ddd-ts-kit 0.0.0-stage → 0.1.1

package/templates/pipeline/github/workflows/ci.yml

@@ -0,0 +1,218 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    # Every night, everything: a pull request runs the specs of the contexts its change reaches.
+    - cron: '0 3 * * *'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # A newer commit of a pull request supersedes the run in progress; the default branch finishes every run.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  install:
+    name: Install
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      scope: ${{ steps.affected.outputs.scope }}
+      contexts: ${{ steps.affected.outputs.contexts }}
+      args: ${{ steps.affected.outputs.args }}
+      lint: ${{ steps.affected.outputs.lint }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # A pull request is checked out as its merge commit, whose first parent is the base it is compared with.
+          fetch-depth: 2
+      - uses: ./.github/actions/setup
+      - name: What this run covers (everything on the default branch and at night, the affected contexts on a pull request)
+        id: affected
+        env:
+          BASE: ${{ github.event_name == 'pull_request' && 'HEAD^1' || '' }}
+        run: npx --no -- ddd-ts-kit affected --base "$BASE" --format github | tee -a "$GITHUB_OUTPUT"
+
+  typecheck:
+    name: Typecheck
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup
+      - run: npm run ci:typecheck
+
+  lint:
+    name: Lint
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup
+      - run: npm run ci:format
+      - name: Lint (the contexts a pull request does not reach are left to the default branch)
+        env:
+          LINT: ${{ needs.install.outputs.lint }}
+        run: npm run ci:lint -- $LINT
+
+  architecture:
+    name: Architecture
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup
+      - name: Architecture rules
+        run: npm run ci:arch:check -- --format github
+      - name: Dependency graph
+        run: npm run ci:arch:graph
+
+  deadcode:
+    name: Dead code
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup
+      - run: npm run ci:deadcode
+
+  unit:
+    name: Unit tests
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup
+      - name: Unit specs, each context held to its coverage thresholds
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        env:
+          DDD_TS_KIT_AFFECTED: ${{ needs.install.outputs.contexts }}
+          PARTIAL: ${{ needs.install.outputs.args }}
+        run: npm run ci:test:unit -- $PARTIAL
+      - uses: actions/upload-artifact@v7
+        if: ${{ !cancelled() }}
+        with:
+          name: coverage
+          path: coverage
+          if-no-files-found: ignore
+          retention-days: 14
+
+  integration:
+    name: Integration tests
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      DATABASE_URL: postgres://app:app@localhost:5432/app
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup
+      - name: PostgreSQL
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        run: sh .github/scripts/start-postgres.sh
+      - if: ${{ needs.install.outputs.scope != 'none' }}
+        run: npm run db:migrate
+      - name: Integration specs, each context held to its coverage thresholds
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        env:
+          DDD_TS_KIT_AFFECTED: ${{ needs.install.outputs.contexts }}
+          PARTIAL: ${{ needs.install.outputs.args }}
+        run: npm run ci:test:integration -- $PARTIAL
+
+  e2e:
+    name: End-to-end tests
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      DATABASE_URL: postgres://app:app@localhost:5432/app
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup
+      - name: PostgreSQL
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        run: sh .github/scripts/start-postgres.sh
+      - if: ${{ needs.install.outputs.scope != 'none' }}
+        run: npm run db:migrate
+      - name: End-to-end specs (the whole application, whatever the contexts a change reaches)
+        if: ${{ needs.install.outputs.scope != 'none' }}
+        run: npm run ci:test:e2e
+
+  build:
+    name: Build, docs and contract drift
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup
+      - name: The production build
+        run: npm run ci:build
+      - name: Generated documents and contracts, from that build
+        run: npm run ci:docs
+
+  security:
+    name: Security
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup
+      - name: Production dependencies audit
+        run: npm run ci:audit
+      - name: Dependency review
+        if: ${{ github.event_name == 'pull_request' && !cancelled() }}
+        uses: actions/dependency-review-action@v5.0.0
+        with:
+          fail-on-severity: high
+      - name: Secrets
+        if: ${{ !cancelled() }}
+        run: docker run --rm --volume "$GITHUB_WORKSPACE:/repo" ghcr.io/gitleaks/gitleaks:v8.30.1 git /repo --redact --no-banner
+
+  image:
+    name: Docker image
+    needs: install
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
+        with:
+          context: .
+          push: false
+          tags: app:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  gate:
+    name: gate
+    if: ${{ always() }}
+    needs: [install, typecheck, lint, architecture, deadcode, unit, integration, e2e, build, security, image]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Every gate passed
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          echo "Results: $RESULTS"
+          for result in $RESULTS; do
+            if [ "$result" != "success" ]; then
+              echo "::error::A required job ended as $result."
+              exit 1
+            fi
+          done

package/templates/pipeline/github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '17 4 * * 1'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+          build-mode: none
+          queries: security-extended
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:javascript-typescript

package/templates/pipeline/github/workflows/pr-title.yml

@@ -0,0 +1,25 @@
+name: Pull request title
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  conventional-title:
+    name: Conventional title
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup
+      - name: The title is a conventional commit subject
+        env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: printf '%s\n' "$TITLE" | npx --no -- commitlint --verbose

package/templates/pipeline/gitlab/gitlab-ci.yml.tpl

@@ -0,0 +1,236 @@
+workflow:
+  auto_cancel:
+    on_new_commit: interruptible
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    # A pipeline schedule (Build > Pipeline schedules, every night on the default branch) runs everything.
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+
+include:
+  - template: Jobs/SAST.gitlab-ci.yml
+  - template: Jobs/Secret-Detection.gitlab-ci.yml
+  - template: Jobs/Dependency-Scanning.v2.gitlab-ci.yml
+    rules:
+      - if: $GITLAB_FEATURES =~ /\bdependency_scanning\b/
+
+stages:
+  - install
+  - test
+  - security
+  - gate
+
+variables:
+  AST_ENABLE_MR_PIPELINES: 'true'
+  NODE_IMAGE: node:24-bookworm-slim
+  # Behind the dependency proxy of a group, a registry that rate-limits is never asked twice:
+  # POSTGRES_IMAGE: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/postgres:18
+  POSTGRES_IMAGE: postgres:18
+
+default:
+  # A newer commit of a merge request supersedes the pipeline in progress; the default branch finishes every pipeline.
+  interruptible: true
+  # An image that could not be pulled (a registry that rate-limits once) or a runner that failed is tried again; a failing script is not.
+  retry:
+    max: 2
+    when: [runner_system_failure, stuck_or_timeout_failure, scheduler_failure]
+
+# One install per lockfile, shared by every job and every pipeline. The key holds the lockfile
+# and package.json: a hit is what a fresh install of that lockfile gives. A job that finds no
+# cache installs.
+.node:
+  image: $NODE_IMAGE
+  cache:
+    key:
+      files:
+        - package-lock.json
+        - package.json
+    paths:
+      - node_modules/
+    policy: pull
+  before_script:
+{{#if pm.corepack}}
+    - corepack enable
+{{/if}}
+    - test -d node_modules || npm ci
+{{#if orm.prisma}}
+    # The Prisma client and the schema of the tests are build products of prisma/schema.prisma.
+    - npm run db:client
+{{/if}}
+
+.postgres:
+  services:
+    - name: $POSTGRES_IMAGE
+      alias: postgres
+  variables:
+    POSTGRES_USER: app
+    POSTGRES_PASSWORD: app
+    POSTGRES_DB: app
+    DATABASE_URL: postgres://app:app@postgres:5432/app
+
+.junit:
+  artifacts:
+    when: always
+    expire_in: 14 days
+    reports:
+      junit: reports/junit.xml
+
+install:
+  extends: .node
+  stage: install
+  # The image with git: what a merge request covers is read from the difference with its target.
+  image: node:24-bookworm
+  cache:
+    key:
+      files:
+        - package-lock.json
+        - package.json
+    paths:
+      - node_modules/
+    policy: pull-push
+  script:
+    - node --version
+    - if [ -n "${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}" ]; then git fetch --quiet --depth=1 origin "$CI_MERGE_REQUEST_DIFF_BASE_SHA"; fi
+    # Everything on the default branch and on a schedule, the affected contexts on a merge request.
+    - npx --no -- ddd-ts-kit affected --base "${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}" --format env | tee affected.env
+  artifacts:
+    reports:
+      dotenv: affected.env
+
+merge-request-title:
+  extends: .node
+  stage: test
+  needs: [install]
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - printf '%s\n' "$CI_MERGE_REQUEST_TITLE" | sed -E 's/^(\[Draft\]|Draft:|\(Draft\)|WIP:) *//I' | npx --no -- commitlint --verbose
+
+typecheck:
+  extends: .node
+  stage: test
+  needs: [install]
+  script:
+    - npm run ci:typecheck
+
+lint:
+  extends: .node
+  stage: test
+  needs: [install]
+  variables:
+    ESLINT_CODE_QUALITY_REPORT: reports/gl-code-quality-eslint.json
+  script:
+    - mkdir -p reports
+    - npm run ci:format
+    # The contexts a merge request does not reach are left to the default branch.
+    - npm run ci:lint -- --format gitlab $AFFECTED_LINT
+  artifacts:
+    when: always
+    expire_in: 14 days
+    reports:
+      codequality: reports/gl-code-quality-eslint.json
+
+architecture:
+  extends: .node
+  stage: test
+  needs: [install]
+  script:
+    - mkdir -p reports
+    - npm run --silent ci:arch:check -- --format gitlab > reports/gl-code-quality-arch.json
+    - npm run ci:arch:graph
+  artifacts:
+    when: always
+    expire_in: 14 days
+    reports:
+      codequality: reports/gl-code-quality-arch.json
+
+deadcode:
+  extends: .node
+  stage: test
+  needs: [install]
+  script:
+    - npm run ci:deadcode
+
+unit:
+  extends: [.node, .junit]
+  stage: test
+  needs: [install]
+  script:
+    - if [ "$AFFECTED_SCOPE" = "none" ]; then echo "Only documents changed, no spec to run."; exit 0; fi
+    - export DDD_TS_KIT_AFFECTED="$AFFECTED_CONTEXTS"
+    - npm run ci:test:unit -- --reporter=default --reporter=junit --outputFile.junit=reports/junit.xml $AFFECTED_ARGS
+  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'
+  artifacts:
+    when: always
+    expire_in: 14 days
+    reports:
+      junit: reports/junit.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage/cobertura-coverage.xml
+
+integration:
+  extends: [.node, .postgres, .junit]
+  stage: test
+  needs: [install]
+  script:
+    - if [ "$AFFECTED_SCOPE" = "none" ]; then echo "Only documents changed, no spec to run."; exit 0; fi
+    - export DDD_TS_KIT_AFFECTED="$AFFECTED_CONTEXTS"
+    - npm run db:migrate
+    - npm run ci:test:integration -- --reporter=default --reporter=junit --outputFile.junit=reports/junit.xml $AFFECTED_ARGS
+
+e2e:
+  extends: [.node, .postgres, .junit]
+  stage: test
+  needs: [install]
+  script:
+    - if [ "$AFFECTED_SCOPE" = "none" ]; then echo "Only documents changed, no spec to run."; exit 0; fi
+    - npm run db:migrate
+    # The whole application, whatever the contexts a change reaches.
+    - npm run ci:test:e2e -- --reporter=default --reporter=junit --outputFile.junit=reports/junit.xml
+
+build:
+  extends: .node
+  stage: test
+  needs: [install]
+  script:
+    - npm run ci:build
+    # The generated documents and contracts, from that build.
+    - npm run ci:docs
+
+audit:
+  extends: .node
+  stage: security
+  needs: [install]
+  script:
+    - npm run ci:audit
+
+secrets:
+  stage: security
+  needs: []
+  image:
+    name: ghcr.io/gitleaks/gitleaks:v8.30.1
+    entrypoint: ['']
+  variables:
+    GIT_DEPTH: '0'
+  script:
+    - gitleaks git . --redact --no-banner
+
+image:
+  stage: test
+  needs: []
+  image:
+    name: moby/buildkit:v0.34.0-rootless
+    entrypoint: ['']
+  variables:
+    BUILDKITD_FLAGS: --oci-worker-no-process-sandbox
+  script:
+    - buildctl-daemonless.sh build --frontend dockerfile.v0 --local context=. --local dockerfile=. --output type=image,name=app:ci,push=false
+
+gate:
+  stage: gate
+  image: $NODE_IMAGE
+  variables:
+    GIT_STRATEGY: none
+  script:
+    - echo "Every job of the earlier stages passed."

package/templates/pipeline/gitlab/merge-request-settings.md

@@ -0,0 +1,89 @@
+# Merge request settings (GitLab)
+
+The pipeline only reports. These project settings make it binding. Nothing here is applied
+automatically: run the commands once, as a project maintainer. `glab api` replaces `:id` with
+the project of the current directory; with `curl`, use
+`--header "PRIVATE-TOKEN: <token>" "https://gitlab.example.com/api/v4/projects/<id>"`.
+
+## Pipelines must succeed, squash, resolved threads (every tier)
+
+```bash
+glab api --method PUT "projects/:id" \
+  -f only_allow_merge_if_pipeline_succeeds=true \
+  -f allow_merge_on_skipped_pipeline=false \
+  -f only_allow_merge_if_all_discussions_are_resolved=true \
+  -f squash_option=always \
+  -f merge_method=ff \
+  -f remove_source_branch_after_merge=true \
+  -f auto_cancel_pending_pipelines=enabled \
+  -f squash_commit_template='%{title}'
+```
+
+- `only_allow_merge_if_pipeline_succeeds` is what turns the whole pipeline, and so its final
+  `gate` job, into the required check. GitLab has no per-job required check on the Free tier:
+  the pipeline status is the unit.
+- `squash_option=always` with `squash_commit_template='%{title}'` makes the merge request title
+  the commit subject, which the `merge-request-title` job holds to the conventional format.
+- `auto_cancel_pending_pipelines` is the project side of `workflow:auto_cancel` and
+  `interruptible: true` in `.gitlab-ci.yml`.
+
+## Protected default branch (every tier)
+
+```bash
+glab api --method DELETE "projects/:id/protected_branches/main"
+glab api --method POST "projects/:id/protected_branches" \
+  -f name=main \
+  -f push_access_level=0 \
+  -f merge_access_level=40 \
+  -f allow_force_push=false
+```
+
+`push_access_level=0` means nobody pushes: every change goes through a merge request.
+`merge_access_level=40` is Maintainer; use `30` to let Developers merge. The `DELETE` is needed
+because a new project protects its default branch already and the rule cannot be created twice.
+
+## Commit messages (Premium and Ultimate)
+
+Push rules are a Premium feature. They reject non-conventional commits on the server:
+
+```bash
+glab api --method POST "projects/:id/push_rule" \
+  -f commit_message_regex='^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([a-z0-9-]+\))?!?: .+' \
+  -F prevent_secrets=true \
+  -F reject_unsigned_commits=false
+```
+
+Use `--method PUT` when a push rule already exists. On the Free tier the same rule is held on
+the client by the `commit-msg` hook of `lefthook.yml` and, for what reaches the default branch,
+by the squash setting above together with the `merge-request-title` job.
+
+## Approvals (Premium and Ultimate)
+
+```bash
+glab api --method POST "projects/:id/approval_rules" -f name=Review -F approvals_required=1
+```
+
+On the Free tier approvals are optional and cannot be enforced.
+
+## Control
+
+```bash
+glab api "projects/:id" | jq '{only_allow_merge_if_pipeline_succeeds, allow_merge_on_skipped_pipeline, squash_option, merge_method, only_allow_merge_if_all_discussions_are_resolved}'
+glab api "projects/:id/protected_branches/main" | jq '{name, allow_force_push, push: [.push_access_levels[].access_level], merge: [.merge_access_levels[].access_level]}'
+```
+
+## Scanners and tiers
+
+| Piece | Free | Premium | Ultimate |
+|---|---|---|---|
+| SAST template (`Jobs/SAST.gitlab-ci.yml`, Semgrep rules for JavaScript and TypeScript) | job runs, report downloadable as an artifact | same | findings in the merge request, vulnerability management, Advanced SAST |
+| Secret Detection template (`Jobs/Secret-Detection.gitlab-ci.yml`) | job runs, report downloadable as an artifact | same | findings in the merge request and the security dashboard |
+| Dependency Scanning template (`Jobs/Dependency-Scanning.v2.gitlab-ci.yml`) | not available: the `include` is skipped | not available | available |
+| Code Quality report (ESLint and architecture) | merge request widget | plus the pipeline report tab | plus inline in the changes view |
+| JUnit report, coverage percentage, Cobertura coverage in the diff | available | available | available |
+| Push rules | no | yes | yes |
+| Required approvals | no | yes | yes |
+
+The template jobs are `allow_failure: true` by design of GitLab: on Free and Premium they never
+block a merge. What blocks, on every tier, is the `audit` job (`npm audit`, production
+dependencies, high and above) and the `secrets` job (gitleaks).

package/templates/pipeline/knip.json.tpl

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json",
+  "entry": [
+{{#if tests.jest}}
+    "{{config.contextsDir}}/*/test/fakes/*.ts",
+{{/if}}
+{{#if knip.apps}}
+    "{{config.sourceRoot}}/apps/*/main.ts",
+{{/if}}
+    "scripts/*.ts"{{knip.e2eEntry}}
+  ],
+  "project": ["{{config.sourceRoot}}/**/*.ts", "scripts/**/*.ts"{{knip.e2eProject}}],
+{{#if knip.ignores}}
+  "ignoreDependencies": {{knip.ignored}},
+{{/if}}
+  "ignoreExportsUsedInFile": true,
+  "vitest": {
+    "config": ["vitest.config.ts"{{knip.e2eConfig}}],
+    "entry": [
+      "{{config.sourceRoot}}/**/*.spec.ts",
+      "{{config.contextsDir}}/*/test/fakes/*.ts",
+      "test/architecture/**/*.spec.ts"{{knip.e2eSpecs}}{{knip.testDatabase}}
+    ]
+  }
+}

package/templates/pipeline/lefthook.yml

@@ -0,0 +1,28 @@
+min_version: 2.0.0
+
+pre-commit:
+  parallel: true
+  jobs:
+    - name: eslint
+      glob: '*.{ts,mts,cts,js,mjs,cjs}'
+      run: npx --no -- eslint --no-warn-ignored {staged_files}
+    - name: format
+      glob: '*.{ts,mts,cts,js,mjs,cjs,json,jsonc}'
+      run: npx --no -- biome format --no-errors-on-unmatched {staged_files}
+    - name: architecture
+      glob: 'src/**/*.{ts,mts,cts}'
+      run: npx --no -- ddd-ts-kit check {staged_files}
+    - name: commit size
+      run: npx --no -- ddd-ts-kit check --commit-size --staged
+
+pre-push:
+  jobs:
+    - name: typecheck
+      run: npm run ci:typecheck
+    - name: unit tests
+      run: npm run ci:test:unit
+
+commit-msg:
+  jobs:
+    - name: conventional commit
+      run: npx --no -- commitlint --edit {1}

package/templates/pipeline/package-scripts.json

@@ -0,0 +1,38 @@
+{
+  "scripts": {
+    "typecheck": "node node_modules/@typescript/native/bin/tsc -p tsconfig.json --noEmit",
+    "build": "node node_modules/@typescript/native/bin/tsc -p tsconfig.build.json && ddd-ts-kit build-aliases",
+    "lint": "eslint .",
+    "format": "biome format --write .",
+    "format:check": "biome format .",
+    "ci:typecheck": "npm run typecheck",
+    "ci:lint": "eslint .",
+    "ci:format": "npm run format:check",
+    "ci:arch": "npm run ci:arch:check && npm run ci:arch:graph",
+    "ci:arch:check": "ddd-ts-kit check",
+    "ci:arch:graph": "depcruise src --config depcruise-config.mjs",
+    "ci:deadcode": "knip",
+    "ci:test:unit": "vitest run --project unit --coverage --mode unit",
+    "ci:test:integration": "vitest run --project integration --coverage --mode integration",
+    "ci:test:e2e": "vitest run --config vitest.e2e.config.ts --passWithNoTests",
+    "ci:docs": "npm run docs:check",
+    "ci:audit": "npm audit --omit=dev --audit-level=high",
+    "ci:build": "npm run build"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.5.15",
+    "@commitlint/cli": "^21.2.3",
+    "@commitlint/config-conventional": "^21.2.3",
+    "@ddd-ts-kit/eslint-plugin": "^0.1.1",
+    "@eslint/js": "^10.0.1",
+    "@typescript/native": "npm:typescript@~7.0.2",
+    "@vitest/coverage-v8": "5.0.3",
+    "dependency-cruiser": "^18.5.0",
+    "eslint": "^10.12.0",
+    "eslint-formatter-gitlab": "^7.2.0",
+    "knip": "^6.41.0",
+    "lefthook": "^2.2.1",
+    "typescript": "~6.0.3",
+    "typescript-eslint": "^8.71.1"
+  }
+}