@commversion/libs 0.18.2 → 0.18.3

package/global.d.ts

@@ -0,0 +1,320 @@
+type AttributionChannel = "whatsapp" | "sms" | "facebook";
+
+interface ChannelWidgetConfig {
+	readonly type: AttributionChannel;
+	readonly number?: string;
+	readonly mobile?: { readonly enabled?: boolean };
+	readonly desktop?: { readonly enabled?: boolean };
+	readonly popover?:
+		| boolean
+		| {
+				readonly enabled?: boolean;
+				readonly title?: string;
+				readonly description?: string;
+				readonly buttonLabel?: string;
+		  };
+}
+
+interface ChannelWidgetsConfig {
+	readonly chatWidgetSelector?: string;
+	readonly channels?: readonly ChannelWidgetConfig[];
+	readonly mobile?: { readonly gap?: string; readonly gapBelow?: string };
+	readonly desktop?: { readonly gap?: string; readonly gapBelow?: string };
+}
+
+interface ChannelMessageConfig {
+	readonly defaultMessage?: string;
+	readonly buttonMessages?: Readonly<Record<string, string>>;
+}
+
+interface CommversionConfiguration {
+	readonly clientId: string;
+	readonly attributionUrl?: string;
+	readonly exitIntentDebounceMs?: number;
+	readonly exitIntentMargin?: number;
+	readonly formAbandonmentSelector?: string;
+	readonly formAbandonmentDelay?: number;
+	readonly formSubmissionSelector?: string;
+	readonly channelWidgetsConfig?: ChannelWidgetsConfig;
+	readonly whatsappConfig?: ChannelMessageConfig;
+	readonly smsConfig?: ChannelMessageConfig;
+	readonly facebookConfig?: ChannelMessageConfig;
+}
+
+namespace LiveChat {
+	export type Availability = "online" | "offline";
+
+	export type Visibility = "maximized" | "minimized" | "hidden";
+
+	export type CustomerStatus = "queued" | "chatting" | "invited" | "browsing";
+
+	export type AuthorType = "customer" | "agent";
+
+	export type NewEventType = "message" | "rich_message" | "file";
+
+	export type FormSubmittedType = "prechat" | "postchat" | "ticket";
+
+	export type Rating = "good" | "bad" | "none";
+
+	export type SessionVariables = Record<string, string>;
+
+	export interface WidgetState {
+		readonly availability: Availability;
+		readonly visibility: Visibility;
+	}
+
+	export interface CustomerData {
+		readonly id: string;
+		readonly name: string | null;
+		readonly email: string | null;
+		readonly isReturning: boolean;
+		readonly status: CustomerStatus;
+		readonly sessionVariables: SessionVariables;
+	}
+
+	export interface ChatData {
+		readonly chatId: string;
+		readonly threadId: string;
+	}
+
+	export interface Author {
+		readonly id: string;
+		readonly type: AuthorType;
+	}
+
+	export interface Greeting {
+		readonly id: number;
+		readonly uniqueId: string;
+	}
+
+	export interface ReadyData {
+		readonly state: WidgetState;
+		readonly customerData: CustomerData;
+	}
+
+	export interface AvailabilityChangedData {
+		readonly availability: Availability;
+	}
+
+	export interface VisibilityChangedData {
+		readonly visibility: Visibility;
+	}
+
+	export interface CustomerStatusChangedData {
+		readonly status: CustomerStatus;
+	}
+
+	export interface NewEventData {
+		readonly timestamp: number;
+		readonly type: NewEventType;
+		readonly author: Author;
+		readonly greeting?: Greeting;
+	}
+
+	export interface FormSubmittedData {
+		readonly type: FormSubmittedType;
+	}
+
+	export interface RichMessageButtonClickedData {
+		readonly eventId: string;
+		readonly postbackId: string;
+		readonly greeting?: Greeting;
+	}
+
+	export interface MaximizeOptions {
+		readonly messageDraft: string;
+	}
+
+	export interface SalesTrackerData {
+		readonly trackerId: string;
+		readonly orderPrice?: string;
+		readonly orderId?: string;
+	}
+
+	export interface Widget {
+		on(event: "ready", handler: (data: ReadyData) => void): void;
+		on(event: "availability_changed", handler: (data: AvailabilityChangedData) => void): void;
+		on(event: "visibility_changed", handler: (data: VisibilityChangedData) => void): void;
+		on(event: "customer_status_changed", handler: (data: CustomerStatusChangedData) => void): void;
+		on(event: "new_event", handler: (data: NewEventData) => void): void;
+		on(event: "form_submitted", handler: (data: FormSubmittedData) => void): void;
+		on(event: "rating_submitted", handler: (rating: Rating) => void): void;
+		on(event: "greeting_displayed", handler: (greeting: Greeting) => void): void;
+		on(event: "greeting_hidden", handler: (greeting: Greeting) => void): void;
+		on(
+			event: "rich_message_button_clicked",
+			handler: (data: RichMessageButtonClickedData) => void,
+		): void;
+
+		once(event: "ready", handler: (data: ReadyData) => void): void;
+		once(event: "availability_changed", handler: (data: AvailabilityChangedData) => void): void;
+		once(event: "visibility_changed", handler: (data: VisibilityChangedData) => void): void;
+		once(
+			event: "customer_status_changed",
+			handler: (data: CustomerStatusChangedData) => void,
+		): void;
+		once(event: "new_event", handler: (data: NewEventData) => void): void;
+		once(event: "form_submitted", handler: (data: FormSubmittedData) => void): void;
+		once(event: "rating_submitted", handler: (rating: Rating) => void): void;
+		once(event: "greeting_displayed", handler: (greeting: Greeting) => void): void;
+		once(event: "greeting_hidden", handler: (greeting: Greeting) => void): void;
+		once(
+			event: "rich_message_button_clicked",
+			handler: (data: RichMessageButtonClickedData) => void,
+		): void;
+
+		off(event: "ready", handler: (data: ReadyData) => void): void;
+		off(event: "availability_changed", handler: (data: AvailabilityChangedData) => void): void;
+		off(event: "visibility_changed", handler: (data: VisibilityChangedData) => void): void;
+		off(event: "customer_status_changed", handler: (data: CustomerStatusChangedData) => void): void;
+		off(event: "new_event", handler: (data: NewEventData) => void): void;
+		off(event: "form_submitted", handler: (data: FormSubmittedData) => void): void;
+		off(event: "rating_submitted", handler: (rating: Rating) => void): void;
+		off(event: "greeting_displayed", handler: (greeting: Greeting) => void): void;
+		off(event: "greeting_hidden", handler: (greeting: Greeting) => void): void;
+		off(
+			event: "rich_message_button_clicked",
+			handler: (data: RichMessageButtonClickedData) => void,
+		): void;
+
+		call(method: "maximize", options?: MaximizeOptions): void;
+		call(method: "minimize"): void;
+		call(method: "hide"): void;
+		call(method: "destroy"): void;
+		call(method: "hide_greeting"): void;
+		call(method: "trigger_sales_tracker", data: SalesTrackerData): void;
+		call(method: "set_session_variables", sessionVariables: SessionVariables): void;
+		call(method: "update_session_variables", sessionVariables: SessionVariables): void;
+		call(method: "set_customer_name", name: string): void;
+		call(method: "set_customer_email", email: string): void;
+
+		get(data: "state"): WidgetState;
+		get(data: "customer_data"): CustomerData;
+		get(data: "chat_data"): ChatData;
+	}
+}
+
+interface JQuery {}
+
+namespace SegmentAnalytics {
+	export interface SegmentOpts {
+		integrations?: any;
+		anonymousId?: string | undefined;
+		context?: object | undefined;
+	}
+
+	export interface CookieOptions {
+		maxage?: number | undefined;
+		domain?: string | undefined;
+		path?: string | undefined;
+		secure?: boolean | undefined;
+	}
+
+	export interface MetricsOptions {
+		host?: string | undefined;
+		sampleRate?: number | undefined;
+		flushTimer?: number | undefined;
+		maxQueueSize?: number | undefined;
+	}
+
+	export interface StoreOptions {
+		enabled?: boolean | undefined;
+	}
+
+	export interface UserOptions {
+		cookie?: { key: string; oldKey: string } | undefined;
+		localStorage?: { key: string } | undefined;
+		persist?: boolean | undefined;
+	}
+
+	export interface GroupOptions {
+		cookie?: { key: string } | undefined;
+		localStorage?: { key: string } | undefined;
+		persist?: boolean | undefined;
+	}
+
+	export interface InitOptions {
+		cookie?: CookieOptions | undefined;
+		metrics?: MetricsOptions | undefined;
+		localStorage?: StoreOptions | undefined;
+		user?: UserOptions | undefined;
+		group?: GroupOptions | undefined;
+		integrations?:
+			| { All?: boolean | undefined; [integration: string]: boolean | undefined }
+			| undefined;
+	}
+
+	export interface IntegrationsSettings {
+		[key: string]: any;
+	}
+
+	export interface AnalyticsJS {
+		use(plugin: (analytics: AnalyticsJS) => void): this;
+		init(settings?: IntegrationsSettings, options?: InitOptions): this;
+		addIntegration(integration: (options: any) => void): this;
+		setAnonymousId(id: string): this;
+		load(writeKey: string): void;
+		load(writeKey: string, options?: SegmentOpts): void;
+		identify(userId: string, traits?: Object, options?: SegmentOpts, callback?: () => void): void;
+		identify(userId: string, traits: Object, callback?: () => void): void;
+		identify(userId: string, callback?: () => void): void;
+		identify(traits?: Object, options?: SegmentOpts, callback?: () => void): void;
+		identify(traits?: Object, callback?: () => void): void;
+		identify(callback: () => void): void;
+		track(event: string, properties?: Object, options?: SegmentOpts, callback?: () => void): void;
+		track(event: string, properties?: Object, callback?: () => void): void;
+		track(event: string, callback?: () => void): void;
+		page(
+			category?: string,
+			name?: string,
+			properties?: Object,
+			options?: SegmentOpts,
+			callback?: () => void,
+		): void;
+		page(name?: string, properties?: Object, options?: SegmentOpts, callback?: () => void): void;
+		page(name?: string, properties?: Object, callback?: () => void): void;
+		page(name?: string, callback?: () => void): void;
+		page(properties?: Object, options?: SegmentOpts, callback?: () => void): void;
+		page(callback?: () => void): void;
+		group(groupId: string, traits?: Object, options?: SegmentOpts, callback?: () => void): void;
+		group(groupId: string, traits?: Object, callback?: () => void): void;
+		group(groupId: string, callback?: () => void): void;
+		alias(userId: string, previousId?: string, options?: SegmentOpts, callback?: () => void): void;
+		alias(userId: string, previousId?: string, callback?: () => void): void;
+		alias(userId: string, callback?: () => void): void;
+		alias(userId: string, options?: SegmentOpts, callback?: () => void): void;
+		trackLink(
+			elements: JQuery | Element[] | Element,
+			event: string | { (elm: Element): string },
+			properties?: Object | { (elm: Element): Object },
+		): void;
+		trackForm(
+			elements: JQuery | Element[] | Element,
+			event: string | { (elm: Element): string },
+			properties?: Object | { (elm: Element): Object },
+		): void;
+		ready(callback: () => void): void;
+		reset(): void;
+		user(): {
+			id(newId?: string | null): string | null | undefined;
+			logout(): void;
+			reset(): void;
+			anonymousId(newId?: string): string;
+			traits(newTraits?: Object): void;
+		};
+		group(): { id(): string; traits(newTraits?: Object): void };
+		debug(state?: boolean): void;
+		on(
+			event: string,
+			callback: { (event: string, properties: Object, options: SegmentOpts): void },
+		): void;
+		timeout(milliseconds: number): void;
+	}
+}
+
+interface Window {
+	commversion: CommversionConfiguration;
+	readonly LiveChatWidget: LiveChat.Widget;
+	readonly gaGlobal?: { vid?: string };
+	readonly analytics?: SegmentAnalytics.AnalyticsJS;
+}

package/package.json

@@ -1,89 +1,114 @@
 {
-  "name": "@commversion/libs",
-  "version": "0.18.2",
-  "author": "Commversion",
-  "license": "UNLICENSED",
-  "scripts": {
-    "lint": "prettier -c .",
-    "lint:fix": "prettier --write .",
-    "test": "wtr ./scripts/**/*.test.js --node-resolve",
-    "prepack": "concurrently npm:build:*",
-    "release": "release-it",
-    "dev:lc-open-on-button-click": "vite serve scripts/lc-open-on-button-click/src/",
-    "build:lc-open-on-button-click": "vite build -c scripts/lc-open-on-button-click/vite.config.js",
-    "dev:lc-cookie-banner-update-position": "vite serve scripts/lc-cookie-banner-update-position/src/",
-    "build:lc-cookie-banner-update-position": "vite build -c scripts/lc-cookie-banner-update-position/vite.config.js",
-    "dev:lc-show-by-selector": "vite serve scripts/lc-show-by-selector/src/",
-    "build:lc-show-by-selector": "vite build -c scripts/lc-show-by-selector/vite.config.js",
-    "dev:lc-exit-intent-debounced": "vite serve scripts/lc-exit-intent-debounced/src/",
-    "build:lc-exit-intent-debounced": "vite build -c scripts/lc-exit-intent-debounced/vite.config.js",
-    "dev:lc-pause-on-url": "vite serve scripts/lc-pause-on-url/src/",
-    "build:lc-pause-on-url": "vite build -c scripts/lc-pause-on-url/vite.config.js",
-    "dev:lc-kill-chat-persist": "vite serve scripts/lc-kill-chat-persist/src/",
-    "build:lc-kill-chat-persist": "vite build -c scripts/lc-kill-chat-persist/vite.config.js",
-    "dev:lc-gclid": "vite serve scripts/lc-gclid/src/",
-    "build:lc-gclid": "vite build -c scripts/lc-gclid/vite.config.js",
-    "dev:lc-powered-by": "vite serve scripts/lc-powered-by/src/",
-    "preview:lc-powered-by": "npm run build:lc-powered-by && vite preview --host 0.0.0.0",
-    "build:lc-powered-by": "vite build -c scripts/lc-powered-by/vite.config.js",
-    "dev:lc-ga-initialize-event": "vite serve scripts/lc-ga-initialize-event/src/",
-    "build:lc-ga-initialize-event": "vite build -c scripts/lc-ga-initialize-event/vite.config.js",
-    "release:pre": "release-it --preRelease=pre",
-    "dev:lc-kill-chat": "vite serve scripts/lc-kill-chat/src/",
-    "build:lc-kill-chat": "vite build -c scripts/lc-kill-chat/vite.config.js",
-    "dev:lc-form-abandonment": "vite serve scripts/lc-form-abandonment/src/",
-    "build:lc-form-abandonment": "vite build -c scripts/lc-form-abandonment/vite.config.js",
-    "dev:lc-form-submission": "vite serve scripts/lc-form-submission/src/",
-    "build:lc-form-submission": "vite build -c scripts/lc-form-submission/vite.config.js",
-    "dev:lc-experiment": "vite serve scripts/lc-experiment/src/",
-    "build:lc-experiment": "vite build -c scripts/lc-experiment/vite.config.js",
-    "dev:lc-gtm": "vite serve scripts/lc-gtm/src/",
-    "build:lc-gtm": "vite build -c scripts/lc-gtm/vite.config.js",
-    "dev:lc-device": "vite serve scripts/lc-device/src/",
-    "build:lc-device": "vite build -c scripts/lc-device/vite.config.js",
-    "dev:lc-geoblocking": "vite serve scripts/lc-geoblocking/src/",
-    "build:lc-geoblocking": "vite build -c scripts/lc-geoblocking/vite.config.js",
-    "dev:lc-utm-params": "vite serve scripts/lc-utm-params/src/",
-    "build:lc-utm-params": "vite build -c scripts/lc-utm-params/vite.config.js",
-    "dev:lc-show-hide": "vite serve scripts/lc-show-hide/src/",
-    "build:lc-show-hide": "vite build -c scripts/lc-show-hide/vite.config.js",
-    "dev:schedule-event": "vite serve scripts/schedule-event/src/",
-    "build:schedule-event": "vite build -c scripts/schedule-event/vite.config.js",
-    "dev:lc-ga-tags": "vite serve scripts/lc-ga-tags/src/",
-    "build:lc-ga-tags": "vite build -c scripts/lc-ga-tags/vite.config.js",
-    "dev:lc-exit-intent": "vite serve scripts/lc-exit-intent/src/",
-    "build:lc-exit-intent": "vite build -c scripts/lc-exit-intent/vite.config.js",
-    "dev:lc-input-error": "vite serve scripts/lc-input-error/src/",
-    "build:lc-input-error": "vite build -c scripts/lc-input-error/vite.config.js",
-    "dev:lc-whatsapp-widget-combo": "vite serve scripts/lc-whatsapp-widget-combo/src/",
-    "build:lc-whatsapp-widget-combo": "vite build -c scripts/lc-whatsapp-widget-combo/vite.config.js",
-    "dev:lc-whatsapp-widget-only": "vite serve scripts/lc-whatsapp-widget-only/src/",
-    "build:lc-whatsapp-widget-only": "vite build -c scripts/lc-whatsapp-widget-only/vite.config.js",
-    "dev:lc-channel-widgets": "vite serve scripts/lc-channel-widgets/src/",
-    "build:lc-channel-widgets": "vite build -c scripts/lc-channel-widgets/vite.config.js"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "devDependencies": {
-    "@esm-bundle/chai": "^4.3.4-fix.0",
-    "@testing-library/dom": "^8.11.1",
-    "@web/test-runner": "^0.13.22",
-    "chai": "^4.3.4",
-    "concurrently": "^6.5.0",
-    "delay": "^5.0.0",
-    "fast-check": "^3.20.0",
-    "hygen": "^6.1.0",
-    "jest": "^29.7.0",
-    "mocha": "^11.5.0",
-    "mongodb": "^6.1.0",
-    "prettier": "^2.7.1",
-    "release-it": "^14.12",
-    "rimraf": "^3.0.2",
-    "sinon": "^12.0.1",
-    "vite": "^2.7.3"
-  },
-  "volta": {
-    "node": "16.13.2"
-  }
+	"name": "@commversion/libs",
+	"version": "0.18.3",
+	"license": "UNLICENSED",
+	"author": "Commversion",
+	"type": "module",
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"build:lc-attribution": "vite build -c scripts/lc-attribution/vite.config.ts",
+		"build:lc-channel-widgets": "vite build -c scripts/lc-channel-widgets/vite.config.js",
+		"build:lc-cookie-banner-update-position": "vite build -c scripts/lc-cookie-banner-update-position/vite.config.js",
+		"build:lc-device": "vite build -c scripts/lc-device/vite.config.js",
+		"build:lc-exit-intent": "vite build -c scripts/lc-exit-intent/vite.config.js",
+		"build:lc-exit-intent-debounced": "vite build -c scripts/lc-exit-intent-debounced/vite.config.js",
+		"build:lc-experiment": "vite build -c scripts/lc-experiment/vite.config.js",
+		"build:lc-form-abandonment": "vite build -c scripts/lc-form-abandonment/vite.config.js",
+		"build:lc-form-submission": "vite build -c scripts/lc-form-submission/vite.config.js",
+		"build:lc-ga-initialize-event": "vite build -c scripts/lc-ga-initialize-event/vite.config.js",
+		"build:lc-ga-tags": "vite build -c scripts/lc-ga-tags/vite.config.js",
+		"build:lc-gclid": "vite build -c scripts/lc-gclid/vite.config.js",
+		"build:lc-geoblocking": "vite build -c scripts/lc-geoblocking/vite.config.js",
+		"build:lc-gtm": "vite build -c scripts/lc-gtm/vite.config.js",
+		"build:lc-input-error": "vite build -c scripts/lc-input-error/vite.config.js",
+		"build:lc-kill-chat": "vite build -c scripts/lc-kill-chat/vite.config.js",
+		"build:lc-kill-chat-persist": "vite build -c scripts/lc-kill-chat-persist/vite.config.js",
+		"build:lc-open-on-button-click": "vite build -c scripts/lc-open-on-button-click/vite.config.js",
+		"build:lc-pause-on-url": "vite build -c scripts/lc-pause-on-url/vite.config.js",
+		"build:lc-powered-by": "vite build -c scripts/lc-powered-by/vite.config.js",
+		"build:lc-show-by-selector": "vite build -c scripts/lc-show-by-selector/vite.config.js",
+		"build:lc-show-hide": "vite build -c scripts/lc-show-hide/vite.config.js",
+		"build:lc-utm-params": "vite build -c scripts/lc-utm-params/vite.config.js",
+		"build:lc-whatsapp-widget-combo": "vite build -c scripts/lc-whatsapp-widget-combo/vite.config.js",
+		"build:lc-whatsapp-widget-only": "vite build -c scripts/lc-whatsapp-widget-only/vite.config.js",
+		"build:schedule-event": "vite build -c scripts/schedule-event/vite.config.js",
+		"dev:lc-attribution": "vite serve scripts/lc-attribution/src/",
+		"dev:lc-channel-widgets": "vite serve scripts/lc-channel-widgets/src/",
+		"dev:lc-cookie-banner-update-position": "vite serve scripts/lc-cookie-banner-update-position/src/",
+		"dev:lc-device": "vite serve scripts/lc-device/src/",
+		"dev:lc-exit-intent": "vite serve scripts/lc-exit-intent/src/",
+		"dev:lc-exit-intent-debounced": "vite serve scripts/lc-exit-intent-debounced/src/",
+		"dev:lc-experiment": "vite serve scripts/lc-experiment/src/",
+		"dev:lc-form-abandonment": "vite serve scripts/lc-form-abandonment/src/",
+		"dev:lc-form-submission": "vite serve scripts/lc-form-submission/src/",
+		"dev:lc-ga-initialize-event": "vite serve scripts/lc-ga-initialize-event/src/",
+		"dev:lc-ga-tags": "vite serve scripts/lc-ga-tags/src/",
+		"dev:lc-gclid": "vite serve scripts/lc-gclid/src/",
+		"dev:lc-geoblocking": "vite serve scripts/lc-geoblocking/src/",
+		"dev:lc-gtm": "vite serve scripts/lc-gtm/src/",
+		"dev:lc-input-error": "vite serve scripts/lc-input-error/src/",
+		"dev:lc-kill-chat": "vite serve scripts/lc-kill-chat/src/",
+		"dev:lc-kill-chat-persist": "vite serve scripts/lc-kill-chat-persist/src/",
+		"dev:lc-open-on-button-click": "vite serve scripts/lc-open-on-button-click/src/",
+		"dev:lc-pause-on-url": "vite serve scripts/lc-pause-on-url/src/",
+		"dev:lc-powered-by": "vite serve scripts/lc-powered-by/src/",
+		"dev:lc-show-by-selector": "vite serve scripts/lc-show-by-selector/src/",
+		"dev:lc-show-hide": "vite serve scripts/lc-show-hide/src/",
+		"dev:lc-utm-params": "vite serve scripts/lc-utm-params/src/",
+		"dev:lc-whatsapp-widget-combo": "vite serve scripts/lc-whatsapp-widget-combo/src/",
+		"dev:lc-whatsapp-widget-only": "vite serve scripts/lc-whatsapp-widget-only/src/",
+		"dev:schedule-event": "vite serve scripts/schedule-event/src/",
+		"fmt": "oxfmt",
+		"fmt:check": "oxfmt --check",
+		"lint": "oxlint --type-aware --type-check --report-unused-disable-directives-severity error",
+		"lint:fix": "pnpm run lint --fix",
+		"new": "node templates/scaffold.ts",
+		"prepack": "concurrently pnpm:build:*",
+		"prepare": "is-ci || husky",
+		"preview:lc-powered-by": "pnpm run build:lc-powered-by && vite preview --host 0.0.0.0",
+		"release": "release-it",
+		"release:pre": "release-it --preRelease=pre",
+		"test": "vitest run",
+		"test:watch": "vitest"
+	},
+	"dependencies": {
+		"zod": "^4.4.3"
+	},
+	"devDependencies": {
+		"@types/node": "^25.9.1",
+		"@typescript/native-preview": "7.0.0-dev.20260519.1",
+		"@vitest/browser": "^4.1.7",
+		"@vitest/browser-playwright": "^4.1.7",
+		"concurrently": "^9.2.1",
+		"fast-check": "^4.8.0",
+		"gitmoji-cli": "^9.7.0",
+		"husky": "^9.1.7",
+		"is-ci": "^4.1.0",
+		"lint-staged": "^17.0.5",
+		"mongodb": "^7.2.0",
+		"oxfmt": "^0.51.0",
+		"oxlint": "^1.66.0",
+		"oxlint-tsgolint": "^0.23.0",
+		"playwright": "^1.60.0",
+		"release-it": "^20.0.1",
+		"rimraf": "^6.1.3",
+		"typescript": "^6.0.3",
+		"vite": "^8.0.13",
+		"vitest": "^4.1.7"
+	},
+	"lint-staged": {
+		"**/*.{js,ts,mjs,cjs,jsx,tsx}": [
+			"oxlint --fix",
+			"oxfmt"
+		],
+		"**/*.{json,md,yml,yaml}": [
+			"oxfmt"
+		]
+	},
+	"engines": {
+		"node": ">=24"
+	},
+	"packageManager": "pnpm@11.3.0+sha512.2c403d6594527287672b1f7056343a1f7c3634036a67ffabfcc2b3d7595d843768f8787148d1b57cf7956c90606bbd192857c363af19e96d2d0ec9ec5741d215"
 }

package/pnpm-workspace.yaml

@@ -0,0 +1,33 @@
+# CV-496 (PR #67 review): pnpm supply-chain hardening.
+# Mirrors the gen2-monorepo-base baseline; package-specific entries reflect
+# only what is actually present in this repo's dependency tree.
+
+# Delay installing newly published packages by 7 days to mitigate
+# rapid-publish supply-chain attacks.
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude: []
+
+# Hardening flags: fetch full metadata, block exotic dep specifiers,
+# warn if node_modules is stale, enforce engines field,
+# fail audits on critical findings, deny postinstall scripts by default.
+#
+# `verifyDepsBeforeRun: warn` (not `error`) — pnpm 11.3.0 has an open bug
+# (pnpm/pnpm#9777, comment #4598452327) where `error` false-positives any
+# time `overrides:` is set, blocking every `pnpm run` immediately after a
+# clean install. Flip to `error` once the upstream fix lands.
+fullMetadata: true
+blockExoticSubdeps: true
+verifyDepsBeforeRun: warn
+engineStrict: true
+auditLevel: critical
+dangerouslyAllowAllBuilds: false
+
+# Pin patched versions for in-tree packages so a future downgrade can't
+# silently reintroduce a known CVE. Each entry listed below has been
+# verified to appear in this repo's transitive tree.
+overrides:
+  vite@>=7.0.0 <7.3.2: ^7.3.2
+  yaml@>=2.0.0 <2.8.3: ^2.8.3
+  brace-expansion@>=4.0.0 <5.0.6: ^5.0.6
+  postcss@<8.5.10: ^8.5.10
+  ws@>=8.0.0 <8.20.1: ^8.20.1

package/templates/scaffold.ts

@@ -0,0 +1,86 @@
+import { existsSync } from "node:fs";
+import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const TEMPLATE_DIR = join(REPO_ROOT, "templates", "script");
+const SCRIPTS_DIR = join(REPO_ROOT, "scripts");
+const README_MARKER = "<!-- scaffold:scripts -->";
+const NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+
+const toCamel = (name: string): string =>
+	name.replace(/-([a-z0-9])/g, (_, c: string) => c.toUpperCase());
+
+const substitute = (input: string, name: string, camelName: string): string =>
+	input.replaceAll("CAMEL_NAME", camelName).replaceAll("NAME", name);
+
+const walk = async (dir: string): Promise<string[]> => {
+	const out: string[] = [];
+	for (const entry of await readdir(dir)) {
+		const full = join(dir, entry);
+		if ((await stat(full)).isDirectory()) {
+			out.push(...(await walk(full)));
+		} else {
+			out.push(full);
+		}
+	}
+	return out;
+};
+
+const die = (msg: string): never => {
+	console.error(`scaffold: ${msg}`);
+	process.exit(1);
+};
+
+const updatePackageJson = async (name: string): Promise<void> => {
+	const path = join(REPO_ROOT, "package.json");
+	const pkg = JSON.parse(await readFile(path, "utf8")) as {
+		scripts: Record<string, string>;
+		[key: string]: unknown;
+	};
+	pkg.scripts[`dev:${name}`] = `vite serve scripts/${name}/src/`;
+	pkg.scripts[`build:${name}`] = `vite build -c scripts/${name}/vite.config.ts`;
+	await writeFile(path, `${JSON.stringify(pkg, null, 2)}\n`);
+};
+
+const updateReadme = async (name: string): Promise<void> => {
+	const path = join(REPO_ROOT, "README.md");
+	const text = await readFile(path, "utf8");
+	if (!text.includes(README_MARKER)) {
+		die(
+			`README.md is missing the "${README_MARKER}" marker. Add it on its own line at the end of the script list.`,
+		);
+	}
+	await writeFile(path, text.replace(README_MARKER, `- ${name}\n${README_MARKER}`));
+};
+
+const main = async (): Promise<void> => {
+	const name = process.argv[2] ?? die("usage: pnpm new <script-name>");
+	if (!NAME_PATTERN.test(name)) {
+		die(`invalid name "${name}" — must match ${NAME_PATTERN}`);
+	}
+
+	const target = join(SCRIPTS_DIR, name);
+	if (existsSync(target)) die(`${relative(REPO_ROOT, target)} already exists`);
+
+	const camelName = toCamel(name);
+	const templateFiles = await walk(TEMPLATE_DIR);
+
+	for (const src of templateFiles) {
+		const rel = relative(TEMPLATE_DIR, src);
+		const destRel = substitute(rel, name, camelName);
+		const dest = join(target, destRel);
+		const contents = substitute(await readFile(src, "utf8"), name, camelName);
+		await mkdir(dirname(dest), { recursive: true });
+		await writeFile(dest, contents);
+	}
+
+	await updatePackageJson(name);
+	await updateReadme(name);
+
+	console.log(`created scripts/${name}/`);
+	console.log(`next: pnpm install && pnpm dev:${name}`);
+};
+
+await main();