Fix local Nix dev shell Bazel authority

[Jesssullivan]

Problem

The repo pins Bazel 8.1.1 in .bazelversion, but the Nix dev shell currently exposes pkgs.bazel_8, which resolves to Bazel 8.6.0 in the current lock. Running bazel in the dev shell fails before any target can run.

CI works because the shared JS Bazel workflow invokes Bazelisk, which reads .bazelversion and downloads Bazel 8.1.1. Local repo-managed startup should match that authority.

Scope

• Make the dev shell provide a Bazel entrypoint that respects .bazelversion, likely Bazelisk from nixpkgs.
• Keep Node 22 and pnpm 9.15.9 aligned with package metadata.
• Document the intended local command path if needed.

Validation

• direnv reload or nix develop enters cleanly.
• bazel version reports 8.1.1, or the documented local command does.
• npx --yes @bazel/bazelisk build //:pkg //:typecheck //:test --verbose_failures still passes.

[Jesssullivan]

Local implementation is in progress.

Change made:

• flake.nix now provides a bazel wrapper that executes nixpkgs bazelisk, so normal bazel ... commands respect .bazelversion instead of using nixpkgs bazel_8.
• Shell banner now reports the pinned .bazelversion without invoking Bazel on shell entry.
• Formatter moved from pkgs.nixfmt-rfc-style to pkgs.nixfmt to match current nixpkgs guidance.

Validation run locally:

• nix fmt flake.nix
• nix flake check --no-build
• nix develop . --command bash -lc 'type -a bazel; bazel --version' -> wrapper first, Bazel 8.1.1\n- nix develop . --command bazel build //:pkg //:typecheck //:test --verbose_failures -> pass

[Jesssullivan]

Working-tree update, not committed yet:

• Dev shell now wraps Bazel with Bazelisk, so .bazelversion controls the actual Bazel version instead of the nixpkgs Bazel derivation.
• Added .bazelignore so Bazel does not walk .direnv, pnpm store, build outputs, or linked Bazel dirs.
• Added docs/release-flow.md to document the package authority chain: pnpm lock and Bazel package target produce the npm artifact; flake is developer shell only; no FlakeHub publication path currently exists.
• Expanded scripts/check-release-metadata.mjs to assert CI/publish reusable workflow parity, pnpm/Node/Bazel target/package-dir alignment, dry-run polarity, and npm provenance permission.

Validated locally: pnpm run check, pnpm run test, pnpm run build, pnpm run check:release-metadata, pnpm run check:package, pnpm audit --audit-level low, git diff --check, nix flake check --no-build, nix develop . --command bazel query ..., nix develop . --command bazel build //:pkg //:typecheck //:test, npm pack --dry-run ./bazel-bin/pkg, and npm publish --dry-run --ignore-scripts --access public ./bazel-bin/pkg all pass.

[Jesssullivan]

Release-flow cleanup update:

• Strengthened scripts/check-release-metadata.mjs so it now treats reusable workflow inputs as a shared CI/publish contract instead of checking only selected values.
• The checker now verifies CI and publish agree on runner/workspace/publish mode, Node matrix, publish Node major, pnpm version, command hooks, Bazel targets, package dir, and npm access.
• Added a check that the MODULE.bazel Node toolchain major matches package.json engines.
• Validation passed:
  • pnpm run check:release-metadata
  • pnpm run check:package
  • nix develop . --command bazel build //:pkg //:typecheck //:test --verbose_failures
  • npm pack --dry-run ./bazel-bin/pkg
  • npm publish --dry-run --ignore-scripts --access public ./bazel-bin/pkg
  • git diff --check

[Jesssullivan]

Package API-surface follow-up:

• Ran a temporary installed-consumer check against bazel-bin/pkg.
• Runtime exports resolved for root, ./motion, ./core, ./themes, and ./themes/css.
• TypeScript caught a real gap: dist-types/svelte/index.d.ts referenced missing Svelte component declarations.
• Fixed by adding explicit Svelte component declaration templates and wiring declaration generation through both pnpm build and Bazel //:pkg.
• The package now ships dist-types/svelte/TinyVectors.d.ts, dist-types/svelte/BlobSVG.d.ts, and a svelte index declaration that resolves through compiled JS specifiers.
• Validation passed: pnpm run build, pnpm run check, pnpm run test, Bazel package/typecheck/test, installed-consumer runtime import check, installed-consumer tsc --noEmit, pnpm run check:package, npm pack --dry-run ./bazel-bin/pkg, npm publish --dry-run --ignore-scripts --access public ./bazel-bin/pkg, pnpm run test:browser:motion, and git diff --check.

[Jesssullivan]

Follow-up hardening for the package type-surface fix:

• Added scripts/check-package-consumer.mjs and pnpm run check:package-consumer.
• The check links the Bazel-built ./bazel-bin/pkg into a temporary consumer workspace with the Svelte peer dependency, verifies runtime imports for root/core/motion/themes/svelte/theme CSS exports, and runs TypeScript against packaged declarations including ComponentProps<typeof TinyVectors>.
• Left it as a post-Bazel local/release command because the pinned shared workflow runs package_check_command before Bazel produces bazel-bin/pkg.
• Documented the ordering in docs/release-flow.md and added a README command entry.
• Validation passed after a fresh Bazel rebuild: pnpm run build, pnpm run check, pnpm run test, pnpm run check:release-metadata, Bazel package/typecheck/test, pnpm run check:package-consumer, publint, npm pack/publish dry-runs from bazel-bin/pkg, browser motion probe, and git diff --check.

[Jesssullivan]

CI hardening follow-up:

• Added Bazel target //:package_consumer_check using js_run_binary so the installed-consumer package validation runs during bazel build, which matches how the pinned shared CI template validates Bazel targets.
• Updated both .github/workflows/ci.yml and .github/workflows/publish.yml to include //:package_consumer_check in bazel_targets.
• Updated release metadata checks and docs so the workflow target list cannot drift silently.
• Verified the Bazel action log reports the consumer check passing against the sandboxed Bazel package directory.
• Validation passed: pnpm run check:release-metadata, direct bazel build //:package_consumer_check, full CI-shaped bazel build //:pkg //:package_consumer_check //:typecheck //:test, pnpm run check:package-consumer, check, test, publint, npm pack/publish dry-runs, browser motion probe, and git diff --check.

[Jesssullivan]

Lockfile consistency check:

• Confirmed the active Bazel graph follows the updated pnpm lock for PostCSS (postcss@8.5.12).
• bazel mod deps --lockfile_mode=update produced no lockfile change, so MODULE.bazel.lock is stable for the current Bzlmod/module extension setup.
• Stale output-base directories for prior npm resolutions may remain locally, but deps(//:tinyvectors_build) references the current package resolution.

[Jesssullivan]

CI truthing note from PR #39 at d0a0ffd:\n\n- Shared JS Bazel package workflow is green on hosted Actions.\n- GitHub emits a non-failing annotation that actions/upload-artifact@v4 and pnpm/action-setup@v4 run on Node 20.\n- GitHub says JavaScript actions default to Node 24 on June 2, 2026, and Node 20 is removed from the runner on September 16, 2026.\n\nNot a package/runtime blocker for this PR, but the follow-up likely belongs in tinyland-inc/ci-templates or this repo pinned shared-workflow SHA.