Add the @gaffa-dev/cli package skeleton

.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: [22, 24]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run build
+      - run: npm test
+      # Prove the package builds and packs cleanly on every change, without publishing.
+      - run: npm publish --dry-run

.github/workflows/publish.yml

@@ -0,0 +1,42 @@
+name: Publish
+
+# Publishes to npm when a version tag is pushed, for example v0.0.1.
+# A tag with a prerelease part (v0.0.1-rc.1) goes out under the "next" dist-tag,
+# so it never becomes the default install and a bad one can be dropped without
+# affecting anyone on "latest".
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+  id-token: write # required for npm provenance
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run build
+      - run: npm test
+      - name: Pick the dist-tag
+        id: tag
+        shell: bash
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          if [[ "$version" == *-* ]]; then
+            echo "dist=next" >> "$GITHUB_OUTPUT"
+          else
+            echo "dist=latest" >> "$GITHUB_OUTPUT"
+          fi
+      - run: npm publish --provenance --access public --tag ${{ steps.tag.outputs.dist }}
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+dist/
+*.log

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Impetus Labs Ltd.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1 +1,44 @@
-# gaffa-cli
+# @gaffa-dev/cli
+
+The Gaffa command line tool. This is the skeleton. It ships with `--version` and
+`--help` and nothing else yet, and exists to prove the release path before there
+is anything real to release.
+
+## Use it
+
+No install needed, run it through npx:
+
+```
+npx @gaffa-dev/cli --help
+npx @gaffa-dev/cli --version
+```
+
+## Develop
+
+```
+npm install
+npm run build
+npm test
+npm run lint
+```
+
+The entry point is `src/cli.ts`, compiled to `dist/cli.js` by `tsc`. Tests run
+the built binary and check its output, so `npm test` builds first.
+
+## Release
+
+Pushing a version tag runs the publish workflow, which lints, builds, tests, then
+publishes to npm with provenance.
+
+```
+npm version patch      # bumps package.json and creates the tag
+git push --follow-tags
+```
+
+A plain tag (`v0.0.1`) publishes under `latest`. A prerelease tag (`v0.0.1-rc.1`)
+publishes under `next`, so it is opt-in and a bad one can be dropped without
+touching anyone on `latest`. Every pull request runs `npm publish --dry-run` on
+Windows, macOS and Linux, so packaging problems show up before a real release.
+
+The final package name is not fixed. `gaffa` is taken on npm, so the skeleton
+uses `@gaffa-dev/cli` for now.

eslint.config.mjs

@@ -0,0 +1,14 @@
+import js from "@eslint/js";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: ["dist/"] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    languageOptions: {
+      globals: { ...globals.node },
+    },
+  },
+);