chore: convert lint-staged config to TypeScript

.github/workflows/ci.yml

@@ -17,7 +17,8 @@ jobs:
     # The local commit-msg hook (.husky/commit-msg) can be bypassed -- a merge via the GitHub web UI, a commit from a tool that doesn't run hooks. This checks every commit on a pull request against the same rules. Nothing to check on a plain push to main: those commits already passed this exact job on their pull request.
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    # 5 has been observed too tight: npm ci installing this repository's ~500 packages has intermittently taken most of 5 minutes on GitHub's shared runners even with a warm actions/setup-node cache, independent of which Node version is in use -- every job below that runs npm ci gets the same headroom.
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
@@ -54,7 +55,7 @@ jobs:
   typecheck:
     name: Typecheck
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
@@ -69,7 +70,7 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
@@ -84,7 +85,7 @@ jobs:
   format:
     name: Format
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:

lint-staged.config.ts

@@ -0,0 +1,15 @@
+// lint-staged loads a TypeScript config via dynamic import of the raw file, relying on Node's native type-stripping. That's enabled by default from v23.6.0 onward, and Node backported the same default-enable to the 22.x LTS line at v22.18.0 (https://nodejs.org/en/blog/release/v22.18.0) -- so this can be a real .ts file like the repository's other *.config.ts files instead of needing a plain-JS carve-out. The "engines" field in package.json pins the 22.x floor higher than that, at v22.22.1: not the type-stripping requirement itself, but lint-staged's own declared minimum, which is the binding constraint for this file to load at all.
+
+// eslint.config.ts excludes package-lock.json from lint entirely (generated, not hand-maintained); the `!(package-lock).json` glob below applies the same exclusion to prettier, which has no ignores option of its own here.
+import { defineConfig } from "lint-staged/config";
+
+export default defineConfig({
+  "*.{ts,md}": [
+    "eslint --fix --cache --cache-location node_modules/.cache/eslint/.eslintcache",
+    "prettier --write --cache",
+  ],
+  "*.json":
+    "eslint --fix --cache --cache-location node_modules/.cache/eslint/.eslintcache",
+  "!(package-lock).json": "prettier --write --cache",
+  "*.{yml,yaml}": "prettier --write --cache",
+});

package.json

@@ -4,6 +4,9 @@
   "private": true,
   "type": "module",
   "packageManager": "npm@11.19.0",
+  "engines": {
+    "node": ">=22.22.1 <23.0.0 || >=23.6.0"
+  },
   "description": "Runs Claude Code for pull-request review, issue triage, or interactive @claude assistance, with shared org-wide prompts and per-mode tool allowlists.",
   "scripts": {
     "prepare": "husky",