create-warlock 4.15.0 → 5.0.0

package/esm/helpers/exec.mjs

@@ -4,44 +4,184 @@ import childProcess from "cross-spawn";
 
 //#region ../create-warlock/src/helpers/exec.ts
 /**
+* The last command executed through {@link executeCommand}.
+*
+* `executeCommand` resolves a bare boolean (a contract several callers depend
+* on), so the *reason* a command failed would otherwise be lost. It is parked
+* here and claimed with {@link takeLastCommandOutput}, which clears it — a
+* caller can never accidentally attribute a stale failure to the wrong step.
+*
+* The scaffolder runs one command at a time, so a single slot is enough.
+*/
+let lastCommandOutput;
+/**
+* Claim (and clear) the output of the most recent {@link executeCommand} call.
+*/
+function takeLastCommandOutput() {
+	const output = lastCommandOutput;
+	lastCommandOutput = void 0;
+	return output;
+}
+/**
+* Keep only the last `lines` non-empty lines of a stream — enough context to
+* act on, without dumping a 500-line npm log over the wizard.
+*/
+function tail(text, lines = 12) {
+	return text.split(/\r?\n/).filter((line) => line.trim().length > 0).slice(-lines).join("\n");
+}
+/**
+* Attach stdout/stderr collectors to a child and return the accumulated text.
+*
+* The streams are optional on purpose: a child spawned with `stdio: "ignore"`
+* (or a test double) exposes none.
+*/
+function collectOutput(child) {
+	const chunks = {
+		stdout: "",
+		stderr: ""
+	};
+	child.stdout?.on("data", (data) => {
+		chunks.stdout += String(data);
+	});
+	child.stderr?.on("data", (data) => {
+		chunks.stderr += String(data);
+	});
+	return chunks;
+}
+function logSpawnError(error) {
+	if (!error) return;
+	const message = error?.message;
+	log.error(colors.red(String(message ?? error)) + `\n\n`);
+}
+/**
 * This function directly executes a command
+*
+* Resolves a boolean for backwards compatibility; the full outcome (exit code
+* and captured output) is available to the caller via
+* {@link takeLastCommandOutput}.
 */
 async function executeCommand(cmd, args, cwd) {
+	const result = await runCapturedCommand(cmd, args, cwd);
+	lastCommandOutput = result;
+	return result.ok;
+}
+/**
+* Run a command to completion and resolve its full {@link CommandResult}.
+*
+* Output is piped and captured rather than discarded — the whole point is that
+* a failure can be explained instead of merely announced.
+*/
+function runCapturedCommand(cmd, args, cwd, options = {}) {
 	return new Promise((resolve) => {
-		const child = childProcess(cmd, args, {
+		const command = [cmd, ...args].join(" ");
+		const settle = (result) => resolve({
+			ok: false,
+			command,
 			cwd,
-			stdio: "ignore"
+			code: null,
+			signal: null,
+			stdout: "",
+			stderr: "",
+			...result
 		});
-		child.on("error", (e) => {
-			if (e) if (e.message) log.error(colors.red(String(e.message)) + `\n\n`);
-			else log.error(colors.red(String(e)) + `\n\n`);
-			resolve(false);
+		let child;
+		try {
+			child = childProcess(cmd, args, {
+				cwd,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				],
+				env: options.env ? {
+					...process.env,
+					...options.env
+				} : process.env
+			});
+		} catch (error) {
+			logSpawnError(error);
+			return settle({
+				error,
+				stderr: String(error)
+			});
+		}
+		const output = collectOutput(child);
+		child.on("error", (error) => {
+			logSpawnError(error);
+			settle({
+				error,
+				stdout: output.stdout,
+				stderr: output.stderr || String(error?.message ?? error)
+			});
 		});
-		child.on("close", (code) => {
-			if (code === 0) resolve(true);
-			else resolve(false);
+		child.on("close", (code, signal) => {
+			settle({
+				ok: code === 0,
+				code,
+				signal,
+				stdout: output.stdout,
+				stderr: output.stderr
+			});
 		});
 	});
 }
-function runCommand(cmd, args, cwd) {
+/**
+* Run a long command with an abort handle.
+*
+* `install` stays a `Promise<boolean>` for existing callers; `result` carries
+* the exit code and the captured output so a failing install can be reported
+* with the command, its status and its stderr instead of a shrug.
+*/
+function runCommand(cmd, args, cwd, options = {}) {
 	let child;
-	const install = new Promise((resolve) => {
+	const result = new Promise((resolve) => {
+		const command = [cmd, ...args].join(" ");
+		const settle = (partial) => resolve({
+			ok: false,
+			command,
+			cwd,
+			code: null,
+			signal: null,
+			stdout: "",
+			stderr: "",
+			...partial
+		});
 		try {
 			child = childProcess(cmd, args, {
 				cwd,
-				stdio: "ignore"
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				],
+				env: options.env ? {
+					...process.env,
+					...options.env
+				} : process.env
+			});
+			const output = collectOutput(child);
+			child.on("error", (error) => {
+				logSpawnError(error);
+				settle({
+					error,
+					stdout: output.stdout,
+					stderr: output.stderr || String(error?.message ?? error)
+				});
 			});
-			child.on("error", (e) => {
-				if (e) if (e.message) log.error(colors.red(String(e.message)) + `\n\n`);
-				else log.error(colors.red(String(e)) + `\n\n`);
-				resolve(false);
+			child.on("close", (code, signal) => {
+				settle({
+					ok: code === 0,
+					code,
+					signal,
+					stdout: output.stdout,
+					stderr: output.stderr
+				});
 			});
-			child.on("close", (code) => {
-				if (code === 0) resolve(true);
-				else resolve(false);
+		} catch (error) {
+			settle({
+				error,
+				stderr: String(error)
 			});
-		} catch (e) {
-			resolve(false);
 		}
 	});
 	const abort = async () => {
@@ -49,10 +189,11 @@ function runCommand(cmd, args, cwd) {
 	};
 	return {
 		abort,
-		install
+		install: result.then((outcome) => outcome.ok),
+		result
 	};
 }
 
 //#endregion
-export { executeCommand, runCommand };
+export { executeCommand, runCommand, tail, takeLastCommandOutput };
 //# sourceMappingURL=exec.mjs.map

package/esm/helpers/exec.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"exec.mjs","names":["spawn"],"sources":["../../../../../../create-warlock/src/helpers/exec.ts"],"sourcesContent":["import { log } from \"@clack/prompts\";\r\nimport { colors } from \"@mongez/copper\";\r\nimport { ChildProcess } from \"child_process\";\r\nimport { default as childProcess, default as spawn } from \"cross-spawn\";\r\n\r\nexport default async function exec(command: string, options: any = {}) {\r\n  const [commandName, ...optionsList] = command.split(\" \");\r\n\r\n  const commandOutput = childProcess.sync(commandName, optionsList, options);\r\n\r\n  // it means command didn't end as expected, then stop the rest of the program\r\n  if (commandOutput.error !== null) {\r\n    process.exit(1);\r\n  }\r\n\r\n  return commandOutput;\r\n}\r\n\r\n/**\r\n * This function directly executes a command\r\n */\r\nexport async function executeCommand(cmd: string, args: string[], cwd: string) {\r\n  return new Promise<boolean>(resolve => {\r\n    const child = spawn(cmd, args, {\r\n      cwd,\r\n      stdio: \"ignore\",\r\n    });\r\n\r\n    child.on(\"error\", e => {\r\n      if (e) {\r\n        if (e.message) {\r\n          log.error(colors.red(String(e.message)) + `\\n\\n`);\r\n        } else {\r\n          log.error(colors.red(String(e)) + `\\n\\n`);\r\n        }\r\n      }\r\n      resolve(false);\r\n    });\r\n\r\n    child.on(\"close\", code => {\r\n      if (code === 0) {\r\n        resolve(true);\r\n      } else {\r\n        resolve(false);\r\n      }\r\n    });\r\n  });\r\n}\r\n\r\nexport function runCommand(cmd: string, args: string[], cwd: string) {\r\n  let child: ChildProcess;\r\n\r\n  const install = new Promise<boolean>(resolve => {\r\n    try {\r\n      child = spawn(cmd, args, {\r\n        cwd,\r\n        stdio: \"ignore\",\r\n      });\r\n\r\n      child.on(\"error\", e => {\r\n        if (e) {\r\n          if (e.message) {\r\n            log.error(colors.red(String(e.message)) + `\\n\\n`);\r\n          } else {\r\n            log.error(colors.red(String(e)) + `\\n\\n`);\r\n          }\r\n        }\r\n        resolve(false);\r\n      });\r\n\r\n      child.on(\"close\", code => {\r\n        if (code === 0) {\r\n          resolve(true);\r\n        } else {\r\n          resolve(false);\r\n        }\r\n      });\r\n    } catch (e) {\r\n      resolve(false);\r\n    }\r\n  });\r\n\r\n  const abort = async () => {\r\n    if (child) {\r\n      child.kill(\"SIGINT\");\r\n    }\r\n  };\r\n\r\n  return { abort, install };\r\n}\r\n"],"mappings":";;;;;;;;AAqBA,eAAsB,eAAe,KAAa,MAAgB,KAAa;CAC7E,OAAO,IAAI,SAAiB,YAAW;EACrC,MAAM,QAAQA,aAAM,KAAK,MAAM;GAC7B;GACA,OAAO;EACT,CAAC;EAED,MAAM,GAAG,UAAS,MAAK;GACrB,IAAI,GACF,IAAI,EAAE,SACJ,IAAI,MAAM,OAAO,IAAI,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM;QAEhD,IAAI,MAAM,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,MAAM;GAG5C,QAAQ,KAAK;EACf,CAAC;EAED,MAAM,GAAG,UAAS,SAAQ;GACxB,IAAI,SAAS,GACX,QAAQ,IAAI;QAEZ,QAAQ,KAAK;EAEjB,CAAC;CACH,CAAC;AACH;AAEA,SAAgB,WAAW,KAAa,MAAgB,KAAa;CACnE,IAAI;CAEJ,MAAM,UAAU,IAAI,SAAiB,YAAW;EAC9C,IAAI;GACF,QAAQA,aAAM,KAAK,MAAM;IACvB;IACA,OAAO;GACT,CAAC;GAED,MAAM,GAAG,UAAS,MAAK;IACrB,IAAI,GACF,IAAI,EAAE,SACJ,IAAI,MAAM,OAAO,IAAI,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM;SAEhD,IAAI,MAAM,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,MAAM;IAG5C,QAAQ,KAAK;GACf,CAAC;GAED,MAAM,GAAG,UAAS,SAAQ;IACxB,IAAI,SAAS,GACX,QAAQ,IAAI;SAEZ,QAAQ,KAAK;GAEjB,CAAC;EACH,SAAS,GAAG;GACV,QAAQ,KAAK;EACf;CACF,CAAC;CAED,MAAM,QAAQ,YAAY;EACxB,IAAI,OACF,MAAM,KAAK,QAAQ;CAEvB;CAEA,OAAO;EAAE;EAAO;CAAQ;AAC1B"}
+{"version":3,"file":"exec.mjs","names":["spawn"],"sources":["../../../../../../create-warlock/src/helpers/exec.ts"],"sourcesContent":["import { log } from \"@clack/prompts\";\nimport { colors } from \"@mongez/copper\";\nimport { ChildProcess } from \"child_process\";\nimport { default as childProcess, default as spawn } from \"cross-spawn\";\n\n/**\n * The full outcome of a spawned command — everything a human needs to act on a\n * failure: what ran, where, how it ended, and what it printed.\n *\n * Every runner in this file produces one. A boolean is never enough: \"it\n * failed\" with no command, no exit code and no stderr is exactly how a broken\n * scaffold gets announced as a success.\n */\nexport type CommandResult = {\n  /** Whether the command exited cleanly (code 0, no spawn error). */\n  ok: boolean;\n  /** The command as typed, e.g. `npm install`. */\n  command: string;\n  /** Directory the command ran in, when known. */\n  cwd?: string;\n  /** Exit code, or `null` when the process was signalled / never spawned. */\n  code: number | null;\n  /** Terminating signal, when the process was killed. */\n  signal: NodeJS.Signals | null;\n  stdout: string;\n  stderr: string;\n  /** Set when the process could not be spawned at all (ENOENT, EACCES, ...). */\n  error?: Error;\n};\n\n/** Options accepted by the capturing runners. */\nexport type RunOptions = {\n  /** Extra environment for the child; merged over `process.env`. */\n  env?: NodeJS.ProcessEnv;\n};\n\n/**\n * The last command executed through {@link executeCommand}.\n *\n * `executeCommand` resolves a bare boolean (a contract several callers depend\n * on), so the *reason* a command failed would otherwise be lost. It is parked\n * here and claimed with {@link takeLastCommandOutput}, which clears it — a\n * caller can never accidentally attribute a stale failure to the wrong step.\n *\n * The scaffolder runs one command at a time, so a single slot is enough.\n */\nlet lastCommandOutput: CommandResult | undefined;\n\n/**\n * Claim (and clear) the output of the most recent {@link executeCommand} call.\n */\nexport function takeLastCommandOutput(): CommandResult | undefined {\n  const output = lastCommandOutput;\n\n  lastCommandOutput = undefined;\n\n  return output;\n}\n\n/**\n * Keep only the last `lines` non-empty lines of a stream — enough context to\n * act on, without dumping a 500-line npm log over the wizard.\n */\nexport function tail(text: string, lines = 12): string {\n  return text\n    .split(/\\r?\\n/)\n    .filter(line => line.trim().length > 0)\n    .slice(-lines)\n    .join(\"\\n\");\n}\n\nexport default async function exec(command: string, options: any = {}) {\n  const [commandName, ...optionsList] = command.split(\" \");\n\n  const commandOutput = childProcess.sync(commandName, optionsList, options);\n\n  // it means command didn't end as expected, then stop the rest of the program\n  if (commandOutput.error !== null) {\n    process.exit(1);\n  }\n\n  return commandOutput;\n}\n\n/**\n * Attach stdout/stderr collectors to a child and return the accumulated text.\n *\n * The streams are optional on purpose: a child spawned with `stdio: \"ignore\"`\n * (or a test double) exposes none.\n */\nfunction collectOutput(child: ChildProcess) {\n  const chunks = { stdout: \"\", stderr: \"\" };\n\n  child.stdout?.on(\"data\", data => {\n    chunks.stdout += String(data);\n  });\n\n  child.stderr?.on(\"data\", data => {\n    chunks.stderr += String(data);\n  });\n\n  return chunks;\n}\n\nfunction logSpawnError(error: unknown) {\n  if (!error) return;\n\n  const message = (error as Error)?.message;\n\n  log.error(colors.red(String(message ?? error)) + `\\n\\n`);\n}\n\n/**\n * This function directly executes a command\n *\n * Resolves a boolean for backwards compatibility; the full outcome (exit code\n * and captured output) is available to the caller via\n * {@link takeLastCommandOutput}.\n */\nexport async function executeCommand(cmd: string, args: string[], cwd: string) {\n  const result = await runCapturedCommand(cmd, args, cwd);\n\n  lastCommandOutput = result;\n\n  return result.ok;\n}\n\n/**\n * Run a command to completion and resolve its full {@link CommandResult}.\n *\n * Output is piped and captured rather than discarded — the whole point is that\n * a failure can be explained instead of merely announced.\n */\nexport function runCapturedCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  options: RunOptions = {},\n): Promise<CommandResult> {\n  return new Promise<CommandResult>(resolve => {\n    const command = [cmd, ...args].join(\" \");\n\n    const settle = (result: Partial<CommandResult>): void =>\n      resolve({\n        ok: false,\n        command,\n        cwd,\n        code: null,\n        signal: null,\n        stdout: \"\",\n        stderr: \"\",\n        ...result,\n      });\n\n    let child: ChildProcess;\n\n    try {\n      child = spawn(cmd, args, {\n        cwd,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n        env: options.env ? { ...process.env, ...options.env } : process.env,\n      });\n    } catch (error) {\n      logSpawnError(error);\n\n      return settle({ error: error as Error, stderr: String(error) });\n    }\n\n    const output = collectOutput(child);\n\n    child.on(\"error\", error => {\n      logSpawnError(error);\n\n      settle({\n        error: error as Error,\n        stdout: output.stdout,\n        stderr: output.stderr || String((error as Error)?.message ?? error),\n      });\n    });\n\n    child.on(\"close\", (code, signal) => {\n      settle({\n        ok: code === 0,\n        code,\n        signal,\n        stdout: output.stdout,\n        stderr: output.stderr,\n      });\n    });\n  });\n}\n\n/**\n * Run a long command with an abort handle.\n *\n * `install` stays a `Promise<boolean>` for existing callers; `result` carries\n * the exit code and the captured output so a failing install can be reported\n * with the command, its status and its stderr instead of a shrug.\n */\nexport function runCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  options: RunOptions = {},\n) {\n  let child: ChildProcess;\n\n  const result = new Promise<CommandResult>(resolve => {\n    const command = [cmd, ...args].join(\" \");\n\n    const settle = (partial: Partial<CommandResult>): void =>\n      resolve({\n        ok: false,\n        command,\n        cwd,\n        code: null,\n        signal: null,\n        stdout: \"\",\n        stderr: \"\",\n        ...partial,\n      });\n\n    try {\n      child = spawn(cmd, args, {\n        cwd,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n        env: options.env ? { ...process.env, ...options.env } : process.env,\n      });\n\n      const output = collectOutput(child);\n\n      child.on(\"error\", error => {\n        logSpawnError(error);\n\n        settle({\n          error: error as Error,\n          stdout: output.stdout,\n          stderr: output.stderr || String((error as Error)?.message ?? error),\n        });\n      });\n\n      child.on(\"close\", (code, signal) => {\n        settle({\n          ok: code === 0,\n          code,\n          signal,\n          stdout: output.stdout,\n          stderr: output.stderr,\n        });\n      });\n    } catch (error) {\n      settle({ error: error as Error, stderr: String(error) });\n    }\n  });\n\n  const abort = async () => {\n    if (child) {\n      child.kill(\"SIGINT\");\n    }\n  };\n\n  return { abort, install: result.then(outcome => outcome.ok), result };\n}\n"],"mappings":";;;;;;;;;;;;;;;AA8CA,IAAI;;;;AAKJ,SAAgB,wBAAmD;CACjE,MAAM,SAAS;CAEf,oBAAoB;CAEpB,OAAO;AACT;;;;;AAMA,SAAgB,KAAK,MAAc,QAAQ,IAAY;CACrD,OAAO,KACJ,MAAM,OAAO,CAAC,CACd,QAAO,SAAQ,KAAK,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CACtC,MAAM,CAAC,KAAK,CAAC,CACb,KAAK,IAAI;AACd;;;;;;;AAqBA,SAAS,cAAc,OAAqB;CAC1C,MAAM,SAAS;EAAE,QAAQ;EAAI,QAAQ;CAAG;CAExC,MAAM,QAAQ,GAAG,SAAQ,SAAQ;EAC/B,OAAO,UAAU,OAAO,IAAI;CAC9B,CAAC;CAED,MAAM,QAAQ,GAAG,SAAQ,SAAQ;EAC/B,OAAO,UAAU,OAAO,IAAI;CAC9B,CAAC;CAED,OAAO;AACT;AAEA,SAAS,cAAc,OAAgB;CACrC,IAAI,CAAC,OAAO;CAEZ,MAAM,UAAW,OAAiB;CAElC,IAAI,MAAM,OAAO,IAAI,OAAO,WAAW,KAAK,CAAC,IAAI,MAAM;AACzD;;;;;;;;AASA,eAAsB,eAAe,KAAa,MAAgB,KAAa;CAC7E,MAAM,SAAS,MAAM,mBAAmB,KAAK,MAAM,GAAG;CAEtD,oBAAoB;CAEpB,OAAO,OAAO;AAChB;;;;;;;AAQA,SAAgB,mBACd,KACA,MACA,KACA,UAAsB,CAAC,GACC;CACxB,OAAO,IAAI,SAAuB,YAAW;EAC3C,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;EAEvC,MAAM,UAAU,WACd,QAAQ;GACN,IAAI;GACJ;GACA;GACA,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAG;EACL,CAAC;EAEH,IAAI;EAEJ,IAAI;GACF,QAAQA,aAAM,KAAK,MAAM;IACvB;IACA,OAAO;KAAC;KAAU;KAAQ;IAAM;IAChC,KAAK,QAAQ,MAAM;KAAE,GAAG,QAAQ;KAAK,GAAG,QAAQ;IAAI,IAAI,QAAQ;GAClE,CAAC;EACH,SAAS,OAAO;GACd,cAAc,KAAK;GAEnB,OAAO,OAAO;IAAS;IAAgB,QAAQ,OAAO,KAAK;GAAE,CAAC;EAChE;EAEA,MAAM,SAAS,cAAc,KAAK;EAElC,MAAM,GAAG,UAAS,UAAS;GACzB,cAAc,KAAK;GAEnB,OAAO;IACE;IACP,QAAQ,OAAO;IACf,QAAQ,OAAO,UAAU,OAAQ,OAAiB,WAAW,KAAK;GACpE,CAAC;EACH,CAAC;EAED,MAAM,GAAG,UAAU,MAAM,WAAW;GAClC,OAAO;IACL,IAAI,SAAS;IACb;IACA;IACA,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB,CAAC;EACH,CAAC;CACH,CAAC;AACH;;;;;;;;AASA,SAAgB,WACd,KACA,MACA,KACA,UAAsB,CAAC,GACvB;CACA,IAAI;CAEJ,MAAM,SAAS,IAAI,SAAuB,YAAW;EACnD,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;EAEvC,MAAM,UAAU,YACd,QAAQ;GACN,IAAI;GACJ;GACA;GACA,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAG;EACL,CAAC;EAEH,IAAI;GACF,QAAQA,aAAM,KAAK,MAAM;IACvB;IACA,OAAO;KAAC;KAAU;KAAQ;IAAM;IAChC,KAAK,QAAQ,MAAM;KAAE,GAAG,QAAQ;KAAK,GAAG,QAAQ;IAAI,IAAI,QAAQ;GAClE,CAAC;GAED,MAAM,SAAS,cAAc,KAAK;GAElC,MAAM,GAAG,UAAS,UAAS;IACzB,cAAc,KAAK;IAEnB,OAAO;KACE;KACP,QAAQ,OAAO;KACf,QAAQ,OAAO,UAAU,OAAQ,OAAiB,WAAW,KAAK;IACpE,CAAC;GACH,CAAC;GAED,MAAM,GAAG,UAAU,MAAM,WAAW;IAClC,OAAO;KACL,IAAI,SAAS;KACb;KACA;KACA,QAAQ,OAAO;KACf,QAAQ,OAAO;IACjB,CAAC;GACH,CAAC;EACH,SAAS,OAAO;GACd,OAAO;IAAS;IAAgB,QAAQ,OAAO,KAAK;GAAE,CAAC;EACzD;CACF,CAAC;CAED,MAAM,QAAQ,YAAY;EACxB,IAAI,OACF,MAAM,KAAK,QAAQ;CAEvB;CAEA,OAAO;EAAE;EAAO,SAAS,OAAO,MAAK,YAAW,QAAQ,EAAE;EAAG;CAAO;AACtE"}

package/esm/helpers/package-manager.mjs

@@ -7,6 +7,23 @@ const execAsync = promisify(exec);
 let detectedPackageManager;
 let cachedSystemManagers;
 let cachedPreferredManager;
+/**
+* The only package managers `--pm` may select. This value reaches `spawn()`
+* as the executable to run and is spliced into the generated
+* `package.json`'s scripts — an allow-list here is a hard security
+* boundary, not just input hygiene, so it stays a fixed literal list
+* rather than anything derived from user input or the running environment.
+*/
+const ALLOWED_PACKAGE_MANAGERS = [
+	"npm",
+	"yarn",
+	"pnpm",
+	"bun"
+];
+/** Whether `value` is one of the allow-listed package managers. */
+function isValidPackageManager(value) {
+	return ALLOWED_PACKAGE_MANAGERS.includes(value);
+}
 function getPackageManager() {
 	if (detectedPackageManager) return detectedPackageManager;
 	return getPreferredPackageManager();
@@ -80,5 +97,5 @@ function runPackageManagerCommand(command) {
 }
 
 //#endregion
-export { detectPackageManagers, getPackageManager, getPreferredPackageManager, getSystemPackageManagers, runPackageManagerCommand, setPackageManager };
+export { ALLOWED_PACKAGE_MANAGERS, detectPackageManagers, getPackageManager, getPreferredPackageManager, getSystemPackageManagers, isValidPackageManager, runPackageManagerCommand, setPackageManager };
 //# sourceMappingURL=package-manager.mjs.map

package/esm/helpers/package-manager.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"package-manager.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/package-manager.ts"],"sourcesContent":["import { exec, execSync } from \"child_process\";\r\nimport { promisify } from \"util\";\r\nimport detectPackageManager from \"which-pm-runs\";\r\n\r\nconst execAsync = promisify(exec);\r\n\r\nlet detectedPackageManager: string | undefined;\r\nlet cachedSystemManagers: string[] | undefined;\r\nlet cachedPreferredManager: string | undefined;\r\n\r\nexport function getPackageManager() {\r\n  if (detectedPackageManager) {\r\n    return detectedPackageManager;\r\n  }\r\n\r\n  return getPreferredPackageManager();\r\n}\r\n\r\n/**\r\n * Check if a package manager is installed\r\n */\r\nfunction isInstalled(manager: string): boolean {\r\n  try {\r\n    execSync(`${manager} --version`, { stdio: \"ignore\" });\r\n    return true;\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\n/**\r\n * Check if a package manager is installed (async)\r\n */\r\nasync function checkManager(manager: string): Promise<boolean> {\r\n  try {\r\n    await execAsync(`${manager} --version`);\r\n    return true;\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\n/**\r\n * Detect available package managers asynchronously and cache results\r\n */\r\nexport async function detectPackageManagers() {\r\n  const managers = [\"npm\"];\r\n  const checks = [checkManager(\"yarn\"), checkManager(\"pnpm\")];\r\n\r\n  const [hasYarn, hasPnpm] = await Promise.all(checks);\r\n\r\n  if (hasYarn) managers.push(\"yarn\");\r\n  if (hasPnpm) managers.push(\"pnpm\");\r\n\r\n  cachedSystemManagers = managers;\r\n\r\n  // Determine preference\r\n  const runningPm = detectPackageManager()?.name;\r\n  if (runningPm && runningPm !== \"npm\") {\r\n    cachedPreferredManager = runningPm;\r\n  } else if (hasYarn) {\r\n    cachedPreferredManager = \"yarn\";\r\n  } else if (hasPnpm) {\r\n    cachedPreferredManager = \"pnpm\";\r\n  } else {\r\n    cachedPreferredManager = \"npm\";\r\n  }\r\n}\r\n\r\n/**\r\n * Get available package managers on the system\r\n */\r\nexport function getSystemPackageManagers(): string[] {\r\n  if (cachedSystemManagers) return cachedSystemManagers;\r\n\r\n  const managers = [\"npm\"]; // npm is assumed to be always available\r\n\r\n  if (isInstalled(\"yarn\")) {\r\n    managers.push(\"yarn\");\r\n  }\r\n\r\n  if (isInstalled(\"pnpm\")) {\r\n    managers.push(\"pnpm\");\r\n  }\r\n\r\n  return managers;\r\n}\r\n\r\n/**\r\n * Get the preferred package manager based on priority\r\n */\r\nexport function getPreferredPackageManager(): string {\r\n  if (cachedPreferredManager) return cachedPreferredManager;\r\n\r\n  // Priority 1: The manager currently running the script\r\n  const runningPm = detectPackageManager()?.name;\r\n  if (runningPm && runningPm !== \"npm\") return runningPm;\r\n\r\n  // Priority 2: Yarn (if installed)\r\n  if (isInstalled(\"yarn\")) return \"yarn\";\r\n\r\n  // Priority 3: pnpm (if installed)\r\n  if (isInstalled(\"pnpm\")) return \"pnpm\";\r\n\r\n  // Priority 4: npm (default)\r\n  return \"npm\";\r\n}\r\n\r\nexport function setPackageManager(packageManager: string) {\r\n  detectedPackageManager = packageManager;\r\n}\r\n\r\nexport function installCommand() {\r\n  return `${getPackageManager()} install`;\r\n}\r\n\r\nexport function startCommand() {\r\n  if (getPackageManager() === \"npm\") return \"npm run dev\";\r\n\r\n  return `${getPackageManager()} dev`;\r\n}\r\n\r\nexport function runPackageManagerCommand(command: string) {\r\n  const packageManager = getPackageManager();\r\n\r\n  if (packageManager === \"npm\") return `npm run ${command}`;\r\n\r\n  return `${packageManager} ${command}`;\r\n}\r\n"],"mappings":";;;;;AAIA,MAAM,YAAY,UAAU,IAAI;AAEhC,IAAI;AACJ,IAAI;AACJ,IAAI;AAEJ,SAAgB,oBAAoB;CAClC,IAAI,wBACF,OAAO;CAGT,OAAO,2BAA2B;AACpC;;;;AAKA,SAAS,YAAY,SAA0B;CAC7C,IAAI;EACF,SAAS,GAAG,QAAQ,aAAa,EAAE,OAAO,SAAS,CAAC;EACpD,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,eAAe,aAAa,SAAmC;CAC7D,IAAI;EACF,MAAM,UAAU,GAAG,QAAQ,WAAW;EACtC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,eAAsB,wBAAwB;CAC5C,MAAM,WAAW,CAAC,KAAK;CACvB,MAAM,SAAS,CAAC,aAAa,MAAM,GAAG,aAAa,MAAM,CAAC;CAE1D,MAAM,CAAC,SAAS,WAAW,MAAM,QAAQ,IAAI,MAAM;CAEnD,IAAI,SAAS,SAAS,KAAK,MAAM;CACjC,IAAI,SAAS,SAAS,KAAK,MAAM;CAEjC,uBAAuB;CAGvB,MAAM,YAAY,qBAAqB,CAAC,EAAE;CAC1C,IAAI,aAAa,cAAc,OAC7B,yBAAyB;MACpB,IAAI,SACT,yBAAyB;MACpB,IAAI,SACT,yBAAyB;MAEzB,yBAAyB;AAE7B;;;;AAKA,SAAgB,2BAAqC;CACnD,IAAI,sBAAsB,OAAO;CAEjC,MAAM,WAAW,CAAC,KAAK;CAEvB,IAAI,YAAY,MAAM,GACpB,SAAS,KAAK,MAAM;CAGtB,IAAI,YAAY,MAAM,GACpB,SAAS,KAAK,MAAM;CAGtB,OAAO;AACT;;;;AAKA,SAAgB,6BAAqC;CACnD,IAAI,wBAAwB,OAAO;CAGnC,MAAM,YAAY,qBAAqB,CAAC,EAAE;CAC1C,IAAI,aAAa,cAAc,OAAO,OAAO;CAG7C,IAAI,YAAY,MAAM,GAAG,OAAO;CAGhC,IAAI,YAAY,MAAM,GAAG,OAAO;CAGhC,OAAO;AACT;AAEA,SAAgB,kBAAkB,gBAAwB;CACxD,yBAAyB;AAC3B;AAYA,SAAgB,yBAAyB,SAAiB;CACxD,MAAM,iBAAiB,kBAAkB;CAEzC,IAAI,mBAAmB,OAAO,OAAO,WAAW;CAEhD,OAAO,GAAG,eAAe,GAAG;AAC9B"}
+{"version":3,"file":"package-manager.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/package-manager.ts"],"sourcesContent":["import { exec, execSync } from \"child_process\";\r\nimport { promisify } from \"util\";\r\nimport detectPackageManager from \"which-pm-runs\";\r\n\r\nconst execAsync = promisify(exec);\r\n\r\nlet detectedPackageManager: string | undefined;\r\nlet cachedSystemManagers: string[] | undefined;\r\nlet cachedPreferredManager: string | undefined;\r\n\r\n/**\r\n * The only package managers `--pm` may select. This value reaches `spawn()`\r\n * as the executable to run and is spliced into the generated\r\n * `package.json`'s scripts — an allow-list here is a hard security\r\n * boundary, not just input hygiene, so it stays a fixed literal list\r\n * rather than anything derived from user input or the running environment.\r\n */\r\nexport const ALLOWED_PACKAGE_MANAGERS = [\"npm\", \"yarn\", \"pnpm\", \"bun\"] as const;\r\n\r\nexport type AllowedPackageManager = (typeof ALLOWED_PACKAGE_MANAGERS)[number];\r\n\r\n/** Whether `value` is one of the allow-listed package managers. */\r\nexport function isValidPackageManager(\r\n  value: string,\r\n): value is AllowedPackageManager {\r\n  return (ALLOWED_PACKAGE_MANAGERS as readonly string[]).includes(value);\r\n}\r\n\r\nexport function getPackageManager() {\r\n  if (detectedPackageManager) {\r\n    return detectedPackageManager;\r\n  }\r\n\r\n  return getPreferredPackageManager();\r\n}\r\n\r\n/**\r\n * Check if a package manager is installed\r\n */\r\nfunction isInstalled(manager: string): boolean {\r\n  try {\r\n    execSync(`${manager} --version`, { stdio: \"ignore\" });\r\n    return true;\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\n/**\r\n * Check if a package manager is installed (async)\r\n */\r\nasync function checkManager(manager: string): Promise<boolean> {\r\n  try {\r\n    await execAsync(`${manager} --version`);\r\n    return true;\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\n/**\r\n * Detect available package managers asynchronously and cache results\r\n */\r\nexport async function detectPackageManagers() {\r\n  const managers = [\"npm\"];\r\n  const checks = [checkManager(\"yarn\"), checkManager(\"pnpm\")];\r\n\r\n  const [hasYarn, hasPnpm] = await Promise.all(checks);\r\n\r\n  if (hasYarn) managers.push(\"yarn\");\r\n  if (hasPnpm) managers.push(\"pnpm\");\r\n\r\n  cachedSystemManagers = managers;\r\n\r\n  // Determine preference\r\n  const runningPm = detectPackageManager()?.name;\r\n  if (runningPm && runningPm !== \"npm\") {\r\n    cachedPreferredManager = runningPm;\r\n  } else if (hasYarn) {\r\n    cachedPreferredManager = \"yarn\";\r\n  } else if (hasPnpm) {\r\n    cachedPreferredManager = \"pnpm\";\r\n  } else {\r\n    cachedPreferredManager = \"npm\";\r\n  }\r\n}\r\n\r\n/**\r\n * Get available package managers on the system\r\n */\r\nexport function getSystemPackageManagers(): string[] {\r\n  if (cachedSystemManagers) return cachedSystemManagers;\r\n\r\n  const managers = [\"npm\"]; // npm is assumed to be always available\r\n\r\n  if (isInstalled(\"yarn\")) {\r\n    managers.push(\"yarn\");\r\n  }\r\n\r\n  if (isInstalled(\"pnpm\")) {\r\n    managers.push(\"pnpm\");\r\n  }\r\n\r\n  return managers;\r\n}\r\n\r\n/**\r\n * Get the preferred package manager based on priority\r\n */\r\nexport function getPreferredPackageManager(): string {\r\n  if (cachedPreferredManager) return cachedPreferredManager;\r\n\r\n  // Priority 1: The manager currently running the script\r\n  const runningPm = detectPackageManager()?.name;\r\n  if (runningPm && runningPm !== \"npm\") return runningPm;\r\n\r\n  // Priority 2: Yarn (if installed)\r\n  if (isInstalled(\"yarn\")) return \"yarn\";\r\n\r\n  // Priority 3: pnpm (if installed)\r\n  if (isInstalled(\"pnpm\")) return \"pnpm\";\r\n\r\n  // Priority 4: npm (default)\r\n  return \"npm\";\r\n}\r\n\r\nexport function setPackageManager(packageManager: string) {\r\n  detectedPackageManager = packageManager;\r\n}\r\n\r\nexport function installCommand() {\r\n  return `${getPackageManager()} install`;\r\n}\r\n\r\nexport function startCommand() {\r\n  if (getPackageManager() === \"npm\") return \"npm run dev\";\r\n\r\n  return `${getPackageManager()} dev`;\r\n}\r\n\r\nexport function runPackageManagerCommand(command: string) {\r\n  const packageManager = getPackageManager();\r\n\r\n  if (packageManager === \"npm\") return `npm run ${command}`;\r\n\r\n  return `${packageManager} ${command}`;\r\n}\r\n"],"mappings":";;;;;AAIA,MAAM,YAAY,UAAU,IAAI;AAEhC,IAAI;AACJ,IAAI;AACJ,IAAI;;;;;;;;AASJ,MAAa,2BAA2B;CAAC;CAAO;CAAQ;CAAQ;AAAK;;AAKrE,SAAgB,sBACd,OACgC;CAChC,OAAQ,yBAA+C,SAAS,KAAK;AACvE;AAEA,SAAgB,oBAAoB;CAClC,IAAI,wBACF,OAAO;CAGT,OAAO,2BAA2B;AACpC;;;;AAKA,SAAS,YAAY,SAA0B;CAC7C,IAAI;EACF,SAAS,GAAG,QAAQ,aAAa,EAAE,OAAO,SAAS,CAAC;EACpD,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,eAAe,aAAa,SAAmC;CAC7D,IAAI;EACF,MAAM,UAAU,GAAG,QAAQ,WAAW;EACtC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,eAAsB,wBAAwB;CAC5C,MAAM,WAAW,CAAC,KAAK;CACvB,MAAM,SAAS,CAAC,aAAa,MAAM,GAAG,aAAa,MAAM,CAAC;CAE1D,MAAM,CAAC,SAAS,WAAW,MAAM,QAAQ,IAAI,MAAM;CAEnD,IAAI,SAAS,SAAS,KAAK,MAAM;CACjC,IAAI,SAAS,SAAS,KAAK,MAAM;CAEjC,uBAAuB;CAGvB,MAAM,YAAY,qBAAqB,CAAC,EAAE;CAC1C,IAAI,aAAa,cAAc,OAC7B,yBAAyB;MACpB,IAAI,SACT,yBAAyB;MACpB,IAAI,SACT,yBAAyB;MAEzB,yBAAyB;AAE7B;;;;AAKA,SAAgB,2BAAqC;CACnD,IAAI,sBAAsB,OAAO;CAEjC,MAAM,WAAW,CAAC,KAAK;CAEvB,IAAI,YAAY,MAAM,GACpB,SAAS,KAAK,MAAM;CAGtB,IAAI,YAAY,MAAM,GACpB,SAAS,KAAK,MAAM;CAGtB,OAAO;AACT;;;;AAKA,SAAgB,6BAAqC;CACnD,IAAI,wBAAwB,OAAO;CAGnC,MAAM,YAAY,qBAAqB,CAAC,EAAE;CAC1C,IAAI,aAAa,cAAc,OAAO,OAAO;CAG7C,IAAI,YAAY,MAAM,GAAG,OAAO;CAGhC,IAAI,YAAY,MAAM,GAAG,OAAO;CAGhC,OAAO;AACT;AAEA,SAAgB,kBAAkB,gBAAwB;CACxD,yBAAyB;AAC3B;AAYA,SAAgB,yBAAyB,SAAiB;CACxD,MAAM,iBAAiB,kBAAkB;CAEzC,IAAI,mBAAmB,OAAO,OAAO,WAAW;CAEhD,OAAO,GAAG,eAAe,GAAG;AAC9B"}

package/esm/helpers/project-builder-helpers.mjs

@@ -7,19 +7,29 @@ import { copyDirectory, getFile, getJsonFile, putFile, putJsonFile, renameFile }
 import path from "path";
 
 //#region ../create-warlock/src/helpers/project-builder-helpers.ts
+/**
+* Bootstrap the project's git repository.
+*
+* Returns `false` as soon as a step fails, and leaves that step's captured
+* output where the caller can claim it with `takeLastCommandOutput()`. It used
+* to `return true` unconditionally, which meant a machine without git printed
+* "Grimoire initialized!" over a directory that was not a repository.
+*/
 async function initializeGitRepository(appPath) {
-	await executeCommand(`git`, ["init"], appPath);
-	await executeCommand(`git`, [
-		"checkout",
-		"-b",
-		"main"
-	], appPath);
-	await executeCommand(`git`, ["add", "."], appPath);
-	await executeCommand(`git`, [
-		"commit",
-		"-m",
-		"Initial commit"
-	], appPath);
+	for (const args of [
+		["init"],
+		[
+			"checkout",
+			"-b",
+			"main"
+		],
+		["add", "."],
+		[
+			"commit",
+			"-m",
+			"Initial commit"
+		]
+	]) if (!await executeCommand(`git`, args, appPath)) return false;
 	return true;
 }
 

package/esm/helpers/project-builder-helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"project-builder-helpers.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/project-builder-helpers.ts"],"sourcesContent":["import { outro } from \"@clack/prompts\";\r\nimport { colors } from \"@mongez/copper\";\r\nimport {\r\n  copyDirectory,\r\n  getFile,\r\n  getJsonFile,\r\n  putFile,\r\n  putJsonFile,\r\n  renameFile,\r\n} from \"@warlock.js/fs\";\r\nimport path from \"path\";\r\nimport { executeCommand } from \"./exec\";\r\nimport { startCommand } from \"./package-manager\";\r\nimport { Template, template } from \"./paths\";\r\n\r\nexport async function initializeGitRepository(appPath: string) {\r\n  // initialize git repository\r\n  await executeCommand(`git`, [\"init\"], appPath);\r\n  // switching to`main`branch\r\n  await executeCommand(`git`, [\"checkout\", \"-b\", \"main\"], appPath);\r\n\r\n  // add files\r\n  await executeCommand(`git`, [\"add\", \".\"], appPath);\r\n\r\n  // commit files\r\n  await executeCommand(`git`, [\"commit\", \"-m\", \"Initial commit\"], appPath);\r\n\r\n  return true;\r\n}\r\n\r\nexport async function updateEnvFile(appPath: string, appName: string) {\r\n  // update package.json file\r\n  const packageJson: any = getJsonFile(path.resolve(appPath, \"package.json\"));\r\n\r\n  packageJson.name = appName;\r\n\r\n  putJsonFile(path.resolve(appPath, \"package.json\"), packageJson);\r\n\r\n  // update env file\r\n  const dotEnv = getFile(path.resolve(appPath, \".env\"))\r\n    .replace(\"AppName\", appName)\r\n    .replace(\r\n      \"AppCodeName\",\r\n      appName\r\n        .split(/-|_/g)\r\n        .map(word => word[0])\r\n        .join(\"\"),\r\n    );\r\n\r\n  putFile(path.resolve(appPath, \".env\"), dotEnv);\r\n\r\n  // update .env.production file\r\n  let dotEnvProduction = getFile(path.resolve(appPath, \".env.shared\"));\r\n\r\n  dotEnvProduction = dotEnvProduction.replace(\"AppName\", appName).replace(\r\n    \"AppCodeName\",\r\n    appName\r\n      .split(/-|_/g)\r\n      .map(word => word[0])\r\n      .join(\"\"),\r\n  );\r\n\r\n  putFile(path.resolve(appPath, \".env.shared\"), dotEnvProduction);\r\n}\r\n\r\nexport async function copyTemplateFiles(\r\n  templateName: Template,\r\n  appPath: string,\r\n  _appName: string,\r\n) {\r\n  // copy project files\r\n  copyDirectory(template(templateName), appPath);\r\n\r\n  // replace _.gitignore to\r\n  renameFile(\r\n    path.resolve(appPath, \"_.gitignore\"),\r\n    path.resolve(appPath, \".gitignore\"),\r\n  );\r\n}\r\n\r\nexport async function allDone(appName: string) {\r\n  outro(\r\n    \"Awesome! Your project is ready to rock! \" +\r\n      \"Run the following command to start development:\",\r\n  );\r\n\r\n  console.log(colors.cyan(`cd ${appName} && ${startCommand()}`));\r\n\r\n  console.log();\r\n\r\n  console.log(\r\n    `Pro tip: Install the ${colors.yellow(\r\n      \"Generator Z\",\r\n    )} extension in VSCode for helpful code snippets and productivity boosters!`,\r\n  );\r\n}\r\n"],"mappings":";;;;;;;;;AAeA,eAAsB,wBAAwB,SAAiB;CAE7D,MAAM,eAAe,OAAO,CAAC,MAAM,GAAG,OAAO;CAE7C,MAAM,eAAe,OAAO;EAAC;EAAY;EAAM;CAAM,GAAG,OAAO;CAG/D,MAAM,eAAe,OAAO,CAAC,OAAO,GAAG,GAAG,OAAO;CAGjD,MAAM,eAAe,OAAO;EAAC;EAAU;EAAM;CAAgB,GAAG,OAAO;CAEvE,OAAO;AACT"}
+{"version":3,"file":"project-builder-helpers.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/project-builder-helpers.ts"],"sourcesContent":["import { outro } from \"@clack/prompts\";\r\nimport { colors } from \"@mongez/copper\";\r\nimport {\r\n  copyDirectory,\r\n  getFile,\r\n  getJsonFile,\r\n  putFile,\r\n  putJsonFile,\r\n  renameFile,\r\n} from \"@warlock.js/fs\";\r\nimport path from \"path\";\r\nimport { executeCommand } from \"./exec\";\r\nimport { startCommand } from \"./package-manager\";\r\nimport { Template, template } from \"./paths\";\r\n\r\n/**\r\n * Bootstrap the project's git repository.\r\n *\r\n * Returns `false` as soon as a step fails, and leaves that step's captured\r\n * output where the caller can claim it with `takeLastCommandOutput()`. It used\r\n * to `return true` unconditionally, which meant a machine without git printed\r\n * \"Grimoire initialized!\" over a directory that was not a repository.\r\n */\r\nexport async function initializeGitRepository(appPath: string) {\r\n  const steps: string[][] = [\r\n    // initialize git repository\r\n    [\"init\"],\r\n    // switching to `main` branch\r\n    [\"checkout\", \"-b\", \"main\"],\r\n    // add files\r\n    [\"add\", \".\"],\r\n    // commit files\r\n    [\"commit\", \"-m\", \"Initial commit\"],\r\n  ];\r\n\r\n  for (const args of steps) {\r\n    const succeeded = await executeCommand(`git`, args, appPath);\r\n\r\n    if (!succeeded) return false;\r\n  }\r\n\r\n  return true;\r\n}\r\n\r\nexport async function updateEnvFile(appPath: string, appName: string) {\r\n  // update package.json file\r\n  const packageJson: any = getJsonFile(path.resolve(appPath, \"package.json\"));\r\n\r\n  packageJson.name = appName;\r\n\r\n  putJsonFile(path.resolve(appPath, \"package.json\"), packageJson);\r\n\r\n  // update env file\r\n  const dotEnv = getFile(path.resolve(appPath, \".env\"))\r\n    .replace(\"AppName\", appName)\r\n    .replace(\r\n      \"AppCodeName\",\r\n      appName\r\n        .split(/-|_/g)\r\n        .map(word => word[0])\r\n        .join(\"\"),\r\n    );\r\n\r\n  putFile(path.resolve(appPath, \".env\"), dotEnv);\r\n\r\n  // update .env.production file\r\n  let dotEnvProduction = getFile(path.resolve(appPath, \".env.shared\"));\r\n\r\n  dotEnvProduction = dotEnvProduction.replace(\"AppName\", appName).replace(\r\n    \"AppCodeName\",\r\n    appName\r\n      .split(/-|_/g)\r\n      .map(word => word[0])\r\n      .join(\"\"),\r\n  );\r\n\r\n  putFile(path.resolve(appPath, \".env.shared\"), dotEnvProduction);\r\n}\r\n\r\nexport async function copyTemplateFiles(\r\n  templateName: Template,\r\n  appPath: string,\r\n  _appName: string,\r\n) {\r\n  // copy project files\r\n  copyDirectory(template(templateName), appPath);\r\n\r\n  // replace _.gitignore to\r\n  renameFile(\r\n    path.resolve(appPath, \"_.gitignore\"),\r\n    path.resolve(appPath, \".gitignore\"),\r\n  );\r\n}\r\n\r\nexport async function allDone(appName: string) {\r\n  outro(\r\n    \"Awesome! Your project is ready to rock! \" +\r\n      \"Run the following command to start development:\",\r\n  );\r\n\r\n  console.log(colors.cyan(`cd ${appName} && ${startCommand()}`));\r\n\r\n  console.log();\r\n\r\n  console.log(\r\n    `Pro tip: Install the ${colors.yellow(\r\n      \"Generator Z\",\r\n    )} extension in VSCode for helpful code snippets and productivity boosters!`,\r\n  );\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;AAuBA,eAAsB,wBAAwB,SAAiB;CAY7D,KAAK,MAAM,QAAQ;EATjB,CAAC,MAAM;EAEP;GAAC;GAAY;GAAM;EAAM;EAEzB,CAAC,OAAO,GAAG;EAEX;GAAC;GAAU;GAAM;EAAgB;CAGZ,GAGrB,IAAI,CAAC,MAFmB,eAAe,OAAO,MAAM,OAAO,GAE3C,OAAO;CAGzB,OAAO;AACT"}

package/esm/helpers/warlock-versions.mjs

@@ -0,0 +1,166 @@
+import { packageRoot, template } from "./paths.mjs";
+import { getJsonFile } from "@warlock.js/fs";
+
+//#region ../create-warlock/src/helpers/warlock-versions.ts
+/**
+* Resolving the version to stamp onto the generated project's `@warlock.js/*`
+* dependencies.
+*
+* ## Why this file exists
+*
+* The scaffolder used to stamp its OWN version onto every sibling package
+* (`"@warlock.js/core": "4.16.2"`). That is only correct while the scaffolder's
+* version is published — and it usually is not: the release tooling bumps the
+* source version on every build, including `--no-publish` builds, so between
+* publishes the working tree carries a version that exists nowhere on the
+* registry. Every project scaffolded in that window pinned eight dependencies
+* to a version npm cannot resolve, and the install died with `ETARGET`.
+*
+* ## The rule
+*
+* Never write a dependency version we have not established exists. Resolution
+* order, per package:
+*
+*   1. the scaffolder's own version, IF the registry has it published — this
+*      preserves the lockstep guarantee the pin was introduced for;
+*   2. otherwise the registry's `latest` — the newest thing that actually
+*      exists, with a note explaining the substitution;
+*   3. otherwise (registry unreachable) a caret range floored to the major,
+*      e.g. `^4.0.0` — always satisfiable by any published 4.x, and the
+*      scaffold-time install writes a lockfile that freezes the result anyway.
+*
+* A package that resolves to nothing (404 — never published) is reported, not
+* papered over: it is the difference between "your install failed" and "the
+* feature you asked for does not exist yet".
+*/
+const REGISTRY_TIMEOUT_MS = 6e3;
+/**
+* Registry to query. `npm_config_registry` is set by npm/npx when the
+* scaffolder runs through them, so a private mirror is honoured for free.
+*/
+function registryUrl() {
+	return (process.env.npm_config_registry?.trim() || "https://registry.npmjs.org").replace(/\/+$/, "");
+}
+/** `4.16.2` -> `^4.0.0`; anything unparseable -> `latest`. */
+function fallbackRange(version) {
+	const major = /^\s*v?(\d+)\./.exec(version)?.[1];
+	return major ? `^${major}.0.0` : "latest";
+}
+/**
+* Fetch the abbreviated packument for a package. Returns `undefined` when the
+* registry cannot be reached (network / timeout) and `null` when the registry
+* answers that the package does not exist.
+*/
+async function fetchPackument(packageName) {
+	const url = `${registryUrl()}/${packageName.replace("/", "%2F")}`;
+	try {
+		const response = await fetch(url, {
+			headers: { accept: "application/vnd.npm.install-v1+json" },
+			signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS)
+		});
+		if (response.status === 404 || response.status === 401) return null;
+		if (!response.ok) return void 0;
+		return await response.json();
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve one package against the registry. Pure aside from the fetch, so the
+* decision table above is readable in one place.
+*/
+async function resolvePackage(packageName, ownVersion) {
+	const packument = await fetchPackument(packageName);
+	if (packument === void 0) return {
+		package: packageName,
+		version: fallbackRange(ownVersion),
+		source: "range-fallback",
+		published: true,
+		reachable: false
+	};
+	if (packument === null) return {
+		package: packageName,
+		version: fallbackRange(ownVersion),
+		source: "range-fallback",
+		published: false,
+		reachable: true
+	};
+	if (packument.versions?.[ownVersion]) return {
+		package: packageName,
+		version: ownVersion,
+		source: "own-version",
+		published: true,
+		reachable: true
+	};
+	const latest = packument["dist-tags"]?.latest;
+	if (latest) return {
+		package: packageName,
+		version: latest,
+		source: "registry-latest",
+		published: true,
+		reachable: true
+	};
+	return {
+		package: packageName,
+		version: fallbackRange(ownVersion),
+		source: "range-fallback",
+		published: true,
+		reachable: true
+	};
+}
+/**
+* Every `@warlock.js/*` dependency the template declares. Read from the
+* template rather than the copied project so resolution can start before (or
+* in parallel with) the copy.
+*/
+function templateWarlockDependencies() {
+	const templatePackageJson = getJsonFile(`${template("warlock")}/package.json`);
+	const names = /* @__PURE__ */ new Set();
+	for (const field of ["dependencies", "devDependencies"]) for (const name of Object.keys(templatePackageJson[field] ?? {})) if (name.startsWith("@warlock.js/")) names.add(name);
+	return [...names];
+}
+/** The scaffolder's own published version, i.e. the lockstep candidate. */
+function scaffolderVersion() {
+	return getJsonFile(packageRoot("package.json")).version;
+}
+let cached;
+/**
+* Resolve the versions to stamp, once per process.
+*
+* Never throws and never blocks a scaffold: the worst case is the caret
+* fallback plus a note saying so.
+*/
+function resolveWarlockVersions(packages = templateWarlockDependencies(), ownVersion = scaffolderVersion()) {
+	if (cached) return cached;
+	cached = (async () => {
+		const resolutions = await Promise.all(packages.map((name) => resolvePackage(name, ownVersion)));
+		const versions = {};
+		const notes = [];
+		const unpublished = [];
+		const substituted = [];
+		let offline = false;
+		for (const resolution of resolutions) {
+			versions[resolution.package] = resolution.version;
+			if (!resolution.reachable) offline = true;
+			if (!resolution.published) unpublished.push(resolution.package);
+			if (resolution.source === "registry-latest") substituted.push(resolution);
+		}
+		if (offline) notes.push(`Could not reach the npm registry — pinning @warlock.js/* to ${fallbackRange(ownVersion)} instead of an exact version.`);
+		if (substituted.length > 0) {
+			const latest = substituted[0].version;
+			notes.push(`create-warlock ${ownVersion} is not published yet — pinning @warlock.js/* to the latest published version (${latest}).`);
+		}
+		if (unpublished.length > 0) notes.push(`Not published on the registry: ${unpublished.join(", ")} — the install will fail until they are released.`);
+		return {
+			versions,
+			notes,
+			unpublished,
+			offline
+		};
+	})();
+	return cached;
+}
+
+//#endregion
+export { fallbackRange, resolveWarlockVersions };
+//# sourceMappingURL=warlock-versions.mjs.map

package/esm/helpers/warlock-versions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"warlock-versions.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/warlock-versions.ts"],"sourcesContent":["/**\n * Resolving the version to stamp onto the generated project's `@warlock.js/*`\n * dependencies.\n *\n * ## Why this file exists\n *\n * The scaffolder used to stamp its OWN version onto every sibling package\n * (`\"@warlock.js/core\": \"4.16.2\"`). That is only correct while the scaffolder's\n * version is published — and it usually is not: the release tooling bumps the\n * source version on every build, including `--no-publish` builds, so between\n * publishes the working tree carries a version that exists nowhere on the\n * registry. Every project scaffolded in that window pinned eight dependencies\n * to a version npm cannot resolve, and the install died with `ETARGET`.\n *\n * ## The rule\n *\n * Never write a dependency version we have not established exists. Resolution\n * order, per package:\n *\n *   1. the scaffolder's own version, IF the registry has it published — this\n *      preserves the lockstep guarantee the pin was introduced for;\n *   2. otherwise the registry's `latest` — the newest thing that actually\n *      exists, with a note explaining the substitution;\n *   3. otherwise (registry unreachable) a caret range floored to the major,\n *      e.g. `^4.0.0` — always satisfiable by any published 4.x, and the\n *      scaffold-time install writes a lockfile that freezes the result anyway.\n *\n * A package that resolves to nothing (404 — never published) is reported, not\n * papered over: it is the difference between \"your install failed\" and \"the\n * feature you asked for does not exist yet\".\n */\n\nimport { getJsonFile } from \"@warlock.js/fs\";\nimport { packageRoot, template } from \"./paths\";\n\nexport type VersionSource =\n  \"own-version\" | \"registry-latest\" | \"range-fallback\";\n\nexport type ResolvedVersion = {\n  package: string;\n  /** The exact version or range to write into the generated package.json. */\n  version: string;\n  source: VersionSource;\n};\n\nexport type VersionResolution = {\n  /** package name -> version/range to stamp. */\n  versions: Record<string, string>;\n  /** Human-readable notes worth showing before the install runs. */\n  notes: string[];\n  /** Packages the registry does not know about at all. */\n  unpublished: string[];\n  /** True when the registry could not be reached and ranges were guessed. */\n  offline: boolean;\n};\n\nconst REGISTRY_TIMEOUT_MS = 6_000;\n\n/**\n * Registry to query. `npm_config_registry` is set by npm/npx when the\n * scaffolder runs through them, so a private mirror is honoured for free.\n */\nfunction registryUrl(): string {\n  const registry =\n    process.env.npm_config_registry?.trim() || \"https://registry.npmjs.org\";\n\n  return registry.replace(/\\/+$/, \"\");\n}\n\n/** `4.16.2` -> `^4.0.0`; anything unparseable -> `latest`. */\nexport function fallbackRange(version: string): string {\n  const major = /^\\s*v?(\\d+)\\./.exec(version)?.[1];\n\n  return major ? `^${major}.0.0` : \"latest\";\n}\n\ntype Packument = {\n  \"dist-tags\"?: Record<string, string>;\n  versions?: Record<string, unknown>;\n};\n\n/**\n * Fetch the abbreviated packument for a package. Returns `undefined` when the\n * registry cannot be reached (network / timeout) and `null` when the registry\n * answers that the package does not exist.\n */\nasync function fetchPackument(\n  packageName: string,\n): Promise<Packument | null | undefined> {\n  const url = `${registryUrl()}/${packageName.replace(\"/\", \"%2F\")}`;\n\n  try {\n    const response = await fetch(url, {\n      headers: { accept: \"application/vnd.npm.install-v1+json\" },\n      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS),\n    });\n\n    // 404 (public) and 401 (scoped package the registry hides) both mean the\n    // same thing to us: there is nothing here to install.\n    if (response.status === 404 || response.status === 401) return null;\n\n    if (!response.ok) return undefined;\n\n    return (await response.json()) as Packument;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Resolve one package against the registry. Pure aside from the fetch, so the\n * decision table above is readable in one place.\n */\nasync function resolvePackage(\n  packageName: string,\n  ownVersion: string,\n): Promise<ResolvedVersion & { published: boolean; reachable: boolean }> {\n  const packument = await fetchPackument(packageName);\n\n  if (packument === undefined) {\n    return {\n      package: packageName,\n      version: fallbackRange(ownVersion),\n      source: \"range-fallback\",\n      published: true,\n      reachable: false,\n    };\n  }\n\n  if (packument === null) {\n    return {\n      package: packageName,\n      version: fallbackRange(ownVersion),\n      source: \"range-fallback\",\n      published: false,\n      reachable: true,\n    };\n  }\n\n  if (packument.versions?.[ownVersion]) {\n    return {\n      package: packageName,\n      version: ownVersion,\n      source: \"own-version\",\n      published: true,\n      reachable: true,\n    };\n  }\n\n  const latest = packument[\"dist-tags\"]?.latest;\n\n  if (latest) {\n    return {\n      package: packageName,\n      version: latest,\n      source: \"registry-latest\",\n      published: true,\n      reachable: true,\n    };\n  }\n\n  return {\n    package: packageName,\n    version: fallbackRange(ownVersion),\n    source: \"range-fallback\",\n    published: true,\n    reachable: true,\n  };\n}\n\n/**\n * Every `@warlock.js/*` dependency the template declares. Read from the\n * template rather than the copied project so resolution can start before (or\n * in parallel with) the copy.\n */\nexport function templateWarlockDependencies(): string[] {\n  const templatePackageJson = getJsonFile(\n    `${template(\"warlock\")}/package.json`,\n  ) as {\n    dependencies?: Record<string, string>;\n    devDependencies?: Record<string, string>;\n  };\n\n  const names = new Set<string>();\n\n  for (const field of [\"dependencies\", \"devDependencies\"] as const) {\n    for (const name of Object.keys(templatePackageJson[field] ?? {})) {\n      if (name.startsWith(\"@warlock.js/\")) names.add(name);\n    }\n  }\n\n  return [...names];\n}\n\n/** The scaffolder's own published version, i.e. the lockstep candidate. */\nexport function scaffolderVersion(): string {\n  return (getJsonFile(packageRoot(\"package.json\")) as { version: string })\n    .version;\n}\n\nlet cached: Promise<VersionResolution> | undefined;\n\n/**\n * Resolve the versions to stamp, once per process.\n *\n * Never throws and never blocks a scaffold: the worst case is the caret\n * fallback plus a note saying so.\n */\nexport function resolveWarlockVersions(\n  packages: string[] = templateWarlockDependencies(),\n  ownVersion: string = scaffolderVersion(),\n): Promise<VersionResolution> {\n  if (cached) return cached;\n\n  cached = (async (): Promise<VersionResolution> => {\n    const resolutions = await Promise.all(\n      packages.map(name => resolvePackage(name, ownVersion)),\n    );\n\n    const versions: Record<string, string> = {};\n    const notes: string[] = [];\n    const unpublished: string[] = [];\n    const substituted: ResolvedVersion[] = [];\n\n    let offline = false;\n\n    for (const resolution of resolutions) {\n      versions[resolution.package] = resolution.version;\n\n      if (!resolution.reachable) offline = true;\n      if (!resolution.published) unpublished.push(resolution.package);\n      if (resolution.source === \"registry-latest\") substituted.push(resolution);\n    }\n\n    if (offline) {\n      notes.push(\n        `Could not reach the npm registry — pinning @warlock.js/* to ${fallbackRange(ownVersion)} instead of an exact version.`,\n      );\n    }\n\n    if (substituted.length > 0) {\n      const latest = substituted[0].version;\n\n      notes.push(\n        `create-warlock ${ownVersion} is not published yet — pinning @warlock.js/* to the latest published version (${latest}).`,\n      );\n    }\n\n    if (unpublished.length > 0) {\n      notes.push(\n        `Not published on the registry: ${unpublished.join(\", \")} — the install will fail until they are released.`,\n      );\n    }\n\n    return { versions, notes, unpublished, offline };\n  })();\n\n  return cached;\n}\n\n/** Test/CLI seam: forget the memoized resolution. */\nexport function resetWarlockVersionsCache() {\n  cached = undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,MAAM,sBAAsB;;;;;AAM5B,SAAS,cAAsB;CAI7B,QAFE,QAAQ,IAAI,qBAAqB,KAAK,KAAK,6BAE9B,CAAC,QAAQ,QAAQ,EAAE;AACpC;;AAGA,SAAgB,cAAc,SAAyB;CACrD,MAAM,QAAQ,gBAAgB,KAAK,OAAO,CAAC,GAAG;CAE9C,OAAO,QAAQ,IAAI,MAAM,QAAQ;AACnC;;;;;;AAYA,eAAe,eACb,aACuC;CACvC,MAAM,MAAM,GAAG,YAAY,EAAE,GAAG,YAAY,QAAQ,KAAK,KAAK;CAE9D,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,SAAS,EAAE,QAAQ,sCAAsC;GACzD,QAAQ,YAAY,QAAQ,mBAAmB;EACjD,CAAC;EAID,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK,OAAO;EAE/D,IAAI,CAAC,SAAS,IAAI,OAAO;EAEzB,OAAQ,MAAM,SAAS,KAAK;CAC9B,QAAQ;EACN;CACF;AACF;;;;;AAMA,eAAe,eACb,aACA,YACuE;CACvE,MAAM,YAAY,MAAM,eAAe,WAAW;CAElD,IAAI,cAAc,QAChB,OAAO;EACL,SAAS;EACT,SAAS,cAAc,UAAU;EACjC,QAAQ;EACR,WAAW;EACX,WAAW;CACb;CAGF,IAAI,cAAc,MAChB,OAAO;EACL,SAAS;EACT,SAAS,cAAc,UAAU;EACjC,QAAQ;EACR,WAAW;EACX,WAAW;CACb;CAGF,IAAI,UAAU,WAAW,aACvB,OAAO;EACL,SAAS;EACT,SAAS;EACT,QAAQ;EACR,WAAW;EACX,WAAW;CACb;CAGF,MAAM,SAAS,UAAU,YAAY,EAAE;CAEvC,IAAI,QACF,OAAO;EACL,SAAS;EACT,SAAS;EACT,QAAQ;EACR,WAAW;EACX,WAAW;CACb;CAGF,OAAO;EACL,SAAS;EACT,SAAS,cAAc,UAAU;EACjC,QAAQ;EACR,WAAW;EACX,WAAW;CACb;AACF;;;;;;AAOA,SAAgB,8BAAwC;CACtD,MAAM,sBAAsB,YAC1B,GAAG,SAAS,SAAS,EAAE,cACzB;CAKA,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,SAAS,CAAC,gBAAgB,iBAAiB,GACpD,KAAK,MAAM,QAAQ,OAAO,KAAK,oBAAoB,UAAU,CAAC,CAAC,GAC7D,IAAI,KAAK,WAAW,cAAc,GAAG,MAAM,IAAI,IAAI;CAIvD,OAAO,CAAC,GAAG,KAAK;AAClB;;AAGA,SAAgB,oBAA4B;CAC1C,OAAQ,YAAY,YAAY,cAAc,CAAC,CAAC,CAC7C;AACL;AAEA,IAAI;;;;;;;AAQJ,SAAgB,uBACd,WAAqB,4BAA4B,GACjD,aAAqB,kBAAkB,GACX;CAC5B,IAAI,QAAQ,OAAO;CAEnB,UAAU,YAAwC;EAChD,MAAM,cAAc,MAAM,QAAQ,IAChC,SAAS,KAAI,SAAQ,eAAe,MAAM,UAAU,CAAC,CACvD;EAEA,MAAM,WAAmC,CAAC;EAC1C,MAAM,QAAkB,CAAC;EACzB,MAAM,cAAwB,CAAC;EAC/B,MAAM,cAAiC,CAAC;EAExC,IAAI,UAAU;EAEd,KAAK,MAAM,cAAc,aAAa;GACpC,SAAS,WAAW,WAAW,WAAW;GAE1C,IAAI,CAAC,WAAW,WAAW,UAAU;GACrC,IAAI,CAAC,WAAW,WAAW,YAAY,KAAK,WAAW,OAAO;GAC9D,IAAI,WAAW,WAAW,mBAAmB,YAAY,KAAK,UAAU;EAC1E;EAEA,IAAI,SACF,MAAM,KACJ,+DAA+D,cAAc,UAAU,EAAE,8BAC3F;EAGF,IAAI,YAAY,SAAS,GAAG;GAC1B,MAAM,SAAS,YAAY,EAAE,CAAC;GAE9B,MAAM,KACJ,kBAAkB,WAAW,iFAAiF,OAAO,GACvH;EACF;EAEA,IAAI,YAAY,SAAS,GACvB,MAAM,KACJ,kCAAkC,YAAY,KAAK,IAAI,EAAE,kDAC3D;EAGF,OAAO;GAAE;GAAU;GAAO;GAAa;EAAQ;CACjD,EAAC,CAAE;CAEH,OAAO;AACT"}

package/esm/index.mjs

@@ -79,7 +79,13 @@ function splitList(value) {
 	return value.split(",").map((item) => item.trim()).filter(Boolean);
 }
 function createApp() {
-	createNewApp(parseFlags(process.argv.slice(2)));
+	const flags = parseFlags(process.argv.slice(2));
+	Promise.resolve(createNewApp(flags)).catch((error) => {
+		console.error();
+		console.error(`  create-warlock failed: ${error?.message ?? String(error)}`);
+		console.error();
+		process.exit(1);
+	});
 }
 
 //#endregion

package/esm/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../create-warlock/src/index.ts"],"sourcesContent":["import createNewApp from \"./commands/create-new-app\";\nimport { CliFlags } from \"./commands/create-new-app/types\";\nimport { NO_DATABASE } from \"./features/database-drivers\";\n\nconst valueFlags = [\"name\", \"db\", \"pm\", \"features\", \"ai\"];\n\n/**\n * Parse the scaffolder's own CLI flags for non-interactive mode.\n *\n * @example\n * create-warlock my-app --db=postgres --features=test,herald --ai=openai,anthropic --yes\n */\nexport function parseFlags(argv: string[]): CliFlags {\n  const flags: CliFlags = {};\n  const positionals: string[] = [];\n\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n\n    if (!arg.startsWith(\"-\")) {\n      positionals.push(arg);\n      continue;\n    }\n\n    const equalIndex = arg.indexOf(\"=\");\n    const key = (equalIndex === -1 ? arg : arg.slice(0, equalIndex)).replace(/^-+/, \"\");\n    let value: string | undefined = equalIndex === -1 ? undefined : arg.slice(equalIndex + 1);\n\n    // Value-taking flags may use either `--key=value` or `--key value`.\n    if (valueFlags.includes(key) && value === undefined) {\n      const next = argv[i + 1];\n\n      if (next && !next.startsWith(\"-\")) {\n        value = next;\n        i++;\n      }\n    }\n\n    switch (key) {\n      case \"yes\":\n      case \"y\":\n        flags.yes = true;\n        break;\n      case \"git\":\n        flags.git = true;\n        break;\n      case \"no-git\":\n        flags.git = false;\n        break;\n      case \"jwt\":\n        flags.jwt = true;\n        break;\n      case \"no-jwt\":\n        flags.jwt = false;\n        break;\n      case \"name\":\n        flags.name = value;\n        break;\n      case \"db\":\n        flags.db = value;\n        break;\n      case \"no-db\":\n        // Opt out of a database entirely — equivalent to `--db=none`.\n        flags.db = NO_DATABASE;\n        break;\n      case \"pm\":\n        flags.pm = value;\n        break;\n      case \"features\":\n        flags.features = splitList(value);\n        break;\n      case \"ai\":\n        flags.ai = splitList(value);\n        break;\n    }\n  }\n\n  if (!flags.name && positionals.length > 0) {\n    flags.name = positionals[0];\n  }\n\n  return flags;\n}\n\nfunction splitList(value: string | undefined): string[] {\n  if (!value) return [];\n\n  return value\n    .split(\",\")\n    .map(item => item.trim())\n    .filter(Boolean);\n}\n\nexport default function createApp() {\n  const flags = parseFlags(process.argv.slice(2));\n\n  createNewApp(flags);\n}\n"],"mappings":";;;;AAIA,MAAM,aAAa;CAAC;CAAQ;CAAM;CAAM;CAAY;AAAI;;;;;;;AAQxD,SAAgB,WAAW,MAA0B;CACnD,MAAM,QAAkB,CAAC;CACzB,MAAM,cAAwB,CAAC;CAE/B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;EAEjB,IAAI,CAAC,IAAI,WAAW,GAAG,GAAG;GACxB,YAAY,KAAK,GAAG;GACpB;EACF;EAEA,MAAM,aAAa,IAAI,QAAQ,GAAG;EAClC,MAAM,OAAO,eAAe,KAAK,MAAM,IAAI,MAAM,GAAG,UAAU,EAAC,CAAE,QAAQ,OAAO,EAAE;EAClF,IAAI,QAA4B,eAAe,KAAK,SAAY,IAAI,MAAM,aAAa,CAAC;EAGxF,IAAI,WAAW,SAAS,GAAG,KAAK,UAAU,QAAW;GACnD,MAAM,OAAO,KAAK,IAAI;GAEtB,IAAI,QAAQ,CAAC,KAAK,WAAW,GAAG,GAAG;IACjC,QAAQ;IACR;GACF;EACF;EAEA,QAAQ,KAAR;GACE,KAAK;GACL,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,OAAO;IACb;GACF,KAAK;IACH,MAAM,KAAK;IACX;GACF,KAAK;IAEH,MAAM,KAAK;IACX;GACF,KAAK;IACH,MAAM,KAAK;IACX;GACF,KAAK;IACH,MAAM,WAAW,UAAU,KAAK;IAChC;GACF,KAAK;IACH,MAAM,KAAK,UAAU,KAAK;IAC1B;EACJ;CACF;CAEA,IAAI,CAAC,MAAM,QAAQ,YAAY,SAAS,GACtC,MAAM,OAAO,YAAY;CAG3B,OAAO;AACT;AAEA,SAAS,UAAU,OAAqC;CACtD,IAAI,CAAC,OAAO,OAAO,CAAC;CAEpB,OAAO,MACJ,MAAM,GAAG,CAAC,CACV,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,CACxB,OAAO,OAAO;AACnB;AAEA,SAAwB,YAAY;CAGlC,aAFc,WAAW,QAAQ,KAAK,MAAM,CAAC,CAE5B,CAAC;AACpB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../create-warlock/src/index.ts"],"sourcesContent":["import createNewApp from \"./commands/create-new-app\";\nimport { CliFlags } from \"./commands/create-new-app/types\";\nimport { NO_DATABASE } from \"./features/database-drivers\";\n\nconst valueFlags = [\"name\", \"db\", \"pm\", \"features\", \"ai\"];\n\n/**\n * Parse the scaffolder's own CLI flags for non-interactive mode.\n *\n * @example\n * create-warlock my-app --db=postgres --features=test,herald --ai=openai,anthropic --yes\n */\nexport function parseFlags(argv: string[]): CliFlags {\n  const flags: CliFlags = {};\n  const positionals: string[] = [];\n\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n\n    if (!arg.startsWith(\"-\")) {\n      positionals.push(arg);\n      continue;\n    }\n\n    const equalIndex = arg.indexOf(\"=\");\n    const key = (equalIndex === -1 ? arg : arg.slice(0, equalIndex)).replace(/^-+/, \"\");\n    let value: string | undefined = equalIndex === -1 ? undefined : arg.slice(equalIndex + 1);\n\n    // Value-taking flags may use either `--key=value` or `--key value`.\n    if (valueFlags.includes(key) && value === undefined) {\n      const next = argv[i + 1];\n\n      if (next && !next.startsWith(\"-\")) {\n        value = next;\n        i++;\n      }\n    }\n\n    switch (key) {\n      case \"yes\":\n      case \"y\":\n        flags.yes = true;\n        break;\n      case \"git\":\n        flags.git = true;\n        break;\n      case \"no-git\":\n        flags.git = false;\n        break;\n      case \"jwt\":\n        flags.jwt = true;\n        break;\n      case \"no-jwt\":\n        flags.jwt = false;\n        break;\n      case \"name\":\n        flags.name = value;\n        break;\n      case \"db\":\n        flags.db = value;\n        break;\n      case \"no-db\":\n        // Opt out of a database entirely — equivalent to `--db=none`.\n        flags.db = NO_DATABASE;\n        break;\n      case \"pm\":\n        flags.pm = value;\n        break;\n      case \"features\":\n        flags.features = splitList(value);\n        break;\n      case \"ai\":\n        flags.ai = splitList(value);\n        break;\n    }\n  }\n\n  if (!flags.name && positionals.length > 0) {\n    flags.name = positionals[0];\n  }\n\n  return flags;\n}\n\nfunction splitList(value: string | undefined): string[] {\n  if (!value) return [];\n\n  return value\n    .split(\",\")\n    .map(item => item.trim())\n    .filter(Boolean);\n}\n\nexport default function createApp() {\n  const flags = parseFlags(process.argv.slice(2));\n\n  // An unexpected throw must surface as a readable error AND a non-zero exit\n  // code — never as a stack trace the user scrolls past on the way to a green\n  // banner (there is no banner after this point).\n  Promise.resolve(createNewApp(flags)).catch((error: unknown) => {\n    console.error();\n    console.error(\n      `  create-warlock failed: ${(error as Error)?.message ?? String(error)}`,\n    );\n    console.error();\n\n    process.exit(1);\n  });\n}\n"],"mappings":";;;;AAIA,MAAM,aAAa;CAAC;CAAQ;CAAM;CAAM;CAAY;AAAI;;;;;;;AAQxD,SAAgB,WAAW,MAA0B;CACnD,MAAM,QAAkB,CAAC;CACzB,MAAM,cAAwB,CAAC;CAE/B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;EAEjB,IAAI,CAAC,IAAI,WAAW,GAAG,GAAG;GACxB,YAAY,KAAK,GAAG;GACpB;EACF;EAEA,MAAM,aAAa,IAAI,QAAQ,GAAG;EAClC,MAAM,OAAO,eAAe,KAAK,MAAM,IAAI,MAAM,GAAG,UAAU,EAAC,CAAE,QAAQ,OAAO,EAAE;EAClF,IAAI,QAA4B,eAAe,KAAK,SAAY,IAAI,MAAM,aAAa,CAAC;EAGxF,IAAI,WAAW,SAAS,GAAG,KAAK,UAAU,QAAW;GACnD,MAAM,OAAO,KAAK,IAAI;GAEtB,IAAI,QAAQ,CAAC,KAAK,WAAW,GAAG,GAAG;IACjC,QAAQ;IACR;GACF;EACF;EAEA,QAAQ,KAAR;GACE,KAAK;GACL,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,MAAM;IACZ;GACF,KAAK;IACH,MAAM,OAAO;IACb;GACF,KAAK;IACH,MAAM,KAAK;IACX;GACF,KAAK;IAEH,MAAM,KAAK;IACX;GACF,KAAK;IACH,MAAM,KAAK;IACX;GACF,KAAK;IACH,MAAM,WAAW,UAAU,KAAK;IAChC;GACF,KAAK;IACH,MAAM,KAAK,UAAU,KAAK;IAC1B;EACJ;CACF;CAEA,IAAI,CAAC,MAAM,QAAQ,YAAY,SAAS,GACtC,MAAM,OAAO,YAAY;CAG3B,OAAO;AACT;AAEA,SAAS,UAAU,OAAqC;CACtD,IAAI,CAAC,OAAO,OAAO,CAAC;CAEpB,OAAO,MACJ,MAAM,GAAG,CAAC,CACV,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,CACxB,OAAO,OAAO;AACnB;AAEA,SAAwB,YAAY;CAClC,MAAM,QAAQ,WAAW,QAAQ,KAAK,MAAM,CAAC,CAAC;CAK9C,QAAQ,QAAQ,aAAa,KAAK,CAAC,CAAC,CAAC,OAAO,UAAmB;EAC7D,QAAQ,MAAM;EACd,QAAQ,MACN,4BAA6B,OAAiB,WAAW,OAAO,KAAK,GACvE;EACA,QAAQ,MAAM;EAEd,QAAQ,KAAK,CAAC;CAChB,CAAC;AACH"}