@mnci/cli 1.10.0 → 1.11.1

package/README.md

@@ -121,9 +121,11 @@ that would just fail felt worse than being upfront that it doesn't exist yet.
    default for): independent versioning from **conventional commits**,
    `{projectName}@{version}` tags, **tag-only git** (`commit: false`) — nothing
    is ever pushed to `main`; future runs resolve versions from tag names.
-3. Writes `.npmrc` (Azure Artifacts feed or public npm — scope routing makes
-   accidental public publishes impossible), `commitlint.config.mjs`, a husky
-   `commit-msg` hook, the chosen CI provider's pipeline file(s)
+3. Writes `eslint.config.mjs` (three lines importing `@mnci/eslint-config` —
+   the whole linting opinion, in one root config), `.prettierrc.json` +
+   `.prettierignore`, `.npmrc` (comment-only — see **Known gaps** below),
+   `commitlint.config.mjs`, a husky `commit-msg` hook, the chosen CI provider's
+   pipeline file(s)
    (`azure-pipelines.yml` and/or `.github/workflows/ci.yml`, `--ci`, default
    `azure`; `github`/`both` also gets `.github/dependabot.yml` — weekly
    dependency-update PRs), a `<workspace-name>.code-workspace` file (VS Code
@@ -143,9 +145,23 @@ this existed; nothing let an already-generated workspace pick one up.
 same options `new` would have and calls the exact same `applyOverlay` `new`
 itself calls — the one function that does every bit of `mnci`-owned file
 writing (`nx.json`'s `release`/`sync`/`generators`/`mnci` blocks, `.npmrc`,
-`commitlint.config.mjs`, `.husky/commit-msg`, the CI pipeline file(s), and the
-curated root `package.json` scripts). Nothing else in the workspace — app/lib
-source, `project.json` targets from `mnci add` — is ever touched.
+`eslint.config.mjs`, `.prettierrc.json`, `commitlint.config.mjs`,
+`.husky/commit-msg`, the CI pipeline file(s), and the curated root
+`package.json` scripts). Nothing else in the workspace — app/lib source,
+`project.json` targets from `mnci add` — is ever touched.
+
+`upgrade` also **deletes** things, which is stronger than the overwriting it
+has always done — one more reason to run `git diff` first, as the command's own
+output tells you to:
+
+- `create-nx-workspace`'s `.prettierrc` and `.vscode/`, both superseded (by
+  `.prettierrc.json`, which Prettier would otherwise never reach, and by the
+  `.code-workspace` file).
+- **every per-project `eslint.config.*` under `apps/`, `libs/` and
+  `packages/`.** This is the migration path for a workspace generated before
+  mnci owned linting: without it an upgrade would install the root config while
+  each project kept linting against its own stale copy. The root config is never
+  touched, and neither is a config anywhere outside those three directories.
 
 ```sh
 mnci upgrade                          # re-apply from persisted config alone
@@ -182,13 +198,33 @@ stack:
 | --------------- | ------------------ | ------- | ---------------------------------------------------------------------------------------- |
 | `--test-runner` | `jest` \| `vitest` | `jest`  | `nx.json` generator `unitTestRunner` default; the hand-built function app follows it too |
 
-**Linting and formatting are unified across the workspace**: every project uses
-**ESLint + Prettier** with the JavaScript Standard Style configuration (no
-semicolons, single quotes, 2-space indents). ESLint is a per-project Nx target
-handling code quality (correctness only), while Prettier handles all formatting.
-Both are automatically configured; `npm run lint` checks code quality, `npm run
-format` (write) and `npm run format:check` (CI-safe) handle formatting. The CI
-runs lint/test/build only — formatting is left as a local/pre-commit step.
+**Linting and formatting are unified across the workspace, from exactly one
+config file each.** The root `eslint.config.mjs` is three lines importing
+[`@mnci/eslint-config`](../eslint-config/README.md); every `@nx/*` generator
+drops a config into the project it creates, and `mnci add` deletes it. Projects
+still get their `lint` target: `@nx/eslint/plugin` infers it by mapping config
+_directories_ onto the project roots beneath them, so the root config covers
+them all. (Verified, not assumed — and the e2e enforces both "every project has
+a `lint` target" and "the root config genuinely reports violations in a project
+with no config of its own", because a future Nx change there would silently
+switch linting off workspace-wide.)
+
+ESLint handles code quality only; **Prettier owns all formatting**, configured
+for JavaScript Standard Style (no semicolons, single quotes, 2-space indents, no
+trailing commas). `mnci` runs Prettier itself at the end of `new` and every
+`add`, so a generated workspace passes its own `format:check` immediately — Nx's
+generators emit semicolons and double quotes, and without that pass the first
+commit buries every real change under generator noise.
+
+One caveat worth knowing: `space-before-function-paren`, Standard's signature
+rule, is **not** enforced. Prettier rewrites `function f (a)` to `function f(a)`
+on every run and has closed the corresponding option permanently, so enabling it
+would make `npm run lint` and `npm run format:check` mutually unsatisfiable.
+Choosing Prettier means accepting its call there.
+
+`npm run lint` checks code quality; `npm run format` (write) and
+`npm run format:check` (CI-safe) handle formatting. The CI runs lint/test/build
+only — formatting is left as a local/pre-commit step.
 
 TypeScript is not a question — every workspace runs the **dual compiler** from
 [Nx's TS 7 guide](https://nx.dev/docs/technologies/typescript/guides/typescript-7):
@@ -466,6 +502,13 @@ than a surprise:
 
 ## Known gaps (accepted for the experiment)
 
+- **The generated `.npmrc` is empty (comments only), so `npm publish` will not
+  authenticate.** This is a deliberate deferral, not an oversight: the previous
+  file claimed here that scope routing made accidental public publishes
+  impossible, when in fact no `@scope:registry` line was ever emitted. Rather
+  than ship half-wired auth, the CI token export (`NODE_AUTH_TOKEN`/`PAT`) is
+  left in place so wiring it later is one line, and the generated `.npmrc`
+  carries a comment saying so. Publish-path e2e assertions are relaxed to match.
 - No `doctor`/`resurrect`/`spell` — out of scope until the model is proven.
 - **Flutter apps build for web only.** Android would require the Android SDK and
   NDK on every build agent; iOS is impossible on a Linux agent regardless. Add

package/dist/cli.js

@@ -43,6 +43,27 @@ var import_prompts4 = require("@inquirer/prompts");
 
 // src/nx.ts
 var import_cross_spawn = __toESM(require("cross-spawn"));
+
+// src/util/logger.ts
+var logger = {
+  info(message) {
+    console.log(message);
+  },
+  step(message) {
+    console.log(`\u2192 ${message}`);
+  },
+  success(message) {
+    console.log(`\u2713 ${message}`);
+  },
+  warn(message) {
+    console.warn(`! ${message}`);
+  },
+  error(message) {
+    console.error(`\u2717 ${message}`);
+  }
+};
+
+// src/nx.ts
 function runShell(command, arguments_, cwd) {
   const result = import_cross_spawn.default.sync(command, arguments_, { stdio: "inherit", cwd });
   return result.status ?? 1;
@@ -59,6 +80,14 @@ function runNpx(arguments_, cwd) {
     throw new Error(`npx ${arguments_.join(" ")} failed with exit code ${status}`);
   }
 }
+function runPrettier(cwd, target = ".") {
+  const status = runShell("npx", ["prettier", "--write", "--log-level", "warn", target], cwd);
+  if (status !== 0) {
+    logger.warn(
+      `Prettier could not format '${target}' (exit code ${status}). The project was generated; run 'npm run format' to normalise it.`
+    );
+  }
+}
 
 // src/prompts.ts
 var import_prompts = require("@inquirer/prompts");
@@ -136,25 +165,6 @@ function fileExists(path) {
   return (0, import_node_fs.existsSync)(path);
 }
 
-// src/util/logger.ts
-var logger = {
-  info(message) {
-    console.log(message);
-  },
-  step(message) {
-    console.log(`\u2192 ${message}`);
-  },
-  success(message) {
-    console.log(`\u2713 ${message}`);
-  },
-  warn(message) {
-    console.warn(`! ${message}`);
-  },
-  error(message) {
-    console.error(`\u2717 ${message}`);
-  }
-};
-
 // src/util/names.ts
 function assertValidProjectName(name, label) {
   if (!/^[a-z][a-z0-9-]*$/.test(name)) {
@@ -202,6 +212,20 @@ function addNxTargets(manifestPath, newTargets) {
     toJson({ ...manifest, nx: { ...nx, targets: { ...targets, ...newTargets } } })
   );
 }
+var ESLINT_CONFIG_FILENAMES = [
+  "eslint.config.js",
+  "eslint.config.mjs",
+  "eslint.config.cjs",
+  "eslint.config.ts",
+  "eslint.config.mts",
+  "eslint.config.cts"
+];
+function removeGeneratedEslintConfig(workspaceRoot, projectRoot) {
+  for (const filename of ESLINT_CONFIG_FILENAMES) {
+    (0, import_node_fs2.rmSync)((0, import_node_path2.join)(workspaceRoot, projectRoot, filename), { force: true });
+  }
+  (0, import_node_fs2.rmSync)((0, import_node_path2.join)(workspaceRoot, ".vscode"), { recursive: true, force: true });
+}
 function findCodeWorkspaceFile(workspaceRoot) {
   try {
     const entry = (0, import_node_fs2.readdirSync)(workspaceRoot).find((file) => file.endsWith(".code-workspace"));
@@ -377,7 +401,6 @@ function goLintTarget() {
 function goBuildTarget(name) {
   return {
     executor: "@nx-go/nx-go:build",
-    // eslint-disable-next-line unicorn/no-incorrect-template-string-interpolation -- {workspaceRoot} is an Nx output token
     outputs: [`{workspaceRoot}/dist/apps/${name}`],
     options: { outputPath: `../../dist/apps/${name}/${name}` }
   };
@@ -388,7 +411,6 @@ function goPackageTarget(tag, name) {
   return {
     executor: "nx:run-commands",
     dependsOn: ["build"],
-    // eslint-disable-next-line unicorn/no-incorrect-template-string-interpolation -- {workspaceRoot} is an Nx output token
     outputs: [`{workspaceRoot}/${zip}`],
     options: { command }
   };
@@ -516,7 +538,7 @@ function runNodeApp(workspaceRoot, name, stack, framework) {
       `apps/${name}`,
       "--bundler=esbuild",
       `--unitTestRunner=${stack.testRunner}`,
-      "--linter=eslint",
+      "--linter=none",
       "--e2eTestRunner=none",
       `--framework=${framework}`,
       "--no-interactive"
@@ -530,7 +552,6 @@ function nodeAppPackageTarget(name) {
   return {
     executor: "nx:run-commands",
     dependsOn: ["build"],
-    // eslint-disable-next-line unicorn/no-incorrect-template-string-interpolation -- {workspaceRoot} is an Nx output token
     outputs: [`{workspaceRoot}/${zip}`],
     options: { command }
   };
@@ -541,6 +562,7 @@ function addNodeApp(workspaceRoot, name, stack, framework = "none") {
   addNxTargets((0, import_node_path5.join)(workspaceRoot, "apps", name, "package.json"), {
     package: nodeAppPackageTarget(name)
   });
+  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
 }
 function ensureAzureFunctionsPackage(workspaceRoot) {
@@ -564,10 +586,11 @@ var NODE_FUNCTION_APP_HOST_JSON = `{
   }
 }
 `;
-var NODE_FUNCTION_APP_HELLO = `import { app, HttpRequest, HttpResponseInit } from '@azure/functions'
+var NODE_FUNCTION_APP_HELLO = `import { app } from '@azure/functions'
+import type { HttpRequest, HttpResponseInit } from '@azure/functions'
 import { buildGreeting } from './greeting'
 
-async function hello (request: HttpRequest): Promise<HttpResponseInit> {
+async function hello(request: HttpRequest): Promise<HttpResponseInit> {
   const name = request.query.get('name') ?? 'world'
   return { body: buildGreeting(name) }
 }
@@ -614,7 +637,6 @@ function nodeFunctionAppPackageTarget(name) {
   return {
     executor: "nx:run-commands",
     dependsOn: ["build"],
-    // eslint-disable-next-line unicorn/no-incorrect-template-string-interpolation -- {workspaceRoot} is an Nx output token
     outputs: [`{workspaceRoot}/${zip}`],
     options: { command }
   };
@@ -648,62 +670,12 @@ function addNodeFunctionApp(workspaceRoot, name, stack) {
     package: nodeFunctionAppPackageTarget(name),
     start: nodeFunctionAppStartTarget(name)
   });
+  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
 }
 
 // src/commands/add/npmLib.ts
 var import_node_path6 = require("path");
-var NPM_LIB_ESLINT_CONFIG = `import { globSync, readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import baseConfig from '../../eslint.config.mjs';
-
-// Private workspace libs are compiled INTO this package's rollup bundle and
-// never declared in the manifest (a consumer could not install them), so the
-// dependency check must ignore them. Computed at lint time: adding a new
-// internal lib never requires touching this file.
-const workspaceRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
-const privateWorkspacePackages = globSync(['libs/*/package.json', 'packages/*/package.json'], { cwd: workspaceRoot })
-  .map((manifestPath) => JSON.parse(readFileSync(join(workspaceRoot, manifestPath), 'utf8')))
-  .filter((manifest) => manifest.private === true)
-  .map((manifest) => manifest.name);
-
-export default [
-  ...baseConfig,
-  {
-    files: ['**/*.json'],
-    rules: {
-      '@nx/dependency-checks': [
-        'error',
-        {
-          ignoredDependencies: privateWorkspacePackages,
-          ignoredFiles: [
-            '{projectRoot}/eslint.config.{js,cjs,mjs,ts,cts,mts}',
-            '{projectRoot}/rollup.config.{js,ts,mjs,mts,cjs,cts}',
-            // Same reasoning as the two config files above, extended to the test
-            // toolchain: rollup bundles from the entry point only, so neither the
-            // Vitest config nor the spec files reach the published package \u2014 their
-            // imports must not drive the published manifest.
-            //
-            // Without this, a vitest-stack workspace fails \`npm run lint\` on a
-            // freshly generated npm-lib: Nx's own spec imports \`vitest\`, and
-            // @nx/dependency-checks then demands it be declared as a runtime
-            // dependency of a package that never uses it at runtime.
-            '{projectRoot}/vitest.config.{js,ts,mjs,mts,cjs,cts}',
-            '{projectRoot}/**/*.spec.{js,ts,jsx,tsx}',
-          ],
-        },
-      ],
-    },
-    languageOptions: {
-      parser: await import('jsonc-eslint-parser'),
-    },
-  },
-  {
-    ignores: ['**/out-tsc'],
-  },
-];
-`;
 async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
   const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
   runNx(
@@ -715,16 +687,13 @@ async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
       `--importPath=${scope}/${name}`,
       "--bundler=rollup",
       `--unitTestRunner=${stack.testRunner}`,
-      "--linter=eslint",
+      "--linter=none",
       "--no-interactive"
     ],
     workspaceRoot
   );
   markPublic((0, import_node_path6.join)(workspaceRoot, "packages", name, "package.json"));
-  writeFileEnsured(
-    (0, import_node_path6.join)(workspaceRoot, "packages", name, "eslint.config.mjs"),
-    NPM_LIB_ESLINT_CONFIG
-  );
+  removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true });
 }
 function markPublic(manifestPath) {
@@ -805,7 +774,6 @@ function pythonAppPackageTarget(name) {
   return {
     executor: "nx:run-commands",
     dependsOn: ["build"],
-    // eslint-disable-next-line unicorn/no-incorrect-template-string-interpolation -- {workspaceRoot} is an Nx output token
     outputs: [`{workspaceRoot}/${zip}`],
     options: { command }
   };
@@ -816,7 +784,6 @@ function pythonFunctionAppPackageTarget(name, moduleDirectory) {
   const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFile('${root}/function_app.py');z.addLocalFile('${root}/host.json');z.addLocalFile('${root}/requirements.txt');z.addLocalFolder('${root}/${moduleDirectory}','${moduleDirectory}');z.writeZip('${zip}')"`;
   return {
     executor: "nx:run-commands",
-    // eslint-disable-next-line unicorn/no-incorrect-template-string-interpolation -- {workspaceRoot} is an Nx output token
     outputs: [`{workspaceRoot}/${zip}`],
     options: { command }
   };
@@ -976,7 +943,6 @@ function reactAppTargets(name) {
   for (const environment of REACT_ENVIRONMENTS) {
     targets[`build-${environment}`] = {
       executor: "nx:run-commands",
-      // eslint-disable-next-line unicorn/no-incorrect-template-string-interpolation -- {workspaceRoot} is an Nx output token
       outputs: [`{workspaceRoot}/apps/${name}/dist-${environment}`],
       options: {
         command: `vite build --mode ${environment} --outDir dist-${environment}`,
@@ -991,7 +957,6 @@ function reactAppTargets(name) {
     executor: "nx:run-commands",
     dependsOn: REACT_ENVIRONMENTS.map((environment) => `build-${environment}`),
     outputs: REACT_ENVIRONMENTS.map(
-      // eslint-disable-next-line unicorn/no-incorrect-template-string-interpolation
       (environment) => `{workspaceRoot}/dist/drop/react-app-${name}-${environment}.zip`
     ),
     options: {
@@ -1025,7 +990,7 @@ function addReactApp(workspaceRoot, name, stack) {
       `apps/${name}`,
       "--bundler=vite",
       `--unitTestRunner=${stack.testRunner}`,
-      "--linter=eslint",
+      "--linter=none",
       "--style=css",
       "--e2eTestRunner=none",
       "--no-interactive"
@@ -1039,6 +1004,7 @@ function addReactApp(workspaceRoot, name, stack) {
   }
   allowEnvFiles(workspaceRoot);
   addNxTargets((0, import_node_path8.join)(reactAppRoot, "package.json"), reactAppTargets(name));
+  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
 }
 
@@ -1100,12 +1066,13 @@ async function runAdd(kind, name, options) {
           `libs/${resolvedName}`,
           "--bundler=tsc",
           `--unitTestRunner=${stack.testRunner}`,
-          "--linter=eslint",
+          "--linter=none",
           "--no-interactive"
         ],
         workspaceRoot
       );
       markPrivate((0, import_node_path9.join)(workspaceRoot, "libs", resolvedName, "package.json"));
+      removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
       registerProjectCommands(workspaceRoot, resolvedName, { build: true });
       break;
     }
@@ -1156,6 +1123,7 @@ async function runAdd(kind, name, options) {
     case "python-vendor": {
       await addPythonVendor(workspaceRoot, resolvedName, options, kindProvided);
       syncProjectReferences(workspaceRoot);
+      runPrettier(workspaceRoot);
       return;
     }
     default: {
@@ -1166,6 +1134,7 @@ async function runAdd(kind, name, options) {
     }
   }
   syncProjectReferences(workspaceRoot);
+  runPrettier(workspaceRoot);
   logger.success(`Added ${resolvedKind} '${resolvedName}'.`);
 }
 function syncProjectReferences(workspaceRoot) {
@@ -1198,6 +1167,7 @@ var import_prompts7 = require("@inquirer/prompts");
 var import_node_path11 = require("path");
 
 // src/overlay.ts
+var import_node_fs6 = require("fs");
 var import_node_path10 = require("path");
 var DEFAULT_STACK = { testRunner: "jest" };
 var PRETTIER_VERSION = "^3.8.1";
@@ -1205,34 +1175,16 @@ var TS_COMPILER_DEPENDENCIES = {
   "@typescript/native": "npm:typescript@^7.0.2",
   typescript: "npm:@typescript/typescript6@^6.0.2"
 };
-function npmrcContent(registry, scope) {
-  const scopeName = scope.replace(/^@/, "");
-  const lines = [
-    "registry=https://registry.npmjs.org/",
-    "; Community Nx plugins (e.g. the Azure Functions one) peer on the previous",
-    "; Nx major for a while after each release; accept the resolved tree.",
-    "legacy-peer-deps=true"
-  ];
-  if (registry.kind === "azure-artifacts") {
-    const base = `https://pkgs.dev.azure.com/${registry.organization}/${registry.project}/_packaging/${registry.artifactsFeed}`;
-    const registryHost = `${base}/npm/registry/`.replace(/^https:\/\//, "");
-    const feedHost = `${base}/`.replace(/^https:\/\//, "");
-    lines.push(
-      `@${scopeName}:registry=${base}/npm/registry/`,
-      "; Azure Artifacts auth \u2014 the base64 PAT is expanded at runtime from the",
-      "; PAT env var (CI: your PAT variable group; locally: export PAT=<base64 token>).",
-      `//${registryHost}:username=${registry.organization}`,
-      `//${registryHost}:_password=\${PAT}`,
-      `//${registryHost}:email=npm@example.com`,
-      `//${feedHost}:username=${registry.organization}`,
-      `//${feedHost}:_password=\${PAT}`,
-      `//${feedHost}:email=npm@example.com`
-    );
-  } else {
-    lines.push(`//registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}`);
-  }
-  lines.push("");
-  return lines.join("\n");
+function npmrcContent(_registry, _scope) {
+  return `; Intentionally empty.
+;
+; Publish authentication is not configured yet. The generated CI exports a
+; token for the release step (NODE_AUTH_TOKEN for public npm, PAT for Azure
+; Artifacts), but nothing here consumes it, so 'npm publish' will not
+; authenticate until this is wired up.
+;
+; See "Known gaps" in the @mnci/cli README.
+`;
 }
 function releaseConfig(ci) {
   const githubReleases = ci === "github";
@@ -1259,6 +1211,18 @@ function releaseConfig(ci) {
   };
 }
 var SYNC_CONFIG = { applyChanges: true };
+var ESLINT_PLUGIN_CONFIG = {
+  plugin: "@nx/eslint/plugin",
+  options: { targetName: "lint" }
+};
+function pluginName(entry) {
+  return typeof entry === "string" ? entry : entry.plugin;
+}
+function withEslintPlugin(nxJson) {
+  const plugins = nxJson.plugins ?? [];
+  const registered = plugins.some((entry) => pluginName(entry) === ESLINT_PLUGIN_CONFIG.plugin);
+  return registered ? { ...nxJson, plugins } : { ...nxJson, plugins: [...plugins, ESLINT_PLUGIN_CONFIG] };
+}
 function withReleaseConfig(nxJson, ci) {
   return { ...nxJson, defaultBase: "main", release: releaseConfig(ci) };
 }
@@ -1269,13 +1233,30 @@ var COMMIT_MSG_HOOK = `npx --no -- commitlint --edit "$1"
 var PRETTIER_CONFIG = `{
   "semi": false,
   "singleQuote": true,
-  "trailingComma": "es5",
+  "trailingComma": "none",
   "arrowParens": "avoid",
   "printWidth": 100,
   "tabWidth": 2,
   "useTabs": false
 }
 `;
+var ESLINT_CONFIG_VERSION = "^0.1.0";
+function eslintConfigSpec() {
+  return process.env.MNCI_ESLINT_CONFIG_SPEC ?? ESLINT_CONFIG_VERSION;
+}
+var ESLINT_VERSION = "^9.39.0";
+function eslintToolchainDependencies(nxVersion) {
+  return {
+    eslint: ESLINT_VERSION,
+    "@nx/eslint": nxVersion,
+    "@nx/eslint-plugin": nxVersion,
+    "@mnci/eslint-config": eslintConfigSpec()
+  };
+}
+var ESLINT_CONFIG = `import mnci from '@mnci/eslint-config'
+
+export default mnci({ workspaceRoot: import.meta.dirname })
+`;
 var PRETTIER_IGNORE = `node_modules
 dist
 dist-dev
@@ -1352,7 +1333,13 @@ function rootScripts() {
 }
 function generatorDefaults(stack) {
   const shared = {
-    linter: "eslint",
+    // `none`, not `eslint`, and the workspace is still fully linted. The root
+    // config plus `@nx/eslint/plugin` ({@link ESLINT_PLUGIN_CONFIG}) give every
+    // project its `lint` target; `eslint` here would only make the generator
+    // scaffold a per-project config mnci deletes anyway — and drag in
+    // `eslint-plugin-import@2.31.0`, which peer-caps at ESLint 9 and breaks the
+    // install outright on this workspace's ESLint 10.
+    linter: "none",
     unitTestRunner: stack.testRunner
   };
   return {
@@ -1797,6 +1784,21 @@ updates:
     schedule:
       interval: weekly
 `;
+var NX_SCAFFOLDING_TO_REMOVE = [".prettierrc", ".vscode"];
+function removeNxScaffolding(workspaceRoot) {
+  for (const entry of NX_SCAFFOLDING_TO_REMOVE) {
+    (0, import_node_fs6.rmSync)((0, import_node_path10.join)(workspaceRoot, entry), { recursive: true, force: true });
+  }
+  removeProjectEslintConfigs(workspaceRoot);
+}
+function removeProjectEslintConfigs(workspaceRoot) {
+  const matches = (0, import_node_fs6.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
+    cwd: workspaceRoot
+  });
+  for (const match of matches) {
+    (0, import_node_fs6.rmSync)((0, import_node_path10.join)(workspaceRoot, match), { force: true });
+  }
+}
 function applyOverlay(workspaceRoot, options) {
   const nxJsonPath = (0, import_node_path10.join)(workspaceRoot, "nx.json");
   const nxJson = readJson(nxJsonPath);
@@ -1806,19 +1808,20 @@ function applyOverlay(workspaceRoot, options) {
   };
   const sync = { ...nxJson.sync, ...SYNC_CONFIG };
   const mnci = { ...nxJson.mnci, ...mnciConfig(options) };
-  writeFileEnsured(
-    nxJsonPath,
-    toJson({ ...withReleaseConfig(nxJson, options.ci), generators, sync, mnci })
-  );
+  const patched = withEslintPlugin(withReleaseConfig(nxJson, options.ci));
+  writeFileEnsured(nxJsonPath, toJson({ ...patched, generators, sync, mnci }));
   const manifestPath = (0, import_node_path10.join)(workspaceRoot, "package.json");
   const manifest = readJson(manifestPath);
   const scripts = {
     ...manifest.scripts,
     ...rootScripts()
   };
+  const existingDevDeps = manifest.devDependencies;
   const devDeps = {
-    ...manifest.devDependencies,
+    ...existingDevDeps,
     ...TS_COMPILER_DEPENDENCIES,
+    // The preset pins `nx` itself; the ESLint plugins must match it exactly.
+    ...eslintToolchainDependencies(existingDevDeps?.nx ?? "latest"),
     prettier: PRETTIER_VERSION
   };
   writeFileEnsured(
@@ -1830,8 +1833,10 @@ function applyOverlay(workspaceRoot, options) {
   const hookPath = (0, import_node_path10.join)(workspaceRoot, ".husky/commit-msg");
   writeFileEnsured(hookPath, COMMIT_MSG_HOOK);
   markExecutable(hookPath);
+  writeFileEnsured((0, import_node_path10.join)(workspaceRoot, "eslint.config.mjs"), ESLINT_CONFIG);
   writeFileEnsured((0, import_node_path10.join)(workspaceRoot, ".prettierrc.json"), PRETTIER_CONFIG);
   writeFileEnsured((0, import_node_path10.join)(workspaceRoot, ".prettierignore"), PRETTIER_IGNORE);
+  removeNxScaffolding(workspaceRoot);
   writeFileEnsured(
     (0, import_node_path10.join)(workspaceRoot, `${options.workspaceName}.code-workspace`),
     vscodeWorkspace(options.workspaceName)
@@ -1922,7 +1927,7 @@ async function runNew(name, options) {
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
   );
   applyOverlay(workspaceRoot, { workspaceName, scope, registry, agent, variableGroup, ci, stack });
-  logger.step("Installing the toolchain (commitlint + husky)");
+  logger.step("Installing the toolchain (commitlint + husky + linting/formatting)");
   const installStatus = runShell(
     "npm",
     ["install", "--save-dev", "husky", "@commitlint/cli", "@commitlint/config-conventional"],
@@ -1932,6 +1937,8 @@ async function runNew(name, options) {
     throw new Error(`npm install of the toolchain failed with exit code ${installStatus}`);
   }
   runShell("npx", ["husky"], workspaceRoot);
+  logger.step("Formatting the workspace (Prettier, JavaScript Standard Style)");
+  runPrettier(workspaceRoot);
   logger.success("Done. Next steps:");
   logger.info(`  cd ${workspaceName}`);
   logger.info(
@@ -2039,7 +2046,7 @@ async function runInteractive() {
 }
 
 // src/util/versionChecker.ts
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_node_path14 = require("path");
 var import_cross_spawn2 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME = "@mnci/cli";
@@ -2097,7 +2104,7 @@ function releaseTriple(version) {
 function readCliVersion(packageDirectory) {
   try {
     const manifestPath = (0, import_node_path14.join)(packageDirectory, "..", "package.json");
-    const manifest = JSON.parse((0, import_node_fs6.readFileSync)(manifestPath, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs7.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {
     return "0.0.0";