@warlock.js/core 5.4.0 → 5.5.0

package/CHANGELOG.md

@@ -6,6 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 > ⚠ **Versioning: `@warlock.js/*` does not follow SemVer strictly — breaking changes may ship in a minor.** This is a deliberate decision, not an oversight: the framework is pre-adoption and the cost of a major per behaviour fix currently outweighs the benefit. **Pin an exact version or a tilde range (`~4.13.0`) if you need to opt into changes rather than receive them.** Every breaking change is marked **BREAKING** in its entry and summarised in an *Upgrading* section at the top of the release. **This policy will change once the framework has consumers beyond its author.**
 
+## 5.5.0 - 2026-09-07
+
+### Fixed
+
+- `warlock add web` silently overwrote an existing `src/app/contact` module. It guarded `src/web/root.tsx` against clobbering a human's work but wrote the contact route and controller unconditionally, destroying them without a word. Each file is now guarded on its own existence, and a skip reports the consequence — that the contact form's `POST /api/contact` endpoint is missing and the form will 404 until you wire it.
+- Documentation shipped in `skills/` told users to run `pnpm`-specific commands — including `pnpm warlock routes --json`, which cannot work under npm at all, since `pnpm <binary>` has no npm equivalent. Commands are now package-manager neutral.
+
 ## 5.4.0 - 2026-09-07
 
 ### Fixed

package/esm/generations/features/shared/resolve-contact-scaffold.mjs

@@ -0,0 +1,45 @@
+import { colors } from "@mongez/copper";
+
+//#region ../core/src/generations/features/shared/resolve-contact-scaffold.ts
+const CONTROLLER_PATH = "src/app/contact/controllers/contact.controller.ts";
+const ROUTES_PATH = "src/app/contact/routes.ts";
+/**
+* Decide which of the two contact-module files are safe to (re)write, and
+* report loudly about the ones that are not.
+*
+* Pure by design: no filesystem access here, so a test can exercise every
+* combination directly. {@link completeWebInstallation} in `web.feature.ts`
+* is the thin I/O wrapper — it stats both files, calls this, writes back
+* whatever this says to write, and prints whatever this says to print.
+*
+* `src/web/root.tsx` is the "a human has been here" sentinel for the web
+* layer as a whole, but `src/app/contact/**` is an ordinary application
+* module the web feature happens to also scaffold — nothing stops a project
+* from having its own `contact` module (with its own controller and routes)
+* independently of ever having run `warlock add web`. Trusting root.tsx's
+* absence as license to write these two files meant `warlock add web` could
+* silently overwrite a human's existing `contact` module. Exactly like
+* {@link relocateConflictingHomeRoute} already insists for the home route:
+* "`warlock add web` runs against a project a human has been living in, and
+* silently unlinking their code is not a thing an `add` command gets to do."
+* So each file gets its own independent existence guard, and an existing
+* file is skipped — never overwritten, never a reason to abort the rest of
+* the install.
+*/
+function resolveContactScaffold(state) {
+	const writeController = !state.controllerExists;
+	const writeRoutes = !state.routesExists;
+	const messages = [];
+	if (state.controllerExists) messages.push(`${colors.yellowBright("!")} ${colors.yellowBright(CONTROLLER_PATH)} already exists, skipping — the contact form's endpoint is missing this controller's logic unless it already handles ${colors.yellowBright("POST /api/contact")}, so the form will 404 until you wire it yourself.`);
+	if (state.routesExists) messages.push(`${colors.yellowBright("!")} ${colors.yellowBright(ROUTES_PATH)} already exists, skipping — the contact form's endpoint (${colors.yellowBright("POST /api/contact")}) was not registered here, so the form will 404 until you wire it yourself.`);
+	if (writeController && writeRoutes) messages.push(`${colors.green("✓")} Created POST /api/contact starter route`);
+	return {
+		writeController,
+		writeRoutes,
+		messages
+	};
+}
+
+//#endregion
+export { resolveContactScaffold };
+//# sourceMappingURL=resolve-contact-scaffold.mjs.map

package/esm/generations/features/shared/resolve-contact-scaffold.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-contact-scaffold.mjs","names":[],"sources":["../../../../../../../../../core/src/generations/features/shared/resolve-contact-scaffold.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\n\n/** Whether each contact-module file `completeWebInstallation` writes already exists on disk. */\nexport type ContactScaffoldState = {\n  controllerExists: boolean;\n  routesExists: boolean;\n};\n\n/** Which contact-module files may be written, and what to tell the user. */\nexport type ContactScaffoldPlan = {\n  writeController: boolean;\n  writeRoutes: boolean;\n  messages: string[];\n};\n\nconst CONTROLLER_PATH = \"src/app/contact/controllers/contact.controller.ts\";\nconst ROUTES_PATH = \"src/app/contact/routes.ts\";\n\n/**\n * Decide which of the two contact-module files are safe to (re)write, and\n * report loudly about the ones that are not.\n *\n * Pure by design: no filesystem access here, so a test can exercise every\n * combination directly. {@link completeWebInstallation} in `web.feature.ts`\n * is the thin I/O wrapper — it stats both files, calls this, writes back\n * whatever this says to write, and prints whatever this says to print.\n *\n * `src/web/root.tsx` is the \"a human has been here\" sentinel for the web\n * layer as a whole, but `src/app/contact/**` is an ordinary application\n * module the web feature happens to also scaffold — nothing stops a project\n * from having its own `contact` module (with its own controller and routes)\n * independently of ever having run `warlock add web`. Trusting root.tsx's\n * absence as license to write these two files meant `warlock add web` could\n * silently overwrite a human's existing `contact` module. Exactly like\n * {@link relocateConflictingHomeRoute} already insists for the home route:\n * \"`warlock add web` runs against a project a human has been living in, and\n * silently unlinking their code is not a thing an `add` command gets to do.\"\n * So each file gets its own independent existence guard, and an existing\n * file is skipped — never overwritten, never a reason to abort the rest of\n * the install.\n */\nexport function resolveContactScaffold(state: ContactScaffoldState): ContactScaffoldPlan {\n  const writeController = !state.controllerExists;\n  const writeRoutes = !state.routesExists;\n  const messages: string[] = [];\n\n  if (state.controllerExists) {\n    messages.push(\n      `${colors.yellowBright(\"!\")} ${colors.yellowBright(CONTROLLER_PATH)} already exists, skipping — ` +\n        \"the contact form's endpoint is missing this controller's logic unless it already handles \" +\n        `${colors.yellowBright(\"POST /api/contact\")}, so the form will 404 until you wire it yourself.`,\n    );\n  }\n\n  if (state.routesExists) {\n    messages.push(\n      `${colors.yellowBright(\"!\")} ${colors.yellowBright(ROUTES_PATH)} already exists, skipping — ` +\n        `the contact form's endpoint (${colors.yellowBright(\"POST /api/contact\")}) was not registered here, ` +\n        \"so the form will 404 until you wire it yourself.\",\n    );\n  }\n\n  if (writeController && writeRoutes) {\n    messages.push(`${colors.green(\"✓\")} Created POST /api/contact starter route`);\n  }\n\n  return { writeController, writeRoutes, messages };\n}\n"],"mappings":";;;AAeA,MAAM,kBAAkB;AACxB,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;AAyBpB,SAAgB,uBAAuB,OAAkD;CACvF,MAAM,kBAAkB,CAAC,MAAM;CAC/B,MAAM,cAAc,CAAC,MAAM;CAC3B,MAAM,WAAqB,CAAC;CAE5B,IAAI,MAAM,kBACR,SAAS,KACP,GAAG,OAAO,aAAa,GAAG,EAAE,GAAG,OAAO,aAAa,eAAe,EAAE,uHAE/D,OAAO,aAAa,mBAAmB,EAAE,mDAChD;CAGF,IAAI,MAAM,cACR,SAAS,KACP,GAAG,OAAO,aAAa,GAAG,EAAE,GAAG,OAAO,aAAa,WAAW,EAAE,2DAC9B,OAAO,aAAa,mBAAmB,EAAE,4EAE7E;CAGF,IAAI,mBAAmB,aACrB,SAAS,KAAK,GAAG,OAAO,MAAM,GAAG,EAAE,yCAAyC;CAG9E,OAAO;EAAE;EAAiB;EAAa;CAAS;AAClD"}

package/esm/generations/features/web.feature.mjs

@@ -3,6 +3,7 @@ import "../../utils/index.mjs";
 import { webContactControllerStub, webContactRoutesStub, webHomePageStub, webHomeRegisterStub, webRootStub } from "../stubs.mjs";
 import { INSTALLED_WARLOCK_VERSION } from "./types.mjs";
 import { relocateConflictingHomeRoute } from "./shared/relocate-conflicting-home-route.mjs";
+import { resolveContactScaffold } from "./shared/resolve-contact-scaffold.mjs";
 import { colors } from "@mongez/copper";
 import { ensureDirectoryAsync, fileExistsAsync, getFileAsync, putFileAsync } from "@warlock.js/fs";
 
@@ -70,11 +71,20 @@ async function completeWebInstallation(_options) {
 		} else {
 			await putFileAsync(srcPath("web/index.page.tsx"), webHomePageStub);
 			await putFileAsync(srcPath("web/index.register.ts"), webHomeRegisterStub);
-			await ensureDirectoryAsync(srcPath("app/contact/controllers"));
-			await putFileAsync(srcPath("app/contact/controllers/contact.controller.ts"), webContactControllerStub);
-			await putFileAsync(srcPath("app/contact/routes.ts"), webContactRoutesStub);
+			const contactPlan = resolveContactScaffold({
+				controllerExists: await fileExistsAsync(srcPath("app/contact/controllers/contact.controller.ts")),
+				routesExists: await fileExistsAsync(srcPath("app/contact/routes.ts"))
+			});
+			if (contactPlan.writeController) {
+				await ensureDirectoryAsync(srcPath("app/contact/controllers"));
+				await putFileAsync(srcPath("app/contact/controllers/contact.controller.ts"), webContactControllerStub);
+			}
+			if (contactPlan.writeRoutes) {
+				await ensureDirectoryAsync(srcPath("app/contact"));
+				await putFileAsync(srcPath("app/contact/routes.ts"), webContactRoutesStub);
+			}
 			console.log(`${colors.green("✓")} Created src/web/index.page.tsx`);
-			console.log(`${colors.green("✓")} Created POST /api/contact starter route`);
+			for (const message of contactPlan.messages) console.log(message);
 		}
 	}
 	await registerWebConnector();

package/esm/generations/features/web.feature.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"web.feature.mjs","names":[],"sources":["../../../../../../../../core/src/generations/features/web.feature.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\r\nimport { ensureDirectoryAsync, fileExistsAsync, getFileAsync, putFileAsync } from \"@warlock.js/fs\";\r\nimport type { CommandActionData } from \"../../commands/types\";\r\nimport { rootPath, srcPath } from \"../../utils\";\r\nimport { relocateConflictingHomeRoute } from \"./shared/relocate-conflicting-home-route\";\r\nimport {\r\n  webContactControllerStub,\r\n  webContactRoutesStub,\r\n  webHomePageStub,\r\n  webHomeRegisterStub,\r\n  webRootStub,\r\n} from \"../stubs\";\r\nimport { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\r\n\r\n/**\r\n * Register the WebConnector in `warlock.config.ts`, and ONLY there.\r\n *\r\n * It belongs to the config array or to app code, never both. Both halves are\r\n * registered before app code loads — the CLI preloader in dev, the generated\r\n * entry in production — so also calling `connectorsManager.register(...)` in\r\n * `src/app/main.ts` boots the connector twice and installs every page route\r\n * twice. That surfaces at PRODUCTION boot as `Route name \"...\" is already\r\n * taken`, because pages and API routes share one route-name namespace.\r\n *\r\n * The config array is the half to prefer: `warlock build` reads the same array\r\n * to drain each connector's build contribution, so \"built for\" and \"boots with\"\r\n * cannot drift.\r\n *\r\n * String surgery rather than a TypeScript parse: `warlock.config.ts` is an\r\n * app-owned file that may carry any formatting, and a parse-and-print would\r\n * reformat the parts we did not come to change.\r\n */\r\nasync function registerWebConnector(): Promise<void> {\r\n  const configPath = rootPath(\"warlock.config.ts\");\r\n\r\n  if (!(await fileExistsAsync(configPath))) {\r\n    console.log(\r\n      `${colors.yellowBright(\"warlock.config.ts\")} not found — add this yourself:\\n` +\r\n        `  import { webConnector } from \"@warlock.js/web/connector\";\\n` +\r\n        `  export default defineConfig({ connectors: [webConnector()] });`,\r\n    );\r\n\r\n    return;\r\n  }\r\n\r\n  const current = await getFileAsync(configPath);\r\n\r\n  if (current.includes(\"webConnector\")) {\r\n    console.log(`${colors.yellowBright(\"webConnector\")} already registered, skipping...`);\r\n\r\n    return;\r\n  }\r\n\r\n  const importLine = 'import { webConnector } from \"@warlock.js/web/connector\";';\r\n  let next = current.includes(importLine) ? current : `${importLine}\\n${current}`;\r\n\r\n  // An existing `connectors: [` gains one entry; otherwise the key is added to\r\n  // the object `defineConfig` receives.\r\n  if (/connectors:\\s*\\[/.test(next)) {\r\n    next = next.replace(/connectors:\\s*\\[/, \"connectors: [webConnector(),\");\r\n  } else if (next.includes(\"defineConfig({\")) {\r\n    next = next.replace(\"defineConfig({\", \"defineConfig({\\n  connectors: [webConnector()],\");\r\n  } else {\r\n    console.log(\r\n      `${colors.yellowBright(\"warlock.config.ts\")} has no recognisable defineConfig({...}) — ` +\r\n        \"add `connectors: [webConnector()]` yourself.\",\r\n    );\r\n\r\n    return;\r\n  }\r\n\r\n  await putFileAsync(configPath, next);\r\n  console.log(`${colors.green(\"✓\")} Registered webConnector in warlock.config.ts`);\r\n}\r\n\r\n/**\r\n * Scaffold the smallest page layer that renders, and register the connector.\r\n *\r\n * `src/web/root.tsx` is the sentinel for \"already scaffolded\" — the framework\r\n * ships a default root, so its presence means a human has been here.\r\n */\r\nasync function completeWebInstallation(_options: CommandActionData) {\r\n  const rootFile = srcPath(\"web/root.tsx\");\r\n\r\n  if (await fileExistsAsync(rootFile)) {\r\n    console.log(`${colors.yellowBright(\"src/web\")} already scaffolded, skipping...`);\r\n  } else {\r\n    await ensureDirectoryAsync(srcPath(\"web\"));\r\n    await putFileAsync(rootFile, webRootStub);\r\n    console.log(`${colors.green(\"✓\")} Created src/web/root.tsx`);\r\n\r\n    const collision = await relocateConflictingHomeRoute();\r\n\r\n    if (collision.outcome === \"relocated\") {\r\n      console.log(\r\n        `${colors.green(\"✓\")} Moved the existing ${colors.yellowBright('GET \"/\"')} route to ` +\r\n          `${colors.yellowBright('\"/welcome\"')} in ${colors.yellowBright(`src/${collision.relativePath}`)} — ` +\r\n          \"the new page owns `/` now, and the JSON welcome route still answers at /welcome.\",\r\n      );\r\n    }\r\n\r\n    // The page is written ONLY when `/` is provably free. Writing it while\r\n    // another handler holds `/` produces a homepage that 500s on first request,\r\n    // which is precisely the outcome a scaffolder must never hand back.\r\n    if (collision.outcome === \"conflict\" || collision.outcome === \"failed\") {\r\n      const verb = collision.outcome === \"failed\" ? colors.redBright(\"✗\") : colors.yellowBright(\"!\");\r\n\r\n      console.log(\r\n        `${verb} Did not create src/web/index.page.tsx: ${collision.reason}.\\n` +\r\n          `  The page stub declares ${colors.yellowBright('route.path = \"/\"')}, and two handlers on one ` +\r\n          \"path is a 500 at request time, not a startup error.\\n\" +\r\n          `  Free up ${colors.yellowBright('GET \"/\"')} under src/app — move it to a path of its own, ` +\r\n          \"or remove it — then create src/web/index.page.tsx yourself. Giving the page a `route` other \" +\r\n          \"than `/` works too.\",\r\n      );\r\n\r\n      // Non-zero on BOTH branches. The page layer this command exists to\r\n      // scaffold was not scaffolded, and a 0 here is the exact \"looked like it\r\n      // worked\" signal that put `/` in this state to begin with — a conflict we\r\n      // declined to guess at is still an incomplete install, not a success.\r\n      //\r\n      // `exitCode` rather than `exit(1)`: the connector below still has to be\r\n      // registered, and any other feature in the same `warlock add` invocation\r\n      // still has to install, or the project is left half-wired on top of this.\r\n      process.exitCode = 1;\r\n    } else {\r\n      await putFileAsync(srcPath(\"web/index.page.tsx\"), webHomePageStub);\r\n      await putFileAsync(srcPath(\"web/index.register.ts\"), webHomeRegisterStub);\r\n      await ensureDirectoryAsync(srcPath(\"app/contact/controllers\"));\r\n      await putFileAsync(\r\n        srcPath(\"app/contact/controllers/contact.controller.ts\"),\r\n        webContactControllerStub,\r\n      );\r\n      await putFileAsync(srcPath(\"app/contact/routes.ts\"), webContactRoutesStub);\r\n      console.log(`${colors.green(\"✓\")} Created src/web/index.page.tsx`);\r\n      console.log(`${colors.green(\"✓\")} Created POST /api/contact starter route`);\r\n    }\r\n  }\r\n\r\n  await registerWebConnector();\r\n}\r\n\r\nexport const webFeature: FeatureDefinition = {\r\n  description:\r\n    \"Installs @warlock.js/web — SSR React pages served by the Warlock HTTP server. Scaffolds src/web (root.tsx + a home page) and registers the WebConnector in warlock.config.ts. Pages are opt-in: a Warlock app is an API until you add this.\",\r\n  dependencies: {\r\n    \"@warlock.js/web\": INSTALLED_WARLOCK_VERSION,\r\n    \"@mongez/http\": \"^3.5.0\",\r\n    \"@mongez/react-form\": \"^4.0.0\",\r\n    \"@mongez/react-localization\": \"^3.4.7\",\r\n    react: \"^19.2.3\",\r\n    \"react-dom\": \"^19.2.3\",\r\n  },\r\n  devDependencies: {\r\n    \"@types/react\": \"^19.2.7\",\r\n    \"@types/react-dom\": \"^19.2.3\",\r\n    // Loaded through `await import()` by the dev server only, so both are\r\n    // optional peers of `web` rather than hard dependencies.\r\n    vite: \"^7.3.5\",\r\n    \"@vitejs/plugin-react\": \"^5.2.0\",\r\n  },\r\n  onExecuting: completeWebInstallation,\r\n};\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,eAAe,uBAAsC;CACnD,MAAM,aAAa,SAAS,mBAAmB;CAE/C,IAAI,CAAE,MAAM,gBAAgB,UAAU,GAAI;EACxC,QAAQ,IACN,GAAG,OAAO,aAAa,mBAAmB,EAAE,+JAG9C;EAEA;CACF;CAEA,MAAM,UAAU,MAAM,aAAa,UAAU;CAE7C,IAAI,QAAQ,SAAS,cAAc,GAAG;EACpC,QAAQ,IAAI,GAAG,OAAO,aAAa,cAAc,EAAE,iCAAiC;EAEpF;CACF;CAEA,MAAM,aAAa;CACnB,IAAI,OAAO,QAAQ,SAAS,UAAU,IAAI,UAAU,GAAG,WAAW,IAAI;CAItE,IAAI,mBAAmB,KAAK,IAAI,GAC9B,OAAO,KAAK,QAAQ,oBAAoB,8BAA8B;MACjE,IAAI,KAAK,SAAS,gBAAgB,GACvC,OAAO,KAAK,QAAQ,kBAAkB,iDAAiD;MAClF;EACL,QAAQ,IACN,GAAG,OAAO,aAAa,mBAAmB,EAAE,0FAE9C;EAEA;CACF;CAEA,MAAM,aAAa,YAAY,IAAI;CACnC,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,8CAA8C;AACjF;;;;;;;AAQA,eAAe,wBAAwB,UAA6B;CAClE,MAAM,WAAW,QAAQ,cAAc;CAEvC,IAAI,MAAM,gBAAgB,QAAQ,GAChC,QAAQ,IAAI,GAAG,OAAO,aAAa,SAAS,EAAE,iCAAiC;MAC1E;EACL,MAAM,qBAAqB,QAAQ,KAAK,CAAC;EACzC,MAAM,aAAa,UAAU,WAAW;EACxC,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,0BAA0B;EAE3D,MAAM,YAAY,MAAM,6BAA6B;EAErD,IAAI,UAAU,YAAY,aACxB,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,sBAAsB,OAAO,aAAa,WAAS,EAAE,YACrE,OAAO,aAAa,cAAY,EAAE,MAAM,OAAO,aAAa,OAAO,UAAU,cAAc,EAAE,sFAEpG;EAMF,IAAI,UAAU,YAAY,cAAc,UAAU,YAAY,UAAU;GACtE,MAAM,OAAO,UAAU,YAAY,WAAW,OAAO,UAAU,GAAG,IAAI,OAAO,aAAa,GAAG;GAE7F,QAAQ,IACN,GAAG,KAAK,0CAA0C,UAAU,OAAO,8BACrC,OAAO,aAAa,oBAAkB,EAAE;YAEvD,OAAO,aAAa,WAAS,EAAE,mKAGhD;GAUA,QAAQ,WAAW;EACrB,OAAO;GACL,MAAM,aAAa,QAAQ,oBAAoB,GAAG,eAAe;GACjE,MAAM,aAAa,QAAQ,uBAAuB,GAAG,mBAAmB;GACxE,MAAM,qBAAqB,QAAQ,yBAAyB,CAAC;GAC7D,MAAM,aACJ,QAAQ,+CAA+C,GACvD,wBACF;GACA,MAAM,aAAa,QAAQ,uBAAuB,GAAG,oBAAoB;GACzE,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,gCAAgC;GACjE,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,yCAAyC;EAC5E;CACF;CAEA,MAAM,qBAAqB;AAC7B;AAEA,MAAa,aAAgC;CAC3C,aACE;CACF,cAAc;EACZ,mBAAmB;EACnB,gBAAgB;EAChB,sBAAsB;EACtB,8BAA8B;EAC9B,OAAO;EACP,aAAa;CACf;CACA,iBAAiB;EACf,gBAAgB;EAChB,oBAAoB;EAGpB,MAAM;EACN,wBAAwB;CAC1B;CACA,aAAa;AACf"}
+{"version":3,"file":"web.feature.mjs","names":[],"sources":["../../../../../../../../core/src/generations/features/web.feature.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\r\nimport { ensureDirectoryAsync, fileExistsAsync, getFileAsync, putFileAsync } from \"@warlock.js/fs\";\r\nimport type { CommandActionData } from \"../../commands/types\";\r\nimport { rootPath, srcPath } from \"../../utils\";\r\nimport { relocateConflictingHomeRoute } from \"./shared/relocate-conflicting-home-route\";\r\nimport { resolveContactScaffold } from \"./shared/resolve-contact-scaffold\";\r\nimport {\r\n  webContactControllerStub,\r\n  webContactRoutesStub,\r\n  webHomePageStub,\r\n  webHomeRegisterStub,\r\n  webRootStub,\r\n} from \"../stubs\";\r\nimport { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\r\n\r\n/**\r\n * Register the WebConnector in `warlock.config.ts`, and ONLY there.\r\n *\r\n * It belongs to the config array or to app code, never both. Both halves are\r\n * registered before app code loads — the CLI preloader in dev, the generated\r\n * entry in production — so also calling `connectorsManager.register(...)` in\r\n * `src/app/main.ts` boots the connector twice and installs every page route\r\n * twice. That surfaces at PRODUCTION boot as `Route name \"...\" is already\r\n * taken`, because pages and API routes share one route-name namespace.\r\n *\r\n * The config array is the half to prefer: `warlock build` reads the same array\r\n * to drain each connector's build contribution, so \"built for\" and \"boots with\"\r\n * cannot drift.\r\n *\r\n * String surgery rather than a TypeScript parse: `warlock.config.ts` is an\r\n * app-owned file that may carry any formatting, and a parse-and-print would\r\n * reformat the parts we did not come to change.\r\n */\r\nasync function registerWebConnector(): Promise<void> {\r\n  const configPath = rootPath(\"warlock.config.ts\");\r\n\r\n  if (!(await fileExistsAsync(configPath))) {\r\n    console.log(\r\n      `${colors.yellowBright(\"warlock.config.ts\")} not found — add this yourself:\\n` +\r\n        `  import { webConnector } from \"@warlock.js/web/connector\";\\n` +\r\n        `  export default defineConfig({ connectors: [webConnector()] });`,\r\n    );\r\n\r\n    return;\r\n  }\r\n\r\n  const current = await getFileAsync(configPath);\r\n\r\n  if (current.includes(\"webConnector\")) {\r\n    console.log(`${colors.yellowBright(\"webConnector\")} already registered, skipping...`);\r\n\r\n    return;\r\n  }\r\n\r\n  const importLine = 'import { webConnector } from \"@warlock.js/web/connector\";';\r\n  let next = current.includes(importLine) ? current : `${importLine}\\n${current}`;\r\n\r\n  // An existing `connectors: [` gains one entry; otherwise the key is added to\r\n  // the object `defineConfig` receives.\r\n  if (/connectors:\\s*\\[/.test(next)) {\r\n    next = next.replace(/connectors:\\s*\\[/, \"connectors: [webConnector(),\");\r\n  } else if (next.includes(\"defineConfig({\")) {\r\n    next = next.replace(\"defineConfig({\", \"defineConfig({\\n  connectors: [webConnector()],\");\r\n  } else {\r\n    console.log(\r\n      `${colors.yellowBright(\"warlock.config.ts\")} has no recognisable defineConfig({...}) — ` +\r\n        \"add `connectors: [webConnector()]` yourself.\",\r\n    );\r\n\r\n    return;\r\n  }\r\n\r\n  await putFileAsync(configPath, next);\r\n  console.log(`${colors.green(\"✓\")} Registered webConnector in warlock.config.ts`);\r\n}\r\n\r\n/**\r\n * Scaffold the smallest page layer that renders, and register the connector.\r\n *\r\n * `src/web/root.tsx` is the sentinel for \"already scaffolded\" — the framework\r\n * ships a default root, so its presence means a human has been here.\r\n */\r\nasync function completeWebInstallation(_options: CommandActionData) {\r\n  const rootFile = srcPath(\"web/root.tsx\");\r\n\r\n  if (await fileExistsAsync(rootFile)) {\r\n    console.log(`${colors.yellowBright(\"src/web\")} already scaffolded, skipping...`);\r\n  } else {\r\n    await ensureDirectoryAsync(srcPath(\"web\"));\r\n    await putFileAsync(rootFile, webRootStub);\r\n    console.log(`${colors.green(\"✓\")} Created src/web/root.tsx`);\r\n\r\n    const collision = await relocateConflictingHomeRoute();\r\n\r\n    if (collision.outcome === \"relocated\") {\r\n      console.log(\r\n        `${colors.green(\"✓\")} Moved the existing ${colors.yellowBright('GET \"/\"')} route to ` +\r\n          `${colors.yellowBright('\"/welcome\"')} in ${colors.yellowBright(`src/${collision.relativePath}`)} — ` +\r\n          \"the new page owns `/` now, and the JSON welcome route still answers at /welcome.\",\r\n      );\r\n    }\r\n\r\n    // The page is written ONLY when `/` is provably free. Writing it while\r\n    // another handler holds `/` produces a homepage that 500s on first request,\r\n    // which is precisely the outcome a scaffolder must never hand back.\r\n    if (collision.outcome === \"conflict\" || collision.outcome === \"failed\") {\r\n      const verb = collision.outcome === \"failed\" ? colors.redBright(\"✗\") : colors.yellowBright(\"!\");\r\n\r\n      console.log(\r\n        `${verb} Did not create src/web/index.page.tsx: ${collision.reason}.\\n` +\r\n          `  The page stub declares ${colors.yellowBright('route.path = \"/\"')}, and two handlers on one ` +\r\n          \"path is a 500 at request time, not a startup error.\\n\" +\r\n          `  Free up ${colors.yellowBright('GET \"/\"')} under src/app — move it to a path of its own, ` +\r\n          \"or remove it — then create src/web/index.page.tsx yourself. Giving the page a `route` other \" +\r\n          \"than `/` works too.\",\r\n      );\r\n\r\n      // Non-zero on BOTH branches. The page layer this command exists to\r\n      // scaffold was not scaffolded, and a 0 here is the exact \"looked like it\r\n      // worked\" signal that put `/` in this state to begin with — a conflict we\r\n      // declined to guess at is still an incomplete install, not a success.\r\n      //\r\n      // `exitCode` rather than `exit(1)`: the connector below still has to be\r\n      // registered, and any other feature in the same `warlock add` invocation\r\n      // still has to install, or the project is left half-wired on top of this.\r\n      process.exitCode = 1;\r\n    } else {\r\n      await putFileAsync(srcPath(\"web/index.page.tsx\"), webHomePageStub);\r\n      await putFileAsync(srcPath(\"web/index.register.ts\"), webHomeRegisterStub);\r\n\r\n      // Unlike root.tsx above, the contact controller and its routes file are\r\n      // ordinary application files a project can already have — independently\r\n      // of ever having run `warlock add web`. Each is guarded on its OWN\r\n      // existence, not on the (already-consumed) root.tsx sentinel, so an\r\n      // existing `contact` module is skipped rather than clobbered. See\r\n      // resolveContactScaffold's doc comment for why.\r\n      const contactPlan = resolveContactScaffold({\r\n        controllerExists: await fileExistsAsync(\r\n          srcPath(\"app/contact/controllers/contact.controller.ts\"),\r\n        ),\r\n        routesExists: await fileExistsAsync(srcPath(\"app/contact/routes.ts\")),\r\n      });\r\n\r\n      if (contactPlan.writeController) {\r\n        await ensureDirectoryAsync(srcPath(\"app/contact/controllers\"));\r\n        await putFileAsync(\r\n          srcPath(\"app/contact/controllers/contact.controller.ts\"),\r\n          webContactControllerStub,\r\n        );\r\n      }\r\n\r\n      if (contactPlan.writeRoutes) {\r\n        await ensureDirectoryAsync(srcPath(\"app/contact\"));\r\n        await putFileAsync(srcPath(\"app/contact/routes.ts\"), webContactRoutesStub);\r\n      }\r\n\r\n      console.log(`${colors.green(\"✓\")} Created src/web/index.page.tsx`);\r\n\r\n      for (const message of contactPlan.messages) {\r\n        console.log(message);\r\n      }\r\n    }\r\n  }\r\n\r\n  await registerWebConnector();\r\n}\r\n\r\nexport const webFeature: FeatureDefinition = {\r\n  description:\r\n    \"Installs @warlock.js/web — SSR React pages served by the Warlock HTTP server. Scaffolds src/web (root.tsx + a home page) and registers the WebConnector in warlock.config.ts. Pages are opt-in: a Warlock app is an API until you add this.\",\r\n  dependencies: {\r\n    \"@warlock.js/web\": INSTALLED_WARLOCK_VERSION,\r\n    \"@mongez/http\": \"^3.5.0\",\r\n    \"@mongez/react-form\": \"^4.0.0\",\r\n    \"@mongez/react-localization\": \"^3.4.7\",\r\n    react: \"^19.2.3\",\r\n    \"react-dom\": \"^19.2.3\",\r\n  },\r\n  devDependencies: {\r\n    \"@types/react\": \"^19.2.7\",\r\n    \"@types/react-dom\": \"^19.2.3\",\r\n    // Loaded through `await import()` by the dev server only, so both are\r\n    // optional peers of `web` rather than hard dependencies.\r\n    vite: \"^7.3.5\",\r\n    \"@vitejs/plugin-react\": \"^5.2.0\",\r\n  },\r\n  onExecuting: completeWebInstallation,\r\n};\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,eAAe,uBAAsC;CACnD,MAAM,aAAa,SAAS,mBAAmB;CAE/C,IAAI,CAAE,MAAM,gBAAgB,UAAU,GAAI;EACxC,QAAQ,IACN,GAAG,OAAO,aAAa,mBAAmB,EAAE,+JAG9C;EAEA;CACF;CAEA,MAAM,UAAU,MAAM,aAAa,UAAU;CAE7C,IAAI,QAAQ,SAAS,cAAc,GAAG;EACpC,QAAQ,IAAI,GAAG,OAAO,aAAa,cAAc,EAAE,iCAAiC;EAEpF;CACF;CAEA,MAAM,aAAa;CACnB,IAAI,OAAO,QAAQ,SAAS,UAAU,IAAI,UAAU,GAAG,WAAW,IAAI;CAItE,IAAI,mBAAmB,KAAK,IAAI,GAC9B,OAAO,KAAK,QAAQ,oBAAoB,8BAA8B;MACjE,IAAI,KAAK,SAAS,gBAAgB,GACvC,OAAO,KAAK,QAAQ,kBAAkB,iDAAiD;MAClF;EACL,QAAQ,IACN,GAAG,OAAO,aAAa,mBAAmB,EAAE,0FAE9C;EAEA;CACF;CAEA,MAAM,aAAa,YAAY,IAAI;CACnC,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,8CAA8C;AACjF;;;;;;;AAQA,eAAe,wBAAwB,UAA6B;CAClE,MAAM,WAAW,QAAQ,cAAc;CAEvC,IAAI,MAAM,gBAAgB,QAAQ,GAChC,QAAQ,IAAI,GAAG,OAAO,aAAa,SAAS,EAAE,iCAAiC;MAC1E;EACL,MAAM,qBAAqB,QAAQ,KAAK,CAAC;EACzC,MAAM,aAAa,UAAU,WAAW;EACxC,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,0BAA0B;EAE3D,MAAM,YAAY,MAAM,6BAA6B;EAErD,IAAI,UAAU,YAAY,aACxB,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,sBAAsB,OAAO,aAAa,WAAS,EAAE,YACrE,OAAO,aAAa,cAAY,EAAE,MAAM,OAAO,aAAa,OAAO,UAAU,cAAc,EAAE,sFAEpG;EAMF,IAAI,UAAU,YAAY,cAAc,UAAU,YAAY,UAAU;GACtE,MAAM,OAAO,UAAU,YAAY,WAAW,OAAO,UAAU,GAAG,IAAI,OAAO,aAAa,GAAG;GAE7F,QAAQ,IACN,GAAG,KAAK,0CAA0C,UAAU,OAAO,8BACrC,OAAO,aAAa,oBAAkB,EAAE;YAEvD,OAAO,aAAa,WAAS,EAAE,mKAGhD;GAUA,QAAQ,WAAW;EACrB,OAAO;GACL,MAAM,aAAa,QAAQ,oBAAoB,GAAG,eAAe;GACjE,MAAM,aAAa,QAAQ,uBAAuB,GAAG,mBAAmB;GAQxE,MAAM,cAAc,uBAAuB;IACzC,kBAAkB,MAAM,gBACtB,QAAQ,+CAA+C,CACzD;IACA,cAAc,MAAM,gBAAgB,QAAQ,uBAAuB,CAAC;GACtE,CAAC;GAED,IAAI,YAAY,iBAAiB;IAC/B,MAAM,qBAAqB,QAAQ,yBAAyB,CAAC;IAC7D,MAAM,aACJ,QAAQ,+CAA+C,GACvD,wBACF;GACF;GAEA,IAAI,YAAY,aAAa;IAC3B,MAAM,qBAAqB,QAAQ,aAAa,CAAC;IACjD,MAAM,aAAa,QAAQ,uBAAuB,GAAG,oBAAoB;GAC3E;GAEA,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,gCAAgC;GAEjE,KAAK,MAAM,WAAW,YAAY,UAChC,QAAQ,IAAI,OAAO;EAEvB;CACF;CAEA,MAAM,qBAAqB;AAC7B;AAEA,MAAa,aAAgC;CAC3C,aACE;CACF,cAAc;EACZ,mBAAmB;EACnB,gBAAgB;EAChB,sBAAsB;EACtB,8BAA8B;EAC9B,OAAO;EACP,aAAa;CACf;CACA,iBAAiB;EACf,gBAAgB;EAChB,oBAAoB;EAGpB,MAAM;EACN,wBAAwB;CAC1B;CACA,aAAa;AACf"}

package/llms-full.txt

@@ -1235,7 +1235,7 @@ That's the full contract. The `RequestHandler` annotation carries both parameter
 - File: `src/app/<module>/controllers/<action>.controller.ts`.
 - Export name matches the action in camelCase + `Controller` suffix: `listProductsController`, `createProductController`, `getProductController`.
 
-Scaffold with: `pnpm warlock generate.controller <module>/<action>` (add `--with-validation` to get the schema generated alongside).
+Scaffold with: `npx warlock generate.controller <module>/<action>` (add `--with-validation` to get the schema generated alongside).
 
 ## Reading input
 
@@ -1437,7 +1437,7 @@ No `if (!product)` branch in the controller. The error class carries the HTTP se
 
 ---
 name: create-module
-description: 'Scaffold a new feature module under `src/app/<name>/` via `warlock generate.module` and the follow-up generators for controllers, models, repositories, resources, and validation schemas. Triggers: `warlock generate.module`, `generate.controller`, `generate.service`, `generate.model`, `generate.repository`, `generate.resource`, `generate.migration`, `--minimal`, `gen.m`; "scaffold a new module", "create CRUD bootstrap", "add a controller to a module", "generate a model"; typical CLI `pnpm warlock generate.module <name>`. Skip: framework-wide layout rules — `@warlock.js/core/warlock-conventions/SKILL.md`; routes file shape — `@warlock.js/core/register-route/SKILL.md`; controller shape — `@warlock.js/core/create-controller/SKILL.md`; competing tooling: `@nestjs/cli`, `hygen`, hand-rolled folder layouts.'
+description: 'Scaffold a new feature module under `src/app/<name>/` via `warlock generate.module` and the follow-up generators for controllers, models, repositories, resources, and validation schemas. Triggers: `warlock generate.module`, `generate.controller`, `generate.service`, `generate.model`, `generate.repository`, `generate.resource`, `generate.migration`, `--minimal`, `gen.m`; "scaffold a new module", "create CRUD bootstrap", "add a controller to a module", "generate a model"; typical CLI `npx warlock generate.module <name>`. Skip: framework-wide layout rules — `@warlock.js/core/warlock-conventions/SKILL.md`; routes file shape — `@warlock.js/core/register-route/SKILL.md`; controller shape — `@warlock.js/core/create-controller/SKILL.md`; competing tooling: `@nestjs/cli`, `hygen`, hand-rolled folder layouts.'
 ---
 
 # Warlock — create a module
@@ -1447,8 +1447,8 @@ A module is a self-contained feature folder under `src/app/<name>/`. The CLI sca
 ## The shape
 
 ```bash
-pnpm warlock generate.module products            # full CRUD bootstrap (default — controllers, model, services, repository, resource, schemas, routes, seed)
-pnpm warlock generate.module products --minimal  # bare bones (routes.ts + main.ts + utils/locales.ts + empty subfolders)
+npx warlock generate.module products            # full CRUD bootstrap (default — controllers, model, services, repository, resource, schemas, routes, seed)
+npx warlock generate.module products --minimal  # bare bones (routes.ts + main.ts + utils/locales.ts + empty subfolders)
 ```
 
 Full CRUD is the default — opt down to a bare skeleton with `--minimal` (`-m`) when you want to build the module piece by piece. `--force` (`-f`) overwrites existing files. The plural form is auto-derived: `generate.module product` and `generate.module products` produce the same `src/app/products/` folder.
@@ -1554,9 +1554,9 @@ Inside the same module, plain relative imports (`./`, `../`).
 ### Full CRUD bootstrap
 
 ```bash
-pnpm warlock generate.module products
+npx warlock generate.module products
 # edit schemas + model fields, then
-pnpm warlock migrate
+npx warlock migrate
 ```
 
 The CRUD scaffold's `routes.ts` already chains the five controllers behind `guarded(...)`:
@@ -1584,11 +1584,11 @@ guarded(() => {
 ### Skeleton module, add pieces piecemeal
 
 ```bash
-pnpm warlock generate.module orders --minimal
-pnpm warlock generate.model orders/order --with-resource
-pnpm warlock generate.repository orders/order
-pnpm warlock generate.controller orders/place-order --with-validation
-pnpm warlock generate.controller orders/list-orders
+npx warlock generate.module orders --minimal
+npx warlock generate.model orders/order --with-resource
+npx warlock generate.repository orders/order
+npx warlock generate.controller orders/place-order --with-validation
+npx warlock generate.controller orders/list-orders
 ```
 
 Then wire URLs by editing `src/app/orders/routes.ts` and the schema rules in `src/app/orders/schema/`.
@@ -1609,7 +1609,7 @@ await warmupProductCache();
 - **There's no standalone `generate.validation` command.** Validation is no longer scaffolded on its own — each controller carries its own schema (imported from `schema/` and bound via `controller.validation`). Generate the controller with `--with-validation` to get the paired schema file, or hand-write the `schema/*.schema.ts`.
 - **No `requests/` folder.** Controllers import the schema's exported type + value directly from `schema/*.schema.ts`; there is no `*.request.ts` alias.
 - **Subfolder is `seeds/` (plural), not `seed/`.** The seed file is `<module>.seed.ts`.
-- **`generate.module` does not run the migration.** It only creates the migration file. Run `pnpm warlock migrate` separately to apply it.
+- **`generate.module` does not run the migration.** It only creates the migration file. Run `npx warlock migrate` separately to apply it.
 - **`models/<entity>/` is its own folder, not a flat file.** The generator puts `product.model.ts` inside `models/product/` so migrations can sit beside the model in `models/product/migrations/`.
 - **Don't import `routes.ts`, `main.ts`, or anything in `events/`.** They're auto-loaded; double-loading errors out at boot.
 - **`utils/locales.ts` is mandatory for translation keys.** Skip it and `t("products.notFound")` silently falls back to the key itself.
@@ -2292,7 +2292,7 @@ The "same error for missing user vs wrong password" pattern is deliberate — it
 `hashPassword` / `verifyPassword` need `bcryptjs`. Install it directly:
 
 ```bash
-pnpm add bcryptjs
+npm install bcryptjs
 ```
 
 If you skip the install, the first call throws with the framework's install hint:
@@ -2301,14 +2301,14 @@ If you skip the install, the first call throws with the framework's install hint
 Password encryption requires the bcryptjs package.
 Install it with:
 
-  pnpm add bcryptjs
+  npm install bcryptjs
 
 Or with your preferred package manager:
 
-  pnpm add bcryptjs
+  npm install bcryptjs
 ```
 
-There is no `warlock add` feature for password hashing — `bcryptjs` is a plain dependency, so install it directly with `pnpm add bcryptjs`.
+There is no `warlock add` feature for password hashing — `bcryptjs` is a plain dependency, so install it directly with `npm install bcryptjs`.
 
 ## Gotchas
 
@@ -3288,13 +3288,13 @@ Three commands move the app through its lifecycle: `dev` while you're editing, `
 
 ```bash
 # Local development
-pnpm warlock dev
+npx warlock dev
 
 # Production build
-pnpm warlock build
+npx warlock build
 
 # Run the built bundle
-pnpm warlock start
+npx warlock start
 ```
 
 `dev` and `start` are **persistent** (long-running, no auto-exit). `build` is one-shot — it exits when the bundle is written.
@@ -3511,9 +3511,9 @@ The three cases that reach it are: never built; a build that failed before promo
 ### Behavior
 
 ```bash
-pnpm warlock start                        # → spawns node --enable-source-maps dist/app.js
-pnpm warlock start --inspect              # → spawns node --enable-source-maps --inspect dist/app.js
-pnpm warlock start --max-old-space-size=4096  # → spawns node --enable-source-maps --max-old-space-size=4096 dist/app.js
+npx warlock start                        # → spawns node --enable-source-maps dist/app.js
+npx warlock start --inspect              # → spawns node --enable-source-maps --inspect dist/app.js
+npx warlock start --max-old-space-size=4096  # → spawns node --enable-source-maps --max-old-space-size=4096 dist/app.js
 ```
 
 Everything you pass after `start` is forwarded to the spawned Node process. Use this to attach a debugger (`--inspect`), tune memory (`--max-old-space-size`), or pass any other Node flag without editing the command.
@@ -3565,7 +3565,7 @@ The started banner prints **only** when the running application reports a comple
 
 ```bash
 # a CI gate can be this blunt, and it is now correct
-pnpm warlock start | grep -q "production server started"
+npx warlock start | grep -q "production server started"
 ```
 
 ### Reading a failed start (5.2)
@@ -3648,17 +3648,17 @@ If you need conditional behavior, branch on `Application.environment` (the ortho
 }
 ```
 
-Now `pnpm dev` / `pnpm build` / `pnpm start`. Standard Node hosting providers (Render, Fly, Railway, Heroku) recognize this layout.
+Now `npm run dev` / `npm run build` / `npm run start`. Standard Node hosting providers (Render, Fly, Railway, Heroku) recognize this layout.
 
 ### Production Dockerfile
 
 ```dockerfile
 FROM node:20-alpine AS build
 WORKDIR /app
-COPY package.json yarn.lock ./
-RUN pnpm install --frozen-lockfile
+COPY package.json package-lock.json ./
+RUN npm ci
 COPY . .
-RUN pnpm warlock build
+RUN npx warlock build
 
 FROM node:20-alpine
 WORKDIR /app
@@ -3667,7 +3667,7 @@ COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/package.json ./
 COPY --from=build /app/warlock.config.ts ./
 ENV NODE_ENV=production
-CMD ["yarn", "warlock", "start"]
+CMD ["npx", "warlock", "start"]
 ```
 
 Two-stage build trims `devDependencies` out of the runtime image. Keep `warlock.config.ts` in the runtime stage — `start` reads it to resolve the bundle path.
@@ -3702,7 +3702,7 @@ That is deliberate: `build` and `start` do **not** force `production`. Forcing i
 ### Skip type-gen on machines without write access
 
 ```bash
-pnpm warlock dev --skip-typings
+npx warlock dev --skip-typings
 ```
 
 Or persist it:
@@ -3720,20 +3720,20 @@ Useful in a containerized dev environment where `.warlock/typings.d.ts` is read-
 ### Memory-tune the production process
 
 ```bash
-pnpm warlock start --max-old-space-size=4096
+npx warlock start --max-old-space-size=4096
 ```
 
 Or via `NODE_OPTIONS` in the deployment env if you don't want to change the start invocation:
 
 ```bash
-NODE_OPTIONS=--max-old-space-size=4096 pnpm warlock start
+NODE_OPTIONS=--max-old-space-size=4096 npx warlock start
 ```
 
 ## Gotchas
 
 - **`warlock dev` is persistent — `Ctrl+C` to stop.** The framework's `persistent: true` flag keeps the process alive after `action` returns. Same for `start`.
 - **`--fresh` only deletes the manifest, not the transpile cache.** If you're chasing a stale-compile bug, `rm -rf .warlock/` clears everything. The manifest restoring is what `--fresh` solves.
-- **`warlock build` does NOT run migrations.** Production bundles ship the migration files but don't apply them. Run `pnpm warlock migrate` against the production DB separately.
+- **`warlock build` does NOT run migrations.** Production bundles ship the migration files but don't apply them. Run `npx warlock migrate` against the production DB separately.
 - **`warlock start` requires a build it can vouch for.** Since 5.2 it refuses any `outdir` without the `.warlock-build.json` success marker — a hand-assembled `dist/`, or one left behind by a build that failed, is rejected by that reason instead of being spawned and crashing halfway through boot. Run `warlock build` first.
 - **Do not add `.warlock-build.json` to `.gitignore`-driven artifact pruning.** Stripping it from a `dist/` you ship makes `warlock start` refuse the artifact on the target host. Copy `outdir` whole.
 - **`outdir` is the directory, `outFile` is the filename within it.** A common mistake is putting the full path in one and leaving the other default — you end up with `<full-path>/app.js` or `dist/<full-path>`. They concatenate.
@@ -3840,7 +3840,7 @@ const config: MailConfigurations = {
 };
 ```
 
-Requires `@aws-sdk/client-sesv2` installed (`pnpm add @aws-sdk/client-sesv2`).
+Requires `@aws-sdk/client-sesv2` installed (`npm install @aws-sdk/client-sesv2`).
 
 ## Mail modes
 
@@ -4116,7 +4116,7 @@ await Mail.to(user.email)
 
 - **`.send()` validates** — `to`, `subject`, and at least one of `text`/`html`/`component` are required. Missing any throws synchronously.
 - **`@react-email/render` is optional.** Without it you get the basic fallback (inline styles, no MSO conditionals). Install it for production-quality HTML.
-- **`nodemailer` is loaded lazily** at import time. If you see `nodemailer is not installed` errors, run `warlock add mail` (or `pnpm add nodemailer`).
+- **`nodemailer` is loaded lazily** at import time. If you see `nodemailer is not installed` errors, run `warlock add mail` (or `npm install nodemailer`).
 - **`secure: true` requires port 465.** For port 587 use `secure: false` and `tls: true` (STARTTLS).
 - **Test mode is process-global.** Set it in `beforeAll`/`beforeEach`; reset with `setMailMode("production")` (or rely on test runner isolation).
 - **Per-mail handlers don't replace global ones** — both fire. Avoid double-counting metrics.
@@ -6894,7 +6894,7 @@ What it does at save time:
 | Existing row, password unchanged | Pass through (no re-hashing — stored hash preserved). |
 | Empty / undefined value         | Pass through untouched.                     |
 
-Calls `authService.hashPassword(String(value))` under the hood — same bcryptjs path as the standalone `hashPassword()` helper. See [`hash-password/SKILL.md`](../hash-password/SKILL.md) for full bcrypt setup (salt rounds, `pnpm add bcryptjs`).
+Calls `authService.hashPassword(String(value))` under the hood — same bcryptjs path as the standalone `hashPassword()` helper. See [`hash-password/SKILL.md`](../hash-password/SKILL.md) for full bcrypt setup (salt rounds, `npm install bcryptjs`).
 
 ### Why declarative wins
 
@@ -7048,7 +7048,7 @@ Rule of thumb: transformers are for **pure, deterministic** transforms of the ro
 
 ## See also
 
-- [`hash-password/SKILL.md`](../hash-password/SKILL.md) — the bcrypt setup that `useHashedPassword` calls under the hood; salt rounds, `pnpm add bcryptjs`.
+- [`hash-password/SKILL.md`](../hash-password/SKILL.md) — the bcrypt setup that `useHashedPassword` calls under the hood; salt rounds, `npm install bcryptjs`.
 - [`use-repository/SKILL.md`](../use-repository/SKILL.md) — where `create` / `save` calls happen that trigger the transformers.
 - [`define-resource/SKILL.md`](../define-resource/SKILL.md) — filtering transformed fields (`password`) out of API responses.
 - [`warlock-conventions/SKILL.md`](../warlock-conventions/SKILL.md) — schema files live in `src/app/<module>/models/<entity>/<entity>.model.ts`.
@@ -7111,7 +7111,7 @@ Five lines do the heavy lifting:
 4. **`defaultOptions`** — applied to every call (`orderBy`, default `limit`, etc.).
 5. **`new FaqsRepository()`** singleton — import this everywhere; never instantiate again.
 
-The class is intentionally private — only the singleton escapes the module. Scaffold with `pnpm warlock generate.repository <module>/<entity>`.
+The class is intentionally private — only the singleton escapes the module. Scaffold with `npx warlock generate.repository <module>/<entity>`.
 
 ## The `filterBy` rules
 
@@ -7710,7 +7710,7 @@ Two pieces, always:
 
 No separate `*.request.ts` alias file. `RequestHandler<Request<TSchema>>` types `request.validated()` directly off the schema's inferred type.
 
-Scaffold with `pnpm warlock generate.controller <module>/<action> --with-validation`. If the scaffolder emits a `requests/<action>.request.ts` file, delete it — the inline pattern is the convention.
+Scaffold with `npx warlock generate.controller <module>/<action> --with-validation`. If the scaffolder emits a `requests/<action>.request.ts` file, delete it — the inline pattern is the convention.
 
 ## The `v.*` factory surface
 
@@ -8097,7 +8097,7 @@ Cascade uses `@RegisterModel()` for the model registry and `@BelongsTo` / `@HasM
 
 ---
 name: warlock-doctor
-description: 'Run `warlock doctor` — a read-only diagnostics command that checks routes / config / connectors / optional-peers / health endpoints / release hygiene and prints a pass/warn/fail report, exiting non-zero on any failure. Add your own probe with the `DoctorCheck` contract and `runChecks` / `formatReportLines`. Triggers: `warlock doctor`, `doctorCommand`, `DoctorCheck`, `CheckResult`, `CheckStatus`, `DoctorReport`, `runChecks`, `formatReportLines`, `printReport`, `defaultDoctorChecks`; "diagnose my app", "preflight / preflight check", "is the app healthy", "why are there 0 routes", "pre-release sanity check", "CI smoke check"; run as `pnpm warlock doctor`. Skip: the live `/health` + `/ready` HTTP probes — `@warlock.js/core/health-checks/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; releasing the package — `releasing-warlock-monorepo`; competing tools `npm doctor`, `nest info`, hand-rolled preflight scripts.'
+description: 'Run `warlock doctor` — a read-only diagnostics command that checks routes / config / connectors / optional-peers / health endpoints / release hygiene and prints a pass/warn/fail report, exiting non-zero on any failure. Add your own probe with the `DoctorCheck` contract and `runChecks` / `formatReportLines`. Triggers: `warlock doctor`, `doctorCommand`, `DoctorCheck`, `CheckResult`, `CheckStatus`, `DoctorReport`, `runChecks`, `formatReportLines`, `printReport`, `defaultDoctorChecks`; "diagnose my app", "preflight / preflight check", "is the app healthy", "why are there 0 routes", "pre-release sanity check", "CI smoke check"; run as `npx warlock doctor`. Skip: the live `/health` + `/ready` HTTP probes — `@warlock.js/core/health-checks/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; releasing the package — `releasing-warlock-monorepo`; competing tools `npm doctor`, `nest info`, hand-rolled preflight scripts.'
 ---
 
 # Warlock — `warlock doctor`
@@ -8105,7 +8105,7 @@ description: 'Run `warlock doctor` — a read-only diagnostics command that chec
 `warlock doctor` is a read-only preflight. It boots the app far enough to introspect it — loads every config file and bootstrap code so routes and connectors register — but **starts no connectors**, so it never opens a database, cache, or socket connection. It then runs a set of checks and prints a grouped pass / warn / fail report.
 
 ```bash
-pnpm warlock doctor
+npx warlock doctor
 ```
 
 ```
@@ -8208,7 +8208,7 @@ if (report.hasFailures) process.exit(report.exitCode);
 ### CI / pre-release gate
 
 ```bash
-pnpm warlock doctor || exit 1   # non-zero exit fails the job
+npx warlock doctor || exit 1   # non-zero exit fails the job
 ```
 
 A red `release-hygiene` line catches the classic "bumped `package.json` but forgot the CHANGELOG heading" mistake before a publish.
@@ -8236,7 +8236,7 @@ A `⚠ routes: 0 routes registered` line is the tell that a route module threw o
 
 ---
 name: warlock-routes
-description: 'Run `warlock routes` — a read-only command that lists the registered HTTP routes as a verb-colored table (method / path / name / action / middleware-count / source), a sibling of `warlock doctor`. Filter with `--method` / `--path` / `--name`, or emit normalized rows as JSON with `--json`. Also covers `warlock routes:diff`, which compares live page routes against the last `warlock build`''s route snapshot and exits non-zero on drift. Triggers: `warlock routes`, `routesCommand`, `warlock routes:diff`, `routesDiffCommand`, "list my routes", "show all routes", "route table", "what endpoints does my app expose", "dump routes as JSON", "which routes have middleware", "route map for CI", "did my page routes drift from the last build"; run as `pnpm warlock routes` / `pnpm warlock routes:diff`. Skip: read-only health/preflight checks — `@warlock.js/core/warlock-doctor/SKILL.md`; defining/naming/grouping routes — `@warlock.js/core/register-route/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; competing tools `nest`/`express` route listers, `php artisan route:list`.'
+description: 'Run `warlock routes` — a read-only command that lists the registered HTTP routes as a verb-colored table (method / path / name / action / middleware-count / source), a sibling of `warlock doctor`. Filter with `--method` / `--path` / `--name`, or emit normalized rows as JSON with `--json`. Also covers `warlock routes:diff`, which compares live page routes against the last `warlock build`''s route snapshot and exits non-zero on drift. Triggers: `warlock routes`, `routesCommand`, `warlock routes:diff`, `routesDiffCommand`, "list my routes", "show all routes", "route table", "what endpoints does my app expose", "dump routes as JSON", "which routes have middleware", "route map for CI", "did my page routes drift from the last build"; run as `npx warlock routes` / `npx warlock routes:diff`. Skip: read-only health/preflight checks — `@warlock.js/core/warlock-doctor/SKILL.md`; defining/naming/grouping routes — `@warlock.js/core/register-route/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; competing tools `nest`/`express` route listers, `php artisan route:list`.'
 ---
 
 # Warlock — `warlock routes`
@@ -8244,7 +8244,7 @@ description: 'Run `warlock routes` — a read-only command that lists the regist
 `warlock routes` lists every registered HTTP route as a table. It's the read-only sibling of [`warlock doctor`](../warlock-doctor/SKILL.md): it boots the app far enough to register route modules — but **starts no connectors**, so it never opens a database, cache, or socket connection.
 
 ```bash
-pnpm warlock routes
+npx warlock routes
 ```
 
 ```
@@ -8275,10 +8275,10 @@ The `METHOD` column is verb-colored (GET green, POST blue, PUT/PATCH yellow, DEL
 Optional, case-insensitive, AND-combined:
 
 ```bash
-pnpm warlock routes --method GET     # -m  exact HTTP method
-pnpm warlock routes --path /users    # -p  path substring
-pnpm warlock routes --name users     # -n  route-name substring
-pnpm warlock routes -m POST -p /users
+npx warlock routes --method GET     # -m  exact HTTP method
+npx warlock routes --path /users    # -p  path substring
+npx warlock routes --name users     # -n  route-name substring
+npx warlock routes -m POST -p /users
 ```
 
 ## JSON output
@@ -8286,7 +8286,7 @@ pnpm warlock routes -m POST -p /users
 `--json` (`-j`) emits the normalized rows instead of the table — for `jq`, a CI diff, or a generated API map. Filters apply before serialization.
 
 ```bash
-pnpm warlock routes --json
+npx warlock routes --json
 ```
 
 ```json
@@ -8300,7 +8300,7 @@ pnpm warlock routes --json
 ### Audit which routes are guarded
 
 ```bash
-pnpm warlock routes --json | jq '[.[] | select(.middleware == 0)]'
+npx warlock routes --json | jq '[.[] | select(.middleware == 0)]'
 ```
 
 Surfaces public routes (no middleware) — a quick check that auth-protected paths actually carry a guard.
@@ -8308,7 +8308,7 @@ Surfaces public routes (no middleware) — a quick check that auth-protected pat
 ### Confirm a route registered
 
 ```bash
-pnpm warlock routes --name users.create
+npx warlock routes --name users.create
 ```
 
 An empty result means the route isn't registered — re-run `warlock dev` and read the boot error (the route-module loader is fail-loud, so a throwing route file aborts boot rather than being silently dropped).
@@ -8318,7 +8318,7 @@ An empty result means the route isn't registered — re-run `warlock dev` and re
 Compares the **live dev-server page routes** (`router.list().filter(r => r.isPage)`) against a **snapshot written by the last successful `warlock build`** (`page-routes.manifest.json` in `resolveBuildConfig().outdir`, e.g. `dist/page-routes.manifest.json`). Boots the same diagnostic way as `warlock routes` — route modules registered, no connectors started — then diffs.
 
 ```bash
-pnpm warlock routes:diff
+npx warlock routes:diff
 ```
 
 ```
@@ -8696,7 +8696,7 @@ export default command({
 });
 ```
 
-Run it: `pnpm warlock users.promote --email=hasan@example.com` (or `pnpm warlock up -e hasan@example.com`).
+Run it: `npx warlock users.promote --email=hasan@example.com` (or `npx warlock up -e hasan@example.com`).
 
 ## `CLICommandOptions` — the factory input
 
@@ -9229,12 +9229,12 @@ export default seeder({
 Run them:
 
 ```bash
-pnpm warlock seed                            # discover + run all
-pnpm warlock seed --list                     # show registry, don't run
-pnpm warlock seed --path=src/app/roles/seeds/default-roles.seed.ts  # one file
-pnpm warlock seed --fresh                    # truncate every table first, then run all
-pnpm warlock seed --drop                     # undo every tracked record, reset the log
-pnpm warlock seed --drop=default-roles       # undo just one seeder's records
+npx warlock seed                            # discover + run all
+npx warlock seed --list                     # show registry, don't run
+npx warlock seed --path=src/app/roles/seeds/default-roles.seed.ts  # one file
+npx warlock seed --fresh                    # truncate every table first, then run all
+npx warlock seed --drop                     # undo every tracked record, reset the log
+npx warlock seed --drop=default-roles       # undo just one seeder's records
 ```
 
 `--fresh` truncates **every** table in the DB (`datasource.driver.truncateTable(table, { cascade: true })`), including the `seeds` tracking table. After `--fresh`, `once: true` seeds will run again.
@@ -9372,8 +9372,8 @@ Every record you `track()` is written to a `seed_records` table (created on firs
 `warlock seed --drop` reads those refs and undoes the seed:
 
 ```bash
-pnpm warlock seed --drop                # undo every tracked record across all seeders
-pnpm warlock seed --drop=default-roles  # undo just one seeder's records
+npx warlock seed --drop                # undo every tracked record across all seeders
+npx warlock seed --drop=default-roles  # undo just one seeder's records
 ```
 
 What it does, inside a single transaction:

package/llms.txt

@@ -12,7 +12,7 @@
 - [build-url](@warlock.js/core/build-url/SKILL.md): HTTP URL helpers — `url`, `publicUrl`, `assetsUrl`, `uploadsUrl`, anchored at `app.baseUrl`. Use to render `src` / `href` / API URLs in resources and responses. `setBaseUrl` is wired by the HTTP connector from `config.get("app.baseUrl")`. Triggers: `url`, `publicUrl`, `assetsUrl`, `uploadsUrl`, `setBaseUrl`, `BASE_URL`; "render an avatar src URL", "absolute download link", "embed asset URL in email", "URL helpers vs path helpers"; typical import `import { url, publicUrl, uploadsUrl } from "@warlock.js/core"`. Skip: filesystem paths — `@warlock.js/core/resolve-path/SKILL.md`; signed CDN URLs — `@warlock.js/core/store-file/SKILL.md`; resource output — `@warlock.js/core/define-resource/SKILL.md`; competing patterns: hand-rolled `${baseUrl}/...` template strings.
 - [configure-app](@warlock.js/core/configure-app/SKILL.md): Configure a Warlock app — the two layers (`warlock.config.ts` for framework-level wiring, `src/config/*.ts` for subsystems), `.env` + `env()`, and the `config()` getter for runtime reads. Triggers: `defineConfig`, `config.get`, `config.key`, `env`, `ConfigRegistry`, `HttpConfigurations`, `AppConfigurations`; "add a new config file", "warlock.config.ts vs src/config", "read env values", "runtime config lookup"; typical import `import { defineConfig, config, env } from "@warlock.js/core"`. Skip: cache driver registration — `@warlock.js/cache/cache-basics/SKILL.md`; mail config — `@warlock.js/core/send-mail/SKILL.md`; storage config — `@warlock.js/core/store-file/SKILL.md`; competing libs `dotenv` direct, `convict`, `node-config`.
 - [create-controller](@warlock.js/core/create-controller/SKILL.md): Author HTTP controllers in @warlock.js/core — RequestHandler signature, validated input via seal schemas, response helpers, attaching metadata. Controllers are thin functions; business logic moves to services or use-cases. Triggers: `RequestHandler`, `Request<TSchema>`, `GuardedRequestHandler`, `request.validated`, `request.input`, `controller.validation`, `response.success`, `response.successCreate`; "write a controller", "attach a schema to a handler", "thin controller pattern", "guarded request type"; typical import `import { type RequestHandler } from "@warlock.js/core"`. Skip: response helper menu — `@warlock.js/core/send-response/SKILL.md`; schema authoring — `@warlock.js/core/validate-input/SKILL.md`; URL wiring — `@warlock.js/core/register-route/SKILL.md`; competing patterns: `express` middleware functions, `@nestjs/common` `@Controller`/`@Get` decorators.
-- [create-module](@warlock.js/core/create-module/SKILL.md): Scaffold a new feature module under `src/app/<name>/` via `warlock generate.module` and the follow-up generators for controllers, models, repositories, resources, and validation schemas. Triggers: `warlock generate.module`, `generate.controller`, `generate.service`, `generate.model`, `generate.repository`, `generate.resource`, `generate.migration`, `--minimal`, `gen.m`; "scaffold a new module", "create CRUD bootstrap", "add a controller to a module", "generate a model"; typical CLI `pnpm warlock generate.module <name>`. Skip: framework-wide layout rules — `@warlock.js/core/warlock-conventions/SKILL.md`; routes file shape — `@warlock.js/core/register-route/SKILL.md`; controller shape — `@warlock.js/core/create-controller/SKILL.md`; competing tooling: `@nestjs/cli`, `hygen`, hand-rolled folder layouts.
+- [create-module](@warlock.js/core/create-module/SKILL.md): Scaffold a new feature module under `src/app/<name>/` via `warlock generate.module` and the follow-up generators for controllers, models, repositories, resources, and validation schemas. Triggers: `warlock generate.module`, `generate.controller`, `generate.service`, `generate.model`, `generate.repository`, `generate.resource`, `generate.migration`, `--minimal`, `gen.m`; "scaffold a new module", "create CRUD bootstrap", "add a controller to a module", "generate a model"; typical CLI `npx warlock generate.module <name>`. Skip: framework-wide layout rules — `@warlock.js/core/warlock-conventions/SKILL.md`; routes file shape — `@warlock.js/core/register-route/SKILL.md`; controller shape — `@warlock.js/core/create-controller/SKILL.md`; competing tooling: `@nestjs/cli`, `hygen`, hand-rolled folder layouts.
 - [define-resource](@warlock.js/core/define-resource/SKILL.md): Map model fields to wire-shape via `defineResource()` or `Resource` subclasses. Output-only — never put business logic, hydration, or reconciliation in a resource. Triggers: `defineResource`, `Resource`, `RegisterResource`, `toJSON`, `"self"`, `"localized"`, `"uploadsUrl"`; "shape an API response", "nest related resources", "rename a field on output", "self-referential tree resource"; typical import `import { defineResource } from "@warlock.js/core"`. Skip: localized columns — `@warlock.js/core/use-localization/SKILL.md`; URL casting — `@warlock.js/core/build-url/SKILL.md`; controller side — `@warlock.js/core/create-controller/SKILL.md`; competing libs `@nestjs/swagger` `@ApiProperty`, `class-transformer`, hand-rolled DTO mappers.
 - [encrypt-data](@warlock.js/core/encrypt-data/SKILL.md): Reversible AES-256-GCM `encrypt` / `decrypt` for secrets you need to read back; one-way HMAC-SHA256 `hmacHash` for deterministic fingerprints (lookup/dedup of encrypted columns). Keys come from `src/config/encryption.ts`. Triggers: `encrypt`, `decrypt`, `hmacHash`, `EncryptionConfigurations`, `APP_ENCRYPTION_KEY`, `APP_HMAC_KEY`; "store an API key reversibly", "fingerprint an encrypted column for lookup", "AES-256-GCM secret", "HMAC-SHA256 dedup key"; typical import `import { encrypt, decrypt, hmacHash } from "@warlock.js/core"`. Skip: password hashing — `@warlock.js/core/hash-password/SKILL.md`; config wiring — `@warlock.js/core/configure-app/SKILL.md`; competing libs Node `crypto` direct, `crypto-js`, `libsodium-wrappers`.
 - [hash-password](@warlock.js/core/hash-password/SKILL.md): One-way bcrypt password hashing — `hashPassword` / `verifyPassword`, plus the declarative `useHashedPassword()` schema transformer that auto-hashes a model's password field on save. Salt rounds come from `src/config/encryption.ts`. Triggers: `hashPassword`, `verifyPassword`, `useHashedPassword`, `password.salt`, `bcryptjs`; "hash a user password", "verify login credentials", "auto-hash on save", "rotate a password"; typical import `import { hashPassword, verifyPassword } from "@warlock.js/core"`. Skip: reversible secrets — `@warlock.js/core/encrypt-data/SKILL.md`; the other transformers — `@warlock.js/core/use-model-transformers/SKILL.md`; config wiring — `@warlock.js/core/configure-app/SKILL.md`; competing libs `bcrypt` native, `argon2`, `scrypt`.
@@ -39,8 +39,8 @@
 - [use-request-locals](@warlock.js/core/use-request-locals/SKILL.md): Carry typed, server-only data through one HTTP request with `request.locals`, usually written by middleware and read by downstream middleware or controllers. Augment `RequestLocals` in the module that owns each key; v5 no longer permits arbitrary `request.foo` properties. Triggers: `request.locals`, `RequestLocals`, `request.post`, `request.organization`, `Property does not exist on type Request`, `Request index signature`; "attach data to a request", "share middleware data with a controller", "type request locals", "migrate dynamic request properties"; typical type augmentation `declare module "@warlock.js/core" { interface RequestLocals { ... } }`. Skip: computed-on-demand single-flight values and removed `fromRequest` — `@warlock.js/core/request-memo/SKILL.md`; middleware mechanics — `@warlock.js/core/write-middleware/SKILL.md`; authenticated user typing — augment `RequestUser`, not `RequestLocals`; competing patterns: `(request as any).foo`, `request.set()`, module-global mutable state.
 - [validate-input](@warlock.js/core/validate-input/SKILL.md): Author seal schemas, attach them to controllers via `controller.validation = { schema }`, infer types via `Infer<typeof schema>`, and layer DB-aware (`unique`/`exists`) and file validators on top. Triggers: `v.object`, `v.string`, `v.email`, `Infer`, `controller.validation`, `.unique`, `.exists`, `uniqueExceptCurrentId`, `request.validated`; "validate a request body", "attach a schema to a controller", "DB-aware unique rule", "infer schema types"; typical import `import { v, type Infer } from "@warlock.js/seal"`. Skip: schema authoring foundations — `@warlock.js/seal/seal-basics/SKILL.md`; controller wiring — `@warlock.js/core/create-controller/SKILL.md`; file rules deep-dive — `@warlock.js/core/upload-file/SKILL.md`; competing libs `zod`, `joi`, `yup`, `class-validator`.
 - [warlock-conventions](@warlock.js/core/warlock-conventions/SKILL.md): Framework-wide invariants for projects built on @warlock.js/core — module layout, canonical imports, layered flow, file naming, and the non-negotiable rules every other warlock skill assumes. Triggers: `src/app/<module>`, `routes.ts`, `main.ts`, `Request<TSchema>`, `RequestHandler`, `GuardedRequestHandler`, `app/<module>/...`; "where do files go in this project", "canonical Warlock imports", "module layout rules", "controller-service-repository layering"; typical import `import { router, type RequestHandler } from "@warlock.js/core"`. Skip: scaffold a new module — `@warlock.js/core/create-module/SKILL.md`; route shape — `@warlock.js/core/register-route/SKILL.md`; controller shape — `@warlock.js/core/create-controller/SKILL.md`; competing patterns: `express` ad-hoc layouts, `@nestjs/common` decorator-driven structure.
-- [warlock-doctor](@warlock.js/core/warlock-doctor/SKILL.md): Run `warlock doctor` — a read-only diagnostics command that checks routes / config / connectors / optional-peers / health endpoints / release hygiene and prints a pass/warn/fail report, exiting non-zero on any failure. Add your own probe with the `DoctorCheck` contract and `runChecks` / `formatReportLines`. Triggers: `warlock doctor`, `doctorCommand`, `DoctorCheck`, `CheckResult`, `CheckStatus`, `DoctorReport`, `runChecks`, `formatReportLines`, `printReport`, `defaultDoctorChecks`; "diagnose my app", "preflight / preflight check", "is the app healthy", "why are there 0 routes", "pre-release sanity check", "CI smoke check"; run as `pnpm warlock doctor`. Skip: the live `/health` + `/ready` HTTP probes — `@warlock.js/core/health-checks/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; releasing the package — `releasing-warlock-monorepo`; competing tools `npm doctor`, `nest info`, hand-rolled preflight scripts.
-- [warlock-routes](@warlock.js/core/warlock-routes/SKILL.md): Run `warlock routes` — a read-only command that lists the registered HTTP routes as a verb-colored table (method / path / name / action / middleware-count / source), a sibling of `warlock doctor`. Filter with `--method` / `--path` / `--name`, or emit normalized rows as JSON with `--json`. Also covers `warlock routes:diff`, which compares live page routes against the last `warlock build`'s route snapshot and exits non-zero on drift. Triggers: `warlock routes`, `routesCommand`, `warlock routes:diff`, `routesDiffCommand`, "list my routes", "show all routes", "route table", "what endpoints does my app expose", "dump routes as JSON", "which routes have middleware", "route map for CI", "did my page routes drift from the last build"; run as `pnpm warlock routes` / `pnpm warlock routes:diff`. Skip: read-only health/preflight checks — `@warlock.js/core/warlock-doctor/SKILL.md`; defining/naming/grouping routes — `@warlock.js/core/register-route/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; competing tools `nest`/`express` route listers, `php artisan route:list`.
+- [warlock-doctor](@warlock.js/core/warlock-doctor/SKILL.md): Run `warlock doctor` — a read-only diagnostics command that checks routes / config / connectors / optional-peers / health endpoints / release hygiene and prints a pass/warn/fail report, exiting non-zero on any failure. Add your own probe with the `DoctorCheck` contract and `runChecks` / `formatReportLines`. Triggers: `warlock doctor`, `doctorCommand`, `DoctorCheck`, `CheckResult`, `CheckStatus`, `DoctorReport`, `runChecks`, `formatReportLines`, `printReport`, `defaultDoctorChecks`; "diagnose my app", "preflight / preflight check", "is the app healthy", "why are there 0 routes", "pre-release sanity check", "CI smoke check"; run as `npx warlock doctor`. Skip: the live `/health` + `/ready` HTTP probes — `@warlock.js/core/health-checks/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; releasing the package — `releasing-warlock-monorepo`; competing tools `npm doctor`, `nest info`, hand-rolled preflight scripts.
+- [warlock-routes](@warlock.js/core/warlock-routes/SKILL.md): Run `warlock routes` — a read-only command that lists the registered HTTP routes as a verb-colored table (method / path / name / action / middleware-count / source), a sibling of `warlock doctor`. Filter with `--method` / `--path` / `--name`, or emit normalized rows as JSON with `--json`. Also covers `warlock routes:diff`, which compares live page routes against the last `warlock build`'s route snapshot and exits non-zero on drift. Triggers: `warlock routes`, `routesCommand`, `warlock routes:diff`, `routesDiffCommand`, "list my routes", "show all routes", "route table", "what endpoints does my app expose", "dump routes as JSON", "which routes have middleware", "route map for CI", "did my page routes drift from the last build"; run as `npx warlock routes` / `npx warlock routes:diff`. Skip: read-only health/preflight checks — `@warlock.js/core/warlock-doctor/SKILL.md`; defining/naming/grouping routes — `@warlock.js/core/register-route/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; competing tools `nest`/`express` route listers, `php artisan route:list`.
 - [wire-socket](@warlock.js/core/wire-socket/SKILL.md): Configure Socket.IO via `src/config/socket.ts`, reach the live server through `getSocketServer()` (or `app.socket` post-bootstrap), register `connection` handlers once the late-phase socket connector has booted, emit from controllers/services, use rooms and namespaces. Triggers: `app.socket`, `getSocketServer`, `SocketOptions`, `socket.io` `Server`, `socket.join`, `socket.to`, `io.of`, `io.use`; "add realtime chat", "emit socket events from a service", "use rooms and namespaces", "per-socket JWT auth". Skip: connector lifecycle — `@warlock.js/core/add-connector/SKILL.md`; app context accessors — `@warlock.js/core/use-app-context/SKILL.md`; competing libs `ws`, `socket.io` direct without Warlock connector, `uWebSockets.js`.
 - [write-cli-command](@warlock.js/core/write-cli-command/SKILL.md): Author a custom `warlock <my-cmd>` command via the `command()` factory — name, description, action, options, preload, then register in `warlock.config.ts > cli.commands` or drop in `src/app/<module>/commands/`. Also covers built-in `warlock add` feature scaffolding, including the Web starter and `index.register.ts`. Triggers: `command`, `CLICommand`, `CLICommandPreload`, `CLICommandOption`, `preload`, `preAction`, `persistent`, `colors`, `warlock add`, `index.register.ts`; "write a custom warlock command", "one-off maintenance task", "ship a CLI from a package", "framework built-in commands"; typical import `import { command } from "@warlock.js/core"`. Skip: framework dev/build/start — `@warlock.js/core/run-app/SKILL.md`; warlock.config.ts wiring — `@warlock.js/core/configure-app/SKILL.md`; competing libs `commander`, `yargs`, `oclif`.
 - [write-middleware](@warlock.js/core/write-middleware/SKILL.md): Author HTTP middleware for @warlock.js/core — the `({ request, response })` signature, short-circuit by returning a response, enrich the request with extra fields, register per-route, per-group, or app-wide. Triggers: `Middleware`, `MiddlewareResponse`, `router.group`, `guarded`, `request.detectIp`, `authMiddleware`; "write a custom middleware", "short-circuit a request", "enrich the request with extra fields", "per-route vs per-group middleware"; typical import `import type { Middleware } from "@warlock.js/core"`. Skip: built-in middleware catalog — `@warlock.js/core/use-middleware/SKILL.md`; route attachment — `@warlock.js/core/register-route/SKILL.md`; response helpers — `@warlock.js/core/send-response/SKILL.md`; competing patterns: `express` `(req, res, next)` middleware, Fastify `preHandler` hooks.

package/package.json

@@ -25,13 +25,13 @@
     "@mongez/slug": "^1.0.7",
     "@mongez/supportive-is": "^2.1.4",
     "@mongez/time-wizard": "^1.0.6",
-    "@warlock.js/auth": "5.4.0",
-    "@warlock.js/cache": "5.4.0",
-    "@warlock.js/cascade": "5.4.0",
-    "@warlock.js/context": "5.4.0",
-    "@warlock.js/logger": "5.4.0",
-    "@warlock.js/seal": "5.4.0",
-    "@warlock.js/fs": "5.4.0",
+    "@warlock.js/auth": "5.5.0",
+    "@warlock.js/cache": "5.5.0",
+    "@warlock.js/cascade": "5.5.0",
+    "@warlock.js/context": "5.5.0",
+    "@warlock.js/logger": "5.5.0",
+    "@warlock.js/seal": "5.5.0",
+    "@warlock.js/fs": "5.5.0",
     "chokidar": "^5.0.0",
     "dayjs": "^1.11.19",
     "es-module-lexer": "^2.0.0",
@@ -57,10 +57,10 @@
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
     "@react-email/render": "^2.0.5",
-    "@warlock.js/herald": "5.4.0",
-    "@warlock.js/ai": "5.4.0",
-    "@warlock.js/access": "5.4.0",
-    "@warlock.js/notifications": "5.4.0"
+    "@warlock.js/herald": "5.5.0",
+    "@warlock.js/ai": "5.5.0",
+    "@warlock.js/access": "5.5.0",
+    "@warlock.js/notifications": "5.5.0"
   },
   "peerDependenciesMeta": {
     "sharp": {
@@ -123,7 +123,7 @@
   ],
   "author": "hassanzohdy",
   "license": "MIT",
-  "version": "5.4.0",
+  "version": "5.5.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",

package/skills/create-controller/SKILL.md

@@ -25,7 +25,7 @@ That's the full contract. The `RequestHandler` annotation carries both parameter
 - File: `src/app/<module>/controllers/<action>.controller.ts`.
 - Export name matches the action in camelCase + `Controller` suffix: `listProductsController`, `createProductController`, `getProductController`.
 
-Scaffold with: `pnpm warlock generate.controller <module>/<action>` (add `--with-validation` to get the schema generated alongside).
+Scaffold with: `npx warlock generate.controller <module>/<action>` (add `--with-validation` to get the schema generated alongside).
 
 ## Reading input
 

package/skills/create-module/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: create-module
-description: 'Scaffold a new feature module under `src/app/<name>/` via `warlock generate.module` and the follow-up generators for controllers, models, repositories, resources, and validation schemas. Triggers: `warlock generate.module`, `generate.controller`, `generate.service`, `generate.model`, `generate.repository`, `generate.resource`, `generate.migration`, `--minimal`, `gen.m`; "scaffold a new module", "create CRUD bootstrap", "add a controller to a module", "generate a model"; typical CLI `pnpm warlock generate.module <name>`. Skip: framework-wide layout rules — `@warlock.js/core/warlock-conventions/SKILL.md`; routes file shape — `@warlock.js/core/register-route/SKILL.md`; controller shape — `@warlock.js/core/create-controller/SKILL.md`; competing tooling: `@nestjs/cli`, `hygen`, hand-rolled folder layouts.'
+description: 'Scaffold a new feature module under `src/app/<name>/` via `warlock generate.module` and the follow-up generators for controllers, models, repositories, resources, and validation schemas. Triggers: `warlock generate.module`, `generate.controller`, `generate.service`, `generate.model`, `generate.repository`, `generate.resource`, `generate.migration`, `--minimal`, `gen.m`; "scaffold a new module", "create CRUD bootstrap", "add a controller to a module", "generate a model"; typical CLI `npx warlock generate.module <name>`. Skip: framework-wide layout rules — `@warlock.js/core/warlock-conventions/SKILL.md`; routes file shape — `@warlock.js/core/register-route/SKILL.md`; controller shape — `@warlock.js/core/create-controller/SKILL.md`; competing tooling: `@nestjs/cli`, `hygen`, hand-rolled folder layouts.'
 ---
 
 # Warlock — create a module
@@ -10,8 +10,8 @@ A module is a self-contained feature folder under `src/app/<name>/`. The CLI sca
 ## The shape
 
 ```bash
-pnpm warlock generate.module products            # full CRUD bootstrap (default — controllers, model, services, repository, resource, schemas, routes, seed)
-pnpm warlock generate.module products --minimal  # bare bones (routes.ts + main.ts + utils/locales.ts + empty subfolders)
+npx warlock generate.module products            # full CRUD bootstrap (default — controllers, model, services, repository, resource, schemas, routes, seed)
+npx warlock generate.module products --minimal  # bare bones (routes.ts + main.ts + utils/locales.ts + empty subfolders)
 ```
 
 Full CRUD is the default — opt down to a bare skeleton with `--minimal` (`-m`) when you want to build the module piece by piece. `--force` (`-f`) overwrites existing files. The plural form is auto-derived: `generate.module product` and `generate.module products` produce the same `src/app/products/` folder.
@@ -117,9 +117,9 @@ Inside the same module, plain relative imports (`./`, `../`).
 ### Full CRUD bootstrap
 
 ```bash
-pnpm warlock generate.module products
+npx warlock generate.module products
 # edit schemas + model fields, then
-pnpm warlock migrate
+npx warlock migrate
 ```
 
 The CRUD scaffold's `routes.ts` already chains the five controllers behind `guarded(...)`:
@@ -147,11 +147,11 @@ guarded(() => {
 ### Skeleton module, add pieces piecemeal
 
 ```bash
-pnpm warlock generate.module orders --minimal
-pnpm warlock generate.model orders/order --with-resource
-pnpm warlock generate.repository orders/order
-pnpm warlock generate.controller orders/place-order --with-validation
-pnpm warlock generate.controller orders/list-orders
+npx warlock generate.module orders --minimal
+npx warlock generate.model orders/order --with-resource
+npx warlock generate.repository orders/order
+npx warlock generate.controller orders/place-order --with-validation
+npx warlock generate.controller orders/list-orders
 ```
 
 Then wire URLs by editing `src/app/orders/routes.ts` and the schema rules in `src/app/orders/schema/`.
@@ -172,7 +172,7 @@ await warmupProductCache();
 - **There's no standalone `generate.validation` command.** Validation is no longer scaffolded on its own — each controller carries its own schema (imported from `schema/` and bound via `controller.validation`). Generate the controller with `--with-validation` to get the paired schema file, or hand-write the `schema/*.schema.ts`.
 - **No `requests/` folder.** Controllers import the schema's exported type + value directly from `schema/*.schema.ts`; there is no `*.request.ts` alias.
 - **Subfolder is `seeds/` (plural), not `seed/`.** The seed file is `<module>.seed.ts`.
-- **`generate.module` does not run the migration.** It only creates the migration file. Run `pnpm warlock migrate` separately to apply it.
+- **`generate.module` does not run the migration.** It only creates the migration file. Run `npx warlock migrate` separately to apply it.
 - **`models/<entity>/` is its own folder, not a flat file.** The generator puts `product.model.ts` inside `models/product/` so migrations can sit beside the model in `models/product/migrations/`.
 - **Don't import `routes.ts`, `main.ts`, or anything in `events/`.** They're auto-loaded; double-loading errors out at boot.
 - **`utils/locales.ts` is mandatory for translation keys.** Skip it and `t("products.notFound")` silently falls back to the key itself.

package/skills/hash-password/SKILL.md

@@ -148,7 +148,7 @@ The "same error for missing user vs wrong password" pattern is deliberate — it
 `hashPassword` / `verifyPassword` need `bcryptjs`. Install it directly:
 
 ```bash
-pnpm add bcryptjs
+npm install bcryptjs
 ```
 
 If you skip the install, the first call throws with the framework's install hint:
@@ -157,14 +157,14 @@ If you skip the install, the first call throws with the framework's install hint
 Password encryption requires the bcryptjs package.
 Install it with:
 
-  pnpm add bcryptjs
+  npm install bcryptjs
 
 Or with your preferred package manager:
 
-  pnpm add bcryptjs
+  npm install bcryptjs
 ```
 
-There is no `warlock add` feature for password hashing — `bcryptjs` is a plain dependency, so install it directly with `pnpm add bcryptjs`.
+There is no `warlock add` feature for password hashing — `bcryptjs` is a plain dependency, so install it directly with `npm install bcryptjs`.
 
 ## Gotchas
 

package/skills/run-app/SKILL.md

@@ -11,13 +11,13 @@ Three commands move the app through its lifecycle: `dev` while you're editing, `
 
 ```bash
 # Local development
-pnpm warlock dev
+npx warlock dev
 
 # Production build
-pnpm warlock build
+npx warlock build
 
 # Run the built bundle
-pnpm warlock start
+npx warlock start
 ```
 
 `dev` and `start` are **persistent** (long-running, no auto-exit). `build` is one-shot — it exits when the bundle is written.
@@ -234,9 +234,9 @@ The three cases that reach it are: never built; a build that failed before promo
 ### Behavior
 
 ```bash
-pnpm warlock start                        # → spawns node --enable-source-maps dist/app.js
-pnpm warlock start --inspect              # → spawns node --enable-source-maps --inspect dist/app.js
-pnpm warlock start --max-old-space-size=4096  # → spawns node --enable-source-maps --max-old-space-size=4096 dist/app.js
+npx warlock start                        # → spawns node --enable-source-maps dist/app.js
+npx warlock start --inspect              # → spawns node --enable-source-maps --inspect dist/app.js
+npx warlock start --max-old-space-size=4096  # → spawns node --enable-source-maps --max-old-space-size=4096 dist/app.js
 ```
 
 Everything you pass after `start` is forwarded to the spawned Node process. Use this to attach a debugger (`--inspect`), tune memory (`--max-old-space-size`), or pass any other Node flag without editing the command.
@@ -288,7 +288,7 @@ The started banner prints **only** when the running application reports a comple
 
 ```bash
 # a CI gate can be this blunt, and it is now correct
-pnpm warlock start | grep -q "production server started"
+npx warlock start | grep -q "production server started"
 ```
 
 ### Reading a failed start (5.2)
@@ -371,17 +371,17 @@ If you need conditional behavior, branch on `Application.environment` (the ortho
 }
 ```
 
-Now `pnpm dev` / `pnpm build` / `pnpm start`. Standard Node hosting providers (Render, Fly, Railway, Heroku) recognize this layout.
+Now `npm run dev` / `npm run build` / `npm run start`. Standard Node hosting providers (Render, Fly, Railway, Heroku) recognize this layout.
 
 ### Production Dockerfile
 
 ```dockerfile
 FROM node:20-alpine AS build
 WORKDIR /app
-COPY package.json yarn.lock ./
-RUN pnpm install --frozen-lockfile
+COPY package.json package-lock.json ./
+RUN npm ci
 COPY . .
-RUN pnpm warlock build
+RUN npx warlock build
 
 FROM node:20-alpine
 WORKDIR /app
@@ -390,7 +390,7 @@ COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/package.json ./
 COPY --from=build /app/warlock.config.ts ./
 ENV NODE_ENV=production
-CMD ["yarn", "warlock", "start"]
+CMD ["npx", "warlock", "start"]
 ```
 
 Two-stage build trims `devDependencies` out of the runtime image. Keep `warlock.config.ts` in the runtime stage — `start` reads it to resolve the bundle path.
@@ -425,7 +425,7 @@ That is deliberate: `build` and `start` do **not** force `production`. Forcing i
 ### Skip type-gen on machines without write access
 
 ```bash
-pnpm warlock dev --skip-typings
+npx warlock dev --skip-typings
 ```
 
 Or persist it:
@@ -443,20 +443,20 @@ Useful in a containerized dev environment where `.warlock/typings.d.ts` is read-
 ### Memory-tune the production process
 
 ```bash
-pnpm warlock start --max-old-space-size=4096
+npx warlock start --max-old-space-size=4096
 ```
 
 Or via `NODE_OPTIONS` in the deployment env if you don't want to change the start invocation:
 
 ```bash
-NODE_OPTIONS=--max-old-space-size=4096 pnpm warlock start
+NODE_OPTIONS=--max-old-space-size=4096 npx warlock start
 ```
 
 ## Gotchas
 
 - **`warlock dev` is persistent — `Ctrl+C` to stop.** The framework's `persistent: true` flag keeps the process alive after `action` returns. Same for `start`.
 - **`--fresh` only deletes the manifest, not the transpile cache.** If you're chasing a stale-compile bug, `rm -rf .warlock/` clears everything. The manifest restoring is what `--fresh` solves.
-- **`warlock build` does NOT run migrations.** Production bundles ship the migration files but don't apply them. Run `pnpm warlock migrate` against the production DB separately.
+- **`warlock build` does NOT run migrations.** Production bundles ship the migration files but don't apply them. Run `npx warlock migrate` against the production DB separately.
 - **`warlock start` requires a build it can vouch for.** Since 5.2 it refuses any `outdir` without the `.warlock-build.json` success marker — a hand-assembled `dist/`, or one left behind by a build that failed, is rejected by that reason instead of being spawned and crashing halfway through boot. Run `warlock build` first.
 - **Do not add `.warlock-build.json` to `.gitignore`-driven artifact pruning.** Stripping it from a `dist/` you ship makes `warlock start` refuse the artifact on the target host. Copy `outdir` whole.
 - **`outdir` is the directory, `outFile` is the filename within it.** A common mistake is putting the full path in one and leaving the other default — you end up with `<full-path>/app.js` or `dist/<full-path>`. They concatenate.

package/skills/send-mail/SKILL.md

@@ -85,7 +85,7 @@ const config: MailConfigurations = {
 };
 ```
 
-Requires `@aws-sdk/client-sesv2` installed (`pnpm add @aws-sdk/client-sesv2`).
+Requires `@aws-sdk/client-sesv2` installed (`npm install @aws-sdk/client-sesv2`).
 
 ## Mail modes
 
@@ -361,7 +361,7 @@ await Mail.to(user.email)
 
 - **`.send()` validates** — `to`, `subject`, and at least one of `text`/`html`/`component` are required. Missing any throws synchronously.
 - **`@react-email/render` is optional.** Without it you get the basic fallback (inline styles, no MSO conditionals). Install it for production-quality HTML.
-- **`nodemailer` is loaded lazily** at import time. If you see `nodemailer is not installed` errors, run `warlock add mail` (or `pnpm add nodemailer`).
+- **`nodemailer` is loaded lazily** at import time. If you see `nodemailer is not installed` errors, run `warlock add mail` (or `npm install nodemailer`).
 - **`secure: true` requires port 465.** For port 587 use `secure: false` and `tls: true` (STARTTLS).
 - **Test mode is process-global.** Set it in `beforeAll`/`beforeEach`; reset with `setMailMode("production")` (or rely on test runner isolation).
 - **Per-mail handlers don't replace global ones** — both fire. Avoid double-counting metrics.

package/skills/use-model-transformers/SKILL.md

@@ -60,7 +60,7 @@ What it does at save time:
 | Existing row, password unchanged | Pass through (no re-hashing — stored hash preserved). |
 | Empty / undefined value         | Pass through untouched.                     |
 
-Calls `authService.hashPassword(String(value))` under the hood — same bcryptjs path as the standalone `hashPassword()` helper. See [`hash-password/SKILL.md`](../hash-password/SKILL.md) for full bcrypt setup (salt rounds, `pnpm add bcryptjs`).
+Calls `authService.hashPassword(String(value))` under the hood — same bcryptjs path as the standalone `hashPassword()` helper. See [`hash-password/SKILL.md`](../hash-password/SKILL.md) for full bcrypt setup (salt rounds, `npm install bcryptjs`).
 
 ### Why declarative wins
 
@@ -214,7 +214,7 @@ Rule of thumb: transformers are for **pure, deterministic** transforms of the ro
 
 ## See also
 
-- [`hash-password/SKILL.md`](../hash-password/SKILL.md) — the bcrypt setup that `useHashedPassword` calls under the hood; salt rounds, `pnpm add bcryptjs`.
+- [`hash-password/SKILL.md`](../hash-password/SKILL.md) — the bcrypt setup that `useHashedPassword` calls under the hood; salt rounds, `npm install bcryptjs`.
 - [`use-repository/SKILL.md`](../use-repository/SKILL.md) — where `create` / `save` calls happen that trigger the transformers.
 - [`define-resource/SKILL.md`](../define-resource/SKILL.md) — filtering transformed fields (`password`) out of API responses.
 - [`warlock-conventions/SKILL.md`](../warlock-conventions/SKILL.md) — schema files live in `src/app/<module>/models/<entity>/<entity>.model.ts`.

package/skills/use-repository/SKILL.md

@@ -53,7 +53,7 @@ Five lines do the heavy lifting:
 4. **`defaultOptions`** — applied to every call (`orderBy`, default `limit`, etc.).
 5. **`new FaqsRepository()`** singleton — import this everywhere; never instantiate again.
 
-The class is intentionally private — only the singleton escapes the module. Scaffold with `pnpm warlock generate.repository <module>/<entity>`.
+The class is intentionally private — only the singleton escapes the module. Scaffold with `npx warlock generate.repository <module>/<entity>`.
 
 ## The `filterBy` rules
 

package/skills/validate-input/SKILL.md

@@ -47,7 +47,7 @@ Two pieces, always:
 
 No separate `*.request.ts` alias file. `RequestHandler<Request<TSchema>>` types `request.validated()` directly off the schema's inferred type.
 
-Scaffold with `pnpm warlock generate.controller <module>/<action> --with-validation`. If the scaffolder emits a `requests/<action>.request.ts` file, delete it — the inline pattern is the convention.
+Scaffold with `npx warlock generate.controller <module>/<action> --with-validation`. If the scaffolder emits a `requests/<action>.request.ts` file, delete it — the inline pattern is the convention.
 
 ## The `v.*` factory surface
 

package/skills/warlock-doctor/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: warlock-doctor
-description: 'Run `warlock doctor` — a read-only diagnostics command that checks routes / config / connectors / optional-peers / health endpoints / release hygiene and prints a pass/warn/fail report, exiting non-zero on any failure. Add your own probe with the `DoctorCheck` contract and `runChecks` / `formatReportLines`. Triggers: `warlock doctor`, `doctorCommand`, `DoctorCheck`, `CheckResult`, `CheckStatus`, `DoctorReport`, `runChecks`, `formatReportLines`, `printReport`, `defaultDoctorChecks`; "diagnose my app", "preflight / preflight check", "is the app healthy", "why are there 0 routes", "pre-release sanity check", "CI smoke check"; run as `pnpm warlock doctor`. Skip: the live `/health` + `/ready` HTTP probes — `@warlock.js/core/health-checks/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; releasing the package — `releasing-warlock-monorepo`; competing tools `npm doctor`, `nest info`, hand-rolled preflight scripts.'
+description: 'Run `warlock doctor` — a read-only diagnostics command that checks routes / config / connectors / optional-peers / health endpoints / release hygiene and prints a pass/warn/fail report, exiting non-zero on any failure. Add your own probe with the `DoctorCheck` contract and `runChecks` / `formatReportLines`. Triggers: `warlock doctor`, `doctorCommand`, `DoctorCheck`, `CheckResult`, `CheckStatus`, `DoctorReport`, `runChecks`, `formatReportLines`, `printReport`, `defaultDoctorChecks`; "diagnose my app", "preflight / preflight check", "is the app healthy", "why are there 0 routes", "pre-release sanity check", "CI smoke check"; run as `npx warlock doctor`. Skip: the live `/health` + `/ready` HTTP probes — `@warlock.js/core/health-checks/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; releasing the package — `releasing-warlock-monorepo`; competing tools `npm doctor`, `nest info`, hand-rolled preflight scripts.'
 ---
 
 # Warlock — `warlock doctor`
@@ -8,7 +8,7 @@ description: 'Run `warlock doctor` — a read-only diagnostics command that chec
 `warlock doctor` is a read-only preflight. It boots the app far enough to introspect it — loads every config file and bootstrap code so routes and connectors register — but **starts no connectors**, so it never opens a database, cache, or socket connection. It then runs a set of checks and prints a grouped pass / warn / fail report.
 
 ```bash
-pnpm warlock doctor
+npx warlock doctor
 ```
 
 ```
@@ -111,7 +111,7 @@ if (report.hasFailures) process.exit(report.exitCode);
 ### CI / pre-release gate
 
 ```bash
-pnpm warlock doctor || exit 1   # non-zero exit fails the job
+npx warlock doctor || exit 1   # non-zero exit fails the job
 ```
 
 A red `release-hygiene` line catches the classic "bumped `package.json` but forgot the CHANGELOG heading" mistake before a publish.

package/skills/warlock-routes/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: warlock-routes
-description: 'Run `warlock routes` — a read-only command that lists the registered HTTP routes as a verb-colored table (method / path / name / action / middleware-count / source), a sibling of `warlock doctor`. Filter with `--method` / `--path` / `--name`, or emit normalized rows as JSON with `--json`. Also covers `warlock routes:diff`, which compares live page routes against the last `warlock build`''s route snapshot and exits non-zero on drift. Triggers: `warlock routes`, `routesCommand`, `warlock routes:diff`, `routesDiffCommand`, "list my routes", "show all routes", "route table", "what endpoints does my app expose", "dump routes as JSON", "which routes have middleware", "route map for CI", "did my page routes drift from the last build"; run as `pnpm warlock routes` / `pnpm warlock routes:diff`. Skip: read-only health/preflight checks — `@warlock.js/core/warlock-doctor/SKILL.md`; defining/naming/grouping routes — `@warlock.js/core/register-route/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; competing tools `nest`/`express` route listers, `php artisan route:list`.'
+description: 'Run `warlock routes` — a read-only command that lists the registered HTTP routes as a verb-colored table (method / path / name / action / middleware-count / source), a sibling of `warlock doctor`. Filter with `--method` / `--path` / `--name`, or emit normalized rows as JSON with `--json`. Also covers `warlock routes:diff`, which compares live page routes against the last `warlock build`''s route snapshot and exits non-zero on drift. Triggers: `warlock routes`, `routesCommand`, `warlock routes:diff`, `routesDiffCommand`, "list my routes", "show all routes", "route table", "what endpoints does my app expose", "dump routes as JSON", "which routes have middleware", "route map for CI", "did my page routes drift from the last build"; run as `npx warlock routes` / `npx warlock routes:diff`. Skip: read-only health/preflight checks — `@warlock.js/core/warlock-doctor/SKILL.md`; defining/naming/grouping routes — `@warlock.js/core/register-route/SKILL.md`; authoring a general CLI command — `@warlock.js/core/write-cli-command/SKILL.md`; competing tools `nest`/`express` route listers, `php artisan route:list`.'
 ---
 
 # Warlock — `warlock routes`
@@ -8,7 +8,7 @@ description: 'Run `warlock routes` — a read-only command that lists the regist
 `warlock routes` lists every registered HTTP route as a table. It's the read-only sibling of [`warlock doctor`](../warlock-doctor/SKILL.md): it boots the app far enough to register route modules — but **starts no connectors**, so it never opens a database, cache, or socket connection.
 
 ```bash
-pnpm warlock routes
+npx warlock routes
 ```
 
 ```
@@ -39,10 +39,10 @@ The `METHOD` column is verb-colored (GET green, POST blue, PUT/PATCH yellow, DEL
 Optional, case-insensitive, AND-combined:
 
 ```bash
-pnpm warlock routes --method GET     # -m  exact HTTP method
-pnpm warlock routes --path /users    # -p  path substring
-pnpm warlock routes --name users     # -n  route-name substring
-pnpm warlock routes -m POST -p /users
+npx warlock routes --method GET     # -m  exact HTTP method
+npx warlock routes --path /users    # -p  path substring
+npx warlock routes --name users     # -n  route-name substring
+npx warlock routes -m POST -p /users
 ```
 
 ## JSON output
@@ -50,7 +50,7 @@ pnpm warlock routes -m POST -p /users
 `--json` (`-j`) emits the normalized rows instead of the table — for `jq`, a CI diff, or a generated API map. Filters apply before serialization.
 
 ```bash
-pnpm warlock routes --json
+npx warlock routes --json
 ```
 
 ```json
@@ -64,7 +64,7 @@ pnpm warlock routes --json
 ### Audit which routes are guarded
 
 ```bash
-pnpm warlock routes --json | jq '[.[] | select(.middleware == 0)]'
+npx warlock routes --json | jq '[.[] | select(.middleware == 0)]'
 ```
 
 Surfaces public routes (no middleware) — a quick check that auth-protected paths actually carry a guard.
@@ -72,7 +72,7 @@ Surfaces public routes (no middleware) — a quick check that auth-protected pat
 ### Confirm a route registered
 
 ```bash
-pnpm warlock routes --name users.create
+npx warlock routes --name users.create
 ```
 
 An empty result means the route isn't registered — re-run `warlock dev` and read the boot error (the route-module loader is fail-loud, so a throwing route file aborts boot rather than being silently dropped).
@@ -82,7 +82,7 @@ An empty result means the route isn't registered — re-run `warlock dev` and re
 Compares the **live dev-server page routes** (`router.list().filter(r => r.isPage)`) against a **snapshot written by the last successful `warlock build`** (`page-routes.manifest.json` in `resolveBuildConfig().outdir`, e.g. `dist/page-routes.manifest.json`). Boots the same diagnostic way as `warlock routes` — route modules registered, no connectors started — then diffs.
 
 ```bash
-pnpm warlock routes:diff
+npx warlock routes:diff
 ```
 
 ```

package/skills/write-cli-command/SKILL.md

@@ -39,7 +39,7 @@ export default command({
 });
 ```
 
-Run it: `pnpm warlock users.promote --email=hasan@example.com` (or `pnpm warlock up -e hasan@example.com`).
+Run it: `npx warlock users.promote --email=hasan@example.com` (or `npx warlock up -e hasan@example.com`).
 
 ## `CLICommandOptions` — the factory input
 

package/skills/write-seeder/SKILL.md

@@ -36,12 +36,12 @@ export default seeder({
 Run them:
 
 ```bash
-pnpm warlock seed                            # discover + run all
-pnpm warlock seed --list                     # show registry, don't run
-pnpm warlock seed --path=src/app/roles/seeds/default-roles.seed.ts  # one file
-pnpm warlock seed --fresh                    # truncate every table first, then run all
-pnpm warlock seed --drop                     # undo every tracked record, reset the log
-pnpm warlock seed --drop=default-roles       # undo just one seeder's records
+npx warlock seed                            # discover + run all
+npx warlock seed --list                     # show registry, don't run
+npx warlock seed --path=src/app/roles/seeds/default-roles.seed.ts  # one file
+npx warlock seed --fresh                    # truncate every table first, then run all
+npx warlock seed --drop                     # undo every tracked record, reset the log
+npx warlock seed --drop=default-roles       # undo just one seeder's records
 ```
 
 `--fresh` truncates **every** table in the DB (`datasource.driver.truncateTable(table, { cascade: true })`), including the `seeds` tracking table. After `--fresh`, `once: true` seeds will run again.
@@ -179,8 +179,8 @@ Every record you `track()` is written to a `seed_records` table (created on firs
 `warlock seed --drop` reads those refs and undoes the seed:
 
 ```bash
-pnpm warlock seed --drop                # undo every tracked record across all seeders
-pnpm warlock seed --drop=default-roles  # undo just one seeder's records
+npx warlock seed --drop                # undo every tracked record across all seeders
+npx warlock seed --drop=default-roles  # undo just one seeder's records
 ```
 
 What it does, inside a single transaction: