@zairakai/js-dev-tools 1.0.0

package/scripts/stylelint-fix.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/config.sh"
+
+EXTRA_IGNORES=()
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --ignore)     EXTRA_IGNORES+=("$2"); shift 2 ;;
+        --ignore=*)   EXTRA_IGNORES+=("${1#--ignore=}"); shift ;;
+        *)            shift ;;
+    esac
+done
+
+log_header "Stylelint Fix"
+
+ensure_bin_optional "$STYLELINT_BIN" "stylelint" || exit 0
+
+if [[ -n "$STYLELINT_CONFIG" ]]; then
+    log_step "Using configuration: ${STYLELINT_CONFIG#"$PROJECT_ROOT"/}"
+fi
+
+if [[ "$PROJECT_TYPE" == "laravel-app" ]]; then
+    STYLELINT_TARGET="${STYLELINT_TARGET:-resources/**/*.scss}"
+else
+    STYLELINT_TARGET="${STYLELINT_TARGET:-src/**/*.scss}"
+fi
+
+log_step "Fixing: $STYLELINT_TARGET"
+
+# Skip gracefully if no matching files exist
+if ! has_files "${PROJECT_ROOT}/${STYLELINT_TARGET}"; then
+    log_info "No SCSS/CSS files found matching ${STYLELINT_TARGET} — skipping"
+    exit 0
+fi
+
+STYLELINT_ARGS=(--fix)
+
+if [[ -n "$STYLELINT_CONFIG" ]] && [[ "$STYLELINT_CONFIG" != "${PROJECT_ROOT}/stylelint.config.js" ]]; then
+    STYLELINT_ARGS+=(--config "$STYLELINT_CONFIG")
+fi
+
+if [[ -n "$STYLELINT_IGNORE" ]]; then
+    STYLELINT_ARGS+=(--ignore-path "$STYLELINT_IGNORE")
+fi
+
+# Also respect .gitignore if present
+if [[ -f "${PROJECT_ROOT}/.gitignore" ]]; then
+    STYLELINT_ARGS+=(--ignore-path "${PROJECT_ROOT}/.gitignore")
+fi
+
+# Extra ignores passed via --ignore → temp file (gitignore format)
+if [[ ${#EXTRA_IGNORES[@]} -gt 0 ]]; then
+    _TMP_IGNORE=$(mktemp)
+    trap 'rm -f "$_TMP_IGNORE"' EXIT
+    printf '%s\n' "${EXTRA_IGNORES[@]}" > "$_TMP_IGNORE"
+    STYLELINT_ARGS+=(--ignore-path "$_TMP_IGNORE")
+fi
+
+"$STYLELINT_BIN" "${STYLELINT_ARGS[@]}" "$STYLELINT_TARGET"
+
+log_success "Stylelint fix applied"

package/scripts/stylelint.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/config.sh"
+
+EXTRA_IGNORES=()
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --ignore)     EXTRA_IGNORES+=("$2"); shift 2 ;;
+        --ignore=*)   EXTRA_IGNORES+=("${1#--ignore=}"); shift ;;
+        *)            shift ;;
+    esac
+done
+
+log_header "Stylelint Check"
+
+# Stylelint is optional — skip gracefully if not installed
+ensure_bin_optional "$STYLELINT_BIN" "stylelint" || exit 0
+
+if [[ -n "$STYLELINT_CONFIG" ]]; then
+    log_step "Using configuration: ${STYLELINT_CONFIG#"$PROJECT_ROOT"/}"
+fi
+
+# Lint target depends on project type (overridable via env)
+if [[ "$PROJECT_TYPE" == "laravel-app" ]]; then
+    STYLELINT_TARGET="${STYLELINT_TARGET:-resources/**/*.scss}"
+else
+    STYLELINT_TARGET="${STYLELINT_TARGET:-src/**/*.scss}"
+fi
+
+log_step "Checking: $STYLELINT_TARGET"
+
+# Skip gracefully if no matching files exist (stylelint v16 errors on empty glob)
+if ! has_files "${PROJECT_ROOT}/${STYLELINT_TARGET}"; then
+    log_info "No SCSS/CSS files found matching ${STYLELINT_TARGET} — skipping"
+    exit 0
+fi
+
+STYLELINT_ARGS=()
+
+if [[ -n "$STYLELINT_CONFIG" ]] && [[ "$STYLELINT_CONFIG" != "${PROJECT_ROOT}/stylelint.config.js" ]]; then
+    STYLELINT_ARGS+=(--config "$STYLELINT_CONFIG")
+fi
+
+if [[ -n "$STYLELINT_IGNORE" ]]; then
+    STYLELINT_ARGS+=(--ignore-path "$STYLELINT_IGNORE")
+fi
+
+# Also respect .gitignore if present
+if [[ -f "${PROJECT_ROOT}/.gitignore" ]]; then
+    STYLELINT_ARGS+=(--ignore-path "${PROJECT_ROOT}/.gitignore")
+fi
+
+# Extra ignores passed via --ignore → temp file (gitignore format)
+if [[ ${#EXTRA_IGNORES[@]} -gt 0 ]]; then
+    _TMP_IGNORE=$(mktemp)
+    trap 'rm -f "$_TMP_IGNORE"' EXIT
+    printf '%s\n' "${EXTRA_IGNORES[@]}" > "$_TMP_IGNORE"
+    STYLELINT_ARGS+=(--ignore-path "$_TMP_IGNORE")
+fi
+
+"$STYLELINT_BIN" "${STYLELINT_ARGS[@]}" "$STYLELINT_TARGET"
+
+log_success "Stylelint check passed"

package/scripts/test.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/config.sh"
+
+log_header "Vitest Tests"
+
+if ! ensure_bin_optional "$VITEST_BIN" "vitest"; then
+    log_warning "vitest not installed — add it to devDependencies to run tests"
+    exit 0
+fi
+
+COVERAGE="${COVERAGE:-false}"
+CI="${CI:-false}"
+
+# CI mode: always run with coverage
+if [[ "$CI" == "true" ]]; then
+    log_info "Running in CI mode (strict + coverage)"
+    COVERAGE="true"
+fi
+
+VITEST_ARGS=()
+
+if [[ -n "$VITEST_CONFIG" ]]; then
+    log_step "Using configuration: ${VITEST_CONFIG#"$PROJECT_ROOT"/}"
+    VITEST_ARGS+=(--config "$VITEST_CONFIG")
+fi
+
+if [[ "$COVERAGE" == "true" ]]; then
+    log_info "Running with coverage report"
+    ensure_dir "build/coverage"
+    ensure_dir "build/logs"
+    "$VITEST_BIN" run --coverage --passWithNoTests "${VITEST_ARGS[@]}"
+else
+    "$VITEST_BIN" run --passWithNoTests "${VITEST_ARGS[@]}"
+fi
+
+log_success "Tests passed"

package/scripts/typecheck.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+#
+# TypeScript Type Checking (tsc --noEmit)
+# Validates types without emitting output files.
+# Equivalent to PHPStan for TypeScript.
+#
+# Usage:
+#   bash scripts/typecheck.sh
+#
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+source "${SCRIPT_DIR}/config.sh"
+
+TSC_BIN="${BIN_DIR}/tsc"
+
+log_header "TypeScript Type Checking"
+
+ensure_bin "$TSC_BIN" "tsc (typescript)"
+
+if [[ ! -f "${PROJECT_ROOT}/tsconfig.json" ]]; then
+    log_error "No tsconfig.json found at project root"
+    log_info "Publish one with:"
+    log_info "  bash node_modules/@zairakai/js-dev-tools/scripts/setup-project.sh --publish=tsconfig"
+    exit 1
+fi
+
+log_info "Config: tsconfig.json"
+log_info "Mode: --noEmit (type validation only)"
+
+# Skip gracefully if no .ts files are found
+if ! has_files "${PROJECT_ROOT}/**/*.ts" && ! has_files "${PROJECT_ROOT}/**/*.tsx"; then
+    log_info "No TypeScript files found — skipping"
+    exit 0
+fi
+
+"$TSC_BIN" --noEmit
+
+log_success "TypeScript type checking passed"

package/scripts/validate-shellcheck.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# scripts/validate-shellcheck.sh
+# Runs ShellCheck validation on all shell scripts (100% compliance required)
+#
+# Usage:
+#   bash scripts/validate-shellcheck.sh
+#
+# Environment Variables:
+#   SHELLCHECK_SEVERITY - Severity level (default: warning)
+#   SHELLCHECK_FORMAT   - Output format (default: gcc)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+source "${SCRIPT_DIR}/config.sh"
+
+SEVERITY="${SHELLCHECK_SEVERITY:-warning}"
+FORMAT="${SHELLCHECK_FORMAT:-gcc}"
+
+log_header "Running ShellCheck Validation"
+log_info "Severity: ${SEVERITY}"
+log_info "Format: ${FORMAT}"
+
+if ! command_exists shellcheck; then
+    log_error "ShellCheck not found. Please install shellcheck."
+    log_info "  Alpine: apk add shellcheck"
+    log_info "  Debian/Ubuntu: apt-get install shellcheck"
+    log_info "  macOS: brew install shellcheck"
+    exit 1
+fi
+
+SHELLCHECK_VERSION="$(shellcheck --version | grep "version:" | awk '{print $2}')"
+log_info "ShellCheck version: ${SHELLCHECK_VERSION}"
+
+log_info "→ Finding shell scripts…"
+
+mapfile -t SHELL_SCRIPTS < <(find . \( -name "*.sh" -o -name "*.bats" \) -type f ! -path "*/node_modules/*" ! -path "*/dist/*" ! -path "*/build/*")
+
+SCRIPT_COUNT=${#SHELL_SCRIPTS[@]}
+log_info "Found ${SCRIPT_COUNT} shell scripts"
+
+if [[ ${SCRIPT_COUNT} -eq 0 ]]; then
+    log_warning "No shell scripts found"
+    exit 0
+fi
+
+log_info "→ Running ShellCheck validation…"
+
+FAILED=0
+TOTAL=0
+
+for script in "${SHELL_SCRIPTS[@]}"; do
+    TOTAL=$((TOTAL + 1))
+
+    if shellcheck --severity="${SEVERITY}" --format="${FORMAT}" "${script}"; then
+        :
+    else
+        log_error "  ✗ ${script} — ShellCheck failed"
+        FAILED=$((FAILED + 1))
+    fi
+done
+
+if [[ ${FAILED} -eq 0 ]]; then
+    log_success "All ${TOTAL} scripts passed ShellCheck"
+    exit 0
+else
+    log_error "${FAILED}/${TOTAL} scripts failed ShellCheck"
+    exit 1
+fi

package/stubs/githooks/commit-msg

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+#
+# Zairakai Git Hooks - Commit Message Validator
+# Ensures commit messages follow Conventional Commits format
+#
+# To bypass (emergency only):
+#   git commit --no-verify
+
+set -euo pipefail
+
+# ANSI Colors
+RED='\033[0;31m'
+NC='\033[0m'
+
+COMMIT_MSG_FILE=$1
+COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
+
+# Conventional Commits regex
+# Format: <type>(<scope>): <subject>
+CONVENTIONAL_RE='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert|init)(\(.+\))?!?: .+$'
+
+if [[ ! $COMMIT_MSG =~ $CONVENTIONAL_RE ]]; then
+    echo ""
+    echo -e "${RED}❌ Invalid commit message format!${NC}"
+    echo ""
+    echo "Commit messages must follow Conventional Commits:"
+    echo "  feat: add new feature"
+    echo "  fix: resolve a bug"
+    echo "  chore(deps): update dependencies"
+    echo ""
+    echo "See: https://www.conventionalcommits.org/"
+    echo ""
+    exit 1
+fi

package/stubs/githooks/pre-commit

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+#
+# Zairakai Git Hooks - Pre-Commit Quality Checks
+# Runs quick quality checks before allowing commit
+#
+# To bypass (emergency only):
+#   git commit --no-verify
+
+set -euo pipefail
+
+# ANSI Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+echo ""
+echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${CYAN}  Pre-Commit Quality Checks${NC}"
+echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+
+# Navigate to project root
+PROJECT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"
+cd "$PROJECT_ROOT"
+
+# Check if make is available
+if ! command -v make &>/dev/null; then
+    echo -e "${RED}❌ make not found - skipping quality checks${NC}"
+    echo ""
+    exit 0
+fi
+
+# Run fast quality checks (eslint + prettier + markdown)
+echo -e "${BLUE}→${NC} Running: ${CYAN}make quality-fast${NC}"
+echo ""
+
+if make quality-fast; then
+    echo ""
+    echo -e "${GREEN}✅ Quality checks passed - commit allowed${NC}"
+    echo ""
+    exit 0
+else
+    echo ""
+    echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+    echo -e "${RED}  ❌ Quality checks failed!${NC}"
+    echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+    echo ""
+    echo -e "${YELLOW}Fix issues with:${NC}"
+    echo -e "  ${CYAN}make quality-fix${NC}  ${YELLOW}# Auto-fix what can be fixed${NC}"
+    echo ""
+    echo -e "${YELLOW}Or bypass (NOT recommended):${NC}"
+    echo -e "  ${CYAN}git commit --no-verify${NC}"
+    echo ""
+    exit 1
+fi

package/stubs/githooks/pre-push

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+#
+# Zairakai Git Hooks - Pre-Push Quality Gate
+# Runs full quality checks and tests before allowing push
+#
+# To bypass (emergency only):
+#   git push --no-verify
+
+set -euo pipefail
+
+# ANSI Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+echo ""
+echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${CYAN}  Pre-Push Quality Gate${NC}"
+echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+
+# Navigate to project root
+PROJECT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"
+cd "$PROJECT_ROOT"
+
+# Check if make is available
+if ! command -v make &>/dev/null; then
+    echo -e "${RED}❌ make not found - skipping quality checks${NC}"
+    echo ""
+    exit 0
+fi
+
+# Run full quality gate (quality + tests)
+echo -e "${BLUE}→${NC} Running: ${CYAN}make ci${NC}"
+echo ""
+
+if make ci; then
+    echo ""
+    echo -e "${GREEN}✅ All quality gates passed - push allowed${NC}"
+    echo ""
+    exit 0
+else
+    echo ""
+    echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+    echo -e "${RED}  ❌ Quality gate failed!${NC}"
+    echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+    echo ""
+    echo -e "${YELLOW}Fix issues or run local tests before pushing.${NC}"
+    echo ""
+    echo -e "${YELLOW}Or bypass (NOT recommended):${NC}"
+    echo -e "  ${CYAN}git push --no-verify${NC}"
+    echo ""
+    exit 1
+fi

package/stubs/githooks/prepare-commit-msg

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+#
+# Zairakai Git Hooks - Commit Message Preparer
+# Auto-prefixes the ticket number from branch name (e.g. feature/ABC-123 -> ABC-123: )
+#
+
+set -euo pipefail
+
+COMMIT_MSG_FILE=$1
+BRANCH_NAME=$(git symbolic-ref --short HEAD 2>/dev/null || true)
+
+# Skip for special commits
+COMMIT_SOURCE=${2:-}
+if [[ "$COMMIT_SOURCE" == "merge" || "$COMMIT_SOURCE" == "squash" || "$COMMIT_SOURCE" == "message" ]]; then
+    exit 0
+fi
+
+# Extract ticket number (Jira/GitLab style: PROJECT-123)
+TICKET_RE='[A-Z]+-[0-9]+'
+if [[ $BRANCH_NAME =~ $TICKET_RE ]]; then
+    TICKET="${BASH_REMATCH[0]}"
+    COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
+
+    # Only prefix if not already present
+    if [[ ! $COMMIT_MSG =~ $TICKET ]]; then
+        # If it's a conventional commit type: subject format, inject after type:
+        # Before: feat: my change
+        # After: feat(ABC-123): my change
+        CONVENTIONAL_RE='^([a-z]+)(\(.*\))?!?: (.+)$'
+        if [[ $COMMIT_MSG =~ $CONVENTIONAL_RE ]]; then
+            TYPE="${BASH_REMATCH[1]}"
+            REMAINDER="${BASH_REMATCH[3]}"
+            echo "${TYPE}(${TICKET}): ${REMAINDER}" > "$COMMIT_MSG_FILE"
+        else
+            # Fallback: simple prefix
+            echo "${TICKET}: ${COMMIT_MSG}" > "$COMMIT_MSG_FILE"
+        fi
+    fi
+fi

package/stubs/gitlab-ci/gitlab-ci.yml.stub

@@ -0,0 +1,18 @@
+# .gitlab-ci.yml
+# Generated by @zairakai/js-dev-tools setup-project.sh
+# Inherits the full shared template — only project-specific variables are defined here.
+#
+# To regenerate:
+#   bash node_modules/@zairakai/js-dev-tools/scripts/setup-project.sh --publish=gitlab-ci --force
+
+include:
+  - project: 'zairakai/npm-packages/js-dev-tools'
+    ref: v0.0.0
+    file: '.gitlab/ci/pipeline-js-package.yml'
+
+variables:
+  # Unique cache key for this project (update suffix when changing dependencies)
+  CACHE_KEY: "PACKAGE_CACHE_KEY"
+
+  # Full package name on npm (used in the GitLab release link)
+  NPM_PACKAGE_NAME: "PACKAGE_NPM_NAME"

package/stubs/gitlab-ci/gitlab-pipeline-js-app.yml.stub

@@ -0,0 +1,16 @@
+# .gitlab/pipeline-js-app.yml
+# JavaScript/Frontend CI jobs for this Laravel application.
+# Generated by @zairakai/js-dev-tools setup-project.sh
+# Included from .gitlab-ci.yml via: include: - local: '.gitlab/pipeline-js-app.yml'
+#
+# To regenerate:
+#   bash node_modules/@zairakai/js-dev-tools/scripts/setup-project.sh --publish=gitlab-ci --force
+
+include:
+  - project: 'zairakai/npm-packages/js-dev-tools'
+    ref: v0.0.0
+    file: '.gitlab/ci/pipeline-js-app.yml'
+
+variables:
+  # Unique JS cache key for this project
+  CACHE_KEY: "PACKAGE_CACHE_KEY"

package/stubs/governance/CODE_OF_CONDUCT.md.stub

@@ -0,0 +1,8 @@
+# Code of Conduct
+
+> This project adheres to the [Zairakai Code of Conduct][handbook-coc].
+>
+> Instances of abusive, harassing, or otherwise unacceptable behavior may be reported
+> by contacting the project team at `contact@the-white-rabbits.fr`.
+
+[handbook-coc]: https://gitlab.com/zairakai/handbook/-/blob/main/CODE_OF_CONDUCT.md

package/stubs/governance/CONTRIBUTING.md.stub

@@ -0,0 +1,39 @@
+# Contributing
+
+> This project follows the [Zairakai Global Contributing Guide][handbook-contributing].  
+> Please read it before contributing. The sections below document project-specific workflow.
+
+---
+
+## Development Workflow
+
+| Step | Command / Action | Description |
+| :--- | :--- | :--- |
+| **1. Install** | `npm install && bash scripts/install-hooks.sh` | Install dependencies and set up git hooks. |
+| **2. Branch** | `git checkout -b feature/#TICKET-name` | Create a feature branch from `main`. |
+| **3. Code** | *(your IDE)* | Implement your changes following quality standards. |
+| **4. Quality** | `make quality` | Run the full quality gate. |
+| **5. Test** | `make test-all` | Ensure all tests (Vitest + BATS) are passing. |
+| **6. Commit** | `git commit -m "type(scope): #TICKET subject"` | Use [Conventional Commits][git-rules] format. |
+| **7. Push** | `git push origin feature/#TICKET-name` | Push and open a Merge Request to `main`. |
+
+---
+
+## Quality Targets
+
+| Command | Tool | Description |
+| :--- | :--- | :--- |
+| `make quality` | All | Full static analysis and formatting gate. |
+| `make eslint` | ESLint | Run JS/TS static analysis. |
+| `make prettier` | Prettier | Check code formatting. |
+| `make stylelint` | Stylelint | Run SCSS/CSS static analysis. |
+| `make typecheck` | TSC | Run TypeScript type checking. |
+| `make markdownlint` | Markdownlint | Validate Markdown documentation. |
+| `make test` | Vitest | Run unit tests with coverage. |
+| `make bats` | BATS | Run shell script integration tests. |
+
+---
+
+[handbook-contributing]: https://gitlab.com/zairakai/handbook/-/blob/main/CONTRIBUTING.md
+[git-rules]: https://gitlab.com/zairakai/handbook/-/blob/main/policies/git-rules.md
+[issues]: PACKAGE_GITLAB_ISSUES

package/stubs/governance/SECURITY.md.stub

@@ -0,0 +1,41 @@
+# Security Policy
+
+> This project follows the [Zairakai Global Security Policy][handbook-security].  
+> Please refer to it for standard protections, response timeline, and contact information.
+
+---
+
+## 🔒 Reporting Vulnerabilities
+
+| Channel | Description | Contact / Link |
+| :--- | :--- | :--- |
+| **GitLab Issues** | For non-sensitive issues (bugs, public vulnerabilities). | [Open Issue][issues] |
+| **Service Desk** | Preferred channel for sensitive reports. | `TODO: add your project service desk email` |
+| **Email** | Alternative secure contact. | `security@the-white-rabbits.fr` |
+
+Please **do not disclose vulnerabilities publicly** until they have been reviewed.
+
+---
+
+## 🛡️ Security Features
+
+### Protection Layers
+
+| Layer | Security Protection |
+| :--- | :--- |
+| **Static Analysis** | Strict TypeScript configs and ESLint security rules. |
+| **Execution** | Controlled shell execution via `config.sh` and `scripts/`. |
+| **Filesystem** | Non-destructive defaults for file generation and publishing. |
+| **Git Hooks** | Isolated quality enforcement in project scope (`.githooks`). |
+| **CI Pipeline** | Automated secret detection and ShellCheck validation. |
+
+---
+
+## 🔍 Security Scope
+
+<!-- TODO: describe what this package interacts with (filesystem, network, shell, etc.) -->
+
+---
+
+[handbook-security]: https://gitlab.com/zairakai/handbook/-/blob/main/SECURITY.md
+[issues]: PACKAGE_GITLAB_ISSUES

package/stubs/quality/eslint.config.js.stub

@@ -0,0 +1,18 @@
+/**
+ * Project ESLint configuration.
+ * Extends the @zairakai/js-dev-tools base config — customize as needed.
+ *
+ * Example of adding project-specific rules:
+ *   export default [
+ *     ...baseConfig,
+ *     {
+ *       rules: {
+ *         'no-console': 'warn',
+ *       },
+ *     },
+ *   ]
+ */
+
+import baseConfig from '@zairakai/js-dev-tools/config/eslint.config.js'
+
+export default [...baseConfig]

package/stubs/quality/knip.config.js.stub

@@ -0,0 +1,14 @@
+/**
+ * Knip configuration
+ * @see https://knip.dev/reference/configuration
+ */
+export default {
+  // Extend the base configuration from @zairakai/js-dev-tools
+  // (Assuming the base config is compatible or you want to start fresh)
+  // For now, we point to the project structure
+  entry: ['src/index.ts!', 'src/index.js!'],
+  project: ['src/**/*.ts!', 'src/**/*.js!'],
+  ignore: ['**/*.d.ts'],
+  ignoreDependencies: [],
+  ignoreBinaries: [],
+}

package/stubs/style/prettier.config.js.stub

@@ -0,0 +1,16 @@
+/**
+ * Project Prettier configuration.
+ * Extends the @zairakai/js-dev-tools base config — customize as needed.
+ *
+ * Example of adding project-specific overrides:
+ *   module.exports = {
+ *     ...baseConfig,
+ *     printWidth: 100,
+ *   }
+ */
+
+const baseConfig = require('@zairakai/js-dev-tools/config/prettier.config.js')
+
+module.exports = {
+  ...baseConfig,
+}

package/stubs/style/stylelint.config.js.stub

@@ -0,0 +1,17 @@
+/**
+ * Project Stylelint configuration.
+ * Extends the @zairakai/js-dev-tools base config — customize as needed.
+ *
+ * Example of adding project-specific rules:
+ *   export default {
+ *     ...baseConfig,
+ *     rules: {
+ *       ...baseConfig.rules,
+ *       'color-no-invalid-hex': true,
+ *     },
+ *   }
+ */
+
+import baseConfig from '@zairakai/js-dev-tools/config/stylelint.config.js'
+
+export default { ...baseConfig }