@getarbiter/cli 0.5.0

package/dist/templates/static-analysis/.golangci.yml.ejs

@@ -0,0 +1,70 @@
+# <%= projectName %> golangci-lint configuration — generated by arbiter (M29)
+# Peer dep: golangci-lint >= 2.0  (v2 config schema)
+# Run: golangci-lint run
+# Re-generate: arbiter update
+version: "2"
+run:
+  timeout: 5m
+
+linters:
+  default: none
+  enable:
+    # Complexity
+    - gocyclo      # cyclomatic complexity
+    - gocognit     # cognitive complexity
+    - funlen       # function length
+    # Dead code & unused
+    - unused
+    # Constants & duplication
+    - goconst      # repeated string literals that should be constants
+    # Security
+    - gosec        # security issues (G-rules, equivalent to bandit)
+    # Compiler-level checks
+    - govet        # go vet
+    # Error handling
+    - errcheck     # unchecked errors
+    # Static analysis
+    - staticcheck  # comprehensive static analysis (SA rules)
+  settings:
+    gocyclo:
+      min-complexity: <%= locals.thresholds ? locals.thresholds.cyclomaticComplexity : 15 %>
+    gocognit:
+      min-complexity: <%= locals.thresholds ? locals.thresholds.cyclomaticComplexity : 15 %>
+    funlen:
+      lines: <%= locals.thresholds ? locals.thresholds.methodLength : 65 %>
+      statements: <%= locals.thresholds ? locals.thresholds.methodLength : 65 %>
+    goconst:
+      min-len: 3
+      min-occurrences: 3
+    gosec:
+      severity: medium
+      confidence: medium
+    errcheck:
+      check-type-assertions: true
+      check-blank: true
+  exclusions:
+    rules:
+      # Test files: allow unhandled errors in assertions
+      - path: _test\.go
+        linters:
+          - errcheck
+      # Generated protobuf files
+      - path: \.pb\.go
+        linters:
+          - gocyclo
+          - gocognit
+          - funlen
+          - unused
+          - goconst
+          - gosec
+          - govet
+          - errcheck
+          - staticcheck
+
+formatters:
+  enable:
+    - gofmt        # Go standard formatter
+
+issues:
+  max-issues-per-linter: 50
+  max-same-issues: 10

package/dist/templates/static-analysis/.shellcheckrc.ejs

@@ -0,0 +1,13 @@
+# shellcheck configuration (gold-align #1507)
+#
+# Auto-discovered by shellcheck for every *.sh file in the repo. The CI
+# `config-lint` lane and the pre-commit hook both run
+# `shellcheck --severity=warning`, blocking on warning-or-worse findings
+# (unquoted expansions, unsafe word-splitting, useless `cat`, etc.).
+
+# Treat all generated scripts as bash (they ship a bash shebang).
+shell=bash
+
+# Follow `source`d / `.`-included files when the path is statically resolvable
+# (honours `# shellcheck source=...` directives) so cross-file checks work.
+external-sources=true

package/dist/templates/static-analysis/.yamllint.yml.ejs

@@ -0,0 +1,41 @@
+# yamllint configuration (gold-align #1506)
+#
+# Lints non-workflow YAML (compose files, k8s manifests, generic config) for
+# structure and style: indentation, duplicate keys, trailing spaces, document
+# structure. actionlint owns .github/workflows *semantics*; this config is
+# auto-discovered by `yamllint` for everything else.
+#
+# Policy: ERRORS block the gate; WARNINGS are advisory and tunable here. The CI
+# `config-lint` lane and the pre-commit hook both run `yamllint`, which exits
+# non-zero only on error-level problems by default.
+---
+extends: default
+
+rules:
+  # Long lines are common in config (URLs, base64, annotations) — warn, do not block.
+  line-length:
+    max: 120
+    level: warning
+  # `---` document markers are optional for single-document config files.
+  document-start: disable
+  # `yes`/`no`/`on`/`off` truthy coercion is a style smell, not an error.
+  truthy:
+    level: warning
+  comments:
+    min-spaces-from-content: 1
+  # Permit the formatter/flow-mapping inner-space style (`{ a: 1 }`, `[ a, b ]`).
+  # prettier and most YAML formatters emit it, so the strict default (max 0) would
+  # error on already-formatted config — allow up to one inner space, forbid more.
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  brackets:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+
+# Skip generated/vendored trees and the workflow files actionlint already checks.
+ignore: |
+  .github/workflows/
+  node_modules/
+  dist/
+  build/

package/dist/templates/static-analysis/checkstyle.xml.ejs

@@ -0,0 +1,83 @@
+<?xml version="1.0"?>
+<!DOCTYPE module PUBLIC
+    "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN"
+    "https://checkstyle.org/dtds/configuration_1_3.dtd">
+<!--
+  <%= projectName %> Checkstyle configuration — generated by arbiter (M29)
+  Thresholds: CC≤<%= locals.thresholds ? locals.thresholds.cyclomaticComplexity : 15 %>, method≤<%= locals.thresholds ? locals.thresholds.methodLength : 65 %> lines, params≤<%= locals.thresholds ? locals.thresholds.maxParams : 7 %>, classFanOut≤25
+  Re-generate: arbiter update
+-->
+<module name="Checker">
+  <property name="severity" value="error"/>
+
+  <!-- Encoding -->
+  <module name="FileTabCharacter">
+    <property name="eachLine" value="true"/>
+  </module>
+  <module name="NewlineAtEndOfFile"/>
+
+  <module name="TreeWalker">
+
+    <!-- Complexity -->
+    <module name="CyclomaticComplexity">
+      <property name="max" value="<%= locals.thresholds ? locals.thresholds.cyclomaticComplexity : 15 %>"/>
+    </module>
+
+    <!-- Method length: body only -->
+    <module name="MethodLength">
+      <property name="max" value="<%= locals.thresholds ? locals.thresholds.methodLength : 65 %>"/>
+      <property name="countEmpty" value="false"/>
+    </module>
+
+    <!-- Parameter count -->
+    <module name="ParameterNumber">
+      <property name="max" value="<%= locals.thresholds ? locals.thresholds.maxParams : 7 %>"/>
+    </module>
+
+    <!-- Fan-out: max 25 distinct class references -->
+    <module name="ClassFanOutComplexity">
+      <property name="max" value="25"/>
+    </module>
+
+    <!-- Imports: no star imports, no duplicate imports -->
+    <module name="AvoidStarImport"/>
+    <module name="RedundantImport"/>
+    <module name="UnusedImports"/>
+
+    <!-- Whitespace & formatting. Empty-body allowances match google-java-format
+         (spotless), which collapses empty constructors/methods/types to `{}` —
+         without them the two generated tools contradict each other and no file
+         with an empty body can satisfy both gates. -->
+    <module name="WhitespaceAround">
+      <property name="allowEmptyConstructors" value="true"/>
+      <property name="allowEmptyMethods" value="true"/>
+      <property name="allowEmptyTypes" value="true"/>
+      <property name="allowEmptyLambdas" value="true"/>
+      <property name="allowEmptyLoops" value="true"/>
+      <property name="allowEmptyCatches" value="true"/>
+    </module>
+    <module name="WhitespaceAfter"/>
+    <module name="NoWhitespaceBefore"/>
+    <module name="EmptyLineSeparator">
+      <property name="allowNoEmptyLineBetweenFields" value="true"/>
+    </module>
+
+    <!-- Braces -->
+    <module name="LeftCurly"/>
+    <module name="RightCurly"/>
+    <module name="NeedBraces"/>
+
+    <!-- Naming conventions -->
+    <module name="TypeName"/>
+    <module name="MethodName"/>
+    <module name="ConstantName"/>
+    <module name="LocalVariableName"/>
+
+    <!-- Enable @SuppressWarnings recognition -->
+    <module name="SuppressWarningsHolder"/>
+
+  </module>
+
+  <!-- Activates SuppressWarningsHolder annotations at file level -->
+  <module name="SuppressWarningsFilter"/>
+</module>

package/dist/templates/static-analysis/detekt.yml.ejs

@@ -0,0 +1,26 @@
+# detekt configuration — generated by arbiter (#1177)
+# Static analysis for Kotlin using io.gitlab.arturbosch.detekt 1.23.x
+# Run:   ./gradlew detekt
+# Docs:  https://detekt.dev/docs/gettingstarted/gradle
+# To generate a full config: ./gradlew detektGenerateConfig
+build:
+  maxIssues: 0
+
+complexity:
+  ComplexMethod:
+    threshold: 15
+  LongMethod:
+    threshold: 60
+  TooManyFunctions:
+    threshold: 15
+
+naming:
+  MemberNameEqualsClassName:
+    active: true
+
+style:
+  MagicNumber:
+    active: true
+    excludes: ["**/test/**", "**/Test*/**"]
+  WildcardImport:
+    active: true

package/dist/templates/static-analysis/eslint.config.mjs.ejs

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+// Flat ESLint config (ESLint v9+) — the `lint` gate runs `eslint .` and loads
+// this file. Kept intentionally lean so a freshly-scaffolded project lints GREEN
+// on first run: type-aware rules (which need a tsconfig project reference and a
+// full type-check pass) live in the optional strict layer you can enable later.
+//
+// Customise freely — this is YOUR config, not arbiter-owned. The deeper
+// project-wide prohibitions arbiter enforces (complexity, no-console, max-depth,
+// …) live in eslint.config.static.mjs, run by the separate `static analysis` gate.
+import js from '@eslint/js'
+import tseslint from 'typescript-eslint'
+
+export default tseslint.config(
+  {
+    ignores: [
+      'dist/**',
+      'build/**',
+      'coverage/**',
+      'node_modules/**',
+      '.claude/**',
+      '.codex/**',
+      '.githooks/**',
+      'scripts/**',
+      'pacts/**',
+      '.dependency-cruiser.cjs',
+      // #2257: legacy eslintrc-format compat files (.eslintrc-frontend-spa.cjs,
+      // .eslintrc-boundaries.cjs, …) — retained for tooling that still reads
+      // eslintrc format, NOT used by the flat-config gate itself. Un-ignored,
+      // their bare `module.exports` CommonJS shape REDs `no-undef` on Day 1.
+      '.eslintrc-*.cjs',
+      // #2434: same class — commitlint.config.js is a CommonJS `module.exports`
+      // config consumed by commitlint's own loader, never by this flat-config
+      // gate. It only reached greenfield projects once the `root` generator
+      // stopped being gated on GitHub permission; un-ignored it REDs `no-undef`
+      // on Day 1 exactly as the eslintrc compat files did.
+      'commitlint.config.js',
+    ],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    rules: {
+      '@typescript-eslint/no-explicit-any': 'error',
+      'no-var': 'error',
+      'prefer-const': 'error',
+      eqeqeq: ['error', 'always'],
+      // #1840 F4 tranche-3: respect the underscore-prefix "intentionally unused"
+      // convention (e.g. Express's required-but-unused `_next` error-handler
+      // param — arbiter's own middleware/error-handler.ts.ejs uses it) — without
+      // this, tseslint's recommended no-unused-vars flags it on every fresh init.
+      '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
+    },
+  },
+)

package/dist/templates/static-analysis/eslint.config.static.mjs.ejs

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: Apache-2.0
+// Flat ESLint config for the `static analysis` gate (M29). Run in isolation by
+// check-all.mjs via `eslint --config eslint.config.static.mjs --no-config-lookup`
+// so it enforces ONLY arbiter's project-wide prohibitions (complexity, no-console,
+// max-depth, …) independent of your main eslint.config.mjs. ESLint v9+ flat config
+// — the legacy `.eslintrc-static.json` is no longer used by the gate (eslintrc was
+// removed in the flat-config era), but is retained for tooling that still reads it.
+import tseslint from 'typescript-eslint'
+
+export default tseslint.config({
+  files: ['**/*.ts', '**/*.tsx', '**/*.mts', '**/*.cts'],
+  languageOptions: {
+    parser: tseslint.parser,
+    ecmaVersion: 2022,
+    sourceType: 'module',
+  },
+  plugins: {
+    '@typescript-eslint': tseslint.plugin,
+  },
+  rules: {
+    '@typescript-eslint/no-explicit-any': 'error',
+    'no-console': 'error',
+    complexity: ['error', <%= locals.thresholds ? locals.thresholds.cyclomaticComplexity : 15 %>],
+    'max-params': ['error', <%= locals.thresholds ? locals.thresholds.maxParams : 7 %>],
+    'max-depth': ['error', 4],
+    'max-lines-per-function': [
+      'error',
+      { max: <%= locals.thresholds ? locals.thresholds.methodLength : 100 %>, skipBlankLines: true, skipComments: true },
+    ],
+    'max-nested-callbacks': ['error', 3],
+    'no-var': 'error',
+    'prefer-const': 'error',
+    eqeqeq: ['error', 'always'],
+    'no-eval': 'error',
+    'no-implied-eval': 'error',
+    'no-new-func': 'error',
+  },
+})

package/dist/templates/static-analysis/eslintrc-static.json.ejs

@@ -0,0 +1,30 @@
+{
+  "parser": "@typescript-eslint/parser",
+  "plugins": ["@typescript-eslint"],
+  "env": {
+    "es2022": true,
+    "node": true
+  },
+  "parserOptions": {
+    "ecmaVersion": 2022,
+    "sourceType": "module"
+  },
+  "rules": {
+    "@typescript-eslint/no-explicit-any": "error",
+    "no-console": "error",
+    "complexity": ["error", <%= locals.thresholds ? locals.thresholds.cyclomaticComplexity : 15 %>],
+    "max-params": ["error", <%= locals.thresholds ? locals.thresholds.maxParams : 7 %>],
+    "max-depth": ["error", 4],
+    "max-lines-per-function": [
+      "error",
+      { "max": <%= locals.thresholds ? locals.thresholds.methodLength : 100 %>, "skipBlankLines": true, "skipComments": true }
+    ],
+    "max-nested-callbacks": ["error", 3],
+    "no-var": "error",
+    "prefer-const": "error",
+    "eqeqeq": ["error", "always"],
+    "no-eval": "error",
+    "no-implied-eval": "error",
+    "no-new-func": "error"
+  }
+}

package/dist/templates/static-analysis/jscpd.json.ejs

@@ -0,0 +1,25 @@
+<%# jscpd duplication (DRY) gate config — CANON-22 Tier-1 (Juergens et al. ICSE'09).
+    `threshold` is a CEILING (% duplicated tokens); the debt ratchet additionally
+    enforces monotonic non-increase (Lehman's law of rising entropy). Juergens'09:
+    INCONSISTENT clones — a fragment duplicated then edited in one copy but not the
+    other — are the dangerous ones (latent bugs), so minTokens is kept low to surface
+    near-duplicates rather than only exact copies. Threshold scales with governance.
+    jscpd v5 ignores the v4 `pattern` key (silent 0-file scan): the fileset lives in
+    `path` (read by the generated scripts and passed as positional CLI args — jscpd
+    itself disregards the key) plus the `format` filter. -%>
+{
+  "threshold": <%= duplicationThreshold %>,
+  "minTokens": 50,
+  "reporters": ["json", "consoleFull"],
+  "absolute": true,
+  "path": ["src"],
+  "format": ["typescript", "tsx", "javascript", "jsx"],
+  "ignore": [
+    "**/node_modules/**",
+    "dist/**",
+    "build/**",
+    "coverage/**",
+    "**/__tests__/fixtures/**",
+    "**/*.min.js"
+  ]
+}

package/dist/templates/static-analysis/knip.json.ejs

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://unpkg.com/knip@latest/schema.json",
+  "entry": [
+    <%- archetype === 'cli' ? '"src/cli.ts!"' : '"src/index.ts!"' %><% if (hasPublicApi && (language === 'typescript' || language === 'multi')) { %>,
+    "src/middleware/deprecation.ts!",
+    "src/middleware/410-gone-handler.ts!",
+    "src/middleware/error-handler.ts!",
+    "src/middleware/correlation-id.ts!",
+    "src/middleware/payload-size-limit.ts!"<% } %>
+  ],
+  "project": ["src/**/*.ts!"],
+  "ignoreDependencies": ["jscpd"<% if ((language === 'typescript' || language === 'multi') && (archetype === 'frontend-spa' || archetype === 'backend-web-db')) { %>, "@playwright/test"<% } %><% if ((language === 'typescript' || language === 'multi') && (archetype === 'frontend-spa' || architectureStyle === 'hexagonal')) { %>, "eslint-plugin-boundaries"<% } %>],
+  "ignoreBinaries": [
+    "knip",
+    "madge",
+    "license-checker",
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "CC0-1.0",
+    "0BSD",
+    "Unlicense",
+    "Python-2.0"
+  ]
+}

package/dist/templates/static-analysis/pmd-ruleset.xml.ejs

@@ -0,0 +1,92 @@
+<?xml version="1.0"?>
+<ruleset name="<%= projectName %> PMD Rules"
+  xmlns="http://pmd.sourceforge.net/ruleset/2.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0
+    https://pmd.sourceforge.io/ruleset_2_0_0.xsd">
+
+  <description>Precise quality rules for <%= projectName %> — generated by arbiter (M29)</description>
+
+  <!-- ── DESIGN ──────────────────────────────────────────────────────────── -->
+  <rule ref="category/java/design.xml/CyclomaticComplexity">
+    <properties>
+      <property name="methodReportLevel" value="<%= locals.thresholds ? locals.thresholds.cyclomaticComplexity : 15 %>"/>
+      <property name="classReportLevel" value="80"/>
+    </properties>
+  </rule>
+
+  <rule ref="category/java/design.xml/CognitiveComplexity">
+    <properties>
+      <property name="reportLevel" value="<%= locals.thresholds ? locals.thresholds.cyclomaticComplexity : 15 %>"/>
+    </properties>
+  </rule>
+
+  <rule ref="category/java/design.xml/NcssCount">
+    <properties>
+      <property name="methodReportLevel" value="<%= locals.thresholds ? locals.thresholds.methodLength : 50 %>"/>
+      <property name="classReportLevel" value="1000"/>
+    </properties>
+  </rule>
+
+  <rule ref="category/java/design.xml/TooManyMethods">
+    <properties>
+      <property name="maxmethods" value="20"/>
+    </properties>
+  </rule>
+
+  <rule ref="category/java/design.xml/TooManyFields">
+    <properties>
+      <property name="maxfields" value="15"/>
+    </properties>
+  </rule>
+
+  <rule ref="category/java/design.xml/AvoidDeeplyNestedIfStmts">
+    <properties>
+      <property name="problemDepth" value="4"/>
+    </properties>
+  </rule>
+
+  <rule ref="category/java/design.xml/GodClass"/>
+
+  <rule ref="category/java/design.xml/ExcessiveImports">
+    <properties>
+      <property name="minimum" value="30"/>
+    </properties>
+  </rule>
+
+  <!-- ── ERROR-PRONE ─────────────────────────────────────────────────────── -->
+  <rule ref="category/java/errorprone.xml">
+    <exclude name="MissingSerialVersionUID"/>
+    <!-- Framework patterns: Spring/CDI use reflection-based injection -->
+    <exclude name="BeanMembersShouldSerialize"/>
+    <!-- Allow @Autowired field injection in test classes -->
+    <exclude name="UnnecessaryConstructor"/>
+  </rule>
+
+  <!-- ── MULTITHREADING ──────────────────────────────────────────────────── -->
+  <rule ref="category/java/multithreading.xml">
+    <exclude name="UseConcurrentHashMap"/>
+  </rule>
+
+  <!-- ── SECURITY ────────────────────────────────────────────────────────── -->
+  <!-- Zero exclusions: security rules are never suppressed -->
+  <rule ref="category/java/security.xml"/>
+
+  <!-- ── BEST PRACTICES ──────────────────────────────────────────────────── -->
+  <rule ref="category/java/bestpractices.xml">
+    <!-- Allow JUnit 5 public test methods -->
+    <exclude name="JUnit4TestShouldUseTestAnnotation"/>
+  </rule>
+
+  <!-- ── PERFORMANCE ─────────────────────────────────────────────────────── -->
+  <rule ref="category/java/performance.xml">
+    <exclude name="AvoidInstantiatingObjectsJustToGetClass"/>
+  </rule>
+
+  <!-- ── CODE STYLE ─────────────────────────────────────────────────────── -->
+  <rule ref="category/java/codestyle.xml/UnnecessaryFullyQualifiedName"/>
+  <rule ref="category/java/codestyle.xml/UnnecessaryReturn"/>
+  <rule ref="category/java/codestyle.xml/UselessParentheses"/>
+  <rule ref="category/java/codestyle.xml/UselessQualifiedThis"/>
+
+</ruleset>

package/dist/templates/static-analysis/prettierignore.ejs

@@ -0,0 +1,59 @@
+# Arbiter-generated governance scaffold — owned by the installer, not your source.
+# The `format` gate runs `prettier --check .`; without this ignore-list it would
+# flag arbiter's own generated docs/config/hooks (which intentionally do not all
+# conform to your project's .prettierrc) and the gate would be RED on first run.
+# Your application source (src/**, etc.) is NOT ignored — it is still format-gated.
+
+# Build / dependency output
+node_modules/
+dist/
+build/
+coverage/
+.next/
+out/
+
+# Arbiter runtime + governance state (regenerated by `arbiter update`)
+.arbiter/
+.arbiter-generated-manifest.json
+.claude/
+.codex/
+.cursor/
+.agents/
+.githooks/
+.evidence/
+
+# Generated gate scripts (arbiter-owned .mjs checkers, not user source)
+scripts/
+pacts/
+
+# Generated governance docs (long-form Markdown, not prettier-shaped)
+docs/
+standards/
+suppressions/
+features/
+AGENTS.md
+GLOBAL_INVARIANTS.md
+CONTRIBUTING.md
+SECURITY.md
+
+# Generated tool configs (machine-emitted; own formatting conventions)
+arbiter.json
+.dependency-cruiser.cjs
+.eslintrc-static.json
+.eslintrc-frontend-spa.cjs
+.eslintrc-boundaries.cjs
+.eslintrc-playwright.json
+knip.json
+.jscpd.json
+test-pyramid.json
+api-e2e.json
+Makefile
+# Generated TS config (emitted by arbiter; not hand-authored source)
+vitest.config.ts
+vitest.browser.config.ts
+tsconfig.json
+eslint.config.mjs
+eslint.config.static.mjs
+eslint.config.frontend-spa.mjs
+eslint.config.boundaries.mjs
+eslint.config.playwright.mjs

package/dist/templates/static-analysis/prettierrc.json.ejs

@@ -0,0 +1,10 @@
+{
+  "printWidth": 100,
+  "singleQuote": true,
+  "semi": false,
+  "tabWidth": 2,
+  "trailingComma": "all",
+  "bracketSpacing": true,
+  "arrowParens": "always",
+  "endOfLine": "lf"
+}

package/dist/templates/static-analysis/requirements-dev.txt.ejs

@@ -0,0 +1,11 @@
+# Arbiter-generated — dev/test toolchain the generated gate (check-all.mjs)
+# invokes. Install with:  python -m pip install -r requirements-dev.txt
+#
+# L1 (fast) gate: ruff (lint+format) and pytest (unit tests).
+# L2 (full) gate additionally exercises coverage and the pytest-bdd behavioural
+# suite. pytest-bdd is L2-only — the L1 unit run skips the BDD module cleanly when
+# it is absent (see tests/bdd/test_example_bdd.py), so L1 is green without it.
+ruff>=0.4
+pytest>=8.0
+pytest-cov>=5.0
+pytest-bdd>=7.0

package/dist/templates/static-analysis/ruff.toml.ejs

@@ -0,0 +1,40 @@
+# <%- projectName %> ruff configuration — generated by arbiter (M29)
+# Re-generate: arbiter update
+<%- architectureStyle === 'hexagonal' ? 'extend = "ruff-boundaries.toml"' : '' %>
+
+[lint]
+# Select rules by category prefix:
+#   C9xx  — McCabe complexity
+#   PLRxx — Pylint refactor (complexity metrics)
+#   F4xx  — pyflakes unused imports
+#   S     — bandit security (equivalent)
+select = [
+  "C901",    # McCabe complexity > max-complexity
+  "PLR0911", # Too many return statements
+  "PLR0912", # Too many branches
+  "PLR0913", # Too many arguments
+  "PLR0915", # Too many statements
+  "F401",    # Unused import
+  "F811",    # Redefinition of unused name from import
+  "S",       # Security (bandit equivalent — SQL injection, shell injection, etc.)
+  "E",       # pycodestyle errors
+  "W",       # pycodestyle warnings
+]
+
+# Exclude from security rules: test files (S101 assert, S311 random)
+[lint.per-file-ignores]
+"tests/**" = ["S101", "S311"]
+"test_*.py" = ["S101", "S311"]
+"*_test.py" = ["S101", "S311"]
+
+[lint.mccabe]
+max-complexity = <%= locals.thresholds ? locals.thresholds.cyclomaticComplexity : 15 %>
+
+[lint.pylint]
+max-args = <%= locals.thresholds ? locals.thresholds.maxParams : 7 %>
+
+[format]
+# Match Black defaults for consistency
+quote-style = "double"
+indent-style = "space"
+line-ending = "auto"

package/dist/templates/static-analysis/rustfmt.toml.ejs

@@ -0,0 +1,3 @@
+edition = "2021"
+max_width = 100
+use_small_heuristics = "Max"