chore: update ultracite to 7.4.3, fix lint-staged for Next.js paths

- Update ultracite 7.3.2 → 7.4.3 (fixes parentheses/brackets in paths)
- Remove workaround for square bracket paths in lint-staged
- Add JSDoc type annotations to lint-staged config to fix type-safety lint errors
- All 34 pre-existing typescript-eslint errors in lint-staged.config.mjs resolved

Author: kzndotsh

apps/portal/next.config.ts

@@ -19,7 +19,7 @@ function getAppVersion(): string {
   }
   try {
     const pkg = JSON.parse(
-      readFileSync(join(process.cwd(), "package.json"), "utf8")
+      readFileSync(join(process.cwd(), "package.json"), "utf-8")
     );
     const ver = pkg.version as string | undefined;
     if (ver) {
@@ -30,7 +30,7 @@ function getAppVersion(): string {
   }
   try {
     const result = execSync("git describe --tags --always", {
-      encoding: "utf8",
+      encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
     }).trim();
     if (result) {
@@ -135,7 +135,7 @@ let nextConfig: NextConfig = {
     // Try to get git commit hash directly
     try {
       const gitHash = execSync("git rev-parse --short HEAD", {
-        encoding: "utf8",
+        encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"],
       }).trim();
 

apps/portal/package.json

@@ -128,7 +128,7 @@
     "tsx": "^4.21.0",
     "turbo": "^2.8.20",
     "typescript": "catalog:",
-    "ultracite": "7.3.2",
+    "ultracite": "7.4.3",
     "vitest": "^4.1.1"
   },
   "engines": {

apps/portal/tests/monorepo/monorepo-correctness.test.ts

@@ -48,7 +48,7 @@ function getLibraryPackageDirs(): string[] {
 /** Read and parse a package's package.json */
 function readPackageJson(pkgDir: string): Record<string, unknown> {
   const filePath = path.join(PACKAGES_DIR, pkgDir, "package.json");
-  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  return JSON.parse(fs.readFileSync(filePath, "utf-8"));
 }
 
 /** Recursively collect all .ts/.tsx files under a directory */
@@ -254,7 +254,7 @@ describe("Property 2: No stale imports remain", () => {
     const violations: { file: string; line: string; pattern: string }[] = [];
 
     for (const file of sourceFiles) {
-      const content = fs.readFileSync(file, "utf8");
+      const content = fs.readFileSync(file, "utf-8");
       const lines = content.split("\n");
 
       for (const line of lines) {
@@ -286,7 +286,7 @@ describe("Property 2: No stale imports remain", () => {
 
     assert(
       property(constantFrom(...sourceFiles), (file) => {
-        const content = fs.readFileSync(file, "utf8");
+        const content = fs.readFileSync(file, "utf-8");
         return STALE_PATTERNS.every((p) => !p.test(content));
       }),
       { numRuns: Math.min(sourceFiles.length, 100) }
@@ -347,7 +347,7 @@ describe("Property 3: Package boundary enforcement", () => {
     const violations: { pkg: string; file: string; line: string }[] = [];
 
     for (const { pkgDir, file } of files) {
-      const content = fs.readFileSync(file, "utf8");
+      const content = fs.readFileSync(file, "utf-8");
       const lines = content.split("\n");
       for (const line of lines) {
         if (/(?:from|import)\s+["']@\//.test(line)) {
@@ -373,7 +373,7 @@ describe("Property 3: Package boundary enforcement", () => {
     const violations: { pkg: string; file: string; line: string }[] = [];
 
     for (const { pkgDir, file } of files) {
-      const content = fs.readFileSync(file, "utf8");
+      const content = fs.readFileSync(file, "utf-8");
       const imports = extractImports(content);
       for (const imp of imports) {
         if (imp.startsWith("../") || imp.startsWith("../../")) {
@@ -406,7 +406,7 @@ describe("Property 3: Package boundary enforcement", () => {
 
     assert(
       property(constantFrom(...files), ({ pkgDir, file }) => {
-        const content = fs.readFileSync(file, "utf8");
+        const content = fs.readFileSync(file, "utf-8");
         if (/(?:from|import)\s+["']@\//.test(content)) {
           return false;
         }
@@ -440,7 +440,7 @@ describe("Property 3: Package boundary enforcement", () => {
 describe("Property 8: Environment variable completeness", () => {
   /** Extract env var names from a keys.ts file's runtimeEnv block */
   function extractEnvVarsFromKeysFile(filePath: string): string[] {
-    const content = fs.readFileSync(filePath, "utf8");
+    const content = fs.readFileSync(filePath, "utf-8");
     const vars: string[] = [];
     const processEnvRegex = /process\.env\.([A-Z_][A-Z0-9_]*)/g;
     let match: RegExpExecArray | null;
@@ -467,7 +467,7 @@ describe("Property 8: Environment variable completeness", () => {
   /** Get all declared env vars from turbo.json (all task env + globalEnv) */
   function getTurboEnvVars(): { exact: Set<string>; wildcards: string[] } {
     const turboJson = JSON.parse(
-      fs.readFileSync(MONOREPO_TURBO_JSON_PATH, "utf8")
+      fs.readFileSync(MONOREPO_TURBO_JSON_PATH, "utf-8")
     );
     const exact = new Set<string>();
     const wildcards: string[] = [];
@@ -611,7 +611,7 @@ describe("Property 9: No direct process.env access in packages", () => {
           continue;
         }
 
-        const content = fs.readFileSync(file, "utf8");
+        const content = fs.readFileSync(file, "utf-8");
         const strippedContent = stripComments(content);
         const lines = strippedContent.split("\n");
         for (let i = 0; i < lines.length; i += 1) {
@@ -657,7 +657,7 @@ describe("Property 9: No direct process.env access in packages", () => {
 
     assert(
       property(constantFrom(...nonKeysFiles), (file) => {
-        const content = fs.readFileSync(file, "utf8");
+        const content = fs.readFileSync(file, "utf-8");
         const stripped = stripComments(content);
         const lines = stripped.split("\n");
         return lines.every((line) => !hasRealProcessEnvAccess(line));
@@ -699,7 +699,7 @@ describe("Property 10: Import path correctness", () => {
     const violations: { file: string; importPath: string }[] = [];
 
     for (const file of sourceFiles) {
-      const content = fs.readFileSync(file, "utf8");
+      const content = fs.readFileSync(file, "utf-8");
       const imports = extractImports(content);
 
       for (const imp of imports) {
@@ -739,7 +739,7 @@ describe("Property 10: Import path correctness", () => {
 
     assert(
       property(constantFrom(...sourceFiles), (file) => {
-        const content = fs.readFileSync(file, "utf8");
+        const content = fs.readFileSync(file, "utf-8");
         const imports = extractImports(content);
         for (const imp of imports) {
           const isPortal = imp.startsWith("@portal/");
@@ -787,7 +787,7 @@ describe("Property 11: App-internal alias preservation", () => {
     let foundAppInternalImports = false;
 
     for (const file of appFiles) {
-      const content = fs.readFileSync(file, "utf8");
+      const content = fs.readFileSync(file, "utf-8");
       const imports = extractImports(content);
 
       for (const imp of imports) {
@@ -812,7 +812,7 @@ describe("Property 11: App-internal alias preservation", () => {
 
     assert(
       property(constantFrom(...appFiles), (file) => {
-        const content = fs.readFileSync(file, "utf8");
+        const content = fs.readFileSync(file, "utf-8");
         const imports = extractImports(content);
         for (const imp of imports) {
           for (const pattern of APP_INTERNAL_PATTERNS) {
@@ -924,7 +924,7 @@ describe("Property 14: Package dependency completeness", () => {
       // dependencies since they resolve through the app's bundler
       if (PACKAGES_WITH_APP_IMPORTS.has(pkgDir)) {
         const appPkgPath = path.join(ROOT_DIR, "package.json");
-        const appPkg = JSON.parse(fs.readFileSync(appPkgPath, "utf8"));
+        const appPkg = JSON.parse(fs.readFileSync(appPkgPath, "utf-8"));
         for (const dep of Object.keys(
           (appPkg.dependencies ?? {}) as Record<string, string>
         )) {
@@ -942,7 +942,7 @@ describe("Property 14: Package dependency completeness", () => {
       const undeclared: { file: string; importPkg: string }[] = [];
 
       for (const file of files) {
-        const content = fs.readFileSync(file, "utf8");
+        const content = fs.readFileSync(file, "utf-8");
         // Use strict imports (ES only) to skip optional require() in try/catch
         const imports = extractStrictImports(content);
 

apps/portal/tests/monorepo/package-structure.test.ts

@@ -26,7 +26,7 @@ function getPackageDirs(): string[] {
 /** Read and parse a package's package.json */
 function readPackageJson(pkgDir: string): Record<string, unknown> {
   const filePath = path.join(PACKAGES_DIR, pkgDir, "package.json");
-  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  return JSON.parse(fs.readFileSync(filePath, "utf-8"));
 }
 
 /** Non-config packages that should follow the standard library pattern */
@@ -121,7 +121,7 @@ describe("Property 6: TypeScript config inheritance (extends library.json)", ()
         `tsconfig.json should exist in packages/${pkgDir}`
       ).toBe(true);
 
-      const tsconfig = JSON.parse(fs.readFileSync(tsconfigPath, "utf8"));
+      const tsconfig = JSON.parse(fs.readFileSync(tsconfigPath, "utf-8"));
       expect(tsconfig.extends).toBe("@portal/typescript-config/library.json");
     }
   );

apps/web/scripts/generate-code-of-conduct.mjs

@@ -48,7 +48,7 @@ let lastUpdated;
 
 try {
   // Read and process the README.md content
-  readmeContent = processMarkdownContent(fs.readFileSync(readmePath, "utf8"));
+  readmeContent = processMarkdownContent(fs.readFileSync(readmePath, "utf-8"));
 
   // Get the last updated date
   const gitCommand = `git -C ${path.join(

apps/web/src/lib/integrations/quickbooks.ts

@@ -1006,7 +1006,7 @@ function updateLocalEnvFiles(tokens: {
     // Update .env.local (for Next.js dev on port 3000)
     if (existsSync(envLocalPath)) {
       try {
-        const content = readFileSync(envLocalPath, "utf8");
+        const content = readFileSync(envLocalPath, "utf-8");
         const lines = content.split("\n");
         const updatedLines = lines.map((line) => {
           if (line.startsWith("QUICKBOOKS_REFRESH_TOKEN=")) {
@@ -1033,7 +1033,7 @@ function updateLocalEnvFiles(tokens: {
           updatedLines.push(`QUICKBOOKS_REALM_ID=${tokens.realmId}`);
         }
 
-        writeFileSync(envLocalPath, updatedLines.join("\n"), "utf8");
+        writeFileSync(envLocalPath, updatedLines.join("\n"), "utf-8");
         updatedAny = true;
         console.log("[QuickBooks] ✅ Updated .env.local");
       } catch (error) {
@@ -1044,7 +1044,7 @@ function updateLocalEnvFiles(tokens: {
     // Update .dev.vars (for Wrangler dev on port 8787)
     if (existsSync(devVarsPath)) {
       try {
-        const content = readFileSync(devVarsPath, "utf8");
+        const content = readFileSync(devVarsPath, "utf-8");
         const lines = content.split("\n");
         const updatedLines = lines.map((line) => {
           if (line.startsWith("QUICKBOOKS_REFRESH_TOKEN=")) {
@@ -1071,7 +1071,7 @@ function updateLocalEnvFiles(tokens: {
           updatedLines.push(`QUICKBOOKS_REALM_ID=${tokens.realmId}`);
         }
 
-        writeFileSync(devVarsPath, updatedLines.join("\n"), "utf8");
+        writeFileSync(devVarsPath, updatedLines.join("\n"), "utf-8");
         updatedAny = true;
         console.log("[QuickBooks] ✅ Updated .dev.vars");
       } catch (error) {

lint-staged.config.mjs

@@ -8,6 +8,7 @@
  * behaviour matches `pnpm lint`.
  */
 
+/** @type {string[]} */
 const ULTRACITE_IGNORE_PREFIXES = [
   "apps/portal/references/",
   "apps/portal/drizzle/",
@@ -18,7 +19,11 @@ const ULTRACITE_IGNORE_PREFIXES = [
   "references/",
 ];
 
-/** Normalise a path and strip the cwd prefix to get a repo-relative path. */
+/**
+ * Normalise a path and strip the cwd prefix to get a repo-relative path.
+ * @param {string} file Absolute file path
+ * @returns {string} Repo-relative path
+ */
 function toRelative(file) {
   const normalised = file.replaceAll("\\", "/");
   const cwd = process.cwd().replaceAll("\\", "/");
@@ -27,27 +32,27 @@ function toRelative(file) {
     : normalised;
 }
 
-/** Return true if the file should be skipped by ultracite. */
+/**
+ * Return true if the file should be skipped by ultracite.
+ * @param {string} file Absolute file path
+ * @returns {boolean} Whether the file should be skipped
+ */
 function isUltraciteIgnored(file) {
   const rel = toRelative(file);
-  // Skip files with square brackets — ultracite/oxlint treats them as glob patterns
-  if (/[[\]]/.test(rel)) {
-    return true;
-  }
   return ULTRACITE_IGNORE_PREFIXES.some(
     (prefix) => rel.startsWith(prefix) || rel.includes(`/${prefix}`)
   );
 }
 
 export default {
   // Python — ruff check + format (uv handles its own path resolution)
-  "*.py": (files) => {
+  "*.py": (/** @type {string[]} */ files) => {
     const args = files.map((f) => JSON.stringify(toRelative(f))).join(" ");
     return [`uv run ruff check --fix ${args}`, `uv run ruff format ${args}`];
   },
 
   // Shell — shellcheck + shfmt
-  "*.sh": (files) => {
+  "*.sh": (/** @type {string[]} */ files) => {
     const args = files.map((f) => JSON.stringify(toRelative(f))).join(" ");
     return [
       `shellcheck ${args}`,
@@ -60,33 +65,12 @@ export default {
 
   // JS/TS/JSON/CSS/MD — run ultracite fix (oxfmt + oxlint) on relative paths
   "*.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,css,md,mdx,html,graphql,yaml,yml,toml}":
-    (files) => {
+    (/** @type {string[]} */ files) => {
       const filtered = files.filter((f) => !isUltraciteIgnored(f));
       if (filtered.length === 0) {
         return [];
       }
-
-      // Ultracite can't handle parentheses in paths (e.g. Next.js route groups).
-      // Split into files ultracite can handle vs ones needing direct oxfmt+oxlint.
-      const hasParens = (f) => /[()]/.test(toRelative(f));
-      const normal = filtered.filter((f) => !hasParens(f));
-      const parenFiles = filtered.filter((f) => hasParens(f));
-
-      const cmds = [];
-
-      if (normal.length > 0) {
-        const args = normal.map((f) => JSON.stringify(toRelative(f))).join(" ");
-        cmds.push(`pnpm exec ultracite fix ${args}`);
-      }
-
-      if (parenFiles.length > 0) {
-        const args = parenFiles
-          .map((f) => JSON.stringify(toRelative(f)))
-          .join(" ");
-        cmds.push(`pnpm exec oxfmt ${args}`);
-        cmds.push(`pnpm exec oxlint --fix ${args}`);
-      }
-
-      return cmds;
+      const args = filtered.map((f) => JSON.stringify(toRelative(f))).join(" ");
+      return `pnpm exec ultracite fix ${args}`;
     },
 };

package.json

@@ -39,7 +39,7 @@
     "oxlint-tsgolint": "^0.17.2",
     "turbo": "^2.8.20",
     "typescript": "catalog:",
-    "ultracite": "7.3.2"
+    "ultracite": "7.4.3"
   },
   "engines": {
     "node": ">=24.0.0",

packages/fibery/vitest.config.ts

@@ -6,7 +6,7 @@ import { defineConfig } from "vitest/config";
 function loadEnv(dir: string): Record<string, string> {
   const env: Record<string, string> = {};
   try {
-    const contents = readFileSync(resolve(dir, ".env"), "utf8");
+    const contents = readFileSync(resolve(dir, ".env"), "utf-8");
     for (const line of contents.split("\n")) {
       const eqIdx = line.indexOf("=");
       if (eqIdx === -1) {