ci: add Biome + Vitest + git-hook quality gates

.github/workflows/ci.yml

@@ -17,11 +17,28 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
+      # The Vault crypto core is Rust -> WASM. tsc and `next build` import the
+      # generated bindings (src/lib/vault/pkg, gitignored), so CI must build
+      # them before typechecking — this also verifies the crypto FFI contract.
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: crypto-core
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
       # Installs @mind-studio/* from GitHub Packages via the committed .npmrc.
       - run: npm ci
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN || secrets.GITHUB_TOKEN }}
+      - name: Build crypto-core WASM bindings
+        run: npm run wasm
+      # Lint + format gate (Biome). Fails on errors; warnings are the
+      # documented legacy baseline tracked in biome.json.
+      - run: npx biome ci .
       - run: npx tsc --noEmit
+      - run: npm run test
       - run: npm run build
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN || secrets.GITHUB_TOKEN }}

.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

.husky/pre-push

@@ -0,0 +1,15 @@
+# Fast confidence gate before code leaves this machine — mirrors CI's
+# correctness checks. The slow `next build` is left to CI.
+# Bypass in a pinch with `git push --no-verify`.
+npm run lint || exit 1
+
+# Typecheck needs the generated WASM bindings (src/lib/vault/pkg, built via
+# `npm run wasm`). Skip when absent so contributors without the Rust toolchain
+# aren't blocked — CI always builds WASM and typechecks for real.
+if [ -f src/lib/vault/pkg/crypto_core.d.ts ]; then
+  npm run typecheck || exit 1
+else
+  echo "⏭  Skipping typecheck — WASM bindings not built (run 'npm run wasm'). CI typechecks for real."
+fi
+
+npm run test || exit 1

biome.json

@@ -0,0 +1,66 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "ignoreUnknown": true,
+    "includes": [
+      "**",
+      "!**/src/lib/vault/pkg",
+      "!**/crypto-core",
+      "!**/src-tauri",
+      "!**/public",
+      "!**/scripts",
+      "!**/next-env.d.ts",
+      "!**/package-lock.json",
+      "!**/*.css"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 100
+  },
+  "linter": {
+    "enabled": true,
+    "domains": {
+      "next": "recommended",
+      "react": "recommended"
+    },
+    "rules": {
+      "recommended": true,
+      "correctness": {
+        "useExhaustiveDependencies": "warn"
+      },
+      "suspicious": {
+        "noImplicitAnyLet": "warn",
+        "useIterableCallbackReturn": "warn",
+        "noArrayIndexKey": "warn"
+      },
+      "a11y": {
+        "useButtonType": "warn",
+        "noLabelWithoutControl": "warn",
+        "noStaticElementInteractions": "warn",
+        "noSvgWithoutTitle": "warn",
+        "noAutofocus": "warn"
+      }
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double"
+    }
+  },
+  "assist": {
+    "enabled": true,
+    "actions": {
+      "source": {
+        "organizeImports": "on"
+      }
+    }
+  }
+}