bank20baht-cli 0.3.0 → 0.4.0

package/README.md

@@ -38,14 +38,15 @@ bun run check      # lint + format:check + knip + typecheck — green on the emp
 What you get:
 
 ```
-package.json         workspaces apps/* + packages/*, lint-staged, check script
-tsconfig.base.json   strict, moduleResolution bundler, verbatimModuleSyntax
+package.json         workspaces apps/* + packages/*, check script, prettier config ref
+tsconfig.base.json   extends bank20baht-strict/tsconfig/base.json (strict + noUncheckedIndexedAccess + exactOptionalPropertyTypes ...)
 tsconfig.json        typechecks scripts/ (extend the base from each workspace)
-eslint.config.ts     ESLint 10 + typescript-eslint + eslint-config-prettier
-.prettierrc          no semicolons, single quotes, printWidth 100
-knip.json            dead-code / unused-dependency checks
+eslint.config.ts     one line: bank20baht-strict/eslint `base` (ESLint 10, typescript-eslint strict, sonarjs, prettier)
+lint-staged.config.js · commitlint.config.js   re-exports from bank20baht-strict
+knip.ts              dead-code / unused-dependency checks (bank20baht-strict/knip)
 commitlint.config.js Conventional Commits
-.husky/              pre-commit → lint-staged · commit-msg → commitlint · pre-push → bun run check
+.husky/              pre-commit → gitleaks + lint-staged · commit-msg → commitlint · pre-push → bun run check:fast
+.gitleaks.toml · .jscpd.json · .dependency-cruiser.mjs · renovate.json · .github/ (CI: lint, typecheck, knip/madge/deps, dup, test, build, gitleaks, audit, commitlint)
 scripts/dev.ts       runs every apps/*/ "dev" script in parallel with prefixed output
 scripts/each.ts      `bun run scripts/each.ts <script>` in every workspace that defines it
 .mcp.json, CLAUDE.md zvec_grep code-search MCP wiring for Claude Code
@@ -64,7 +65,7 @@ husky hooks prove themselves before you touch anything. Flags:
 
 Add a workspace by creating `apps/<name>/package.json` with `dev` / `build` / `typecheck`
 scripts; `bun run dev`, `bun run build` and `bun run typecheck` pick it up automatically.
-Add a matching entry to `knip.json` so dead-code checks cover it.
+Add a matching entry to `knip.ts` so dead-code checks cover it.
 
 ### `bahtui create <name>`
 

package/dist/application/create.js

@@ -1,24 +1,13 @@
 import { planCreate, PRESET_TEMPLATE_SET } from '../domain/create-plan.js';
 import { validateProjectName } from '../domain/naming.js';
-export function runCreate(input, deps) {
-    const errors = validateProjectName(input.name);
-    if (errors.length > 0) {
-        for (const e of errors)
-            deps.log.error(e);
-        throw new CreateError('Invalid project name.');
-    }
-    const blueprint = planCreate(input, deps.templates.load(PRESET_TEMPLATE_SET[input.preset]), (raw, data) => deps.renderer.render(raw, data));
-    if (input.dryRun) {
-        deps.log.info(`dry-run — would create in ${blueprint.root}:`);
-        for (const f of blueprint.files)
-            deps.log.info(`  ${f.path}`);
-        for (const c of blueprint.postCommands)
-            deps.log.info(`  $ ${c.cmd} ${c.args.join(' ')}`);
-        return;
-    }
-    deps.writer.ensureUsableDir(blueprint.root, input.force);
-    deps.writer.writeFiles(blueprint);
-    deps.log.step(`${blueprint.files.length} files written to ${blueprint.root}`);
+function logDryRun(blueprint, deps) {
+    deps.log.info(`dry-run — would create in ${blueprint.root}:`);
+    for (const f of blueprint.files)
+        deps.log.info(`  ${f.path}`);
+    for (const c of blueprint.postCommands)
+        deps.log.info(`  $ ${c.cmd} ${c.args.join(' ')}`);
+}
+function runPostCommands(blueprint, input, deps) {
     for (const c of blueprint.postCommands) {
         deps.log.step(c.label);
         try {
@@ -29,6 +18,8 @@ export function runCreate(input, deps) {
             throw new CreateError(`${err instanceof Error ? err.message : String(err)}\nproject files are written — cd ${input.name} and rerun: ${retry}`);
         }
     }
+}
+function logNextSteps(input, deps) {
     deps.log.info('');
     deps.log.info(`Done. Next:`);
     deps.log.info(`  cd ${input.name}`);
@@ -37,6 +28,24 @@ export function runCreate(input, deps) {
     for (const line of NEXT_STEPS[input.preset])
         deps.log.info(`  ${line}`);
 }
+export function runCreate(input, deps) {
+    const errors = validateProjectName(input.name);
+    if (errors.length > 0) {
+        for (const e of errors)
+            deps.log.error(e);
+        throw new CreateError('Invalid project name.');
+    }
+    const blueprint = planCreate(input, deps.templates.load(PRESET_TEMPLATE_SET[input.preset]), (raw, data) => deps.renderer.render(raw, data));
+    if (input.dryRun) {
+        logDryRun(blueprint, deps);
+        return;
+    }
+    deps.writer.ensureUsableDir(blueprint.root, input.force);
+    deps.writer.writeFiles(blueprint);
+    deps.log.step(`${blueprint.files.length} files written to ${blueprint.root}`);
+    runPostCommands(blueprint, input, deps);
+    logNextSteps(input, deps);
+}
 const NEXT_STEPS = {
     full: [
         'bun run dev        # web :5173 + api :3001',
@@ -45,7 +54,7 @@ const NEXT_STEPS = {
     workspace: [
         'mkdir -p apps/<name> && add a package.json with dev/build/typecheck scripts',
         'bun run dev        # runs every apps/*/ dev script in parallel',
-        'bun run check      # lint + format:check + knip + typecheck',
+        'bun run check      # lint + format:check + typecheck + madge + deps + knip + dup + build + test',
     ],
 };
 export class CreateError extends Error {

package/dist/args.js

@@ -0,0 +1,48 @@
+/** Boolean flags recognized anywhere on the command line (no value). */
+export const KNOWN_FLAGS = new Set([
+    '-v',
+    '--version',
+    '-h',
+    '--help',
+    '--dry-run',
+    '--force',
+    '--no-install',
+    '--no-git',
+    '--skip-install',
+    '--skip-git',
+]);
+/**
+ * Value-carrying flags pulled out before positional parsing. Supports both
+ * `--flag value` and `--flag=value`. If the token after `--flag value` looks
+ * like another flag (starts with `-`), the option is treated as missing
+ * rather than swallowing that flag as the value.
+ */
+export function takeOption(argv, flag) {
+    const eqPrefix = `${flag}=`;
+    const eqIndex = argv.findIndex((a) => a.startsWith(eqPrefix));
+    if (eqIndex !== -1) {
+        const value = argv[eqIndex].slice(eqPrefix.length);
+        argv.splice(eqIndex, 1);
+        return value;
+    }
+    const i = argv.indexOf(flag);
+    if (i === -1)
+        return undefined;
+    const value = argv[i + 1];
+    if (value === undefined || value.startsWith('-')) {
+        argv.splice(i, 1);
+        return undefined;
+    }
+    argv.splice(i, 2);
+    return value;
+}
+export function parseArgs(rawArgv) {
+    const argv = [...rawArgv];
+    const fields = takeOption(argv, '--fields');
+    const frontend = takeOption(argv, '--frontend');
+    const backend = takeOption(argv, '--backend');
+    const args = argv.filter((a) => !a.startsWith('-'));
+    const flags = new Set(argv.filter((a) => a.startsWith('-')));
+    const [command, name, sub] = args;
+    return { fields, frontend, backend, flags, command, name, sub };
+}

package/dist/cli.js

@@ -9,11 +9,12 @@ import { TemplateRenderer } from './infrastructure/template-renderer.js';
 import { DiskFileWriter } from './infrastructure/fs-writer.js';
 import { DiskFileReader } from './infrastructure/fs-reader.js';
 import { ShellRunner } from './infrastructure/shell-runner.js';
+import { KNOWN_FLAGS, parseArgs } from './args.js';
 const HELP = `bahtui — bun-workspace DDD scaffolding (React + Elysia + Eden)
 
 Usage:
   bahtui new <name> [options]           bare bun workspace in ./<name> — toolchain only
-                                        (eslint, prettier, knip, husky, commitlint), no apps
+                                        (eslint, prettier, knip, husky, commitlint, gitleaks, jscpd, depcruise, CI), no apps
   bahtui create <name> [options]        full monorepo in ./<name> (React + Elysia + Eden)
   bahtui init [options]                 write bahtui.json into an existing repo
   bahtui g model <domain>               libs/domain/<d>/model package
@@ -39,56 +40,18 @@ function version() {
     return JSON.parse(readFileSync(pkg, 'utf8')).version;
 }
 const log = {
-    info: (m) => console.log(m),
-    step: (m) => console.log(`• ${m}`),
-    error: (m) => console.error(`✖ ${m}`),
+    info: (m) => {
+        console.log(m);
+    },
+    step: (m) => {
+        console.log(`• ${m}`);
+    },
+    error: (m) => {
+        console.error(`✖ ${m}`);
+    },
 };
-/** Boolean flags recognized anywhere on the command line (no value). */
-const KNOWN_FLAGS = new Set([
-    '-v',
-    '--version',
-    '-h',
-    '--help',
-    '--dry-run',
-    '--force',
-    '--no-install',
-    '--no-git',
-    '--skip-install',
-    '--skip-git',
-]);
-/**
- * Value-carrying flags pulled out before positional parsing. Supports both
- * `--flag value` and `--flag=value`. If the token after `--flag value` looks
- * like another flag (starts with `-`), the option is treated as missing
- * rather than swallowing that flag as the value.
- */
-function takeOption(argv, flag) {
-    const eqPrefix = `${flag}=`;
-    const eqIndex = argv.findIndex((a) => a.startsWith(eqPrefix));
-    if (eqIndex !== -1) {
-        const value = argv[eqIndex].slice(eqPrefix.length);
-        argv.splice(eqIndex, 1);
-        return value;
-    }
-    const i = argv.indexOf(flag);
-    if (i === -1)
-        return undefined;
-    const value = argv[i + 1];
-    if (value === undefined || value.startsWith('-')) {
-        argv.splice(i, 1);
-        return undefined;
-    }
-    argv.splice(i, 2);
-    return value;
-}
-function main(rawArgv) {
-    const argv = [...rawArgv];
-    const fields = takeOption(argv, '--fields');
-    const frontend = takeOption(argv, '--frontend');
-    const backend = takeOption(argv, '--backend');
-    const args = argv.filter((a) => !a.startsWith('-'));
-    const flags = new Set(argv.filter((a) => a.startsWith('-')));
-    const [command, name, sub] = args;
+/** Handles unknown flags, --version and --help; null = carry on. */
+function preflight({ flags }) {
     const unknownFlags = [...flags].filter((f) => !KNOWN_FLAGS.has(f));
     if (unknownFlags.length > 0) {
         log.error(`Unknown flag${unknownFlags.length > 1 ? 's' : ''}: ${unknownFlags.join(', ')}`);
@@ -108,67 +71,89 @@ function main(rawArgv) {
         log.info(HELP);
         return 0;
     }
-    if (command === undefined) {
-        log.error('No command given — see usage below.');
-        log.error(HELP);
+    return null;
+}
+function commandCreate(a, command) {
+    if (!a.name) {
+        log.error(`${command} needs a project name: bahtui ${command} <name>`);
+        return 1;
+    }
+    runCreate({
+        name: a.name,
+        preset: command === 'new' ? 'workspace' : 'full',
+        targetDir: resolve(process.cwd(), a.name),
+        install: !a.flags.has('--no-install') && !a.flags.has('--skip-install'),
+        git: !a.flags.has('--no-git') && !a.flags.has('--skip-git'),
+        dryRun: a.flags.has('--dry-run'),
+        force: a.flags.has('--force'),
+    }, {
+        templates: new DiskTemplateSource(),
+        renderer: new TemplateRenderer(),
+        writer: new DiskFileWriter(),
+        runner: new ShellRunner(),
+        log,
+    });
+    return 0;
+}
+function commandInit(a, generateDeps) {
+    runInit({
+        root: process.cwd(),
+        frontend: a.frontend === 'none' ? null : 'react',
+        backend: a.backend === 'none' ? null : 'elysia',
+        dryRun: a.flags.has('--dry-run'),
+        force: a.flags.has('--force'),
+    }, generateDeps);
+    return 0;
+}
+function commandGenerate(a, generateDeps) {
+    const { name, sub } = a;
+    if (name !== 'model' && name !== 'form') {
+        log.error('Unknown generator — bahtui g model <domain> | g form <domain>/<name>.');
+        return 1;
+    }
+    if (!sub) {
+        log.error(`g ${name} needs a target: bahtui g ${name} <${name === 'model' ? 'domain' : 'domain/name'}>`);
         return 1;
     }
-    const dryRun = flags.has('--dry-run');
-    const force = flags.has('--force');
+    runGenerate({
+        root: process.cwd(),
+        kind: name,
+        target: sub,
+        fields: a.fields,
+        dryRun: a.flags.has('--dry-run'),
+        force: a.flags.has('--force'),
+    }, generateDeps);
+    return 0;
+}
+function dispatch(a, command) {
     const generateDeps = {
         reader: new DiskFileReader(),
         writer: new DiskFileWriter(),
         log,
     };
-    try {
-        if (command === 'create' || command === 'new') {
-            if (!name) {
-                log.error(`${command} needs a project name: bahtui ${command} <name>`);
-                return 1;
-            }
-            runCreate({
-                name,
-                preset: command === 'new' ? 'workspace' : 'full',
-                targetDir: resolve(process.cwd(), name),
-                install: !flags.has('--no-install') && !flags.has('--skip-install'),
-                git: !flags.has('--no-git') && !flags.has('--skip-git'),
-                dryRun,
-                force,
-            }, {
-                templates: new DiskTemplateSource(),
-                renderer: new TemplateRenderer(),
-                writer: new DiskFileWriter(),
-                runner: new ShellRunner(),
-                log,
-            });
-            return 0;
-        }
-        if (command === 'init') {
-            runInit({
-                root: process.cwd(),
-                frontend: frontend === 'none' ? null : 'react',
-                backend: backend === 'none' ? null : 'elysia',
-                dryRun,
-                force,
-            }, generateDeps);
-            return 0;
-        }
-        if (command === 'g') {
-            if (name !== 'model' && name !== 'form') {
-                log.error('Unknown generator — bahtui g model <domain> | g form <domain>/<name>.');
-                return 1;
-            }
-            if (!sub) {
-                log.error(`g ${name} needs a target: bahtui g ${name} <${name === 'model' ? 'domain' : 'domain/name'}>`);
-                return 1;
-            }
-            runGenerate({ root: process.cwd(), kind: name, target: sub, fields, dryRun, force }, generateDeps);
-            return 0;
-        }
-        log.error(`Unknown command "${command}".`);
+    if (command === 'create' || command === 'new')
+        return commandCreate(a, command);
+    if (command === 'init')
+        return commandInit(a, generateDeps);
+    if (command === 'g')
+        return commandGenerate(a, generateDeps);
+    log.error(`Unknown command "${command}".`);
+    log.error(HELP);
+    return 1;
+}
+function main(rawArgv) {
+    const parsed = parseArgs(rawArgv);
+    const early = preflight(parsed);
+    if (early !== null)
+        return early;
+    if (parsed.command === undefined) {
+        log.error('No command given — see usage below.');
         log.error(HELP);
         return 1;
     }
+    try {
+        return dispatch(parsed, parsed.command);
+    }
     catch (err) {
         log.error(err instanceof CreateError || err instanceof GenerateError ? err.message : String(err));
         return 1;

package/dist/domain/form-dsl.js

@@ -37,51 +37,55 @@ function parseNumberMod(name, raw, part) {
     }
     return n;
 }
+function parseOptionsMod(mod, part) {
+    const opts = mod
+        .slice('options='.length)
+        .split('|')
+        .map((o) => o.trim())
+        .filter(Boolean);
+    if (opts.length === 0) {
+        throw new FormDslError(`options modifier needs at least one value in "${part}".`);
+    }
+    if (new Set(opts).size !== opts.length) {
+        throw new FormDslError(`Duplicate option keys in "${part}".`);
+    }
+    return opts.map((o) => ({ key: o, label: titleCase(o) }));
+}
+function applyModifier(field, mod, part) {
+    if (mod === 'required')
+        field.required = true;
+    else if (mod.startsWith('options='))
+        field.options = parseOptionsMod(mod, part);
+    else if (mod.startsWith('min='))
+        field.min = parseNumberMod('min', mod.slice(4), part);
+    else if (mod.startsWith('max='))
+        field.max = parseNumberMod('max', mod.slice(4), part);
+    else if (mod.startsWith('flag='))
+        field.flag = mod.slice(5);
+    else
+        throw new FormDslError(`Unknown modifier ${JSON.stringify(mod)} in "${part}".`);
+}
+function parseFieldPart(part, order) {
+    const [key, type, ...mods] = part.split(':').map((s) => s.trim());
+    if (!key || !KEY_PATTERN.test(key)) {
+        throw new FormDslError(`Bad field key ${JSON.stringify(key ?? '')} in "${part}".`);
+    }
+    if (!type || !FIELD_TYPES.has(type)) {
+        throw new FormDslError(`Unknown field type ${JSON.stringify(type ?? '')} in "${part}" — one of: ${[...FIELD_TYPES].join(', ')}.`);
+    }
+    const field = { order, type, key, label: titleCase(key) };
+    for (const mod of mods)
+        applyModifier(field, mod, part);
+    return field;
+}
 export function parseFieldsDsl(dsl) {
-    const fields = [];
     const parts = dsl
         .split(',')
         .map((p) => p.trim())
         .filter(Boolean);
     if (parts.length === 0)
         throw new FormDslError('No fields given — pass --fields "key:type,…".');
-    for (const [i, part] of parts.entries()) {
-        const [key, type, ...mods] = part.split(':').map((s) => s.trim());
-        if (!key || !KEY_PATTERN.test(key)) {
-            throw new FormDslError(`Bad field key ${JSON.stringify(key ?? '')} in "${part}".`);
-        }
-        if (!type || !FIELD_TYPES.has(type)) {
-            throw new FormDslError(`Unknown field type ${JSON.stringify(type ?? '')} in "${part}" — one of: ${[...FIELD_TYPES].join(', ')}.`);
-        }
-        const field = { order: i + 1, type, key, label: titleCase(key) };
-        for (const mod of mods) {
-            if (mod === 'required')
-                field.required = true;
-            else if (mod.startsWith('options=')) {
-                const opts = mod
-                    .slice('options='.length)
-                    .split('|')
-                    .map((o) => o.trim())
-                    .filter(Boolean);
-                if (opts.length === 0) {
-                    throw new FormDslError(`options modifier needs at least one value in "${part}".`);
-                }
-                if (new Set(opts).size !== opts.length) {
-                    throw new FormDslError(`Duplicate option keys in "${part}".`);
-                }
-                field.options = opts.map((o) => ({ key: o, label: titleCase(o) }));
-            }
-            else if (mod.startsWith('min='))
-                field.min = parseNumberMod('min', mod.slice(4), part);
-            else if (mod.startsWith('max='))
-                field.max = parseNumberMod('max', mod.slice(4), part);
-            else if (mod.startsWith('flag='))
-                field.flag = mod.slice(5);
-            else
-                throw new FormDslError(`Unknown modifier ${JSON.stringify(mod)} in "${part}".`);
-        }
-        fields.push(field);
-    }
+    const fields = parts.map((part, i) => parseFieldPart(part, i + 1));
     const keys = fields.map((f) => f.key);
     if (new Set(keys).size !== keys.length) {
         throw new FormDslError('Field keys must be unique.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bank20baht-cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "type": "module",
   "description": "Scaffold bun workspaces (bahtui new) and DDD monorepos (React + Elysia + Eden, bahtui create) plus bahtui generators.",
   "license": "MIT",
@@ -40,10 +40,11 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "bank20baht-validator": "^0.2.0"
+    "bank20baht-validator": "^0.3.0"
   },
   "devDependencies": {
     "@types/node": "^22",

package/templates/new/README.md.hbs

@@ -22,15 +22,17 @@ scripts/each.ts      `bun run scripts/each.ts <script>` in every workspace that
 ```
 
 Add a workspace by creating `apps/<name>/package.json` (or `packages/<name>`)
-with `dev`, `build` and `typecheck` scripts, then extend `knip.json` with a
+with `dev`, `build` and `typecheck` scripts, then extend `knip.ts` with a
 matching workspace entry so dead-code checks cover it.
 
 ## Toolchain
 
 - **ESLint 10 + typescript-eslint** (`eslint.config.ts`), **Prettier** (no semi,
-  single quotes, width 100), **knip** — all run by `bun run check`.
+  single quotes, width 100), **knip** — all run by `bun run check`. Their config comes from
+  `bank20baht-strict`: bump it to take rule updates (Renovate does this); put app overrides
+  last, each with a reason.
 - **husky** hooks: `pre-commit` → lint-staged, `commit-msg` → commitlint
   (Conventional Commits), `pre-push` → `bun run check`.
-- `tsconfig.base.json` — strict, `moduleResolution: bundler`,
-  `verbatimModuleSyntax`, `noUncheckedIndexedAccess`. Extend it from each
-  workspace's `tsconfig.json`.
+- `tsconfig.base.json` — extends `bank20baht-strict/tsconfig/base.json` (strict,
+  `verbatimModuleSyntax`, `noUncheckedIndexedAccess`, `exactOptionalPropertyTypes`, ...).
+  Extend it from each workspace's `tsconfig.json`.

package/templates/new/_dependency-cruiser.mjs

@@ -0,0 +1,9 @@
+/**
+ * Architecture boundaries, checked with `bun run deps`. `generic` gives no-circular and
+ * production-not-tests for apps/* and packages/*; add layer rules (features may not import
+ * each other, shared/ knows no feature, ...) as your structure grows. Every rule is `error`:
+ * a violation is a decision, not a warning.
+ */
+import { makeConfig } from 'bank20baht-strict/depcruise'
+
+export default makeConfig({ generic: true })

package/templates/new/_github/actions/setup/action.yml

@@ -0,0 +1,15 @@
+name: Setup
+description: Bun at the version pinned in package.json, with the install cache restored, and dependencies installed.
+runs:
+  using: composite
+  steps:
+    - uses: oven-sh/setup-bun@v2
+      with:
+        bun-version-file: package.json
+    - uses: actions/cache@v4
+      with:
+        path: ~/.bun/install/cache
+        key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+        restore-keys: bun-${{ runner.os }}-
+    - run: bun install --frozen-lockfile
+      shell: bash

package/templates/new/_github/workflows/ci.yml

@@ -0,0 +1,122 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: lint · prettier
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run lint
+      - run: bun run format:check
+
+  typecheck:
+    name: typecheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run typecheck
+
+  structure:
+    name: knip · madge · boundaries
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run knip
+      - run: bun run madge
+      - run: bun run deps
+
+  dup:
+    name: duplication
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run dup -- --reporters console,json --output jscpd-report
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: jscpd-report
+          path: jscpd-report
+          retention-days: 7
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run test
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: coverage
+          path: '**/coverage'
+          retention-days: 7
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - run: bun run build
+
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  audit:
+    name: dependency audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      # The npm advisory endpoint answers 503 now and then; retry before giving
+      # up, and never block a merge on it - a red audit is a warning to look at.
+      - run: |
+          for i in 1 2 3; do bun run audit && exit 0; echo "audit attempt $i failed"; sleep 15; done
+          exit 1
+        continue-on-error: true
+
+  commitlint:
+    name: commitlint
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup
+      - run: bunx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

package/templates/new/_gitleaks.toml

@@ -0,0 +1,6 @@
+# Default gitleaks rule set. Add an [[allowlists]] entry here (with a reason)
+# rather than a `# gitleaks:allow` comment when a finding is a false positive.
+title = "gitleaks config"
+
+[extend]
+useDefault = true

package/templates/new/_husky/pre-commit

@@ -1 +1,8 @@
+# Secret scan of what is about to be committed. CI runs the same scan over the
+# whole history, so a machine without gitleaks only loses the early warning.
+if command -v gitleaks >/dev/null 2>&1; then
+  gitleaks git --pre-commit --staged --redact --no-banner || exit 1
+else
+  echo "gitleaks is not installed - skipping the local secret scan (CI still runs it). brew install gitleaks" >&2
+fi
 bunx lint-staged

package/templates/new/_husky/pre-push

@@ -1 +1 @@
-bun run check
+bun run check:fast

package/templates/new/_jscpd.json

@@ -0,0 +1,20 @@
+{
+  "path": ["apps", "packages", "scripts"],
+  "format": ["typescript", "markup", "css"],
+  "ignore": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/coverage/**",
+    "**/test-results/**",
+    "**/playwright-report/**",
+    "**/*.spec.ts",
+    "**/*.test.ts",
+    "**/*.d.ts",
+    "**/*.gen.ts"
+  ],
+  "minTokens": 50,
+  "minLines": 5,
+  "gitignore": true,
+  "reporters": ["console"],
+  "threshold": 5
+}

package/templates/new/_prettierignore

@@ -1,3 +1,4 @@
 node_modules
 dist
 bun.lock
+coverage

package/templates/new/commitlint.config.js

@@ -1,3 +1 @@
-export default {
-  extends: ['@commitlint/config-conventional'],
-}
+export { default } from 'bank20baht-strict/commitlint'

package/templates/new/eslint.config.ts.hbs

@@ -0,0 +1,7 @@
+import { defineConfig } from 'eslint/config'
+
+import { base } from 'bank20baht-strict/eslint'
+
+// Every rule in `base` is an error. Add app overrides below, each with a reason:
+//   // eslint-disable-next-line <rule> -- <why>
+export default defineConfig([...base])

package/templates/new/knip.ts

@@ -0,0 +1,7 @@
+import { knip } from 'bank20baht-strict/knip'
+
+export default knip({
+  workspaces: {
+    '.': { entry: ['scripts/*.ts'], project: ['scripts/**/*.ts'] },
+  },
+})

package/templates/new/lint-staged.config.js

@@ -0,0 +1 @@
+export { default } from 'bank20baht-strict/lint-staged'

package/templates/new/package.json.hbs

@@ -2,7 +2,10 @@
   "name": "{{name}}",
   "private": true,
   "type": "module",
-  "workspaces": ["apps/*", "packages/*"],
+  "workspaces": [
+    "apps/*",
+    "packages/*"
+  ],
   "scripts": {
     "dev": "bun run scripts/dev.ts",
     "build": "bun run scripts/each.ts build",
@@ -12,24 +15,35 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "knip": "knip",
-    "check": "bun run lint && bun run format:check && bun run knip && bun run typecheck",
+    "madge": "madge --circular --extensions ts,tsx apps packages scripts",
+    "deps": "depcruise apps packages scripts --config .dependency-cruiser.mjs",
+    "dup": "jscpd",
+    "audit": "bun audit --audit-level=high",
+    "secrets": "gitleaks git --redact --no-banner",
+    "test": "bun run scripts/each.ts test:coverage",
+    "check:fast": "bun run lint && bun run format:check && bun run typecheck && bun run madge && bun run deps",
+    "check": "bun run check:fast && bun run knip && bun run dup && bun run build && bun run test",
     "prepare": "husky"
   },
-  "lint-staged": {
-    "*.{ts,tsx}": ["eslint --fix", "prettier --write"],
-    "*.{json,md,html,css}": ["prettier --write"]
-  },
+  "prettier": "bank20baht-strict/prettier",
+  "packageManager": "bun@1.3.14",
   "devDependencies": {
     "@commitlint/cli": "^21.2.2",
     "@commitlint/config-conventional": "^21.2.2",
+    "@eslint/css": "^2.0.0",
     "@eslint/js": "^10.0.1",
     "@types/bun": "^1.3.0",
+    "bank20baht-strict": "0.0.3",
+    "dependency-cruiser": "^18.3.1",
     "eslint": "^10.10.0",
     "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-sonarjs": "^4.2.1",
     "husky": "^9.1.7",
     "jiti": "^2.6.1",
+    "jscpd": "^5.3.0",
     "knip": "^6.35.1",
     "lint-staged": "^17.5.1",
+    "madge": "^8.0.0",
     "prettier": "^3.9.6",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.70.0"

package/templates/new/renovate.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended", ":semanticCommitTypeAll(chore)"],
+  "schedule": ["before 6am on monday"],
+  "prConcurrentLimit": 4,
+  "packageRules": [
+    {
+      "description": "Everything not matched below: one weekly PR.",
+      "matchPackageNames": ["*"],
+      "groupName": "others"
+    },
+    {
+      "description": "Dev tooling: linters, formatters, test runners, type packages.",
+      "matchDepTypes": ["devDependencies"],
+      "groupName": "dev-deps"
+    },
+    {
+      "description": "GitHub Actions move together.",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions"
+    }
+  ]
+}

package/templates/new/scripts/dev.ts

@@ -39,8 +39,8 @@ const procs = targets.map(({ name, cwd, color }) => {
     if (buf) console.log(prefix(buf))
   }
 
-  pump(proc.stdout)
-  pump(proc.stderr)
+  void pump(proc.stdout)
+  void pump(proc.stderr)
   return proc
 })
 

package/templates/new/scripts/each.ts

@@ -20,6 +20,10 @@ if (targets.length === 0) {
 
 for (const { name, cwd } of targets) {
   console.log(`\x1b[36m[${name}]\x1b[0m bun run ${script}`)
-  const proc = Bun.spawnSync(['bun', 'run', script], { cwd, env: process.env, stdio: ['inherit', 'inherit', 'inherit'] })
-  if (proc.exitCode !== 0) process.exit(proc.exitCode ?? 1)
+  const proc = Bun.spawnSync(['bun', 'run', script], {
+    cwd,
+    env: process.env,
+    stdio: ['inherit', 'inherit', 'inherit'],
+  })
+  if (proc.exitCode !== 0) process.exit(proc.exitCode)
 }

package/templates/new/scripts/workspaces.ts

@@ -1,7 +1,7 @@
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
 
-export interface Workspace {
+export type Workspace = {
   name: string
   cwd: string
 }

package/templates/new/tsconfig.base.json

@@ -1,16 +1,3 @@
 {
-  "compilerOptions": {
-    "target": "ESNext",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "moduleDetection": "force",
-    "allowImportingTsExtensions": true,
-    "verbatimModuleSyntax": true,
-    "esModuleInterop": true,
-    "resolveJsonModule": true,
-    "strict": true,
-    "skipLibCheck": true,
-    "noUncheckedIndexedAccess": true,
-    "noEmit": true
-  }
+  "extends": "bank20baht-strict/tsconfig/base.json"
 }

package/templates/new/tsconfig.json

@@ -3,5 +3,5 @@
   "compilerOptions": {
     "types": ["bun"]
   },
-  "include": ["scripts"]
+  "include": ["scripts", "eslint.config.ts", "knip.ts"]
 }

package/templates/new/_prettierrc

@@ -1,6 +0,0 @@
-{
-  "semi": false,
-  "singleQuote": true,
-  "trailingComma": "all",
-  "printWidth": 100
-}

package/templates/new/eslint.config.ts

@@ -1,24 +0,0 @@
-import js from '@eslint/js'
-import prettier from 'eslint-config-prettier'
-import tseslint from 'typescript-eslint'
-
-export default tseslint.config(
-  {
-    ignores: ['**/dist/**', '**/node_modules/**', '**/*.gen.ts', '**/.angular/**'],
-  },
-  js.configs.recommended,
-  ...tseslint.configs.recommended,
-  {
-    languageOptions: {
-      parserOptions: { tsconfigRootDir: import.meta.dirname },
-    },
-    rules: {
-      '@typescript-eslint/no-unused-vars': [
-        'error',
-        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
-      ],
-      '@typescript-eslint/consistent-type-imports': 'error',
-    },
-  },
-  prettier,
-)

package/templates/new/knip.json

@@ -1,9 +0,0 @@
-{
-  "$schema": "https://unpkg.com/knip@latest/schema.json",
-  "workspaces": {
-    ".": {
-      "entry": ["scripts/*.ts"],
-      "project": ["scripts/**/*.ts"]
-    }
-  }
-}