chore: scaffold prek pre-commit hooks for local quality gates

[27Bslash6]

Summary

Adds a robust pre-commit toolchain to cachekit-ts. Before this change, this repo had zero committed pre-commit tooling — quality gates only fired in CI, every contributor (fork or otherwise) found out about lint/format/type errors via GitHub. This PR closes that gap, matching the pattern already in place in sibling repos cachekit-py and cachekit-rs.

Uses prek (Rust reimplementation of pre-commit, drop-in compatible) — consistent with the workspace tooling preference. Python pre-commit works identically against the same config.

What runs when

Pre-commit stage (every git commit):

Hook	Scope
ESLint --fix	staged *.ts / *.tsx in packages/cachekit/src
Prettier --write	staged *.{ts,tsx,js,mjs,cjs,json,md,yaml,yml}
Cargo fmt --check	when packages/cachekit-core-ts/**/*.rs staged
Cargo clippy -D warnings	when packages/cachekit-core-ts/**/*.rs staged
actionlint	when .github/workflows/*.yml staged
pre-commit-hooks suite	trailing-whitespace, end-of-file-fixer, check-yaml/json/toml, added-large-files (1MB cap), merge-conflict, case-conflict
detect-secrets	every commit against .secrets.baseline

Pre-push stage (slow gates, run once per branch):

Hook	Scope
pnpm type-check	full repo TypeScript type-check

Side-effect fixes

The new hooks surfaced latent issues that were hidden by the absence of pre-commit. Bundled into this PR so the repo is green on first merge:

• cargo fmt normalisations in packages/cachekit-core-ts/src/lib.rs (import ordering, multi-line format!() wrapping)
• impl Default for ByteStorage — fixes clippy::new_without_default violation that was already a #![deny(clippy::all)] failure
• Trailing newlines added to .nvmrc and .gitignore
• Prettier reflow across READMEs, CHANGELOGs, intents.ts, test files, tsconfig.json, vitest.workspace.ts, pnpm-workspace.yaml, release-please-config.json
• .github/actionlint.yaml added to whitelist the cachekit-lean and cachekit self-hosted runner labels (otherwise actionlint flags 7 lines in CI workflows)
• .secrets.baseline committed with 16 baselined test fixtures (all ck_test_* API keys + deterministic cross-SDK hex test vectors — verified false positives)

Install (one-time per clone)

prek install --install-hooks

(Or pre-commit install --install-hooks if you don't have prek.)

Existing local hooks (e.g. personal caliber refresh) are migrated to .legacy and chained automatically — nothing breaks.

Test plan

• prek run --all-files → all 14 hooks pass
• pnpm build → 2/2 packages succeed
• pnpm test → 456/457 passes (1 skipped)
• cargo clippy --all-targets -- -D warnings → clean
• Pre-push hook fires pnpm type-check (verified via push)

Out of scope

• Branch protection on main (admin action, separate)
• Fork-PR CI runner strategy (separate code change)
• CONTRIBUTING.md / CODE_OF_CONDUCT.md (separate, follow-up)
• The 0.1.0 → 0.1.1 drift in packages/cachekit-core-ts/index.js (stale napi-generated artifact, unrelated)

Summary by CodeRabbit

• Chores
  • Updated Node.js engine requirement
  • Added pre-commit hooks for code quality, linting, and secret detection (baseline)
  • Configured CI runner label allowances
  • Ignored new artifact pattern and reformatted config/documentation for consistency
• Enhancement
  • Added a default initialization behavior for byte storage to simplify usage

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fe8fbb80-7303-4d78-9d4f-1214ad6d4685

📥 Commits

Reviewing files that changed from the base of the PR and between 7fd6bda and ec4965a.

📒 Files selected for processing (2)

• .nvmrc
• package.json

✅ Files skipped from review due to trivial changes (2)

• package.json
• .nvmrc

---

📝 Walkthrough

Walkthrough

Adds pre-commit hooks and a secrets baseline; tweaks CI/infra and workspace config formatting; reformats docs, tests, and TypeScript exports/imports; and implements Rust's Default for ByteStorage (delegates to new()). All behavior-preserving except for the ByteStorage Default impl.

Changes

Developer tooling, code formatting, and configuration

Layer / File(s)	Summary
Pre-commit hooks and secrets detection configuration .pre-commit-config.yaml, .secrets.baseline	Adds comprehensive pre-commit hooks for TypeScript/JavaScript (ESLint, Prettier, type-check), Rust (cargo fmt, clippy), GitHub Actions linting, general hygiene (trailing whitespace, EOF fixer, YAML/JSON/TOML checks, merge-conflict detection), and detect-secrets baseline with hashed detections.
CI runner configuration and version updates .github/actionlint.yaml, .github/workflows/ci.yml, .nvmrc, .gitignore	Adds actionlint self-hosted-runner labels, adjusts CI workflow comment spacing, updates Node.js version in .nvmrc, and ignores .cursorrules.
Rust library trait implementation and code organization packages/cachekit-core-ts/src/lib.rs	Implements Default for ByteStorage (returns Self::new()), groups cachekit_core imports, and reformats error/validation code without changing semantics.
TypeScript export/import formatting and intent helpers packages/cachekit/src/index.ts, packages/cachekit/src/intents.ts	Reformats export type and import type blocks to multiline, and adjusts formatting of ConfigurationError construction and mergeReliability helper without signature or logic changes.
Test assertion and protocol helper formatting packages/cachekit/src/intents.test.ts, packages/cachekit/test/integration/encryption-real-crypto.integration.test.ts, packages/cachekit/test/integration/redis-backend.integration.test.ts, packages/cachekit/test/protocol/aad-format.protocol.test.ts, packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts	Reformats assertions and helper signatures, aligns whitespace and hex literal casing; test logic and expected values are unchanged.
Configuration and workspace file formatting pnpm-workspace.yaml, release-please-config.json, tsconfig.json, vitest.workspace.ts	Standardizes workspace/glob quoting, reformats changelog-sections array, and converts references/workspace arrays to single-line forms.
Documentation and changelog formatting README.md, SECURITY.md, packages/cachekit-core-ts/CHANGELOG.md, packages/cachekit/CHANGELOG.md, packages/cachekit/README.md	Updates Markdown table separators and layouts, changes list bullet markers, and reformats examples while preserving content values.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• cachekit-io/cachekit-rs#10: Modifies pre-commit and detect-secrets baseline files similar to this PR.

Poem

🐰 With hooks that catch each typo and leak,
A baseline hums where secrets used to peek,
Formatting hops through docs and test,
ByteStorage defaults wake from rest,
Now commits are tidy for a cleaner week.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title mentions 'prek' but the PR objectives clearly describe implementing a 'pre-commit toolchain', where 'prek' is a Rust reimplementation of pre-commit. The title uses 'prek' (likely a typo for 'pre-commit') instead of the standard tool name, which obscures the primary purpose from developers unfamiliar with prek.	Consider clarifying the title to 'chore: scaffold pre-commit hooks for local quality gates' for clarity, or if 'prek' is intentional, verify this terminology is consistent with team conventions.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.nvmrc:
- Line 1: Update .nvmrc to match CI by changing the single line from "20" to
"22" so local tooling uses the same Node major as CI and the majority of
packages, and if you intentionally need to stay on 20 instead, add a short note
in the repo (e.g., README or CONTRIBUTING) explaining the reason and any special
steps; also verify and, if needed, align the "engines" field in package.json
workspace and individual packages with the chosen major to avoid mismatches with
CI build-matrix expectations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1a4d9ee7-9190-46ee-b0ae-2dff6e0a5c56

📥 Commits

Reviewing files that changed from the base of the PR and between e2c7105 and bf94935.

📒 Files selected for processing (23)

• .github/actionlint.yaml
• .github/workflows/ci.yml
• .gitignore
• .nvmrc
• .pre-commit-config.yaml
• .secrets.baseline
• README.md
• SECURITY.md
• packages/cachekit-core-ts/CHANGELOG.md
• packages/cachekit-core-ts/src/lib.rs
• packages/cachekit/CHANGELOG.md
• packages/cachekit/README.md
• packages/cachekit/src/index.ts
• packages/cachekit/src/intents.test.ts
• packages/cachekit/src/intents.ts
• packages/cachekit/test/integration/encryption-real-crypto.integration.test.ts
• packages/cachekit/test/integration/redis-backend.integration.test.ts
• packages/cachekit/test/protocol/aad-format.protocol.test.ts
• packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts
• pnpm-workspace.yaml
• release-please-config.json
• tsconfig.json
• vitest.workspace.ts