create-bestax 4.2.18 → 4.3.0

package/README.md

@@ -44,9 +44,10 @@ You'll be asked to:
 1. Enter a project name or path (and, if that directory already holds files, confirm removing
    them; nothing is removed until you have answered the last question)
 2. Select a framework (Vite or Vite + TypeScript)
-3. Choose a Bulma CSS flavor (the `--bulma` options below)
-4. Select an icon library (Font Awesome, Material Icons, etc.)
-5. Choose whether to install the bestax AI skills into `.claude/skills/`
+3. Choose a linter (Oxlint or ESLint)
+4. Choose a Bulma CSS flavor (the `--bulma` options below)
+5. Select an icon library (Font Awesome, Material Icons, etc.)
+6. Choose whether to install the bestax AI skills into `.claude/skills/`
 
 Every prompt has a flag equivalent, so the whole flow is scriptable and CI-friendly — see the options below.
 
@@ -73,6 +74,11 @@ with or without it.
 
 - `-t, --template <template>` - Template to use: `vite` or `vite-ts`  
   **Default:** `vite`
+- `--lint <linter>` - Linter:
+  - `oxlint` - Oxlint, as `npm create vite` sets up. `vite-ts` gets TypeScript 7.
+  - `eslint` - ESLint with typescript-eslint, as `npm create vite -- --eslint` sets up.
+    typescript-eslint doesn't support TypeScript 7 yet, so `vite-ts` stays on TypeScript 6.  
+    **Default:** `oxlint`, which a run without a terminal also gets when it leaves `--lint` out
 - `-b, --bulma <flavor>` - Bulma CSS flavor:
   - `complete` - Full Bulma CSS with all components and helpers
   - `prefixed` - Prefixed version for compatibility
@@ -94,6 +100,7 @@ with or without it.
 - `-y, --yes` - Skip prompts and use defaults or provided options.  
   When used, the following defaults are selected unless overridden by flags:
   - Template: `vite`
+  - Linter: `oxlint`
   - Bulma flavor: `complete`
   - Icon library: `none`
   - AI skills: installed (pass `--no-skills` to opt out)
@@ -112,6 +119,9 @@ with or without it.
 # Create a TypeScript project with Font Awesome icons
 npm create bestax@latest my-app -- -t vite-ts -i fontawesome -b complete
 
+# The same, linted with ESLint (and on TypeScript 6)
+npm create bestax@latest my-app -- -t vite-ts -i fontawesome --lint eslint
+
 # Use all defaults (skip prompts)
 npm create bestax@latest my-app -- -y
 

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EACL,cAAc,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGzE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,cAAc,IAAI,cAAc,EAChC,iBAAiB,IAAI,iBAAiB,EACtC,iBAAiB,IAAI,iBAAiB,GACvC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,wBAAsB,cAAc,CAClC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAGhC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,aAAa,CACjC,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,IAAI,CAAC,CAGf;AAcD,wBAAgB,SAAS,IAAI,OAAO,CAyCnC;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAKxE;AAED,wBAAsB,MAAM,CAC1B,IAAI,GAAE,SAAS,MAAM,EAAiB,GACrC,OAAO,CAAC,IAAI,CAAC,CAGf"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EACL,cAAc,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGzE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,cAAc,IAAI,cAAc,EAChC,iBAAiB,IAAI,iBAAiB,EACtC,iBAAiB,IAAI,iBAAiB,GACvC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,wBAAsB,cAAc,CAClC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAGhC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,aAAa,CACjC,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,IAAI,CAAC,CAGf;AAcD,wBAAgB,SAAS,IAAI,OAAO,CA0CnC;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAKxE;AAED,wBAAsB,MAAM,CAC1B,IAAI,GAAE,SAAS,MAAM,EAAiB,GACrC,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/cli.js

@@ -55,6 +55,7 @@ export function createCLI() {
         .version(getPackageVersion())
         .argument('[project-directory]', 'project directory to create, a name or a path (its last part names the package)')
         .option('-t, --template <template>', 'template to use (vite, vite-ts)')
+        .option('--lint <linter>', 'linter (oxlint, eslint)')
         .option('-b, --bulma <flavor>', 'Bulma CSS flavor (complete, prefixed, no-helpers, no-helpers-prefixed, no-dark-mode)')
         .option('-i, --icon <library>', 'icon library (none, fontawesome, mdi, ionicons, material-icons, material-symbols)')
         .option('--skills', 'install the bestax AI skills into .claude/skills')

package/dist/constants.d.ts

@@ -40,6 +40,7 @@ export declare const LAUNCH_JSON: string;
 export declare const PROMPTS: {
     readonly PROJECT_NAME: "Project name:";
     readonly SELECT_FRAMEWORK: "Select a framework:";
+    readonly SELECT_LINTER: "Which linter would you like to use?";
     readonly SELECT_ICON_LIBRARY: "Would you like to add an icon library?";
     readonly SELECT_BULMA_FLAVOR: "Which Bulma CSS flavor would you like to use?";
     readonly INSTALL_SKILLS: "Install the bestax AI skills (.claude/skills) for Claude Code and other agents?";
@@ -71,6 +72,17 @@ export interface BulmaFlavor {
     noHelpers?: boolean;
 }
 export declare const BULMA_FLAVORS: BulmaFlavor[];
+export interface Linter {
+    name: string;
+    display: string;
+    description: string;
+    color: typeof chalk.yellow;
+}
+export declare const LINTERS: Linter[];
+export declare const ESLINT_DEV_DEPENDENCIES: Record<string, string>;
+export declare const ESLINT_TYPESCRIPT_DEV_DEPENDENCIES: Record<string, string>;
+/** The eslint.config.js create-vite's `--eslint` writes. */
+export declare const ESLINT_CONFIG: (typescript: boolean) => string;
 export declare const CSS_ORDER_COMMENT: string;
 export interface StarterClass {
     prop: string;

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,SAAS,EAAE,QAAQ,EAG/B,CAAC;AAEF,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AACpD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AAGtD,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAOpC,eAAO,MAAM,QAAQ;;;;;;+CASe,MAAM,QAAQ,MAAM;6CAEtB,MAAM;;;wCAQX,MAAM,WAAW,MAAM,EAAE;oCAE7B,MAAM;wCAIF,MAAM;gDAKE,MAAM,WAAW,MAAM,EAAE;uCAIlC,MAAM;sCACP,MAAM;4CAEA,MAAM;;;;;wCAMV,MAAM,mBAAmB,MAAM;;;;;CAclD,CAAC;AASX,eAAO,MAAM,WAAW,QAed,CAAC;AAEX,eAAO,MAAM,OAAO;;;;;;;CAQV,CAAC;AAOX,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK9D,CAAC;AAKF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAkCD,eAAO,MAAM,SAAS,GACpB,aAAa,MAAM,EACnB,8BAA8B,eAAe,KAC5C,MA8HF,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,EA8DvC,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,eAAO,MAAM,aAAa,EAAE,WAAW,EA8CtC,CAAC;AAKF,eAAO,MAAM,iBAAiB,QAE+B,CAAC;AAE9D,MAAM,WAAW,YAAY;IAE3B,IAAI,EAAE,MAAM,CAAC;IAEb,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD,eAAO,MAAM,0BAA0B,EAAE,YAAY,EAgBpD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAMjB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,SAAS,EAAE,QAAQ,EAG/B,CAAC;AAEF,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AACpD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AAGtD,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAOpC,eAAO,MAAM,QAAQ;;;;;;+CASe,MAAM,QAAQ,MAAM;6CAEtB,MAAM;;;wCAQX,MAAM,WAAW,MAAM,EAAE;oCAE7B,MAAM;wCAIF,MAAM;gDAKE,MAAM,WAAW,MAAM,EAAE;uCAIlC,MAAM;sCACP,MAAM;4CAEA,MAAM;;;;;wCAMV,MAAM,mBAAmB,MAAM;;;;;CAclD,CAAC;AASX,eAAO,MAAM,WAAW,QAed,CAAC;AAEX,eAAO,MAAM,OAAO;;;;;;;;CASV,CAAC;AAOX,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK9D,CAAC;AAKF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAkCD,eAAO,MAAM,SAAS,GACpB,aAAa,MAAM,EACnB,8BAA8B,eAAe,KAC5C,MA8HF,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,EA8DvC,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,eAAO,MAAM,aAAa,EAAE,WAAW,EA8CtC,CAAC;AAEF,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;CAC5B;AAKD,eAAO,MAAM,OAAO,EAAE,MAAM,EAe3B,CAAC;AAIF,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAM1D,CAAC;AAKF,eAAO,MAAM,kCAAkC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGrE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,aAAa,GAAI,YAAY,OAAO,KAAG,MA8BtC,CAAC;AAQf,eAAO,MAAM,iBAAiB,QAEiC,CAAC;AAEhE,MAAM,WAAW,YAAY;IAE3B,IAAI,EAAE,MAAM,CAAC;IAEb,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD,eAAO,MAAM,0BAA0B,EAAE,YAAY,EAgBpD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAMjB,CAAC"}

package/dist/constants.js

@@ -76,6 +76,7 @@ export const LAUNCH_JSON = JSON.stringify({
 export const PROMPTS = {
     PROJECT_NAME: 'Project name:',
     SELECT_FRAMEWORK: 'Select a framework:',
+    SELECT_LINTER: 'Which linter would you like to use?',
     SELECT_ICON_LIBRARY: 'Would you like to add an icon library?',
     SELECT_BULMA_FLAVOR: 'Which Bulma CSS flavor would you like to use?',
     INSTALL_SKILLS: 'Install the bestax AI skills (.claude/skills) for Claude Code and other agents?',
@@ -345,11 +346,78 @@ export const BULMA_FLAVORS = [
         importStatement: "import '@allxsmith/bestax-bulma/versions/bestax-no-dark-mode.css';",
     },
 ];
+// The templates ship create-vite's default lint setup, Oxlint, and the
+// scaffolder writes create-vite's `--eslint` setup in its place for ESLint
+// (ProjectCreator.setupLinter).
+export const LINTERS = [
+    {
+        name: 'oxlint',
+        display: 'Oxlint (Recommended)',
+        description: "create-vite's default, and TypeScript 7 for Vite + TypeScript",
+        color: chalk.green,
+    },
+    {
+        name: 'eslint',
+        display: 'ESLint',
+        description: 'with typescript-eslint, which keeps Vite + TypeScript on TypeScript 6',
+        color: chalk.blue,
+    },
+];
+// The packages create-vite's `--eslint` puts in place of oxlint. When
+// create-vite moves them, these follow (create-bestax/CLAUDE.md).
+export const ESLINT_DEV_DEPENDENCIES = {
+    '@eslint/js': '^10.0.1',
+    eslint: '^10.13.0',
+    'eslint-plugin-react-hooks': '^7.1.1',
+    'eslint-plugin-react-refresh': '^0.5.7',
+    globals: '^17.13.0',
+};
+// What `--eslint` adds for a TypeScript app. typescript-eslint loads
+// TypeScript's compiler API, which TypeScript 7.0 doesn't ship, and accepts
+// TypeScript below 6.1 only, so the app stays on TypeScript 6 (#394).
+export const ESLINT_TYPESCRIPT_DEV_DEPENDENCIES = {
+    typescript: '~6.0.3',
+    'typescript-eslint': '^8.72.0',
+};
+/** The eslint.config.js create-vite's `--eslint` writes. */
+export const ESLINT_CONFIG = (typescript) => [
+    "import js from '@eslint/js';",
+    "import globals from 'globals';",
+    "import reactHooks from 'eslint-plugin-react-hooks';",
+    "import reactRefresh from 'eslint-plugin-react-refresh';",
+    ...(typescript ? ["import tseslint from 'typescript-eslint';"] : []),
+    "import { defineConfig, globalIgnores } from 'eslint/config';",
+    '',
+    'export default defineConfig([',
+    "  globalIgnores(['dist']),",
+    '  {',
+    typescript
+        ? "    files: ['**/*.{ts,tsx}'],"
+        : "    files: ['**/*.{js,jsx}'],",
+    '    extends: [',
+    '      js.configs.recommended,',
+    ...(typescript ? ['      tseslint.configs.recommended,'] : []),
+    '      reactHooks.configs.flat.recommended,',
+    '      reactRefresh.configs.vite,',
+    '    ],',
+    '    languageOptions: {',
+    '      globals: globals.browser,',
+    ...(typescript
+        ? []
+        : ['      parserOptions: { ecmaFeatures: { jsx: true } },']),
+    '    },',
+    '  },',
+    ']);',
+    '',
+].join('\n');
 // Sits above the stylesheet import in the templates' entry files, and the
 // scaffolder writes it back when it swaps in a flavor's stylesheet, so the
 // reason for the import order survives. The no-helpers classes depend on it.
+// It names src/index.css, the app's global stylesheet, rather than the starter
+// page's src/App.css, which loads after bestax's too but goes when a port
+// replaces the page (#1240).
 export const CSS_ORDER_COMMENT = "// Bestax's stylesheet loads before the app's own CSS, so a named class in\n" +
-    '// src/App.css wins over a Bulma rule of the same weight.';
+    '// src/index.css wins over a Bulma rule of the same weight.';
 // Every helper prop the starter App uses, with the named class that stands in
 // for it under a `noHelpers` flavor, where the prop would render nothing. The
 // scaffolder swaps each prop for its class and writes the rules into

package/dist/file-system.d.ts

@@ -25,5 +25,9 @@ export declare function ensureDirectory(targetPath: string): Promise<void>;
 export declare function copyDirectory(source: string, destination: string, renames?: Record<string, string>): Promise<void>;
 export declare function readJsonFile<T = unknown>(filePath: string): Promise<T>;
 export declare function writeJsonFile(filePath: string, data: unknown, spaces?: number): Promise<void>;
-export declare function updatePackageJson(targetPath: string, projectName: string): Promise<void>;
+/**
+ * Names the copied app's package and sets the given dependencies' ranges. One
+ * the template already lists keeps its place among the others.
+ */
+export declare function updatePackageJson(targetPath: string, projectName: string, dependencies?: Record<string, string>): Promise<void>;
 //# sourceMappingURL=file-system.d.ts.map

package/dist/file-system.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-system.d.ts","sourceRoot":"","sources":["../src/file-system.ts"],"names":[],"mappings":"AAIA,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM3E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMlE;AAED,4EAA4E;AAC5E,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAE5E;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,SAAI,GACT,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAQf"}
+{"version":3,"file":"file-system.d.ts","sourceRoot":"","sources":["../src/file-system.ts"],"names":[],"mappings":"AAIA,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM3E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMlE;AAED,4EAA4E;AAC5E,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAE5E;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,SAAI,GACT,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACxC,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/file-system.js

@@ -90,11 +90,21 @@ export async function readJsonFile(filePath) {
 export async function writeJsonFile(filePath, data, spaces = 2) {
     await fs.writeJson(filePath, data, { spaces });
 }
-export async function updatePackageJson(targetPath, projectName) {
+/**
+ * Names the copied app's package and sets the given dependencies' ranges. One
+ * the template already lists keeps its place among the others.
+ */
+export async function updatePackageJson(targetPath, projectName, dependencies = {}) {
     const packageJsonPath = path.join(targetPath, 'package.json');
     if (fs.existsSync(packageJsonPath)) {
         const packageJson = await fs.readJson(packageJsonPath);
         packageJson.name = projectName;
+        if (Object.keys(dependencies).length > 0) {
+            packageJson.dependencies = {
+                ...packageJson.dependencies,
+                ...dependencies,
+            };
+        }
         await fs.writeJson(packageJsonPath, packageJson, { spaces: 2 });
     }
 }

package/dist/library-range.d.ts

@@ -0,0 +1,16 @@
+/** The library every template is built on. */
+export declare const LIBRARY = "@allxsmith/bestax-bulma";
+/**
+ * The range a scaffolded app gives @allxsmith/bestax-bulma: the one this
+ * CLI's own manifest declares, so the app is floored at the release the CLI
+ * was built with (#1240). The manifest spells it `workspace:^`, which
+ * `pnpm publish` rewrites to a caret on the library's version in the checkout
+ * it packs, and CI releases bulma-ui first in the same job. A published CLI
+ * therefore reads a plain range, the one `npm create bestax` installed the
+ * library from beside it. Run from this repo, the protocol is still there,
+ * and it is resolved the way `pnpm publish` resolves it, from the version of
+ * the library the workspace links, so a scaffold made with a checkout's build
+ * gets that checkout's release.
+ */
+export declare function libraryRange(packageRoot?: string): string;
+//# sourceMappingURL=library-range.d.ts.map

package/dist/library-range.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-range.d.ts","sourceRoot":"","sources":["../src/library-range.ts"],"names":[],"mappings":"AAIA,8CAA8C;AAC9C,eAAO,MAAM,OAAO,4BAA4B,CAAC;AAqBjD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,GAAE,MAAqB,GAAG,MAAM,CAkBvE"}

package/dist/library-range.js

@@ -0,0 +1,40 @@
+import { readFileSync } from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+/** The library every template is built on. */
+export const LIBRARY = '@allxsmith/bestax-bulma';
+const WORKSPACE = 'workspace:';
+// dist/ and src/ both sit directly under the package root.
+const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+function readManifest(dir) {
+    return JSON.parse(readFileSync(path.join(dir, 'package.json'), 'utf8'));
+}
+/**
+ * The range a scaffolded app gives @allxsmith/bestax-bulma: the one this
+ * CLI's own manifest declares, so the app is floored at the release the CLI
+ * was built with (#1240). The manifest spells it `workspace:^`, which
+ * `pnpm publish` rewrites to a caret on the library's version in the checkout
+ * it packs, and CI releases bulma-ui first in the same job. A published CLI
+ * therefore reads a plain range, the one `npm create bestax` installed the
+ * library from beside it. Run from this repo, the protocol is still there,
+ * and it is resolved the way `pnpm publish` resolves it, from the version of
+ * the library the workspace links, so a scaffold made with a checkout's build
+ * gets that checkout's release.
+ */
+export function libraryRange(packageRoot = PACKAGE_ROOT) {
+    const declared = readManifest(packageRoot).dependencies?.[LIBRARY];
+    if (declared === undefined) {
+        throw new Error(`${path.join(packageRoot, 'package.json')} declares no ${LIBRARY} dependency.`);
+    }
+    if (!declared.startsWith(WORKSPACE))
+        return declared;
+    const { version } = readManifest(path.join(packageRoot, 'node_modules', LIBRARY));
+    // What pnpm publish writes for each form: `*` the version itself, `^` and
+    // `~` that operator on it, and a range as written.
+    const spec = declared.slice(WORKSPACE.length);
+    if (spec === '*')
+        return version;
+    if (spec === '^' || spec === '~')
+        return `${spec}${version}`;
+    return spec;
+}

package/dist/project-creator.d.ts

@@ -8,6 +8,7 @@ export interface ProjectConfig {
 }
 export interface CLIOptions {
     template?: string;
+    lint?: string;
     bulma?: string;
     icon?: string;
     skills?: boolean;
@@ -64,6 +65,13 @@ export declare class ProjectCreator {
      * user picked, if any.
      */
     updateReadme(targetPath: string, iconLibrary: string): Promise<void>;
+    /**
+     * The templates ship create-vite's default lint setup, Oxlint. For ESLint,
+     * write what create-vite's `--eslint` writes in its place: the config, the
+     * packages and the lint script, and for TypeScript, TypeScript 6, since
+     * typescript-eslint can't load TypeScript 7 (#394).
+     */
+    setupLinter(targetPath: string, linter: string, template: string): Promise<void>;
     setupSkills(targetPath: string, projectName: string, options: ClaudeMdOptions): Promise<void>;
     setupBulmaFlavor(targetPath: string, bulmaFlavor: string, template: string): Promise<void>;
     /**

package/dist/project-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-creator.d.ts","sourceRoot":"","sources":["../src/project-creator.ts"],"names":[],"mappings":"AA+BA,OAAO,EAWL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAYxB,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;AAEnE,qBAAa,cAAc;IACzB,OAAO,CAAC,YAAY,CAAS;gBAEjB,YAAY,CAAC,EAAE,MAAM;IAIjC;;;OAGG;IACG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAajE;;;;;;;;;;OAUG;IACG,sBAAsB,CAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,qBAAqB,CAAC;IAqCjC;;;;;;OAMG;YACW,qBAAqB;IAanC;;;OAGG;IACH,eAAe,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI;IAmBpD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAInC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjE,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAgBhB;;;;;OAKG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBpE,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC;IAqBV,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAyDhB;;;;;OAKG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAmBhB,OAAO,CAAC,WAAW;IA2BnB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAcd,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAsJV,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAmEV,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAuItE;;;;;;;;OAQG;YACW,eAAe;CA2B9B"}
+{"version":3,"file":"project-creator.d.ts","sourceRoot":"","sources":["../src/project-creator.ts"],"names":[],"mappings":"AAgCA,OAAO,EAeL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAexB,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;AAEnE,qBAAa,cAAc;IACzB,OAAO,CAAC,YAAY,CAAS;gBAEjB,YAAY,CAAC,EAAE,MAAM;IAIjC;;;OAGG;IACG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAajE;;;;;;;;;;OAUG;IACG,sBAAsB,CAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,qBAAqB,CAAC;IAqCjC;;;;;;OAMG;YACW,qBAAqB;IAanC;;;OAGG;IACH,eAAe,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI;IAwBpD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAInC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjE,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAgBhB;;;;;OAKG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1E;;;;;OAKG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAmCV,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC;IAqBV,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAyDhB;;;;;OAKG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAmBhB,OAAO,CAAC,WAAW;IA2BnB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAcd,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAsJV,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAmEV,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4JtE;;;;;;;;OAQG;YACW,eAAe;CA2B9B"}

package/dist/project-creator.js

@@ -3,18 +3,21 @@ import { fileURLToPath } from 'url';
 import chalk from 'chalk';
 import fs from 'fs-extra';
 import { checkDirectoryExists, listDirectoryEntries, findNonDirectoryInPath, realPath, emptyDirectory, ensureDirectory, copyDirectory, updatePackageJson, } from './file-system.js';
-import { promptProjectName, promptOverwriteDirectory, promptTemplate, promptIconLibrary, promptBulmaFlavor, promptInstallSkills, promptTelemetryConsent, } from './prompts.js';
+import { promptProjectName, promptOverwriteDirectory, promptTemplate, promptLinter, promptIconLibrary, promptBulmaFlavor, promptInstallSkills, promptTelemetryConsent, } from './prompts.js';
 import { reportScaffold } from './telemetry.js';
 import { displayHeader, displaySuccess, displayError, displayCancelled, } from './display.js';
 import { validateProjectDirectory, toValidPackageName } from './validators.js';
-import { MESSAGES, TEMPLATES, ICON_LIBRARIES, BULMA_FLAVORS, CLAUDE_MD, LAUNCH_JSON, CONFIG_PROVIDER_ICON_VALUES, NO_HELPERS_STARTER_CLASSES, NO_HELPERS_APP_CSS, CSS_ORDER_COMMENT, } from './constants.js';
+import { MESSAGES, TEMPLATES, ICON_LIBRARIES, BULMA_FLAVORS, LINTERS, ESLINT_CONFIG, ESLINT_DEV_DEPENDENCIES, ESLINT_TYPESCRIPT_DEV_DEPENDENCIES, CLAUDE_MD, LAUNCH_JSON, CONFIG_PROVIDER_ICON_VALUES, NO_HELPERS_STARTER_CLASSES, NO_HELPERS_APP_CSS, CSS_ORDER_COMMENT, } from './constants.js';
 import { detectPackageManager } from './package-manager.js';
+import { LIBRARY, libraryRange } from './library-range.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // npm strips literal `.gitignore` files from published tarballs, so the
 // templates track `_gitignore` instead and the scaffolder renames it back
 // on copy — otherwise published scaffolds would ship with no .gitignore.
+// The Oxlint config follows create-vite, which names it the same way.
 const TEMPLATE_RENAMES = {
     _gitignore: '.gitignore',
+    '_oxlintrc.json': '.oxlintrc.json',
 };
 export class ProjectCreator {
     templatesDir;
@@ -97,6 +100,10 @@ export class ProjectCreator {
         if (options?.template && !validTemplates.includes(options.template)) {
             return `Invalid template: ${options.template}. Valid options are: ${validTemplates.join(', ')}`;
         }
+        const validLinters = LINTERS.map(l => l.name);
+        if (options?.lint && !validLinters.includes(options.lint)) {
+            return `Invalid linter: ${options.lint}. Valid options are: ${validLinters.join(', ')}`;
+        }
         const validFlavors = BULMA_FLAVORS.map(f => f.name);
         if (options?.bulma && !validFlavors.includes(options.bulma)) {
             return `Invalid Bulma flavor: ${options.bulma}. Valid options are: ${validFlavors.join(', ')}`;
@@ -146,6 +153,37 @@ export class ProjectCreator {
         }
         await fs.writeFile(readmePath, readme);
     }
+    /**
+     * The templates ship create-vite's default lint setup, Oxlint. For ESLint,
+     * write what create-vite's `--eslint` writes in its place: the config, the
+     * packages and the lint script, and for TypeScript, TypeScript 6, since
+     * typescript-eslint can't load TypeScript 7 (#394).
+     */
+    async setupLinter(targetPath, linter, template) {
+        if (linter !== 'eslint')
+            return;
+        const isTypeScript = template.includes('-ts');
+        await fs.remove(path.join(targetPath, '.oxlintrc.json'));
+        await fs.writeFile(path.join(targetPath, 'eslint.config.js'), ESLINT_CONFIG(isTypeScript));
+        const packageJsonPath = path.join(targetPath, 'package.json');
+        if (fs.existsSync(packageJsonPath)) {
+            const packageJson = await fs.readJson(packageJsonPath);
+            const devDependencies = {
+                ...packageJson.devDependencies,
+                ...ESLINT_DEV_DEPENDENCIES,
+                ...(isTypeScript ? ESLINT_TYPESCRIPT_DEV_DEPENDENCIES : {}),
+            };
+            delete devDependencies.oxlint;
+            packageJson.devDependencies = Object.fromEntries(Object.entries(devDependencies).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+            packageJson.scripts = { ...packageJson.scripts, lint: 'eslint .' };
+            await fs.writeJson(packageJsonPath, packageJson, { spaces: 2 });
+        }
+        const readmePath = path.join(targetPath, 'README.md');
+        if (fs.existsSync(readmePath)) {
+            const readme = await fs.readFile(readmePath, 'utf8');
+            await fs.writeFile(readmePath, readme.replace(/\bOxlint\b/g, 'ESLint'));
+        }
+    }
     async setupSkills(targetPath, projectName, options) {
         const skillsSrc = path.join(this.templatesDir, 'skills');
         if (!(await checkDirectoryExists(skillsSrc))) {
@@ -465,6 +503,24 @@ export class ProjectCreator {
                 process.exit(1);
             }
         }
+        // Select linter (use option or prompt). The question is newer than the
+        // others, so a run without a terminal that answers every other one by
+        // flag takes the default here rather than stopping, as it did before the
+        // question existed (#192).
+        let linter;
+        if (options?.lint) {
+            linter = options.lint;
+        }
+        else if (options?.yes || !process.stdin.isTTY) {
+            linter = 'oxlint'; // default linter
+        }
+        else {
+            linter = await promptLinter();
+            if (linter === null) {
+                displayCancelled();
+                process.exit(1);
+            }
+        }
         // Select Bulma flavor (use option or prompt)
         let bulmaFlavor;
         if (options?.bulma) {
@@ -511,6 +567,8 @@ export class ProjectCreator {
             }
         }
         try {
+            // Read before the directory is emptied, so a failed read costs nothing.
+            const libraryDependency = { [LIBRARY]: libraryRange() };
             if (directoryPlan === 'overwrite') {
                 console.log(chalk.yellow(MESSAGES.EMPTYING_DIRECTORY(targetDir)));
                 await emptyDirectory(targetPath);
@@ -523,12 +581,13 @@ export class ProjectCreator {
                 console.log(chalk.dim(MESSAGES.PACKAGE_NAME_NORMALIZED(packageName)));
             }
             await this.copyTemplate(template, targetPath);
-            await updatePackageJson(targetPath, packageName);
+            await updatePackageJson(targetPath, packageName, libraryDependency);
             await this.updateIndexHtmlTitle(targetPath, projectName);
             await this.updateReadme(targetPath, iconLibrary);
             await this.setupBulmaFlavor(targetPath, bulmaFlavor, template);
             await this.setupIconLibrary(targetPath, iconLibrary, template);
             await this.setupConfigProvider(targetPath, bulmaFlavor, iconLibrary, template);
+            await this.setupLinter(targetPath, linter, template);
             if (installSkills) {
                 await this.setupSkills(targetPath, projectName, {
                     bulmaFlavor,

package/dist/prompts.d.ts

@@ -8,6 +8,7 @@ export declare function promptOverwriteDirectory(targetDir: string, entries: str
  */
 export declare function promptInstallSkills(): Promise<boolean | null>;
 export declare function promptTemplate(): Promise<string | null>;
+export declare function promptLinter(): Promise<string | null>;
 export declare function promptIconLibrary(): Promise<string | null>;
 /**
  * Consent for anonymous usage telemetry. Deliberately does NOT call

package/dist/prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAyBA,0EAA0E;AAC1E,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWhE;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAUnE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa7D;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAchE;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA2BtE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBhE"}
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AA0BA,0EAA0E;AAC1E,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWhE;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAUnE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa7D;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAc3D;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAchE;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA2BtE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBhE"}

package/dist/prompts.js

@@ -1,6 +1,6 @@
 import prompts from 'prompts';
 import chalk from 'chalk';
-import { TEMPLATES, DEFAULT_PROJECT_NAME, PROMPTS as PROMPT_MESSAGES, MESSAGES, ICON_LIBRARIES, BULMA_FLAVORS, } from './constants.js';
+import { TEMPLATES, DEFAULT_PROJECT_NAME, PROMPTS as PROMPT_MESSAGES, MESSAGES, ICON_LIBRARIES, BULMA_FLAVORS, LINTERS, } from './constants.js';
 import { validateProjectDirectory } from './validators.js';
 import { displayError } from './display.js';
 /**
@@ -64,6 +64,20 @@ export async function promptTemplate() {
     });
     return response.template || null;
 }
+export async function promptLinter() {
+    ensureInteractive();
+    const response = await prompts({
+        type: 'select',
+        name: 'linter',
+        message: PROMPT_MESSAGES.SELECT_LINTER,
+        choices: LINTERS.map(linter => ({
+            title: linter.color(`${linter.display} - ${linter.description}`),
+            value: linter.name,
+        })),
+        initial: 0, // Default to 'oxlint'
+    });
+    return response.linter || null;
+}
 export async function promptIconLibrary() {
     ensureInteractive();
     const response = await prompts({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-bestax",
-  "version": "4.2.18",
+  "version": "4.3.0",
   "description": "Create a new bestax-bulma project",
   "type": "module",
   "bin": {
@@ -34,26 +34,26 @@
     "url": "https://github.com/allxsmith/bestax/issues"
   },
   "dependencies": {
-    "chalk": "^6.0.0",
+    "chalk": "^6.0.1",
     "commander": "^15.0.0",
     "figures": "^6.1.0",
-    "fs-extra": "^11.4.0",
+    "fs-extra": "^11.4.1",
     "prompts": "^2.4.2",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "@allxsmith/bestax-bulma": "^5.37.0"
+    "@allxsmith/bestax-bulma": "^5.49.1"
   },
   "devDependencies": {
     "@jest/globals": "^30.0.0",
-    "@playwright/test": "^1.63.0",
+    "@playwright/test": "^1.64.1",
     "@types/fs-extra": "^11.0.4",
     "@types/jest": "^30.0.0",
-    "@types/node": "^26.6.4",
+    "@types/node": "^26.6.5",
     "@types/prompts": "^2.4.9",
     "@types/wait-on": "^5.3.4",
     "jest": "^30.2.0",
     "semver": "^7.8.5",
-    "ts-jest": "^29.4.14",
+    "ts-jest": "^29.4.15",
     "typescript": "^6.0.3",
     "wait-on": "^9.5.1"
   },
@@ -78,5 +78,5 @@
     "clean": "rimraf dist",
     "release": "npx semantic-release"
   },
-  "readme": "# create-bestax\n\n[![npm version](https://img.shields.io/npm/v/create-bestax.svg)](https://www.npmjs.com/package/create-bestax)\n[![npm downloads](https://img.shields.io/npm/dm/create-bestax.svg)](https://www.npmjs.com/package/create-bestax)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Socket Badge](https://badge.socket.dev/npm/package/create-bestax/latest)](https://socket.dev/npm/package/create-bestax/overview)\n[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/allxsmith/bestax/badge)](https://scorecard.dev/viewer/?uri=github.com/allxsmith/bestax)\n[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14361/badge)](https://www.bestpractices.dev/projects/14361)\n[![npm provenance](https://img.shields.io/badge/npm-provenance-3fb950.svg)](https://www.npmjs.com/package/create-bestax#provenance)\n[![Security policy](https://img.shields.io/badge/security-policy-blue.svg)](https://github.com/allxsmith/bestax/blob/main/SECURITY.md)\n\nThe scaffolder for [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) — spin up a Vite app pre-wired for the **Bulma v1** React component library in one command. Picks your framework (JS or TypeScript), CSS flavor, and icon library, and can drop in the bestax **AI skills** so an agent like Claude Code knows the library from the first prompt.\n\nPart of the [bestax monorepo](https://github.com/allxsmith/bestax) — see also [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) for the components themselves.\n\n## Requirements\n\n- **Node.js 22 or newer.** Node 18 and 20 are both past end-of-life. On an older runtime the\n  CLI exits immediately with an explicit upgrade message.\n- npm 10 or newer (ships with Node 22), or yarn/pnpm.\n\n## Usage\n\n### Quick Start\n\n```bash\n# Using npm\nnpm create bestax@latest my-app\n\n# Using npx\nnpx create-bestax@latest my-app\n```\n\n### Interactive Mode\n\nRunning without arguments will prompt you for all options:\n\n```bash\nnpm create bestax@latest\n```\n\nYou'll be asked to:\n\n1. Enter a project name or path (and, if that directory already holds files, confirm removing\n   them; nothing is removed until you have answered the last question)\n2. Select a framework (Vite or Vite + TypeScript)\n3. Choose a Bulma CSS flavor (the `--bulma` options below)\n4. Select an icon library (Font Awesome, Material Icons, etc.)\n5. Choose whether to install the bestax AI skills into `.claude/skills/`\n\nEvery prompt has a flag equivalent, so the whole flow is scriptable and CI-friendly — see the options below.\n\n### Command Line Options\n\n```bash\nnpm create bestax@latest [project-directory] -- [options]\n```\n\nPut the options after `--`. npm needs it to pass them on at all, and so does bun, whose\n`bun create` rejects short flags such as `-t` and `-y` itself. pnpm and Yarn 1 accept the options\nwith or without it.\n\n**Arguments:**\n\n- `[project-directory]` - Optional project directory: a name such as `my-app`, or a path,\n  absolute or relative, such as `../apps/my-app`, whose missing folders are created. Its last\n  part is the project name, held to the same rules as a bare name. It becomes the page title as\n  typed, and the `package.json` name lower-cased the way `npm init` does and without a leading\n  `_`, since npm rejects both. A path ending in `.` or `..` is refused, like a bare `.` or `..`,\n  so name the directory you want.\n\n**Options:**\n\n- `-t, --template <template>` - Template to use: `vite` or `vite-ts`  \n  **Default:** `vite`\n- `-b, --bulma <flavor>` - Bulma CSS flavor:\n  - `complete` - Full Bulma CSS with all components and helpers\n  - `prefixed` - Prefixed version for compatibility\n  - `no-helpers` - Without helper classes\n  - `no-helpers-prefixed` - Prefixed without helpers\n  - `no-dark-mode` - Without dark mode support  \n    **Default:** `complete`\n- `-i, --icon <library>` - Icon library:\n  - `none` - No icon library\n  - `fontawesome` - Font Awesome\n  - `mdi` - Material Design Icons\n  - `ionicons` - Ionicons\n  - `material-icons` - Material Icons\n  - `material-symbols` - Material Symbols  \n    **Default:** `none`\n- `--skills` / `--no-skills` - Install (or skip) the bestax AI skills into\n  `.claude/skills/` (with a `CLAUDE.md`) so a Claude Code session picks them up\n  automatically. When omitted you're prompted; with `-y` the default is to install.\n- `-y, --yes` - Skip prompts and use defaults or provided options.  \n  When used, the following defaults are selected unless overridden by flags:\n  - Template: `vite`\n  - Bulma flavor: `complete`\n  - Icon library: `none`\n  - AI skills: installed (pass `--no-skills` to opt out)\n\n  `-y` never deletes files. If the target directory is not empty, the run stops, lists what is\n  there, and changes nothing; add `--overwrite` to empty it first. Earlier versions emptied the\n  directory under `-y` alone, so a script that relied on that now needs `--overwrite`.\n\n- `--overwrite` - Remove existing files if the target directory is not empty, without asking.\n  Every other flag is checked first, so a typo stops the run before anything is deleted. It\n  never empties the current directory or a folder that holds it, however the path is written.\n\n**Example:**\n\n```bash\n# Create a TypeScript project with Font Awesome icons\nnpm create bestax@latest my-app -- -t vite-ts -i fontawesome -b complete\n\n# Use all defaults (skip prompts)\nnpm create bestax@latest my-app -- -y\n\n# Scaffold into a path; the package is named my-app\nnpm create bestax@latest ../apps/my-app -- -y\n\n# The same with bun\nbun create bestax@latest my-app -- -y\n```\n\n## Templates\n\nAvailable templates:\n\n- `vite` - Vite + JavaScript\n- `vite-ts` - Vite + TypeScript\n\nEach template includes:\n\n- Pre-configured bestax-bulma integration (React 19)\n- The latest `@allxsmith/bestax-bulma`, which ships Bulma v1 automatically\n- Icon library support (Font Awesome, Material Design, etc.)\n- Sample components demonstrating library usage\n- Development and build scripts\n\n## For AI Tools\n\nScaffolding for an AI agent? Pass `--skills` (or accept the prompt) to drop the bestax\nAgent Skills and a `CLAUDE.md` into the new project so Claude Code, Cursor, or Copilot\nbuild the bestax way from the start. The library also ships LLM-optimized docs:\n\n- [LLMs guide](https://bestax.io/docs/guides/llms) — using bestax with Claude Code, Cursor, Copilot\n- [Agent Skills](https://bestax.io/docs/skills/intro) — teach your agent the bestax conventions\n- [llms.txt](https://bestax.io/llms.txt) (curated index) · [llms-full.txt](https://bestax.io/llms-full.txt) (full docs)\n\n## Development\n\n```bash\nnpm run build    # Build the CLI\nnpm run dev      # Watch mode\nnpm test         # Run tests\nnpm run lint     # Lint CLI source code\nnpm run typecheck # Type check CLI source code\n```\n\n**Note on Templates:** Template files in `templates/` are excluded from linting. They should be manually validated by scaffolding a test project and running lint/build there before releasing.\n\n## Hardened by default\n\nA scaffolder runs with write access to your filesystem and picks your starting dependencies, so how it is built and published matters:\n\n- **Signed provenance** — every release carries a sigstore attestation linking the tarball to the exact commit and CI run that built it. Check the **Provenance** section on the [npm page](https://www.npmjs.com/package/create-bestax#provenance), or run `npm audit signatures`.\n- **npm OIDC trusted publishing** — short-lived, per-run credentials; no long-lived `NPM_TOKEN` exists to be stolen. Release commits and tags are GPG-signed.\n- **Socket.dev scans every PR** for malware, install scripts, obfuscated code, and privilege escalation before it can reach `main`.\n- **Dependencies are a deliberate act** — install scripts are blocked unless individually allow-listed, freshly published versions are refused for 3 days, and CI installs only what the reviewed lockfile resolves.\n- **Every GitHub Action is pinned to a full commit SHA**, so a compromised action release can't roll silently into a build of this CLI.\n- **CodeQL, Dependency Review, and Dependabot** run continuously, alongside a high-severity `pnpm audit` gate.\n- **Layered AI review before merge** — [CodeRabbit](https://coderabbit.ai) plus an independent adversarial Claude review (a different model from the one writing AI-authored changes), on top of required green CI, an approving review, and a human merge.\n\nFull detail: [`SECURITY.md`](https://github.com/allxsmith/bestax/blob/main/SECURITY.md) · [Security guide](https://bestax.io/docs/guides/security)\n\n## Telemetry\n\n`create-bestax` can send one **anonymous** usage event after a successful\nscaffold — only if you opt in when asked (once, at the end of a scaffold). The\nevent is just the choices you made — template, Bulma flavor, icon library,\nskills, package manager — plus the CLI version, Node major version, and OS\nplatform; never names, IPs, machine IDs, paths, or file contents, and no\nidentifier exists that could link two events together. Opt out any time with\n`--no-telemetry`, `BESTAX_TELEMETRY=0`, or `DO_NOT_TRACK=1`.\n\nFull disclosure of every field and control: [Telemetry guide](https://bestax.io/docs/guides/telemetry)\n\n## Publishing\n\nThis package uses semantic-release with scope-based rules. Only commits with `feat(create-bestax)` or `fix(create-bestax)` will trigger releases.\n"
+  "readme": "# create-bestax\n\n[![npm version](https://img.shields.io/npm/v/create-bestax.svg)](https://www.npmjs.com/package/create-bestax)\n[![npm downloads](https://img.shields.io/npm/dm/create-bestax.svg)](https://www.npmjs.com/package/create-bestax)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Socket Badge](https://badge.socket.dev/npm/package/create-bestax/latest)](https://socket.dev/npm/package/create-bestax/overview)\n[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/allxsmith/bestax/badge)](https://scorecard.dev/viewer/?uri=github.com/allxsmith/bestax)\n[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14361/badge)](https://www.bestpractices.dev/projects/14361)\n[![npm provenance](https://img.shields.io/badge/npm-provenance-3fb950.svg)](https://www.npmjs.com/package/create-bestax#provenance)\n[![Security policy](https://img.shields.io/badge/security-policy-blue.svg)](https://github.com/allxsmith/bestax/blob/main/SECURITY.md)\n\nThe scaffolder for [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) — spin up a Vite app pre-wired for the **Bulma v1** React component library in one command. Picks your framework (JS or TypeScript), CSS flavor, and icon library, and can drop in the bestax **AI skills** so an agent like Claude Code knows the library from the first prompt.\n\nPart of the [bestax monorepo](https://github.com/allxsmith/bestax) — see also [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) for the components themselves.\n\n## Requirements\n\n- **Node.js 22 or newer.** Node 18 and 20 are both past end-of-life. On an older runtime the\n  CLI exits immediately with an explicit upgrade message.\n- npm 10 or newer (ships with Node 22), or yarn/pnpm.\n\n## Usage\n\n### Quick Start\n\n```bash\n# Using npm\nnpm create bestax@latest my-app\n\n# Using npx\nnpx create-bestax@latest my-app\n```\n\n### Interactive Mode\n\nRunning without arguments will prompt you for all options:\n\n```bash\nnpm create bestax@latest\n```\n\nYou'll be asked to:\n\n1. Enter a project name or path (and, if that directory already holds files, confirm removing\n   them; nothing is removed until you have answered the last question)\n2. Select a framework (Vite or Vite + TypeScript)\n3. Choose a linter (Oxlint or ESLint)\n4. Choose a Bulma CSS flavor (the `--bulma` options below)\n5. Select an icon library (Font Awesome, Material Icons, etc.)\n6. Choose whether to install the bestax AI skills into `.claude/skills/`\n\nEvery prompt has a flag equivalent, so the whole flow is scriptable and CI-friendly — see the options below.\n\n### Command Line Options\n\n```bash\nnpm create bestax@latest [project-directory] -- [options]\n```\n\nPut the options after `--`. npm needs it to pass them on at all, and so does bun, whose\n`bun create` rejects short flags such as `-t` and `-y` itself. pnpm and Yarn 1 accept the options\nwith or without it.\n\n**Arguments:**\n\n- `[project-directory]` - Optional project directory: a name such as `my-app`, or a path,\n  absolute or relative, such as `../apps/my-app`, whose missing folders are created. Its last\n  part is the project name, held to the same rules as a bare name. It becomes the page title as\n  typed, and the `package.json` name lower-cased the way `npm init` does and without a leading\n  `_`, since npm rejects both. A path ending in `.` or `..` is refused, like a bare `.` or `..`,\n  so name the directory you want.\n\n**Options:**\n\n- `-t, --template <template>` - Template to use: `vite` or `vite-ts`  \n  **Default:** `vite`\n- `--lint <linter>` - Linter:\n  - `oxlint` - Oxlint, as `npm create vite` sets up. `vite-ts` gets TypeScript 7.\n  - `eslint` - ESLint with typescript-eslint, as `npm create vite -- --eslint` sets up.\n    typescript-eslint doesn't support TypeScript 7 yet, so `vite-ts` stays on TypeScript 6.  \n    **Default:** `oxlint`, which a run without a terminal also gets when it leaves `--lint` out\n- `-b, --bulma <flavor>` - Bulma CSS flavor:\n  - `complete` - Full Bulma CSS with all components and helpers\n  - `prefixed` - Prefixed version for compatibility\n  - `no-helpers` - Without helper classes\n  - `no-helpers-prefixed` - Prefixed without helpers\n  - `no-dark-mode` - Without dark mode support  \n    **Default:** `complete`\n- `-i, --icon <library>` - Icon library:\n  - `none` - No icon library\n  - `fontawesome` - Font Awesome\n  - `mdi` - Material Design Icons\n  - `ionicons` - Ionicons\n  - `material-icons` - Material Icons\n  - `material-symbols` - Material Symbols  \n    **Default:** `none`\n- `--skills` / `--no-skills` - Install (or skip) the bestax AI skills into\n  `.claude/skills/` (with a `CLAUDE.md`) so a Claude Code session picks them up\n  automatically. When omitted you're prompted; with `-y` the default is to install.\n- `-y, --yes` - Skip prompts and use defaults or provided options.  \n  When used, the following defaults are selected unless overridden by flags:\n  - Template: `vite`\n  - Linter: `oxlint`\n  - Bulma flavor: `complete`\n  - Icon library: `none`\n  - AI skills: installed (pass `--no-skills` to opt out)\n\n  `-y` never deletes files. If the target directory is not empty, the run stops, lists what is\n  there, and changes nothing; add `--overwrite` to empty it first. Earlier versions emptied the\n  directory under `-y` alone, so a script that relied on that now needs `--overwrite`.\n\n- `--overwrite` - Remove existing files if the target directory is not empty, without asking.\n  Every other flag is checked first, so a typo stops the run before anything is deleted. It\n  never empties the current directory or a folder that holds it, however the path is written.\n\n**Example:**\n\n```bash\n# Create a TypeScript project with Font Awesome icons\nnpm create bestax@latest my-app -- -t vite-ts -i fontawesome -b complete\n\n# The same, linted with ESLint (and on TypeScript 6)\nnpm create bestax@latest my-app -- -t vite-ts -i fontawesome --lint eslint\n\n# Use all defaults (skip prompts)\nnpm create bestax@latest my-app -- -y\n\n# Scaffold into a path; the package is named my-app\nnpm create bestax@latest ../apps/my-app -- -y\n\n# The same with bun\nbun create bestax@latest my-app -- -y\n```\n\n## Templates\n\nAvailable templates:\n\n- `vite` - Vite + JavaScript\n- `vite-ts` - Vite + TypeScript\n\nEach template includes:\n\n- Pre-configured bestax-bulma integration (React 19)\n- The latest `@allxsmith/bestax-bulma`, which ships Bulma v1 automatically\n- Icon library support (Font Awesome, Material Design, etc.)\n- Sample components demonstrating library usage\n- Development and build scripts\n\n## For AI Tools\n\nScaffolding for an AI agent? Pass `--skills` (or accept the prompt) to drop the bestax\nAgent Skills and a `CLAUDE.md` into the new project so Claude Code, Cursor, or Copilot\nbuild the bestax way from the start. The library also ships LLM-optimized docs:\n\n- [LLMs guide](https://bestax.io/docs/guides/llms) — using bestax with Claude Code, Cursor, Copilot\n- [Agent Skills](https://bestax.io/docs/skills/intro) — teach your agent the bestax conventions\n- [llms.txt](https://bestax.io/llms.txt) (curated index) · [llms-full.txt](https://bestax.io/llms-full.txt) (full docs)\n\n## Development\n\n```bash\nnpm run build    # Build the CLI\nnpm run dev      # Watch mode\nnpm test         # Run tests\nnpm run lint     # Lint CLI source code\nnpm run typecheck # Type check CLI source code\n```\n\n**Note on Templates:** Template files in `templates/` are excluded from linting. They should be manually validated by scaffolding a test project and running lint/build there before releasing.\n\n## Hardened by default\n\nA scaffolder runs with write access to your filesystem and picks your starting dependencies, so how it is built and published matters:\n\n- **Signed provenance** — every release carries a sigstore attestation linking the tarball to the exact commit and CI run that built it. Check the **Provenance** section on the [npm page](https://www.npmjs.com/package/create-bestax#provenance), or run `npm audit signatures`.\n- **npm OIDC trusted publishing** — short-lived, per-run credentials; no long-lived `NPM_TOKEN` exists to be stolen. Release commits and tags are GPG-signed.\n- **Socket.dev scans every PR** for malware, install scripts, obfuscated code, and privilege escalation before it can reach `main`.\n- **Dependencies are a deliberate act** — install scripts are blocked unless individually allow-listed, freshly published versions are refused for 3 days, and CI installs only what the reviewed lockfile resolves.\n- **Every GitHub Action is pinned to a full commit SHA**, so a compromised action release can't roll silently into a build of this CLI.\n- **CodeQL, Dependency Review, and Dependabot** run continuously, alongside a high-severity `pnpm audit` gate.\n- **Layered AI review before merge** — [CodeRabbit](https://coderabbit.ai) plus an independent adversarial Claude review (a different model from the one writing AI-authored changes), on top of required green CI, an approving review, and a human merge.\n\nFull detail: [`SECURITY.md`](https://github.com/allxsmith/bestax/blob/main/SECURITY.md) · [Security guide](https://bestax.io/docs/guides/security)\n\n## Telemetry\n\n`create-bestax` can send one **anonymous** usage event after a successful\nscaffold — only if you opt in when asked (once, at the end of a scaffold). The\nevent is just the choices you made — template, Bulma flavor, icon library,\nskills, package manager — plus the CLI version, Node major version, and OS\nplatform; never names, IPs, machine IDs, paths, or file contents, and no\nidentifier exists that could link two events together. Opt out any time with\n`--no-telemetry`, `BESTAX_TELEMETRY=0`, or `DO_NOT_TRACK=1`.\n\nFull disclosure of every field and control: [Telemetry guide](https://bestax.io/docs/guides/telemetry)\n\n## Publishing\n\nThis package uses semantic-release with scope-based rules. Only commits with `feat(create-bestax)` or `fix(create-bestax)` will trigger releases.\n"
 }