adopt the ts-lib-starter layout and tooling

.github/workflows/build.yml

@@ -0,0 +1,26 @@
+name: Build
+
+on:
+  push:
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm check
+      - run: pnpm build

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  schedule:
+    - cron: 0 4 * * 1
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - javascript-typescript
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # Initializes the CodeQL tools for scanning.
+      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended,security-and-quality
+
+      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9

.github/workflows/publish.yml

@@ -0,0 +1,40 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    name: publish
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: package.json
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - name: determine dist-tag
+        id: dist-tag
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          if [[ "$VERSION" =~ -([a-zA-Z]+) ]]; then
+            echo "tag=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          fi
+      - name: publish
+        env:
+          NPM_TAG: ${{ steps.dist-tag.outputs.tag }}
+        run: pnpm publish --provenance --access public --no-git-checks --tag "$NPM_TAG"

.github/workflows/test.yml

@@ -0,0 +1,31 @@
+name: Test
+
+on:
+  push:
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+
+jobs:
+  test:
+    name: test on ${{ matrix.os-release }}
+    runs-on: ${{ matrix.os-release }}
+
+    strategy:
+      matrix:
+        os-release:
+          - ubuntu-latest
+          - windows-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm test:coverage

.gitignore

@@ -1,2 +1,25 @@
-node_modules/
-dist/
+## Windows
+Thumbs.db
+Desktop.ini
+$RECYCLE.BIN/
+
+## OS X
+.DS_Store
+._*
+
+## Editors and IDE
+*.sublime*
+*.code-workspace
+
+## Node.js
+node_modules
+*.log
+
+## Build
+build
+
+## Coverage reports
+coverage
+
+## API keys and secrets
+.env

.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+  "recommendations": ["oxc.oxc-vscode", "editorconfig.editorconfig", "vitest.explorer"]
+}

.vscode/settings.json

@@ -0,0 +1,10 @@
+{
+  "editor.codeActionsOnSave": {
+    "source.fixAll": "always",
+    "source.organizeImports": "always"
+  },
+  "editor.defaultFormatter": "oxc.oxc-vscode",
+  "editor.formatOnPaste": true,
+  "editor.formatOnSave": true,
+  "js/ts.preferences.importModuleSpecifierEnding": "js"
+}

CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-09-12
+
+### Added
+
+- First release: projects, tasks, search, create, update, move, archive, delete, changes, status and the MCP bridge over stdio

README.md

@@ -124,7 +124,7 @@ The same tools and resources are served either way.
 
 ## Contributing
 
-Bug reports and feature requests go in [issues](https://github.com/dotpm/cli/issues). The package builds with `pnpm build`, and `pnpm check` and `pnpm test` are what CI runs. The API contract it talks to is [`@dotpm/api`](https://github.com/dotpm/obsidian-pm/tree/main/packages/api), released from the plugin repository.
+Bug reports and feature requests go in [issues](https://github.com/dotpm/cli/issues). The package builds with `pnpm build` into `build/`, and `pnpm check` and `pnpm test:coverage` are what CI runs on Linux and Windows. The API contract it talks to is [`@dotpm/api`](https://github.com/dotpm/obsidian-pm/tree/main/packages/api), released from the plugin repository.
 
 ## License
 

oxlint.config.ts

@@ -3,14 +3,8 @@ import { defineConfig } from 'oxlint'
 
 export default defineConfig({
   extends: [axiom],
-  ignorePatterns: ['dist/**'],
   rules: {
-    'no-new': 'off',
-    'import/no-default-export': 'off',
     'jsdoc/require-param': 'off',
-    'jsdoc/require-returns': 'off',
-    'typescript/no-non-null-assertion': 'warn',
-    'promise/prefer-await-to-then': 'warn',
-    'promise/prefer-await-to-callbacks': 'warn'
+    'jsdoc/require-returns': 'off'
   }
 })

package.json

@@ -2,39 +2,67 @@
   "name": "@dotpm/cli",
   "version": "0.1.0",
   "description": "Command line for dotpm, the Obsidian project manager: list, search and edit tasks from a terminal or an agent",
-  "keywords": ["cli", "mcp", "obsidian", "project-management", "tasks"],
+  "keywords": [
+    "cli",
+    "mcp",
+    "obsidian",
+    "project-management",
+    "tasks"
+  ],
   "homepage": "https://github.com/dotpm/cli#readme",
+  "bugs": {
+    "url": "https://github.com/dotpm/cli/issues"
+  },
   "license": "MIT",
-  "repository": "github:dotpm/cli",
-  "bin": { "dotpm": "./dist/dotpm.js" },
-  "files": ["dist"],
+  "author": "dotpm (https://dotpm.pm)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dotpm/cli.git"
+  },
+  "bin": {
+    "dotpm": "./build/dotpm.js"
+  },
+  "files": [
+    "build"
+  ],
   "type": "module",
-  "publishConfig": { "access": "public" },
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "build": "tsdown",
     "check": "run-p check:**",
-    "check:code": "oxlint ./src",
-    "check:format": "oxfmt --check ./src",
-    "check:types": "tsc -noEmit -skipLibCheck",
+    "check:code": "oxlint ./source",
+    "check:format": "oxfmt --check ./source",
+    "check:types": "tsc --noEmit",
     "fix": "run-p fix:**",
-    "fix:code": "oxlint --fix ./src",
-    "fix:format": "oxfmt ./src",
+    "fix:code": "oxlint --fix ./source",
+    "fix:format": "oxfmt ./source",
+    "prepublishOnly": "run-s build",
+    "preversion": "run-s check test build",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:coverage": "vitest run --coverage"
   },
   "devDependencies": {
     "@2bad/axiom": "2.1.0",
     "@2bad/tsconfig": "4.0.0",
     "@dotpm/api": "0.1.0",
-    "@types/node": "26.4.1",
+    "@types/node": "26.5.1",
+    "@vitest/coverage-v8": "5.0.0",
     "npm-run-all2": "9.0.3",
-    "oxfmt": "0.66.0",
-    "oxlint": "1.81.0",
+    "oxfmt": "0.68.0",
+    "oxlint": "1.83.0",
+    "publint": "0.3.24",
     "tsdown": "0.23.0",
-    "typescript": "6.0.3",
+    "typescript": "7.0.2",
     "vitest": "5.0.0"
   },
-  "packageManager": "pnpm@11.5.3",
-  "engines": { "node": ">=22" },
-  "volta": { "node": "24.15.0", "pnpm": "11.5.3" }
+  "engines": {
+    "node": ">=22"
+  },
+  "volta": {
+    "node": "26.8.1",
+    "pnpm": "11.27.0"
+  },
+  "packageManager": "pnpm@11.27.0"
 }

pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+minimumReleaseAgeExclude:
+  - '@2bad/*'
+  - '@dotpm/*'

src/cli.test.ts → source/cli.test.ts

@@ -1,7 +1,7 @@
 import { createRouter } from '@dotpm/api'
 import { FakeApi } from '@dotpm/api/testing'
 import { beforeEach, describe, expect, it } from 'vitest'
-import { runCli, type CliDeps } from './cli'
+import { runCli, type CliDeps } from './cli.ts'
 
 const TOKEN = 'secret-token-0123456789'
 const VAULT = '/vault'