fix(create-bestax): bring the vite-ts tsconfigs up to create-vite 9

[allxsmith]

The create-bestax vite-ts template had fallen a create-vite major behind on its tsconfigs: an ES2020 target and lib, and a src/vite-env.d.ts for the Vite client types. The docs fence gate, meanwhile, checked every live example against a literal copy of create-vite's newer options, not the template's. So a fence using .at() passed the gate and was a type error in the app npm create bestax actually makes.

This brings the template's tsconfigs up to create-vite's, points the fence gate at the template itself, keeps the StackBlitz project in step, and writes down when to catch up next time.

The template

The tsconfigs are create-vite 9.2.1's react-ts files, byte for byte (same git blobs): packages/create-vite/template-react-ts at create-vite@9.2.1. The tsconfigs at that tag are still the ones on vite's main. tsconfig.json was already the same, so it doesn't change.

--- a/create-bestax/templates/vite-ts/tsconfig.app.json
+++ b/create-bestax/templates/vite-ts/tsconfig.app.json
 {
   "compilerOptions": {
-    "target": "ES2020",
-    "useDefineForClassFields": true,
-    "lib": ["ES2020", "DOM", "DOM.Iterable"],
-    "module": "ESNext",
-    "skipLibCheck": true,
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "target": "es2023",
+    "lib": ["ES2023", "DOM"],
+    "module": "esnext",
+    "types": ["vite/client"],
+    "allowArbitraryExtensions": true,
+    "skipLibCheck": true,

     /* Bundler mode */
     "moduleResolution": "bundler",
     "allowImportingTsExtensions": true,
-    "resolveJsonModule": true,
-    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
     "noEmit": true,
     "jsx": "react-jsx",

     /* Linting */
-    "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
     "noFallthroughCasesInSwitch": true
   },
   "include": ["src"]
 }
--- a/create-bestax/templates/vite-ts/tsconfig.node.json
+++ b/create-bestax/templates/vite-ts/tsconfig.node.json
 {
   "compilerOptions": {
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
+    "target": "es2023",
+    "lib": ["ES2023"],
+    "types": ["node"],
     "skipLibCheck": true,
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "allowSyntheticDefaultImports": true,
+
+    /* Bundler mode */
+    "module": "nodenext",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
     "noEmit": true,
-    "strict": true,
-    "types": ["vite/client"]
+
+    /* Linting */
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true
   },
   "include": ["vite.config.ts"]
 }

And src/vite-env.d.ts is gone, since types: ["vite/client"] does its job.

A few of the removals look scarier than they are:

• strict isn't off. TypeScript 6, which the template installs, turns it on by default, which is why create-vite dropped the line. The fence gate's untyped-state fixture only fails under strictNullChecks, so it would catch the gate losing strict mode.
• DOM.Iterable is folded into DOM in TypeScript 6.
• isolatedModules comes with verbatimModuleSyntax, and resolveJsonModule is the default under bundler resolution. A JSON import in src/ still compiles.

One devDependency joins: @types/node at create-vite's range (^24.13.3). tsconfig.node.json names types: ["node"], and without the package tsc -b stops on TS2688. Vite lists it only as an optional peer, so nothing else brings it in. If you'd rather not add it, the alternative is types: [] in tsconfig.node.json, which leaves vite.config.ts without Node's types, the way it is today.

Everything else stays put: ESLint with typescript-eslint is still the linter (create-vite now ships oxlint), and the App, its assets, the README, vite.config.ts and main.tsx are untouched.

What verbatimModuleSyntax and erasableSyntaxOnly forced: nothing. The template's own source has no type-only value import and no enum, and neither does anything create-bestax writes into it. The flavor step writes CSS imports, the icon step writes CSS imports and IconText, and ConfigProvider is a value import.

The fence gate

scripts/docs-fence-types.test.mjs no longer carries its own options. It reads the options of the template project that compiles src/, through the reader skill-examples-typecheck.test.mjs already used, which moves to scripts/lib/template-tsconfig.mjs (with its tests, in scripts/template-tsconfig.test.mjs). That reader parses with getParsedCommandLineOfConfigFile, so the comments in the template's JSON are fine, and it fails on any option it can't read rather than dropping it. Both gates now hold code to the same file.

The fence gate overrides two options, each with a comment:

• types: [], since vite/client resolves from a scaffold's install, not from the template in this repo (left as is, it's a TS2688), and only declares asset imports, which no fence keeps.
• allowJs: true, for the docs-only ProfileCard, a .jsx file.

It needs nothing for noEmit or paths: the template already sets noEmit, and the fence modules sit in bulma-ui/ so the library resolves without paths.

Every live fence passes under the template's options. No fence changed.

The new reader has a coverage floor row, and one new test (a template with no tsconfig.json) for the one path the moved tests didn't reach.

The docs sandboxes

The StackBlitz builder copies the template's files by name, so TEMPLATE_FILES and the raw-loader imports in open.js drop vite-env.d.ts in the template commit, or the docs build would fail looking for it. The project now gets the new tsconfigs and @types/node along with them. CodeSandbox has its own tsconfig for its older editor, so it doesn't change.

sandbox.test.mjs already failed when a copied file left the template, but a file the template gained went unnoticed. Now every file the template tracks has to be in TEMPLATE_FILES or in a LEFT_OUT map with the reason the sandbox does without it (the gitignore, README, lint config, the starter App with its CSS and images). The list comes from git ls-files, so a lockfile or dist/ from an install inside the template doesn't count.

The buttons copy from the TEMPLATE map in open.js, not from TEMPLATE_FILES, and before this no test read it. A file listed in one and left out of the other passed every check, and the button threw on the reader's click. open.js only runs under webpack, so the test reads it as text. Its keys have to be exactly TEMPLATE_FILES, each bound to the raw-loader import of the file with that name.

These fail it: dropping a key from open.js, binding a key to the wrong file's import, and taking README.md out of LEFT_OUT. A lockfile and dist/ left in the template don't.

turbo.json needed nothing. docs#test already lists create-bestax/templates/vite-ts/** as an input, and the fence gate runs in test:scripts, outside turbo.

When to catch up next time

create-bestax/CLAUDE.md now says that at each Vite or create-vite major you scaffold npm create vite@latest's react-ts, compare its tsconfigs, devDependencies, vite.config.ts and src/main.tsx, and catch up. It names what differs on purpose: the App, its assets, the README, and ESLint as the linter. It doesn't include a version number, so it won't go stale.

What #1049 proposed

• Build the generated StackBlitz project in the docs test run: declined, in favour of the note above. visual-regression.yml already installs and builds vite-ts scaffolds on every PR that touches create-bestax/** and on a daily schedule. The fence gate type-checks each sandbox App.tsx under the template's options, and the sandbox test holds the copied file list to the template. A build in the docs tests would add an install of the assembled project (the template's package.json without its lint packages) on every run.
• Decide how the template follows create-vite: the note in create-bestax/CLAUDE.md.
• Keep the template versions on the deliberate-dependency rules: the one new version, @types/node, is create-vite's range, published well before the cooldown, and nothing is latest.

Checked

• Every scaffold builds and lints. I scaffolded vite-ts outside the repo in all 30 combinations of the five Bulma flavors (complete, prefixed, no-helpers, no-helpers-prefixed, no-dark-mode) and the six icon choices (none, fontawesome, mdi, ionicons, material-icons, material-symbols), and ran tsc -b, vite build and eslint . in each. They shared one real npm install of the template's dependencies plus the icon packages. One app went through a fresh npm install && npm run build && npm run lint. Another went through pnpm install --ignore-workspace and pnpm run build and lint, the way the visual-regression workflow does it.
• The new options are live. A probe file in a scaffold failed with TS1484 (a type imported without import type) and TS1294 (an enum), and .at() and import.meta.env compiled.
• The visual-regression baselines shouldn't move. I built three scaffolds (complete/none, no-helpers-prefixed/fontawesome, prefixed/mdi) under the old tsconfigs and the new ones, and dist/ came out byte-identical.
• The StackBlitz project builds. I wrote the project stackblitzProject makes for an example using .at() and an MDI icon, from the real template, and it passed tsc -b && vite build.
• pnpm --filter create-bestax test:coverage, the docs tests, pnpm test:scripts (coverage floors included), pnpm check:conformance, pnpm typecheck, pnpm lint, pnpm format:check, and the three gen:*:check staleness checks all pass. I didn't run pnpm all.

Releasing and listings

Squashed under this title, it's a patch release of create-bestax, which is how the new template reaches npm create bestax. The test, test(docs) and docs commits release nothing.

Nothing in "What goes stale" in the distribution guide applies. No skill, MCP tool, install command, package folder or Node floor changes.

Fixes #1049

[allxsmith]

deep-review: fresh

This brings create-bestax's vite-ts template up to create-vite 9.2.1's tsconfigs. tsconfig.app.json and tsconfig.node.json are now byte-identical to create-vite's at the tag, src/vite-env.d.ts is gone, and @types/node joins devDependencies for types: ["node"]. ESLint stays.

The docs fence gate now reads its compiler options from the template's tsconfig.app.json, through a reader shared with the skill-examples gate. That replaces a hard-coded literal, so the gate checks fences against what a StackBlitz reader actually compiles. The sandbox file list drops vite-env.d.ts, and a new guard fails on a template file the StackBlitz project neither copies nor lists as left out. create-bestax/CLAUDE.md gains a re-sync note for each create-vite major.

Review it in full:

• Check the claim that no removed option loosens checking under TypeScript 6.
• Check every create-bestax flavor and icon path still compiles under verbatimModuleSyntax and erasableSyntaxOnly.
• Check the gate's two overrides (types: [], allowJs) and that each is needed.
• Check the shared reader's failure modes and its coverage floor row.
• Check the guard's LEFT_OUT map.

Post every finding, advisory included, as its own thread.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​node@​24.19.2

View full report

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 3 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: allxsmith/bestax/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 48461f3a-1eee-4a7c-afb5-8108b926e5cf

📥 Commits

Reviewing files that changed from the base of the PR and between 7830d90 and 92f54f9.

📒 Files selected for processing: 13

• create-bestax/CLAUDE.md
• create-bestax/templates/vite-ts/package.json
• create-bestax/templates/vite-ts/src/vite-env.d.ts
• create-bestax/templates/vite-ts/tsconfig.app.json
• create-bestax/templates/vite-ts/tsconfig.node.json
• docs/scripts/sandbox.test.mjs
• docs/src/theme/CodeBlock/sandbox/open.js
• docs/src/theme/CodeBlock/sandbox/projects.mjs
• scripts/coverage-floors.json
• scripts/docs-fence-types.test.mjs
• scripts/lib/template-tsconfig.mjs
• scripts/skill-examples-typecheck.test.mjs
• scripts/template-tsconfig.test.mjs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: allxsmith/bestax/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: e3b9b505-2369-4905-bd65-99cb3b8f9bef

📥 Commits

Reviewing files that changed from the base of the PR and between 4c2f53b and 7830d90.

📒 Files selected for processing: 13

• create-bestax/CLAUDE.md
• create-bestax/templates/vite-ts/package.json
• create-bestax/templates/vite-ts/src/vite-env.d.ts
• create-bestax/templates/vite-ts/tsconfig.app.json
• create-bestax/templates/vite-ts/tsconfig.node.json
• docs/scripts/sandbox.test.mjs
• docs/src/theme/CodeBlock/sandbox/open.js
• docs/src/theme/CodeBlock/sandbox/projects.mjs
• scripts/coverage-floors.json
• scripts/docs-fence-types.test.mjs
• scripts/lib/template-tsconfig.mjs
• scripts/skill-examples-typecheck.test.mjs
• scripts/template-tsconfig.test.mjs

💤 Files with no reviewable changes: 3

• create-bestax/templates/vite-ts/src/vite-env.d.ts
• docs/src/theme/CodeBlock/sandbox/open.js
• docs/src/theme/CodeBlock/sandbox/projects.mjs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The Vite TypeScript template’s compiler settings and files changed. Sandbox generation and validation now track the template file set, and compiler-option checks read options from the template through a shared helper.

Changes

Vite TypeScript template alignment

Layer / File(s)	Summary
Template configuration and sync guidance create-bestax/templates/vite-ts/*, create-bestax/CLAUDE.md	The template updates its TypeScript configurations and adds @types/node. It removes src/vite-env.d.ts. The guidance describes comparison with Vite’s react-ts starter and alignment with docs sandbox files.
Sandbox file set docs/src/theme/CodeBlock/sandbox/*, docs/scripts/sandbox.test.mjs	Sandbox generation no longer includes src/vite-env.d.ts. The test checks that each template file is copied or listed as intentionally excluded, and that each exclusion still exists.
Compiler-option checks scripts/lib/template-tsconfig.mjs, scripts/*typecheck.test.mjs, scripts/docs-fence-types.test.mjs, scripts/template-tsconfig.test.mjs, scripts/coverage-floors.json	A shared helper reads compiler options from the template project that compiles src/. Documentation and skill-example checks use it. New tests cover missing or invalid configuration and cyclic project references; the helper is added to coverage floors.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 7830d

This change aligns the Vite TypeScript template's compiler settings with the upstream starter and updates the docs sandbox checks. No actionable merge-blocking risk was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #1049 requires an automated docs-test check that builds a generated StackBlitz project with the real template. The current docs/scripts/sandbox.test.mjs checks project contents and template-fi…	Add an automated docs test or invoked test helper that generates a StackBlitz project from the real vite-ts template, installs or uses its dependencies, and runs tsc -b && vite build. Make the docs test fail when that build fails.

Passed checks: 4 passed

Check name	Status	Explanation
Out of Scope Changes check		The changed areas support Issue #1049. They update the vite-ts template, synchronize StackBlitz inputs, align the type-check gate with the template, detect uncopied template files, and document the …
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 5 files. (5 skipped: 5 …
Title check		The title clearly identifies the primary change: updating the create-bestax vite-ts TypeScript configurations to match create-vite 9.
Description check		The description is comprehensive. It explains the affected create-bestax template, related issue #1049, configuration changes, documentation and sandbox updates, validation results, and the fact that …

Full details: Out of Scope Changes check

Explanation

The changed areas support Issue #1049. They update the vite-ts template, synchronize StackBlitz inputs, align the type-check gate with the template, detect uncopied template files, and document the create-vite re-check point. The added reader tests and coverage floor are supporting tests. No unrelated change is demonstrated.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 5 files. (5 skipped: 5 unsupported.)

Full details: Description check

Explanation

The description is comprehensive. It explains the affected create-bestax template, related issue #1049, configuration changes, documentation and sandbox updates, validation results, and the fact that pnpm all was not run. It does not reproduce the repository template headings or checkbox checklist, but the required information is present in the prose.

Full details: Linked Issues check

Explanation

Issue #1049 requires an automated docs-test check that builds a generated StackBlitz project with the real template. The current docs/scripts/sandbox.test.mjs checks project contents and template-file coverage, but it does not run tsc -b or vite build. The reported StackBlitz build is manual evidence and does not implement the requested automated check. The template sync, dependency update, sandbox file synchronization, and create-vite re-check note address the other stated objectives.

Resolution

Add an automated docs test or invoked test helper that generates a StackBlitz project from the real vite-ts template, installs or uses its dependencies, and runs tsc -b && vite build. Make the docs test fail when that build fails.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Preview Deployment

Preview URL: https://1e5619cd.bestax.pages.dev

[claude]

Deep review — 0 blocking · 3 advisory

#	Severity	Area	Finding	Location
1	🔵 Advisory	Coverage	The new guard closes template dir ↔ TEMPLATE_FILES, but nothing reads the TEMPLATE map in open.js, so a file a future catch-up adds can break the sandbox button at click time	docs/scripts/sandbox.test.mjs:412
2	🔵 Advisory	Robustness	templateFiles() walks the working tree, so a lockfile or dist/ left by an in-place install fails the gate with the wrong instruction	docs/scripts/sandbox.test.mjs:396
3	🔵 Advisory	Coverage	Fixes #1049 closes the issue while its first proposal — a check that builds the generated StackBlitz project — stays a one-time manual check	create-bestax/CLAUDE.md:82 (no line of its own)

Overall: Sound, and unusually well evidenced. I checked both tsconfigs and @types/node: ^24.13.3 byte-for-byte against vitejs/vite at the SHA the PR names, and every removal against the installed typescript@6.0.3 rather than against a changelog: getStrictOptionValue reads strict !== false, so unset is on; isolatedModules is implied by verbatimModuleSyntax; resolveJsonModule defaults true under bundler resolution; useDefineForClassFields defaults true at ES2022+; allowSyntheticDefaultImports defaults true; and lib.dom.iterable.d.ts is now a stub saying its contents are included in the main types file. The riskiest part is the one the focus names — the fence gate no longer spells strict out, so it inherits it from whatever TypeScript the repo has — and that turns out to be self-guarding: fixture/untyped-state.md asserts a TS2322 that exists only under strictNullChecks, so losing strict mode reds the gate rather than quietly widening it. Human attention is best spent on finding 1: the file-list chain is now airtight on the half a test can see, and untested on the half the shipped site actually uses.

Residual risk:

• The gate checking options no app has — closed. Both gates read one appCompilerOptions, and template-tsconfig.test.mjs pins the configFilePath it lands on to inside the template, so a reader that silently picked the wrong project fails. Build and Test is green on this commit, which exercises test:scripts including the new branches: 82 floor row.
• The two overrides hiding a difference — refuted; both are needed and neither relaxes checking. types: [] because vite/client cannot resolve from a template with no install (TS2688), and allowJs for the docs-only .jsx ProfileCard. Both make the gate stricter than the scaffold, so they can only produce loud false failures, never a false pass. The inherited tsBuildInfoFile is not neutralized the way the skill-examples gate neutralizes it, but TypeScript writes build info only when incremental or composite is set, neither is, and the gate never emits — so nothing is written.
• A flavor or icon path tripping the new options — refuted. The scaffolder writes only CSS imports, IconText and ConfigProvider, all value imports, with no enum, namespace or parameter property anywhere in it or in the template source. Five vite-ts scenarios in visual-regression.yml install standalone and run tsc -b && vite build; all pass on this commit, as do the two skill examples that use import type.
• LEFT_OUT drifting — refuted today. The 9 copied plus 7 left-out entries are exactly the 16 files in the template, each reason matches what the builder does (the lint packages really are stripped; App.css, App.tsx, react.svg and vite.svg really are starter-only), and a stale LEFT_OUT key now fails too.
• Open: the TEMPLATE_FILES to open.js leg (finding 1), the one path left where the sandbox can fall a step behind the scaffold with every gate green.
• Open, low: the shared reader compares the forward-slash fileNames TypeScript reports against join(template, "src") + path.sep, so on Windows both gates would assert.fail("no project … compiles src/"). Moved verbatim rather than introduced, it fails loudly rather than silently, and nothing in the repo claims Windows as a dev platform — so recorded here, not raised.
• Not a risk: a template that compiled src/ through two projects would get the first in reference order. Only tsconfig.app.json includes src, and the create-bestax jest walk independently asserts noEmit on every project that has files.

🏄 Total cleanup set, dude — paddled the template out of ES2020, pointed the fence gate at the real board instead of a photo of one, and brought upstream receipts for every line. Only thing still bobbing out back is that open.js file list nobody is watching. Ship it.

[allxsmith]

deep-review: verify

Every open thread has a reply: fixed, with the commit, or refuted with a reason. This settles them on 0cac0ca.

[github-actions]

Preview Deployment

Preview URL: https://d5f98b6e.bestax.pages.dev

[claude]

Deep review (verify) — 3 resolved · 0 open

#	Severity	Area	Finding	Location
1	🔵 Advisory	Coverage	The TEMPLATE map in open.js was unguarded — fixed in 58a1b3c1, resolved	docs/scripts/sandbox.test.mjs:445
2	🔵 Advisory	Robustness	templateFiles() walked the working tree — fixed in dc4fbe0b, resolved	docs/scripts/sandbox.test.mjs
3	🔵 Advisory	Coverage	Fixes #1049 with the build check unimplemented — accepted, the decision is now recorded in the PR body, resolved	create-bestax/CLAUDE.md:82

Overall: This pass settled the three threads the earlier deep review left open, and reviewed no commits. Two were code findings and both are genuinely fixed rather than papered over: openJsTemplate() parses open.js as text and holds its TEMPLATE to TEMPLATE_FILES in both directions, and templateFiles() reads git ls-files, so a local lockfile or dist/ no longer fails the gate. The third was a reasoned decline from the maintainer, with the decision written into the PR body, which is what the finding asked for. Nothing here is left for a human to rule on.

What I checked, per thread

Thread 1 — the TEMPLATE map in open.js (58a1b3c). I re-ran the new guard against mutations of the real open.js:

Mutation	keys match	misbound
baseline	true	[]
drop the src/main.tsx key	false	["src/main.tsx"]
bind tsconfig.app.json to tsconfigNode	true	["tsconfig.app.json"]
add a stray src/App.css key	false	[]
repoint the main.tsx import path	true	["src/main.tsx"]

Every mutation trips at least one of the two assertions, and the baseline is clean. The wrong-file binding is the case a plain includes check would have let through, so this is stricter than the fix I had suggested.

Thread 2 — templateFiles() (dc4fbe0). I dropped package-lock.json, pnpm-lock.yaml and dist/assets/index.js into create-bestax/templates/vite-ts and ran the same git ls-files -z plus existsSync call: 16 tracked files came out (9 TEMPLATE_FILES and 7 LEFT_OUT), with the lockfiles visible only as untracked in git status --porcelain. I removed them again, and the tree is clean. The existsSync filter covers the other direction, a tracked file deleted but not staged.

Thread 3 — the issue reference. The PR body now carries a "What #1049 proposed" section marking the docs-test build of the assembled StackBlitz project as declined, with the cost it would add and the compensating gates. The reply is from allxsmith, live role_name: admin.

Test run. pnpm --filter @allxsmith/bestax-docs run test — 121 pass, 0 fail, including both of the the template files tests. One run covers every thread.

Residual risk: none newly identified, a verify pass raising no findings by design. On the failure class the settled threads named: the TEMPLATE_FILES-to-open.js half of the copied-file chain is now closed both ways, with each key bound to the import of the file of that name (mutation-tested above), and the template-directory half no longer mistakes untracked build output for a file the template gained (reproduced, then refuted, above). The gap the maintainer accepted on the record stands: no gate installs and builds the project stackblitzProject assembles, so a break reachable only through the rewritten package.json or the edited main.tsx still surfaces on a reader click.

🏄 Three advisories paddled out, three came back in clean — two with real code behind them and one with a straight answer on the record. The author even out-hardened my own suggestion on the open.js guard, which is the good kind of getting dropped in on. Good to go.

[github-actions]

📸 Story screenshots at handoff — 0cac0ca

No Storybook stories map to this PR's changed files — nothing to screenshot. (workflow run)

[github-actions]

Preview Deployment

Preview URL: https://c08c1181.bestax.pages.dev

[allxsmith]

deep-review: fresh

Main is merged in, with what landed since the last review, and the generated files are regenerated. The last review covered the PR before that merge, so this one reviews the head in full. Post every finding, advisory included, as its own thread.

[claude]

Deep review — 0 blocking · 1 advisory

#	Severity	Area	Finding	Location
1	🔵 Advisory	Coverage	The new file-list guard closes template ↔ StackBlitz in both directions; the CodeSandbox project's set is hand-rolled and still unguarded, and the new create-bestax/CLAUDE.md bullet reads as covering both	docs/scripts/sandbox.test.mjs:390

Overall: Sound, and verified this pass by the thing that matters rather than by reading: the six Test vite-ts-* visual-regression jobs on 200b790 are green, and each one scaffolds the template, runs a real pnpm install --ignore-workspace and then pnpm run build — tsc -b && vite build — so @types/node@^24.13.3 resolves from npm and the two new tsconfigs type-check a real app. Locally pnpm run test:scripts exits 0 with every coverage floor met, and pnpm --filter @allxsmith/bestax-docs run test passes, including the two new the template files tests. The riskiest part is the one the focus names — the merge, whose single conflict was in scripts/docs-fence-types.test.mjs — and it is resolved correctly: it keeps main's docsOnlyModule: DOCS_ONLY_MODULE over the branch's profileCard: PROFILE_CARD while keeping fenceCompilerOptions(), and both scope-binding tests that would catch a wrong resolution pass. Human attention is best spent on the advisory, which is a scope question rather than a defect.

Residual risk:

• The gate checking options no app has — closed. Both gates read one appCompilerOptions(), and template-tsconfig.test.mjs pins the configFilePath it lands on to inside the template. The new floor row is not a loose one either: template-tsconfig.mjs measures 100 / 94.12 / 100, and the row 100 / 82 / 100 is exactly the documented rule — two covered branches of slack, (16-2)/17 = 82.35 — so it was derived, not picked.
• Dropping strict from the fence gate's options — refuted. The root typescript is ^6.0.3, where an unset strict reads as on, and fixture/untyped-state.md asserts a TS2322 that exists only under strictNullChecks, so losing strict mode reds the gate rather than quietly widening it.
• types naming vite/client moving into the app project — new in this diff, since it used to sit in tsconfig.node.json, which no gate reads, so appCompilerOptions() now hands it to both gates. Refuted: each overrides it to an empty list, and the raises nothing outside the examples themselves test in skill-examples-typecheck.test.mjs keys on a diagnostic with no file, which is exactly where the TS2688 would land if that override ever went away.
• The two fence-gate overrides hiding a difference — refuted; both make the gate stricter than the scaffold (an empty types against the app's vite/client, allowJs only for the docs-only .jsx), so they can produce loud false failures, never a false pass. The inherited tsBuildInfoFile is not neutralized the way the skill gate neutralizes it, but TypeScript writes build info only under incremental or composite, neither is set, and the gate never emits.
• The deleted src/vite-env.d.ts leaving a dangling reference — refuted; vite-env appears nowhere else in the tree (skills, bestax-mcp/data, the workflows, the docs and create-bestax/src are all clean), and codesandboxFiles writes its own src/css.d.ts rather than reading it.
• An open.js-only edit skipping the new guard under turbo — refuted. The docs test task carries the turbo default input set alongside the template input, so a change under docs/src/ invalidates its cache.
• Open: which project appCompilerOptions() lands on is decided by reference order, and its test pins only that the config sits inside the template. A future template with a second project over src/ listed ahead of tsconfig.app.json would swap the options both gates hold code to, with every test green. Not reachable today, since the template has one project over src/.
• Open: the CodeSandbox half of the sandbox file list, posted as finding 1.

🏄 Dude, this one caught the wave it was paddling for — the template is back in step with create-vite, the fence gate finally reads the same file the app does, and six real scaffolds built clean in CI. Clean ride, green light, go surf.

[allxsmith]

deep-review: verify

Every open thread has a reply: fixed, with the commit, or refuted with a reason. This settles them on 92f54f9.

[github-actions]

Preview Deployment

Preview URL: https://0365c5d7.bestax.pages.dev

[claude]

Deep review (verify) — 1 resolved · 0 open

No.	Severity	Area	Thread	Location
1	🔵 Advisory	Coverage	CodeSandbox project unguarded by the new file-list check — accepted as deliberate, prose narrowed in bf1fa9a4	docs/scripts/sandbox.test.mjs:392

Overall: This pass settled threads and reviewed no commits. One advisory thread was open; the maintainer answered it as deliberate and applied the finding's own suggested remedy — the LEFT_OUT comment now carries the clause, and the create-bestax/CLAUDE.md bullet scopes the guard to the StackBlitz project while stating that no test holds the CodeSandbox builder to the template. I confirmed that narrowed prose is true against projects.mjs (codesandboxFiles reads three template entries; public/index.html and tsconfig.json are written from literals) and that the docs suite is green at 125/125. Every thread of mine on this PR is now resolved.

Residual risk:

• The CodeSandbox project still has no file-list guard — refuted as a blocker rather than as a risk: a CRA layout has no file-for-file mapping to the Vite template, five of the nine TEMPLATE_FILES entries already go unused there, and the limitation is now stated in both the test and create-bestax/CLAUDE.md instead of being implied away.
• No new findings were hunted for: a verify pass settles open threads only. A reader who wants the current code reviewed asks for a fresh one.

🏄 Last wave of the set, and it came in clean — one advisory, answered with a reason that actually holds, and the docs even got honest about what the check does and does not cover. Board is on the rack, 125 for 125, this one is good to paddle in.

[bestax-release-bot]

🎉 This PR is included in version 4.2.17 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bestax-release-bot]

🎉 This PR is included in version 5.35.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bestax-release-bot]

🎉 This PR is included in version 2.25.5 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bestax-release-bot]

🎉 This PR is included in version 1.15.7 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀