@react-vault/create-app 0.1.0

package/dist/index.js

@@ -0,0 +1,339 @@
+/**
+ * `create-app` entry point.
+ *
+ * Scaffolds a new BFSI React project from `templates/_shared/` + a variant overlay
+ * (RTK Query or TanStack Query), inlines the Claude toolkit into the project's
+ * `.claude/` directory, and optionally rewrites `@react-vault/*` deps to local `link:`
+ * paths so the project installs without the packages being published yet.
+ */
+import { intro, outro, text, select, confirm, isCancel, cancel, spinner, note, } from '@clack/prompts';
+import pc from 'picocolors';
+import fs from 'fs-extra';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execa } from 'execa';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+// The CLI runs in two modes:
+//   - Dev: inside the monorepo at <starter>/packages/cli/dist/index.js.
+//     Templates are at <starter>/templates/ and the toolkit lives at
+//     <starter>/packages/claude-toolkit/.
+//   - Published: installed at <somewhere>/node_modules/@react-vault/create-app/.
+//     The prepublishOnly script bundles templates/ and claude-toolkit/ INTO
+//     the package itself, so they sit alongside dist/.
+const PACKAGE_ROOT = path.resolve(__dirname, '..');
+const BUNDLED_TEMPLATES = path.join(PACKAGE_ROOT, 'templates');
+const IS_PUBLISHED_MODE = fs.existsSync(BUNDLED_TEMPLATES);
+const TEMPLATES_ROOT = IS_PUBLISHED_MODE
+    ? BUNDLED_TEMPLATES
+    : path.resolve(PACKAGE_ROOT, '..', '..', 'templates');
+const TOOLKIT_ROOT = IS_PUBLISHED_MODE
+    ? path.join(PACKAGE_ROOT, 'claude-toolkit')
+    : path.resolve(PACKAGE_ROOT, '..', 'claude-toolkit');
+// The npm scope used in templates' package.json references. The CLI's `link:`
+// rewrite swaps these to absolute paths for local-dev mode.
+const PACKAGE_SCOPE = '@react-vault';
+export async function main() {
+    console.log();
+    intro(pc.bold(pc.bgCyan(pc.black(' @react-vault/create-app '))));
+    const projectName = await text({
+        message: 'Project name?',
+        placeholder: 'my-bank-app',
+        validate(value) {
+            if (!value) {
+                return 'Project name is required';
+            }
+            if (!/^[a-z0-9][a-z0-9-]*$/.test(value)) {
+                return 'Lowercase letters, digits, and hyphens only';
+            }
+            const target = path.resolve(process.cwd(), value);
+            if (fs.existsSync(target)) {
+                return `Directory ${value} already exists`;
+            }
+            return undefined;
+        },
+    });
+    if (isCancel(projectName)) {
+        return cancelled();
+    }
+    const variant = (await select({
+        message: 'State management?',
+        options: [
+            {
+                value: 'rtk',
+                label: 'RTK Query (Redux Toolkit)',
+                hint: 'Recommended for complex client state',
+            },
+            {
+                value: 'tanstack',
+                label: 'TanStack Query + Zustand',
+                hint: 'Lighter; great for server-state-heavy apps',
+            },
+        ],
+    }));
+    if (isCancel(variant)) {
+        return cancelled();
+    }
+    const inlineToolkit = (await confirm({
+        message: 'Inline the Claude toolkit (skills/agents/hooks/commands) into .claude/?',
+        initialValue: true,
+    }));
+    if (isCancel(inlineToolkit)) {
+        return cancelled();
+    }
+    // In published mode (npx-installed CLI), `link:` paths to a local workspace
+    // don't exist on the user's machine — skip the prompt. In dev mode (running
+    // from the monorepo), offer to point at the local workspace.
+    let localLink = false;
+    if (!IS_PUBLISHED_MODE) {
+        const answer = (await confirm({
+            message: 'Use link: refs for @react-vault/core and @react-vault/ui? (points the project at this local workspace instead of fetching from npm)',
+            initialValue: true,
+        }));
+        if (isCancel(answer)) {
+            return cancelled();
+        }
+        localLink = answer;
+    }
+    const installDeps = (await confirm({
+        message: 'Install dependencies after scaffolding (pnpm install)?',
+        initialValue: true,
+    }));
+    if (isCancel(installDeps)) {
+        return cancelled();
+    }
+    const initGit = (await confirm({
+        message: 'Initialise git repository?',
+        initialValue: true,
+    }));
+    if (isCancel(initGit)) {
+        return cancelled();
+    }
+    const opts = {
+        projectName: projectName,
+        variant,
+        inlineToolkit,
+        localLink,
+        installDeps,
+        initGit,
+    };
+    await scaffold(opts);
+    const lines = [
+        `${pc.bold('cd ' + opts.projectName)}`,
+        '',
+        `  ${pc.cyan('pnpm dev')}        — start dev server`,
+        `  ${pc.cyan('claude')}          — Claude Code (BFSI toolkit auto-available)`,
+        `  ${pc.cyan('/bfsi-doctor')}    — verify wiring inside Claude`,
+        `  ${pc.cyan('/bfsi-onboarding')} — orient yourself to the project`,
+    ];
+    note(lines.join('\n'), 'Next steps');
+    outro(pc.green('Done.'));
+}
+async function scaffold(opts) {
+    const s = spinner();
+    const target = path.resolve(process.cwd(), opts.projectName);
+    const sharedDir = path.join(TEMPLATES_ROOT, '_shared');
+    const variantDir = path.join(TEMPLATES_ROOT, opts.variant === 'rtk' ? 'rtk-query' : 'tanstack-query');
+    // 1. Copy shared template
+    s.start('Copying template files');
+    await fs.copy(sharedDir, target, {
+        filter: (src) => !/(\bnode_modules\b|\.turbo\b|\bdist\b)/.test(src),
+    });
+    // 2. Apply variant overlay
+    if (await fs.pathExists(variantDir)) {
+        await fs.copy(variantDir, target, { overwrite: true });
+    }
+    s.stop('Template files copied');
+    // 3. Merge package.partial.json from variant into package.json, then delete it
+    await mergeVariantPackage(target);
+    // 4. Substitute {{projectName}} in package.json, README.md, index.html, i18n
+    await substituteVars(target, opts.projectName);
+    // 5. In dev mode, optionally swap @react-vault/{core,ui} dep versions to
+    //    `link:` paths pointing at the workspace. No-op in published mode.
+    await maybeRewriteToLinkDeps(target, opts.localLink);
+    // 6. Inline the toolkit (skills, agents, commands, hooks) into .claude/.
+    //    Variant-specific RTK skills are shipped in templates/rtk-query/.claude/
+    //    so they're already in place from step 2 — nothing extra to copy here.
+    if (opts.inlineToolkit) {
+        s.start('Inlining Claude toolkit into .claude/');
+        await inlineToolkitInto(target);
+        s.stop('Claude toolkit inlined into .claude/');
+    }
+    // 7. pnpm install
+    if (opts.installDeps) {
+        s.start('Installing dependencies (pnpm install)');
+        try {
+            await execa('pnpm', ['install'], { cwd: target, stdio: 'pipe' });
+            s.stop('Dependencies installed');
+        }
+        catch (err) {
+            s.stop(pc.yellow('pnpm install failed — see error above. Re-run manually with: pnpm install'));
+            console.warn(pc.dim(err.message));
+        }
+    }
+    // 8. git init + rename to main + first commit
+    if (opts.initGit) {
+        s.start('Initialising git');
+        try {
+            await execa('git', ['init', '-q'], { cwd: target });
+            await execa('git', ['branch', '-m', 'main'], { cwd: target }).catch(() => {
+                // Older git versions: master is created by init; rename may fail if no commits yet
+            });
+            await execa('git', ['add', '.'], { cwd: target });
+            await execa('git', ['commit', '-q', '-m', `chore: scaffold ${opts.projectName} from create-app`], {
+                cwd: target,
+            });
+            // Ensure final branch is main even if rename pre-commit failed
+            await execa('git', ['branch', '-M', 'main'], { cwd: target }).catch(() => {
+                /* ignore */
+            });
+            s.stop('Git repo initialised (branch: main)');
+        }
+        catch (err) {
+            s.stop(pc.yellow('git init failed (continuing anyway)'));
+            console.warn(pc.dim(err.message));
+        }
+    }
+}
+async function mergeVariantPackage(target) {
+    const partialPath = path.join(target, 'package.partial.json');
+    const pkgPath = path.join(target, 'package.json');
+    if (!(await fs.pathExists(partialPath)) || !(await fs.pathExists(pkgPath))) {
+        return;
+    }
+    const partial = (await fs.readJSON(partialPath));
+    const pkg = (await fs.readJSON(pkgPath));
+    if (partial.dependencies) {
+        pkg.dependencies = { ...(pkg.dependencies ?? {}), ...partial.dependencies };
+    }
+    if (partial.devDependencies) {
+        pkg.devDependencies = { ...(pkg.devDependencies ?? {}), ...partial.devDependencies };
+    }
+    await fs.writeJSON(pkgPath, pkg, { spaces: 2 });
+    await fs.remove(partialPath);
+}
+async function substituteVars(target, projectName) {
+    const filesToTouch = [
+        path.join(target, 'package.json'),
+        path.join(target, 'README.md'),
+        path.join(target, 'CLAUDE.md'),
+        path.join(target, 'index.html'),
+        path.join(target, 'src', 'i18n', 'translations', 'en.json'),
+        path.join(target, 'src', 'i18n', 'translations', 'hi.json'),
+    ];
+    for (const f of filesToTouch) {
+        if (!(await fs.pathExists(f))) {
+            continue;
+        }
+        const content = await fs.readFile(f, 'utf8');
+        const replaced = content.replaceAll('{{projectName}}', projectName);
+        if (replaced !== content) {
+            await fs.writeFile(f, replaced, 'utf8');
+        }
+    }
+}
+/**
+ * In local-dev (running from the monorepo) the user can opt-in to rewriting
+ * @react-vault/core and @react-vault/ui dependency versions to `link:` paths
+ * that point at the workspace packages. Lets you `pnpm install` before the
+ * packages are published to npm.
+ *
+ * In published mode (npx-installed CLI), `link:` paths would dangle, so this
+ * step is a no-op — the templates' versions stay as published npm versions.
+ */
+async function maybeRewriteToLinkDeps(target, localLink) {
+    if (!localLink || IS_PUBLISHED_MODE) {
+        return;
+    }
+    const pkgPath = path.join(target, 'package.json');
+    if (!(await fs.pathExists(pkgPath))) {
+        return;
+    }
+    const pkg = (await fs.readJSON(pkgPath));
+    // Resolve workspace paths relative to the monorepo root (only valid in dev mode)
+    const starterRoot = path.resolve(PACKAGE_ROOT, '..', '..');
+    const linkTargets = {
+        [`${PACKAGE_SCOPE}/core`]: `link:${path.join(starterRoot, 'packages', 'core')}`,
+        [`${PACKAGE_SCOPE}/ui`]: `link:${path.join(starterRoot, 'packages', 'ui')}`,
+    };
+    for (const key of ['dependencies', 'devDependencies']) {
+        const block = pkg[key];
+        if (!block) {
+            continue;
+        }
+        for (const depName of Object.keys(block)) {
+            const target = linkTargets[depName];
+            if (target) {
+                block[depName] = target;
+            }
+        }
+    }
+    await fs.writeJSON(pkgPath, pkg, { spaces: 2 });
+}
+/**
+ * Inline the Claude toolkit into <project>/.claude/.
+ *
+ * - Copies the toolkit's skills/, agents/, commands/ into the project (these
+ *   are the shared bfsi-* skills that ship in every project)
+ * - Copies hooks/scripts/ and rewrites paths in hooks.json from `${CLAUDE_PLUGIN_ROOT}/...`
+ *   to `${CLAUDE_PROJECT_DIR}/.claude/...` since we're now project-local, not a plugin
+ * - Merges hooks into existing `.claude/settings.json` (which already has permissions)
+ * - Removes `enabledPlugins` from settings since the plugin is now inlined
+ *
+ * Variant-specific skills (e.g. RTK pattern skills under templates/rtk-query/
+ * .claude/skills/) are NOT handled here — they ship inside their variant
+ * overlay and land in the project as part of the standard overlay copy.
+ */
+async function inlineToolkitInto(target) {
+    const claudeDir = path.join(target, '.claude');
+    await fs.ensureDir(claudeDir);
+    // Copy the toolkit's skills, agents, commands. Existing files at the same
+    // path (e.g. variant-shipped RTK skills already placed by the overlay) are
+    // preserved because we don't write over names we don't have.
+    for (const sub of ['skills', 'agents', 'commands']) {
+        const src = path.join(TOOLKIT_ROOT, sub);
+        const dst = path.join(claudeDir, sub);
+        if (await fs.pathExists(src)) {
+            await fs.copy(src, dst, { overwrite: true });
+        }
+    }
+    // Copy hook scripts + chmod +x
+    const scriptsSrc = path.join(TOOLKIT_ROOT, 'hooks', 'scripts');
+    const scriptsDst = path.join(claudeDir, 'hooks', 'scripts');
+    if (await fs.pathExists(scriptsSrc)) {
+        await fs.copy(scriptsSrc, scriptsDst, { overwrite: true });
+        const entries = await fs.readdir(scriptsDst);
+        for (const e of entries) {
+            const p = path.join(scriptsDst, e);
+            if ((await fs.stat(p)).isFile()) {
+                await fs.chmod(p, 0o755);
+            }
+        }
+    }
+    // Read toolkit hooks.json, rewrite ${CLAUDE_PLUGIN_ROOT} → ${CLAUDE_PROJECT_DIR}/.claude
+    const toolkitHooksPath = path.join(TOOLKIT_ROOT, 'hooks', 'hooks.json');
+    let toolkitHooks = {};
+    if (await fs.pathExists(toolkitHooksPath)) {
+        const raw = await fs.readFile(toolkitHooksPath, 'utf8');
+        const rewritten = raw.replaceAll('${CLAUDE_PLUGIN_ROOT}', '${CLAUDE_PROJECT_DIR}/.claude');
+        toolkitHooks = JSON.parse(rewritten);
+    }
+    // Merge into existing settings.json
+    const settingsPath = path.join(claudeDir, 'settings.json');
+    const existing = (await fs.pathExists(settingsPath))
+        ? (await fs.readJSON(settingsPath))
+        : {};
+    // Remove plugin reference — the toolkit is now project-local
+    delete existing.enabledPlugins;
+    // Set hooks from the rewritten toolkit
+    const hookSection = toolkitHooks.hooks;
+    if (hookSection !== undefined) {
+        existing.hooks = hookSection;
+    }
+    await fs.writeJSON(settingsPath, existing, { spaces: 2 });
+}
+function cancelled() {
+    cancel('Cancelled. No files written.');
+    process.exit(0);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,KAAK,EACL,KAAK,EACL,IAAI,EACJ,MAAM,EACN,OAAO,EACP,QAAQ,EACR,MAAM,EACN,OAAO,EACP,IAAI,GACL,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3C,6BAA6B;AAC7B,wEAAwE;AACxE,qEAAqE;AACrE,0CAA0C;AAC1C,iFAAiF;AACjF,4EAA4E;AAC5E,uDAAuD;AACvD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AACnD,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AAC/D,MAAM,iBAAiB,GAAG,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAE3D,MAAM,cAAc,GAAG,iBAAiB;IACtC,CAAC,CAAC,iBAAiB;IACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,iBAAiB;IACpC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AAEvD,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,aAAa,GAAG,cAAc,CAAC;AAWrC,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;QAC7B,OAAO,EAAE,eAAe;QACxB,WAAW,EAAE,aAAa;QAC1B,QAAQ,CAAC,KAAK;YACZ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,0BAA0B,CAAC;YACpC,CAAC;YACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,OAAO,6CAA6C,CAAC;YACvD,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,OAAO,aAAa,KAAK,iBAAiB,CAAC;YAC7C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC;QAC5B,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,2BAA2B;gBAClC,IAAI,EAAE,sCAAsC;aAC7C;YACD;gBACE,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,0BAA0B;gBACjC,IAAI,EAAE,4CAA4C;aACnD;SACF;KACF,CAAC,CAAuB,CAAC;IAC1B,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,MAAM,OAAO,CAAC;QACnC,OAAO,EAAE,yEAAyE;QAClF,YAAY,EAAE,IAAI;KACnB,CAAC,CAAY,CAAC;IACf,IAAI,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,6DAA6D;IAC7D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC;YAC5B,OAAO,EACL,qIAAqI;YACvI,YAAY,EAAE,IAAI;SACnB,CAAC,CAAY,CAAC;QACf,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC;QACD,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC;QACjC,OAAO,EAAE,wDAAwD;QACjE,YAAY,EAAE,IAAI;KACnB,CAAC,CAAY,CAAC;IACf,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,4BAA4B;QACrC,YAAY,EAAE,IAAI;KACnB,CAAC,CAAY,CAAC;IACf,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAoB;QAC5B,WAAW,EAAE,WAAqB;QAClC,OAAO;QACP,aAAa;QACb,SAAS;QACT,WAAW;QACX,OAAO;KACR,CAAC;IAEF,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAErB,MAAM,KAAK,GAAG;QACZ,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE;QACtC,EAAE;QACF,KAAK,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,4BAA4B;QACpD,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,uDAAuD;QAC7E,KAAK,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,mCAAmC;QAC/D,KAAK,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,mCAAmC;KACpE,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAqB;IAC3C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,cAAc,EACd,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CACxD,CAAC;IAEF,0BAA0B;IAC1B,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE;QAC/B,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC;KACpE,CAAC,CAAC;IAEH,2BAA2B;IAC3B,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAEhC,+EAA+E;IAC/E,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAElC,6EAA6E;IAC7E,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAE/C,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAErD,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACjD,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACjD,CAAC;IAED,kBAAkB;IAClB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CACJ,EAAE,CAAC,MAAM,CAAC,2EAA2E,CAAC,CACvF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACvE,mFAAmF;YACrF,CAAC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,CACT,KAAK,EACL,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,IAAI,CAAC,WAAW,kBAAkB,CAAC,EAC7E;gBACE,GAAG,EAAE,MAAM;aACZ,CACF,CAAC;YACF,+DAA+D;YAC/D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACvE,YAAY;YACd,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAG9C,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAGtC,CAAC;IACF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,GAAG,CAAC,YAAY,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,GAAG,CAAC,eAAe,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,WAAmB;IAC/D,MAAM,YAAY,GAAG;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC;KAC5D,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,SAAkB;IACtE,IAAI,CAAC,SAAS,IAAI,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAGtC,CAAC;IACF,iFAAiF;IACjF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,WAAW,GAA2B;QAC1C,CAAC,GAAG,aAAa,OAAO,CAAC,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;QAC/E,CAAC,GAAG,aAAa,KAAK,CAAC,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE;KAC5E,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAU,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,iBAAiB,CAAC,MAAc;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAE9B,0EAA0E;IAC1E,2EAA2E;IAC3E,6DAA6D;IAC7D,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAChC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACxE,IAAI,YAAY,GAAY,EAAE,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,uBAAuB,EAAE,+BAA+B,CAAC,CAAC;QAC3F,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,oCAAoC;IACpC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC,CAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAA6B;QAChE,CAAC,CAAE,EAA8B,CAAC;IACpC,6DAA6D;IAC7D,OAAO,QAAQ,CAAC,cAAc,CAAC;IAC/B,uCAAuC;IACvC,MAAM,WAAW,GAAI,YAAoC,CAAC,KAAK,CAAC;IAChE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,QAAQ,CAAC,KAAK,GAAG,WAAW,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@react-vault/create-app",
+  "version": "0.1.0",
+  "description": "Scaffold a new BFSI React project with security, audit, encryption, Tailwind, shadcn/ui, and a Claude Code companion baked in. Pick RTK Query or TanStack Query at scaffold time.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "bin": {
+    "create-app": "./bin/create-app.js"
+  },
+  "main": "./dist/index.js",
+  "files": [
+    "bin",
+    "dist",
+    "templates",
+    "claude-toolkit",
+    "README.md"
+  ],
+  "dependencies": {
+    "@clack/prompts": "0.7.0",
+    "picocolors": "1.0.0",
+    "fs-extra": "11.2.0",
+    "execa": "9.0.2"
+  },
+  "devDependencies": {
+    "@types/node": "20.11.30",
+    "@types/fs-extra": "11.0.4",
+    "typescript": "5.4.5",
+    "vitest": "1.6.0"
+  },
+  "engines": {
+    "node": ">=20.11.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/amar-josh/react-vault.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/amar-josh/react-vault#readme",
+  "bugs": {
+    "url": "https://github.com/amar-josh/react-vault/issues"
+  },
+  "keywords": [
+    "create-app",
+    "react",
+    "vite",
+    "bfsi",
+    "fintech",
+    "tailwind",
+    "shadcn",
+    "rtk-query",
+    "tanstack-query",
+    "claude-code",
+    "scaffolder",
+    "starter"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "eslint src --ext .ts --fix",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "clean": "rm -rf dist .tsbuildinfo templates claude-toolkit",
+    "bundle": "node ./scripts/bundle-for-publish.mjs"
+  }
+}

package/templates/_shared/.claude/settings.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "enabledPlugins": [
+    "toolkit@react-vault"
+  ],
+  "permissions": {
+    "deny": [
+      "Bash(rm -rf /*)",
+      "Bash(git push --force *main*)",
+      "Bash(git push --force *master*)",
+      "Bash(git push --force *production*)",
+      "Bash(git push --force *staging*)"
+    ],
+    "allow": [
+      "Bash(pnpm:*)",
+      "Bash(npx:*)",
+      "Bash(node:*)",
+      "Bash(git status:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git branch:*)",
+      "Bash(git show:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(git pull:*)",
+      "Bash(git fetch:*)",
+      "Bash(gh pr:*)",
+      "Bash(gh repo:*)"
+    ]
+  }
+}

package/templates/_shared/.env.local.sample

@@ -0,0 +1,25 @@
+# Copy this file to .env.local and fill in real values for your environment.
+# .env.local is gitignored — never commit real secrets.
+
+# --- API ---
+VITE_API_BASE_URL=https://api.example.com
+VITE_API_TIMEOUT_MS=30000
+
+# --- Auth ---
+VITE_AUTH_HEADER_NAME=Authorization
+
+# --- Audit ---
+VITE_AUDIT_ENDPOINT=/api/audit
+VITE_AUDIT_BATCH_SIZE=20
+VITE_AUDIT_FLUSH_INTERVAL_MS=5000
+
+# --- Observability (optional) ---
+# Sentry DSN — leave empty to disable
+VITE_SENTRY_DSN=
+
+# --- Session ---
+VITE_IDLE_TIMEOUT_MS=900000           # 15 minutes
+VITE_SENSITIVE_IDLE_TIMEOUT_MS=300000 # 5 minutes for transaction routes
+
+# --- Feature flags ---
+VITE_FEATURE_FLAGS_PROVIDER=local

package/templates/_shared/.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [main, staging]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      matrix:
+        node: [20]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 9
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: pnpm
+      - name: Install
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck
+        run: pnpm typecheck
+      - name: Lint
+        run: pnpm lint
+      - name: Test
+        run: pnpm test
+      - name: Build
+        run: pnpm build
+      - name: npm audit (high+)
+        run: pnpm audit --audit-level=high
+        continue-on-error: true
+      - name: Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package/templates/_shared/CLAUDE.md

@@ -0,0 +1,89 @@
+# CLAUDE.md — `{{projectName}}`
+
+BFSI React project scaffolded from `create-app`. This file is what Claude reads at session start, per the [Claude Code spec](https://code.claude.com/docs/best-practices).
+
+## Stack (so you don't have to read configs)
+
+- **React 18** + **Vite 5** + **TypeScript strict**
+- **Tailwind CSS** + **shadcn/ui** (components owned in `src/components/ui/`)
+- **React Hook Form** + **Zod** for forms
+- **react-router-dom v6** with `<ProtectedRoute permission="...">` guards
+- **react-i18next** (`en`, `hi` defaults)
+- Data layer: **RTK Query** OR **TanStack Query** — check `package.json` to confirm which
+- Tests: **Vitest** + **Testing Library**; E2E **Playwright**
+
+## Bash commands
+
+```bash
+pnpm dev                # vite dev server on :5173
+pnpm build              # tsc -b && vite build
+pnpm test               # vitest run
+pnpm test:watch         # vitest watch
+pnpm test:e2e           # playwright
+pnpm typecheck          # tsc -b --noEmit
+pnpm lint               # eslint, --max-warnings 0
+pnpm format             # prettier write
+```
+
+## Critical conventions (DO NOT violate)
+
+1. **Tokens never in `localStorage`.** Use `setAuthToken(axios, token)` from `@<scope>/core/http` at login — it lives in memory.
+2. **All API responses go through Zod `.parse()`.** No raw types. See the `rtk-query-api` or `tanstack-services` skill.
+3. **PII fields display via `<PIIMaskedDisplay>`.** Never render PAN/Aadhaar/account-number directly.
+4. **No card data in HTML inputs.** Use `<PCITokenizedCardInput>` (v0.2 — for now, flag any plain card input).
+5. **All routes are `<ProtectedRoute permission="...">`** with explicit permission strings (route to feature-permission mapping in `src/routes/`).
+6. **No `dangerouslySetInnerHTML`** unless explicitly sanitised. Pre-write hook will block it.
+7. **No `console.log` of PII variables** (PAN, Aadhaar, account, password, OTP). Post-write hook scans for this.
+8. **Conventional Commits with BFSI types**: `feat`, `fix`, `security`, `compliance`, `audit`, `perf`, `refactor`, `docs`, `style`, `test`, `build`, `ci`, `chore`. NO `Co-Authored-By` trailer.
+
+## Where things live
+
+```
+src/
+├── app/                    App.tsx, providers, globals.css
+├── routes/                 ProtectedRoute, route config
+├── features/<Feature>/     ALL feature code: api/schema/types/containers/components/tests
+├── shared/                 Cross-feature components (ErrorBoundary, NotFound)
+├── i18n/                   react-i18next setup + translations/en.json + hi.json
+├── utils/constants/        urls / routes / regex / tag-types / app constants
+├── env.ts                  Zod-validated env (throws at boot on bad config)
+└── main.tsx                Entry point
+```
+
+Variant-specific:
+
+- **RTK Query**: `src/axiosconfig/` (instance + interceptor + baseQuery), `src/redux/` (store + rootReducer + reduxHooks + invalidateCacheMiddleware)
+- **TanStack Query**: `src/api/` (axiosInstance + http + queryClient), `src/services/` (typed service methods)
+
+## Claude skills available
+
+Run `/skills` or open `.claude/skills/<name>/SKILL.md` directly. Reference skills auto-load when relevant; action skills are invoked with `/<name>`.
+
+**Always available** (from the toolkit): `/bfsi-feature`, `/bfsi-form`, `/bfsi-pii-field`, `/bfsi-api-endpoint`, `/bfsi-compliance-check`, `/bfsi-commit`, `/bfsi-doctor`, `/bfsi-onboarding`, `/bfsi-review`, `/bfsi-audit`.
+
+**Variant-specific** (in `.claude/skills/`):
+- RTK: `axios-auth`, `constants-organization`, `redux-store-integration`, `rtk-query-api`
+- TanStack: `axios-auth`, `constants-organization`, `tanstack-services`, `query-client-setup`
+
+## Auto-review on Stop
+
+A Stop hook runs a review sub-agent after every coding turn. If it finds P0 (security/PII/secrets) or P1 (convention violations) issues in the uncommitted diff, it'll show you the list and ask:
+
+1. **Fix all now** — Claude resolves every P0/P1 finding before stopping
+2. **Fix selected ones** — checkbox list, you pick which
+3. **Skip** — Claude stops; the findings list is yours to act on
+
+No prompt fires when the diff is clean, doc-only, or contains only P2 (style/naming) findings. To turn it off entirely, delete the second entry under `Stop` in `.claude/settings.json`.
+
+## Gotchas
+
+- `.env.local` is gitignored. If app fails at boot with a Zod error, copy `.env.local.sample` → `.env.local` and fill in real values.
+- `src/components/ui/` is shadcn-managed. Add components via `pnpm dlx shadcn-ui@latest add <component>` — don't hand-author there.
+- The dev server enforces tight security headers (X-Frame-Options: DENY, etc.). If iframe embedding fails in dev, that's why.
+- ESLint runs with `--max-warnings 0`. Warnings fail CI; fix them as they appear.
+
+## When something fails
+
+- Type error after `pnpm install` → `pnpm typecheck` to see all errors; the `@<scope>/core` and `@<scope>/ui` paths resolve via `link:` to the local workspace.
+- 401 in dev → check `setAuthToken(axiosInstance, token)` is called in the login mutation's `onQueryStarted` (RTK) or `onSuccess` (TanStack).
+- `/bfsi-doctor` fails on `.claude/settings.json $schema` → the correct URL is `https://json.schemastore.org/claude-code-settings.json`.