feat!: RU1 stack uplift and Bazel-only distribution (1.0.0)

.bazelignore

@@ -7,3 +7,4 @@ coverage
 dist
 dist-types
 node_modules
+.svelte-check

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
       npm_publish_mode: disabled
       node_versions: '["22"]'
       publish_node_version: "22"
-      pnpm_version: "9.15.9"
+      pnpm_version: "10.13.1"
       metadata_check_command: pnpm run check:release-metadata
       typecheck_command: pnpm run check
       unit_test_command: pnpm run test

.gitignore

@@ -4,3 +4,4 @@ coverage/
 node_modules/
 bazel-*
 *.tsbuildinfo
+.svelte-check/

.pnpmfile.cjs

@@ -0,0 +1,40 @@
+// RU13 (TypeScript 7.0.2 as `typescript`): see patches/README.md.
+//
+// TypeScript 7 ships no in-process compiler API, but the packages below parse
+// TypeScript in-process and declare `typescript` as a peer. pnpm resolves a
+// peer from the root, where `typescript` is 7.0.2, and neither pnpm
+// `overrides` nor `packageExtensions` can redirect a peer. This hook turns
+// that peer into a regular dependency on Microsoft's TypeScript 6 API package
+// (`@typescript/typescript6`), so only these packages load it; the root
+// `typescript`, every `tsc` and every type check stay on 7.0.2. pnpm records
+// the result in pnpm-lock.yaml (`pnpmfileChecksum`), which rules_js reads.
+//
+// SvelteKit is not listed: patches/@sveltejs__kit@3.0.1.patch teaches it to
+// find the companion itself. Remove a name once its upstream supports
+// TypeScript 7.
+
+const COMPANION = 'npm:@typescript/typescript6@6.0.2';
+
+const TS_API_CONSUMERS = new Set([
+	'svelte-check',
+	'ts-api-utils',
+	'typescript-eslint',
+	'@typescript-eslint/eslint-plugin',
+	'@typescript-eslint/parser',
+	'@typescript-eslint/project-service',
+	'@typescript-eslint/tsconfig-utils',
+	'@typescript-eslint/type-utils',
+	'@typescript-eslint/typescript-estree',
+	'@typescript-eslint/utils',
+]);
+
+function readPackage(pkg) {
+	if (TS_API_CONSUMERS.has(pkg.name) && pkg.peerDependencies?.typescript) {
+		delete pkg.peerDependencies.typescript;
+		if (pkg.peerDependenciesMeta) delete pkg.peerDependenciesMeta.typescript;
+		pkg.dependencies = { ...pkg.dependencies, typescript: COMPANION };
+	}
+	return pkg;
+}
+
+module.exports = { hooks: { readPackage }, TS_API_CONSUMERS, COMPANION };

BUILD.bazel

@@ -14,10 +14,9 @@ Build strategy:
   - vitest for PBT tests (property-based tests using fast-check)
 """
 
-load("@aspect_rules_js//js:defs.bzl", "js_binary", "js_library", "js_run_binary")
+load("@aspect_rules_js//js:defs.bzl", "js_binary", "js_library", "js_run_binary", "js_test")
 load("@aspect_rules_js//npm:defs.bzl", "npm_package")
 load("@tummycrypt_tinyvectors_npm//:defs.bzl", "npm_link_all_packages")
-load("@tummycrypt_tinyvectors_npm//:svelte-check/package_json.bzl", svelte_check_bin = "bin")
 load("@tummycrypt_tinyvectors_npm//:vitest/package_json.bzl", vitest_bin = "bin")
 
 # =============================================================================
@@ -26,7 +25,18 @@ load("@tummycrypt_tinyvectors_npm//:vitest/package_json.bzl", vitest_bin = "bin"
 
 npm_link_all_packages(name = "node_modules")
 
-svelte_check_bin.svelte_check_binary(name = "svelte_check")
+# RU13: svelte-check runs in its TypeScript 7 native mode (--tsgo) through a
+# runner that checks a writable scratch copy (see the script header).
+js_binary(
+    name = "svelte_check",
+    data = [
+        ":node_modules",
+        ":node_modules/svelte",
+        ":node_modules/svelte-check",
+        ":node_modules/typescript",
+    ],
+    entry_point = "scripts/bazel/run-svelte-check.mjs",
+)
 
 js_binary(
     name = "build_declarations",
@@ -149,7 +159,7 @@ npm_package(
         ":tinyvectors",
     ],
     package = "@tummycrypt/tinyvectors",
-    version = "0.3.7",
+    version = "1.0.0",
     visibility = ["//visibility:public"],
 )
 
@@ -226,7 +236,8 @@ vitest_bin.vitest_test(
 #
 # Uses svelte-check for type validation of .svelte and .ts files.
 # This is preferred over plain tsc for packages containing Svelte components,
-# as it understands .svelte file boundaries and runes syntax.
+# as it understands .svelte file boundaries and runes syntax. RU13: it runs as
+# `svelte-check --tsgo`, so TypeScript 7.0.2 does the checking.
 # =============================================================================
 
 js_run_binary(
@@ -241,13 +252,35 @@ js_run_binary(
         ":node_modules",
     ],
     args = [
-        "--tsconfig",
         "$(execpath tsconfig.json)",
     ],
     stdout = "typecheck.log",
     visibility = ["//visibility:public"],
 )
 
+# Seeded-error canary for the gate above: under --tsgo a tsconfig that checks
+# nothing reports 0 errors (sveltejs/language-tools#3136), so this test fails
+# unless a seeded .ts and a seeded .svelte type error are both reported.
+js_test(
+    name = "typecheck_canary_test",
+    args = [
+        "$(rootpath tsconfig.json)",
+        "--canary",
+    ],
+    data = glob([
+        "src/**/*.ts",
+        "src/**/*.svelte",
+    ]) + [
+        "package.json",
+        "tsconfig.json",
+        ":node_modules",
+        ":node_modules/svelte",
+        ":node_modules/svelte-check",
+        ":node_modules/typescript",
+    ],
+    entry_point = "scripts/bazel/run-svelte-check.mjs",
+)
+
 # =============================================================================
 # Exported files for downstream consumers
 # =============================================================================

CHANGELOG.md

@@ -1,9 +1,71 @@
 # Changelog
 
-> **Distribution note (2026-07-25):** the npm channel is retired. npm
-> publishes stop at 0.3.0; 0.3.1+ ship as git tags + entries in
-> [tinyland-inc/bazel-registry](https://github.com/tinyland-inc/bazel-registry)
-> only. See the README's Install section for the sanctioned consumption paths.
+> **Distribution (RU6/RU8, 2026-10-08):** this package is distributed only
+> through Bazel: signed git tags plus entries in
+> [xoxd-ai/bazel-registry](https://github.com/xoxd-ai/bazel-registry). The npm
+> channel stopped at 0.3.0 (retired 2026-07-25) and the package is now
+> `private`; nothing is published to npmjs or GitHub Packages.
+
+## 1.0.0 - 2026-10-14
+
+Stack uplift to the estate RU1 stack. The runtime API is unchanged: every
+export, prop, default and physics constant is the same as 0.3.7. It is a major
+version because the Svelte peer, the toolchain and the distribution contract
+change (RU10).
+
+### Breaking changes
+
+- **Svelte peer is exact `5.57.2`** (was `>=5.20.0`), per the estate pin policy
+  (RS11/RU5). Consumers must be on Svelte 5.57.2.
+- **Bazel-only distribution.** `package.json` is `private: true`;
+  `publishConfig`, the `prepublishOnly` hook and `.github/workflows/publish.yml`
+  are removed (RU8). Consume `tummycrypt_tinyvectors` 1.0.0 from
+  xoxd-ai/bazel-registry.
+- **Build toolchain:** TypeScript 7.0.2 (native compiler), Vite 8.3.3
+  (Rolldown, Oxc minifier), @sveltejs/vite-plugin-svelte 7.3.1, vitest 5.0.3,
+  svelte-check 4.7.6, pnpm 10.13.1, Node toolchain 22.22.0 (engines
+  `>=22.12.0`). A consumer that builds this module from source (Bazel
+  `@tummycrypt_tinyvectors//:pkg`, or a tag-archive `prepare` hook) needs
+  pnpm 10 and Node >= 22.12.
+- `@sveltejs/package` is dropped from devDependencies (it was not used by any
+  build step; declarations come from `tsc` plus the hand-written
+  `*.svelte.d.ts` files).
+
+### Migration
+
+1. Bazel consumers: `bazel_dep(name = "tummycrypt_tinyvectors", version = "1.0.0")`
+   and refresh `MODULE.bazel.lock`. Keep linking `@tummycrypt_tinyvectors//:pkg`
+   with `npm_link_package`; target names are unchanged.
+2. Pin `svelte` to exactly `5.57.2` in the consuming app.
+3. Remove any `@tummycrypt/tinyvectors` npm or tag-tarball specifier from
+   `package.json`; the registry module is the only supported source.
+4. No source changes are needed: imports, component props, the
+   `themes/css` entry and all exported names are identical to 0.3.7.
+
+### Tooling details
+
+- TypeScript 7 (RU13): `tsc` is resolved through `typescript/package.json`
+  `bin` because the TypeScript 7 exports map no longer exposes
+  `lib/tsc.js`. `tsconfig.json` drops `baseUrl`/`paths` (removed in
+  TypeScript 7; no source used `$lib`).
+- Type checking is `svelte-check --tsgo` (TypeScript 7 does the checking). The
+  RU13 patch set is copied verbatim from xoxd-ai/site.scaffold (`patches/`,
+  `.pnpmfile.cjs`); only `patches/svelte-check@4.7.6.patch` is wired here,
+  since this package uses neither SvelteKit nor devalue. svelte-check's
+  in-process svelte2tsx parser loads `@typescript/typescript6` through the
+  `.pnpmfile.cjs` hook (operator ruling RU13b); nothing type-checks with it.
+- Bazel: `//:typecheck` runs svelte-check `--tsgo` in a writable scratch copy
+  (`scripts/bazel/run-svelte-check.mjs`), and the new `//:typecheck_canary_test`
+  proves the gate reports a seeded `.ts` and `.svelte` error
+  (sveltejs/language-tools#3136).
+- Vite 8: `build.rolldownOptions` replaces the deprecated `rollupOptions`
+  alias, and the default Oxc minifier replaces esbuild in both the library
+  build and the bundle-size gate.
+- fast-check 4, publint 0.3.
+- `scripts/check-release-metadata.mjs` now asserts the RU8 contract
+  (`private`, no `publishConfig`, no `prepublishOnly`, no `publish.yml`)
+  instead of the old publish-workflow parity checks.
+- Repository URLs point at xoxd-ai.
 
 ## 0.3.7 - 2026-09-01
 

MODULE.bazel

@@ -1,13 +1,13 @@
 """
 MODULE.bazel for standalone Bazel consumption of @tummycrypt/tinyvectors.
 
-Usage from external repo:
-  bazel_dep(name = "tummycrypt_tinyvectors", version = "0.3.0")
+Usage from external repo (xoxd-ai/bazel-registry):
+  bazel_dep(name = "tummycrypt_tinyvectors", version = "1.0.0")
 """
 
 module(
     name = "tummycrypt_tinyvectors",
-    version = "0.3.7",
+    version = "1.0.0",
     compatibility_level = 1,
 )
 
@@ -18,20 +18,28 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.22.5")
 bazel_dep(name = "rules_nodejs", version = "6.7.3")
 
 node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")
-node.toolchain(node_version = "22.13.1")
+# Node 22.22.0: Vite 8 needs Node >= 22.12 (engines in package.json); 22.22.0
+# is the newest 22.x that rules_nodejs 6.7.3 knows (matches site.scaffold).
+node.toolchain(node_version = "22.22.0")
 
 pnpm = use_extension("@aspect_rules_js//npm:extensions.bzl", "pnpm")
 pnpm.pnpm(
     name = "pnpm",
-    pnpm_version = "9.15.9",
+    pnpm_version = "10.13.1",
 )
 use_repo(pnpm, "pnpm")
 
 npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm")
 npm.npm_translate_lock(
     name = "tummycrypt_tinyvectors_npm",
     pnpm_lock = "//:pnpm-lock.yaml",
-    data = ["//:package.json"],
+    # RU13: npm_translate_lock applies the pnpm `patchedDependencies` and the
+    # .pnpmfile.cjs rewrite recorded in pnpm-lock.yaml; both are inputs.
+    data = [
+        "//:.pnpmfile.cjs",
+        "//:package.json",
+        "//:patches/svelte-check@4.7.6.patch",
+    ],
     # TIN-2099: skip esbuild's `node install.js` postinstall so no build
     # action needs network or a platform binary outside declared inputs
     # (breaks under strict sandbox/worker strategies). Safe because vite