Merge pull request #34 from boringstack-xyz/chore/boringstack-family-bun-security

feat: adopt boringstack family conventions, bun, and org security CI

Author: agjs

.claude/agents/domain-reviewer.md

@@ -28,4 +28,4 @@ For each failure, point to the file:line and explain which rule it violates and
 
 Do not modify any files. Read-only review.
 
-Run `pnpm lint src/domain/` and include any lint errors in the report.
+Run `bun run lint src/domain/` and include any lint errors in the report.

.claude/commands/check.md

@@ -1,8 +1,8 @@
 ---
-description: Run pnpm check and summarize any failures
+description: Run bun run check and summarize any failures
 ---
 
-Run `pnpm check` and report the result:
+Run `bun run check` and report the result:
 
-- If it passes: say "check: green" and stop.
+- If it passes: say "check: green". Mention that `bun run validate` is the full bar (check + Playwright smoke) if they asked whether they can ship.
 - If it fails: show the first failing step and the first 20 lines of its output, then stop. Do not attempt fixes unless I ask.

.claude/commands/new-feature.md

@@ -1,9 +1,9 @@
 ---
-description: Scaffold a new feature via pnpm new:feature
+description: Scaffold a new feature via bun run new:feature
 argument-hint: <FeatureName>
 ---
 
-Run `pnpm new:feature $ARGUMENTS`. Then:
+Run `bun run new:feature $ARGUMENTS`. Then:
 
 1. Read `docs/ai/feature-checklist.md` if you haven't in this session.
 2. List the files that were created.

.claude/commands/new-module.md

@@ -1,9 +1,9 @@
 ---
-description: Scaffold a new domain module via pnpm new:module
+description: Scaffold a new domain module via bun run new:module
 argument-hint: <ModuleName>
 ---
 
-Run `pnpm new:module $ARGUMENTS`. Then:
+Run `bun run new:module $ARGUMENTS`. Then:
 
 1. Read `docs/ai/module-template.md` and `docs/ai/naming-conventions.md` if you haven't in this session.
 2. Describe the 8 files that were created.

.claude/commands/new-scene.md

@@ -1,9 +1,9 @@
 ---
-description: Scaffold a new Phaser scene via pnpm new:scene
+description: Scaffold a new Phaser scene via bun run new:scene
 argument-hint: <SceneName>
 ---
 
-Run `pnpm new:scene $ARGUMENTS`. Then:
+Run `bun run new:scene $ARGUMENTS`. Then:
 
 1. Read `docs/ai/scene-template.md` if you haven't in this session.
 2. Remind me to register the scene in `src/app/config/gameConfig.ts`.

.claude/commands/review-slice.md

@@ -9,6 +9,6 @@ Review the feature at `$ARGUMENTS` (or the most recently-changed feature if no p
 2. Does it define `I<Name>FeatureDeps` with an event bus + any ports it needs?
 3. Does it have a `.test.ts` with fake ports from `@shared/testing`?
 4. Does it register in a scene's `*.setup.ts`?
-5. Does `docs/ai/catalog.md` list it? (Run `pnpm catalog` and check.)
+5. Does `docs/ai/catalog.md` list it? (Run `bun run catalog` and check.)
 
 Report as a short checklist. Do not fix issues automatically — list them.

.claude/commands/speckit/implement.md

@@ -130,7 +130,7 @@ You **MUST** consider the user input before proceeding (if not empty).
    **Tool-Specific Patterns**:
    - **Docker**: `node_modules/`, `.git/`, `Dockerfile*`, `.dockerignore`, `*.log*`, `.env*`, `coverage/`
    - **ESLint**: `node_modules/`, `dist/`, `build/`, `coverage/`, `*.min.js`
-   - **Prettier**: `node_modules/`, `dist/`, `build/`, `coverage/`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`
+   - **Prettier**: `node_modules/`, `dist/`, `build/`, `coverage/`, `package-lock.json`, `yarn.lock`, `bun.lock`
    - **Terraform**: `.terraform/`, `*.tfstate*`, `*.tfvars`, `.terraform.lock.hcl`
    - **Kubernetes/k8s**: `*.secret.yaml`, `secrets/`, `.kube/`, `kubeconfig*`, `*.key`, `*.crt`
 

.claude/commands/verify-boundaries.md

@@ -2,7 +2,7 @@
 description: Run architectural boundary checks (eslint boundaries + dep-cruiser)
 ---
 
-Run `pnpm check:arch`. Report:
+Run `bun run check:arch`. Report:
 
 1. Boundary violations (if any), from both tools.
 2. Orphan modules (if any) from dep-cruiser.

.claude/settings.json

@@ -1,7 +1,8 @@
 {
   "permissions": {
     "allow": [
-      "Bash(pnpm:*)",
+      "Bash(bun:*)",
+      "Bash(bunx:*)",
       "Bash(node:*)",
       "Bash(npx playwright:*)",
       "Bash(git status)",

.dependency-cruiser.cjs

@@ -67,6 +67,14 @@ module.exports = {
       from: { path: '^src/features' },
       to: { path: '^src/app' },
     },
+    {
+      name: 'features-cannot-import-runtime',
+      severity: 'error',
+      comment:
+        'Features orchestrate domain + ports. Runtime implements those ports. Do not import runtime from features.',
+      from: { path: '^src/features' },
+      to: { path: '^src/runtime' },
+    },
     {
       name: 'no-circular',
       severity: 'error',