chore: add oxlint + oxfmt, upgrade TypeScript to 7, move installs to bun

.github/workflows/ci.yml

@@ -13,6 +13,26 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  lint:
+    name: Lint and format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+
+      - run: bun install --frozen-lockfile
+
+      - run: bun run lint
+
+      # package.json and wrangler.jsonc are deliberately excluded in
+      # .prettierignore — read the comment there before adding them back.
+      - run: bun run format:check
+
   check:
     name: Typecheck, test, manifest freshness
     runs-on: ubuntu-latest
@@ -21,20 +41,39 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          node-version: 24
-          cache: npm
+          bun-version: 1.3.14
 
-      - run: npm ci
+      - run: bun install --frozen-lockfile
 
       # Deliberately from a clean checkout, before any build step — the
       # committed composition-manifest.json must be enough for tsc to pass.
-      - run: npm run typecheck
+      - run: bun run typecheck
 
-      - run: npm test
+      # `bun run test` (vitest), not `bun test` — the latter would silently
+      # swap in bun's own runner and skip the vitest suite.
+      - run: bun run test
 
       # The manifest is committed but regenerated by prepare-assets; fail if
       # a composition change landed without its manifest diff.
-      - run: npm run prepare-assets
+      - run: bun run prepare-assets
       - run: git diff --exit-code src/composition-manifest.json
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+
+      - run: bun install --frozen-lockfile
+
+      # The path a template user actually hits on deploy. Nothing else in CI
+      # exercises the vite client + SSR build.
+      - run: bun run build

.oxlintrc.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
+  "categories": {
+    "correctness": "error"
+  },
+  "plugins": ["react", "typescript"],
+  "ignorePatterns": [
+    "node_modules/",
+    "dist/",
+    ".output/",
+    ".nitro/",
+    ".tanstack/",
+    ".wrangler/",
+    "public/_bundled/",
+    "public/_hyperframes/",
+    "src/routeTree.gen.ts",
+    "worker-configuration.d.ts"
+  ]
+}

.prettierignore

@@ -0,0 +1,42 @@
+# oxfmt reads .prettierignore for its ignore list.
+
+# Generated by `wrangler types` — regenerated, never hand-edited.
+worker-configuration.d.ts
+
+# Generated by TanStack Router — regenerated on dev/build.
+src/routeTree.gen.ts
+
+# Generated by scripts/build.mjs (prepare-assets). Committed so a clean
+# checkout typechecks, but not hand-authored.
+src/composition-manifest.json
+
+# Build output.
+dist/
+.output/
+.nitro/
+.tanstack/
+.wrangler/
+public/_bundled/
+public/_hyperframes/
+
+# Lockfile.
+bun.lock
+
+# Cloudflare deploy-button inputs — DO NOT FORMAT.
+#
+# The "Deploy to Cloudflare" button parses both of these, and its parser is
+# demonstrably strict: an empty "preview_image_url": "" in package.json's
+# `cloudflare` block broke the button and surfaced as a misleading "problem
+# parsing the Wrangler configuration file" (fixed in #9, upstream
+# cloudflare/workers-sdk#14831).
+#
+# oxfmt wants to reorder package.json's top-level keys (it relocates the whole
+# `cloudflare` block below `engines`) and to add trailing commas throughout
+# wrangler.jsonc. Both are cosmetic-only for a spec-compliant parser and buy us
+# nothing, but they rewrite the exact bytes that parser reads. Not worth the
+# risk of re-breaking the button for zero benefit.
+package.json
+wrangler.jsonc
+
+# Vendored composition assets shipped verbatim with the template.
+public/compositions/

README.md

@@ -76,11 +76,23 @@ With 4 vCPUs, `hyperframes render --workers auto` launches 3 parallel Chrome wor
 ## Local development
 
 ```bash
-npm install
-npm run dev
+bun install
+bun run dev
 ```
 
-`npm run dev` regenerates the composition manifest/preview bundle (`scripts/build.mjs`) and starts Vite on port 3000. The [Cloudflare Vite plugin](https://developers.cloudflare.com/workers/vite-plugin/) runs the Worker runtime locally, including building + running the render container against your local Docker daemon (Docker is required for local container dev). The browser preview works without Docker; only `/api/render` needs the container.
+`bun run dev` regenerates the composition manifest/preview bundle (`scripts/build.mjs`) and starts Vite on port 3000. The [Cloudflare Vite plugin](https://developers.cloudflare.com/workers/vite-plugin/) runs the Worker runtime locally, including building + running the render container against your local Docker daemon (Docker is required for local container dev). The browser preview works without Docker; only `/api/render` needs the container.
+
+### Checks
+
+```bash
+bun run typecheck   # tsc --noEmit
+bun run test        # vitest
+bun run lint        # oxlint
+bun run format      # oxfmt (use format:check in CI)
+```
+
+CI runs all of these plus a production build. `package.json` and `wrangler.jsonc`
+are excluded from the formatter on purpose — see the note in `.prettierignore`.
 
 ### Testing the render container in isolation
 
@@ -140,11 +152,11 @@ wrangler.jsonc                # Worker + Container + R2 bindings (main: src/serv
 1. Drop your composition bundle into `public/compositions/<your-name>/`.
 2. Set `PREVIEW_COMPOSITION_DIR` env var when running build/deploy:
    ```bash
-   PREVIEW_COMPOSITION_DIR=compositions/<your-name> npm run deploy
+   PREVIEW_COMPOSITION_DIR=compositions/<your-name> bun run deploy
    ```
    Or edit the default in `scripts/build.mjs` (line 9).
 3. Optionally update the player dimensions in `src/components/Player.tsx` if your composition isn't 1920×1080.
-4. Re-run `npm run dev` or `npm run deploy` — `scripts/build.mjs` regenerates the manifest and bundle.
+4. Re-run `bun run dev` or `bun run deploy` — `scripts/build.mjs` regenerates the manifest and bundle.
 
 ## AI generation (BYOK)