Sweep deps and cut 2.7.2

lefthook.yml

@@ -1,13 +1,28 @@
+# Hooks run the REPO'S OWN pinned tooling, never `bunx`.
+#
+# `bunx <tool>` resolves the tool independently of this project, so it can fetch
+# a different major and then fail, or pass, for reasons that have nothing to do
+# with the code being checked. That is not hypothetical here: this repo
+# deliberately holds eslint at 9 and TypeScript at 6 while 10 and 7 are
+# published, so `bunx eslint` and `bunx tsc` would pull exactly the majors the
+# manifest pins away from. `bunx` also writes to the lockfile as a side effect.
+#
+# A bare `tsc --noEmit` has a second problem: it judges the current source
+# against whatever build output is lying around, so it must go through the
+# pinned `typecheck` script the way CI invokes it.
+#
+# CI already runs the package scripts, so the hooks are the only place that can
+# drift away from them.
 pre-commit:
   parallel: true
   commands:
     eslint:
       glob: "**/*.{ts,tsx,mjs}"
-      run: bunx eslint --max-warnings 0 {staged_files}
+      run: ./node_modules/.bin/eslint --max-warnings 0 {staged_files}
 
 pre-push:
   commands:
     typecheck:
-      run: bunx tsc --noEmit
+      run: bun run typecheck
     knip:
       run: bun run knip

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/sdk",
-  "version": "2.7.1",
+  "version": "2.7.2",
   "description": "TypeScript client for the AgentScore APIs",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -60,14 +60,14 @@
     "eslint": "^9.39.5",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-unused-imports": "^4.4.1",
-    "knip": "^6.29.0",
+    "knip": "^6.31.0",
     "lefthook": "^2.1.10",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.65.0",
     "vitest": "^4.1.10"
   },
-  "packageManager": "bun@1.3.13",
+  "packageManager": "bun@1.3.14",
   "overrides": {
     "esbuild": "^0.28.1"
   }