebase sync (primary) plus an optional local
backup slot — no GitHub mirror UI. Pure UI + a FirebaseSyncController
service layer over injected closures (keystore/Google-plugin access stays
in each consuming app, exactly as before this package existed). Consumed by
todo, diet_guard_app, workout_app, wake_alarm/phone_app, and
home_inventory's dedicated "Sync settings" route.
Consume via:
dependencies:
sync_settings_ui:
git:
url: https://github.com/kuhyx/utils
ref: sync_settings_ui-v0.1.0
path: sync_settings_ui
crdt-sync/
Python CRDT sync library (package: crdt_sync, not published to PyPI). Same
design as crdt_sync_dart (HLC clocks, per-field LWW, sticky-delete
tombstones). Consumed by diet-guard and screen-locker.
Consume via:
crdt-sync @ git+https://github.com/kuhyx/utils@crdt-sync-v0.2.0#subdirectory=crdt-sync
guard-lib/
Bash tamper-resistance primitives (guardctl: chattr + bind-mount + systemd
watcher + pacman hooks). Not a package — installed by running
guard-lib/install.sh as root, which copies files onto the system
(/usr/local/bin, /usr/local/lib/guard-lib, systemd units, pacman hooks).
Consumed by steam-backlog-enforcer (expects a guard-lib/install.sh
sibling clone) and referenced by screen-locker.
gatelock/
Python lock-window + HMAC log-integrity backend (package: gatelock, not
published to PyPI). Consumed via pip by screen-locker, diet-guard, and
wake-alarm:
gatelock @ git+https://github.com/kuhyx/utils@gatelock-v0.1.0#subdirectory=gatelock
unified-design-system/
Not a package — the frozen design tokens (colors, spacing, type, radius,
shadow policy) and per-stack (Flutter/web/Tkinter) implementation patterns
that keep every one of kuhy's repos visually identical, plus annotated
component references (components.html, button.html). Read
unified-design-system/README.md and
DOCS-tokens.md before touching any theme/CSS/style file in any repo. The
unified-design-system Claude Code skill is a thin pointer here, not a
duplicate.