chore: adopt Astro toolchain (typecheck, format, lint, dead-code, security)

.editorconfig

@@ -0,0 +1,13 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+# Markdown uses trailing spaces for hard line breaks.
+[*.md]
+trim_trailing_whitespace = false

.githooks/pre-commit

@@ -0,0 +1,7 @@
+#!/bin/sh
+# Fast pre-commit checks. The full gate runs on pre-push.
+# Wired via `core.hooksPath .githooks` (set by the package.json prepare script).
+set -e
+
+bun run secrets
+bun run format

.githooks/pre-push

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Full verification before pushing. Mirrors what CI enforces.
+set -e
+
+bun run gate
+
+# Advisory only: report known advisories but never block the push. The current
+# ones are transitive build-time deps (picomatch/js-yaml) with no static-site
+# attack surface; Dependabot bumps them upstream.
+bun audit || true

.github/dependabot.yml

@@ -5,29 +5,29 @@ version: 2
 updates:
   # JavaScript dependencies — managed with Bun (bun.lock is the source of truth;
   # the deploy/CI workflows run `bun install`). Requires Bun >= 1.1.39.
-  - package-ecosystem: "bun"
-    directory: "/"
+  - package-ecosystem: 'bun'
+    directory: '/'
     schedule:
-      interval: "weekly"
+      interval: 'weekly'
     open-pull-requests-limit: 5
     commit-message:
-      prefix: "chore(deps)"
+      prefix: 'chore(deps)'
     groups:
       # Batch all non-major updates into a single PR to cut review noise.
       # Major bumps still arrive as individual PRs (they need manual review).
       minor-and-patch:
         update-types:
-          - "minor"
-          - "patch"
+          - 'minor'
+          - 'patch'
 
   # GitHub Actions — keeps the SHA pins (and their `# vX.Y.Z` comments) current.
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
-      interval: "weekly"
+      interval: 'weekly'
     commit-message:
-      prefix: "ci"
+      prefix: 'ci'
     groups:
       actions:
         patterns:
-          - "*"
+          - '*'

.github/workflows/ci.yml

@@ -36,6 +36,15 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Gate (typecheck, format, lint, dead-code, tests)
+        run: bun run gate
+
+      - name: Secret scan
+        run: bun run secrets
+
+      - name: Dependency audit (advisory, non-blocking)
+        run: bun run audit || echo "::notice::bun audit reported advisories (non-blocking; Dependabot tracks upstream fixes)"
+
       - name: Build website
         run: bun run build
 

.github/workflows/deploy.yml

@@ -13,7 +13,7 @@ permissions:
   id-token: write
 
 concurrency:
-  group: "pages"
+  group: 'pages'
   cancel-in-progress: false
 
 jobs:

.gitignore

@@ -26,6 +26,9 @@ pnpm-debug.log*
 # Brainstorm visual companion
 .superpowers/
 
+# Session memory (remember plugin) — local tooling state, not project source
+.remember/
+
 # Playwright MCP output
 .playwright-mcp/
 

.oxlintrc.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "oxc"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "warn",
+    "perf": "off",
+    "pedantic": "off",
+    "style": "off"
+  },
+  "rules": {
+    "no-underscore-dangle": "off"
+  },
+  "ignorePatterns": ["dist/**", ".astro/**", "node_modules/**", "public/**"]
+}

.prettierignore

@@ -0,0 +1,16 @@
+# Build output / generated
+dist
+.astro
+node_modules
+bun.lock
+
+# Internal design/plan artifacts (HTML mockups + agent plan files whose fenced
+# code blocks aren't valid JS). Not shipped source — don't format.
+docs
+
+# Served verbatim — Prettier must not reflow static assets
+public
+
+# Verbatim copy synced from libredb-studio by scripts/sync-docker-compose.mjs.
+# Formatting it here would fight the sync step on every build.
+src/data/docker-compose.example.yml

.prettierrc.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://json.schemastore.org/prettierrc",
+  "singleQuote": true,
+  "printWidth": 120,
+  "plugins": ["prettier-plugin-astro", "prettier-plugin-tailwindcss"],
+  "tailwindStylesheet": "./src/styles/global.css",
+  "overrides": [{ "files": "*.astro", "options": { "parser": "astro" } }]
+}

.secretlintignore

@@ -0,0 +1,8 @@
+dist
+.astro
+node_modules
+bun.lock
+
+# Synced docker-compose example (from libredb-studio). The "connection string"
+# is a commented-out template default (postgres:postgres@...), not a secret.
+**/docker-compose.example.yml

.secretlintrc.json

@@ -0,0 +1,3 @@
+{
+  "rules": [{ "id": "@secretlint/secretlint-rule-preset-recommend" }]
+}

astro.config.mjs

@@ -9,13 +9,15 @@ export default defineConfig({
   redirects: {
     '/databases': '/providers',
   },
-  integrations: [sitemap({
-    lastmod: new Date(),
-  })],
+  integrations: [
+    sitemap({
+      lastmod: new Date(),
+    }),
+  ],
   vite: {
     plugins: [tailwindcss()],
   },
   build: {
-    assets: 'assets'
-  }
+    assets: 'assets',
+  },
 });