chore(release): prepare validated project update

.cspell.json

@@ -9,12 +9,17 @@
     "Autobuild",
     "autorelease",
     "Commitprompt",
+    "Commitizen",
     "commitlint",
+    "commitlintrc",
+    "cosmiconfig",
+    "Czg",
     "domexception",
     "esbuild",
     "eslintcache",
     "knip",
     "lede",
+    "lockfiles",
     "publint",
     "santi",
     "Turborepo",

.github/workflows/infisical-connection.yml

@@ -0,0 +1,27 @@
+name: Infisical Connection Check
+
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  verify:
+    name: Verify Infisical OIDC
+    runs-on: ubuntu-latest
+    steps:
+      - name: Authenticate and fetch development secrets
+        uses: Infisical/secrets-action@v1.0.16
+        with:
+          method: oidc
+          identity-id: ${{ vars.INFISICAL_IDENTITY_ID }}
+          project-slug: ${{ vars.INFISICAL_PROJECT_SLUG }}
+          env-slug: dev
+          secret-path: /
+          recursive: true
+
+      - name: Confirm connection
+        run: echo "Infisical OIDC authentication completed successfully."
+

.infisical.json

@@ -0,0 +1,5 @@
+{
+  "workspaceId": "14389c5e-c8bb-4253-a5ff-5f7df6569e7d",
+  "defaultEnvironment": "dev",
+  "gitBranchToEnvironmentMapping": null
+}

IMPROVEMENTS.md

@@ -0,0 +1,94 @@
+# Commitprompt next-release improvements
+
+This document records the v1 adoption findings, what is implemented for the
+next release, and the remaining work that should guide a later iteration.
+
+## Implemented for the next release
+
+### Valid VS Code JSONC
+
+- VS Code settings accept comments and trailing commas at every nesting level.
+- Existing formatting, comments, custom instructions, and model preferences are
+  preserved.
+- Realistic exported settings and repeat-run idempotency are covered by tests.
+
+### Repository setup
+
+`commitprompt setup project` now:
+
+- detects npm, pnpm, or Yarn from repository metadata and lockfiles;
+- adds Commitprompt and Husky development dependencies;
+- respects pnpm workspace catalogs;
+- sets the neutral `commitprompt` package script;
+- installs the canonical `commit-msg` validation hook while preserving
+  unrelated hook commands;
+- reports the detected package manager so the user can update the dependency
+  installation and lockfile explicitly;
+- writes guarded AGENTS.md and GitHub Copilot instructions;
+- installs reusable Commitprompt skills for common agent layouts;
+- reports obsolete Commitizen, Czg, and custom prompt configuration without
+  deleting it.
+
+The command supports independent `--only` actions, `--check`, `--dry-run`,
+`--json`, and `--cwd`.
+
+### Repository-aware editor instructions
+
+`commitprompt setup editors` writes tracked VS Code and Zed workspace settings
+using the repository's configured types and scopes. It preserves user-authored
+instructions, never writes machine-specific model preferences, and supports
+editor selection plus check, preview, JSON, and alternate-working-directory
+modes.
+
+### Hook diagnostics and AI assets
+
+- Invalid hooks explicitly state that the commit was blocked, list violated
+  rules, and provide a correction-and-retry workflow.
+- npm, pnpm, and Yarn hook examples use the same canonical validation command.
+- A real Husky integration test accepts a valid message and rejects an invalid
+  one.
+- Versioned AGENTS.md, GitHub Copilot, and agent-skill templates ship from one
+  canonical source.
+- The instructions require repository and diff inspection, type and scope
+  discovery, structured formatting, exact validation, explicit authorization,
+  and normal Git hooks.
+
+### Release verification
+
+The consumer smoke test installs the artifact with npm, pnpm, and Yarn and
+checks:
+
+1. the interactive binary;
+2. `types`, `scopes`, `instructions`, `format`, and `validate`;
+3. realistic VS Code and Zed JSONC;
+4. project and editor setup idempotency;
+5. generated hook enforcement;
+6. published templates, declaration maps, and source maps.
+
+Published-package verification also checks the npm `latest` dist-tag and runs
+the same consumer workflow against the registry artifact.
+
+### Warning-free minimal consumers
+
+Commitprompt now loads Commitlint configuration without
+`cosmiconfig-typescript-loader`. JavaScript, JSON, YAML, extends, plugins,
+parser presets, asynchronous rules, and native Node.js TypeScript configuration
+remain supported. Minimal consumers no longer need TypeScript or
+`@types/node`. Packed npm, pnpm, and Yarn consumers load and enforce a native
+TypeScript configuration while verifying that neither package was installed.
+The Commitlint lint engine is bundled with generated third-party license
+notices, avoiding the upstream `es-toolkit` manifest warning in Yarn Classic.
+The packed verifier rejects every npm, pnpm, or Yarn installer warning rather
+than suppressing output.
+
+## Candidates for the following release
+
+- Add an explicitly confirmed cleanup mode for obsolete Commitizen/Czg
+  dependencies and configuration.
+- Detect monorepo roots when setup starts from a nested workspace package and
+  report which manifest, catalog, and hook will be changed.
+- Add a setup report format suitable for pull-request annotations.
+- Explore editor-native validation feedback so generated messages can be
+  corrected before Git invokes the authoritative hook.
+- Report changes to the bundled lint engine's dependency, license, and byte-size
+  inventory during dependency upgrades.

apps/docs/playwright.config.ts

@@ -17,6 +17,7 @@ export default defineConfig({
   ],
   reporter: process.env.CI ? 'github' : 'list',
   retries: process.env.CI ? 2 : 0,
+  timeout: 60_000,
   testDir: 'tests',
   use: {
     baseURL,

apps/docs/public/llms-full.txt

@@ -19,6 +19,8 @@ The binary is always named `commitprompt`. Conventional Commitlint rules are
 included. Repository rules and extended configurations take precedence. When a
 resolved configuration has no extends, parser preset, or declared rules,
 Commitprompt retains its other settings and uses the included rules.
+JavaScript, JSON, YAML, and erasable TypeScript configuration files are
+supported without adding TypeScript to consumer dependencies.
 
 ## Interactive workflow
 
@@ -99,15 +101,19 @@ import {
   createGitClient,
   formatCommitMessage,
   runAutomation,
-  runCommitFlow
+  runCommitFlow,
+  setupProject,
+  setupWorkspaceEditors
 } from '@santi020k/commitprompt'
 ```
 
 `formatCommitMessage(answers)` produces the exact Conventional Commit message.
 `createCommitlintValidator(cwd)` returns cached `getTypes()`, `getScopes()`, and
 `validate(message)` operations. `createGitClient(cwd)` checks staged changes and
 commits through Git. `runAutomation(options)` powers the non-interactive commands.
-`runCommitFlow(options)` powers the interactive workflow.
+`runCommitFlow(options)` powers the interactive workflow. `setupProject(options)`
+and `setupWorkspaceEditors(options)` provide non-interactive repository setup
+and drift checking.
 
 The package is ESM-only. Every value and type exported from the package root is
 stable and follows semantic versioning. Source and `dist/` file paths are
@@ -120,22 +126,57 @@ existing documented behavior and required inputs will not change incompatibly.
 ```sh
 commitprompt setup zed
 commitprompt setup vscode
+commitprompt setup editors
 ```
 
-These commands add global Conventional Commit generation instructions while
-preserving existing editor settings and model selection. VS Code uses GitHub
-Copilot. Editor-generated messages do not pass through Commitprompt validation
-unless separately validated.
+The Zed and VS Code commands add global Conventional Commit generation
+instructions while preserving existing settings and model selection. The
+`editors` command creates tracked, repository-aware workspace settings using
+configured types and scopes. It supports `--editor`, `--dry-run`, `--check`,
+`--json`, and `--cwd`.
+
+Editor-generated messages do not pass through Commitprompt validation unless
+the repository installs the hook below.
+
+## Project setup
+
+```sh
+commitprompt setup project
+```
+
+This idempotent command detects npm, pnpm, or Yarn; adds Commitprompt and Husky;
+sets the `commit` script; installs a `commit-msg` hook; adds guarded AGENTS.md
+and GitHub Copilot instructions; and installs reusable agent skills. It reports
+obsolete Commitizen, Czg, and custom prompt configuration without deleting it.
+Run the detected package manager's install command afterward to update the
+lockfile and activate Husky.
+
+Use `--dry-run` to preview, `--check` as a non-writing CI drift gate, `--json`
+for machine-readable output, and `--only` to select actions. The canonical hook
+is:
+
+```sh
+commitprompt validate --input "$1"
+```
+
+Equivalent explicit npm, pnpm, and Yarn commands are:
+
+```sh
+npx --no-install commitprompt validate --input "$1"
+pnpm exec commitprompt validate --input "$1"
+yarn exec commitprompt validate --input "$1"
+```
 
 ## Safety boundaries
 
 - Commitprompt never stages files.
 - The interactive flow asks before committing.
 - The non-interactive flow requires `--yes`.
 - Commitprompt does not disable Git hooks.
-- Commitprompt does not install a `commit-msg` hook.
-- Enforce all Git-created messages by configuring Commitlint in a
-  repository `commit-msg` hook.
+- Project setup installs a guarded `commit-msg` hook without deleting unrelated
+  hook commands.
+- A failed hook states that the commit was blocked and reports violated rules.
+- Never bypass validation with `--no-verify`.
 
 ## Links
 

apps/docs/public/llms.txt

@@ -8,6 +8,10 @@ the target repository and staged diff, run `commitprompt types --json` and
 committing. A non-interactive commit requires the explicit `--yes` flag and
 leaves Git hooks enabled.
 
+Use `commitprompt setup project` for package-manager-neutral repository
+enforcement and reusable AI instructions. Use `commitprompt setup editors` for
+tracked, repository-aware Zed and VS Code generation guidance.
+
 ## Documentation
 
 - [Documentation](https://commitprompt.santi020k.com/docs/): Installation, interactive use, repository rules, automation commands, and programmatic API.

apps/docs/src/pages/docs.astro

@@ -64,6 +64,27 @@ Closes #123`
 
 const usageCommand = 'git add src/\npnpm commit'
 
+const hookItems = [
+  {
+    code: 'npx --no-install commitprompt validate --input "$1"',
+    label: 'npm',
+    language: 'shell',
+    value: 'npm'
+  },
+  {
+    code: 'pnpm exec commitprompt validate --input "$1"',
+    label: 'pnpm',
+    language: 'shell',
+    value: 'pnpm'
+  },
+  {
+    code: 'yarn exec commitprompt validate --input "$1"',
+    label: 'Yarn',
+    language: 'shell',
+    value: 'yarn'
+  }
+] as const
+
 const automationExample = `commitprompt instructions --json
 commitprompt scopes --json
 commitprompt types --json
@@ -111,6 +132,7 @@ await runCommitFlow({
       <nav aria-label="Documentation">
         <p>Start here</p>
         <a href="#installation">Installation</a>
+        <a href="#project-setup">Project setup</a>
         <a href="#configuration">Configuration</a>
         <a href="#usage">Usage</a>
         <a href="#editor-ai">Editor AI</a>
@@ -163,6 +185,46 @@ await runCommitFlow({
 
         <Separator />
 
+        <section id="project-setup">
+          <h2>Project setup</h2>
+          <p>
+            Configure package metadata, repository enforcement, and AI
+            instructions in one idempotent operation:
+          </p>
+          <Code
+            code="commitprompt setup project"
+            copy
+            label="Terminal"
+            language="shell"
+            variant="block"
+          />
+          <p>
+            Setup detects npm, pnpm, or Yarn; adds Commitprompt and Husky as
+            development dependencies; sets the neutral <Code>commit</Code>
+            script; installs a <Code>commit-msg</Code> validation hook; and adds
+            guarded guidance to <Code>AGENTS.md</Code> and GitHub Copilot
+            instructions plus reusable agent skills. Run the detected package
+            manager’s install command afterward to update the lockfile and
+            activate Husky.
+          </p>
+          <Callout>
+            <p>
+              Existing Commitizen, Czg, and custom prompt configuration is
+              reported but never deleted. Preview with
+              <Code>commitprompt setup project --dry-run</Code>, or use
+              <Code>--check --json</Code> as a non-writing CI drift gate.
+            </p>
+          </Callout>
+          <p>
+            Run <Code>commitprompt setup editors</Code> to create tracked,
+            repository-aware instructions in <Code>.vscode/settings.json</Code>
+            and <Code>.zed/settings.json</Code>. Configured commit types and
+            scopes are included without writing model preferences.
+          </p>
+        </section>
+
+        <Separator />
+
         <section id="configuration">
           <h2>Configuration</h2>
           <p>
@@ -202,6 +264,9 @@ await runCommitFlow({
             <Code>1</Code> for a warning, and <Code>2</Code> for an error.
             Commitprompt also passes through repository parser presets, plugins,
             ignores, default ignores, and help URLs when it validates a message.
+            JavaScript, JSON, YAML, and erasable TypeScript configuration files
+            load through Node.js without adding TypeScript to consumer
+            dependencies.
           </p>
           <Callout>
             <p>
@@ -316,15 +381,29 @@ await runCommitFlow({
         <section id="git-hooks">
           <h2>Git hooks</h2>
           <p>
-            Commitprompt validates every message created through its own commit
-            flow. It does not currently install Git hooks, so a commit created
-            directly by Git or an editor does not pass through Commitprompt.
+            Project setup installs a Husky <Code>commit-msg</Code> hook that runs
+            <Code>commitprompt validate --input "$1"</Code>. It preserves
+            unrelated hook commands and replaces known package-manager-specific
+            Commitlint invocations.
+          </p>
+          <p>
+            The hook enforces the same repository rules for commits created
+            directly by Git, Zed, or VS Code. A <Code>pre-commit</Code> hook runs
+            before the commit message exists and is better suited to staged-file
+            checks.
           </p>
+          <CodeTabs
+            ariaLabel="Explicit hook commands by package manager"
+            copy
+            items={hookItems}
+            storageKey="commitprompt-hook-package-manager"
+            wrap={false}
+          />
           <p>
-            To enforce the same policy for every commit, configure Commitlint in
-            your repository’s <Code>commit-msg</Code> hook. A
-            <Code>pre-commit</Code> hook runs before the commit message exists and
-            is better suited to staged-file checks.
+            On failure, Commitprompt lists the violated rules, states that the
+            commit was blocked, and directs the author to correct the message.
+            The generated neutral command works with npm, pnpm, and Yarn because
+            Husky adds local binaries to <Code>PATH</Code>.
           </p>
         </section>