cachekit-io · 27Bslash6 · May 17, 2026 · May 17, 2026 · May 17, 2026
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
@@ -0,0 +1,4 @@
+self-hosted-runner:
+  labels:
+    - cachekit-lean
+    - cachekit
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -60,7 +60,7 @@ jobs:
         run: pnpm test
 
   test-integration:
-    runs-on: cachekit  # needs DinD for Redis service container
+    runs-on: cachekit # needs DinD for Redis service container
     services:
       redis:
         image: redis:7-alpine

diff --git a/.gitignore b/.gitignore
@@ -54,4 +54,4 @@ AGENTS.md
 .caliber/
 CALIBER_LEARNINGS.md
 .cursor/
-.cursorrules
+.cursorrules
diff --git a/.nvmrc b/.nvmrc
@@ -1 +1 @@
-20
+22
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -0,0 +1,98 @@
+# Pre-commit hooks for cachekit-ts
+#
+# Install (one time):   prek install --install-hooks
+# Run on all files:     prek run --all-files
+# Run on staged only:   prek run
+# Update hook versions: prek autoupdate
+#
+# Uses prek (https://github.com/j178/prek), a Rust reimplementation of
+# pre-commit that consumes this same .pre-commit-config.yaml format. Falling
+# back to Python `pre-commit` works identically.
+
+default_install_hook_types: [pre-commit, pre-push]
+
+repos:
+  # ─── TypeScript / JavaScript ─────────────────────────────────────────────
+  - repo: local
+    hooks:
+      - id: eslint
+        name: ESLint (auto-fix)
+        entry: pnpm exec eslint --fix --max-warnings 0
+        language: system
+        files: ^packages/cachekit/src/.*\.(ts|tsx)$
+        pass_filenames: true
+
+      - id: prettier
+        name: Prettier (auto-format)
+        entry: pnpm exec prettier --write --ignore-unknown
+        language: system
+        files: \.(ts|tsx|js|mjs|cjs|json|md|yaml|yml)$
+        exclude: |
+          (?x)^(
+            pnpm-lock\.yaml|
+            packages/[^/]+/dist/.*|
+            packages/cachekit-core-ts/index\.(js|d\.ts)|
+            \.release-please-manifest\.json
+          )$
+        pass_filenames: true
+
+      - id: type-check
+        name: TypeScript type-check (pre-push)
+        entry: pnpm type-check
+        language: system
+        files: \.(ts|tsx)$
+        pass_filenames: false
+        stages: [pre-push]
+
+  # ─── Rust (packages/cachekit-core-ts) ────────────────────────────────────
+  - repo: local
+    hooks:
+      - id: cargo-fmt
+        name: Cargo format
+        entry: bash -c 'cd packages/cachekit-core-ts && cargo fmt --all -- --check'
+        language: system
+        files: ^packages/cachekit-core-ts/.*\.rs$
+        pass_filenames: false
+
+      - id: cargo-clippy
+        name: Cargo clippy
+        entry: bash -c 'cd packages/cachekit-core-ts && cargo clippy --all-targets -- -D warnings'
+        language: system
+        files: ^packages/cachekit-core-ts/.*\.rs$
+        pass_filenames: false
+
+  # ─── GitHub Actions workflow linting ─────────────────────────────────────
+  - repo: https://github.com/rhysd/actionlint
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12  # pragma: allowlist secret
+    hooks:
+      - id: actionlint
+
+  # ─── General file hygiene ────────────────────────────────────────────────
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0  # pragma: allowlist secret
+    hooks:
+      - id: trailing-whitespace
+        exclude: \.md$ # markdown uses trailing whitespace for line breaks
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-json
+        exclude: ^(\.vscode/|tsconfig.*\.json$) # tsconfig allows comments
+      - id: check-toml
+      - id: check-added-large-files
+        args: [--maxkb=1000]
+      - id: check-merge-conflict
+      - id: check-case-conflict
+
+  # ─── Secret scanning ─────────────────────────────────────────────────────
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: 01886c8a910c64595c47f186ca1ffc0b77fa5458 # v1.5.0  # pragma: allowlist secret
+    hooks:
+      - id: detect-secrets
+        args: [--baseline, .secrets.baseline]
+        exclude: |
+          (?x)^(
+            pnpm-lock\.yaml|
+            packages/[^/]+/dist/.*|
+            packages/cachekit-core-ts/index\.(js|d\.ts)|
+            .*\.snap$
+          )$
diff --git a/.secrets.baseline b/.secrets.baseline
@@ -0,0 +1,262 @@
+{
+  "version": "1.5.0",
+  "plugins_used": [
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "name": "Base64HighEntropyString",
+      "limit": 4.5
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "DiscordBotTokenDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "name": "GitLabTokenDetector"
+    },
+    {
+      "name": "HexHighEntropyString",
+      "limit": 3.0
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "IPPublicDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "name": "KeywordDetector",
+      "keyword_exclude": ""
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "OpenAIDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "PypiTokenDetector"
+    },
+    {
+      "name": "SendGridDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TelegramBotTokenDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "filters_used": [
+    {
+      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_baseline_file",
+      "filename": ".secrets.baseline"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
+      "min_level": 2
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_lock_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_sequential_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_swagger_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    },
+    {
+      "path": "detect_secrets.filters.regex.should_exclude_file",
+      "pattern": [
+        "pnpm-lock\\.yaml|node_modules/|packages/.+/dist/|packages/cachekit-core-ts/index\\.(js|d\\.ts)|\\.snap$"
+      ]
+    }
+  ],
+  "results": {
+    "packages/cachekit/src/backends/cachekitio-lockable.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "packages/cachekit/src/backends/cachekitio-lockable.test.ts",
+        "hashed_secret": "e0fdd3a410527dc3165e4b0454a4f751532fe2d6",
+        "is_verified": false,
+        "line_number": 21
+      }
+    ],
+    "packages/cachekit/src/backends/cachekitio-ttl.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "packages/cachekit/src/backends/cachekitio-ttl.test.ts",
+        "hashed_secret": "d5cddcdc91bee2fd64ae234ac73fdd0591c0e3ca",
+        "is_verified": false,
+        "line_number": 20
+      }
+    ],
+    "packages/cachekit/src/backends/cachekitio.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "packages/cachekit/src/backends/cachekitio.test.ts",
+        "hashed_secret": "9242986caf890b01f4265ee595e88ee087af4b90",
+        "is_verified": false,
+        "line_number": 19
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "packages/cachekit/src/backends/cachekitio.test.ts",
+        "hashed_secret": "a62f2225bf70bfaccbc7f1ef2a397836717377de",
+        "is_verified": false,
+        "line_number": 45
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "packages/cachekit/src/backends/cachekitio.test.ts",
+        "hashed_secret": "310ca4c3a208b51df7a1d454bab0730b474e0d99",
+        "is_verified": false,
+        "line_number": 358
+      }
+    ],
+    "packages/cachekit/src/intents.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "packages/cachekit/src/intents.test.ts",
+        "hashed_secret": "42c48ae0d1c6bc8d47b3b25fdcf2eb1156cd0c6a",
+        "is_verified": false,
+        "line_number": 206
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "packages/cachekit/src/intents.test.ts",
+        "hashed_secret": "18060b49185cba9a51b0d10290136007c3c8ab00",
+        "is_verified": false,
+        "line_number": 242
+      }
+    ],
+    "packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts",
+        "hashed_secret": "43f8a5e00c7a0964cdf90022b9eb2cab0b0f96ca",
+        "is_verified": false,
+        "line_number": 39
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts",
+        "hashed_secret": "78957630e10fc59808977ffa94afcab92592eb41",
+        "is_verified": false,
+        "line_number": 46
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts",
+        "hashed_secret": "769703a72cded41716f0bb63f41ba5594f1f9459",
+        "is_verified": false,
+        "line_number": 47
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts",
+        "hashed_secret": "549cfabd06bf6e6628429cb26091a7fb31658135",
+        "is_verified": false,
+        "line_number": 54
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts",
+        "hashed_secret": "a3c0c29cee36901e4791679ae22d7259900561a4",
+        "is_verified": false,
+        "line_number": 55
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts",
+        "hashed_secret": "4b579b62045b402109810e56d7e35dbb5047df7a",
+        "is_verified": false,
+        "line_number": 339
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "packages/cachekit/test/protocol/cross-sdk-interop.protocol.test.ts",
+        "hashed_secret": "638d131f1034c3a24b1b8b6829b7c765c85f568b",
+        "is_verified": false,
+        "line_number": 340
+      }
+    ],
+    "packages/cachekit/test/protocol/wire-format.protocol.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "packages/cachekit/test/protocol/wire-format.protocol.test.ts",
+        "hashed_secret": "94a0e90cfabf50717f7f969ff1b8d5335f2b0ed2",
+        "is_verified": false,
+        "line_number": 135
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "packages/cachekit/test/protocol/wire-format.protocol.test.ts",
+        "hashed_secret": "433223517d64226aefd32d9b2e6bebaa8599bddd",
+        "is_verified": false,
+        "line_number": 137
+      }
+    ]
+  },
+  "generated_at": "2026-05-17T00:20:23Z"
+}
diff --git a/README.md b/README.md
@@ -4,9 +4,9 @@ TypeScript SDK for CacheKit - Production-ready Redis caching with L1 in-memory,
 
 ## Packages
 
-| Package | Description |
-|---------|-------------|
-| [@cachekit-io/cachekit](./packages/cachekit) | Main SDK |
+| Package                                                      | Description             |
+| ------------------------------------------------------------ | ----------------------- |
+| [@cachekit-io/cachekit](./packages/cachekit)                 | Main SDK                |
 | [@cachekit-io/cachekit-core-ts](./packages/cachekit-core-ts) | Native bindings (N-API) |
 
 ## Development