🚀 Release 0.1.7

`create:finish` leaves the merge local until `create:release` pushes it, so
`main` is routinely ahead of its upstream between a merge and a release. The
branch front door demanded an exact match and refused until it was pushed,
forcing a manual `git push` that the model deliberately keeps out of it.

Reject only a `main` that is behind its upstream — matching `create:finish`,
which already tolerates being ahead — and record why pushing from `finish` was
rejected instead. The push stays with `create:release`, so the merge remains
reviewable locally, and the known issue about the deadlock is gone.

Resolves: backlog task "Resolve the finish/push tension".

.gitea/workflows/ci.yml

@@ -0,0 +1,208 @@
+name: CI
+
+on:
+    push:
+        branches: [main]
+        # Releases are tag pushes (`scripts/release.sh` tags bare `x.y.z`). A
+        # `branches` filter alone matches no tag ref, so without this both the
+        # tag-gated `publish` job and the coverage publish step never fire.
+        tags: ["*"]
+    pull_request:
+        branches: [main]
+    workflow_dispatch: {}
+
+jobs:
+    # Cheap gate that collapses the release double-run. `scripts/release.sh`
+    # pushes `main` and the tag seconds apart, and the tag points at exactly
+    # the HEAD commit that push delivers — so the branch run would verify the
+    # identical tree the tag run verifies anyway (plus `publish`). When a push
+    # to `main` is headed by a release commit (`:rocket: Release x.y.z`, the
+    # single commit release.sh creates), the full CI is skipped here and the
+    # tag run becomes the authoritative one for that SHA. All other pushes —
+    # PRs, tags, ordinary `main` merges — see `skip=false` and run as before.
+    #
+    # Coupling: the pattern below MUST stay in sync with the release commit
+    # message in `scripts/release.sh`. Failure mode if the tag push ever fails
+    # after `main` accepted the release commit: no CI fires; fix by re-running
+    # `git push --tags`.
+    release-gate:
+        runs-on: ubuntu-latest
+        outputs:
+            skip: ${{ steps.decide.outputs.skip }}
+        steps:
+            - uses: actions/checkout@v4
+            - id: decide
+              env:
+                  REF: ${{ gitea.ref }}
+              run: |
+                  # Keyed on the ref, not just the message: a tag run checks out
+                  # the same release commit, and `publish` needs its `build`.
+                  if [ "${REF}" = "refs/heads/main" ] &&
+                      git log -1 --format=%s | grep -qE '^:rocket: Release [0-9]+\.[0-9]+\.[0-9]+$'; then
+                      echo 'Release commit on main — the tag run covers this SHA; skipping full CI.'
+                      echo 'skip=true' >>"${GITHUB_OUTPUT}"
+                  else
+                      echo 'skip=false' >>"${GITHUB_OUTPUT}"
+                  fi
+
+    build:
+        needs: release-gate
+        if: needs.release-gate.outputs.skip != 'true'
+        runs-on: ubuntu-latest
+        # `image` extends the runner's default job image (catthehacker/act)
+        # with Node 26 pre-planted in the tool cache layout, so setup-node's
+        # version probe hits and never downloads (see docker/Dockerfile). The
+        # tag MUST equal the exact version pinned in `.node-version`; the bump
+        # ritual is documented in CONTRIBUTING.md § CI runner image. The volume
+        # bind-mounts the shared pages tree so the
+        # coverage step below can write into it; the runner whitelists this
+        # path via `container.valid_volumes` (docker-space `setup/gitea.sh`).
+        container:
+            image: gitea.e1nsnull.de/tmu/act-ci:26.8.2
+            volumes:
+                - /data/gitea-pages:/data/gitea-pages
+        steps:
+            - uses: actions/checkout@v4
+            # Fail fast when the job container is not the baked image: a stale
+            # tag on the runner (`forcePull=false` in its pull log) silently
+            # reintroduces the per-job download. Cheap, and it names the
+            # invariant.
+            - name: Assert the baked tool cache is present
+              run: |
+                  test -f "/opt/hostedtoolcache/node/$(tr -d '[:space:]' < .node-version)/x64.complete"
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: .node-version
+                  cache: "npm"
+            - run: npm ci
+            - run: npm run build
+            - run: npm run check
+            - run: npm run test:ci
+            # Publish this tag's coverage to the self-hosted pages server,
+            # served read-only at
+            # https://pages.e1nsnull.de/<owner>/<repo>/<tag>/coverage/. Wipe only
+            # this tag's `coverage/`, so sibling docs/landing trees and older
+            # tags survive; pruning stale tags is a manual chore. The
+            # precompress pass emits `.br` / `.gz` / `.zst` sidecars next to
+            # every text asset, so `static-web-server` can serve the precompressed
+            # variant and keep the original as fallback.
+            - name: Publish coverage to the pages server
+              if: startsWith(gitea.ref, 'refs/tags/')
+              env:
+                  REPO: ${{ github.repository }}
+                  REF: ${{ gitea.ref }}
+              run: |
+                  TAG="${REF#refs/tags/}"
+                  DEST="/data/gitea-pages/${REPO}/${TAG}/coverage"
+                  rm -rf "${DEST}"
+                  mkdir -p "${DEST}"
+                  cp -R coverage/. "${DEST}/"
+                  node --strip-types scripts/precompress.ts "${DEST}"
+                  echo "Coverage: https://pages.e1nsnull.de/${REPO}/${TAG}/coverage/"
+            # Fast, offline packaging gate. `attw` stays in `publish` (it needs
+            # a pack + full resolution matrix); `publint` packs too but is cheap
+            # enough to run on every push so a packaging break fails here, not
+            # at release time.
+            - run: npm run publish:publint
+            # Persist the exact dist/ that `check`, `test:ci` and `publint` were
+            # run against, so `publish` ships those bytes instead of rebuilding
+            # (which could in principle differ and would pay the build twice).
+            - uses: actions/upload-artifact@v4
+              with:
+                  name: dist
+                  path: dist/
+
+    # Advisory scans (dead code, dependency freshness). Non-blocking: surfaced in
+    # the Actions tab for visibility, but must never gate a merge — so
+    # continue-on-error and intentionally NOT in `publish`'s `needs`.
+    maintain:
+        needs: release-gate
+        if: needs.release-gate.outputs.skip != 'true'
+        runs-on: ubuntu-latest
+        continue-on-error: true
+        # Same baked image as `build` — without it this job re-downloads Node
+        # per run (see docker/Dockerfile).
+        container:
+            image: gitea.e1nsnull.de/tmu/act-ci:26.8.2
+        steps:
+            - uses: actions/checkout@v4
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: .node-version
+                  cache: "npm"
+            - run: npm ci
+            - run: npm run maintain
+
+    publish:
+        if: startsWith(gitea.ref, 'refs/tags/')
+        needs: build
+        runs-on: ubuntu-latest
+        # Same baked image as `build` — setup-node still owns the registry-url
+        # `.npmrc` rewrite here; only the Node download is skipped.
+        container:
+            image: gitea.e1nsnull.de/tmu/act-ci:26.8.2
+        # The release page is created with the run's automatic Gitea token
+        # (`github.token`), so it needs `contents: write`.
+        permissions:
+            contents: write
+        # The npm token is optional: `secrets` is not an allowed context in a
+        # step `if` (see GitHub's context-availability table), so it is lifted
+        # into job-level `env`, where an unset secret arrives as the empty
+        # string and skips the publish rather than attempting an unauthenticated
+        # one. Set NPM_TOKEN in the Gitea repo: Settings → Actions → Secrets.
+        env:
+            NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        steps:
+            - uses: actions/checkout@v4
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: .node-version
+                  # Same lockfile/key as `build`, and tag runs can read caches
+                  # saved on `main` — without this, every release pays a cold
+                  # `npm ci` despite the warm shared npm cache.
+                  cache: "npm"
+                  registry-url: "https://registry.npmjs.org/"
+            - run: npm ci
+            # Consume the dist/ that `build` produced and gated, instead of
+            # rebuilding here — `publish` must ship the tested artifact.
+            - uses: actions/download-artifact@v4
+              with:
+                  name: dist
+                  path: dist/
+            - run: npm run publish:publint
+            - run: npm run publish:attw
+            # The Gitea release page is created *before* `npm publish` on
+            # purpose: a broken page then fails CI without burning an npm
+            # version. The page is cheap to retry, a published version is not.
+            # The body is the matching Keep-a-Changelog section; an unknown tag
+            # makes the extractor exit non-zero, so the page can never go up
+            # empty.
+            - name: Extract release notes from CHANGELOG.md
+              env:
+                  TAG_REF: ${{ gitea.ref }}
+              run: ./scripts/release-notes.sh "${TAG_REF#refs/tags/}" > release-notes.md
+            - name: Create the Gitea release
+              id: gitea_release
+              uses: https://gitea.com/actions/gitea-release-action@v1
+              with:
+                  body_path: release-notes.md
+            - name: Publish to npm
+              id: npm_publish
+              if: env.NPM_TOKEN != ''
+              run: npm publish --access public
+              env:
+                  NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
+            # All-or-nothing: the tag is only released once *both* the release
+            # page and the npm package are up. A skipped npm publish (NPM_TOKEN
+            # unset) has no `success` outcome, so `always()` reaches this check
+            # even after a failure and turns the skipped half into an explicit
+            # red job instead of a silently green one.
+            - name: Require both releases
+              if: always()
+              run: |
+                  GITEA="${{ steps.gitea_release.outcome }}"
+                  NPM="${{ steps.npm_publish.outcome }}"
+                  if [ "${GITEA}" != success ] || [ "${NPM}" != success ]; then
+                      echo "::error::incomplete release — gitea=${GITEA:-skipped} npm=${NPM:-skipped}"
+                      exit 1
+                  fi

.github/workflows/ci.yml

@@ -1,43 +0,0 @@
-name: CI
-
-on:
-    push:
-        branches: [main]
-    pull_request:
-        branches: [main]
-    workflow_dispatch: {}
-
-jobs:
-    build:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
-              with:
-                  node-version-file: .node-version
-                  cache: "npm"
-            - run: npm ci
-            - run: npm run build
-            - run: npm run check
-            - run: npm run test:ci
-            - name: Upload coverage
-              uses: actions/upload-artifact@v4
-              with:
-                  name: coverage
-                  path: coverage
-
-    publish:
-        if: startsWith(github.ref, 'refs/tags/')
-        needs: build
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
-              with:
-                  node-version-file: .node-version
-                  registry-url: "https://registry.npmjs.org/"
-            - run: npm ci
-            - run: npm run build
-            - run: npm publish --access public
-              env:
-                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -1,16 +1,8 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-pnpm-debug.log*
-lerna-debug.log*
-
-coverage
 node_modules
 dist
-dist-ssr
+coverage
+*.log
+*.tsbuildinfo
 *.local
 
 # Editor directories and files
@@ -20,8 +12,3 @@ dist-ssr
 !.vscode/tasks.json
 .idea
 .DS_Store
-*.suo
-*.ntvs*
-*.njsproj
-*.sln
-*.sw?

.node-version

@@ -1 +1 @@
-26
+26.8.2

.npmignore

@@ -1,14 +0,0 @@
-node_modules/
-coverage/
-*.log
-*.tsbuildinfo
-src/
-.vscode/
-.editorconfig
-.oxfmtrc.json
-.oxlintrc.json
-.node-version
-cspell.json
-lefthook.yml
-LICENSE
-commit-message-template

.npmrc

@@ -0,0 +1,5 @@
+# Turn the `engines` field from a warning into a gate. By default a Node
+# version mismatch is only reported as a notice, so an install run under an
+# unpinned Node still succeeds and silently rewrites package-lock.json using
+# that older npm's resolution rules. Refuse the install instead.
+engine-strict=true

.oxlintrc.json

@@ -13,13 +13,17 @@
         "eslint/no-undefined": "off",
         "eslint/sort-keys": "off",
         "eslint/id-length": "off",
-        "import/no-named-export": "off"
-    },
-    "env": {
-        "builtin": true,
-        "es2024": true,
-        "node": true
+        "import/no-named-export": "off",
+        "eslint/one-var": "off",
+        "import/group-exports": "off",
+        "import/exports-last": "off",
+        "eslint/sort-imports": "off",
+        "import/consistent-type-specifier-style": "off",
+        "unicorn/prefer-export-from": "off",
+        "typescript/method-signature-style": "off"
     },
+    "options": { "typeAware": true },
+    "env": { "builtin": true, "es2024": true, "node": true },
     "overrides": [
         {
             "files": ["**/*.test.ts"],
@@ -29,6 +33,12 @@
                 "import/no-nodejs-modules": "off",
                 "eslint/no-magic-numbers": "off"
             }
+        },
+        {
+            "files": ["scripts/**/*.ts"],
+            "rules": {
+                "import/no-nodejs-modules": "off"
+            }
         }
     ],
     "ignorePatterns": ["dist", "node_modules", "coverage"]

.pi/npm/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore

.pi/settings.json

@@ -0,0 +1,3 @@
+{
+    "packages": ["npm:@spences10/pi-lsp@0.0.46"]
+}

.vscode/extensions.json

@@ -2,6 +2,8 @@
     "recommendations": [
         "oxc.oxc-vscode",
         "streetsidesoftware.code-spell-checker",
-        "typescriptteam.native-preview"
+        "typescriptteam.native-preview",
+        "sandy081.todotasks",
+        "EditorConfig.EditorConfig"
     ]
 }

.vscode/settings.json

@@ -1,13 +1,20 @@
 {
-    "typescript.tsdk": "node_modules/typescript/lib",
     "[typescript]": {
         "editor.defaultFormatter": "oxc.oxc-vscode",
         "editor.formatOnSave": true
     },
+    "[typescriptreact]": {
+        "editor.defaultFormatter": "oxc.oxc-vscode",
+        "editor.formatOnSave": true
+    },
     "[javascript]": {
         "editor.defaultFormatter": "oxc.oxc-vscode",
         "editor.formatOnSave": true
     },
+    "[javascriptreact]": {
+        "editor.defaultFormatter": "oxc.oxc-vscode",
+        "editor.formatOnSave": true
+    },
     "[json]": {
         "editor.defaultFormatter": "oxc.oxc-vscode",
         "editor.formatOnSave": true
@@ -29,6 +36,5 @@
         "editor.formatOnSave": true
     },
     "editor.defaultFormatter": "oxc.oxc-vscode",
-    "editor.formatOnSave": true,
-    "js/ts.tsdk.path": "node_modules/typescript/lib"
+    "editor.formatOnSave": true
 }

AGENTS.md

@@ -0,0 +1,70 @@
+# AGENTS.md
+
+Machine entry point for AI coding agents working in this repo. The authoritative
+guidance for humans lives in [CONTRIBUTING.md](./CONTRIBUTING.md) and
+[README.md](./README.md); this file only points at it and states the stable
+first-action facts. Do not restate evolving prose here — it will drift.
+
+## First action
+
+- Project: F#-style pattern matching for TypeScript/ESM. Node `>=26` (pinned via `.node-version`), ESM-only (no CommonJS shim).
+- **While iterating:** `npm run test` (`check:tsc` + the unit suite) for fast feedback on the files you changed.
+- **Optional code intelligence:** this repo installs `@spences10/pi-lsp` (pinned in `.pi/settings.json`) as a project-local pi extension. It talks to the repo's own TypeScript 7 via `tsc --lsp --stdio` and exposes **read-only** tools — `lsp_hover`, `lsp_definition`, `lsp_references`, `lsp_find_symbol`, `lsp_document_symbols`, `lsp_diagnostics(_many)`. Prefer `lsp_references` over `grep -w` for widely-colliding identifiers (`matches`, `type`, …); use `lsp_hover` to read inferred types on generic-heavy code. It has no rename / code-action / apply-edit surface — the write side is pi's `edit` tool + `check:tsc`. Treat empty LSP output as _inconclusive_, not success: **`npm run test` / `npm run verify` remain the sole authoritative gate** (see the next bullet). The server keeps running across that gate with a ~5 min idle timeout and registers no file watchers, so if you change `tsconfig.json` / `package.json` mid-session its diagnostics can be stale — when LSP output disagrees with `check:tsc`, trust `check:tsc` and restart pi (or wait out the idle timeout) before concluding the LSP is wrong.
+- **Definition of done — run this before you call the work finished:** `npm run verify`. If all green, commit. If red, look at the output, fix the root cause, and re-run.
+- **On commit:** write a good message (see [CONTRIBUTING.md § Commit messages](./CONTRIBUTING.md#commit-messages)). Lefthook's pre-commit hook already runs the fast, offline, staged-file checks — don't run them by hand. If the hook fails on style, `npm run fix`, restage, recommit.
+- **Document decisions where the next maintainer will look:** rationale, rejected alternatives and known issues go in `development/<category>.md` (see [development/README.md](./development/README.md)); the actionable rule stays in [CONTRIBUTING.md](./CONTRIBUTING.md) and links to it. Write each fact once — never copy the rule into `development/` or the reason into `CONTRIBUTING.md` — and change both in the same commit when a rule changes.
+- **`npm run maintain` is NOT part of the feature loop.** Its scans are advisory, never a gate; run them only on an explicit maintenance / update-deps branch.
+
+    ```sh
+    npm run test    # while iterating (fast feedback)
+    npm run verify  # definition of done: whole-project correctness, one shot
+    ```
+
+## Never do
+
+Don't silence the type system to force a green run. As an agent these are forbidden:
+
+- `// @ts-nocheck`, `// @ts-ignore`, `// @ts-expect-error`
+- `// oxlint-disable` / `// oxlint-disable-next-line`
+- `as` casts used to push an expression through (type-aware oxlint already flags unsafe assertions)
+
+Fix the root cause with the type system instead — narrowing, generics, `satisfies`, conditional / mapped types, utility types (`NonNullable`, `Exclude`, …). TypeScript can express it; that's the intended tool. The `oxlint-disable`-location rule in [CONTRIBUTING.md § Rules the tools don't enforce](./CONTRIBUTING.md#rules-the-tools-dont-enforce) is a **human** last-resort convention (so a reviewer can spot a deliberate suppression) — it is not permission for you to add one. If the types genuinely cannot express something, stop and surface the conflict (commit message / handover) rather than suppress it.
+
+The same applies to the checks themselves: **never `git commit --no-verify`** (or otherwise skip a pre-commit / pre-push hook). The checks are fast and offline, so a redundant run is fine — bypassing a hook to get green is the identical anti-pattern. If a commit already skipped a hook, redo it through one: `git reset --soft HEAD~1 && git commit -C <skipped-sha>`.
+
+Never start a long-lived / blocking process such as `npm run watch`. It runs until a human stops it with Ctrl-C, so in an agent turn it hangs forever and floods the context with continuous output. Reach for a one-shot command instead — `npm run test` (or `npm run check`) — to get feedback.
+
+## Backlog
+
+`backlog.tasks` uses the vscode-todotasks format (not Markdown). A line ending in `:` is a project; every other line is a task. Status glyphs: `☐` open, `✔` done, `✘` cancelled; subtasks nest by indentation. Inline `@tags` carry metadata — `@done` / `@cancelled` mark completion, `@critical` / `@high` / `@low` / `@today` set priority. The `(…)` timestamp after `@done` is editor-generated: omit it when checking off by hand.
+
+**Required coupling:** a `✔` line _must_ also carry `@done`, and a `✘` line _must_ carry `@cancelled`. The `sandy081.todotasks` extension treats the glyph as the completion signal, then unconditionally searches for the matching tag to decorate; a bare `✔`/`✘` with no tag makes it compute an illegal `Range` (negative character offset) that throws and kills all highlighting/decoration for the document. A `☐` may stand alone. So check off by hand as `✔ … @done` (optionally `@done (timestamp)`), never a lone `✔`.
+
+### Working on tasks
+
+- **Task with subtasks** (a task that has indented children): create the branch with `npm run create:branch -- <prefix>/<desc>`, inferring the prefix from the task content (`feature/…` / `fix/…` / `chore/…`) — do not hand-write `git switch -c`, the command enforces the clean-tree / current-`main` / green-baseline precondition. Work on each subtask with commits, then present a concise handover for the user to review. Use this fixed shape:
+
+    ```md
+    ## Handover — <branch>
+
+    **Implemented:** <what was built, and how>
+    **Judgement calls:** <where the task was unclear, and what you assumed>
+    **Known problems:** <open issues, caveats, follow-ups>
+    ```
+
+    Once the user has no further objections, merge back: `npm run create:finish` (on the branch — it merges `--no-ff`, runs `npm run verify`, and deletes the branch). The branching model is documented in [CONTRIBUTING.md § Branching model](./CONTRIBUTING.md#branching-model).
+
+- **Leaf task** (no indented children): implement on the current branch and commit.
+
+In both cases, follow [CONTRIBUTING.md § Testing discipline (type-driven)](./CONTRIBUTING.md#testing-discipline-type-driven). Each subtask gets one or more commits.
+
+## Read these
+
+- [CONTRIBUTING.md § Rules the tools don't enforce](./CONTRIBUTING.md#rules-the-tools-dont-enforce) — the constraints the linters don't catch; CI/review bounce these. **The most important section.**
+- [CONTRIBUTING.md § Testing discipline (type-driven)](./CONTRIBUTING.md#testing-discipline-type-driven) — write the `expectTypeOf` (type) before the `assert` (red); the types are the feature.
+- [CONTRIBUTING.md § Script prefix convention](./CONTRIBUTING.md#script-prefix-convention) — adding an `npm run` script? reuse an existing prefix or it doesn't belong.
+- [CONTRIBUTING.md § Commit messages](./CONTRIBUTING.md#commit-messages) — gitmoji + imperative + 50/72.
+- [CONTRIBUTING.md § Feedback tiers](./CONTRIBUTING.md#feedback-tiers) — what runs when and at what cost (`watch` / pre-commit / pre-push / `check` / `verify` / `fix` / `maintain` / CI).
+- [development/](./development/README.md) — the decisions, rejected alternatives and known issues behind the rules; the “why” that CONTRIBUTING.md links to. Read the relevant file before changing an area.
+- [development/tooling.md](./development/tooling.md) — the rationale behind each tool choice; read before changing tooling.
+- [package.json `#scripts`](./package.json) — the source of truth for every command (the `LEFTHOOK_FILES` convention scopes them to staged files vs. the whole project).

CHANGELOG.md

@@ -0,0 +1,53 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0/).
+
+## [Unreleased]
+
+## [0.1.7] - 2026-09-16
+
+- require a short summary under `[Unreleased]` in the changelog before a branch is finished
+- let `create:branch` start from a `main` that is ahead of its upstream, so a finished merge no longer blocks the next branch until it is pushed
+
+## [0.1.6] - 2026-09-15
+
+- restructure the documentation: README.md for users, CONTRIBUTING.md for contributors, and development/ for the decisions, rejected alternatives and known issues
+- document the decisions and known issues for CI, tooling, testing, publishing and the workflow
+
+## [0.1.5] - 2026-09-15
+
+- improve CI configuration
+
+## [0.1.4] - 2026-09-14
+
+- fix CI to node from custom image
+- upgrade dependencies
+
+## [0.1.3] - 2026-09-14
+
+- change to custom image for CI
+
+## [0.1.2] - 2026-09-14
+
+- upgrade dependencies
+
+## [0.1.1] - 2026-09-14
+
+- upgrade dependencies
+
+## [0.1.0] - 2026-09-14
+
+- basic setup
+
+[Unreleased]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.7...main
+[0.1.7]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.6...0.1.7
+[0.1.6]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.5...0.1.6
+[0.1.5]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.4...0.1.5
+[0.1.4]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.3...0.1.4
+[0.1.3]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.2...0.1.3
+[0.1.2]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.1...0.1.2
+[0.1.1]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.0...0.1.1
+[0.1.0]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/20308c5a6d8cccfb09b02ac2ebebd8055e91cd11...0.1.0

CONTRIBUTING.md

@@ -0,0 +1,224 @@
+# Contributing
+
+This document is for maintainers and contributors working on the project
+itself. End-user documentation is in [README.md](./README.md). The reasons
+behind the rules here — the decisions, rejected alternatives, and known issues —
+live in [development/](./development/README.md). The machine entry point for AI
+coding agents is [AGENTS.md](./AGENTS.md); keep this file as the prose home for
+the rules so agents and humans don't diverge.
+
+## Setup
+
+1. Clone the repository.
+2. Install Node.js >= 26 — see [.node-version](./.node-version); the exact pinned
+   version is what CI and the runner image use.
+3. `npm ci`.
+4. `npm run setup` — the one-time clone configuration (currently registers the
+   commit-message template).
+
+## Development commands
+
+- **Build:** `npm run build`
+- **Test:** `npm run test`, `npm run test:ci`
+- **Watch:** `npm run watch` - re-runs tests on file save, humans only
+- **Checks:** `npm run check`, `npm run fix`
+- **Verify:** `npm run verify` — the definition of done
+- **Maintenance:** `npm run maintain` — advisory only
+- **Individual fixes:** `npm run fix:oxfmt`, `npm run fix:oxlint`
+
+## Feedback tiers
+
+The tools are organized into a feedback ladder. Each tier catches different
+things at different costs; the rule of thumb is "earlier tiers fire more often,
+faster tiers catch less, slower tiers are more thorough":
+
+| Tier                             | When                    | What it runs                                                                                                                                            | Time  |
+| -------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| `npm run watch`                  | manual                  | `watch:test` — re-runs tests on file save                                                                                                               | ~0.1s |
+| Pre-commit (auto)                | on stage                | tsc + oxlint + oxfmt + cspell (staged files only)                                                                                                       | ~1.3s |
+| Pre-push (auto)                  | on push                 | `npm test` (full tsc + unit tests)                                                                                                                      | ~3.5s |
+| `npm run check`                  | manual                  | Correctness gates: tsc + oxlint + oxfmt + cspell (whole project)                                                                                        | ~3s   |
+| `npm run verify`                 | manual                  | Definition of done: `npm run check` + unit tests, one shot                                                                                              | ~6s   |
+| `npm run fix`                    | manual                  | Auto-resolve fixable issues (lint, format)                                                                                                              | ~3s   |
+| `npm run maintain`               | manual / CI (advisory)  | `maintain:knip` + `maintain:outdated` (whole-project + network scans)                                                                                   | ~10s  |
+| CI build (auto)                  | on push to `main` / tag | `build` job (build + correctness + packaging) — see [.gitea/workflows/ci.yml](./.gitea/workflows/ci.yml)                                                | ~30s+ |
+| CI maintain (auto, non-blocking) | on push to `main`       | `npm run maintain` — reports, never fails the build                                                                                                     | ~10s  |
+| CI publish (auto)                | on tag                  | packaging checks + `publish:publint` / `publish:attw`, then the Gitea release page and `npm publish` (skipped, and the job failed, without `NPM_TOKEN`) | ~15s  |
+
+Before pushing, run `npm run verify` — the one-shot correctness gate. Run
+`npm run maintain` only on a maintenance / update-deps branch. Why the splits
+are where they are: [development/workflow.md § Feedback tiers](./development/workflow.md#feedback-tiers).
+
+## Testing discipline (type-driven)
+
+For this library the types _are_ the feature, so development is **type-driven**:
+the compile-time expectation is written before the runtime assertion, and both
+before the implementation. The loop is **type → red → green → refactor**:
+
+1. **Type** — write the compile-time expectation first
+   (`expectTypeOf(...).toEqualTypeOf<…>()`) and let `npm run check:tsc` fail on
+   the _type_. The type error is the spec you want to hit before the runtime
+   logic exists.
+2. **Red** — add the matching runtime assertion (`assert.*`) so
+   `npm run test:unit` now fails on behavior.
+3. **Green** — implement in `src/*.ts` until both the type check and the test
+   pass.
+4. **Refactor** — with the type system and the tests as the safety net, then
+   `npm run verify` as the definition-of-done gate.
+
+Every test pairs an `expectTypeOf(...)` with an `assert.*`; keep them together.
+Type-first is enforced structurally: `npm test` runs `check:tsc` before the
+test runner, so a wrong type can never be papered over by a passing assertion.
+Per [AGENTS.md § Never do](./AGENTS.md#never-do), reach green honestly — fix the
+types, never suppress the checks you can't make pass. Full rationale:
+[development/testing.md](./development/testing.md).
+
+## Code style and formatting
+
+`oxfmt` is the formatter and `oxlint` is the linter (with type-aware rules).
+`npm run fix` resolves the fixable issues; `npm run check` verifies without
+writing. Suppressions must be fixed at the root — do not add `oxlint-disable`
+directives or `as` casts to force a green run (see
+[AGENTS.md § Never do](./AGENTS.md#never-do)).
+
+Suggested VSCode extensions are in
+[.vscode/extensions.json](./.vscode/extensions.json); the project's formatter
+and linter are wired up there. Toolchain decisions:
+[development/tooling.md](./development/tooling.md).
+
+## Commit messages
+
+Gitmoji subject, imperative mood, 50/72 wrapping. The template is
+[commit-message-template](./commit-message-template); `npm run setup`
+(or `npm run setup:git-commit-message`) registers it as git's
+`commit.template`. Examples and rationale:
+[development/workflow.md § Commit messages](./development/workflow.md#commit-messages).
+
+## Script prefix convention
+
+Script names in `package.json` use a prefix that signals _when_ the script is
+intended to run. A `<prefix>:<name>` script is implicitly aggregated by a
+`<prefix>` script (if one exists) and run by the corresponding lefthook hook or
+CI step. Pick the prefix that matches the script's lifecycle:
+
+- `create:*` — front doors of the repo's own workflow; these mutate git state
+  rather than the source. `create:branch` opens a unit of work, `create:finish`
+  closes the branch half, `create:release` closes the release half
+  (maintainer-only). No bare `create` aggregator on purpose.
+- `check:*` — read-only verification; never modifies files. Aggregated by
+  `npm run check`.
+- `fix:*` — mutating counterpart of a `check:*` script. Aggregated by
+  `npm run fix`; the diff is the review surface.
+- `test:*` — test scripts. `test` is the canonical entry point (`check:tsc` +
+  unit tests); `test:unit` skips the typecheck for fast local iteration;
+  `test:ci` adds c8 coverage.
+- `watch:*` — long-running watchers for the manual inner dev loop. Aggregated by
+  `watch`.
+- `maintain:*` — advisory repo-maintenance scans: read-only, but whole-project
+  and/or network-bound, so never a correctness gate. Aggregated by
+  `npm run maintain`.
+- `publish:*` — validates the _publishable artifact_ (e.g. `dist/`) rather than
+  the source, so it needs a fresh build.
+- `setup:*` — one-time configuration of a fresh clone; mutates the local
+  environment rather than the repo source, so it is never part of a hook or CI
+  step. Aggregated by `npm run setup`, run once after cloning.
+
+A new script must reuse an existing prefix. If none fits, that's a signal the
+script doesn't belong in the pipeline — not a reason to invent a new prefix. If
+it genuinely does belong, add the prefix to this list in the same commit as its
+first member; an undocumented prefix becomes invisible and quietly accrues
+members. Why `create:` exists, the rejected names, and the design of the bare
+scripts: [development/workflow.md § Script prefix convention](./development/workflow.md#script-prefix-convention).
+
+## Rules the tools don't enforce
+
+CI and review will bounce these even though `npm run check` and the linters
+don't catch them. They're the high-frequency things a contributor (or an agent)
+reaches for by default:
+
+- **Source imports use `.ts` extensions, never `.js`.** `node --strip-types`
+  only resolves the `.ts` form at test time; "pre-fixing" an import to `.js`
+  breaks the inner loop. (why:
+  [development/tooling.md](./development/tooling.md#source-imports-use-ts-extensions))
+- **A new `npm run` script must reuse an existing prefix.** See
+  [Script prefix convention](#script-prefix-convention).
+- **`oxlint-disable` directives live in source, not `.oxlintrc.json`.** The
+  trade-off must sit next to the code it silences. This is a _human_ last-resort
+  convention; agents must not add these — see
+  [AGENTS.md § Never do](./AGENTS.md#never-do). (why:
+  [development/tooling.md](./development/tooling.md#oxlint-disable-directives-live-next-to-the-code))
+- **Don't put slow / network / whole-project scans in `check` or pre-commit.**
+  Advisory scans are not correctness gates; they belong under `maintain:`. (why:
+  [development/workflow.md](./development/workflow.md#feedback-tiers))
+- **New work starts with `npm run create:branch`, never a hand-written
+  `git switch -c` / `git checkout -b`.** The command carries the branch
+  precondition; branching around it skips the clean-tree, current-`main` and
+  green-baseline checks, and the skip is invisible until a failure can no longer
+  be attributed. (why:
+  [development/workflow.md](./development/workflow.md#branching-model))
+- **Work is merged back with `npm run create:finish`, never a hand-written
+  `git merge`.** The command carries the merge-side preconditions (clean tree,
+  current `main`, a `feature/`/`fix/`/`chore/` branch) and runs `npm run verify`
+  after the merge, so a merge cannot land unverified. (why:
+  [development/workflow.md](./development/workflow.md#branching-model))
+- **There is no local `npm run publish`, and `publish:publint` / `publish:attw`
+  don't go in `check`.** (why:
+  [development/publishing.md](./development/publishing.md#ci-only-publishing))
+- **A branch ends with a changelog note:** before `npm run create:finish`,
+  summarize the work under `[Unreleased]` in [CHANGELOG.md](./CHANGELOG.md).
+  (why:
+  [development/workflow.md](./development/workflow.md#changelog-notes))
+- **A decision or its rationale belongs in `development/`, not here.** This file
+  holds the actionable rule; `development/<category>.md` holds why, the rejected
+  alternatives and the known issues. When you change a rule, update its category
+  file in the same commit and cross-link the two. (why:
+  [development/README.md](./development/README.md))
+
+## Branching model
+
+**GitHub Flow (single-developer).** Every change — feature, fix, refactor —
+branches off `main` and is merged back via a local commit. There is no pull
+request workflow on Gitea yet.
+
+- **Base branch:** `main`
+- **Branch naming:** `feature/<desc>` / `fix/<desc>` / `chore/<desc>`
+- **Starting work:** `npm run create:branch -- <prefix>/<desc>`. It refuses,
+  without changing anything, unless the working tree is clean, no
+  merge/rebase/cherry-pick is in progress, `main` is not behind its upstream
+  (a local merge not yet pushed is fine — the push belongs to `create:release`),
+  and `npm run test` is green on `main`. The prefix is _your_ call, inferred from
+  the task; the script validates it rather than guessing it.
+- **Merging:** `npm run create:finish` (on the branch). It re-asserts the same
+  preconditions, merges `--no-ff`, runs `npm run verify`, and deletes the branch
+  only after the merge is green. The push is left to `create:release`, so the
+  merge stays local and reviewable.
+- CI runs on every push to `main` — see [Feedback tiers](#feedback-tiers) and
+  [.gitea/workflows/ci.yml](./.gitea/workflows/ci.yml).
+- **Releases are NOT triggered by pushes.** Only the maintainer triggers a
+  release; see [Publishing](#publishing).
+
+Full rationale, including the front-door decisions:
+[development/workflow.md § Branching model](./development/workflow.md#branching-model).
+
+## Submitting changes
+
+There is no pull request workflow on Gitea yet, so a contribution is submitted
+as a branch that is merged locally:
+
+1. `npm run create:branch -- <prefix>/<desc>`.
+2. Commit your work (one or more commits, per the tests and style rules above).
+3. `npm run verify` — the definition of done.
+4. Add a changelog note under `[Unreleased]` (see
+   [Rules the tools don't enforce](#rules-the-tools-dont-enforce)).
+5. `npm run create:finish` to merge the branch into `main` and verify the
+   result.
+6. Present a handover for review. Once there are no further objections, the
+   maintainer pushes.
+
+When the project is promoted to GitHub, this step becomes a normal pull request
+against `main`.
+
+## Publishing
+
+Publishing is maintainer-only and CI-only. See
+[development/publishing.md](./development/publishing.md).

README.md

@@ -2,41 +2,172 @@
 
 Pattern matching for TypeScript/ESM environments (F#-style, not regex).
 
-## Development
+## Synopsis
 
-- **Build:** `npm run build`
-- **Test:** `npm run test`, `npm run test:ci`
-- **Checks:** `npm run check`, `npm run fix`
-- **Format/Fix:** `npm run fix:oxfmt`, `npm run fix:oxlint`
+```ts
+import { match, P } from "tiny-pattern-ts";
 
-### Tooling
+const reply = (answer: "yes" | "no") =>
+    match(answer)
+        .with(P.literal("yes"), (): "agreed" => "agreed")
+        .with(P.literal("no"), (): "declined" => "declined")
+        .exhaustive();
 
-- **TypeScript 7** — type checker and build (`tsc`).
-- **node --test** + `--experimental-strip-types` — test runner (Node 22.6+, flag dropped on Node 24).
-- **c8** — code coverage for `test:ci`.
-- **oxlint** — Rust-based linter.
-- **oxfmt** — Rust-based formatter (Prettier-compatible). Formats JS/TS, JSON/JSONC, YAML, Markdown, MDX, and more; built-in `package.json` key sorting replaces `sort-package-json`.
-- **cspell** — spell checking.
-- **lefthook** — git pre-commit hooks.
+reply("yes"); // "agreed"
+```
 
-### Requirements
+## Description
 
-- Node.js >= 22.6 (>= 24 recommended; `--experimental-strip-types` is unflagged on 24).
+`tiny-pattern-ts` gives TypeScript the shape of F#-style pattern matching:
+a value flows through a chain of patterns, the first one that matches runs its
+handler, and the handler receives the value narrowed to that pattern's type. The
+"patterns" are ordinary objects whose `matches` method is a TypeScript type
+guard, so narrowing composes the way any other guard does.
 
-## VSCode integration
+It is deliberately not a regex engine and not a macro. There is no transpiler
+and no DSL to learn: `match(value)` returns a builder, `.with(pattern, handler)`
+adds a case, and the chain ends in either `.exhaustive()` or `.otherwise(...)`.
+The type-level contract is the feature — see
+[development/library.md](./development/library.md) for the design decisions and
+the known limitations.
 
-- Recommended extensions: see `.vscode/extensions.json` (oxc, cspell).
-- TypeScript 7 is used via `typescript.tsdk` pointing at `node_modules/typescript/lib`.
-- oxc extension provides oxlint squiggles and oxfmt format-on-save.
+## Requirements
 
-## Workflows
+- **Node.js >= 26** (`engines` field; pinned via `.node-version`).
+- **TypeScript >= 5.0** to consume the published declarations. The emitted `.d.ts`
+  use `const` type parameters (TS 5.0) and keep their relative `.ts` specifiers;
+  both resolve on TS >= 5.0 in `node10` / `node16` / `nodenext` / `bundler`.
+- The package is **ESM-only** (no CommonJS shim).
 
-- Version updates via `npm version`.
-- Publishing via GitHub Actions on tagged commits (see `.github/workflows/ci.yml`).
+## Examples
 
-## Contribution guidelines
+### Literal matching and `exhaustive()`
 
-- Commit signing (GPG).
-- Set up commit message template: `npm run use:git-commit-message`.
-- See `commit-message-template`.
-- Type-only tests use `expect-type`'s `expectTypeOf(...)` inside `node --test` cases.
+`.exhaustive()` returns the union of the handler return types and throws if no
+case matched. Annotate handler returns when you want literal types rather than
+`string`:
+
+```ts
+type Answer = "yes" | "no";
+
+const reply = (answer: Answer): "agreed" | "declined" =>
+    match(answer)
+        .with(P.literal("yes"), (): "agreed" => "agreed")
+        .with(P.literal("no"), (): "declined" => "declined")
+        .exhaustive();
+
+reply("yes"); // "agreed"
+```
+
+`exhaustive()` checks at runtime, not at compile time — TypeScript does not force
+every union member to have a case (see
+[development/library.md](./development/library.md#exhaustive-is-a-runtime-check)).
+Use `.otherwise(...)` when a fallback is wanted:
+
+```ts
+const label = (answer: Answer): string =>
+    match(answer)
+        .with(P.literal("yes"), () => "agreed")
+        .otherwise(() => "not agreed");
+```
+
+### Matching by `typeof`
+
+`P.type<T>(name)` pairs an explicit type `T` with the runtime `typeof` name it
+should test for:
+
+```ts
+const describe = (value: unknown): string =>
+    match(value)
+        .with(P.type<string>("string"), (s) => `string of length ${s.length}`)
+        .with(P.type<number>("number"), (n) => `number ${n.toFixed(2)}`)
+        .otherwise(() => "something else");
+```
+
+The supported names are `string`, `number`, `boolean`, `bigint`, `symbol`,
+`undefined`, `object`, and `function`. `"object"` matches non-null objects and
+functions; `"undefined"` compares against `undefined` directly.
+
+### Structural matching and discriminated unions
+
+`P.shape(shape, refine?)` checks that every key in `shape` exists on the value.
+A value that is itself a matcher is applied, otherwise it is compared with
+strict equality. To narrow to a concrete type, pass a `refine` type guard:
+
+```ts
+interface Circle {
+    readonly kind: "circle";
+    readonly radius: number;
+}
+
+interface Square {
+    readonly kind: "square";
+    readonly side: number;
+}
+
+type Shape = Circle | Square;
+
+const area = (shape: Shape): number =>
+    match(shape)
+        .with(
+            P.shape({ kind: "circle" }, (v): v is Circle => "radius" in v),
+            (c) => Math.PI * c.radius ** 2,
+        )
+        .with(
+            P.shape({ kind: "square" }, (v): v is Square => "side" in v),
+            (s) => s.side ** 2,
+        )
+        .exhaustive();
+```
+
+Without `refine`, `P.shape` returns a matcher for the shape's own type, not the
+narrowed one. Nested matchers can be used in the shape object, for example
+`P.shape({ name: P.type<string>("string") })`.
+
+### Custom guards with `when`
+
+`P.when` takes a type guard and infers the narrowed type from it:
+
+```ts
+const toNumber = (value: unknown): number =>
+    match(value)
+        .with(
+            P.when((v): v is string => typeof v === "string"),
+            (s) => Number.parseInt(s, 10),
+        )
+        .otherwise(() => 0);
+```
+
+### Widening with `any`
+
+`P.any<T>(predicate)` takes a plain boolean predicate and a declared type `T`,
+for cases where the predicate cannot be written as a type guard:
+
+```ts
+const firstNumber = (items: readonly unknown[]): number | undefined =>
+    match(items)
+        .with(
+            P.any<readonly number[]>(
+                (v) =>
+                    Array.isArray(v) &&
+                    v.every((item) => typeof item === "number"),
+            ),
+            (xs) => xs[0],
+        )
+        .otherwise(() => undefined);
+```
+
+## API
+
+Yet to be implemented
+
+## License
+
+MIT © 2025 tmu. See [LICENSE](./LICENSE).
+
+## Contributing
+
+Contributions are documented in [CONTRIBUTING.md](./CONTRIBUTING.md); the
+reasons behind the project's decisions, rejected alternatives, and known issues
+live in [development/](./development/README.md). AI coding agents start at
+[AGENTS.md](./AGENTS.md).

backlog.tasks

@@ -0,0 +1,45 @@
+Tasks
+
+Backlog and tracking for tiny-pattern-ts. Managed in vscode-todotasks format.
+
+---
+
+Setup:
+☐ Split off template into separate package => pi --session 01a07dde-7050-7054-bb36-1606d7eb2bc3 @high
+
+v1.0:
+☐ API surface is stable and fully typed
+    ☐ Finalize public exports in `src/index.ts`
+    ☐ Document all exported types and functions
+    ☐ Add JSDoc for public APIs
+☐ Test coverage meets threshold
+    ☐ Achieve 100% branch coverage on `src/pattern.ts`
+    ☐ Achieve 100% branch coverage on `src/match.ts`
+    ☐ Achieve 100% branch coverage on `src/index.ts`
+
+Bugs:
+
+Enhancements:
+
+Documentation:
+☐ Create `examples/` directory with runnable snippets
+☐ Add comparison section vs. other TS pattern-matching libs in Readme.md
+☐ Write migration guide for users coming from discriminated unions
+☐ Create backlog tasks for implementation
+☐ Validate code fences in Markdown (start with README.md) — compile the TypeScript examples against `src/` so the docs cannot drift from the API
+
+Workflow:
+✔ Resolve the finish/push tension: `create:finish` leaves `main` ahead of its upstream while `create:branch` refuses until `main` matches upstream — decide whether `finish` should push or `branch` should compare only `BEHIND` (see development/workflow.md) @done
+
+Maintenance:
+☐ Serve CI coverage over a tiny self-hosted webserver (replace the zip artifact) @low
+    ☐ Explore serving coverage for non-tag pushes (e.g. `main/coverage`, PR previews) @low
+    → design: no deploy step in CI; the webserver just exposes the shared directory (decided over Gitea Pages / Codecov — neither confirmed available/ wanted)
+☐ serve docs over self hosted server @low
+    ☐ Add a minimal dir-listing webserver to the gitea docker setup for serving docs (reuse existing reverse proxy)
+    ☐ CI writes docs to a shared volume keyed by project + tag (e.g. `/docs/tiny-pattern-ts/<tag>/`)
+    ☐ Browse to `…/docs/<repo>/<tag>/index.html` in the browser
+☐ serve landing page over self hosted server @low
+    ☐ Add a minimal dir-listing webserver to the gitea docker setup for serving landing page (reuse existing reverse proxy)
+    ☐ CI writes landing page to a shared volume keyed by project + tag (e.g. `/landing/tiny-pattern-ts/<tag>/`)
+    ☐ Browse to `…/tiny-pattern-ts/index.html` in the browser

cspell.json

@@ -2,8 +2,6 @@
     "version": "0.2",
     "language": "en",
     "words": [
-        "tslib",
-        "typefest",
         "lefthook",
         "oxlint",
         "oxfmt",
@@ -15,14 +13,36 @@
         "typescriptteam",
         "gitmoji",
         "dbaeumer",
-        "msvc"
+        "msvc",
+        "publint",
+        "attw",
+        "arethetypeswrong",
+        "knip",
+        "tsgolint",
+        "tsgo",
+        "tsserver",
+        "gitea",
+        "lipanski",
+        "pubv",
+        "knope",
+        "runwisp",
+        "glab",
+        "hostedtoolcache",
+        "nodebase",
+        "frontends",
+        "catthehacker",
+        "nsnull",
+        "dedup",
+        "dedupe",
+        "repoint",
+        "postversion",
+        "prebuild",
+        "Zilla",
+        "kacl",
+        "bestikk",
+        "silverwind",
+        "idris",
+        "todotasks"
     ],
-    "ignorePaths": [
-        "dist",
-        "node_modules",
-        "public",
-        "coverage",
-        "*.svg",
-        ".gitignore"
-    ]
+    "ignorePaths": ["dist", "node_modules", "coverage", "*.svg", ".gitignore"]
 }

development/README.md

@@ -0,0 +1,78 @@
+# Development documentation
+
+Why this project works the way it does: the decisions, what was rejected, and
+the shortcomings and known issues we carry. Written for maintainers and
+contributors.
+
+The actionable rules — setup, running, testing, submitting — live in
+[CONTRIBUTING.md](../CONTRIBUTING.md). **Each fact is written once**: the rule
+there, the reason here; neither restates the other, and where a fact is useful
+in both they link. Read the relevant file before changing an area, and when a
+rule changes update its rationale here in the same commit.
+
+User-facing documentation is [README.md](../README.md). `docs/` is deliberately
+unused: that name is reserved for the future user documentation site, and
+deploying it is out of scope. These files are not part of that site.
+
+## Layout
+
+One file per category:
+
+| File                             | Covers                                                                  |
+| -------------------------------- | ----------------------------------------------------------------------- |
+| [library.md](./library.md)       | Public API design, the type-level contract, and its limitations         |
+| [workflow.md](./workflow.md)     | Branching and merging, script prefixes, feedback tiers, commit messages |
+| [tooling.md](./tooling.md)       | Toolchain choices and configuration, editor setup                       |
+| [testing.md](./testing.md)       | Test strategy and type-driven development                               |
+| [ci.md](./ci.md)                 | CI pipeline, runner image, coverage serving                             |
+| [publishing.md](./publishing.md) | Release and npm publishing                                              |
+
+We start with one file per category so each area stays small enough to hold in
+mind; a category that outgrows it becomes a folder with an index, and the links
+in CONTRIBUTING.md and README.md point at the category, not a single decision.
+
+## Decision blocks
+
+Record every non-obvious choice as a block in the relevant category file:
+
+```md
+## Runner image
+
+#### Decision (2026-09)
+
+Bake Node into the CI job image at the setup-node tool-cache layout instead
+of downloading per job.
+
+#### Why
+
+- ...
+
+#### Rejected
+
+- Gitea Pages / per-job download
+- force-pull
+
+#### Known issue
+
+- a Dockerfile-only change re-pushed under an unchanged tag is invisible to the runner
+    - recover with `docker rmi <image>`
+```
+
+- The date is the month the decision was made, not when the file was edited —
+  the anchor for "current" versus "was current once".
+- `Rejected` stops the project re-litigating the same alternatives; an empty one
+  usually means they were never written down.
+- `Known issue` is where shortcomings live. A caveat not tied to one decision
+  goes under a `## Known issues` section at the end of the file.
+- Replace a superseded decision in place rather than archiving it; git history
+  is the archive.
+
+## Adding to these docs
+
+1. Pick the category: `library`, `workflow`, `tooling`, `testing`, `ci`,
+   `publishing`.
+2. Add or update a decision block; keep existing text unless the decision
+   changed.
+3. If an actionable rule changes, update
+   [CONTRIBUTING.md](../CONTRIBUTING.md) in the same commit and cross-link.
+   Never change a rule there without updating its rationale here.

development/ci.md

@@ -0,0 +1,136 @@
+# CI
+
+[.gitea/workflows/ci.yml](../.gitea/workflows/ci.yml) is the source of truth for
+the job graph; this file records why it is shaped the way it is.
+
+## Pipeline
+
+- **`build`** (push to `main` / tag) — build + correctness + packaging.
+- **`maintain`** (push to `main`, non-blocking) — `npm run maintain`; reports,
+  never fails the build.
+- **`publish`** (tag) — packaging checks + `publish:publint` / `publish:attw`,
+  then the Gitea release page and `npm publish` (see
+  [publishing.md](./publishing.md)).
+- **`release-gate`** — on a `:rocket: Release x.y.z` commit it skips
+  `build`/`maintain`, because `create:release` pushes the tag for the same commit
+  right after and the tag run is authoritative. It uses no Node and stays on the
+  default image.
+
+## Runner image
+
+#### Decision (2026-09)
+
+`build` / `maintain` / `publish` run in `gitea.e1nsnull.de/tmu/act-ci:<version>`
+([docker/Dockerfile](../docker/Dockerfile)): the default act image with Node
+overlaid at the exact `/opt/hostedtoolcache` layout `actions/setup-node` probes.
+
+#### Why
+
+- No job pays the ~50 MB Node fetch, because the probe hits the baked entry.
+- The tag must equal the exact [.node-version](../.node-version) pin, and the
+  image is rebuilt only as part of a Node bump — there is no other trigger.
+- Building needs a docker daemon and registry credentials, so it belongs to no
+  feedback tier. That is why it is **not** an `npm run` script: no
+  [prefix](./workflow.md#script-prefix-convention) fits, and that is the signal.
+
+#### Rejected
+
+- Downloading Node in every job — the ~50 MB fetch was the original problem.
+- Caching Proxy (Squid or similar) — adds complexity to global setup
+- Mounting the tool cache - No invalidation will fill the cache with stale versions
+
+## Bumping Node
+
+Bumping Node is one coordinated change, committed as a unit:
+
+1. Edit [.node-version](../.node-version) to the exact `x.y.z` — floats like `26`
+   resolve to the latest patch at runtime and bust the baked entry, so
+   [scripts/runner-image.sh](../scripts/runner-image.sh) refuses them.
+2. `docker login gitea.e1nsnull.de` (user + package/access token), then
+   `./scripts/runner-image.sh --push`, which reads the version and pushes
+   `<IMAGE_REPO>:<version>`.
+3. Repoint the three `container.image` tags in
+   [.gitea/workflows/ci.yml](../.gitea/workflows/ci.yml) to that version.
+
+Skipping step 2 fails CI at image pull; skipping step 3 silently reverts to the
+per-job download.
+
+## Image invariants
+
+For the `setup-node` probe to hit, two things must hold — both easy to break:
+
+### The `x64.complete` marker
+
+#### Decision (2026-09)
+
+Bake a `<version>/<arch>.complete` marker next to the Node directory.
+
+#### Why
+
+- `actions/tool-cache` accepts a cached tool only when
+  `<version>/<arch>.complete` exists beside it (`tc.find()` checks). A bare
+  `node/<version>/x64/` is ignored and the download happens anyway. See the
+  comment in [docker/Dockerfile](../docker/Dockerfile).
+
+### Tag freshness, with force-pull deliberately off
+
+#### Decision (2026-09)
+
+Leave `act_runner`'s `force_pull` disabled.
+
+#### Why
+
+- The tag encodes only the Node version, and the image is rebuilt only when that
+  changes — so the normal flow always yields a new tag and the runner pulls it.
+- Forcing a pull re-pulls the image on every job for no benefit.
+
+#### Rejected
+
+- Enabling `force_pull`: it is acceptable to miss a runner-side image change,
+  and a `Dockerfile`-only change is not worth a per-job pull.
+
+#### Known issue
+
+- A `Dockerfile`-only change (like the marker above) re-pushed under an
+  unchanged tag is invisible to the runner, which keeps the old image while the
+  registry shows the new digest. Remove the stale tag on the runner host
+  (`docker rmi gitea.e1nsnull.de/tmu/act-ci:<version>`); do not reach for
+  force-pull.
+
+## Coverage serving
+
+#### Decision (2026-09)
+
+Serve CI coverage from a shared directory on the runner, with no deploy step in
+CI.
+
+#### Why
+
+- The webserver exposes the shared directory and the Gitea docker setup reuses
+  the existing reverse proxy — no upload artifact, no external service.
+- Coverage is written to a shared volume keyed by project and tag (for example
+  `/docs/tiny-pattern-ts/<tag>/`).
+
+#### Rejected
+
+- Gitea Pages and Codecov: neither was confirmed available or wanted.
+
+#### Known issue
+
+- Coverage is served for tag pushes only; non-tag pushes (for example
+  `main/coverage`) are tracked separately.
+
+[scripts/precompress.ts](../scripts/precompress.ts) emits `.br` / `.gz` / `.zst`
+sidecars next to text assets. The Gitea pages service (`static-web-server` with
+`SERVER_COMPRESSION_STATIC=true`) serves the sidecar matching `Accept-Encoding`
+and falls back to the original.
+
+#### Decision (2026-09)
+
+Precompress into sidecars rather than per request.
+
+#### Why
+
+- The assets are static and change only on deploy, so the work is paid once.
+- Images, fonts and archives are already compressed; a sidecar would only grow
+  them, so only text extensions are emitted.

development/library.md

@@ -0,0 +1,6 @@
+# Library design
+
+The type-level design of the public API and the limitations it carries. The
+user-facing reference is [README § API](../README.md#api).
+
+Currently the library is placeholder code.

development/publishing.md

@@ -0,0 +1,131 @@
+# Publishing
+
+Publishing is CI-only: local `npm publish` is not supported, and the maintainer
+triggers releases from `main`. The mechanics are in
+[scripts/release.sh](../scripts/release.sh) and
+[scripts/release-notes.sh](../scripts/release-notes.sh); the job graph is
+[.gitea/workflows/ci.yml](../.gitea/workflows/ci.yml).
+
+## Release steps
+
+1. All intended changes are merged to `main` and passing CI.
+2. The maintainer runs `npm run create:release`. VS Code opens
+   [CHANGELOG.md](../CHANGELOG.md) to finalize the `[Unreleased]` notes; because
+   pubv refuses a dirty tree, the edit is committed first (then folded into the
+   release commit), and pubv suggests a version from those notes to confirm or
+   edit.
+3. `scripts/release.sh` creates one release commit (graduated changelog +
+   `package.json` bump, amended together), tags it, and pushes.
+4. CI fires on both pushes. `publish` runs on the tag (build + publish checks +
+   release page + `npm publish`), while `release-gate` recognizes the release
+   commit and skips `build`/`maintain`: the tag verifies the identical SHA, so no
+   work is duplicated. The publish checks pass before the artifact is published,
+   and the release page is created from the matching Keep-a-Changelog section
+   _before_ `npm publish`, so a broken page fails CI without consuming a version
+   and `npm publish` stays the last step.
+
+## CI-only publishing
+
+#### Decision (2026-09)
+
+Releases are cut by CI from `main`; there is no local `npm publish` and no
+`publish:*` script in the `check` chain.
+
+#### Why
+
+- The tag is the artifact marker: CI verifies the exact commit it points at, so
+  a local publish could ship something the tag does not describe.
+- `publish:publint` / `publish:attw` validate the _publishable artifact_, which
+  needs a fresh build; they are not source-correctness checks and do not belong
+  in `check`.
+
+## The release commit is assembled from two tools
+
+#### Decision (2026-09)
+
+`create:release` uses `pubv` for the changelog graduation and bump heuristic,
+then `npm version` for the `package.json` + lockfile bump, amended into a single
+release commit.
+
+#### Why
+
+- We want hand-written Keep-a-Changelog notes, an `[Unreleased]` ->
+  `## [x.y.z] - DATE` graduation, and a tag on the exact commit that gets
+  published — and no single tool did both the graduation and the `package.json`
+  bump.
+- Split by strength: `pubv` (tiny, changelog-driven) owns preflight, the
+  interactive major/minor/patch heuristic, and graduating and committing
+  `CHANGELOG.md` (no tag, no push); `npm version` syncs `package.json` + the
+  lockfile; `--amend` folds them into one commit; the tag is created _after_ the
+  amend so it is never orphaned.
+- The notes are finalized _before_ pubv because its bump heuristic reads the
+  `[Unreleased]` body — editing afterwards would inform the changelog only, not
+  the version. The staging commit that satisfies pubv's clean-tree check is
+  folded back into the single release commit.
+
+#### Rejected
+
+- The conventional-commits family: the history is gitmoji, not Conventional, and
+  the notes are hand-written (see
+  [workflow.md § Commit messages](./workflow.md#commit-messages)).
+- `changesets` / `rtk`: config plus a heavier flow that fights the CI-only
+  publish.
+- `knope` / `kacl` / `bestikk`: changelog-only (no `package.json` bump) and
+  5-year / 2-year / brand-new maintenance.
+- `pubv` alone: it never writes `package.json`.
+- `versions` (silverwind): good Gitea support, but pairing it with a hand-rolled
+  promote became a ~180-line script, which this ~30-line version replaces.
+
+## The version has one source of truth
+
+#### Decision (2026-09)
+
+The version is derived from the graduated `## [x.y.z]` heading in
+[CHANGELOG.md](../CHANGELOG.md) and written to `package.json` +
+`package-lock.json` by `npm version`.
+
+#### Why
+
+- `release.sh` reads the version from the changelog, so the changelog is the
+  input and `package.json` the derived copy — one direction, no drift.
+
+#### Rejected
+
+- A `## Version` line in the README: it makes `release.sh` responsible for a
+  third file.
+- Linking `package.json` from the README: it invites a hand-maintained duplicate
+  the link does not keep in sync.
+
+## Release notes are extracted from the changelog
+
+#### Decision (2026-09)
+
+`scripts/release-notes.sh <tag>` prints the Keep-a-Changelog section for the tag
+and exits non-zero when it is missing.
+
+#### Why
+
+- CI reuses the release body from the same file that drove the version, so the
+  page and the changelog cannot disagree.
+- Failing on a missing section means a release can never publish an empty body.
+  A leading `v` is tolerated so both `v1.2.3` and `1.2.3` match `## [1.2.3]`.
+
+## Token gates
+
+#### Decision (2026-09)
+
+The Gitea release page uses the run's automatic token (`github.token`).
+`npm publish` is gated on `NPM_TOKEN`, lifted into job-level `env`. A final
+`always()` step fails the job unless both halves reported `success`.
+
+#### Why
+
+- The automatic token needs only `contents: write`, so the release page needs no
+  secret gate.
+- `secrets` is not allowed in a step `if`, so `NPM_TOKEN` must be lifted into
+  job-level `env`; an unset secret then skips the publish instead of attempting
+  an unauthenticated one.
+- A tag is all-or-nothing: without the `always()` guard a skipped or failed npm
+  half would leave the job silently green. The guard turns it red.
+
+Set `NPM_TOKEN` (npm publish rights) under Settings -> Actions -> Secrets.

development/testing.md

@@ -0,0 +1,45 @@
+# Testing
+
+For this library the types _are_ the feature, so a runtime-only test loop would
+verify the wrong thing. The commands are in
+[CONTRIBUTING.md](../CONTRIBUTING.md); this file records why the loop is shaped
+the way it is.
+
+## Type-driven development
+
+The rules — the loop and the pairing rule — are in
+[CONTRIBUTING.md § Testing discipline (type-driven)](../CONTRIBUTING.md#testing-discipline-type-driven).
+What follows is why and what was rejected.
+
+#### Decision (2026-09)
+
+The compile-time expectation is written before the runtime assertion, and both
+before the implementation.
+
+#### Why
+
+- A runtime-only test can pass while the type is wrong, so a type-level library
+  would ship a broken feature its tests bless.
+- The type error is a more precise spec than a failing assertion, because it
+  states the exact expected type before the logic exists.
+
+#### Rejected
+
+- Runtime-first (classic red/green): it verifies the value, not the contract,
+  and the contract is the product.
+- Testing the type only: it would not catch handler wiring, `exhaustive()`
+  throwing, or the `otherwise` fallback (see `src/index.test.ts`).
+
+The runner is `node --test --strip-types "src/**/*.test.ts"` and the tiers are in
+[CONTRIBUTING.md § Development commands](../CONTRIBUTING.md#development-commands).
+`c8` uses V8 coverage, so the `--strip-types` source is instrumented without a
+build step, and the runner relies on the `.ts` import-extension convention (see
+[tooling.md](./tooling.md#source-imports-use-ts-extensions)).
+
+## Known issues
+
+- The type-aware linter misidentifies `expectTypeOf()` as a floating promise, so
+  `src/index.test.ts` carries a file-level `oxlint-disable
+typescript/no-floating-promises` with an explanatory comment. It is a known
+  false positive, not a rule worth disabling project-wide (see
+  [tooling.md § oxlint-disable directives live next to the code](./tooling.md#oxlint-disable-directives-live-next-to-the-code)).

development/tooling.md

@@ -0,0 +1,236 @@
+# Tooling
+
+Every tool below was chosen and configured deliberately. The commands a
+contributor runs are in [CONTRIBUTING.md](../CONTRIBUTING.md) and the versions
+in [package.json](../package.json).
+
+## Tool inventory
+
+- **TypeScript 7** — type checker and build (`tsc`).
+- **node --test** + `--strip-types` — test runner.
+- **c8** — coverage for `test:ci`.
+- **oxlint** — Rust linter, type-aware via **oxlint-tsgolint** (typescript-go).
+- **oxfmt** — Rust formatter (Prettier-compatible) for JS/TS, JSON/JSONC, YAML,
+  Markdown, MDX, and more; its `package.json` key sorting replaces
+  `sort-package-json`.
+- **cspell** — spell checking.
+- **knip** — unused dependencies, exports, and files.
+- **check-outdated** — dependencies behind the registry; exits non-zero when any
+  is outdated.
+- **publint** — validates `package.json` for ESM publishing.
+- **@arethetypeswrong/cli** (`attw`) — validates `.d.ts` against module-resolution
+  scenarios.
+- **lefthook** — git hooks.
+- **@spences10/pi-lsp** — read-only LSP code intelligence for AI agents
+  (project-local `.pi/settings.json`); talks to this repo's TypeScript 7 via
+  `tsc --lsp --stdio`.
+
+When each runs is in
+[CONTRIBUTING.md § Feedback tiers](../CONTRIBUTING.md#feedback-tiers).
+
+## TypeScript and build
+
+### One type-check config, one emit config
+
+#### Decision (2026-09)
+
+`tsconfig.json` extends `@tsconfig/strictest` + `@tsconfig/node26`.
+`tsconfig.build.json` adds the emit-only options (`declaration`, `sourceMap`,
+`inlineSources`, `outDir`, `target: es2024`,
+`rewriteRelativeImportExtensions: true`) and excludes test files.
+
+#### Why
+
+- The editor and CI type-check from one config while the build emits from the
+  other, so a test file cannot leak into `dist/`.
+- `inlineSources` embeds the original TypeScript in `dist/*.js.map`, so
+  debuggers map into `src/` without it being shipped.
+- `declarationMap` stays off: a `.d.ts.map` cannot embed source and would
+  dangle.
+
+### The build starts from an empty `dist/`
+
+#### Decision (2026-09)
+
+`npm run build` runs a `prebuild` hook that empties `dist/`.
+
+#### Why
+
+- `tsc` does not prune orphaned emit output — dropping `declarationMap` left
+  stale `*.d.ts.map` files — so reproducibility needs an empty `dist/`.
+- `prebuild` removes only `dist`; the manual `clean` resets `dist` + `coverage`,
+  so a local coverage report survives a build.
+
+### Source imports use `.ts` extensions
+
+#### Decision (2026-09)
+
+Source imports use `.ts`, never `.js`.
+
+#### Why
+
+- `node --strip-types` resolves the `.ts` form at test time.
+- `rewriteRelativeImportExtensions` rewrites them to `.js` in the emitted
+  JavaScript.
+- The emitted `.d.ts` keep the `.ts` specifier, which TypeScript >= 5.0 resolves
+  (see [README § Requirements](../README.md#requirements)), so no
+  post-processing step is needed.
+
+#### Rejected
+
+- "Pre-fixing" an import to `.js`: it breaks the inner `node --strip-types`
+  loop.
+
+## Linting and formatting
+
+### Type-aware oxlint is a config property
+
+#### Decision (2026-09)
+
+Type-aware oxlint is enabled via `options.typeAware: true` in `.oxlintrc.json`
+(powered by `oxlint-tsgolint`).
+
+#### Why
+
+- The script commands stay clean — no CLI flag.
+- A config property cannot be forgotten on one call site.
+
+#### Rejected
+
+- A CLI flag in the `check:oxlint` / `fix:oxlint` scripts: it puts the mode in
+  two places and invites them to drift.
+
+### `oxlint-disable` directives live next to the code
+
+#### Decision (2026-09)
+
+Known type-aware false positives are silenced with source-level `oxlint-disable`
+directives (see `src/pattern.ts`, `src/match.ts`, `src/index.test.ts`), not with
+rules disabled in `.oxlintrc.json`.
+
+#### Why
+
+- The disable sits next to the code it silences, visible to anyone reading the
+  source.
+
+#### Rejected
+
+- A project-wide disable in `.oxlintrc.json`: it hides the suppression from the
+  reader of the affected code.
+
+#### Known issue
+
+- A source-level disable is a _human_ last resort. AI agents must not add one;
+  they fix the type at its root (see [AGENTS.md § Never do](../AGENTS.md#never-do)).
+
+### `check:tsc` runs first
+
+#### Decision (2026-09)
+
+`check:tsc` runs first in the `npm run check` chain.
+
+#### Why
+
+- A type error short-circuits the rest, which is faster than running
+  oxlint/oxfmt and failing on `tsc` at the end.
+
+### `.editorconfig` is a fallback, not a gate
+
+#### Decision (2026-09)
+
+`.editorconfig` exists for editor compatibility; where both apply,
+`.oxfmtrc.json` is authoritative.
+
+#### Why
+
+- `.editorconfig` covers the files oxfmt does not format: shell scripts,
+  dotfiles, `LICENSE`, the commit-message template, and git's `COMMIT_EDITMSG`
+  buffer.
+- oxfmt is the formatter; the overlapping keys only keep non-oxfmt editors close
+  to the formatted result, so they cannot disagree with the checker.
+
+## Static analysis and packaging
+
+### `knip` omits the `types` category
+
+#### Decision (2026-09)
+
+`knip --include dependencies,exports,files` omits the `types` category.
+
+#### Why
+
+- `types` produces systematic false positives for libraries whose exported types
+  are part of the public API.
+- The narrower scope keeps the signal high without config-file boilerplate.
+
+### `attw` targets ESM-only
+
+#### Decision (2026-09)
+
+`attw --profile esm-only` is used.
+
+#### Why
+
+- The package is intentionally ESM-only (no CommonJS shim), so CJS resolution
+  scenarios are out of scope by design, not a bug.
+
+### `tslib` is deliberately not used
+
+#### Decision (2026-09)
+
+`tslib` is not a dependency.
+
+#### Why
+
+- `tslib` is a runtime helper for old ES3/ES5 targets; this project targets
+  ES2024.
+
+## Git hooks and script wiring
+
+### `LEFTHOOK_FILES` scopes commands to staged files
+
+#### Decision (2026-09)
+
+The pre-commit hook sets `LEFTHOOK_FILES` to the staged-files list, and the
+affected scripts use `${LEFTHOOK_FILES:-<default>}` to default to the whole
+project.
+
+#### Why
+
+- It keeps `package.json#scripts` the single source of truth; `lefthook.yml`
+  only says what to run on which files.
+- The same script works by hand (whole project) and staged (scoped), so there is
+  no second command to maintain.
+
+## Editor and agent tooling
+
+### VSCode integration
+
+- Recommended extensions are in
+  [.vscode/extensions.json](../.vscode/extensions.json) (oxc, cspell, TypeScript
+  native-preview, EditorConfig, todo-tasks).
+- TypeScript 7 runs via the `typescriptteam.native-preview` extension.
+- The oxc extension provides oxlint squiggles and oxfmt format-on-save;
+  `.vscode/settings.json` pins it per language so a local `[language]` formatter
+  setting cannot override the project's choice.
+
+### `@spences10/pi-lsp` is pinned and read-only
+
+#### Decision (2026-09)
+
+`@spences10/pi-lsp` is pinned to `0.0.46` and used read-only.
+
+#### Why
+
+- It inspects `node_modules/typescript`, sees major >= 7 with no
+  `lib/tsserver.js` (true of the `typescript-go` / `tsgo` port), and spawns the
+  repo's own `tsc --lsp --stdio` — no `typescript-language-server` dependency is
+  needed.
+- Earlier releases (`<= 0.0.10`) hard-wire to `typescript-language-server
+--stdio` and are TS6-only.
+- It is _intermediate_ agent feedback (hover, references, definition, symbols,
+  diagnostics), with no rename / code-action / apply-edit surface, and is never a
+  gate — `npm run check` / `verify` are.
+- `.pi/settings.json` is the committed declaration; `.pi/npm/` is a gitignored
+  install cache that pi recreates on a trusted startup (running `npm install`
+  for any missing project package), so it is deliberately not tracked.

development/workflow.md

@@ -0,0 +1,173 @@
+# Workflow
+
+How work moves through the repository. The rules are in
+[CONTRIBUTING.md](../CONTRIBUTING.md); this file records why they are shaped the
+way they are.
+
+## Branching model
+
+The model is GitHub Flow (single-developer); the steps are in
+[CONTRIBUTING.md § Branching model](../CONTRIBUTING.md#branching-model). Context
+behind it: Gitea has no collaborative review UI in use, so it is the lab, and
+the project moves to GitHub once it is tested and ready.
+
+#### Decision (2026-09)
+
+Work is opened and closed by `create:branch` / `create:finish`, not by prose
+plus hand-written `git`.
+
+#### Why
+
+- The preconditions were prose, and prose rots: a rule nobody checks is a
+  suggestion. A script asserts, then acts, so the branch or merge only exists if
+  the assertions passed.
+- Type-driven work is only trustworthy if the baseline was green before the
+  first edit. Cheap checks run first and `npm run test` last, so the expensive
+  gate is not paid on an ineligible tree.
+- The merge half owns the post-merge `npm run verify`, so a merge cannot land
+  unverified. The push stays with `create:release` so the merge is reviewed
+  locally first; `main` is therefore routinely ahead of its upstream between a
+  merge and the release that ships it. `create:branch` requires only that `main`
+  is not _behind_ — matching `create:finish`, which tolerates the local merge and
+  fast-forwards over a remote one — rather than an exact match.
+- Every failure is non-mutating except the baseline test, which runs on `main`
+  after switching there: a red `main` restores the branch you started on, and a
+  merge conflict aborts back to the feature branch rather than stranding a
+  half-merged `main`.
+
+#### Rejected
+
+- Hand-written `git switch -c` / `git merge`: same rules, no enforcement.
+- Reusing `pubv`'s preflight for `create:branch`: release-shaped, third-party,
+  and it would pay for a build and pack a new branch has no use for.
+- Leaving the merge to reviewer judgment: that judgment moved earlier, to the
+  handover review before `create:finish`, rather than living in a command anyone
+  can run from a dirty tree.
+- Fast-forward instead of `--no-ff`: `--no-ff` keeps each unit of work visible
+  in `git log`.
+- Pushing from `create:finish` to keep `main` level with its upstream: it would
+  trade the local review the push waits for for a network side effect, and a
+  failed push would leave the merge landed but unpublished.
+
+## Changelog notes
+
+The rule is in
+[CONTRIBUTING.md § Rules the tools don't enforce](../CONTRIBUTING.md#rules-the-tools-dont-enforce).
+
+#### Decision (2026-09)
+
+A merged branch carries its own summary under `[Unreleased]` in
+[CHANGELOG.md](../CHANGELOG.md), added before `create:finish`;
+`create:release` graduates it into the tagged section (see
+[publishing.md](./publishing.md)).
+
+#### Why
+
+- `create:release` derives the bump heuristic from the `[Unreleased]` body, so
+  the notes must exist before release day.
+- The contributor has fresh context; at release day the intent of a branch is
+  only its diff.
+- Gitmoji subjects are signposts, not semantic keys, so notes cannot be derived
+  from the history.
+
+#### Rejected
+
+- Generating notes from subjects at release time: subjects carry no parseable
+  type/scope (see § Commit messages).
+- The maintainer writing one summary during `create:release`: reconstruction
+  after the fact.
+- Enforcing it in `create:finish`: the front doors assert git state, not
+  content — and _notable_ is exactly the judgment a tool cannot make.
+
+## Script prefix convention
+
+The prefix taxonomy is the rule, and it lives in
+[CONTRIBUTING.md § Script prefix convention](../CONTRIBUTING.md#script-prefix-convention).
+The design behind it: bare scripts are the tier entry points — a single tool
+(`build`, `clean`) or an aggregator of a `prefix:*` family (`check`, `fix`,
+`test`, `watch`, `maintain`, `setup`) — while `verify` composes `check` +
+`test:unit` into the whole-project gate (it uses `test:unit`, not `test`,
+because `check` already runs `check:tsc`).
+
+#### Decision (2026-09)
+
+`create:` is the prefix for workflow front doors, with no bare `create`
+aggregator.
+
+#### Why
+
+- Both members create something real: a branch, a release.
+- It joined both lists in [CONTRIBUTING.md](../CONTRIBUTING.md) alongside its
+  first members, so it could not go invisible the way the retired `use:` prefix
+  did.
+- `publish:*` already set the precedent for a prefix without an aggregator.
+
+#### Rejected
+
+- `run:` / `perform:`: they mean only "do the named thing", so every script fits
+  and the taxonomy collapses.
+- `git:`: names the tool, not the lifecycle moment, and implies passthrough
+  aliases.
+- `start:`: describes the branch half, not the release.
+- `cut:`: idiomatic but needs VCS slang to decode.
+- `flow:`: overloaded in a type-level matching library.
+- The existing families: `check:*` is read-only (CI would run a state-mutating
+  command), `fix:*` reviews as a diff not a branch, `maintain:*` is advisory and
+  never a gate.
+
+## Feedback tiers
+
+The table and invocation rules are in
+[CONTRIBUTING.md § Feedback tiers](../CONTRIBUTING.md#feedback-tiers); this
+section explains the split.
+
+#### Decision (2026-09)
+
+Fast, offline, staged-file checks sit in pre-commit; whole-project test runs in
+pre-push and `verify`; slow or network-bound scans under `maintain`.
+
+#### Why
+
+- `watch:*` runs until killed, in its own pane, so it is the earliest tier,
+  firing on save before staging or commit.
+- `check:tsc` / `check:oxlint` / `check:oxfmt` / `check:cspell` are fast
+  (~0.2–0.5s each), offline, and scope to staged files via `LEFTHOOK_FILES`, so
+  pre-commit gives instant feedback on what you typed.
+- `test` (and its `tsc`) runs the whole suite over the whole project, and the
+  staged-file convention does not apply to the test runner, so it belongs in
+  pre-push, after the commits exist but before the push leaves the machine.
+
+#### Rejected
+
+- `maintain:*` in `check` or pre-commit: advisory, whole-project and
+  network-bound scans are not correctness gates and would slow the fast tier.
+- Treating a green pre-commit as the definition of done: it sees only staged
+  files, hence `npm run verify`.
+- A separate `git push` hook for `verify`: the pre-push test tier already covers
+  it.
+
+## Commit messages
+
+The convention is in
+[CONTRIBUTING.md § Commit messages](../CONTRIBUTING.md#commit-messages).
+Examples: `:sparkles: Add watch tier with watch:test child`,
+`:recycle: Move type-aware config to .oxlintrc.json; use source-level disable
+directives`, `:memo: Restore unique maintainer content as CONTRIBUTING.md`. The
+body explains what and why, not how; link issues with `Resolves #...`.
+
+#### Decision (2026-09)
+
+Gitmoji subjects, imperative mood, wrapped 50/72, not Conventional Commits.
+
+#### Why
+
+- The history is gitmoji and predates any commit-lint tooling; switching would
+  rewrite the convention for no gain.
+- The body carries the reasoning a reviewer needs; the subject is a signpost,
+  not a semantic key.
+
+#### Rejected
+
+- Conventional Commits: the release flow uses hand-written Keep-a-Changelog
+  notes, not generated ones, so the prefix has no automation value here (see
+  [publishing.md](./publishing.md)).

docker/Dockerfile

@@ -0,0 +1,51 @@
+# CI job image for the Gitea act_runner: the runner's default job image with
+# Node pre-planted where actions/setup-node looks first.
+#
+# Why this layout: setup-node ignores `node` on PATH; its only fast path is a
+# probe of /opt/hostedtoolcache/node/<version>/<arch>. Without an entry there
+# it downloads the ~50 MB distribution on EVERY job (the runner's job
+# containers are ephemeral, so its tool cache never survives a job). The
+# official node images keep exactly the layout setup-node expects under
+# /usr/local, so this layer is a pure file overlay — no scripts, no env.
+#
+# Why not a host bind of /opt/hostedtoolcache: binds never self-prune. Docker
+# images are content-addressed: the base layers dedupe against the act image
+# the host already has, and `docker image prune` / re-pulls are the cleanup
+# story.
+#
+# NODE_VERSION must match `.node-version` exactly. setup-node resolves a float
+# like `26` to the latest known patch at runtime, so a bump silently busts the
+# baked entry; `.node-version` is pinned to x.y.z and scripts/runner-image.sh
+# guards the coupling. Rebuild + repoint `container.image` in
+# .gitea/workflows/ci.yml on every bump.
+#
+# The extra `nodebase` stage is load-bearing: `COPY --from=` resolves its value
+# as a *stage name* at parse time, before build args exist, so
+# `COPY --from=node:${NODE_VERSION}` collapses to the invalid `node:` on
+# frontends that do not expand args there. ARGs declared before the first FROM
+# *are* expanded in FROM, so routing through a named stage works everywhere.
+
+# Global scope: only visible to FROM lines, but that is exactly where we need it.
+ARG NODE_VERSION=26.8.2
+FROM node:${NODE_VERSION} AS nodebase
+
+FROM catthehacker/ubuntu:act-latest
+
+# ARGs do not cross stage boundaries; redeclare (with the same default, so a
+# bare `docker build -f docker/Dockerfile .` still works) for the paths below.
+# Keep this default in sync with the global one above.
+ARG NODE_VERSION=26.8.2
+
+# node image: bin/ + lib/ under /usr/local → tool cache: bin/ + lib/ under <ver>/x64.
+COPY --from=nodebase /usr/local /opt/hostedtoolcache/node/${NODE_VERSION}/x64
+
+# actions/tool-cache only accepts a cached tool when the sibling marker file
+# "<version>/<arch>.complete" exists — tc.find() checks it and falls back to
+# downloading otherwise, however complete the directory is. The marker is what
+# tc.cacheDir() writes after *it* installs a tool, so a pre-baked entry has to
+# reproduce it explicitly.
+RUN touch "/opt/hostedtoolcache/node/${NODE_VERSION}/x64.complete"
+
+# Fail the build (not CI) if the overlay or the version arg were wrong.
+# Shell form on purpose: exec form (`RUN [...]`) does not expand ARG values.
+RUN "/opt/hostedtoolcache/node/${NODE_VERSION}/x64/bin/node" --version

knip.json

@@ -0,0 +1,5 @@
+{
+    "$schema": "./node_modules/knip/schema.json",
+    "entry": ["scripts/*.ts"],
+    "ignoreDependencies": ["@runwisp/pubv"]
+}

lefthook.yml

@@ -5,11 +5,17 @@ pre-commit:
     commands:
         oxlint:
             glob: "*.{ts,tsx,js,jsx,mjs,cjs}"
-            run: sh -c 'LEFTHOOK_FILES="$0" npm run check:oxlint' {staged_files}
+            run: sh -c 'LEFTHOOK_FILES="$*" npm run check:oxlint' sh {staged_files}
         oxfmt:
             glob: "*.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,yaml,yml,md,mdx}"
-            run: sh -c 'LEFTHOOK_FILES="$0" npm run check:oxfmt' {staged_files}
+            run: sh -c 'LEFTHOOK_FILES="$*" npm run check:oxfmt' sh {staged_files}
         cspell:
-            run: sh -c 'LEFTHOOK_FILES="$0" npm run check:cspell' {staged_files}
+            run: sh -c 'LEFTHOOK_FILES="$*" npm run check:cspell' sh {staged_files}
         typecheck:
             run: npm run check:tsc
+
+pre-push:
+    parallel: false
+    commands:
+        test:
+            run: npm test

package.json

@@ -1,6 +1,6 @@
 {
     "name": "tiny-pattern-ts",
-    "version": "0.0.0",
+    "version": "0.1.7",
     "description": "Pattern matching for TypeScript/ESM environments (F#-style, not regex)",
     "keywords": [
         "adt",
@@ -10,20 +10,23 @@
         "pattern-matching",
         "typescript"
     ],
+    "homepage": "https://gitea.e1nsnull.de/tmu/tiny-pattern-ts#readme",
+    "bugs": {
+        "url": "https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/issues"
+    },
     "license": "MIT",
     "repository": {
         "type": "git",
-        "url": "https://github.com/tmueller/tiny-pattern-ts.git"
+        "url": "git+https://gitea.e1nsnull.de/tmu/tiny-pattern-ts.git"
     },
     "files": [
         "dist",
+        "CHANGELOG.md",
         "README.md",
         "LICENSE"
     ],
     "type": "module",
     "sideEffects": false,
-    "main": "./dist/index.js",
-    "types": "./dist/index.d.ts",
     "exports": {
         ".": {
             "types": "./dist/index.d.ts",
@@ -35,50 +38,55 @@
     },
     "scripts": {
         "build": "tsc -p tsconfig.build.json",
-        "check": "npm run check:oxlint && npm run check:oxfmt && npm run check:tsc && npm run check:cspell && npm run check:outdated",
+        "prebuild": "rm -rf dist",
+        "check": "npm run check:tsc && npm run check:oxlint && npm run check:oxfmt && npm run check:cspell",
         "check:cspell": "cspell lint ${LEFTHOOK_FILES:-.}",
-        "check:outdated": "check-outdated --ignore-pre-releases --ignore-packages @oxfmt/binding-darwin-arm64,@oxfmt/binding-darwin-x64,@oxfmt/binding-linux-arm64-gnu,@oxfmt/binding-linux-arm64-musl,@oxfmt/binding-linux-x64-gnu,@oxfmt/binding-linux-x64-musl,@oxfmt/binding-win32-x64-msvc,@oxlint/binding-darwin-arm64,@oxlint/binding-darwin-x64,@oxlint/binding-linux-arm64-gnu,@oxlint/binding-linux-arm64-musl,@oxlint/binding-linux-x64-gnu,@oxlint/binding-linux-x64-musl,@oxlint/binding-win32-x64-msvc",
         "check:oxfmt": "oxfmt --check ${LEFTHOOK_FILES:-.}",
-        "check:oxlint": "oxlint ${LEFTHOOK_FILES:-src}",
-        "check:tsc": "tsc --noEmit",
-        "clean": "node -e \"fs.rmSync('dist', { recursive: true, force: true })\"",
+        "check:oxlint": "oxlint ${LEFTHOOK_FILES:-src scripts}",
+        "check:tsc": "tsc",
+        "clean": "rm -rf dist coverage",
+        "fix": "npm run fix:oxlint && npm run fix:oxfmt",
         "fix:oxfmt": "oxfmt ${LEFTHOOK_FILES:-.}",
-        "fix:oxlint": "oxlint --fix src",
-        "test": "npm run check:tsc && node --test --strip-types src/",
-        "test:ci": "c8 --reporter=text --reporter=lcov --reporter=html node --test --strip-types src/",
-        "test:unit": "node --test --strip-types src/",
-        "use:git-commit-message": "cp commit-message-template .git/COMMIT_EDITMSG || true"
+        "fix:oxlint": "oxlint --fix src scripts",
+        "create:branch": "./scripts/branch.sh",
+        "create:finish": "./scripts/finish.sh",
+        "create:release": "./scripts/release.sh",
+        "maintain": "npm run maintain:knip; npm run maintain:outdated",
+        "maintain:knip": "knip --include dependencies,exports,files",
+        "maintain:outdated": "check-outdated --ignore-pre-releases",
+        "test": "npm run check:tsc && node --test --strip-types \"src/**/*.test.ts\"",
+        "test:ci": "c8 --reporter=text --reporter=lcov --reporter=html node --test --strip-types \"src/**/*.test.ts\"",
+        "test:unit": "node --test --strip-types \"src/**/*.test.ts\"",
+        "verify": "npm run check && npm run test:unit",
+        "watch": "npm run watch:test",
+        "watch:test": "node --test --watch --strip-types \"src/**/*.test.ts\"",
+        "publish:attw": "attw . --pack --profile esm-only",
+        "publish:publint": "publint",
+        "setup": "npm run setup:git-commit-message",
+        "setup:git-commit-message": "git config commit.template commit-message-template"
     },
     "devDependencies": {
+        "@arethetypeswrong/cli": "^0.18.5",
+        "@runwisp/pubv": "^1.5.1",
+        "@tsconfig/node26": "^26.0.1",
+        "@tsconfig/strictest": "^2.0.8",
         "@types/node": "^26.4.1",
         "c8": "^12.0.0",
         "check-outdated": "^3.0.0",
-        "cspell": "^10.2.1",
+        "cspell": "^10.2.2",
         "expect-type": "1.4.0",
+        "knip": "^6.34.0",
         "lefthook": "^2.1.12",
-        "oxfmt": "^0.66.0",
-        "oxlint": "^1.81.0",
-        "tslib": "^2.8.1",
-        "type-fest": "^5.9.0",
+        "oxfmt": "^0.68.0",
+        "oxlint": "^1.83.0",
+        "oxlint-tsgolint": "^7.0.2001",
+        "publint": "^0.3.24",
         "typescript": "^7.0.2"
     },
-    "optionalDependencies": {
-        "@oxfmt/binding-darwin-arm64": "^0.66.0",
-        "@oxfmt/binding-darwin-x64": "^0.66.0",
-        "@oxfmt/binding-linux-arm64-gnu": "^0.66.0",
-        "@oxfmt/binding-linux-arm64-musl": "^0.66.0",
-        "@oxfmt/binding-linux-x64-gnu": "^0.66.0",
-        "@oxfmt/binding-linux-x64-musl": "^0.66.0",
-        "@oxfmt/binding-win32-x64-msvc": "^0.66.0",
-        "@oxlint/binding-darwin-arm64": "^1.81.0",
-        "@oxlint/binding-darwin-x64": "^1.81.0",
-        "@oxlint/binding-linux-arm64-gnu": "^1.81.0",
-        "@oxlint/binding-linux-arm64-musl": "^1.81.0",
-        "@oxlint/binding-linux-x64-gnu": "^1.81.0",
-        "@oxlint/binding-linux-x64-musl": "^1.81.0",
-        "@oxlint/binding-win32-x64-msvc": "^1.81.0"
-    },
     "engines": {
         "node": ">=26"
+    },
+    "allowScripts": {
+        "lefthook@2.1.14": true
     }
 }

project-specs.md

@@ -1,463 +0,0 @@
-# Project Specifications for TypeScript NPM Module
-
-- name of package: tiny-pattern-ts
-
-## 0. References
-
-typescript-lib-starter-tiny => https://github.com/tmueller/typescript-lib-starter-tiny/
-
-## 1. Development Environment
-
-- **TypeScript**: Use strictest practical rules. Inline in `tsconfig.json` (not
-  via `@tsconfig/strictest`). The rule set is: `strict`, `noImplicitAny`,
-  `noImplicitThis`, `alwaysStrict`, `strictNullChecks`, `strictFunctionTypes`,
-  `strictBindCallApply`, `strictPropertyInitialization`, `noImplicitReturns`,
-  `noFallthroughCasesInSwitch`, `noUncheckedIndexedAccess`, `noImplicitOverride`,
-  `noUnusedLocals`, `noUnusedParameters`, `forceConsistentCasingInFileNames`,
-  `isolatedModules`, `verbatimModuleSyntax`.
-- **EditorConfig**: Use `.editorconfig` from typescript-lib-starter-tiny.
-- **oxfmt**: Rust-based formatter, Prettier-compatible. Replaces Prettier.
-  Config in `.oxfmtrc.json` (same shape as `.prettierrc`).
-- **oxlint**: Rust-based linter. Replaces ESLint. Config in `.oxlintrc.json`
-  with `typescript`, `unicorn`, `oxc`, `import` plugins. Categories enabled
-  as errors: `correctness`, `suspicious`, `restriction`. As warnings: `perf`,
-  `style`. `nursery` is off.
-- **oxlint rules disabled by design** (in `.oxlintrc.json`):
-    - `eslint/no-undefined` — we use `undefined` as the no-match sentinel.
-    - `eslint/sort-keys` — handler/case order is semantic, not alphabetical.
-    - `eslint/id-length` — `T`, `R`, `U`, `V` are standard TS generics.
-    - `import/no-named-export` — false positive on library entry re-exports.
-      For `*.test.ts` files additionally: `no-unused-expressions` (for
-      `expectTypeOf(...)` calls), `no-empty-file` (we have a single import
-      per test file in some cases), `import/no-nodejs-modules` (we use
-      `node:test`/`node:assert`/`node:fs` intentionally), `eslint/no-magic-numbers`
-      (literals in tests are fine).
-- **Import sorting**: built into oxfmt (no separate plugin).
-- **cspell**: Basic spelling configuration. Words dictionary in `cspell.json`
-  covers tooling names (`oxlint`, `oxfmt`, `oxc`, `nodenext`,
-  `oxfmtrc`, `oxlintrc`, `EDITMSG`, `typescriptteam`,
-  `gitmoji`, `dbaeumer`, `msvc`) and a few library names (`tslib`,
-  `typefest`, `lefthook`).
-- **Lefthook**: Pre-commit checks (run in parallel, lefthook v2 schema).
-  Single source of truth for the underlying commands is in
-  `package.json#scripts`; the lefthook config only describes _what to
-  run on which files_. Hooks that should run on staged files
-  (`oxlint`, `oxfmt`, `cspell`) set the `LEFTHOOK_FILES` env var to
-  the staged-files list via a `sh -c` wrapper, and the npm script
-  uses `${LEFTHOOK_FILES:-<default>}` to default to the full project
-  when invoked manually:
-    - `pre-commit.commands.oxlint` (glob `*.{ts,tsx,js,jsx,mjs,cjs}`):
-      `sh -c 'LEFTHOOK_FILES="$0" npm run check:oxlint' {staged_files}`
-    - `pre-commit.commands.oxfmt` (glob `*.{ts,tsx,js,jsx,mjs,cjs}`):
-      `sh -c 'LEFTHOOK_FILES="$0" npm run check:oxfmt' {staged_files}`
-    - `pre-commit.commands.cspell`:
-      `sh -c 'LEFTHOOK_FILES="$0" npm run check:cspell' {staged_files}`
-    - `pre-commit.commands.typecheck`:
-      `npm run check:tsc` (no file args needed)
-      `outdated` is intentionally NOT a pre-commit check (it can flag
-      upstream patch releases that aren't actionable locally); it runs in
-      CI and via the explicit `lefthook run outdated` command.
-
-- **Additional Dev Dependencies**:
-    - lefthook
-    - check-outdated
-    - c8 (coverage for `node --test`)
-    - expect-type (type-level assertions in tests)
-    - oxfmt, oxlint (with their native bindings as `optionalDependencies`
-      so the correct binding is selected per platform automatically)
-    - typescript (TS 7)
-    - @types/node
-    - tslib (available for future runtime helper imports)
-    - type-fest (utility types)
-
-## 2. Build & Test
-
-- **Build Tool**: TypeScript 7 (`tsc`) — no bundler, no Vite. The build
-  is a plain `tsc -p tsconfig.build.json` invocation that emits ESM
-  JavaScript and `.d.ts` declarations to `dist/`. ESM only, no CJS.
-- **Testing**: Node's built-in `node --test` with `--strip-types` (Node
-  22.6+, unflagged on Node 24/26). Test files are co-located with
-  source as `*.test.ts`. No Vitest.
-- **TypeScript Build Output**: `dist` directory (set in
-  `tsconfig.build.json#outDir`; `tsconfig.json` keeps `outDir` for
-  editor tooling but excludes tests from emission via
-  `tsconfig.build.json#exclude`).
-- **Import extensions**: Source uses `.ts` extensions in imports
-  (e.g. `from "./match.ts"`) so `node --strip-types` resolves them
-  at test time. TypeScript's `rewriteRelativeImportExtensions` (in
-  `tsconfig.build.json`) rewrites these to `.js` in the emitted
-  `dist/*` output, so consumers see conventional ESM imports.
-- **TypeScript Compiler Options Notes**:
-    - `allowImportingTsExtensions: true` is set in the root
-      `tsconfig.json` (works because the root config has `noEmit: true`).
-    - `rewriteRelativeImportExtensions: true` is set in
-      `tsconfig.build.json` to rewrite `.ts` to `.js` on emit.
-    - `module: nodenext`, `moduleResolution: nodenext` for ESM-first
-      Node packages.
-    - `verbatimModuleSyntax: true` enforces explicit `import type`.
-    - `target: es2024`, `lib: ["es2024"]` (Node 26 supports all ES2024
-      features natively).
-- **Additional Dev Dependencies** (for types and tests):
-    - `tslib` — available for runtime helper imports; not currently
-      used by source (kept for future use per the original spec).
-    - `type-fest` — utility types; not currently used by source
-      (kept for future use per the original spec).
-    - `@types/node` — types for `node:test`, `node:assert`, `node:fs`.
-- **Node Version**: `>=26` (engines field). Pinned via `.node-version`
-  for fnm/nvm/volta/mise auto-switching and CI
-  (`actions/setup-node@v4` with `node-version-file: .node-version`).
-
-## 3. Project Structure & Files
-
-- **.gitignore**: Ignore `dist`, `node_modules`, `coverage`, and other
-  common files.
-- **.node-version**: Single line containing the Node major version
-  (currently `26`). Used by version managers and CI.
-- **.npmignore**: Ignore `node_modules/`, `coverage/`, `*.log`,
-  `*.tsbuildinfo`, `src/`, `.vscode/`, `.editorconfig`,
-  `.oxfmtrc.json`, `.oxlintrc.json`, `.node-version`, `cspell.json`,
-  `lefthook.yml`, `commit-message-template`.
-  (Note: `dist/` is included via `package.json#files`, not by absence
-  from `.npmignore`.)
-- **.oxfmtrc.json**: oxfmt configuration (Prettier-shaped).
-- **.oxlintrc.json**: oxlint configuration.
-- **.oxlintrc.json + .oxfmtrc.json** replace the old `.eslintrc.cjs`
-  and `.prettierrc`.
-- **LICENSE**: MIT.
-- **README.md**: Scaffolded.
-- **commit-message-template**: From typescript-lib-starter-tiny.
-- **Target Environments**: Node 26 LTS only (no browser target; this
-  is a pure Node library, no DOM, no DOM lib in tsconfig).
-- **No React, No CJS, ESM only**.
-
-## 4. Automation & Quality
-
-- **Version Automation**: Use standard `npm version` for versioning.
-- **Unused Dependency Check**: Use `check-outdated` (devDep, runs in CI
-  and via the explicit `lefthook run outdated` command).
-- **No commitlint, no conventional commits**. Commits use gitmoji
-  prefixes (e.g. `:sparkles:`, `:wrench:`, `:bug:`, `:fire:`,
-  `:white_check_mark:`, `:tada:`) for at-a-glance categorization.
-
-## 5. Scripts
-
-### SETUP
-
-- `use:git-commit-message`: Set up commit message template (if needed).
-
-### TEST
-
-- `test`: Run `tsc --noEmit` then `node --test --strip-types src/`.
-- `test:unit`: Run unit tests with `node --test --strip-types src/`
-  (no preceding typecheck).
-- `test:ci`: Run tests in CI mode with c8 coverage (text + lcov + html
-  reporters), uploading `coverage/` as an artifact.
-
-### BUILD
-
-- `build`: Build the project using `tsc -p tsconfig.build.json`
-  (emits `dist/*.js` + `dist/*.d.ts` + sourcemaps, with `.ts`
-  imports rewritten to `.js`).
-
-### CLEAN
-
-- `clean`: Remove `dist/` via `node -e "fs.rmSync('dist', {recursive:true, force:true})"`.
-  (Replaces `clean:build` from the original spec — same effect,
-  no `rimraf` dep needed.)
-
-### CHECK
-
-- `check`: Run all checks in order — `check:oxlint`, `check:oxfmt`,
-  `check:tsc`, `check:cspell`, `check:outdated`.
-- `check:oxlint`: `oxlint ${LEFTHOOK_FILES:-src}` — lints `src/`
-  by default; when invoked from the lefthook pre-commit hook with
-  `LEFTHOOK_FILES` set to the staged-files list, lints only those
-  files. This is the single source of truth for the oxlint command
-  and is shared between the manual `npm run check` and the pre-commit
-  hook. oxlint only understands JS/TS-family languages, so config
-  files (JSON/YAML/Markdown) are intentionally outside its scope;
-  they are checked only by oxfmt.
-- `check:oxfmt`: `oxfmt --check ${LEFTHOOK_FILES:-.}` — formats the
-  whole project (`.`) by default, including JS/TS, JSON/JSONC,
-  YAML, Markdown, MDX and other supported file types. From lefthook
-  pre-commit, the `LEFTHOOK_FILES` env var scopes to the staged
-  files matching `*.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,yaml,yml,md,mdx}`.
-  Built-in `sortPackageJson: true` keeps `package.json` keys
-  alphabetized (replaces the former `sort-package-json` tool).
-  Built-in import sorting (enabled via `sortImports: true`) replaces
-  any external import-sort plugin.
-- `check:tsc`: `tsc --noEmit`.
-- `check:cspell`: `cspell lint ${LEFTHOOK_FILES:-.}` — walks the
-  project root by default; from lefthook, only the staged files.
-- `check:outdated`: `check-outdated --ignore-pre-releases --ignore-packages @oxfmt/binding-*,@oxlint/binding-*`. The oxc native bindings are declared as `optionalDependencies` so the correct one is selected per platform automatically; the `*`-platform bindings show as "not installed" on the current platform and are explicitly ignored here.
-
-### FIX
-
-- `fix:oxlint`: `oxlint --fix src`.
-- `fix:oxfmt`: `oxfmt ${LEFTHOOK_FILES:-.}` — same scoping as
-  `check:oxfmt` (whole project by default, staged files from
-  lefthook). Writes changes in place.
-  (There is no `fix` aggregator in the scripts; run the `fix:*` scripts
-  individually.)
-
-### HOOKS
-
-- Lefthook runs the relevant `check:*` scripts on staged files in
-  parallel for pre-commit. See `lefthook.yml`.
-
----
-
-## 6. Repository & CI/CD
-
-- **Repository**: Hosted on GitHub.
-- **Build Pipeline**: GitHub Actions (`.github/workflows/ci.yml`).
-    - `build` job on push and pull_request to `main` and on
-      `workflow_dispatch`. Steps: `actions/checkout@v4`,
-      `actions/setup-node@v4` (with `node-version-file: .node-version`,
-      `cache: npm`), `npm ci`, `npm run build`, `npm run check`,
-      `npm run test:ci`, then upload `coverage/` as an artifact.
-    - `publish` job: only on `refs/tags/*`, depends on `build`. Steps:
-      `actions/checkout@v4`, `actions/setup-node@v4` (with
-      `node-version-file: .node-version` and `registry-url`),
-      `npm ci`, `npm run build`, `npm publish --access public`
-      with `NODE_AUTH_TOKEN` from secrets.
-
-## 7. Versioning & Publishing
-
-- **Version Update**: Use `npm version` to bump version after merging
-  to main and before publishing.
-- **Publishing to npm**: Only publish from CI on tagged commits.
-- **Recommended Workflow**:
-    1. Develop and merge PRs to main
-    2. Run all checks via CI
-    3. Bump version with `npm version <patch|minor|major>`
-    4. Push tag to GitHub
-    5. CI builds and publishes to npm on tag
-
-## 8. NPM Keywords
-
-- pattern-matching
-- pattern
-- match
-- algebraic-data-types
-- adt
-- typescript
-
-> The library is for pattern matching (not regex), similar to F#'s
-> pattern matching, for TypeScript/ESM environments.
-
-## 9. Code Coverage
-
-- **Tool**: c8 (V8-native coverage, no instrumentation step).
-- **Configuration**: c8 has no project config; the report shape is
-  pinned in the `test:ci` script:
-
-```jsonc
-"test:ci": "c8 --reporter=text --reporter=lcov --reporter=html node --test --strip-types src/"
-```
-
-- **Reporters**: text summary, HTML, and lcov (matching the original
-  spec).
-- **CI**: `coverage/` is uploaded as a workflow artifact via
-  `actions/upload-artifact@v4` (see `.github/workflows/ci.yml`).
-- **Optional**: Coverage thresholds can be added in c8 config when the
-  library surface stabilizes.
-
-## 10. Source Structure & Tree Shaking
-
-- **Source Directory**: All source code resides in `src/` and is
-  exported via `src/index.ts`.
-- **Configuration**:
-    - `sideEffects: false` in `package.json` (set).
-    - ESM-only exports; `package.json#exports` field maps `.` to
-      `{"types": "./dist/index.d.ts", "import": "./dist/index.js"}`.
-    - Avoid top-level side effects in modules.
-    - Explicit re-exports in `index.ts` for best results.
-- Source structure (current):
-    - `src/index.ts` — public barrel.
-    - `src/match.ts` — `match(value).with(...).exhaustive() / .otherwise(...)` builder.
-    - `src/pattern.ts` — `P.literal`, `P.type`, `P.when`, `P.any`, `P.shape` constructors and the `Matcher<T>` interface.
-    - `src/index.test.ts` — runtime + type-level tests using `node --test` + `expect-type`.
-- The human will implement the source code.
-
-## 11. Included Templates from typescript-lib-starter-tiny
-
-### .editorconfig
-
-```plaintext
-# Editor configuration, see http://editorconfig.org
-root = true
-
-[*]
-charset = utf-8
-indent_style = space
-indent_size = 4
-insert_final_newline = true
-max_line_length = 80
-trim_trailing_whitespace = true
-quote_type = double
-
-[*.md]
-max_line_length = 0
-trim_trailing_whitespace = false
-
-[COMMIT_EDITMSG]
-max_line_length = 0
-```
-
-### commit-message-template
-
-```plaintext
-# If applied, this commit will... (Max 50 char)
-
-
-# Explain why this change is being made (Max 72 Char) [WHAT and WHY vs HOW]
-
-
-# Provide links or keys to any relevant tickets, articles or other resources
-Resolves #...
-
-# --- COMMIT END ---
-# Remember to
-#    Use the imperative mood in the subject line
-#    Capitalize the subject line
-#    Do not end the subject line with a period
-#    Separate subject from body with a blank line
-#    Use the body to explain what and why vs. how
-#    Can use multiple lines with "-" for bullet points in body
-```
-
-### README.md Structure (scaffolded)
-
-- Project title and description
-- Development
-    - Build: `npm run build`
-    - Test: `npm run test`, `npm run test:ci`
-    - Checks: `npm run check`, `npm run fix:oxfmt`, `npm run fix:oxlint`
-- Tooling section listing TypeScript 7, node --test, c8, oxlint, oxfmt,
-  cspell, lefthook
-- Requirements: Node.js >= 26
-- VSCode integration
-    - Debugging
-    - Running tests
-    - oxc.oxc-vscode provides oxlint and oxfmt in-editor
-- Workflows
-    - Version updates via `npm version`
-    - Publishing via GitHub Actions on tagged commits
-- Contribution guidelines
-    - Commit signing (GPG)
-    - How to set up commit message template (`npm run use:git-commit-message`)
-    - Reference to commit-message-template
-    - Type-level tests use `expect-type`'s `expectTypeOf(...)` inside
-      `node --test` cases
-
-## 12. Project Initialization & Commit Strategy
-
-- Start by initializing git with a `main` branch.
-- Initial commit: empty README + LICENSE.
-- Create a feature branch: `feature/setup`.
-- For each technology or tool added (and its configuration), create a
-  separate commit:
-    - Prepend each commit message with a matching gitmoji (e.g.
-      `:sparkles:` for new features, `:wrench:` for config,
-      `:bug:` for fixes, `:fire:` for removals,
-      `:white_check_mark:` for tests, `:tada:` for initial commit).
-    - Example commit messages used in this project:
-        - `:tada: Initial commit with empty README`
-        - `:wrench: Track .vscode/settings.json for workspace settings`
-        - `:construction_worker: Added GitHub Actions workflow for CI/CD`
-        - `:test_tube: Added Vitest configuration with coverage` (later removed)
-        - `:sparkles: Scaffolded src/index.ts entry point for library code`
-        - `:wrench: Replace Vite/Vitest with TypeScript 7 and node --test`
-        - `:wrench: Replace ESLint and Prettier with oxlint and oxfmt`
-        - `:fire: Remove Vite scaffold leftovers`
-        - `:sparkles: Add initial pattern-matching API`
-        - `:white_check_mark: Add expect-type for type-level tests`
-        - `:wrench: Declare Node 26 as the supported runtime`
-        - `:bug: Use .ts extensions in imports for node --strip-types`
-        - `:wrench: Remove Prettier from editor formatter config`
-- Each commit should include only the relevant files and configuration
-  for that technology/tool. This approach ensures a clean, understandable
-  project history and makes it easy to review or revert specific setup
-  steps.
-
-## 13. Changelog Automation
-
-- Not currently configured. The intended workflow, when adopted, is a
-  changesets-driven release process: feature PRs include a changeset,
-  which gets consumed by a release workflow, producing a `CHANGELOG.md`
-  and a version bump on merge to main.
-- The changelog should be updated as part of the release process.
-
-## 14. Publishing Public
-
-- npm publishing is configured to be public by default.
-- `publishConfig: { "access": "public" }` is set in `package.json`.
-- The CI/CD pipeline publishes with `--access public` on tagged commits.
-
-## 15. VSCode Integration
-
-- `.vscode/settings.json` uses `oxc.oxc-vscode` as the default
-  formatter for `[typescript]`, `[javascript]`, `[json]`, `[jsonc]`,
-  `[markdown]`, `[mdx]`, and `[yaml]` (oxfmt under the hood).
-
-```json
-{
-    "typescript.tsdk": "node_modules/typescript/lib",
-    "js/ts.tsdk.path": "node_modules/typescript/lib",
-    "[typescript]": {
-        "editor.defaultFormatter": "oxc.oxc-vscode",
-        "editor.formatOnSave": true
-    },
-    "[javascript]": {
-        "editor.defaultFormatter": "oxc.oxc-vscode",
-        "editor.formatOnSave": true
-    },
-    "[json]": {
-        "editor.defaultFormatter": "oxc.oxc-vscode",
-        "editor.formatOnSave": true
-    },
-    "[jsonc]": {
-        "editor.defaultFormatter": "oxc.oxc-vscode",
-        "editor.formatOnSave": true
-    },
-    "[markdown]": {
-        "editor.defaultFormatter": "oxc.oxc-vscode",
-        "editor.formatOnSave": true
-    },
-    "[mdx]": {
-        "editor.defaultFormatter": "oxc.oxc-vscode",
-        "editor.formatOnSave": true
-    },
-    "[yaml]": {
-        "editor.defaultFormatter": "oxc.oxc-vscode",
-        "editor.formatOnSave": true
-    },
-    "editor.defaultFormatter": "oxc.oxc-vscode",
-    "editor.formatOnSave": true
-}
-```
-
-- `.vscode/extensions.json` recommends:
-    - `oxc.oxc-vscode` (oxlint + oxfmt, replaces eslint/prettier/vitest)
-    - `streetsidesoftware.code-spell-checker` (cspell)
-    - `typescriptteam.native-preview` (TypeScript 7 nightly support;
-      replaces the older `ms-vscode.vscode-typescript-next`)
-
-```json
-{
-    "recommendations": [
-        "oxc.oxc-vscode",
-        "streetsidesoftware.code-spell-checker",
-        "typescriptteam.native-preview"
-    ]
-}
-```
-
-- `.vscode/tasks.json` is not currently provided; common tasks
-  (build, test, lint, typecheck, format, spell, check:outdated) are
-  run via the npm scripts in `package.json` from the integrated
-  terminal.
-- VSCode uses the workspace TypeScript version via
-  `typescript.tsdk` (and the explicit `js/ts.tsdk.path`), with
-  `oxc.oxc-vscode` for formatting and linting.

scripts/branch.sh

@@ -0,0 +1,124 @@
+#!/bin/sh
+
+set -eu
+
+# Branch front-door. Run as `npm run create:branch -- <prefix>/<desc>`.
+#
+# Asserts the branch preconditions — clean tree, no in-progress operation,
+# current `main`, green baseline — and only then creates the branch, so the
+# expensive `npm run test` is not paid on a tree that was never eligible.
+#
+# Why the front door exists, the rejected prefix names, and the `create:`
+# decision: development/workflow.md § Branching model and § Script prefix
+# convention.
+
+BASE="main"
+PREFIXES="feature fix chore"
+NAME="${1:-}"
+
+if [ -z "${NAME}" ]; then
+    echo "usage: npm run create:branch -- <prefix>/<desc>    (prefix: ${PREFIXES})" >&2
+    exit 2
+fi
+
+git rev-parse --is-inside-work-tree >/dev/null 2>&1 || {
+    echo "error: not inside a git work tree." >&2
+    exit 1
+}
+
+MATCH=0
+for p in ${PREFIXES}; do
+    case "${NAME}" in
+    "${p}/"*) MATCH=1 ;;
+    esac
+done
+if [ "${MATCH}" -ne 1 ]; then
+    echo "error: '${NAME}' must start with one of: ${PREFIXES}." >&2
+    echo "       the prefix is inferred from the task, not defaulted here." >&2
+    exit 1
+fi
+git check-ref-format --branch "${NAME}" >/dev/null 2>&1 || {
+    echo "error: '${NAME}' is not a valid branch name." >&2
+    exit 1
+}
+git show-ref --verify --quiet "refs/heads/${NAME}" && {
+    echo "error: branch '${NAME}' already exists; switch to it instead." >&2
+    exit 1
+}
+
+START_REF=$(git symbolic-ref --quiet --short HEAD || true)
+if [ -z "${START_REF}" ]; then
+    echo "error: detached HEAD; switch to a branch first." >&2
+    exit 1
+fi
+
+STATE_ROOT=$(git rev-parse --absolute-git-dir)
+for state in MERGE_HEAD rebase-merge rebase-apply CHERRY_PICK_HEAD BISECT_LOG; do
+    [ -e "${STATE_ROOT}/${state}" ] && {
+        echo "error: a '${state}' operation is in progress; finish or abort it first." >&2
+        exit 1
+    }
+done
+# `--porcelain` is deliberately stricter than `git diff --quiet`: it also reports
+# untracked files, which would otherwise ride silently onto the new branch.
+DIRTY=$(git status --porcelain)
+if [ -n "${DIRTY}" ]; then
+    echo "error: working tree is not clean:" >&2
+    echo "${DIRTY}" | sed 's/^/         /' >&2
+    exit 1
+fi
+
+git show-ref --verify --quiet "refs/heads/${BASE}" || {
+    echo "error: no local '${BASE}' to branch from." >&2
+    exit 1
+}
+
+# Derive the remote rather than hardcoding it: this repo has `origin` (ssh) and
+# `origin_https`, and `main` tracks the latter — `git fetch origin main` would
+# check currency against a ref that is never updated here.
+# `--quiet` echoes the unresolved `main@{upstream}` literal to stdout on
+# failure, so it cannot be paired with a `$(...) || fallback`; the non-quiet
+# form prints nothing on failure and the fallback runs.
+UPSTREAM=$(git rev-parse --abbrev-ref --symbolic-full-name "${BASE}@{upstream}" 2>/dev/null) || UPSTREAM=""
+if [ -n "${UPSTREAM}" ]; then
+    git fetch --quiet "${UPSTREAM%/*}" "${UPSTREAM#*/}" || {
+        echo "error: '${UPSTREAM}' check failed: could not reach '${UPSTREAM%/*}'." >&2
+        echo "       refusing to branch on a possibly stale '${BASE}'." >&2
+        exit 1
+    }
+    # Only *behind* is a problem. `create:finish` deliberately leaves the local
+    # merge on '${BASE}' until `create:release` pushes it, so being ahead is the
+    # normal state between a merge and the release that ships it; branching from
+    # those commits is intended. Missing remote commits is not.
+    BEHIND=$(git rev-list --count "${BASE}..${UPSTREAM}")
+    if [ "${BEHIND}" -ne 0 ]; then
+        echo "error: '${BASE}' is behind '${UPSTREAM}' (by ${BEHIND})." >&2
+        echo "       update it: git switch ${BASE} && git pull --ff-only" >&2
+        exit 1
+    fi
+else
+    echo "warning: '${BASE}' has no upstream; freshness against the remote is unchecked." >&2
+fi
+
+restore() {
+    git switch --quiet "${START_REF}" 2>/dev/null || true
+}
+trap 'restore' EXIT HUP INT TERM
+
+if [ "${START_REF}" != "${BASE}" ]; then
+    git switch --quiet "${BASE}"
+fi
+
+echo "Baseline: npm run test"
+if ! npm run --silent test; then
+    echo "error: baseline is red on '${BASE}'; fix that first so later failures stay attributable." >&2
+    exit 1
+fi
+
+git switch --quiet --no-track -c "${NAME}"
+trap - EXIT HUP INT TERM
+
+# push.default=upstream is set here, so an inherited upstream would make a bare
+# `git push` target main. Branching local-from-local does not set one anyway;
+# --no-track says so out loud.
+echo "Created ${NAME} from ${BASE} $(git rev-parse --short "${BASE}")."

scripts/finish.sh

@@ -0,0 +1,121 @@
+#!/bin/sh
+
+set -eu
+
+# Feature-finish front door. Run as `npm run create:finish`.
+#
+# Mirror image of `create:branch`: asserts the merge-side preconditions, merges
+# the current `feature/`/`fix/`/`chore/` branch into `main` with `--no-ff`,
+# proves the result with `npm run verify`, and only then deletes the branch. The
+# push is owned by `create:release`, so the merge stays local and reviewable.
+# On a conflict it aborts and returns to the feature branch.
+#
+# Rationale and the rejected alternatives: development/workflow.md § Branching
+# model.
+
+BASE="main"
+PREFIXES="feature fix chore"
+
+git rev-parse --is-inside-work-tree >/dev/null 2>&1 || {
+    echo "error: not inside a git work tree." >&2
+    exit 1
+}
+
+STATE_ROOT=$(git rev-parse --absolute-git-dir)
+for state in MERGE_HEAD rebase-merge rebase-apply CHERRY_PICK_HEAD BISECT_LOG; do
+    [ -e "${STATE_ROOT}/${state}" ] && {
+        echo "error: a '${state}' operation is in progress; finish or abort it first." >&2
+        exit 1
+    }
+done
+
+# `--porcelain` is deliberately stricter than `git diff --quiet`: it also
+# reports untracked files, which would otherwise not be part of the merge and
+# silently outlive the branch deletion.
+DIRTY=$(git status --porcelain)
+if [ -n "${DIRTY}" ]; then
+    echo "error: working tree is not clean:" >&2
+    echo "${DIRTY}" | sed 's/^/         /' >&2
+    exit 1
+fi
+
+START_REF=$(git symbolic-ref --quiet --short HEAD || true)
+if [ -z "${START_REF}" ]; then
+    echo "error: detached HEAD; switch to the branch you want to finish." >&2
+    exit 1
+fi
+
+if [ "${START_REF}" = "${BASE}" ]; then
+    echo "error: already on '${BASE}'; switch to the branch to finish." >&2
+    exit 1
+fi
+
+MATCH=0
+for p in ${PREFIXES}; do
+    case "${START_REF}" in
+    "${p}/"*) MATCH=1 ;;
+    esac
+done
+if [ "${MATCH}" -ne 1 ]; then
+    echo "error: '${START_REF}' must start with one of: ${PREFIXES}." >&2
+    echo "       refusing to merge a branch that is not a unit of work." >&2
+    exit 1
+fi
+
+git show-ref --verify --quiet "refs/heads/${BASE}" || {
+    echo "error: no local '${BASE}' to merge into." >&2
+    exit 1
+}
+
+# Derive the remote rather than hardcoding it: this repo has `origin` (ssh) and
+# `origin_https`, and `main` tracks the latter — `git fetch origin main` would
+# check currency against a ref that is never updated here.
+# `--quiet` echoes the unresolved `main@{upstream}` literal to stdout on
+# failure, so it cannot be paired with a `$(...) || fallback`; the non-quiet
+# form prints nothing on failure and the fallback runs.
+UPSTREAM=$(git rev-parse --abbrev-ref --symbolic-full-name "${BASE}@{upstream}" 2>/dev/null) || UPSTREAM=""
+BEHIND=0
+if [ -n "${UPSTREAM}" ]; then
+    git fetch --quiet "${UPSTREAM%/*}" "${UPSTREAM#*/}" || {
+        echo "error: '${UPSTREAM}' check failed: could not reach '${UPSTREAM%/*}'." >&2
+        echo "       refusing to merge onto a possibly stale '${BASE}'." >&2
+        exit 1
+    }
+    BEHIND=$(git rev-list --count "${BASE}..${UPSTREAM}")
+    AHEAD=$(git rev-list --count "${UPSTREAM}..${BASE}")
+    if [ "${AHEAD}" -ne 0 ] && [ "${BEHIND}" -ne 0 ]; then
+        echo "error: '${BASE}' has diverged from '${UPSTREAM}' (ahead ${AHEAD}, behind ${BEHIND})." >&2
+        echo "       reconcile '${BASE}' with '${UPSTREAM}' before finishing." >&2
+        exit 1
+    fi
+else
+    echo "warning: '${BASE}' has no upstream; freshness against the remote is unchecked." >&2
+fi
+
+echo "Finishing into ${BASE}:"
+git --no-pager log --oneline --no-decorate "${BASE}..${START_REF}" | sed 's/^/  /'
+
+git switch --quiet "${BASE}"
+if [ "${BEHIND}" -ne 0 ]; then
+    echo "Fast-forwarding ${BASE} to ${UPSTREAM} (${BEHIND} commit(s))."
+    git merge --quiet --ff-only "${UPSTREAM}"
+fi
+
+if ! git merge --quiet --no-ff -m ":twisted_rightwards_arrows: Merge ${START_REF} into ${BASE}" "${START_REF}"; then
+    echo "error: merge of '${START_REF}' failed; aborting and returning to it." >&2
+    git merge --abort 2>/dev/null || true
+    git switch --quiet "${START_REF}"
+    exit 1
+fi
+
+echo "Verify: npm run verify"
+if ! npm run --silent verify; then
+    echo "error: 'npm run verify' is red after the merge." >&2
+    echo "       the merge is local and not yet pushed; fix it on '${BASE}' and commit," >&2
+    echo "       then drop the now-merged branch with 'git branch -d ${START_REF}'." >&2
+    exit 1
+fi
+
+git branch --delete "${START_REF}" >/dev/null
+echo "Merged ${START_REF} into ${BASE} and deleted the branch."
+echo "Next: npm run create:release (or git push, for a merge with no release)."

scripts/precompress.ts

@@ -0,0 +1,147 @@
+import fs from "node:fs";
+import path from "node:path";
+import zlib from "node:zlib";
+
+/**
+ * Emit precompressed `.br` / `.gz` / `.zst` sidecars next to every text asset
+ * under the given directories, keeping the originals. The Gitea pages service
+ * (`static-web-server` with `SERVER_COMPRESSION_STATIC=true`) serves the sidecar
+ * matching `Accept-Encoding` and falls back to the original for the rest.
+ *
+ * Usage: node --strip-types scripts/precompress.ts <dir> [<dir>...]
+ *
+ * Why sidecars rather than per-request compression: development/ci.md § Coverage
+ * serving.
+ */
+
+/**
+ * Only extensions worth compressing. Images, fonts and archives are already
+ * compressed, so a sidecar would only make them bigger.
+ */
+const TEXT_EXTENSIONS: ReadonlySet<string> = new Set([
+    ".css",
+    ".htm",
+    ".html",
+    ".info",
+    ".js",
+    ".json",
+    ".map",
+    ".md",
+    ".mjs",
+    ".svg",
+    ".txt",
+    ".xml",
+    ".yaml",
+    ".yml",
+]);
+
+const GZIP_LEVEL = 9;
+const ZSTD_LEVEL = 19;
+const INITIAL_COUNT = 0;
+/** `process.argv` is `[node, script, ...args]`; drop the first two entries. */
+const ARGV_PREFIX_LENGTH = 2;
+const FAILURE_EXIT_CODE = 1;
+
+interface Encoder {
+    readonly suffix: string;
+    readonly encode: (input: Buffer) => Buffer;
+}
+
+const ENCODERS: readonly Encoder[] = [
+    {
+        suffix: ".br",
+        encode: (input) =>
+            zlib.brotliCompressSync(input, {
+                params: {
+                    [zlib.constants.BROTLI_PARAM_QUALITY]:
+                        zlib.constants.BROTLI_MAX_QUALITY,
+                },
+            }),
+    },
+    {
+        suffix: ".gz",
+        encode: (input) => zlib.gzipSync(input, { level: GZIP_LEVEL }),
+    },
+    {
+        suffix: ".zst",
+        encode: (input) =>
+            zlib.zstdCompressSync(input, {
+                params: {
+                    [zlib.constants.ZSTD_c_compressionLevel]: ZSTD_LEVEL,
+                },
+            }),
+    },
+];
+
+interface Totals {
+    assets: number;
+    sidecars: number;
+    savedBytes: number;
+}
+
+/** Depth-first list of every regular file under `directory`, recursively. */
+const listFiles = (directory: string): string[] => {
+    const files: string[] = [];
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+        const entryPath = path.join(directory, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...listFiles(entryPath));
+        } else if (entry.isFile()) {
+            files.push(entryPath);
+        }
+    }
+    return files;
+};
+
+const writeSidecar = (
+    target: string,
+    input: Buffer,
+    encoder: Encoder,
+): number => {
+    const compressed = encoder.encode(input);
+    if (compressed.byteLength < input.byteLength) {
+        fs.writeFileSync(target, compressed);
+        return input.byteLength - compressed.byteLength;
+    }
+    // Drop a stale sidecar: it would still win at the server.
+    fs.rmSync(target, { force: true });
+    return INITIAL_COUNT;
+};
+
+const precompress = (file: string, totals: Totals): void => {
+    if (!TEXT_EXTENSIONS.has(path.extname(file).toLowerCase())) {
+        return;
+    }
+    totals.assets += 1;
+    const input = fs.readFileSync(file);
+    for (const encoder of ENCODERS) {
+        const saved = writeSidecar(`${file}${encoder.suffix}`, input, encoder);
+        if (saved > INITIAL_COUNT) {
+            totals.sidecars += 1;
+            totals.savedBytes += saved;
+        }
+    }
+};
+
+const main = (directories: readonly string[]): void => {
+    if (directories.length === INITIAL_COUNT) {
+        process.stderr.write("usage: precompress.ts <dir> [<dir>...]\n");
+        process.exitCode = FAILURE_EXIT_CODE;
+        return;
+    }
+    const totals: Totals = {
+        assets: INITIAL_COUNT,
+        sidecars: INITIAL_COUNT,
+        savedBytes: INITIAL_COUNT,
+    };
+    for (const directory of directories) {
+        for (const file of listFiles(directory)) {
+            precompress(file, totals);
+        }
+    }
+    process.stdout.write(
+        `precompressed ${totals.assets} text assets into ${totals.sidecars} sidecars (saved ${totals.savedBytes} bytes)\n`,
+    );
+};
+
+main(process.argv.slice(ARGV_PREFIX_LENGTH));

scripts/release-notes.sh

@@ -0,0 +1,66 @@
+#!/bin/sh
+
+set -eu
+
+# Print the Keep-a-Changelog section for a release tag, so CI can use it as the
+# body of the Gitea release page without re-implementing CHANGELOG parsing.
+#
+# Run as `scripts/release-notes.sh <tag>`. A leading `v` is tolerated so both
+# `v1.2.3` and `1.2.3` match the `## [1.2.3]` heading. Prints to stdout and
+# exits non-zero when the tag has no section, so a release can never publish
+# with an empty body.
+#
+# Why: development/publishing.md § Release notes are extracted from the changelog.
+
+TAG="${1:-}"
+CHANGELOG="${CHANGELOG:-CHANGELOG.md}"
+
+if [ -z "${TAG}" ]; then
+    echo "Error: usage: $0 <tag>" >&2
+    exit 1
+fi
+
+if [ ! -f "${CHANGELOG}" ]; then
+    echo "Error: ${CHANGELOG} not found." >&2
+    exit 1
+fi
+
+# `v1.2.3` and `1.2.3` are the same release; the heading only ever uses the
+# bare version.
+VERSION="${TAG#v}"
+
+awk -v version="${VERSION}" '
+    # A new section ends the one we are printing (or is the one we want).
+    /^## \[/ {
+        if (found) exit
+        heading = $0
+        sub(/^## \[/, "", heading)
+        sub(/\].*$/, "", heading)
+        if (heading == version) found = 1
+        next
+    }
+
+    # Link-reference definitions live at the bottom of the file and are never
+    # part of the section body. Stopping here keeps the last release notes
+    # from picking them up (there is no following heading to stop at).
+    /^\[[^]]+\]:/ { exit }
+
+    found {
+        if ($0 ~ /^[[:space:]]*$/) {
+            # Buffer blank lines so trailing ones at the end of the section
+            # are dropped instead of leaking into the release body.
+            if (started) pending = pending $0 "\n"
+        } else {
+            printf "%s%s\n", pending, $0
+            pending = ""
+            started = 1
+        }
+    }
+
+    END {
+        if (!found) {
+            printf "Error: no CHANGELOG section for [%s].\n", version > "/dev/stderr"
+            exit 1
+        }
+    }
+' "${CHANGELOG}"

scripts/release.sh

@@ -0,0 +1,102 @@
+#!/bin/sh
+
+set -eu
+
+# Release front-door. Run as `npm run create:release`.
+#
+# Graduates the [Unreleased] changelog notes, bumps package.json + the lockfile,
+# and commits then tags the exact SHA that CI publishes. The notes are finalized
+# in VS Code before pubv because pubv's bump heuristic reads the [Unreleased]
+# body.
+#
+# Tooling rationale, the rejected alternatives, and the version source of truth:
+# development/publishing.md.
+
+CHANGELOG="CHANGELOG.md"
+BASE="main"
+
+if ! command -v code >/dev/null 2>&1; then
+    echo "Error: 'code' (VS Code CLI) not found; install it or remove the editor step." >&2
+    exit 1
+fi
+
+# Releases are cut from `main` (see CONTRIBUTING § Publishing workflow). Make
+# that explicit rather than relying on pubv's default-branch check, so the
+# error names `main` even when the remote's default is configured differently.
+CURRENT=$(git symbolic-ref --quiet --short HEAD || true)
+if [ "${CURRENT}" != "${BASE}" ]; then
+    echo "Error: releases are cut from '${BASE}', but HEAD is '${CURRENT:-detached}'." >&2
+    exit 1
+fi
+
+# pubv decides the "default branch" by reading the *local*
+# `refs/remotes/origin/HEAD`, not by asking the remote, and `git fetch` never
+# updates that ref. After a default-branch change — or a clone from when the
+# default was different — it goes stale and pubv warns/fails because the
+# current branch (main) does not match it, even though main *is* the remote
+# default. Refresh it from the remote first, so pubv's branch preflight
+# compares against reality. (Without a network this fails, but so would the
+# push pubv is about to do, so it is a real error rather than one to swallow.)
+if ! git remote set-head origin --auto >/dev/null 2>&1; then
+    echo "Error: could not refresh origin/HEAD; check connectivity to origin." >&2
+    exit 1
+fi
+
+# The [Unreleased] body drives pubv's bump heuristic, so finalize it first.
+echo "Opening ${CHANGELOG} in VS Code to finalize the release notes..."
+code --wait "${CHANGELOG}"
+
+# pubv refuses a dirty tree (its "continue with a dirty tree?" prompt defaults
+# to No), so a changed changelog must be committed before it runs. That commit
+# is staging only — the fold below rewrites it into the single release commit.
+NOTES_MSG=":memo: Finalize release notes"
+if [ -n "$(git status --porcelain -- "${CHANGELOG}")" ]; then
+    echo "Committing finalized release notes..."
+    git add "${CHANGELOG}"
+    git commit -m "${NOTES_MSG}"
+fi
+
+echo "Running pubv..."
+pubv --no-tag --no-push --tag-prefix=none
+
+echo "Reading version from ${CHANGELOG}..."
+
+VERSION=$(
+    sed -nE 's/^## \[([0-9]+\.[0-9]+\.[0-9]+)\].*/\1/p' "${CHANGELOG}" |
+        head -n 1
+)
+
+if [ -z "${VERSION}" ]; then
+    echo "Error: Could not determine release version from ${CHANGELOG}." >&2
+    exit 1
+fi
+
+echo "Release version: ${VERSION}"
+
+echo "Updating package.json and package-lock.json..."
+npm version "${VERSION}" --no-git-tag-version
+
+# If pubv's graduation commit sits on top of our staging notes commit, drop it
+# back into the index so the amend below rewrites the notes commit into the one
+# release commit. A message check, not a flag, so a re-run after pubv aborted
+# still folds a notes commit left behind by the earlier attempt.
+if [ "$(git log -1 --format=%s HEAD~1 2>/dev/null || true)" = "${NOTES_MSG}" ]; then
+    git reset --soft HEAD~1
+fi
+
+echo "Amending release commit..."
+git add package.json package-lock.json "${CHANGELOG}"
+# The exact message format is load-bearing: the `release-gate` job in
+# .gitea/workflows/ci.yml recognizes `:rocket: Release x.y.z` on main and
+# skips the full CI run, since the tag push immediately after verifies the
+# identical SHA (and publishes). Keep the two in sync.
+git commit --amend -m ":rocket: Release ${VERSION}"
+
+echo "Creating tag ${VERSION}..."
+git tag "${VERSION}"
+
+echo "Pushing release..."
+git push
+git push --tags
+
+echo "Release ${VERSION} completed."

scripts/runner-image.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Build (and optionally push) the CI job image from docker/Dockerfile.
+# Run wherever docker + registry credentials live (the runner host, or any
+# machine that can reach the registry). The registry/repo below MUST match
+# the `container.image` references in .gitea/workflows/ci.yml — the runner
+# pulls the image by name.
+#
+# Usage: scripts/runner-image.sh [--push]
+#
+# Why the image is baked, its two invariants, and the coordinated Node-bump
+# steps: development/ci.md.
+
+IMAGE_REPO="gitea.e1nsnull.de/tmu/act-ci"
+
+NODE_VERSION="$(tr -d '[:space:]' < .node-version)"
+if [[ ! "${NODE_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    echo "error: .node-version must be pinned to an exact x.y.z, got '${NODE_VERSION}'." >&2
+    echo "       setup-node resolves floats like '26' to the latest patch at runtime," >&2
+    echo "       which silently busts the tool-cache entry baked into the image." >&2
+    exit 1
+fi
+
+IMAGE="${IMAGE_REPO}:${NODE_VERSION}"
+
+# --pull: refresh the act base layer so the derivative does not float on an
+# aging default image forever (layer dedup keeps this cheap).
+docker build --pull --build-arg "NODE_VERSION=${NODE_VERSION}" -t "${IMAGE}" -f docker/Dockerfile .
+
+if [[ "${1:-}" == "--push" ]]; then
+    docker push "${IMAGE}"
+fi
+
+echo "built ${IMAGE}"
+echo "reminder: bump container.image in .gitea/workflows/ci.yml to this tag"

src/index.test.ts

@@ -1,9 +1,10 @@
+/* oxlint-disable typescript/no-floating-promises -- expectTypeOf() is a sync type-assertion library that the type-aware linter misidentifies as a promise */
 import { strict as assert } from "node:assert";
 import { test } from "node:test";
 
 import { expectTypeOf } from "expect-type";
 
-import { match, P, type Matcher } from "./index.ts";
+import { type Matcher, P, match } from "./index.ts";
 
 test("match returns a builder", () => {
     const builder = match("x");
@@ -27,7 +28,7 @@ test("P.type narrows to the typeof target", () => {
 });
 
 test("exhaustive() returns the union of handler return types", () => {
-    const result = match<"a" | "b">("a" as "a" | "b")
+    const result = match<"a" | "b">("a")
         .with(P.literal("a"), () => 1 as const)
         .with(P.literal("b"), () => "two" as const)
         .exhaustive();
@@ -37,7 +38,7 @@ test("exhaustive() returns the union of handler return types", () => {
 });
 
 test("otherwise() falls back when no case matches", () => {
-    const result = match<"x" | "y" | "z">("z" as "x" | "y" | "z")
+    const result = match<"x" | "y" | "z">("z")
         .with(P.literal("x"), (v): string => `got ${v}`)
         .otherwise((v): string => `fallback ${v}`);
     assert.equal(result, "fallback z");
@@ -46,7 +47,7 @@ test("otherwise() falls back when no case matches", () => {
 test("exhaustive throws when no case matches", () => {
     assert.throws(
         () =>
-            match<"a" | "b" | "c">("c" as "a" | "b" | "c")
+            match<"a" | "b" | "c">("c")
                 .with(P.literal("a"), () => "A")
                 .with(P.literal("b"), () => "B")
                 .exhaustive(),

src/match.ts

@@ -1,8 +1,6 @@
 import { P, type Matcher, type Pattern } from "./pattern.ts";
 
-type Cases<R> = ReadonlyArray<
-    readonly [Matcher<unknown>, (value: unknown) => R]
->;
+type Cases<R> = readonly (readonly [Matcher<unknown>, (value: unknown) => R])[];
 
 interface MatchBuilder<T, R> {
     with<U extends T, V>(
@@ -16,7 +14,7 @@ interface MatchBuilder<T, R> {
 const buildMatch = <T, R>(value: T, cases: Cases<R>): MatchBuilder<T, R> => {
     const apply = (): R | undefined => {
         for (const [matcher, handler] of cases) {
-            if (matcher.matches(value as unknown)) {
+            if (matcher.matches(value)) {
                 return handler(value);
             }
         }
@@ -30,6 +28,7 @@ const buildMatch = <T, R>(value: T, cases: Cases<R>): MatchBuilder<T, R> => {
         ): MatchBuilder<T, R | V> {
             const nextCases: Cases<R | V> = [
                 ...cases,
+                // oxlint-disable-next-line typescript/no-unsafe-type-assertion
                 [pattern, handler as (value: unknown) => R | V],
             ];
             return buildMatch(value, nextCases);
@@ -45,8 +44,8 @@ const buildMatch = <T, R>(value: T, cases: Cases<R>): MatchBuilder<T, R> => {
         },
         otherwise(handler: (value: T) => R): R {
             for (const [matcher, run] of cases) {
-                if (matcher.matches(value as unknown)) {
-                    return run(value) as R;
+                if (matcher.matches(value)) {
+                    return run(value);
                 }
             }
             return handler(value);

src/pattern.ts

@@ -14,7 +14,6 @@ const literalMatcher = <
 ): Matcher<L> => ({
     matches: (candidate): candidate is L => candidate === value,
 });
-
 const typeMatcher = <T>(
         type:
             | "string"
@@ -25,58 +24,75 @@ const typeMatcher = <T>(
             | "undefined"
             | "object"
             | "function",
-): Matcher<T> => {
+    ): Matcher<T> => {
         const matches = (value: unknown): value is T => {
-        if (type === "undefined") return value === undefined;
-        if (type === "object")
+            if (type === "undefined") {
+                return value === undefined;
+            }
+            if (type === "object") {
                 return (
                     (typeof value === "object" && value !== null) ||
                     typeof value === "function"
                 );
+            }
             return typeof value === type;
         };
         return { matches };
-};
-
-const whenMatcher = <T>(
+    },
+    whenMatcher = <T>(
         predicate: (value: unknown) => value is T,
-): Matcher<T> => ({
+    ): Matcher<T> => ({
         matches: predicate,
-});
-
-const whenMatcherAny = <T>(
+    }),
+    whenMatcherAny = <T>(
         predicate: (value: unknown) => boolean,
-): Matcher<T> => ({
+    ): Matcher<T> => ({
         matches: (value: unknown): value is T => predicate(value),
-});
-
-const structuralMatcher = <S extends object, T extends S>(
-    shape: S,
-    refine?: (value: S) => value is T,
-): Matcher<T> => ({
-    matches: (value: unknown): value is T => {
-        if (typeof value !== "object" || value === null) return false;
-        const candidate = value as S;
-        for (const key of Object.keys(shape) as Array<keyof S>) {
-            if (!(key in candidate)) return false;
-            const expected = shape[key];
-            const actual = candidate[key];
-            if (
+    }),
+    isNestedMatcher = (expected: unknown): expected is Matcher<unknown> =>
         typeof expected === "object" &&
         expected !== null &&
-                "matches" in expected
-            ) {
-                const nested = expected as unknown as Matcher<unknown>;
-                if (!nested.matches(actual)) return false;
+        "matches" in expected,
+    // oxlint-disable-next-line typescript/no-unnecessary-type-parameters
+    keysMatch = <S extends object>(shape: S, candidate: object): boolean => {
+        // oxlint-disable-next-line typescript/no-unsafe-type-assertion
+        for (const key of Object.keys(shape) as (keyof S)[]) {
+            if (!(key in candidate)) {
+                return false;
+            }
+            // oxlint-disable-next-line typescript/no-unsafe-type-assertion
+            const expected = shape[key],
+                // oxlint-disable-next-line typescript/no-unsafe-type-assertion
+                actual = candidate[key as keyof object];
+            if (isNestedMatcher(expected)) {
+                if (!expected.matches(actual)) {
+                    return false;
+                }
             } else if (actual !== expected) {
                 return false;
             }
         }
-        return refine
-            ? refine(candidate)
-            : (true as T extends S ? true : never);
+        return true;
     },
-});
+    structuralMatcher = <S extends object, T extends S>(
+        shape: S,
+        refine?: (value: S) => value is T,
+    ): Matcher<T> => ({
+        matches: (value: unknown): value is T => {
+            if (typeof value !== "object" || value === null) {
+                return false;
+            }
+            // oxlint-disable-next-line typescript/no-unsafe-type-assertion
+            const candidate = value as S;
+            if (!keysMatch(shape, candidate)) {
+                return false;
+            }
+            if (refine && !refine(candidate)) {
+                return false;
+            }
+            return true;
+        },
+    });
 
 export const P = {
     literal: literalMatcher,

tsconfig.build.json

@@ -2,9 +2,14 @@
     "extends": "./tsconfig.json",
     "compilerOptions": {
         "noEmit": false,
+        "target": "es2024",
+        "declaration": true,
+        "sourceMap": true,
+        "inlineSources": true,
+        "outDir": "dist",
         "rewriteRelativeImportExtensions": true,
-        "rootDir": "src",
-        "outDir": "dist"
+        "rootDir": "src"
     },
+    "include": ["src"],
     "exclude": ["src/**/*.test.ts", "src/**/__tests__/**"]
 }

tsconfig.json

@@ -1,38 +1,12 @@
 {
+    "extends": [
+        "@tsconfig/node26/tsconfig.json",
+        "@tsconfig/strictest/tsconfig.json"
+    ],
     "compilerOptions": {
-        "target": "es2024",
-        "module": "nodenext",
-        "moduleResolution": "nodenext",
-        "moduleDetection": "force",
-        "lib": ["es2024"],
-        "skipLibCheck": true,
-        "strict": true,
-        "noImplicitAny": true,
-        "noImplicitThis": true,
-        "alwaysStrict": true,
-        "strictNullChecks": true,
-        "strictFunctionTypes": true,
-        "strictBindCallApply": true,
-        "strictPropertyInitialization": true,
-        "noImplicitReturns": true,
-        "noFallthroughCasesInSwitch": true,
-        "noUncheckedIndexedAccess": true,
-        "noImplicitOverride": true,
-        "forceConsistentCasingInFileNames": true,
-        "noUnusedLocals": true,
-        "noUnusedParameters": true,
-        "isolatedModules": true,
-        "verbatimModuleSyntax": true,
+        "noEmit": true,
         "allowImportingTsExtensions": true,
-        "declaration": true,
-        "declarationMap": true,
-        "sourceMap": true,
-        "outDir": "dist",
-        "esModuleInterop": true,
-        "allowSyntheticDefaultImports": true,
-        "resolveJsonModule": true,
-        "composite": false,
-        "types": ["node"]
+        "verbatimModuleSyntax": true
     },
-    "include": ["src"]
+    "include": ["src", "scripts"]
 }