bank20baht-cli 0.3.0 → 0.3.1

package/README.md

@@ -45,7 +45,8 @@ eslint.config.ts     ESLint 10 + typescript-eslint + eslint-config-prettier
 .prettierrc          no semicolons, single quotes, printWidth 100
 knip.json            dead-code / unused-dependency checks
 commitlint.config.js Conventional Commits
-.husky/              pre-commit → lint-staged · commit-msg → commitlint · pre-push → bun run check
+.husky/              pre-commit → gitleaks + lint-staged · commit-msg → commitlint · pre-push → bun run check:fast
+.gitleaks.toml · .jscpd.json · .dependency-cruiser.cjs · renovate.json · .github/ (CI: lint, typecheck, knip/madge/deps, dup, test, build, gitleaks, audit, commitlint)
 scripts/dev.ts       runs every apps/*/ "dev" script in parallel with prefixed output
 scripts/each.ts      `bun run scripts/each.ts <script>` in every workspace that defines it
 .mcp.json, CLAUDE.md zvec_grep code-search MCP wiring for Claude Code

package/dist/application/create.js

@@ -1,24 +1,13 @@
 import { planCreate, PRESET_TEMPLATE_SET } from '../domain/create-plan.js';
 import { validateProjectName } from '../domain/naming.js';
-export function runCreate(input, deps) {
-    const errors = validateProjectName(input.name);
-    if (errors.length > 0) {
-        for (const e of errors)
-            deps.log.error(e);
-        throw new CreateError('Invalid project name.');
-    }
-    const blueprint = planCreate(input, deps.templates.load(PRESET_TEMPLATE_SET[input.preset]), (raw, data) => deps.renderer.render(raw, data));
-    if (input.dryRun) {
-        deps.log.info(`dry-run — would create in ${blueprint.root}:`);
-        for (const f of blueprint.files)
-            deps.log.info(`  ${f.path}`);
-        for (const c of blueprint.postCommands)
-            deps.log.info(`  $ ${c.cmd} ${c.args.join(' ')}`);
-        return;
-    }
-    deps.writer.ensureUsableDir(blueprint.root, input.force);
-    deps.writer.writeFiles(blueprint);
-    deps.log.step(`${blueprint.files.length} files written to ${blueprint.root}`);
+function logDryRun(blueprint, deps) {
+    deps.log.info(`dry-run — would create in ${blueprint.root}:`);
+    for (const f of blueprint.files)
+        deps.log.info(`  ${f.path}`);
+    for (const c of blueprint.postCommands)
+        deps.log.info(`  $ ${c.cmd} ${c.args.join(' ')}`);
+}
+function runPostCommands(blueprint, input, deps) {
     for (const c of blueprint.postCommands) {
         deps.log.step(c.label);
         try {
@@ -29,6 +18,8 @@ export function runCreate(input, deps) {
             throw new CreateError(`${err instanceof Error ? err.message : String(err)}\nproject files are written — cd ${input.name} and rerun: ${retry}`);
         }
     }
+}
+function logNextSteps(input, deps) {
     deps.log.info('');
     deps.log.info(`Done. Next:`);
     deps.log.info(`  cd ${input.name}`);
@@ -37,6 +28,24 @@ export function runCreate(input, deps) {
     for (const line of NEXT_STEPS[input.preset])
         deps.log.info(`  ${line}`);
 }
+export function runCreate(input, deps) {
+    const errors = validateProjectName(input.name);
+    if (errors.length > 0) {
+        for (const e of errors)
+            deps.log.error(e);
+        throw new CreateError('Invalid project name.');
+    }
+    const blueprint = planCreate(input, deps.templates.load(PRESET_TEMPLATE_SET[input.preset]), (raw, data) => deps.renderer.render(raw, data));
+    if (input.dryRun) {
+        logDryRun(blueprint, deps);
+        return;
+    }
+    deps.writer.ensureUsableDir(blueprint.root, input.force);
+    deps.writer.writeFiles(blueprint);
+    deps.log.step(`${blueprint.files.length} files written to ${blueprint.root}`);
+    runPostCommands(blueprint, input, deps);
+    logNextSteps(input, deps);
+}
 const NEXT_STEPS = {
     full: [
         'bun run dev        # web :5173 + api :3001',
@@ -45,7 +54,7 @@ const NEXT_STEPS = {
     workspace: [
         'mkdir -p apps/<name> && add a package.json with dev/build/typecheck scripts',
         'bun run dev        # runs every apps/*/ dev script in parallel',
-        'bun run check      # lint + format:check + knip + typecheck',
+        'bun run check      # lint + format:check + typecheck + madge + deps + knip + dup + build + test',
     ],
 };
 export class CreateError extends Error {

package/dist/args.js

@@ -0,0 +1,48 @@
+/** Boolean flags recognized anywhere on the command line (no value). */
+export const KNOWN_FLAGS = new Set([
+    '-v',
+    '--version',
+    '-h',
+    '--help',
+    '--dry-run',
+    '--force',
+    '--no-install',
+    '--no-git',
+    '--skip-install',
+    '--skip-git',
+]);
+/**
+ * Value-carrying flags pulled out before positional parsing. Supports both
+ * `--flag value` and `--flag=value`. If the token after `--flag value` looks
+ * like another flag (starts with `-`), the option is treated as missing
+ * rather than swallowing that flag as the value.
+ */
+export function takeOption(argv, flag) {
+    const eqPrefix = `${flag}=`;
+    const eqIndex = argv.findIndex((a) => a.startsWith(eqPrefix));
+    if (eqIndex !== -1) {
+        const value = argv[eqIndex].slice(eqPrefix.length);
+        argv.splice(eqIndex, 1);
+        return value;
+    }
+    const i = argv.indexOf(flag);
+    if (i === -1)
+        return undefined;
+    const value = argv[i + 1];
+    if (value === undefined || value.startsWith('-')) {
+        argv.splice(i, 1);
+        return undefined;
+    }
+    argv.splice(i, 2);
+    return value;
+}
+export function parseArgs(rawArgv) {
+    const argv = [...rawArgv];
+    const fields = takeOption(argv, '--fields');
+    const frontend = takeOption(argv, '--frontend');
+    const backend = takeOption(argv, '--backend');
+    const args = argv.filter((a) => !a.startsWith('-'));
+    const flags = new Set(argv.filter((a) => a.startsWith('-')));
+    const [command, name, sub] = args;
+    return { fields, frontend, backend, flags, command, name, sub };
+}

package/dist/cli.js

@@ -9,11 +9,12 @@ import { TemplateRenderer } from './infrastructure/template-renderer.js';
 import { DiskFileWriter } from './infrastructure/fs-writer.js';
 import { DiskFileReader } from './infrastructure/fs-reader.js';
 import { ShellRunner } from './infrastructure/shell-runner.js';
+import { KNOWN_FLAGS, parseArgs } from './args.js';
 const HELP = `bahtui — bun-workspace DDD scaffolding (React + Elysia + Eden)
 
 Usage:
   bahtui new <name> [options]           bare bun workspace in ./<name> — toolchain only
-                                        (eslint, prettier, knip, husky, commitlint), no apps
+                                        (eslint, prettier, knip, husky, commitlint, gitleaks, jscpd, depcruise, CI), no apps
   bahtui create <name> [options]        full monorepo in ./<name> (React + Elysia + Eden)
   bahtui init [options]                 write bahtui.json into an existing repo
   bahtui g model <domain>               libs/domain/<d>/model package
@@ -39,56 +40,18 @@ function version() {
     return JSON.parse(readFileSync(pkg, 'utf8')).version;
 }
 const log = {
-    info: (m) => console.log(m),
-    step: (m) => console.log(`• ${m}`),
-    error: (m) => console.error(`✖ ${m}`),
+    info: (m) => {
+        console.log(m);
+    },
+    step: (m) => {
+        console.log(`• ${m}`);
+    },
+    error: (m) => {
+        console.error(`✖ ${m}`);
+    },
 };
-/** Boolean flags recognized anywhere on the command line (no value). */
-const KNOWN_FLAGS = new Set([
-    '-v',
-    '--version',
-    '-h',
-    '--help',
-    '--dry-run',
-    '--force',
-    '--no-install',
-    '--no-git',
-    '--skip-install',
-    '--skip-git',
-]);
-/**
- * Value-carrying flags pulled out before positional parsing. Supports both
- * `--flag value` and `--flag=value`. If the token after `--flag value` looks
- * like another flag (starts with `-`), the option is treated as missing
- * rather than swallowing that flag as the value.
- */
-function takeOption(argv, flag) {
-    const eqPrefix = `${flag}=`;
-    const eqIndex = argv.findIndex((a) => a.startsWith(eqPrefix));
-    if (eqIndex !== -1) {
-        const value = argv[eqIndex].slice(eqPrefix.length);
-        argv.splice(eqIndex, 1);
-        return value;
-    }
-    const i = argv.indexOf(flag);
-    if (i === -1)
-        return undefined;
-    const value = argv[i + 1];
-    if (value === undefined || value.startsWith('-')) {
-        argv.splice(i, 1);
-        return undefined;
-    }
-    argv.splice(i, 2);
-    return value;
-}
-function main(rawArgv) {
-    const argv = [...rawArgv];
-    const fields = takeOption(argv, '--fields');
-    const frontend = takeOption(argv, '--frontend');
-    const backend = takeOption(argv, '--backend');
-    const args = argv.filter((a) => !a.startsWith('-'));
-    const flags = new Set(argv.filter((a) => a.startsWith('-')));
-    const [command, name, sub] = args;
+/** Handles unknown flags, --version and --help; null = carry on. */
+function preflight({ flags }) {
     const unknownFlags = [...flags].filter((f) => !KNOWN_FLAGS.has(f));
     if (unknownFlags.length > 0) {
         log.error(`Unknown flag${unknownFlags.length > 1 ? 's' : ''}: ${unknownFlags.join(', ')}`);
@@ -108,67 +71,89 @@ function main(rawArgv) {
         log.info(HELP);
         return 0;
     }
-    if (command === undefined) {
-        log.error('No command given — see usage below.');
-        log.error(HELP);
+    return null;
+}
+function commandCreate(a, command) {
+    if (!a.name) {
+        log.error(`${command} needs a project name: bahtui ${command} <name>`);
+        return 1;
+    }
+    runCreate({
+        name: a.name,
+        preset: command === 'new' ? 'workspace' : 'full',
+        targetDir: resolve(process.cwd(), a.name),
+        install: !a.flags.has('--no-install') && !a.flags.has('--skip-install'),
+        git: !a.flags.has('--no-git') && !a.flags.has('--skip-git'),
+        dryRun: a.flags.has('--dry-run'),
+        force: a.flags.has('--force'),
+    }, {
+        templates: new DiskTemplateSource(),
+        renderer: new TemplateRenderer(),
+        writer: new DiskFileWriter(),
+        runner: new ShellRunner(),
+        log,
+    });
+    return 0;
+}
+function commandInit(a, generateDeps) {
+    runInit({
+        root: process.cwd(),
+        frontend: a.frontend === 'none' ? null : 'react',
+        backend: a.backend === 'none' ? null : 'elysia',
+        dryRun: a.flags.has('--dry-run'),
+        force: a.flags.has('--force'),
+    }, generateDeps);
+    return 0;
+}
+function commandGenerate(a, generateDeps) {
+    const { name, sub } = a;
+    if (name !== 'model' && name !== 'form') {
+        log.error('Unknown generator — bahtui g model <domain> | g form <domain>/<name>.');
+        return 1;
+    }
+    if (!sub) {
+        log.error(`g ${name} needs a target: bahtui g ${name} <${name === 'model' ? 'domain' : 'domain/name'}>`);
         return 1;
     }
-    const dryRun = flags.has('--dry-run');
-    const force = flags.has('--force');
+    runGenerate({
+        root: process.cwd(),
+        kind: name,
+        target: sub,
+        fields: a.fields,
+        dryRun: a.flags.has('--dry-run'),
+        force: a.flags.has('--force'),
+    }, generateDeps);
+    return 0;
+}
+function dispatch(a, command) {
     const generateDeps = {
         reader: new DiskFileReader(),
         writer: new DiskFileWriter(),
         log,
     };
-    try {
-        if (command === 'create' || command === 'new') {
-            if (!name) {
-                log.error(`${command} needs a project name: bahtui ${command} <name>`);
-                return 1;
-            }
-            runCreate({
-                name,
-                preset: command === 'new' ? 'workspace' : 'full',
-                targetDir: resolve(process.cwd(), name),
-                install: !flags.has('--no-install') && !flags.has('--skip-install'),
-                git: !flags.has('--no-git') && !flags.has('--skip-git'),
-                dryRun,
-                force,
-            }, {
-                templates: new DiskTemplateSource(),
-                renderer: new TemplateRenderer(),
-                writer: new DiskFileWriter(),
-                runner: new ShellRunner(),
-                log,
-            });
-            return 0;
-        }
-        if (command === 'init') {
-            runInit({
-                root: process.cwd(),
-                frontend: frontend === 'none' ? null : 'react',
-                backend: backend === 'none' ? null : 'elysia',
-                dryRun,
-                force,
-            }, generateDeps);
-            return 0;
-        }
-        if (command === 'g') {
-            if (name !== 'model' && name !== 'form') {
-                log.error('Unknown generator — bahtui g model <domain> | g form <domain>/<name>.');
-                return 1;
-            }
-            if (!sub) {
-                log.error(`g ${name} needs a target: bahtui g ${name} <${name === 'model' ? 'domain' : 'domain/name'}>`);
-                return 1;
-            }
-            runGenerate({ root: process.cwd(), kind: name, target: sub, fields, dryRun, force }, generateDeps);
-            return 0;
-        }
-        log.error(`Unknown command "${command}".`);
+    if (command === 'create' || command === 'new')
+        return commandCreate(a, command);
+    if (command === 'init')
+        return commandInit(a, generateDeps);
+    if (command === 'g')
+        return commandGenerate(a, generateDeps);
+    log.error(`Unknown command "${command}".`);
+    log.error(HELP);
+    return 1;
+}
+function main(rawArgv) {
+    const parsed = parseArgs(rawArgv);
+    const early = preflight(parsed);
+    if (early !== null)
+        return early;
+    if (parsed.command === undefined) {
+        log.error('No command given — see usage below.');
         log.error(HELP);
         return 1;
     }
+    try {
+        return dispatch(parsed, parsed.command);
+    }
     catch (err) {
         log.error(err instanceof CreateError || err instanceof GenerateError ? err.message : String(err));
         return 1;

package/dist/domain/form-dsl.js

@@ -37,51 +37,55 @@ function parseNumberMod(name, raw, part) {
     }
     return n;
 }
+function parseOptionsMod(mod, part) {
+    const opts = mod
+        .slice('options='.length)
+        .split('|')
+        .map((o) => o.trim())
+        .filter(Boolean);
+    if (opts.length === 0) {
+        throw new FormDslError(`options modifier needs at least one value in "${part}".`);
+    }
+    if (new Set(opts).size !== opts.length) {
+        throw new FormDslError(`Duplicate option keys in "${part}".`);
+    }
+    return opts.map((o) => ({ key: o, label: titleCase(o) }));
+}
+function applyModifier(field, mod, part) {
+    if (mod === 'required')
+        field.required = true;
+    else if (mod.startsWith('options='))
+        field.options = parseOptionsMod(mod, part);
+    else if (mod.startsWith('min='))
+        field.min = parseNumberMod('min', mod.slice(4), part);
+    else if (mod.startsWith('max='))
+        field.max = parseNumberMod('max', mod.slice(4), part);
+    else if (mod.startsWith('flag='))
+        field.flag = mod.slice(5);
+    else
+        throw new FormDslError(`Unknown modifier ${JSON.stringify(mod)} in "${part}".`);
+}
+function parseFieldPart(part, order) {
+    const [key, type, ...mods] = part.split(':').map((s) => s.trim());
+    if (!key || !KEY_PATTERN.test(key)) {
+        throw new FormDslError(`Bad field key ${JSON.stringify(key ?? '')} in "${part}".`);
+    }
+    if (!type || !FIELD_TYPES.has(type)) {
+        throw new FormDslError(`Unknown field type ${JSON.stringify(type ?? '')} in "${part}" — one of: ${[...FIELD_TYPES].join(', ')}.`);
+    }
+    const field = { order, type, key, label: titleCase(key) };
+    for (const mod of mods)
+        applyModifier(field, mod, part);
+    return field;
+}
 export function parseFieldsDsl(dsl) {
-    const fields = [];
     const parts = dsl
         .split(',')
         .map((p) => p.trim())
         .filter(Boolean);
     if (parts.length === 0)
         throw new FormDslError('No fields given — pass --fields "key:type,…".');
-    for (const [i, part] of parts.entries()) {
-        const [key, type, ...mods] = part.split(':').map((s) => s.trim());
-        if (!key || !KEY_PATTERN.test(key)) {
-            throw new FormDslError(`Bad field key ${JSON.stringify(key ?? '')} in "${part}".`);
-        }
-        if (!type || !FIELD_TYPES.has(type)) {
-            throw new FormDslError(`Unknown field type ${JSON.stringify(type ?? '')} in "${part}" — one of: ${[...FIELD_TYPES].join(', ')}.`);
-        }
-        const field = { order: i + 1, type, key, label: titleCase(key) };
-        for (const mod of mods) {
-            if (mod === 'required')
-                field.required = true;
-            else if (mod.startsWith('options=')) {
-                const opts = mod
-                    .slice('options='.length)
-                    .split('|')
-                    .map((o) => o.trim())
-                    .filter(Boolean);
-                if (opts.length === 0) {
-                    throw new FormDslError(`options modifier needs at least one value in "${part}".`);
-                }
-                if (new Set(opts).size !== opts.length) {
-                    throw new FormDslError(`Duplicate option keys in "${part}".`);
-                }
-                field.options = opts.map((o) => ({ key: o, label: titleCase(o) }));
-            }
-            else if (mod.startsWith('min='))
-                field.min = parseNumberMod('min', mod.slice(4), part);
-            else if (mod.startsWith('max='))
-                field.max = parseNumberMod('max', mod.slice(4), part);
-            else if (mod.startsWith('flag='))
-                field.flag = mod.slice(5);
-            else
-                throw new FormDslError(`Unknown modifier ${JSON.stringify(mod)} in "${part}".`);
-        }
-        fields.push(field);
-    }
+    const fields = parts.map((part, i) => parseFieldPart(part, i + 1));
     const keys = fields.map((f) => f.key);
     if (new Set(keys).size !== keys.length) {
         throw new FormDslError('Field keys must be unique.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bank20baht-cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "description": "Scaffold bun workspaces (bahtui new) and DDD monorepos (React + Elysia + Eden, bahtui create) plus bahtui generators.",
   "license": "MIT",
@@ -40,10 +40,11 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "bank20baht-validator": "^0.2.0"
+    "bank20baht-validator": "^0.3.0"
   },
   "devDependencies": {
     "@types/node": "^22",

package/templates/new/_dependency-cruiser.cjs

@@ -0,0 +1,29 @@
+/**
+ * Architecture boundaries, checked with `bun run deps`. Add a rule per layer
+ * rule you want enforced (features may not import each other, shared/ knows no
+ * feature, ...). Every rule is `error`: a violation is a decision, not a warning.
+ */
+const TESTS = '\\.(test|spec)\\.tsx?$'
+
+/** @type {import('dependency-cruiser').IConfiguration} */
+module.exports = {
+  forbidden: [
+    {
+      name: 'no-circular',
+      severity: 'error',
+      from: {},
+      to: { circular: true },
+    },
+    {
+      name: 'production-not-tests',
+      severity: 'error',
+      from: { path: '^(apps|packages)/[^/]+/src/', pathNot: TESTS },
+      to: { path: TESTS },
+    },
+  ],
+  options: {
+    doNotFollow: { path: 'node_modules' },
+    tsPreCompilationDeps: true,
+    exclude: { path: ['/dist/', '\\.gen\\.ts$'] },
+  },
+}

package/templates/new/_github/actions/setup/action.yml

@@ -0,0 +1,15 @@
+name: Setup
+description: Bun at the version pinned in package.json, with the install cache restored, and dependencies installed.
+runs:
+  using: composite
+  steps:
+    - uses: oven-sh/setup-bun@v2
+      with:
+        bun-version-file: package.json
+    - uses: actions/cache@v4
+      with:
+        path: ~/.bun/install/cache
+        key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+        restore-keys: bun-${{ runner.os }}-
+    - run: bun install --frozen-lockfile
+      shell: bash

package/templates/new/_github/workflows/ci.yml

@@ -0,0 +1,122 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: lint · prettier
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run lint
+      - run: bun run format:check
+
+  typecheck:
+    name: typecheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run typecheck
+
+  structure:
+    name: knip · madge · boundaries
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run knip
+      - run: bun run madge
+      - run: bun run deps
+
+  dup:
+    name: duplication
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run dup -- --reporters console,json --output jscpd-report
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: jscpd-report
+          path: jscpd-report
+          retention-days: 7
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run test
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: coverage
+          path: '**/coverage'
+          retention-days: 7
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run build
+
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  audit:
+    name: dependency audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      # The npm advisory endpoint answers 503 now and then; retry before giving
+      # up, and never block a merge on it - a red audit is a warning to look at.
+      - run: |
+          for i in 1 2 3; do bun run audit && exit 0; echo "audit attempt $i failed"; sleep 15; done
+          exit 1
+        continue-on-error: true
+
+  commitlint:
+    name: commitlint
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup
+      - run: bunx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

package/templates/new/_gitleaks.toml

@@ -0,0 +1,6 @@
+# Default gitleaks rule set. Add an [[allowlists]] entry here (with a reason)
+# rather than a `# gitleaks:allow` comment when a finding is a false positive.
+title = "gitleaks config"
+
+[extend]
+useDefault = true

package/templates/new/_husky/pre-commit

@@ -1 +1,8 @@
+# Secret scan of what is about to be committed. CI runs the same scan over the
+# whole history, so a machine without gitleaks only loses the early warning.
+if command -v gitleaks >/dev/null 2>&1; then
+  gitleaks git --pre-commit --staged --redact --no-banner || exit 1
+else
+  echo "gitleaks is not installed - skipping the local secret scan (CI still runs it). brew install gitleaks" >&2
+fi
 bunx lint-staged

package/templates/new/_husky/pre-push

@@ -1 +1 @@
-bun run check
+bun run check:fast

package/templates/new/_jscpd.json

@@ -0,0 +1,20 @@
+{
+  "path": ["apps", "packages", "scripts"],
+  "format": ["typescript", "markup", "css"],
+  "ignore": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/coverage/**",
+    "**/test-results/**",
+    "**/playwright-report/**",
+    "**/*.spec.ts",
+    "**/*.test.ts",
+    "**/*.d.ts",
+    "**/*.gen.ts"
+  ],
+  "minTokens": 50,
+  "minLines": 5,
+  "gitignore": true,
+  "reporters": ["console"],
+  "threshold": 5
+}

package/templates/new/_prettierignore

@@ -1,3 +1,4 @@
 node_modules
 dist
 bun.lock
+coverage

package/templates/new/eslint.config.ts.hbs

@@ -0,0 +1,64 @@
+import js from '@eslint/js'
+import prettier from 'eslint-config-prettier'
+import sonarjs from 'eslint-plugin-sonarjs'
+import { defineConfig } from 'eslint/config'
+import tseslint from 'typescript-eslint'
+
+export default defineConfig([
+  {
+    ignores: [
+      '**/dist/**',
+      '**/node_modules/**',
+      '**/*.gen.ts',
+      '**/.angular/**',
+      '**/coverage/**',
+      '**/playwright-report/**',
+      '**/test-results/**',
+    ],
+  },
+  // Plain JS config files: no type information available.
+  {
+    files: ['**/*.{js,mjs,cjs}'],
+    extends: [js.configs.recommended],
+  },
+  // TypeScript, type-aware. Every .ts file must be covered by a tsconfig.
+  {
+    files: ['**/*.{ts,tsx}'],
+    extends: [
+      js.configs.recommended,
+      ...tseslint.configs.strictTypeChecked,
+      ...tseslint.configs.stylisticTypeChecked,
+    ],
+    languageOptions: {
+      parserOptions: { projectService: true, tsconfigRootDir: import.meta.dirname },
+    },
+    rules: {
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
+      ],
+      '@typescript-eslint/consistent-type-imports': 'error',
+      '@typescript-eslint/switch-exhaustiveness-check': 'error',
+      '@typescript-eslint/consistent-type-definitions': ['error', 'type'],
+      '@typescript-eslint/restrict-template-expressions': ['error', { allowNumber: true }],
+    },
+  },
+  // Duplication and complexity (jscpd covers whole-block clones, see .jscpd.json).
+  {
+    files: ['**/*.{ts,tsx}'],
+    plugins: { sonarjs },
+    rules: {
+      'sonarjs/no-identical-functions': 'error',
+      'sonarjs/no-identical-expressions': 'error',
+      'sonarjs/cognitive-complexity': ['error', 15],
+    },
+  },
+  // Repeated literals are ordinary in tests, so the rule only guards production code.
+  {
+    files: ['**/*.{ts,tsx}'],
+    ignores: ['**/*.test.ts', '**/*.spec.ts'],
+    plugins: { sonarjs },
+    rules: { 'sonarjs/no-duplicate-string': ['error', { threshold: 4 }] },
+  },
+  prettier,
+])

package/templates/new/knip.json

@@ -5,5 +5,6 @@
       "entry": ["scripts/*.ts"],
       "project": ["scripts/**/*.ts"]
     }
-  }
+  },
+  "ignoreBinaries": ["gitleaks"]
 }

package/templates/new/package.json.hbs

@@ -2,7 +2,10 @@
   "name": "{{name}}",
   "private": true,
   "type": "module",
-  "workspaces": ["apps/*", "packages/*"],
+  "workspaces": [
+    "apps/*",
+    "packages/*"
+  ],
   "scripts": {
     "dev": "bun run scripts/dev.ts",
     "build": "bun run scripts/each.ts build",
@@ -12,24 +15,41 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "knip": "knip",
-    "check": "bun run lint && bun run format:check && bun run knip && bun run typecheck",
+    "madge": "madge --circular --extensions ts,tsx apps packages scripts",
+    "deps": "depcruise apps packages scripts --config .dependency-cruiser.cjs",
+    "dup": "jscpd",
+    "audit": "bun audit --audit-level=high",
+    "secrets": "gitleaks git --redact --no-banner",
+    "test": "bun run scripts/each.ts test:coverage",
+    "check:fast": "bun run lint && bun run format:check && bun run typecheck && bun run madge && bun run deps",
+    "check": "bun run check:fast && bun run knip && bun run dup && bun run build && bun run test",
     "prepare": "husky"
   },
   "lint-staged": {
-    "*.{ts,tsx}": ["eslint --fix", "prettier --write"],
-    "*.{json,md,html,css}": ["prettier --write"]
+    "*.{ts,tsx}": [
+      "eslint --fix",
+      "prettier --write"
+    ],
+    "*.{json,md,html,css}": [
+      "prettier --write"
+    ]
   },
+  "packageManager": "bun@1.3.14",
   "devDependencies": {
     "@commitlint/cli": "^21.2.2",
     "@commitlint/config-conventional": "^21.2.2",
     "@eslint/js": "^10.0.1",
     "@types/bun": "^1.3.0",
+    "dependency-cruiser": "^18.3.1",
     "eslint": "^10.10.0",
     "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-sonarjs": "^4.2.1",
     "husky": "^9.1.7",
     "jiti": "^2.6.1",
+    "jscpd": "^5.3.0",
     "knip": "^6.35.1",
     "lint-staged": "^17.5.1",
+    "madge": "^8.0.0",
     "prettier": "^3.9.6",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.70.0"

package/templates/new/renovate.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended", ":semanticCommitTypeAll(chore)"],
+  "schedule": ["before 6am on monday"],
+  "prConcurrentLimit": 4,
+  "packageRules": [
+    {
+      "description": "Everything not matched below: one weekly PR.",
+      "matchPackageNames": ["*"],
+      "groupName": "others"
+    },
+    {
+      "description": "Dev tooling: linters, formatters, test runners, type packages.",
+      "matchDepTypes": ["devDependencies"],
+      "groupName": "dev-deps"
+    },
+    {
+      "description": "GitHub Actions move together.",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions"
+    }
+  ]
+}

package/templates/new/scripts/dev.ts

@@ -39,8 +39,8 @@ const procs = targets.map(({ name, cwd, color }) => {
     if (buf) console.log(prefix(buf))
   }
 
-  pump(proc.stdout)
-  pump(proc.stderr)
+  void pump(proc.stdout)
+  void pump(proc.stderr)
   return proc
 })
 

package/templates/new/scripts/each.ts

@@ -20,6 +20,10 @@ if (targets.length === 0) {
 
 for (const { name, cwd } of targets) {
   console.log(`\x1b[36m[${name}]\x1b[0m bun run ${script}`)
-  const proc = Bun.spawnSync(['bun', 'run', script], { cwd, env: process.env, stdio: ['inherit', 'inherit', 'inherit'] })
-  if (proc.exitCode !== 0) process.exit(proc.exitCode ?? 1)
+  const proc = Bun.spawnSync(['bun', 'run', script], {
+    cwd,
+    env: process.env,
+    stdio: ['inherit', 'inherit', 'inherit'],
+  })
+  if (proc.exitCode !== 0) process.exit(proc.exitCode)
 }

package/templates/new/scripts/workspaces.ts

@@ -1,7 +1,7 @@
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
 
-export interface Workspace {
+export type Workspace = {
   name: string
   cwd: string
 }

package/templates/new/tsconfig.json

@@ -3,5 +3,5 @@
   "compilerOptions": {
     "types": ["bun"]
   },
-  "include": ["scripts"]
+  "include": ["scripts", "eslint.config.ts"]
 }

package/templates/new/eslint.config.ts

@@ -1,24 +0,0 @@
-import js from '@eslint/js'
-import prettier from 'eslint-config-prettier'
-import tseslint from 'typescript-eslint'
-
-export default tseslint.config(
-  {
-    ignores: ['**/dist/**', '**/node_modules/**', '**/*.gen.ts', '**/.angular/**'],
-  },
-  js.configs.recommended,
-  ...tseslint.configs.recommended,
-  {
-    languageOptions: {
-      parserOptions: { tsconfigRootDir: import.meta.dirname },
-    },
-    rules: {
-      '@typescript-eslint/no-unused-vars': [
-        'error',
-        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
-      ],
-      '@typescript-eslint/consistent-type-imports': 'error',
-    },
-  },
-  prettier,
-)