create-warlock 5.29.0 → 5.30.0

package/esm/helpers/app.mjs

@@ -1,15 +1,15 @@
 import { getDatabaseDriver } from "../features/database-drivers.mjs";
-import { getPackageManager } from "./package-manager.mjs";
+import { getPackageManager, getPnpmVersion } from "./package-manager.mjs";
 import { executeCommand, runCommand } from "./exec.mjs";
 import { insertImportInSortedPosition } from "./insert-import.mjs";
 import { packageRoot, template } from "./paths.mjs";
-import { mergePnpmBuildApprovals, requiredPnpmBuildApprovals } from "./pnpm-build-approvals.mjs";
+import { BASE_PNPM_BUILD_APPROVALS, mergeOnlyBuiltDependencies, mergePackageJsonBuildApprovals, mergePnpmBuildApprovals, pnpmBuildApprovalLayout, requiredPnpmBuildApprovals } from "./pnpm-build-approvals.mjs";
 import { fallbackRange } from "./warlock-versions.mjs";
 import { copyDirectory, copyFile, fileExists, getFile, getJsonFile, putFile, putJsonFile, renameFile } from "@warlock.js/fs";
 import { existsSync, rmSync, unlinkSync } from "node:fs";
 import path from "path";
 
-//#region ../create-warlock/src/helpers/app.ts
+//#region ../../packages/create-warlock/src/helpers/app.ts
 /**
 * Environment for every install the scaffolder spawns.
 *
@@ -48,8 +48,31 @@ var App = class {
 		if (fileExists(this.path + "/.env.example")) copyFile(this.path + "/.env.example", this.path + "/.env");
 		renameFile(this.path + "/_.gitignore", this.path + "/.gitignore");
 		if (isInsidePnpmWorkspace(this.path)) rmSync(path.join(this.path, "pnpm-workspace.yaml"), { force: true });
+		else if (getPackageManager() === "pnpm") this.fitPnpmSettingsToVersion(BASE_PNPM_BUILD_APPROVALS);
 		return this;
 	}
+	/**
+	* Write install-script approvals where the user's pnpm reads them. The
+	* template ships the pnpm 10.26+ layout (settings-only pnpm-workspace.yaml
+	* with `allowBuilds`); see pnpmBuildApprovalLayout for what older versions
+	* need and why.
+	*/
+	fitPnpmSettingsToVersion(packages) {
+		const workspacePath = path.join(this.path, "pnpm-workspace.yaml");
+		const layout = pnpmBuildApprovalLayout(getPnpmVersion());
+		if (layout === "packageJson") {
+			rmSync(workspacePath, { force: true });
+			const packageJsonPath = path.join(this.path, "package.json");
+			putJsonFile(packageJsonPath, mergePackageJsonBuildApprovals(getJsonFile(packageJsonPath), packages));
+			delete this.jsonFiles[path.resolve(packageJsonPath)];
+			return;
+		}
+		if (!fileExists(workspacePath)) return;
+		const current = getFile(workspacePath);
+		let next = mergePnpmBuildApprovals(current, packages);
+		if (layout === "onlyBuiltDependencies") next = mergeOnlyBuiltDependencies(next, packages);
+		if (next !== current) putFile(workspacePath, next);
+	}
 	init() {
 		return this;
 	}
@@ -62,9 +85,8 @@ var App = class {
 		if (getPackageManager() !== "pnpm") return this;
 		const packages = requiredPnpmBuildApprovals(features);
 		if (packages.length === 0) return this;
-		const workspacePath = path.join(this.path, "pnpm-workspace.yaml");
-		if (!fileExists(workspacePath)) return this;
-		putFile(workspacePath, mergePnpmBuildApprovals(getFile(workspacePath), packages));
+		if (isInsidePnpmWorkspace(this.path)) return this;
+		this.fitPnpmSettingsToVersion(packages);
 		return this;
 	}
 	async exec(command) {

package/esm/helpers/app.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"app.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/app.ts"],"sourcesContent":["import {\n  copyDirectory,\n  copyFile,\n  fileExists,\n  getFile,\n  getJsonFile,\n  putFile,\n  putJsonFile,\n  renameFile,\n} from \"@warlock.js/fs\";\nimport { existsSync, rmSync, unlinkSync } from \"node:fs\";\nimport path from \"path\";\nimport { Application, AppOptions } from \"../commands/create-new-app/types\";\nimport { getDatabaseDriver } from \"../features/database-drivers\";\nimport { executeCommand, runCommand } from \"./exec\";\nimport { insertImportInSortedPosition } from \"./insert-import\";\nimport { getPackageManager } from \"./package-manager\";\nimport { packageRoot, Template, template } from \"./paths\";\nimport {\n  mergePnpmBuildApprovals,\n  requiredPnpmBuildApprovals,\n} from \"./pnpm-build-approvals\";\nimport { fallbackRange } from \"./warlock-versions\";\n\n/**\n * Environment for every install the scaffolder spawns.\n *\n * A shell that exports `NODE_ENV=production` makes the package managers skip\n * every devDependency — and still exit 0. The scaffolded project needs its dev\n * toolchain (typescript, vitest, eslint) to be usable at all, so the install\n * child is pinned to `development` regardless of the ambient environment. A\n * silently incomplete install that reports success is the exact failure mode\n * this file exists to prevent.\n */\nexport function installEnvironment(): NodeJS.ProcessEnv {\n  return { NODE_ENV: \"development\" };\n}\n\n/** True when any ancestor of `targetPath` (starting at its parent) has a pnpm-workspace.yaml. */\nexport function isInsidePnpmWorkspace(targetPath: string): boolean {\n  let dir = path.dirname(path.resolve(targetPath));\n\n  while (true) {\n    if (existsSync(path.join(dir, \"pnpm-workspace.yaml\"))) return true;\n    const parent = path.dirname(dir);\n    if (parent === dir) return false;\n    dir = parent;\n  }\n}\n\nexport class App {\n  /**\n   * Resolved files\n   */\n  protected files: Record<string, FileManager> = {};\n\n  /**\n   * Resolved JSON files\n   */\n  protected jsonFiles: Record<string, JsonFileManager> = {};\n\n  public isInstalled = false;\n\n  public constructor(protected app: Application) {}\n\n  public get options(): AppOptions {\n    return this.app.options;\n  }\n\n  public use(templateName: Template) {\n    copyDirectory(template(templateName), this.path);\n\n    if (fileExists(this.path + \"/.env.example\")) {\n      copyFile(this.path + \"/.env.example\", this.path + \"/.env\");\n    }\n\n    renameFile(this.path + \"/_.gitignore\", this.path + \"/.gitignore\");\n\n    // Inside an existing pnpm workspace the parent owns the policy; a per-app\n    // workspace file would nest a second workspace root.\n    if (isInsidePnpmWorkspace(this.path)) {\n      rmSync(path.join(this.path, \"pnpm-workspace.yaml\"), { force: true });\n    }\n\n    return this;\n  }\n\n  public init() {\n    return this;\n  }\n\n  public terminate() {\n    // No longer using outro, using showSuccessScreen instead\n  }\n\n  public install() {\n    return runCommand(getPackageManager(), [\"install\"], this.path, {\n      env: installEnvironment(),\n    });\n  }\n\n  /** Record native build approvals before pnpm installs selected feature dependencies. */\n  public approveSelectedFeatureBuilds(features: readonly string[]) {\n    if (getPackageManager() !== \"pnpm\") return this;\n    const packages = requiredPnpmBuildApprovals(features);\n    if (packages.length === 0) return this;\n    const workspacePath = path.join(this.path, \"pnpm-workspace.yaml\");\n    if (!fileExists(workspacePath)) return this;\n    const current = getFile(workspacePath) as string;\n    putFile(workspacePath, mergePnpmBuildApprovals(current, packages));\n    return this;\n  }\n\n  public async exec(command: string) {\n    const [commandName, ...optionsList] = command.split(\" \");\n    return await executeCommand(commandName, optionsList, this.path);\n  }\n\n  public async git() {\n    const { initializeGitRepository } =\n      await import(\"./project-builder-helpers\");\n    return await initializeGitRepository(this.path);\n  }\n\n  /**\n   * Write the project's `package.json`: the project name and the version of\n   * every `@warlock.js/*` dependency. No template script names a package\n   * manager, so nothing here depends on the one the user chose.\n   *\n   * `versions` comes from {@link resolveWarlockVersions} — versions the\n   * registry has confirmed exist. It is optional because the fluent chain is\n   * synchronous; without it every sibling gets the caret range floored to the\n   * scaffolder's major, which is always satisfiable by a published release.\n   *\n   * What it must NEVER do again is stamp the scaffolder's own version blind:\n   * the release tooling bumps that version on every build, published or not,\n   * so an unverified pin resolves to nothing and the install dies with ETARGET.\n   */\n  public updatePackageJson(versions: Record<string, string> = {}) {\n    const pkg = this.package.replace(\"name\", this.name.replaceAll(\"/\", \"-\"));\n\n    const content: any = pkg.content;\n\n    const warlockVersion: string = (\n      getJsonFile(packageRoot(\"package.json\")) as { version: string }\n    ).version;\n    const defaultRange = fallbackRange(warlockVersion);\n\n    for (const field of [\"dependencies\", \"devDependencies\"] as const) {\n      const deps = content[field] as Record<string, string> | undefined;\n      if (!deps) continue;\n\n      for (const dependency of Object.keys(deps)) {\n        if (dependency.startsWith(\"@warlock.js/\")) {\n          deps[dependency] = versions[dependency] ?? defaultRange;\n        }\n      }\n    }\n\n    pkg.save();\n\n    return this;\n  }\n\n  /**\n   * Configure the chosen database driver: wire `DB_DRIVER` / `DB_PORT` into\n   * `.env`, AND pin the driver's npm package (`mongodb` / `pg`) into the\n   * project's `package.json` dependencies.\n   *\n   * The dependency is written HERE — before the base `yarn install` — so the\n   * driver is pulled deterministically by the very first install. We do NOT\n   * rely on the post-copy `warlock add <driver> --no-install` + separate\n   * batched install, which can be skipped or fail and leave the driver\n   * missing (the \"mongodb package is not installed\" runtime error).\n   */\n  public configureDatabaseEnv(driverValue: string) {\n    const driver = getDatabaseDriver(driverValue);\n\n    if (!driver) return this;\n\n    // Pin the driver package into dependencies (idempotent — never downgrade).\n    const packageJsonPath = path.resolve(this.path, \"package.json\");\n    const packageJson = getJsonFile(packageJsonPath) as {\n      dependencies?: Record<string, string>;\n    };\n    packageJson.dependencies = packageJson.dependencies ?? {};\n    if (!packageJson.dependencies[driver.package]) {\n      packageJson.dependencies[driver.package] = driver.packageVersion;\n      putJsonFile(packageJsonPath, packageJson);\n    }\n\n    // Both files carry the driver defaults: `.env` is what runs, `.env.example`\n    // is what the next developer copies.\n    for (const fileName of [\".env\", \".env.example\"]) {\n      const envPath = this.path + \"/\" + fileName;\n      if (!fileExists(envPath)) continue;\n\n      let envContent = getFile(envPath) as string;\n\n      envContent = envContent.replace(\n        /DB_PORT=\\d+/,\n        `DB_PORT=${driver.defaultPort}`,\n      );\n\n      if (envContent.includes(\"DB_DRIVER=\")) {\n        envContent = envContent.replace(\n          /DB_DRIVER=\\w*/,\n          `DB_DRIVER=${driver.value}`,\n        );\n      } else {\n        envContent = envContent.replace(\n          /DB_PORT=\\d+/,\n          `DB_PORT=${driver.defaultPort}\\nDB_DRIVER=${driver.value}`,\n        );\n      }\n\n      // DB_AUTH is Mongo's authSource; no other driver reads it.\n      if (driver.value !== \"mongodb\") {\n        envContent = envContent.replace(/^DB_AUTH=.*\\r?\\n?/m, \"\");\n      }\n\n      putFile(envPath, envContent);\n    }\n\n    return this;\n  }\n\n  /**\n   * Write the correct `src/config/database.ts` for the chosen driver and remove\n   * every per-driver variant so the scaffold ships exactly one config file.\n   *\n   * The template ships a Mongo-shaped `database.ts` (the default) plus a\n   * `database.postgres.ts` variant. Mongo keeps the default in place; Postgres\n   * overwrites `database.ts` with the Postgres-shaped variant (typed\n   * `ConnectionOptions`, `driver: \"postgres\"`, port 5432, no Mongo-only keys —\n   * no `authSource`, `driverOptions`, `replicaSet`, `randomIncrement` /\n   * `initialId`). Either way the `.postgres` variant file is deleted afterwards\n   * so no leftover config ships in the generated project.\n   *\n   * For Postgres it also corrects the working `.env`: the Mongo template ships\n   * `DB_AUTH=admin`, an `authSource` value Postgres ignores and its config no\n   * longer reads, so the line is dropped to keep `.env` and the config in sync.\n   * The port is rewritten by {@link configureDatabaseEnv} (driver defaultPort),\n   * which runs alongside this in the same branch.\n   */\n  public configureDatabaseConfig(driverValue: string) {\n    const configDir = path.resolve(this.path, \"src/config\");\n    const databasePath = path.resolve(configDir, \"database.ts\");\n    const postgresVariantPath = path.resolve(configDir, \"database.postgres.ts\");\n\n    if (driverValue === \"postgres\" && fileExists(postgresVariantPath)) {\n      putFile(databasePath, getFile(postgresVariantPath) as string);\n\n      const envPath = this.path + \"/.env\";\n\n      if (fileExists(envPath)) {\n        const envContent = getFile(envPath) as string;\n        // Drop the Mongo-only DB_AUTH line entirely (its whole line, so no blank\n        // gap is left behind). Postgres has no authSource concept.\n        putFile(envPath, envContent.replace(/^DB_AUTH=.*\\r?\\n?/m, \"\"));\n      }\n    }\n\n    // Whatever the driver, no per-driver variant may survive into the scaffold.\n    if (fileExists(postgresVariantPath)) {\n      unlinkSync(postgresVariantPath);\n    }\n\n    return this;\n  }\n\n  /**\n   * Remove the database layer for a \"no database\" scaffold.\n   *\n   * Deletes `src/config/database.ts` (and a `.tsx` / per-driver variant if\n   * present) from the freshly-copied template. The framework's database\n   * connector is config-gated on that file — with it gone,\n   * `config.get(\"database\")` is undefined and the connector no-ops, so the app\n   * boots with no database wired and no driver package pulled. The `DB_*` lines\n   * in `.env` are left in place (harmless: no config reads them) as a ready\n   * template for adding a database back later.\n   */\n  public removeDatabaseConfig() {\n    const configDir = path.resolve(this.path, \"src/config\");\n\n    for (const fileName of [\n      \"database.ts\",\n      \"database.tsx\",\n      \"database.postgres.ts\",\n    ]) {\n      const filePath = path.resolve(configDir, fileName);\n\n      if (fileExists(filePath)) {\n        unlinkSync(filePath);\n      }\n    }\n\n    return this;\n  }\n\n  /**\n   * Configure the web starter only when the web feature owns `/`.\n   *\n   * A dependency-free HTTP response is retained without web; otherwise the\n   * SSR page loader owns the route.\n   * Exactly one survives the scaffold: web projects keep the SSR page and API\n   * example; every other project keeps the dependency-free JSON controller.\n   */\n  public configureWebStarter(useWeb: boolean) {\n    const remove = (relativePath: string) => {\n      const target = path.resolve(this.path, relativePath);\n      if (existsSync(target)) rmSync(target, { recursive: true, force: true });\n    };\n\n    if (!useWeb) {\n      for (const entry of [\n        \"src/web\",\n        \"src/app/contact\",\n        \"src/app/locale\",\n        \"src/shared/contact.schema.ts\",\n        \"src/shared/locale.schema.ts\",\n        \"src/shared/locales.ts\",\n        \"postcss.config.mjs\",\n        \"skills/web-code-standards\",\n      ]) {\n        remove(entry);\n      }\n\n      const agentsPath = path.resolve(this.path, \"AGENTS.md\");\n      const agents = getFile(agentsPath) as string;\n      putFile(\n        agentsPath,\n        agents.replace(/^.*\\*\\*web-code-standards\\*\\*.*\\r?\\n/m, \"\"),\n      );\n\n      const tsconfigPath = path.resolve(this.path, \"tsconfig.json\");\n      const tsconfig = getFile(tsconfigPath) as string;\n      putFile(\n        tsconfigPath,\n        tsconfig\n          .replace('      \"web/*\": [\"./src/web/*\"],\\n', \"\")\n          .replace('      \"@shared/*\": [\"./src/shared/*\"]\\n', \"\"),\n      );\n\n      return this;\n    }\n\n    // The SSR page owns `/`; its loader still uses src/app/home/services.\n    remove(\"src/app/home/controllers/home-page.controller.ts\");\n    remove(\"src/app/home/routes.ts\");\n\n    const packageJsonPath = path.resolve(this.path, \"package.json\");\n    const packageJson = getJsonFile(packageJsonPath) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n    packageJson.dependencies = {\n      ...packageJson.dependencies,\n      \"@mongez/http\": \"^3.5.0\",\n      \"@mongez/react-form\": \"^4.0.0\",\n    };\n    packageJson.devDependencies = {\n      ...packageJson.devDependencies,\n      \"@tailwindcss/postcss\": \"^4.1.16\",\n      tailwindcss: \"^4.1.16\",\n    };\n    putJsonFile(packageJsonPath, packageJson);\n\n    const configPath = path.resolve(this.path, \"warlock.config.ts\");\n    const config = getFile(configPath) as string;\n    if (!config.includes('\"@warlock.js/web/connector\"')) {\n      // Inserted in sorted position, not prepended. The generated app formats\n      // with `prettier-plugin-organize-imports`, so an import pushed to the top\n      // of a file that already imports `@warlock.js/auth` and `@warlock.js/core`\n      // is out of order the moment it is written — and the developer meets it as\n      // a `prettier/prettier` error on their first `warlock dev`, in a file they\n      // did not write.\n      const withConnector = insertImportInSortedPosition(\n        config,\n        'import { webConnector } from \"@warlock.js/web/connector\";',\n        \"@warlock.js/web/connector\",\n      );\n\n      putFile(\n        configPath,\n        withConnector.replace(\n          \"export default defineConfig({\",\n          \"export default defineConfig({\\n  connectors: [webConnector()],\",\n        ),\n      );\n    }\n\n    return this;\n  }\n\n  /**\n   * Record non-default `agent-kit` targets into the generated `package.json`'s\n   * `agentKit.targets` block.\n   *\n   * The template's own `postinstall` (`agent-kit init && agent-kit sync`)\n   * already targets `claude` with no flags, so the single-target default case\n   * needs no template edit at all — this only writes when the selection is\n   * anything else, keeping the scaffold diff-free for the common path.\n   */\n  public configureAgentKitTargets(agents: string[]) {\n    const isDefault = agents.length === 1 && agents[0] === \"claude\";\n    if (isDefault) return this;\n\n    const packageJsonPath = path.resolve(this.path, \"package.json\");\n    if (!fileExists(packageJsonPath)) return this;\n\n    const packageJson = getJsonFile(packageJsonPath) as {\n      agentKit?: { targets?: string[] };\n    };\n    packageJson.agentKit = { ...packageJson.agentKit, targets: agents };\n    putJsonFile(packageJsonPath, packageJson);\n\n    return this;\n  }\n\n  /**\n   * Install the selected optional features by delegating to the project's own\n   * `warlock add`. `--no-install` records every dependency in package.json and\n   * ejects configs / scripts / setup hooks WITHOUT installing — the caller runs\n   * one batched install afterwards. Versions come from core's feature map, so\n   * the scaffolder never duplicates them.\n   *\n   * `--no-install` is passed LAST on purpose: the CLI parser treats the\n   * positional after a bare flag as that flag's value, so it must follow the\n   * feature list, not precede it.\n   */\n  public async installFeatures(features: string[]) {\n    if (features.length === 0) return true;\n\n    return this.exec(`npx warlock add ${features.join(\" \")} --no-install`);\n  }\n\n  /**\n   * Force a single copy of `vite` when the project ends up with BOTH `vite`\n   * (written by the `web` feature) and `vitest` (always in the template).\n   *\n   * `vitest` depends on vite through a wide range of its own\n   * (`^6 || ^7 || ^8`), which resolves to a DIFFERENT major than the range the\n   * feature map pins. Yarn 1 then has to nest the second copy under\n   * `vitest/node_modules` and dies on its own linker invariant:\n   *\n   *     error Invariant Violation: could not find a copy of vite to link in\n   *       <project>/node_modules/vitest/node_modules\n   *\n   * It aborts BEFORE `node_modules/.bin` is written, so `warlock` is never\n   * linked and the very first `yarn dev` fails with \"'warlock' is not\n   * recognized\". npm and pnpm nest happily and never hit this — for them the\n   * `overrides` twin below is one copy instead of two, not a crash fix.\n   *\n   * The pin is READ BACK from whatever range the project's own package.json\n   * declares, never re-stated as a literal here: the feature map in\n   * `@warlock.js/core` owns the version, and a second copy of it would drift\n   * the moment that one moves.\n   *\n   * Returns whether a pin was written, so the caller (and its spec) can assert\n   * it instead of assuming it.\n   */\n  public pinViteResolution() {\n    const packageJsonPath = path.resolve(this.path, \"package.json\");\n\n    if (!fileExists(packageJsonPath)) return false;\n\n    const packageJson = getJsonFile(packageJsonPath) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n      resolutions?: Record<string, string>;\n      overrides?: Record<string, string>;\n    };\n\n    const declaredRange = (name: string) =>\n      packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];\n\n    const viteRange = declaredRange(\"vite\");\n\n    // No vite, or no vitest to conflict with it — nothing to pin. Writing a\n    // resolution for a package the project does not depend on would only\n    // freeze a transitive tree nobody asked us to freeze.\n    if (!viteRange || !declaredRange(\"vitest\")) return false;\n\n    // yarn 1 / yarn berry read `resolutions`; npm 8+ and pnpm read `overrides`.\n    packageJson.resolutions = { ...packageJson.resolutions, vite: viteRange };\n    packageJson.overrides = { ...packageJson.overrides, vite: viteRange };\n\n    putJsonFile(packageJsonPath, packageJson);\n\n    return true;\n  }\n\n  /**\n   * Get package json file\n   */\n  public get package() {\n    return this.json(\"package.json\");\n  }\n\n  public updateDotEnv() {\n    this.file(\".env\").replaceAll(\"appName\", this.name).save();\n\n    return this;\n  }\n\n  /**\n   * Get env file to update\n   */\n  public get env() {\n    return this.file(\".env\");\n  }\n\n  public get name() {\n    return this.app.appName;\n  }\n\n  public get path() {\n    return this.app.appPath;\n  }\n\n  public file(relativePath: string) {\n    const fullPath = path.resolve(this.path, relativePath);\n\n    if (!this.files[fullPath]) {\n      this.files[fullPath] = file(fullPath);\n    }\n\n    return this.files[fullPath];\n  }\n\n  public json(relativePath: string): JsonFileManager {\n    const fullPath = path.resolve(this.path, relativePath);\n\n    if (!this.jsonFiles[fullPath]) {\n      this.jsonFiles[fullPath] = jsonFile(fullPath);\n    }\n\n    return this.jsonFiles[fullPath];\n  }\n}\n\nexport function app(app: Application) {\n  return new App(app);\n}\n\nexport class FileManager {\n  public content!: string;\n  public constructor(protected filePath: string) {\n    this.parseContent();\n  }\n\n  protected parseContent() {\n    this.content = getFile(this.filePath) as string;\n  }\n\n  public replace(search: string, replace: string) {\n    this.content = this.content.replace(search, replace);\n\n    return this;\n  }\n\n  public replaceAll(search: string, replace: string) {\n    this.content = this.content.replaceAll(search, replace);\n\n    return this;\n  }\n\n  public save() {\n    putFile(this.filePath, this.content);\n  }\n}\n\nexport class JsonFileManager extends FileManager {\n  protected parseContent() {\n    this.content = getJsonFile(this.filePath);\n  }\n\n  public save() {\n    putJsonFile(this.filePath, this.content);\n  }\n\n  public has(key: string) {\n    return this.content[key] !== undefined;\n  }\n\n  public replace(key: string, value: any) {\n    this.content[key] = value;\n\n    return this;\n  }\n\n  public replaceAll(key: string, value: any) {\n    const contentAsString = JSON.stringify(this.content);\n\n    this.content = JSON.parse(contentAsString.replaceAll(key, value));\n\n    return this;\n  }\n}\n\nexport function file(path: string) {\n  return new FileManager(path);\n}\n\nexport function jsonFile(path: string) {\n  return new JsonFileManager(path);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,qBAAwC;CACtD,OAAO,EAAE,UAAU,cAAc;AACnC;;AAGA,SAAgB,sBAAsB,YAA6B;CACjE,IAAI,MAAM,KAAK,QAAQ,KAAK,QAAQ,UAAU,CAAC;CAE/C,OAAO,MAAM;EACX,IAAI,WAAW,KAAK,KAAK,KAAK,qBAAqB,CAAC,GAAG,OAAO;EAC9D,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,IAAI,WAAW,KAAK,OAAO;EAC3B,MAAM;CACR;AACF;AAEA,IAAa,MAAb,MAAiB;CAaf,AAAO,YAAY,AAAU,KAAkB;EAAlB;eATkB,CAAC;mBAKO,CAAC;qBAEnC;CAE2B;CAEhD,IAAW,UAAsB;EAC/B,OAAO,KAAK,IAAI;CAClB;CAEA,AAAO,IAAI,cAAwB;EACjC,cAAc,SAAS,YAAY,GAAG,KAAK,IAAI;EAE/C,IAAI,WAAW,KAAK,OAAO,eAAe,GACxC,SAAS,KAAK,OAAO,iBAAiB,KAAK,OAAO,OAAO;EAG3D,WAAW,KAAK,OAAO,gBAAgB,KAAK,OAAO,aAAa;EAIhE,IAAI,sBAAsB,KAAK,IAAI,GACjC,OAAO,KAAK,KAAK,KAAK,MAAM,qBAAqB,GAAG,EAAE,OAAO,KAAK,CAAC;EAGrE,OAAO;CACT;CAEA,AAAO,OAAO;EACZ,OAAO;CACT;CAEA,AAAO,YAAY,CAEnB;CAEA,AAAO,UAAU;EACf,OAAO,WAAW,kBAAkB,GAAG,CAAC,SAAS,GAAG,KAAK,MAAM,EAC7D,KAAK,mBAAmB,EAC1B,CAAC;CACH;;CAGA,AAAO,6BAA6B,UAA6B;EAC/D,IAAI,kBAAkB,MAAM,QAAQ,OAAO;EAC3C,MAAM,WAAW,2BAA2B,QAAQ;EACpD,IAAI,SAAS,WAAW,GAAG,OAAO;EAClC,MAAM,gBAAgB,KAAK,KAAK,KAAK,MAAM,qBAAqB;EAChE,IAAI,CAAC,WAAW,aAAa,GAAG,OAAO;EAEvC,QAAQ,eAAe,wBADP,QAAQ,aAC6B,GAAG,QAAQ,CAAC;EACjE,OAAO;CACT;CAEA,MAAa,KAAK,SAAiB;EACjC,MAAM,CAAC,aAAa,GAAG,eAAe,QAAQ,MAAM,GAAG;EACvD,OAAO,MAAM,eAAe,aAAa,aAAa,KAAK,IAAI;CACjE;CAEA,MAAa,MAAM;EACjB,MAAM,EAAE,4BACN,MAAM,OAAO;EACf,OAAO,MAAM,wBAAwB,KAAK,IAAI;CAChD;;;;;;;;;;;;;;;CAgBA,AAAO,kBAAkB,WAAmC,CAAC,GAAG;EAC9D,MAAM,MAAM,KAAK,QAAQ,QAAQ,QAAQ,KAAK,KAAK,WAAW,KAAK,GAAG,CAAC;EAEvE,MAAM,UAAe,IAAI;EAEzB,MAAM,iBACJ,YAAY,YAAY,cAAc,CAAC,CAAC,CACxC;EACF,MAAM,eAAe,cAAc,cAAc;EAEjD,KAAK,MAAM,SAAS,CAAC,gBAAgB,iBAAiB,GAAY;GAChE,MAAM,OAAO,QAAQ;GACrB,IAAI,CAAC,MAAM;GAEX,KAAK,MAAM,cAAc,OAAO,KAAK,IAAI,GACvC,IAAI,WAAW,WAAW,cAAc,GACtC,KAAK,cAAc,SAAS,eAAe;EAGjD;EAEA,IAAI,KAAK;EAET,OAAO;CACT;;;;;;;;;;;;CAaA,AAAO,qBAAqB,aAAqB;EAC/C,MAAM,SAAS,kBAAkB,WAAW;EAE5C,IAAI,CAAC,QAAQ,OAAO;EAGpB,MAAM,kBAAkB,KAAK,QAAQ,KAAK,MAAM,cAAc;EAC9D,MAAM,cAAc,YAAY,eAAe;EAG/C,YAAY,eAAe,YAAY,gBAAgB,CAAC;EACxD,IAAI,CAAC,YAAY,aAAa,OAAO,UAAU;GAC7C,YAAY,aAAa,OAAO,WAAW,OAAO;GAClD,YAAY,iBAAiB,WAAW;EAC1C;EAIA,KAAK,MAAM,YAAY,CAAC,QAAQ,cAAc,GAAG;GAC/C,MAAM,UAAU,KAAK,OAAO,MAAM;GAClC,IAAI,CAAC,WAAW,OAAO,GAAG;GAE1B,IAAI,aAAa,QAAQ,OAAO;GAEhC,aAAa,WAAW,QACtB,eACA,WAAW,OAAO,aACpB;GAEA,IAAI,WAAW,SAAS,YAAY,GAClC,aAAa,WAAW,QACtB,iBACA,aAAa,OAAO,OACtB;QAEA,aAAa,WAAW,QACtB,eACA,WAAW,OAAO,YAAY,cAAc,OAAO,OACrD;GAIF,IAAI,OAAO,UAAU,WACnB,aAAa,WAAW,QAAQ,sBAAsB,EAAE;GAG1D,QAAQ,SAAS,UAAU;EAC7B;EAEA,OAAO;CACT;;;;;;;;;;;;;;;;;;;CAoBA,AAAO,wBAAwB,aAAqB;EAClD,MAAM,YAAY,KAAK,QAAQ,KAAK,MAAM,YAAY;EACtD,MAAM,eAAe,KAAK,QAAQ,WAAW,aAAa;EAC1D,MAAM,sBAAsB,KAAK,QAAQ,WAAW,sBAAsB;EAE1E,IAAI,gBAAgB,cAAc,WAAW,mBAAmB,GAAG;GACjE,QAAQ,cAAc,QAAQ,mBAAmB,CAAW;GAE5D,MAAM,UAAU,KAAK,OAAO;GAE5B,IAAI,WAAW,OAAO,GAIpB,QAAQ,SAHW,QAAQ,OAGD,CAAC,CAAC,QAAQ,sBAAsB,EAAE,CAAC;EAEjE;EAGA,IAAI,WAAW,mBAAmB,GAChC,WAAW,mBAAmB;EAGhC,OAAO;CACT;;;;;;;;;;;;CAaA,AAAO,uBAAuB;EAC5B,MAAM,YAAY,KAAK,QAAQ,KAAK,MAAM,YAAY;EAEtD,KAAK,MAAM,YAAY;GACrB;GACA;GACA;EACF,GAAG;GACD,MAAM,WAAW,KAAK,QAAQ,WAAW,QAAQ;GAEjD,IAAI,WAAW,QAAQ,GACrB,WAAW,QAAQ;EAEvB;EAEA,OAAO;CACT;;;;;;;;;CAUA,AAAO,oBAAoB,QAAiB;EAC1C,MAAM,UAAU,iBAAyB;GACvC,MAAM,SAAS,KAAK,QAAQ,KAAK,MAAM,YAAY;GACnD,IAAI,WAAW,MAAM,GAAG,OAAO,QAAQ;IAAE,WAAW;IAAM,OAAO;GAAK,CAAC;EACzE;EAEA,IAAI,CAAC,QAAQ;GACX,KAAK,MAAM,SAAS;IAClB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACF,GACE,OAAO,KAAK;GAGd,MAAM,aAAa,KAAK,QAAQ,KAAK,MAAM,WAAW;GAEtD,QACE,YAFa,QAAQ,UAGhB,CAAC,CAAC,QAAQ,yCAAyC,EAAE,CAC5D;GAEA,MAAM,eAAe,KAAK,QAAQ,KAAK,MAAM,eAAe;GAE5D,QACE,cAFe,QAAQ,YAGhB,CAAC,CACL,QAAQ,yCAAqC,EAAE,CAAC,CAChD,QAAQ,+CAA2C,EAAE,CAC1D;GAEA,OAAO;EACT;EAGA,OAAO,kDAAkD;EACzD,OAAO,wBAAwB;EAE/B,MAAM,kBAAkB,KAAK,QAAQ,KAAK,MAAM,cAAc;EAC9D,MAAM,cAAc,YAAY,eAAe;EAI/C,YAAY,eAAe;GACzB,GAAG,YAAY;GACf,gBAAgB;GAChB,sBAAsB;EACxB;EACA,YAAY,kBAAkB;GAC5B,GAAG,YAAY;GACf,wBAAwB;GACxB,aAAa;EACf;EACA,YAAY,iBAAiB,WAAW;EAExC,MAAM,aAAa,KAAK,QAAQ,KAAK,MAAM,mBAAmB;EAC9D,MAAM,SAAS,QAAQ,UAAU;EACjC,IAAI,CAAC,OAAO,SAAS,+BAA6B,GAahD,QACE,YAPoB,6BACpB,QACA,+DACA,2BAKY,CAAC,CAAC,QACZ,iCACA,gEACF,CACF;EAGF,OAAO;CACT;;;;;;;;;;CAWA,AAAO,yBAAyB,QAAkB;EAEhD,IADkB,OAAO,WAAW,KAAK,OAAO,OAAO,UACxC,OAAO;EAEtB,MAAM,kBAAkB,KAAK,QAAQ,KAAK,MAAM,cAAc;EAC9D,IAAI,CAAC,WAAW,eAAe,GAAG,OAAO;EAEzC,MAAM,cAAc,YAAY,eAAe;EAG/C,YAAY,WAAW;GAAE,GAAG,YAAY;GAAU,SAAS;EAAO;EAClE,YAAY,iBAAiB,WAAW;EAExC,OAAO;CACT;;;;;;;;;;;;CAaA,MAAa,gBAAgB,UAAoB;EAC/C,IAAI,SAAS,WAAW,GAAG,OAAO;EAElC,OAAO,KAAK,KAAK,mBAAmB,SAAS,KAAK,GAAG,EAAE,cAAc;CACvE;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BA,AAAO,oBAAoB;EACzB,MAAM,kBAAkB,KAAK,QAAQ,KAAK,MAAM,cAAc;EAE9D,IAAI,CAAC,WAAW,eAAe,GAAG,OAAO;EAEzC,MAAM,cAAc,YAAY,eAAe;EAO/C,MAAM,iBAAiB,SACrB,YAAY,eAAe,SAAS,YAAY,kBAAkB;EAEpE,MAAM,YAAY,cAAc,MAAM;EAKtC,IAAI,CAAC,aAAa,CAAC,cAAc,QAAQ,GAAG,OAAO;EAGnD,YAAY,cAAc;GAAE,GAAG,YAAY;GAAa,MAAM;EAAU;EACxE,YAAY,YAAY;GAAE,GAAG,YAAY;GAAW,MAAM;EAAU;EAEpE,YAAY,iBAAiB,WAAW;EAExC,OAAO;CACT;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,KAAK,cAAc;CACjC;CAEA,AAAO,eAAe;EACpB,KAAK,KAAK,MAAM,CAAC,CAAC,WAAW,WAAW,KAAK,IAAI,CAAC,CAAC,KAAK;EAExD,OAAO;CACT;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,KAAK,MAAM;CACzB;CAEA,IAAW,OAAO;EAChB,OAAO,KAAK,IAAI;CAClB;CAEA,IAAW,OAAO;EAChB,OAAO,KAAK,IAAI;CAClB;CAEA,AAAO,KAAK,cAAsB;EAChC,MAAM,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;EAErD,IAAI,CAAC,KAAK,MAAM,WACd,KAAK,MAAM,YAAY,KAAK,QAAQ;EAGtC,OAAO,KAAK,MAAM;CACpB;CAEA,AAAO,KAAK,cAAuC;EACjD,MAAM,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;EAErD,IAAI,CAAC,KAAK,UAAU,WAClB,KAAK,UAAU,YAAY,SAAS,QAAQ;EAG9C,OAAO,KAAK,UAAU;CACxB;AACF;AAMA,IAAa,cAAb,MAAyB;CAEvB,AAAO,YAAY,AAAU,UAAkB;EAAlB;EAC3B,KAAK,aAAa;CACpB;CAEA,AAAU,eAAe;EACvB,KAAK,UAAU,QAAQ,KAAK,QAAQ;CACtC;CAEA,AAAO,QAAQ,QAAgB,SAAiB;EAC9C,KAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,OAAO;EAEnD,OAAO;CACT;CAEA,AAAO,WAAW,QAAgB,SAAiB;EACjD,KAAK,UAAU,KAAK,QAAQ,WAAW,QAAQ,OAAO;EAEtD,OAAO;CACT;CAEA,AAAO,OAAO;EACZ,QAAQ,KAAK,UAAU,KAAK,OAAO;CACrC;AACF;AAEA,IAAa,kBAAb,cAAqC,YAAY;CAC/C,AAAU,eAAe;EACvB,KAAK,UAAU,YAAY,KAAK,QAAQ;CAC1C;CAEA,AAAO,OAAO;EACZ,YAAY,KAAK,UAAU,KAAK,OAAO;CACzC;CAEA,AAAO,IAAI,KAAa;EACtB,OAAO,KAAK,QAAQ,SAAS;CAC/B;CAEA,AAAO,QAAQ,KAAa,OAAY;EACtC,KAAK,QAAQ,OAAO;EAEpB,OAAO;CACT;CAEA,AAAO,WAAW,KAAa,OAAY;EACzC,MAAM,kBAAkB,KAAK,UAAU,KAAK,OAAO;EAEnD,KAAK,UAAU,KAAK,MAAM,gBAAgB,WAAW,KAAK,KAAK,CAAC;EAEhE,OAAO;CACT;AACF;AAEA,SAAgB,KAAK,MAAc;CACjC,OAAO,IAAI,YAAY,IAAI;AAC7B;AAEA,SAAgB,SAAS,MAAc;CACrC,OAAO,IAAI,gBAAgB,IAAI;AACjC"}
+{"version":3,"file":"app.mjs","names":[],"sources":["../../../../../../../packages/create-warlock/src/helpers/app.ts"],"sourcesContent":["import {\n  copyDirectory,\n  copyFile,\n  fileExists,\n  getFile,\n  getJsonFile,\n  putFile,\n  putJsonFile,\n  renameFile,\n} from \"@warlock.js/fs\";\nimport { existsSync, rmSync, unlinkSync } from \"node:fs\";\nimport path from \"path\";\nimport { Application, AppOptions } from \"../commands/create-new-app/types\";\nimport { getDatabaseDriver } from \"../features/database-drivers\";\nimport { executeCommand, runCommand } from \"./exec\";\nimport { insertImportInSortedPosition } from \"./insert-import\";\nimport { getPackageManager, getPnpmVersion } from \"./package-manager\";\nimport { packageRoot, Template, template } from \"./paths\";\nimport {\n  BASE_PNPM_BUILD_APPROVALS,\n  mergeOnlyBuiltDependencies,\n  mergePackageJsonBuildApprovals,\n  mergePnpmBuildApprovals,\n  pnpmBuildApprovalLayout,\n  requiredPnpmBuildApprovals,\n} from \"./pnpm-build-approvals\";\nimport { fallbackRange } from \"./warlock-versions\";\n\n/**\n * Environment for every install the scaffolder spawns.\n *\n * A shell that exports `NODE_ENV=production` makes the package managers skip\n * every devDependency — and still exit 0. The scaffolded project needs its dev\n * toolchain (typescript, vitest, eslint) to be usable at all, so the install\n * child is pinned to `development` regardless of the ambient environment. A\n * silently incomplete install that reports success is the exact failure mode\n * this file exists to prevent.\n */\nexport function installEnvironment(): NodeJS.ProcessEnv {\n  return { NODE_ENV: \"development\" };\n}\n\n/** True when any ancestor of `targetPath` (starting at its parent) has a pnpm-workspace.yaml. */\nexport function isInsidePnpmWorkspace(targetPath: string): boolean {\n  let dir = path.dirname(path.resolve(targetPath));\n\n  while (true) {\n    if (existsSync(path.join(dir, \"pnpm-workspace.yaml\"))) return true;\n    const parent = path.dirname(dir);\n    if (parent === dir) return false;\n    dir = parent;\n  }\n}\n\nexport class App {\n  /**\n   * Resolved files\n   */\n  protected files: Record<string, FileManager> = {};\n\n  /**\n   * Resolved JSON files\n   */\n  protected jsonFiles: Record<string, JsonFileManager> = {};\n\n  public isInstalled = false;\n\n  public constructor(protected app: Application) {}\n\n  public get options(): AppOptions {\n    return this.app.options;\n  }\n\n  public use(templateName: Template) {\n    copyDirectory(template(templateName), this.path);\n\n    if (fileExists(this.path + \"/.env.example\")) {\n      copyFile(this.path + \"/.env.example\", this.path + \"/.env\");\n    }\n\n    renameFile(this.path + \"/_.gitignore\", this.path + \"/.gitignore\");\n\n    // Inside an existing pnpm workspace the parent owns the policy; a per-app\n    // workspace file would nest a second workspace root.\n    if (isInsidePnpmWorkspace(this.path)) {\n      rmSync(path.join(this.path, \"pnpm-workspace.yaml\"), { force: true });\n    } else if (getPackageManager() === \"pnpm\") {\n      this.fitPnpmSettingsToVersion(BASE_PNPM_BUILD_APPROVALS);\n    }\n\n    return this;\n  }\n\n  /**\n   * Write install-script approvals where the user's pnpm reads them. The\n   * template ships the pnpm 10.26+ layout (settings-only pnpm-workspace.yaml\n   * with `allowBuilds`); see pnpmBuildApprovalLayout for what older versions\n   * need and why.\n   */\n  protected fitPnpmSettingsToVersion(packages: readonly string[]) {\n    const workspacePath = path.join(this.path, \"pnpm-workspace.yaml\");\n    const layout = pnpmBuildApprovalLayout(getPnpmVersion());\n\n    if (layout === \"packageJson\") {\n      // pnpm 7-10.4 refuse a workspace file without `packages:`, and adding\n      // one breaks `pnpm add` in the app. The template's other setting,\n      // minimumReleaseAgeExclude, does not exist before pnpm 10.16.\n      rmSync(workspacePath, { force: true });\n      const packageJsonPath = path.join(this.path, \"package.json\");\n      const packageJson = getJsonFile(packageJsonPath) as Record<\n        string,\n        unknown\n      >;\n      putJsonFile(\n        packageJsonPath,\n        mergePackageJsonBuildApprovals(packageJson, packages),\n      );\n      // Drop any cached copy so later package.json edits start from this one.\n      delete this.jsonFiles[path.resolve(packageJsonPath)];\n      return;\n    }\n\n    if (!fileExists(workspacePath)) return;\n\n    const current = getFile(workspacePath) as string;\n    let next = mergePnpmBuildApprovals(current, packages);\n\n    if (layout === \"onlyBuiltDependencies\") {\n      next = mergeOnlyBuiltDependencies(next, packages);\n    }\n\n    if (next !== current) putFile(workspacePath, next);\n  }\n\n  public init() {\n    return this;\n  }\n\n  public terminate() {\n    // No longer using outro, using showSuccessScreen instead\n  }\n\n  public install() {\n    return runCommand(getPackageManager(), [\"install\"], this.path, {\n      env: installEnvironment(),\n    });\n  }\n\n  /** Record native build approvals before pnpm installs selected feature dependencies. */\n  public approveSelectedFeatureBuilds(features: readonly string[]) {\n    if (getPackageManager() !== \"pnpm\") return this;\n    const packages = requiredPnpmBuildApprovals(features);\n    if (packages.length === 0) return this;\n    // Inside a parent workspace the parent's policy decides; leave it alone.\n    if (isInsidePnpmWorkspace(this.path)) return this;\n    this.fitPnpmSettingsToVersion(packages);\n    return this;\n  }\n\n  public async exec(command: string) {\n    const [commandName, ...optionsList] = command.split(\" \");\n    return await executeCommand(commandName, optionsList, this.path);\n  }\n\n  public async git() {\n    const { initializeGitRepository } =\n      await import(\"./project-builder-helpers\");\n    return await initializeGitRepository(this.path);\n  }\n\n  /**\n   * Write the project's `package.json`: the project name and the version of\n   * every `@warlock.js/*` dependency. No template script names a package\n   * manager, so nothing here depends on the one the user chose.\n   *\n   * `versions` comes from {@link resolveWarlockVersions} — versions the\n   * registry has confirmed exist. It is optional because the fluent chain is\n   * synchronous; without it every sibling gets the caret range floored to the\n   * scaffolder's major, which is always satisfiable by a published release.\n   *\n   * What it must NEVER do again is stamp the scaffolder's own version blind:\n   * the release tooling bumps that version on every build, published or not,\n   * so an unverified pin resolves to nothing and the install dies with ETARGET.\n   */\n  public updatePackageJson(versions: Record<string, string> = {}) {\n    const pkg = this.package.replace(\"name\", this.name.replaceAll(\"/\", \"-\"));\n\n    const content: any = pkg.content;\n\n    const warlockVersion: string = (\n      getJsonFile(packageRoot(\"package.json\")) as { version: string }\n    ).version;\n    const defaultRange = fallbackRange(warlockVersion);\n\n    for (const field of [\"dependencies\", \"devDependencies\"] as const) {\n      const deps = content[field] as Record<string, string> | undefined;\n      if (!deps) continue;\n\n      for (const dependency of Object.keys(deps)) {\n        if (dependency.startsWith(\"@warlock.js/\")) {\n          deps[dependency] = versions[dependency] ?? defaultRange;\n        }\n      }\n    }\n\n    pkg.save();\n\n    return this;\n  }\n\n  /**\n   * Configure the chosen database driver: wire `DB_DRIVER` / `DB_PORT` into\n   * `.env`, AND pin the driver's npm package (`mongodb` / `pg`) into the\n   * project's `package.json` dependencies.\n   *\n   * The dependency is written HERE — before the base `yarn install` — so the\n   * driver is pulled deterministically by the very first install. We do NOT\n   * rely on the post-copy `warlock add <driver> --no-install` + separate\n   * batched install, which can be skipped or fail and leave the driver\n   * missing (the \"mongodb package is not installed\" runtime error).\n   */\n  public configureDatabaseEnv(driverValue: string) {\n    const driver = getDatabaseDriver(driverValue);\n\n    if (!driver) return this;\n\n    // Pin the driver package into dependencies (idempotent — never downgrade).\n    const packageJsonPath = path.resolve(this.path, \"package.json\");\n    const packageJson = getJsonFile(packageJsonPath) as {\n      dependencies?: Record<string, string>;\n    };\n    packageJson.dependencies = packageJson.dependencies ?? {};\n    if (!packageJson.dependencies[driver.package]) {\n      packageJson.dependencies[driver.package] = driver.packageVersion;\n      putJsonFile(packageJsonPath, packageJson);\n    }\n\n    // Both files carry the driver defaults: `.env` is what runs, `.env.example`\n    // is what the next developer copies.\n    for (const fileName of [\".env\", \".env.example\"]) {\n      const envPath = this.path + \"/\" + fileName;\n      if (!fileExists(envPath)) continue;\n\n      let envContent = getFile(envPath) as string;\n\n      envContent = envContent.replace(\n        /DB_PORT=\\d+/,\n        `DB_PORT=${driver.defaultPort}`,\n      );\n\n      if (envContent.includes(\"DB_DRIVER=\")) {\n        envContent = envContent.replace(\n          /DB_DRIVER=\\w*/,\n          `DB_DRIVER=${driver.value}`,\n        );\n      } else {\n        envContent = envContent.replace(\n          /DB_PORT=\\d+/,\n          `DB_PORT=${driver.defaultPort}\\nDB_DRIVER=${driver.value}`,\n        );\n      }\n\n      // DB_AUTH is Mongo's authSource; no other driver reads it.\n      if (driver.value !== \"mongodb\") {\n        envContent = envContent.replace(/^DB_AUTH=.*\\r?\\n?/m, \"\");\n      }\n\n      putFile(envPath, envContent);\n    }\n\n    return this;\n  }\n\n  /**\n   * Write the correct `src/config/database.ts` for the chosen driver and remove\n   * every per-driver variant so the scaffold ships exactly one config file.\n   *\n   * The template ships a Mongo-shaped `database.ts` (the default) plus a\n   * `database.postgres.ts` variant. Mongo keeps the default in place; Postgres\n   * overwrites `database.ts` with the Postgres-shaped variant (typed\n   * `ConnectionOptions`, `driver: \"postgres\"`, port 5432, no Mongo-only keys —\n   * no `authSource`, `driverOptions`, `replicaSet`, `randomIncrement` /\n   * `initialId`). Either way the `.postgres` variant file is deleted afterwards\n   * so no leftover config ships in the generated project.\n   *\n   * For Postgres it also corrects the working `.env`: the Mongo template ships\n   * `DB_AUTH=admin`, an `authSource` value Postgres ignores and its config no\n   * longer reads, so the line is dropped to keep `.env` and the config in sync.\n   * The port is rewritten by {@link configureDatabaseEnv} (driver defaultPort),\n   * which runs alongside this in the same branch.\n   */\n  public configureDatabaseConfig(driverValue: string) {\n    const configDir = path.resolve(this.path, \"src/config\");\n    const databasePath = path.resolve(configDir, \"database.ts\");\n    const postgresVariantPath = path.resolve(configDir, \"database.postgres.ts\");\n\n    if (driverValue === \"postgres\" && fileExists(postgresVariantPath)) {\n      putFile(databasePath, getFile(postgresVariantPath) as string);\n\n      const envPath = this.path + \"/.env\";\n\n      if (fileExists(envPath)) {\n        const envContent = getFile(envPath) as string;\n        // Drop the Mongo-only DB_AUTH line entirely (its whole line, so no blank\n        // gap is left behind). Postgres has no authSource concept.\n        putFile(envPath, envContent.replace(/^DB_AUTH=.*\\r?\\n?/m, \"\"));\n      }\n    }\n\n    // Whatever the driver, no per-driver variant may survive into the scaffold.\n    if (fileExists(postgresVariantPath)) {\n      unlinkSync(postgresVariantPath);\n    }\n\n    return this;\n  }\n\n  /**\n   * Remove the database layer for a \"no database\" scaffold.\n   *\n   * Deletes `src/config/database.ts` (and a `.tsx` / per-driver variant if\n   * present) from the freshly-copied template. The framework's database\n   * connector is config-gated on that file — with it gone,\n   * `config.get(\"database\")` is undefined and the connector no-ops, so the app\n   * boots with no database wired and no driver package pulled. The `DB_*` lines\n   * in `.env` are left in place (harmless: no config reads them) as a ready\n   * template for adding a database back later.\n   */\n  public removeDatabaseConfig() {\n    const configDir = path.resolve(this.path, \"src/config\");\n\n    for (const fileName of [\n      \"database.ts\",\n      \"database.tsx\",\n      \"database.postgres.ts\",\n    ]) {\n      const filePath = path.resolve(configDir, fileName);\n\n      if (fileExists(filePath)) {\n        unlinkSync(filePath);\n      }\n    }\n\n    return this;\n  }\n\n  /**\n   * Configure the web starter only when the web feature owns `/`.\n   *\n   * A dependency-free HTTP response is retained without web; otherwise the\n   * SSR page loader owns the route.\n   * Exactly one survives the scaffold: web projects keep the SSR page and API\n   * example; every other project keeps the dependency-free JSON controller.\n   */\n  public configureWebStarter(useWeb: boolean) {\n    const remove = (relativePath: string) => {\n      const target = path.resolve(this.path, relativePath);\n      if (existsSync(target)) rmSync(target, { recursive: true, force: true });\n    };\n\n    if (!useWeb) {\n      for (const entry of [\n        \"src/web\",\n        \"src/app/contact\",\n        \"src/app/locale\",\n        \"src/shared/contact.schema.ts\",\n        \"src/shared/locale.schema.ts\",\n        \"src/shared/locales.ts\",\n        \"postcss.config.mjs\",\n        \"skills/web-code-standards\",\n      ]) {\n        remove(entry);\n      }\n\n      const agentsPath = path.resolve(this.path, \"AGENTS.md\");\n      const agents = getFile(agentsPath) as string;\n      putFile(\n        agentsPath,\n        agents.replace(/^.*\\*\\*web-code-standards\\*\\*.*\\r?\\n/m, \"\"),\n      );\n\n      const tsconfigPath = path.resolve(this.path, \"tsconfig.json\");\n      const tsconfig = getFile(tsconfigPath) as string;\n      putFile(\n        tsconfigPath,\n        tsconfig\n          .replace('      \"web/*\": [\"./src/web/*\"],\\n', \"\")\n          .replace('      \"@shared/*\": [\"./src/shared/*\"]\\n', \"\"),\n      );\n\n      return this;\n    }\n\n    // The SSR page owns `/`; its loader still uses src/app/home/services.\n    remove(\"src/app/home/controllers/home-page.controller.ts\");\n    remove(\"src/app/home/routes.ts\");\n\n    const packageJsonPath = path.resolve(this.path, \"package.json\");\n    const packageJson = getJsonFile(packageJsonPath) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n    packageJson.dependencies = {\n      ...packageJson.dependencies,\n      \"@mongez/http\": \"^3.5.0\",\n      \"@mongez/react-form\": \"^4.0.0\",\n    };\n    packageJson.devDependencies = {\n      ...packageJson.devDependencies,\n      \"@tailwindcss/postcss\": \"^4.1.16\",\n      tailwindcss: \"^4.1.16\",\n    };\n    putJsonFile(packageJsonPath, packageJson);\n\n    const configPath = path.resolve(this.path, \"warlock.config.ts\");\n    const config = getFile(configPath) as string;\n    if (!config.includes('\"@warlock.js/web/connector\"')) {\n      // Inserted in sorted position, not prepended. The generated app formats\n      // with `prettier-plugin-organize-imports`, so an import pushed to the top\n      // of a file that already imports `@warlock.js/auth` and `@warlock.js/core`\n      // is out of order the moment it is written — and the developer meets it as\n      // a `prettier/prettier` error on their first `warlock dev`, in a file they\n      // did not write.\n      const withConnector = insertImportInSortedPosition(\n        config,\n        'import { webConnector } from \"@warlock.js/web/connector\";',\n        \"@warlock.js/web/connector\",\n      );\n\n      putFile(\n        configPath,\n        withConnector.replace(\n          \"export default defineConfig({\",\n          \"export default defineConfig({\\n  connectors: [webConnector()],\",\n        ),\n      );\n    }\n\n    return this;\n  }\n\n  /**\n   * Record non-default `agent-kit` targets into the generated `package.json`'s\n   * `agentKit.targets` block.\n   *\n   * The template's own `postinstall` (`agent-kit init && agent-kit sync`)\n   * already targets `claude` with no flags, so the single-target default case\n   * needs no template edit at all — this only writes when the selection is\n   * anything else, keeping the scaffold diff-free for the common path.\n   */\n  public configureAgentKitTargets(agents: string[]) {\n    const isDefault = agents.length === 1 && agents[0] === \"claude\";\n    if (isDefault) return this;\n\n    const packageJsonPath = path.resolve(this.path, \"package.json\");\n    if (!fileExists(packageJsonPath)) return this;\n\n    const packageJson = getJsonFile(packageJsonPath) as {\n      agentKit?: { targets?: string[] };\n    };\n    packageJson.agentKit = { ...packageJson.agentKit, targets: agents };\n    putJsonFile(packageJsonPath, packageJson);\n\n    return this;\n  }\n\n  /**\n   * Install the selected optional features by delegating to the project's own\n   * `warlock add`. `--no-install` records every dependency in package.json and\n   * ejects configs / scripts / setup hooks WITHOUT installing — the caller runs\n   * one batched install afterwards. Versions come from core's feature map, so\n   * the scaffolder never duplicates them.\n   *\n   * `--no-install` is passed LAST on purpose: the CLI parser treats the\n   * positional after a bare flag as that flag's value, so it must follow the\n   * feature list, not precede it.\n   */\n  public async installFeatures(features: string[]) {\n    if (features.length === 0) return true;\n\n    return this.exec(`npx warlock add ${features.join(\" \")} --no-install`);\n  }\n\n  /**\n   * Force a single copy of `vite` when the project ends up with BOTH `vite`\n   * (written by the `web` feature) and `vitest` (always in the template).\n   *\n   * `vitest` depends on vite through a wide range of its own\n   * (`^6 || ^7 || ^8`), which resolves to a DIFFERENT major than the range the\n   * feature map pins. Yarn 1 then has to nest the second copy under\n   * `vitest/node_modules` and dies on its own linker invariant:\n   *\n   *     error Invariant Violation: could not find a copy of vite to link in\n   *       <project>/node_modules/vitest/node_modules\n   *\n   * It aborts BEFORE `node_modules/.bin` is written, so `warlock` is never\n   * linked and the very first `yarn dev` fails with \"'warlock' is not\n   * recognized\". npm and pnpm nest happily and never hit this — for them the\n   * `overrides` twin below is one copy instead of two, not a crash fix.\n   *\n   * The pin is READ BACK from whatever range the project's own package.json\n   * declares, never re-stated as a literal here: the feature map in\n   * `@warlock.js/core` owns the version, and a second copy of it would drift\n   * the moment that one moves.\n   *\n   * Returns whether a pin was written, so the caller (and its spec) can assert\n   * it instead of assuming it.\n   */\n  public pinViteResolution() {\n    const packageJsonPath = path.resolve(this.path, \"package.json\");\n\n    if (!fileExists(packageJsonPath)) return false;\n\n    const packageJson = getJsonFile(packageJsonPath) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n      resolutions?: Record<string, string>;\n      overrides?: Record<string, string>;\n    };\n\n    const declaredRange = (name: string) =>\n      packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];\n\n    const viteRange = declaredRange(\"vite\");\n\n    // No vite, or no vitest to conflict with it — nothing to pin. Writing a\n    // resolution for a package the project does not depend on would only\n    // freeze a transitive tree nobody asked us to freeze.\n    if (!viteRange || !declaredRange(\"vitest\")) return false;\n\n    // yarn 1 / yarn berry read `resolutions`; npm 8+ and pnpm read `overrides`.\n    packageJson.resolutions = { ...packageJson.resolutions, vite: viteRange };\n    packageJson.overrides = { ...packageJson.overrides, vite: viteRange };\n\n    putJsonFile(packageJsonPath, packageJson);\n\n    return true;\n  }\n\n  /**\n   * Get package json file\n   */\n  public get package() {\n    return this.json(\"package.json\");\n  }\n\n  public updateDotEnv() {\n    this.file(\".env\").replaceAll(\"appName\", this.name).save();\n\n    return this;\n  }\n\n  /**\n   * Get env file to update\n   */\n  public get env() {\n    return this.file(\".env\");\n  }\n\n  public get name() {\n    return this.app.appName;\n  }\n\n  public get path() {\n    return this.app.appPath;\n  }\n\n  public file(relativePath: string) {\n    const fullPath = path.resolve(this.path, relativePath);\n\n    if (!this.files[fullPath]) {\n      this.files[fullPath] = file(fullPath);\n    }\n\n    return this.files[fullPath];\n  }\n\n  public json(relativePath: string): JsonFileManager {\n    const fullPath = path.resolve(this.path, relativePath);\n\n    if (!this.jsonFiles[fullPath]) {\n      this.jsonFiles[fullPath] = jsonFile(fullPath);\n    }\n\n    return this.jsonFiles[fullPath];\n  }\n}\n\nexport function app(app: Application) {\n  return new App(app);\n}\n\nexport class FileManager {\n  public content!: string;\n  public constructor(protected filePath: string) {\n    this.parseContent();\n  }\n\n  protected parseContent() {\n    this.content = getFile(this.filePath) as string;\n  }\n\n  public replace(search: string, replace: string) {\n    this.content = this.content.replace(search, replace);\n\n    return this;\n  }\n\n  public replaceAll(search: string, replace: string) {\n    this.content = this.content.replaceAll(search, replace);\n\n    return this;\n  }\n\n  public save() {\n    putFile(this.filePath, this.content);\n  }\n}\n\nexport class JsonFileManager extends FileManager {\n  protected parseContent() {\n    this.content = getJsonFile(this.filePath);\n  }\n\n  public save() {\n    putJsonFile(this.filePath, this.content);\n  }\n\n  public has(key: string) {\n    return this.content[key] !== undefined;\n  }\n\n  public replace(key: string, value: any) {\n    this.content[key] = value;\n\n    return this;\n  }\n\n  public replaceAll(key: string, value: any) {\n    const contentAsString = JSON.stringify(this.content);\n\n    this.content = JSON.parse(contentAsString.replaceAll(key, value));\n\n    return this;\n  }\n}\n\nexport function file(path: string) {\n  return new FileManager(path);\n}\n\nexport function jsonFile(path: string) {\n  return new JsonFileManager(path);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,qBAAwC;CACtD,OAAO,EAAE,UAAU,cAAc;AACnC;;AAGA,SAAgB,sBAAsB,YAA6B;CACjE,IAAI,MAAM,KAAK,QAAQ,KAAK,QAAQ,UAAU,CAAC;CAE/C,OAAO,MAAM;EACX,IAAI,WAAW,KAAK,KAAK,KAAK,qBAAqB,CAAC,GAAG,OAAO;EAC9D,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,IAAI,WAAW,KAAK,OAAO;EAC3B,MAAM;CACR;AACF;AAEA,IAAa,MAAb,MAAiB;CAaf,AAAO,YAAY,AAAU,KAAkB;EAAlB;eATkB,CAAC;mBAKO,CAAC;qBAEnC;CAE2B;CAEhD,IAAW,UAAsB;EAC/B,OAAO,KAAK,IAAI;CAClB;CAEA,AAAO,IAAI,cAAwB;EACjC,cAAc,SAAS,YAAY,GAAG,KAAK,IAAI;EAE/C,IAAI,WAAW,KAAK,OAAO,eAAe,GACxC,SAAS,KAAK,OAAO,iBAAiB,KAAK,OAAO,OAAO;EAG3D,WAAW,KAAK,OAAO,gBAAgB,KAAK,OAAO,aAAa;EAIhE,IAAI,sBAAsB,KAAK,IAAI,GACjC,OAAO,KAAK,KAAK,KAAK,MAAM,qBAAqB,GAAG,EAAE,OAAO,KAAK,CAAC;OAC9D,IAAI,kBAAkB,MAAM,QACjC,KAAK,yBAAyB,yBAAyB;EAGzD,OAAO;CACT;;;;;;;CAQA,AAAU,yBAAyB,UAA6B;EAC9D,MAAM,gBAAgB,KAAK,KAAK,KAAK,MAAM,qBAAqB;EAChE,MAAM,SAAS,wBAAwB,eAAe,CAAC;EAEvD,IAAI,WAAW,eAAe;GAI5B,OAAO,eAAe,EAAE,OAAO,KAAK,CAAC;GACrC,MAAM,kBAAkB,KAAK,KAAK,KAAK,MAAM,cAAc;GAK3D,YACE,iBACA,+BANkB,YAAY,eAMW,GAAG,QAAQ,CACtD;GAEA,OAAO,KAAK,UAAU,KAAK,QAAQ,eAAe;GAClD;EACF;EAEA,IAAI,CAAC,WAAW,aAAa,GAAG;EAEhC,MAAM,UAAU,QAAQ,aAAa;EACrC,IAAI,OAAO,wBAAwB,SAAS,QAAQ;EAEpD,IAAI,WAAW,yBACb,OAAO,2BAA2B,MAAM,QAAQ;EAGlD,IAAI,SAAS,SAAS,QAAQ,eAAe,IAAI;CACnD;CAEA,AAAO,OAAO;EACZ,OAAO;CACT;CAEA,AAAO,YAAY,CAEnB;CAEA,AAAO,UAAU;EACf,OAAO,WAAW,kBAAkB,GAAG,CAAC,SAAS,GAAG,KAAK,MAAM,EAC7D,KAAK,mBAAmB,EAC1B,CAAC;CACH;;CAGA,AAAO,6BAA6B,UAA6B;EAC/D,IAAI,kBAAkB,MAAM,QAAQ,OAAO;EAC3C,MAAM,WAAW,2BAA2B,QAAQ;EACpD,IAAI,SAAS,WAAW,GAAG,OAAO;EAElC,IAAI,sBAAsB,KAAK,IAAI,GAAG,OAAO;EAC7C,KAAK,yBAAyB,QAAQ;EACtC,OAAO;CACT;CAEA,MAAa,KAAK,SAAiB;EACjC,MAAM,CAAC,aAAa,GAAG,eAAe,QAAQ,MAAM,GAAG;EACvD,OAAO,MAAM,eAAe,aAAa,aAAa,KAAK,IAAI;CACjE;CAEA,MAAa,MAAM;EACjB,MAAM,EAAE,4BACN,MAAM,OAAO;EACf,OAAO,MAAM,wBAAwB,KAAK,IAAI;CAChD;;;;;;;;;;;;;;;CAgBA,AAAO,kBAAkB,WAAmC,CAAC,GAAG;EAC9D,MAAM,MAAM,KAAK,QAAQ,QAAQ,QAAQ,KAAK,KAAK,WAAW,KAAK,GAAG,CAAC;EAEvE,MAAM,UAAe,IAAI;EAEzB,MAAM,iBACJ,YAAY,YAAY,cAAc,CAAC,CAAC,CACxC;EACF,MAAM,eAAe,cAAc,cAAc;EAEjD,KAAK,MAAM,SAAS,CAAC,gBAAgB,iBAAiB,GAAY;GAChE,MAAM,OAAO,QAAQ;GACrB,IAAI,CAAC,MAAM;GAEX,KAAK,MAAM,cAAc,OAAO,KAAK,IAAI,GACvC,IAAI,WAAW,WAAW,cAAc,GACtC,KAAK,cAAc,SAAS,eAAe;EAGjD;EAEA,IAAI,KAAK;EAET,OAAO;CACT;;;;;;;;;;;;CAaA,AAAO,qBAAqB,aAAqB;EAC/C,MAAM,SAAS,kBAAkB,WAAW;EAE5C,IAAI,CAAC,QAAQ,OAAO;EAGpB,MAAM,kBAAkB,KAAK,QAAQ,KAAK,MAAM,cAAc;EAC9D,MAAM,cAAc,YAAY,eAAe;EAG/C,YAAY,eAAe,YAAY,gBAAgB,CAAC;EACxD,IAAI,CAAC,YAAY,aAAa,OAAO,UAAU;GAC7C,YAAY,aAAa,OAAO,WAAW,OAAO;GAClD,YAAY,iBAAiB,WAAW;EAC1C;EAIA,KAAK,MAAM,YAAY,CAAC,QAAQ,cAAc,GAAG;GAC/C,MAAM,UAAU,KAAK,OAAO,MAAM;GAClC,IAAI,CAAC,WAAW,OAAO,GAAG;GAE1B,IAAI,aAAa,QAAQ,OAAO;GAEhC,aAAa,WAAW,QACtB,eACA,WAAW,OAAO,aACpB;GAEA,IAAI,WAAW,SAAS,YAAY,GAClC,aAAa,WAAW,QACtB,iBACA,aAAa,OAAO,OACtB;QAEA,aAAa,WAAW,QACtB,eACA,WAAW,OAAO,YAAY,cAAc,OAAO,OACrD;GAIF,IAAI,OAAO,UAAU,WACnB,aAAa,WAAW,QAAQ,sBAAsB,EAAE;GAG1D,QAAQ,SAAS,UAAU;EAC7B;EAEA,OAAO;CACT;;;;;;;;;;;;;;;;;;;CAoBA,AAAO,wBAAwB,aAAqB;EAClD,MAAM,YAAY,KAAK,QAAQ,KAAK,MAAM,YAAY;EACtD,MAAM,eAAe,KAAK,QAAQ,WAAW,aAAa;EAC1D,MAAM,sBAAsB,KAAK,QAAQ,WAAW,sBAAsB;EAE1E,IAAI,gBAAgB,cAAc,WAAW,mBAAmB,GAAG;GACjE,QAAQ,cAAc,QAAQ,mBAAmB,CAAW;GAE5D,MAAM,UAAU,KAAK,OAAO;GAE5B,IAAI,WAAW,OAAO,GAIpB,QAAQ,SAHW,QAAQ,OAGD,CAAC,CAAC,QAAQ,sBAAsB,EAAE,CAAC;EAEjE;EAGA,IAAI,WAAW,mBAAmB,GAChC,WAAW,mBAAmB;EAGhC,OAAO;CACT;;;;;;;;;;;;CAaA,AAAO,uBAAuB;EAC5B,MAAM,YAAY,KAAK,QAAQ,KAAK,MAAM,YAAY;EAEtD,KAAK,MAAM,YAAY;GACrB;GACA;GACA;EACF,GAAG;GACD,MAAM,WAAW,KAAK,QAAQ,WAAW,QAAQ;GAEjD,IAAI,WAAW,QAAQ,GACrB,WAAW,QAAQ;EAEvB;EAEA,OAAO;CACT;;;;;;;;;CAUA,AAAO,oBAAoB,QAAiB;EAC1C,MAAM,UAAU,iBAAyB;GACvC,MAAM,SAAS,KAAK,QAAQ,KAAK,MAAM,YAAY;GACnD,IAAI,WAAW,MAAM,GAAG,OAAO,QAAQ;IAAE,WAAW;IAAM,OAAO;GAAK,CAAC;EACzE;EAEA,IAAI,CAAC,QAAQ;GACX,KAAK,MAAM,SAAS;IAClB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACF,GACE,OAAO,KAAK;GAGd,MAAM,aAAa,KAAK,QAAQ,KAAK,MAAM,WAAW;GAEtD,QACE,YAFa,QAAQ,UAGhB,CAAC,CAAC,QAAQ,yCAAyC,EAAE,CAC5D;GAEA,MAAM,eAAe,KAAK,QAAQ,KAAK,MAAM,eAAe;GAE5D,QACE,cAFe,QAAQ,YAGhB,CAAC,CACL,QAAQ,yCAAqC,EAAE,CAAC,CAChD,QAAQ,+CAA2C,EAAE,CAC1D;GAEA,OAAO;EACT;EAGA,OAAO,kDAAkD;EACzD,OAAO,wBAAwB;EAE/B,MAAM,kBAAkB,KAAK,QAAQ,KAAK,MAAM,cAAc;EAC9D,MAAM,cAAc,YAAY,eAAe;EAI/C,YAAY,eAAe;GACzB,GAAG,YAAY;GACf,gBAAgB;GAChB,sBAAsB;EACxB;EACA,YAAY,kBAAkB;GAC5B,GAAG,YAAY;GACf,wBAAwB;GACxB,aAAa;EACf;EACA,YAAY,iBAAiB,WAAW;EAExC,MAAM,aAAa,KAAK,QAAQ,KAAK,MAAM,mBAAmB;EAC9D,MAAM,SAAS,QAAQ,UAAU;EACjC,IAAI,CAAC,OAAO,SAAS,+BAA6B,GAahD,QACE,YAPoB,6BACpB,QACA,+DACA,2BAKY,CAAC,CAAC,QACZ,iCACA,gEACF,CACF;EAGF,OAAO;CACT;;;;;;;;;;CAWA,AAAO,yBAAyB,QAAkB;EAEhD,IADkB,OAAO,WAAW,KAAK,OAAO,OAAO,UACxC,OAAO;EAEtB,MAAM,kBAAkB,KAAK,QAAQ,KAAK,MAAM,cAAc;EAC9D,IAAI,CAAC,WAAW,eAAe,GAAG,OAAO;EAEzC,MAAM,cAAc,YAAY,eAAe;EAG/C,YAAY,WAAW;GAAE,GAAG,YAAY;GAAU,SAAS;EAAO;EAClE,YAAY,iBAAiB,WAAW;EAExC,OAAO;CACT;;;;;;;;;;;;CAaA,MAAa,gBAAgB,UAAoB;EAC/C,IAAI,SAAS,WAAW,GAAG,OAAO;EAElC,OAAO,KAAK,KAAK,mBAAmB,SAAS,KAAK,GAAG,EAAE,cAAc;CACvE;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BA,AAAO,oBAAoB;EACzB,MAAM,kBAAkB,KAAK,QAAQ,KAAK,MAAM,cAAc;EAE9D,IAAI,CAAC,WAAW,eAAe,GAAG,OAAO;EAEzC,MAAM,cAAc,YAAY,eAAe;EAO/C,MAAM,iBAAiB,SACrB,YAAY,eAAe,SAAS,YAAY,kBAAkB;EAEpE,MAAM,YAAY,cAAc,MAAM;EAKtC,IAAI,CAAC,aAAa,CAAC,cAAc,QAAQ,GAAG,OAAO;EAGnD,YAAY,cAAc;GAAE,GAAG,YAAY;GAAa,MAAM;EAAU;EACxE,YAAY,YAAY;GAAE,GAAG,YAAY;GAAW,MAAM;EAAU;EAEpE,YAAY,iBAAiB,WAAW;EAExC,OAAO;CACT;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,KAAK,cAAc;CACjC;CAEA,AAAO,eAAe;EACpB,KAAK,KAAK,MAAM,CAAC,CAAC,WAAW,WAAW,KAAK,IAAI,CAAC,CAAC,KAAK;EAExD,OAAO;CACT;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,KAAK,MAAM;CACzB;CAEA,IAAW,OAAO;EAChB,OAAO,KAAK,IAAI;CAClB;CAEA,IAAW,OAAO;EAChB,OAAO,KAAK,IAAI;CAClB;CAEA,AAAO,KAAK,cAAsB;EAChC,MAAM,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;EAErD,IAAI,CAAC,KAAK,MAAM,WACd,KAAK,MAAM,YAAY,KAAK,QAAQ;EAGtC,OAAO,KAAK,MAAM;CACpB;CAEA,AAAO,KAAK,cAAuC;EACjD,MAAM,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;EAErD,IAAI,CAAC,KAAK,UAAU,WAClB,KAAK,UAAU,YAAY,SAAS,QAAQ;EAG9C,OAAO,KAAK,UAAU;CACxB;AACF;AAMA,IAAa,cAAb,MAAyB;CAEvB,AAAO,YAAY,AAAU,UAAkB;EAAlB;EAC3B,KAAK,aAAa;CACpB;CAEA,AAAU,eAAe;EACvB,KAAK,UAAU,QAAQ,KAAK,QAAQ;CACtC;CAEA,AAAO,QAAQ,QAAgB,SAAiB;EAC9C,KAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,OAAO;EAEnD,OAAO;CACT;CAEA,AAAO,WAAW,QAAgB,SAAiB;EACjD,KAAK,UAAU,KAAK,QAAQ,WAAW,QAAQ,OAAO;EAEtD,OAAO;CACT;CAEA,AAAO,OAAO;EACZ,QAAQ,KAAK,UAAU,KAAK,OAAO;CACrC;AACF;AAEA,IAAa,kBAAb,cAAqC,YAAY;CAC/C,AAAU,eAAe;EACvB,KAAK,UAAU,YAAY,KAAK,QAAQ;CAC1C;CAEA,AAAO,OAAO;EACZ,YAAY,KAAK,UAAU,KAAK,OAAO;CACzC;CAEA,AAAO,IAAI,KAAa;EACtB,OAAO,KAAK,QAAQ,SAAS;CAC/B;CAEA,AAAO,QAAQ,KAAa,OAAY;EACtC,KAAK,QAAQ,OAAO;EAEpB,OAAO;CACT;CAEA,AAAO,WAAW,KAAa,OAAY;EACzC,MAAM,kBAAkB,KAAK,UAAU,KAAK,OAAO;EAEnD,KAAK,UAAU,KAAK,MAAM,gBAAgB,WAAW,KAAK,KAAK,CAAC;EAEhE,OAAO;CACT;AACF;AAEA,SAAgB,KAAK,MAAc;CACjC,OAAO,IAAI,YAAY,IAAI;AAC7B;AAEA,SAAgB,SAAS,MAAc;CACrC,OAAO,IAAI,gBAAgB,IAAI;AACjC"}

package/esm/helpers/exec.mjs

@@ -2,7 +2,7 @@ import { log } from "@clack/prompts";
 import { colors } from "@mongez/copper";
 import childProcess from "cross-spawn";
 
-//#region ../create-warlock/src/helpers/exec.ts
+//#region ../../packages/create-warlock/src/helpers/exec.ts
 /**
 * The last command executed through {@link executeCommand}.
 *

package/esm/helpers/exec.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"exec.mjs","names":["spawn"],"sources":["../../../../../../create-warlock/src/helpers/exec.ts"],"sourcesContent":["import { log } from \"@clack/prompts\";\nimport { colors } from \"@mongez/copper\";\nimport { ChildProcess } from \"child_process\";\nimport { default as childProcess, default as spawn } from \"cross-spawn\";\n\n/**\n * The full outcome of a spawned command — everything a human needs to act on a\n * failure: what ran, where, how it ended, and what it printed.\n *\n * Every runner in this file produces one. A boolean is never enough: \"it\n * failed\" with no command, no exit code and no stderr is exactly how a broken\n * scaffold gets announced as a success.\n */\nexport type CommandResult = {\n  /** Whether the command exited cleanly (code 0, no spawn error). */\n  ok: boolean;\n  /** The command as typed, e.g. `npm install`. */\n  command: string;\n  /** Directory the command ran in, when known. */\n  cwd?: string;\n  /** Exit code, or `null` when the process was signalled / never spawned. */\n  code: number | null;\n  /** Terminating signal, when the process was killed. */\n  signal: NodeJS.Signals | null;\n  stdout: string;\n  stderr: string;\n  /** Set when the process could not be spawned at all (ENOENT, EACCES, ...). */\n  error?: Error;\n};\n\n/** Options accepted by the capturing runners. */\nexport type RunOptions = {\n  /** Extra environment for the child; merged over `process.env`. */\n  env?: NodeJS.ProcessEnv;\n};\n\n/**\n * The last command executed through {@link executeCommand}.\n *\n * `executeCommand` resolves a bare boolean (a contract several callers depend\n * on), so the *reason* a command failed would otherwise be lost. It is parked\n * here and claimed with {@link takeLastCommandOutput}, which clears it — a\n * caller can never accidentally attribute a stale failure to the wrong step.\n *\n * The scaffolder runs one command at a time, so a single slot is enough.\n */\nlet lastCommandOutput: CommandResult | undefined;\n\n/**\n * Claim (and clear) the output of the most recent {@link executeCommand} call.\n */\nexport function takeLastCommandOutput(): CommandResult | undefined {\n  const output = lastCommandOutput;\n\n  lastCommandOutput = undefined;\n\n  return output;\n}\n\n/**\n * Keep only the last `lines` non-empty lines of a stream — enough context to\n * act on, without dumping a 500-line npm log over the wizard.\n */\nexport function tail(text: string, lines = 12): string {\n  return text\n    .split(/\\r?\\n/)\n    .filter(line => line.trim().length > 0)\n    .slice(-lines)\n    .join(\"\\n\");\n}\n\nexport default async function exec(command: string, options: any = {}) {\n  const [commandName, ...optionsList] = command.split(\" \");\n\n  const commandOutput = childProcess.sync(commandName, optionsList, options);\n\n  // it means command didn't end as expected, then stop the rest of the program\n  if (commandOutput.error !== null) {\n    process.exit(1);\n  }\n\n  return commandOutput;\n}\n\n/**\n * Attach stdout/stderr collectors to a child and return the accumulated text.\n *\n * The streams are optional on purpose: a child spawned with `stdio: \"ignore\"`\n * (or a test double) exposes none.\n */\nfunction collectOutput(child: ChildProcess) {\n  const chunks = { stdout: \"\", stderr: \"\" };\n\n  child.stdout?.on(\"data\", data => {\n    chunks.stdout += String(data);\n  });\n\n  child.stderr?.on(\"data\", data => {\n    chunks.stderr += String(data);\n  });\n\n  return chunks;\n}\n\nfunction logSpawnError(error: unknown) {\n  if (!error) return;\n\n  const message = (error as Error)?.message;\n\n  log.error(colors.red(String(message ?? error)) + `\\n\\n`);\n}\n\n/**\n * This function directly executes a command\n *\n * Resolves a boolean for backwards compatibility; the full outcome (exit code\n * and captured output) is available to the caller via\n * {@link takeLastCommandOutput}.\n */\nexport async function executeCommand(cmd: string, args: string[], cwd: string) {\n  const result = await runCapturedCommand(cmd, args, cwd);\n\n  lastCommandOutput = result;\n\n  return result.ok;\n}\n\n/**\n * Run a command to completion and resolve its full {@link CommandResult}.\n *\n * Output is piped and captured rather than discarded — the whole point is that\n * a failure can be explained instead of merely announced.\n */\nexport function runCapturedCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  options: RunOptions = {},\n): Promise<CommandResult> {\n  return new Promise<CommandResult>(resolve => {\n    const command = [cmd, ...args].join(\" \");\n\n    const settle = (result: Partial<CommandResult>): void =>\n      resolve({\n        ok: false,\n        command,\n        cwd,\n        code: null,\n        signal: null,\n        stdout: \"\",\n        stderr: \"\",\n        ...result,\n      });\n\n    let child: ChildProcess;\n\n    try {\n      child = spawn(cmd, args, {\n        cwd,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n        env: options.env ? { ...process.env, ...options.env } : process.env,\n      });\n    } catch (error) {\n      logSpawnError(error);\n\n      return settle({ error: error as Error, stderr: String(error) });\n    }\n\n    const output = collectOutput(child);\n\n    child.on(\"error\", error => {\n      logSpawnError(error);\n\n      settle({\n        error: error as Error,\n        stdout: output.stdout,\n        stderr: output.stderr || String((error as Error)?.message ?? error),\n      });\n    });\n\n    child.on(\"close\", (code, signal) => {\n      settle({\n        ok: code === 0,\n        code,\n        signal,\n        stdout: output.stdout,\n        stderr: output.stderr,\n      });\n    });\n  });\n}\n\n/**\n * Run a long command with an abort handle.\n *\n * `install` stays a `Promise<boolean>` for existing callers; `result` carries\n * the exit code and the captured output so a failing install can be reported\n * with the command, its status and its stderr instead of a shrug.\n */\nexport function runCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  options: RunOptions = {},\n) {\n  let child: ChildProcess;\n\n  const result = new Promise<CommandResult>(resolve => {\n    const command = [cmd, ...args].join(\" \");\n\n    const settle = (partial: Partial<CommandResult>): void =>\n      resolve({\n        ok: false,\n        command,\n        cwd,\n        code: null,\n        signal: null,\n        stdout: \"\",\n        stderr: \"\",\n        ...partial,\n      });\n\n    try {\n      child = spawn(cmd, args, {\n        cwd,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n        env: options.env ? { ...process.env, ...options.env } : process.env,\n      });\n\n      const output = collectOutput(child);\n\n      child.on(\"error\", error => {\n        logSpawnError(error);\n\n        settle({\n          error: error as Error,\n          stdout: output.stdout,\n          stderr: output.stderr || String((error as Error)?.message ?? error),\n        });\n      });\n\n      child.on(\"close\", (code, signal) => {\n        settle({\n          ok: code === 0,\n          code,\n          signal,\n          stdout: output.stdout,\n          stderr: output.stderr,\n        });\n      });\n    } catch (error) {\n      settle({ error: error as Error, stderr: String(error) });\n    }\n  });\n\n  const abort = async () => {\n    if (child) {\n      child.kill(\"SIGINT\");\n    }\n  };\n\n  return { abort, install: result.then(outcome => outcome.ok), result };\n}\n"],"mappings":";;;;;;;;;;;;;;;AA8CA,IAAI;;;;AAKJ,SAAgB,wBAAmD;CACjE,MAAM,SAAS;CAEf,oBAAoB;CAEpB,OAAO;AACT;;;;;AAMA,SAAgB,KAAK,MAAc,QAAQ,IAAY;CACrD,OAAO,KACJ,MAAM,OAAO,CAAC,CACd,QAAO,SAAQ,KAAK,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CACtC,MAAM,CAAC,KAAK,CAAC,CACb,KAAK,IAAI;AACd;;;;;;;AAqBA,SAAS,cAAc,OAAqB;CAC1C,MAAM,SAAS;EAAE,QAAQ;EAAI,QAAQ;CAAG;CAExC,MAAM,QAAQ,GAAG,SAAQ,SAAQ;EAC/B,OAAO,UAAU,OAAO,IAAI;CAC9B,CAAC;CAED,MAAM,QAAQ,GAAG,SAAQ,SAAQ;EAC/B,OAAO,UAAU,OAAO,IAAI;CAC9B,CAAC;CAED,OAAO;AACT;AAEA,SAAS,cAAc,OAAgB;CACrC,IAAI,CAAC,OAAO;CAEZ,MAAM,UAAW,OAAiB;CAElC,IAAI,MAAM,OAAO,IAAI,OAAO,WAAW,KAAK,CAAC,IAAI,MAAM;AACzD;;;;;;;;AASA,eAAsB,eAAe,KAAa,MAAgB,KAAa;CAC7E,MAAM,SAAS,MAAM,mBAAmB,KAAK,MAAM,GAAG;CAEtD,oBAAoB;CAEpB,OAAO,OAAO;AAChB;;;;;;;AAQA,SAAgB,mBACd,KACA,MACA,KACA,UAAsB,CAAC,GACC;CACxB,OAAO,IAAI,SAAuB,YAAW;EAC3C,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;EAEvC,MAAM,UAAU,WACd,QAAQ;GACN,IAAI;GACJ;GACA;GACA,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAG;EACL,CAAC;EAEH,IAAI;EAEJ,IAAI;GACF,QAAQA,aAAM,KAAK,MAAM;IACvB;IACA,OAAO;KAAC;KAAU;KAAQ;IAAM;IAChC,KAAK,QAAQ,MAAM;KAAE,GAAG,QAAQ;KAAK,GAAG,QAAQ;IAAI,IAAI,QAAQ;GAClE,CAAC;EACH,SAAS,OAAO;GACd,cAAc,KAAK;GAEnB,OAAO,OAAO;IAAS;IAAgB,QAAQ,OAAO,KAAK;GAAE,CAAC;EAChE;EAEA,MAAM,SAAS,cAAc,KAAK;EAElC,MAAM,GAAG,UAAS,UAAS;GACzB,cAAc,KAAK;GAEnB,OAAO;IACE;IACP,QAAQ,OAAO;IACf,QAAQ,OAAO,UAAU,OAAQ,OAAiB,WAAW,KAAK;GACpE,CAAC;EACH,CAAC;EAED,MAAM,GAAG,UAAU,MAAM,WAAW;GAClC,OAAO;IACL,IAAI,SAAS;IACb;IACA;IACA,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB,CAAC;EACH,CAAC;CACH,CAAC;AACH;;;;;;;;AASA,SAAgB,WACd,KACA,MACA,KACA,UAAsB,CAAC,GACvB;CACA,IAAI;CAEJ,MAAM,SAAS,IAAI,SAAuB,YAAW;EACnD,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;EAEvC,MAAM,UAAU,YACd,QAAQ;GACN,IAAI;GACJ;GACA;GACA,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAG;EACL,CAAC;EAEH,IAAI;GACF,QAAQA,aAAM,KAAK,MAAM;IACvB;IACA,OAAO;KAAC;KAAU;KAAQ;IAAM;IAChC,KAAK,QAAQ,MAAM;KAAE,GAAG,QAAQ;KAAK,GAAG,QAAQ;IAAI,IAAI,QAAQ;GAClE,CAAC;GAED,MAAM,SAAS,cAAc,KAAK;GAElC,MAAM,GAAG,UAAS,UAAS;IACzB,cAAc,KAAK;IAEnB,OAAO;KACE;KACP,QAAQ,OAAO;KACf,QAAQ,OAAO,UAAU,OAAQ,OAAiB,WAAW,KAAK;IACpE,CAAC;GACH,CAAC;GAED,MAAM,GAAG,UAAU,MAAM,WAAW;IAClC,OAAO;KACL,IAAI,SAAS;KACb;KACA;KACA,QAAQ,OAAO;KACf,QAAQ,OAAO;IACjB,CAAC;GACH,CAAC;EACH,SAAS,OAAO;GACd,OAAO;IAAS;IAAgB,QAAQ,OAAO,KAAK;GAAE,CAAC;EACzD;CACF,CAAC;CAED,MAAM,QAAQ,YAAY;EACxB,IAAI,OACF,MAAM,KAAK,QAAQ;CAEvB;CAEA,OAAO;EAAE;EAAO,SAAS,OAAO,MAAK,YAAW,QAAQ,EAAE;EAAG;CAAO;AACtE"}
+{"version":3,"file":"exec.mjs","names":["spawn"],"sources":["../../../../../../../packages/create-warlock/src/helpers/exec.ts"],"sourcesContent":["import { log } from \"@clack/prompts\";\nimport { colors } from \"@mongez/copper\";\nimport { ChildProcess } from \"child_process\";\nimport { default as childProcess, default as spawn } from \"cross-spawn\";\n\n/**\n * The full outcome of a spawned command — everything a human needs to act on a\n * failure: what ran, where, how it ended, and what it printed.\n *\n * Every runner in this file produces one. A boolean is never enough: \"it\n * failed\" with no command, no exit code and no stderr is exactly how a broken\n * scaffold gets announced as a success.\n */\nexport type CommandResult = {\n  /** Whether the command exited cleanly (code 0, no spawn error). */\n  ok: boolean;\n  /** The command as typed, e.g. `npm install`. */\n  command: string;\n  /** Directory the command ran in, when known. */\n  cwd?: string;\n  /** Exit code, or `null` when the process was signalled / never spawned. */\n  code: number | null;\n  /** Terminating signal, when the process was killed. */\n  signal: NodeJS.Signals | null;\n  stdout: string;\n  stderr: string;\n  /** Set when the process could not be spawned at all (ENOENT, EACCES, ...). */\n  error?: Error;\n};\n\n/** Options accepted by the capturing runners. */\nexport type RunOptions = {\n  /** Extra environment for the child; merged over `process.env`. */\n  env?: NodeJS.ProcessEnv;\n};\n\n/**\n * The last command executed through {@link executeCommand}.\n *\n * `executeCommand` resolves a bare boolean (a contract several callers depend\n * on), so the *reason* a command failed would otherwise be lost. It is parked\n * here and claimed with {@link takeLastCommandOutput}, which clears it — a\n * caller can never accidentally attribute a stale failure to the wrong step.\n *\n * The scaffolder runs one command at a time, so a single slot is enough.\n */\nlet lastCommandOutput: CommandResult | undefined;\n\n/**\n * Claim (and clear) the output of the most recent {@link executeCommand} call.\n */\nexport function takeLastCommandOutput(): CommandResult | undefined {\n  const output = lastCommandOutput;\n\n  lastCommandOutput = undefined;\n\n  return output;\n}\n\n/**\n * Keep only the last `lines` non-empty lines of a stream — enough context to\n * act on, without dumping a 500-line npm log over the wizard.\n */\nexport function tail(text: string, lines = 12): string {\n  return text\n    .split(/\\r?\\n/)\n    .filter(line => line.trim().length > 0)\n    .slice(-lines)\n    .join(\"\\n\");\n}\n\nexport default async function exec(command: string, options: any = {}) {\n  const [commandName, ...optionsList] = command.split(\" \");\n\n  const commandOutput = childProcess.sync(commandName, optionsList, options);\n\n  // it means command didn't end as expected, then stop the rest of the program\n  if (commandOutput.error !== null) {\n    process.exit(1);\n  }\n\n  return commandOutput;\n}\n\n/**\n * Attach stdout/stderr collectors to a child and return the accumulated text.\n *\n * The streams are optional on purpose: a child spawned with `stdio: \"ignore\"`\n * (or a test double) exposes none.\n */\nfunction collectOutput(child: ChildProcess) {\n  const chunks = { stdout: \"\", stderr: \"\" };\n\n  child.stdout?.on(\"data\", data => {\n    chunks.stdout += String(data);\n  });\n\n  child.stderr?.on(\"data\", data => {\n    chunks.stderr += String(data);\n  });\n\n  return chunks;\n}\n\nfunction logSpawnError(error: unknown) {\n  if (!error) return;\n\n  const message = (error as Error)?.message;\n\n  log.error(colors.red(String(message ?? error)) + `\\n\\n`);\n}\n\n/**\n * This function directly executes a command\n *\n * Resolves a boolean for backwards compatibility; the full outcome (exit code\n * and captured output) is available to the caller via\n * {@link takeLastCommandOutput}.\n */\nexport async function executeCommand(cmd: string, args: string[], cwd: string) {\n  const result = await runCapturedCommand(cmd, args, cwd);\n\n  lastCommandOutput = result;\n\n  return result.ok;\n}\n\n/**\n * Run a command to completion and resolve its full {@link CommandResult}.\n *\n * Output is piped and captured rather than discarded — the whole point is that\n * a failure can be explained instead of merely announced.\n */\nexport function runCapturedCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  options: RunOptions = {},\n): Promise<CommandResult> {\n  return new Promise<CommandResult>(resolve => {\n    const command = [cmd, ...args].join(\" \");\n\n    const settle = (result: Partial<CommandResult>): void =>\n      resolve({\n        ok: false,\n        command,\n        cwd,\n        code: null,\n        signal: null,\n        stdout: \"\",\n        stderr: \"\",\n        ...result,\n      });\n\n    let child: ChildProcess;\n\n    try {\n      child = spawn(cmd, args, {\n        cwd,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n        env: options.env ? { ...process.env, ...options.env } : process.env,\n      });\n    } catch (error) {\n      logSpawnError(error);\n\n      return settle({ error: error as Error, stderr: String(error) });\n    }\n\n    const output = collectOutput(child);\n\n    child.on(\"error\", error => {\n      logSpawnError(error);\n\n      settle({\n        error: error as Error,\n        stdout: output.stdout,\n        stderr: output.stderr || String((error as Error)?.message ?? error),\n      });\n    });\n\n    child.on(\"close\", (code, signal) => {\n      settle({\n        ok: code === 0,\n        code,\n        signal,\n        stdout: output.stdout,\n        stderr: output.stderr,\n      });\n    });\n  });\n}\n\n/**\n * Run a long command with an abort handle.\n *\n * `install` stays a `Promise<boolean>` for existing callers; `result` carries\n * the exit code and the captured output so a failing install can be reported\n * with the command, its status and its stderr instead of a shrug.\n */\nexport function runCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  options: RunOptions = {},\n) {\n  let child: ChildProcess;\n\n  const result = new Promise<CommandResult>(resolve => {\n    const command = [cmd, ...args].join(\" \");\n\n    const settle = (partial: Partial<CommandResult>): void =>\n      resolve({\n        ok: false,\n        command,\n        cwd,\n        code: null,\n        signal: null,\n        stdout: \"\",\n        stderr: \"\",\n        ...partial,\n      });\n\n    try {\n      child = spawn(cmd, args, {\n        cwd,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n        env: options.env ? { ...process.env, ...options.env } : process.env,\n      });\n\n      const output = collectOutput(child);\n\n      child.on(\"error\", error => {\n        logSpawnError(error);\n\n        settle({\n          error: error as Error,\n          stdout: output.stdout,\n          stderr: output.stderr || String((error as Error)?.message ?? error),\n        });\n      });\n\n      child.on(\"close\", (code, signal) => {\n        settle({\n          ok: code === 0,\n          code,\n          signal,\n          stdout: output.stdout,\n          stderr: output.stderr,\n        });\n      });\n    } catch (error) {\n      settle({ error: error as Error, stderr: String(error) });\n    }\n  });\n\n  const abort = async () => {\n    if (child) {\n      child.kill(\"SIGINT\");\n    }\n  };\n\n  return { abort, install: result.then(outcome => outcome.ok), result };\n}\n"],"mappings":";;;;;;;;;;;;;;;AA8CA,IAAI;;;;AAKJ,SAAgB,wBAAmD;CACjE,MAAM,SAAS;CAEf,oBAAoB;CAEpB,OAAO;AACT;;;;;AAMA,SAAgB,KAAK,MAAc,QAAQ,IAAY;CACrD,OAAO,KACJ,MAAM,OAAO,CAAC,CACd,QAAO,SAAQ,KAAK,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CACtC,MAAM,CAAC,KAAK,CAAC,CACb,KAAK,IAAI;AACd;;;;;;;AAqBA,SAAS,cAAc,OAAqB;CAC1C,MAAM,SAAS;EAAE,QAAQ;EAAI,QAAQ;CAAG;CAExC,MAAM,QAAQ,GAAG,SAAQ,SAAQ;EAC/B,OAAO,UAAU,OAAO,IAAI;CAC9B,CAAC;CAED,MAAM,QAAQ,GAAG,SAAQ,SAAQ;EAC/B,OAAO,UAAU,OAAO,IAAI;CAC9B,CAAC;CAED,OAAO;AACT;AAEA,SAAS,cAAc,OAAgB;CACrC,IAAI,CAAC,OAAO;CAEZ,MAAM,UAAW,OAAiB;CAElC,IAAI,MAAM,OAAO,IAAI,OAAO,WAAW,KAAK,CAAC,IAAI,MAAM;AACzD;;;;;;;;AASA,eAAsB,eAAe,KAAa,MAAgB,KAAa;CAC7E,MAAM,SAAS,MAAM,mBAAmB,KAAK,MAAM,GAAG;CAEtD,oBAAoB;CAEpB,OAAO,OAAO;AAChB;;;;;;;AAQA,SAAgB,mBACd,KACA,MACA,KACA,UAAsB,CAAC,GACC;CACxB,OAAO,IAAI,SAAuB,YAAW;EAC3C,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;EAEvC,MAAM,UAAU,WACd,QAAQ;GACN,IAAI;GACJ;GACA;GACA,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAG;EACL,CAAC;EAEH,IAAI;EAEJ,IAAI;GACF,QAAQA,aAAM,KAAK,MAAM;IACvB;IACA,OAAO;KAAC;KAAU;KAAQ;IAAM;IAChC,KAAK,QAAQ,MAAM;KAAE,GAAG,QAAQ;KAAK,GAAG,QAAQ;IAAI,IAAI,QAAQ;GAClE,CAAC;EACH,SAAS,OAAO;GACd,cAAc,KAAK;GAEnB,OAAO,OAAO;IAAS;IAAgB,QAAQ,OAAO,KAAK;GAAE,CAAC;EAChE;EAEA,MAAM,SAAS,cAAc,KAAK;EAElC,MAAM,GAAG,UAAS,UAAS;GACzB,cAAc,KAAK;GAEnB,OAAO;IACE;IACP,QAAQ,OAAO;IACf,QAAQ,OAAO,UAAU,OAAQ,OAAiB,WAAW,KAAK;GACpE,CAAC;EACH,CAAC;EAED,MAAM,GAAG,UAAU,MAAM,WAAW;GAClC,OAAO;IACL,IAAI,SAAS;IACb;IACA;IACA,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB,CAAC;EACH,CAAC;CACH,CAAC;AACH;;;;;;;;AASA,SAAgB,WACd,KACA,MACA,KACA,UAAsB,CAAC,GACvB;CACA,IAAI;CAEJ,MAAM,SAAS,IAAI,SAAuB,YAAW;EACnD,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;EAEvC,MAAM,UAAU,YACd,QAAQ;GACN,IAAI;GACJ;GACA;GACA,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,GAAG;EACL,CAAC;EAEH,IAAI;GACF,QAAQA,aAAM,KAAK,MAAM;IACvB;IACA,OAAO;KAAC;KAAU;KAAQ;IAAM;IAChC,KAAK,QAAQ,MAAM;KAAE,GAAG,QAAQ;KAAK,GAAG,QAAQ;IAAI,IAAI,QAAQ;GAClE,CAAC;GAED,MAAM,SAAS,cAAc,KAAK;GAElC,MAAM,GAAG,UAAS,UAAS;IACzB,cAAc,KAAK;IAEnB,OAAO;KACE;KACP,QAAQ,OAAO;KACf,QAAQ,OAAO,UAAU,OAAQ,OAAiB,WAAW,KAAK;IACpE,CAAC;GACH,CAAC;GAED,MAAM,GAAG,UAAU,MAAM,WAAW;IAClC,OAAO;KACL,IAAI,SAAS;KACb;KACA;KACA,QAAQ,OAAO;KACf,QAAQ,OAAO;IACjB,CAAC;GACH,CAAC;EACH,SAAS,OAAO;GACd,OAAO;IAAS;IAAgB,QAAQ,OAAO,KAAK;GAAE,CAAC;EACzD;CACF,CAAC;CAED,MAAM,QAAQ,YAAY;EACxB,IAAI,OACF,MAAM,KAAK,QAAQ;CAEvB;CAEA,OAAO;EAAE;EAAO,SAAS,OAAO,MAAK,YAAW,QAAQ,EAAE;EAAG;CAAO;AACtE"}

package/esm/helpers/insert-import.mjs

@@ -1,4 +1,4 @@
-//#region ../create-warlock/src/helpers/insert-import.ts
+//#region ../../packages/create-warlock/src/helpers/insert-import.ts
 /**
 * Splice an `import` statement into a generated source file **in sorted
 * position**, rather than pushing it to the top.

package/esm/helpers/insert-import.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"insert-import.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/insert-import.ts"],"sourcesContent":["/**\n * Splice an `import` statement into a generated source file **in sorted\n * position**, rather than pushing it to the top.\n *\n * The scaffolded app formats with `prettier-plugin-organize-imports`, which\n * orders imports alphabetically by module specifier. So an import prepended to\n * a file that already has some is, by construction, in the wrong place — and\n * the developer meets it as a `prettier/prettier` error on their very first\n * `warlock dev`, in a file they did not write, about code they did not add.\n *\n * That is the defect class this scaffolder keeps paying for: a failure that\n * waits for the user's first ordinary action and then arrives attributed to\n * them.\n */\n\n/**\n * Matches a top-level import statement and captures its module specifier.\n *\n * Deliberately narrow: this reads files THIS scaffolder generates from its own\n * templates, not arbitrary user source. It handles the two forms those\n * templates actually contain — a single-line import and a braced multi-line one\n * — and is not a general TypeScript parser. If a template ever grows an import\n * shape this misses, the insertion falls back to appending after the last match,\n * which is still ordered relative to everything it did recognise.\n */\nconst IMPORT_STATEMENT = /^import\\s[\\s\\S]*?from\\s+[\"']([^\"']+)[\"'];?$/gm;\n\n/**\n * Insert `statement` into `source` so the import block stays alphabetically\n * ordered by module specifier.\n *\n * @param source     the file's current contents.\n * @param statement  the whole import line to add, without a trailing newline.\n * @param specifier  the module specifier `statement` imports from — passed\n *                   rather than re-parsed, because the caller already knows it\n *                   and a second parser is a second thing to disagree.\n * @returns the file contents with the import in place. A file with no imports\n *          at all gets it at the top, which is the only ordering available.\n */\nexport function insertImportInSortedPosition(\n  source: string,\n  statement: string,\n  specifier: string,\n): string {\n  const matches = [...source.matchAll(IMPORT_STATEMENT)];\n\n  if (matches.length === 0) {\n    return `${statement}\\n${source}`;\n  }\n\n  const successor = matches.find(\n    match => (match[1] as string).localeCompare(specifier) > 0,\n  );\n\n  if (successor) {\n    return `${source.slice(0, successor.index)}${statement}\\n${source.slice(successor.index)}`;\n  }\n\n  const last = matches[matches.length - 1] as RegExpMatchArray;\n  const endOfLast = (last.index as number) + last[0].length;\n\n  return `${source.slice(0, endOfLast)}\\n${statement}${source.slice(endOfLast)}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,mBAAmB;;;;;;;;;;;;;AAczB,SAAgB,6BACd,QACA,WACA,WACQ;CACR,MAAM,UAAU,CAAC,GAAG,OAAO,SAAS,gBAAgB,CAAC;CAErD,IAAI,QAAQ,WAAW,GACrB,OAAO,GAAG,UAAU,IAAI;CAG1B,MAAM,YAAY,QAAQ,MACxB,UAAU,MAAM,EAAE,CAAY,cAAc,SAAS,IAAI,CAC3D;CAEA,IAAI,WACF,OAAO,GAAG,OAAO,MAAM,GAAG,UAAU,KAAK,IAAI,UAAU,IAAI,OAAO,MAAM,UAAU,KAAK;CAGzF,MAAM,OAAO,QAAQ,QAAQ,SAAS;CACtC,MAAM,YAAa,KAAK,QAAmB,KAAK,EAAE,CAAC;CAEnD,OAAO,GAAG,OAAO,MAAM,GAAG,SAAS,EAAE,IAAI,YAAY,OAAO,MAAM,SAAS;AAC7E"}
+{"version":3,"file":"insert-import.mjs","names":[],"sources":["../../../../../../../packages/create-warlock/src/helpers/insert-import.ts"],"sourcesContent":["/**\n * Splice an `import` statement into a generated source file **in sorted\n * position**, rather than pushing it to the top.\n *\n * The scaffolded app formats with `prettier-plugin-organize-imports`, which\n * orders imports alphabetically by module specifier. So an import prepended to\n * a file that already has some is, by construction, in the wrong place — and\n * the developer meets it as a `prettier/prettier` error on their very first\n * `warlock dev`, in a file they did not write, about code they did not add.\n *\n * That is the defect class this scaffolder keeps paying for: a failure that\n * waits for the user's first ordinary action and then arrives attributed to\n * them.\n */\n\n/**\n * Matches a top-level import statement and captures its module specifier.\n *\n * Deliberately narrow: this reads files THIS scaffolder generates from its own\n * templates, not arbitrary user source. It handles the two forms those\n * templates actually contain — a single-line import and a braced multi-line one\n * — and is not a general TypeScript parser. If a template ever grows an import\n * shape this misses, the insertion falls back to appending after the last match,\n * which is still ordered relative to everything it did recognise.\n */\nconst IMPORT_STATEMENT = /^import\\s[\\s\\S]*?from\\s+[\"']([^\"']+)[\"'];?$/gm;\n\n/**\n * Insert `statement` into `source` so the import block stays alphabetically\n * ordered by module specifier.\n *\n * @param source     the file's current contents.\n * @param statement  the whole import line to add, without a trailing newline.\n * @param specifier  the module specifier `statement` imports from — passed\n *                   rather than re-parsed, because the caller already knows it\n *                   and a second parser is a second thing to disagree.\n * @returns the file contents with the import in place. A file with no imports\n *          at all gets it at the top, which is the only ordering available.\n */\nexport function insertImportInSortedPosition(\n  source: string,\n  statement: string,\n  specifier: string,\n): string {\n  const matches = [...source.matchAll(IMPORT_STATEMENT)];\n\n  if (matches.length === 0) {\n    return `${statement}\\n${source}`;\n  }\n\n  const successor = matches.find(\n    match => (match[1] as string).localeCompare(specifier) > 0,\n  );\n\n  if (successor) {\n    return `${source.slice(0, successor.index)}${statement}\\n${source.slice(successor.index)}`;\n  }\n\n  const last = matches[matches.length - 1] as RegExpMatchArray;\n  const endOfLast = (last.index as number) + last[0].length;\n\n  return `${source.slice(0, endOfLast)}\\n${statement}${source.slice(endOfLast)}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,mBAAmB;;;;;;;;;;;;;AAczB,SAAgB,6BACd,QACA,WACA,WACQ;CACR,MAAM,UAAU,CAAC,GAAG,OAAO,SAAS,gBAAgB,CAAC;CAErD,IAAI,QAAQ,WAAW,GACrB,OAAO,GAAG,UAAU,IAAI;CAG1B,MAAM,YAAY,QAAQ,MACxB,UAAU,MAAM,EAAE,CAAY,cAAc,SAAS,IAAI,CAC3D;CAEA,IAAI,WACF,OAAO,GAAG,OAAO,MAAM,GAAG,UAAU,KAAK,IAAI,UAAU,IAAI,OAAO,MAAM,UAAU,KAAK;CAGzF,MAAM,OAAO,QAAQ,QAAQ,SAAS;CACtC,MAAM,YAAa,KAAK,QAAmB,KAAK,EAAE,CAAC;CAEnD,OAAO,GAAG,OAAO,MAAM,GAAG,SAAS,EAAE,IAAI,YAAY,OAAO,MAAM,SAAS;AAC7E"}

package/esm/helpers/package-manager.mjs

@@ -2,7 +2,7 @@ import { exec, execSync } from "child_process";
 import { promisify } from "util";
 import detectPackageManager from "which-pm-runs";
 
-//#region ../create-warlock/src/helpers/package-manager.ts
+//#region ../../packages/create-warlock/src/helpers/package-manager.ts
 const execAsync = promisify(exec);
 let detectedPackageManager;
 let cachedSystemManagers;
@@ -100,6 +100,26 @@ function getPreferredPackageManager() {
 function setPackageManager(packageManager) {
 	detectedPackageManager = packageManager;
 }
+let cachedPnpmVersion;
+/**
+* The version `pnpm --version` reports, or undefined when pnpm cannot be run.
+* The scaffold's pnpm settings depend on it (see pnpmBuildApprovalLayout).
+*/
+function getPnpmVersion() {
+	if (cachedPnpmVersion === void 0) try {
+		cachedPnpmVersion = execSync("pnpm --version", {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		cachedPnpmVersion = null;
+	}
+	return cachedPnpmVersion ?? void 0;
+}
 function runPackageManagerCommand(command) {
 	const packageManager = getPackageManager();
 	if (packageManager === "npm") return `npm run ${command}`;
@@ -107,5 +127,5 @@ function runPackageManagerCommand(command) {
 }
 
 //#endregion
-export { ALLOWED_PACKAGE_MANAGERS, detectPackageManagers, getPackageManager, getPreferredPackageManager, getSystemPackageManagers, isValidPackageManager, runPackageManagerCommand, setPackageManager };
+export { ALLOWED_PACKAGE_MANAGERS, detectPackageManagers, getPackageManager, getPnpmVersion, getPreferredPackageManager, getSystemPackageManagers, isValidPackageManager, runPackageManagerCommand, setPackageManager };
 //# sourceMappingURL=package-manager.mjs.map

package/esm/helpers/package-manager.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"package-manager.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/package-manager.ts"],"sourcesContent":["import { exec, execSync } from \"child_process\";\nimport { promisify } from \"util\";\nimport detectPackageManager from \"which-pm-runs\";\n\nconst execAsync = promisify(exec);\n\nlet detectedPackageManager: string | undefined;\nlet cachedSystemManagers: string[] | undefined;\nlet cachedPreferredManager: string | undefined;\n\n/**\n * The only package managers `--pm` may select. This value reaches `spawn()`\n * as the executable to run and is spliced into the generated\n * `package.json`'s scripts — an allow-list here is a hard security\n * boundary, not just input hygiene, so it stays a fixed literal list\n * rather than anything derived from user input or the running environment.\n */\nexport const ALLOWED_PACKAGE_MANAGERS = [\"npm\", \"yarn\", \"pnpm\", \"bun\"] as const;\n\nexport type AllowedPackageManager = (typeof ALLOWED_PACKAGE_MANAGERS)[number];\n\n/** Whether `value` is one of the allow-listed package managers. */\nexport function isValidPackageManager(\n  value: string,\n): value is AllowedPackageManager {\n  return (ALLOWED_PACKAGE_MANAGERS as readonly string[]).includes(value);\n}\n\nexport function getPackageManager() {\n  if (detectedPackageManager) {\n    return detectedPackageManager;\n  }\n\n  return getPreferredPackageManager();\n}\n\n/**\n * Check if a package manager is installed\n */\nfunction isInstalled(manager: string): boolean {\n  try {\n    execSync(`${manager} --version`, { stdio: \"ignore\" });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check if a package manager is installed (async)\n */\nasync function checkManager(manager: string): Promise<boolean> {\n  try {\n    await execAsync(`${manager} --version`);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Every allow-listed manager that has to be PROBED. npm is excluded because\n * it is assumed present.\n *\n * Both detectors read this one list. They used to hold their own literal\n * copies, and the copies drifted: `bun` reached the allow-list and `--help`\n * without reaching either probe, so `--pm=bun` passed the spelling check and\n * then could never appear among the options that would honour it.\n */\nconst PROBED_PACKAGE_MANAGERS = ALLOWED_PACKAGE_MANAGERS.filter(\n  manager => manager !== \"npm\",\n);\n\nconst PREFERRED_PACKAGE_MANAGERS = [\"pnpm\", \"yarn\", \"npm\"] as const;\n\n/**\n * A running non-npm manager is already usable. Every fallback must be present\n * in the detector's installed set, so both sync and async paths agree.\n */\nfunction preferredPackageManager(\n  isAvailable: (manager: AllowedPackageManager) => boolean,\n): string {\n  const runningPm = detectPackageManager()?.name;\n  if (runningPm && runningPm !== \"npm\" && isValidPackageManager(runningPm)) {\n    return runningPm;\n  }\n\n  return PREFERRED_PACKAGE_MANAGERS.find(isAvailable) ?? \"npm\";\n}\n\n/**\n * Detect available package managers asynchronously and cache results\n */\nexport async function detectPackageManagers() {\n  const found = await Promise.all(PROBED_PACKAGE_MANAGERS.map(checkManager));\n  const available = PROBED_PACKAGE_MANAGERS.filter((_, index) => found[index]);\n  const managers = [\"npm\", ...available];\n\n  cachedSystemManagers = managers;\n  cachedPreferredManager = preferredPackageManager(manager =>\n    managers.includes(manager),\n  );\n}\n\n/**\n * Get available package managers on the system\n */\nexport function getSystemPackageManagers(): string[] {\n  if (cachedSystemManagers) return cachedSystemManagers;\n\n  // Same list the async detector probes, so the two can no longer disagree\n  // about which managers exist. npm is assumed to be always available.\n  return [\"npm\", ...PROBED_PACKAGE_MANAGERS.filter(isInstalled)];\n}\n\n/**\n * Get the preferred package manager based on priority\n */\nexport function getPreferredPackageManager(): string {\n  if (cachedPreferredManager) return cachedPreferredManager;\n  return preferredPackageManager(\n    manager => manager === \"npm\" || isInstalled(manager),\n  );\n}\n\nexport function setPackageManager(packageManager: string) {\n  detectedPackageManager = packageManager;\n}\n\nexport function installCommand() {\n  return `${getPackageManager()} install`;\n}\n\nexport function startCommand() {\n  if (getPackageManager() === \"npm\") return \"npm run dev\";\n\n  return `${getPackageManager()} dev`;\n}\n\nexport function runPackageManagerCommand(command: string) {\n  const packageManager = getPackageManager();\n\n  if (packageManager === \"npm\") return `npm run ${command}`;\n\n  return `${packageManager} ${command}`;\n}\n"],"mappings":";;;;;AAIA,MAAM,YAAY,UAAU,IAAI;AAEhC,IAAI;AACJ,IAAI;AACJ,IAAI;;;;;;;;AASJ,MAAa,2BAA2B;CAAC;CAAO;CAAQ;CAAQ;AAAK;;AAKrE,SAAgB,sBACd,OACgC;CAChC,OAAQ,yBAA+C,SAAS,KAAK;AACvE;AAEA,SAAgB,oBAAoB;CAClC,IAAI,wBACF,OAAO;CAGT,OAAO,2BAA2B;AACpC;;;;AAKA,SAAS,YAAY,SAA0B;CAC7C,IAAI;EACF,SAAS,GAAG,QAAQ,aAAa,EAAE,OAAO,SAAS,CAAC;EACpD,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,eAAe,aAAa,SAAmC;CAC7D,IAAI;EACF,MAAM,UAAU,GAAG,QAAQ,WAAW;EACtC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;AAWA,MAAM,0BAA0B,yBAAyB,QACvD,YAAW,YAAY,KACzB;AAEA,MAAM,6BAA6B;CAAC;CAAQ;CAAQ;AAAK;;;;;AAMzD,SAAS,wBACP,aACQ;CACR,MAAM,YAAY,qBAAqB,CAAC,EAAE;CAC1C,IAAI,aAAa,cAAc,SAAS,sBAAsB,SAAS,GACrE,OAAO;CAGT,OAAO,2BAA2B,KAAK,WAAW,KAAK;AACzD;;;;AAKA,eAAsB,wBAAwB;CAC5C,MAAM,QAAQ,MAAM,QAAQ,IAAI,wBAAwB,IAAI,YAAY,CAAC;CAEzE,MAAM,WAAW,CAAC,OAAO,GADP,wBAAwB,QAAQ,GAAG,UAAU,MAAM,MACjC,CAAC;CAErC,uBAAuB;CACvB,yBAAyB,yBAAwB,YAC/C,SAAS,SAAS,OAAO,CAC3B;AACF;;;;AAKA,SAAgB,2BAAqC;CACnD,IAAI,sBAAsB,OAAO;CAIjC,OAAO,CAAC,OAAO,GAAG,wBAAwB,OAAO,WAAW,CAAC;AAC/D;;;;AAKA,SAAgB,6BAAqC;CACnD,IAAI,wBAAwB,OAAO;CACnC,OAAO,yBACL,YAAW,YAAY,SAAS,YAAY,OAAO,CACrD;AACF;AAEA,SAAgB,kBAAkB,gBAAwB;CACxD,yBAAyB;AAC3B;AAYA,SAAgB,yBAAyB,SAAiB;CACxD,MAAM,iBAAiB,kBAAkB;CAEzC,IAAI,mBAAmB,OAAO,OAAO,WAAW;CAEhD,OAAO,GAAG,eAAe,GAAG;AAC9B"}
+{"version":3,"file":"package-manager.mjs","names":[],"sources":["../../../../../../../packages/create-warlock/src/helpers/package-manager.ts"],"sourcesContent":["import { exec, execSync } from \"child_process\";\nimport { promisify } from \"util\";\nimport detectPackageManager from \"which-pm-runs\";\n\nconst execAsync = promisify(exec);\n\nlet detectedPackageManager: string | undefined;\nlet cachedSystemManagers: string[] | undefined;\nlet cachedPreferredManager: string | undefined;\n\n/**\n * The only package managers `--pm` may select. This value reaches `spawn()`\n * as the executable to run and is spliced into the generated\n * `package.json`'s scripts — an allow-list here is a hard security\n * boundary, not just input hygiene, so it stays a fixed literal list\n * rather than anything derived from user input or the running environment.\n */\nexport const ALLOWED_PACKAGE_MANAGERS = [\"npm\", \"yarn\", \"pnpm\", \"bun\"] as const;\n\nexport type AllowedPackageManager = (typeof ALLOWED_PACKAGE_MANAGERS)[number];\n\n/** Whether `value` is one of the allow-listed package managers. */\nexport function isValidPackageManager(\n  value: string,\n): value is AllowedPackageManager {\n  return (ALLOWED_PACKAGE_MANAGERS as readonly string[]).includes(value);\n}\n\nexport function getPackageManager() {\n  if (detectedPackageManager) {\n    return detectedPackageManager;\n  }\n\n  return getPreferredPackageManager();\n}\n\n/**\n * Check if a package manager is installed\n */\nfunction isInstalled(manager: string): boolean {\n  try {\n    execSync(`${manager} --version`, { stdio: \"ignore\" });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check if a package manager is installed (async)\n */\nasync function checkManager(manager: string): Promise<boolean> {\n  try {\n    await execAsync(`${manager} --version`);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Every allow-listed manager that has to be PROBED. npm is excluded because\n * it is assumed present.\n *\n * Both detectors read this one list. They used to hold their own literal\n * copies, and the copies drifted: `bun` reached the allow-list and `--help`\n * without reaching either probe, so `--pm=bun` passed the spelling check and\n * then could never appear among the options that would honour it.\n */\nconst PROBED_PACKAGE_MANAGERS = ALLOWED_PACKAGE_MANAGERS.filter(\n  manager => manager !== \"npm\",\n);\n\nconst PREFERRED_PACKAGE_MANAGERS = [\"pnpm\", \"yarn\", \"npm\"] as const;\n\n/**\n * A running non-npm manager is already usable. Every fallback must be present\n * in the detector's installed set, so both sync and async paths agree.\n */\nfunction preferredPackageManager(\n  isAvailable: (manager: AllowedPackageManager) => boolean,\n): string {\n  const runningPm = detectPackageManager()?.name;\n  if (runningPm && runningPm !== \"npm\" && isValidPackageManager(runningPm)) {\n    return runningPm;\n  }\n\n  return PREFERRED_PACKAGE_MANAGERS.find(isAvailable) ?? \"npm\";\n}\n\n/**\n * Detect available package managers asynchronously and cache results\n */\nexport async function detectPackageManagers() {\n  const found = await Promise.all(PROBED_PACKAGE_MANAGERS.map(checkManager));\n  const available = PROBED_PACKAGE_MANAGERS.filter((_, index) => found[index]);\n  const managers = [\"npm\", ...available];\n\n  cachedSystemManagers = managers;\n  cachedPreferredManager = preferredPackageManager(manager =>\n    managers.includes(manager),\n  );\n}\n\n/**\n * Get available package managers on the system\n */\nexport function getSystemPackageManagers(): string[] {\n  if (cachedSystemManagers) return cachedSystemManagers;\n\n  // Same list the async detector probes, so the two can no longer disagree\n  // about which managers exist. npm is assumed to be always available.\n  return [\"npm\", ...PROBED_PACKAGE_MANAGERS.filter(isInstalled)];\n}\n\n/**\n * Get the preferred package manager based on priority\n */\nexport function getPreferredPackageManager(): string {\n  if (cachedPreferredManager) return cachedPreferredManager;\n  return preferredPackageManager(\n    manager => manager === \"npm\" || isInstalled(manager),\n  );\n}\n\nexport function setPackageManager(packageManager: string) {\n  detectedPackageManager = packageManager;\n}\n\nlet cachedPnpmVersion: string | null | undefined;\n\n/**\n * The version `pnpm --version` reports, or undefined when pnpm cannot be run.\n * The scaffold's pnpm settings depend on it (see pnpmBuildApprovalLayout).\n */\nexport function getPnpmVersion(): string | undefined {\n  if (cachedPnpmVersion === undefined) {\n    try {\n      cachedPnpmVersion = execSync(\"pnpm --version\", {\n        encoding: \"utf8\",\n        stdio: [\"ignore\", \"pipe\", \"ignore\"],\n      }).trim();\n    } catch {\n      cachedPnpmVersion = null;\n    }\n  }\n\n  return cachedPnpmVersion ?? undefined;\n}\n\nexport function installCommand() {\n  return `${getPackageManager()} install`;\n}\n\nexport function startCommand() {\n  if (getPackageManager() === \"npm\") return \"npm run dev\";\n\n  return `${getPackageManager()} dev`;\n}\n\nexport function runPackageManagerCommand(command: string) {\n  const packageManager = getPackageManager();\n\n  if (packageManager === \"npm\") return `npm run ${command}`;\n\n  return `${packageManager} ${command}`;\n}\n"],"mappings":";;;;;AAIA,MAAM,YAAY,UAAU,IAAI;AAEhC,IAAI;AACJ,IAAI;AACJ,IAAI;;;;;;;;AASJ,MAAa,2BAA2B;CAAC;CAAO;CAAQ;CAAQ;AAAK;;AAKrE,SAAgB,sBACd,OACgC;CAChC,OAAQ,yBAA+C,SAAS,KAAK;AACvE;AAEA,SAAgB,oBAAoB;CAClC,IAAI,wBACF,OAAO;CAGT,OAAO,2BAA2B;AACpC;;;;AAKA,SAAS,YAAY,SAA0B;CAC7C,IAAI;EACF,SAAS,GAAG,QAAQ,aAAa,EAAE,OAAO,SAAS,CAAC;EACpD,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,eAAe,aAAa,SAAmC;CAC7D,IAAI;EACF,MAAM,UAAU,GAAG,QAAQ,WAAW;EACtC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;AAWA,MAAM,0BAA0B,yBAAyB,QACvD,YAAW,YAAY,KACzB;AAEA,MAAM,6BAA6B;CAAC;CAAQ;CAAQ;AAAK;;;;;AAMzD,SAAS,wBACP,aACQ;CACR,MAAM,YAAY,qBAAqB,CAAC,EAAE;CAC1C,IAAI,aAAa,cAAc,SAAS,sBAAsB,SAAS,GACrE,OAAO;CAGT,OAAO,2BAA2B,KAAK,WAAW,KAAK;AACzD;;;;AAKA,eAAsB,wBAAwB;CAC5C,MAAM,QAAQ,MAAM,QAAQ,IAAI,wBAAwB,IAAI,YAAY,CAAC;CAEzE,MAAM,WAAW,CAAC,OAAO,GADP,wBAAwB,QAAQ,GAAG,UAAU,MAAM,MACjC,CAAC;CAErC,uBAAuB;CACvB,yBAAyB,yBAAwB,YAC/C,SAAS,SAAS,OAAO,CAC3B;AACF;;;;AAKA,SAAgB,2BAAqC;CACnD,IAAI,sBAAsB,OAAO;CAIjC,OAAO,CAAC,OAAO,GAAG,wBAAwB,OAAO,WAAW,CAAC;AAC/D;;;;AAKA,SAAgB,6BAAqC;CACnD,IAAI,wBAAwB,OAAO;CACnC,OAAO,yBACL,YAAW,YAAY,SAAS,YAAY,OAAO,CACrD;AACF;AAEA,SAAgB,kBAAkB,gBAAwB;CACxD,yBAAyB;AAC3B;AAEA,IAAI;;;;;AAMJ,SAAgB,iBAAqC;CACnD,IAAI,sBAAsB,QACxB,IAAI;EACF,oBAAoB,SAAS,kBAAkB;GAC7C,UAAU;GACV,OAAO;IAAC;IAAU;IAAQ;GAAQ;EACpC,CAAC,CAAC,CAAC,KAAK;CACV,QAAQ;EACN,oBAAoB;CACtB;CAGF,OAAO,qBAAqB;AAC9B;AAYA,SAAgB,yBAAyB,SAAiB;CACxD,MAAM,iBAAiB,kBAAkB;CAEzC,IAAI,mBAAmB,OAAO,OAAO,WAAW;CAEhD,OAAO,GAAG,eAAe,GAAG;AAC9B"}

package/esm/helpers/paths.mjs

@@ -1,7 +1,7 @@
 import path from "path";
 import { fileURLToPath } from "url";
 
-//#region ../create-warlock/src/helpers/paths.ts
+//#region ../../packages/create-warlock/src/helpers/paths.ts
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 function template(templateName) {

package/esm/helpers/paths.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"paths.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/paths.ts"],"sourcesContent":["import path from \"path\";\nimport { fileURLToPath } from \"url\";\n\nconst __filename = fileURLToPath(import.meta.url);\n\nconst __dirname = path.dirname(__filename);\n\nexport type Template = \"warlock\";\n\nexport function template(templateName: Template): string {\n  return path.resolve(__dirname, \"../\", \"../\", \"templates\", templateName);\n}\n\nexport function packageRoot(...paths: string[]): string {\n  return path.resolve(__dirname, \"../\", \"../\", ...paths);\n}\n"],"mappings":";;;;AAGA,MAAM,aAAa,cAAc,OAAO,KAAK,GAAG;AAEhD,MAAM,YAAY,KAAK,QAAQ,UAAU;AAIzC,SAAgB,SAAS,cAAgC;CACvD,OAAO,KAAK,QAAQ,WAAW,OAAO,OAAO,aAAa,YAAY;AACxE;AAEA,SAAgB,YAAY,GAAG,OAAyB;CACtD,OAAO,KAAK,QAAQ,WAAW,OAAO,OAAO,GAAG,KAAK;AACvD"}
+{"version":3,"file":"paths.mjs","names":[],"sources":["../../../../../../../packages/create-warlock/src/helpers/paths.ts"],"sourcesContent":["import path from \"path\";\nimport { fileURLToPath } from \"url\";\n\nconst __filename = fileURLToPath(import.meta.url);\n\nconst __dirname = path.dirname(__filename);\n\nexport type Template = \"warlock\";\n\nexport function template(templateName: Template): string {\n  return path.resolve(__dirname, \"../\", \"../\", \"templates\", templateName);\n}\n\nexport function packageRoot(...paths: string[]): string {\n  return path.resolve(__dirname, \"../\", \"../\", ...paths);\n}\n"],"mappings":";;;;AAGA,MAAM,aAAa,cAAc,OAAO,KAAK,GAAG;AAEhD,MAAM,YAAY,KAAK,QAAQ,UAAU;AAIzC,SAAgB,SAAS,cAAgC;CACvD,OAAO,KAAK,QAAQ,WAAW,OAAO,OAAO,aAAa,YAAY;AACxE;AAEA,SAAgB,YAAY,GAAG,OAAyB;CACtD,OAAO,KAAK,QAAQ,WAAW,OAAO,OAAO,GAAG,KAAK;AACvD"}

package/esm/helpers/pnpm-build-approvals.mjs

@@ -1,11 +1,66 @@
-//#region ../create-warlock/src/helpers/pnpm-build-approvals.ts
+//#region ../../packages/create-warlock/src/helpers/pnpm-build-approvals.ts
+/**
+* Install scripts the template itself needs, mirrored from the `allowBuilds`
+* map in templates/warlock/pnpm-workspace.yaml (a spec keeps the two equal).
+*/
+const BASE_PNPM_BUILD_APPROVALS = ["esbuild"];
+function pnpmBuildApprovalLayout(version) {
+	const match = /^(\d+)\.(\d+)\./.exec(version?.trim() ?? "");
+	if (!match) return "allowBuilds";
+	const major = Number(match[1]);
+	const minor = Number(match[2]);
+	if (major < 10 || major === 10 && minor < 5) return "packageJson";
+	if (major === 10 && minor < 26) return "onlyBuiltDependencies";
+	return "allowBuilds";
+}
+/**
+* Add packages to a block-style `onlyBuiltDependencies:` list, creating it when
+* absent. A flow list or an alias is left alone rather than rewritten.
+*/
+function mergeOnlyBuiltDependencies(yaml, packages) {
+	if (packages.length === 0) return yaml;
+	const block = /^onlyBuiltDependencies:\s*(?:#.*)?(?:\r?\n|$)/m.exec(yaml);
+	if (!block) {
+		if (/^(?:onlyBuiltDependencies|"onlyBuiltDependencies"|'onlyBuiltDependencies')\s*:/m.test(yaml)) return yaml;
+		const items = packages.map((name) => `  - ${name}`).join("\n");
+		return `${yaml.replace(/\s*$/, "")}\n\n# pnpm 10.5-10.25 read install-script approvals from this list.\nonlyBuiltDependencies:\n${items}\n`;
+	}
+	const start = block.index + block[0].length;
+	const tail = yaml.slice(start);
+	const nextTopLevel = /^(?!\s|#|$)[^\r\n]+/m.exec(tail);
+	const end = nextTopLevel ? start + nextTopLevel.index : yaml.length;
+	const list = yaml.slice(start, end);
+	const listed = new Set([...list.matchAll(/^\s*-\s*["']?([^"'\s#]+)["']?/gm)].map((entry) => entry[1]));
+	const missing = packages.filter((name) => !listed.has(name));
+	if (missing.length === 0) return yaml;
+	const indentation = /^([ \t]*)-/m.exec(list)?.[1] ?? "  ";
+	const additions = missing.map((name) => `${indentation}- ${name}\n`).join("");
+	return `${yaml.slice(0, start)}${additions}${list}${yaml.slice(end)}`;
+}
+/**
+* Add packages to `pnpm.onlyBuiltDependencies` in a parsed package.json,
+* keeping existing entries and their order.
+*/
+function mergePackageJsonBuildApprovals(packageJson, packages) {
+	const pnpm = packageJson.pnpm ?? {};
+	const current = Array.isArray(pnpm.onlyBuiltDependencies) ? pnpm.onlyBuiltDependencies : [];
+	const merged = [...current, ...packages.filter((name) => !current.includes(name))];
+	return {
+		...packageJson,
+		pnpm: {
+			...pnpm,
+			onlyBuiltDependencies: merged
+		}
+	};
+}
 /** Native dependency build scripts required by features the scaffold explicitly selected. */
 const FEATURE_BUILD_APPROVALS = { image: ["sharp"] };
 function requiredPnpmBuildApprovals(features) {
 	return [...new Set(features.flatMap((feature) => FEATURE_BUILD_APPROVALS[feature] ?? []))];
 }
 /**
-* Add only known feature-required builds to pnpm 11's workspace policy.
+* Add only known feature-required builds to the workspace `allowBuilds` policy
+* (pnpm 10.26+, 11, 12).
 * Existing `false` values are user decisions and are never overridden.
 */
 function mergePnpmBuildApprovals(yaml, packages) {
@@ -42,5 +97,5 @@ function mergeOneApproval(yaml, packageName) {
 }
 
 //#endregion
-export { mergePnpmBuildApprovals, requiredPnpmBuildApprovals };
+export { BASE_PNPM_BUILD_APPROVALS, mergeOnlyBuiltDependencies, mergePackageJsonBuildApprovals, mergePnpmBuildApprovals, pnpmBuildApprovalLayout, requiredPnpmBuildApprovals };
 //# sourceMappingURL=pnpm-build-approvals.mjs.map

package/esm/helpers/pnpm-build-approvals.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"pnpm-build-approvals.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/pnpm-build-approvals.ts"],"sourcesContent":["/** Native dependency build scripts required by features the scaffold explicitly selected. */\nconst FEATURE_BUILD_APPROVALS: Readonly<Record<string, readonly string[]>> = {\n  image: [\"sharp\"],\n};\n\nexport function requiredPnpmBuildApprovals(\n  features: readonly string[],\n): readonly string[] {\n  return [\n    ...new Set(\n      features.flatMap(feature => FEATURE_BUILD_APPROVALS[feature] ?? []),\n    ),\n  ];\n}\n\n/**\n * Add only known feature-required builds to pnpm 11's workspace policy.\n * Existing `false` values are user decisions and are never overridden.\n */\nexport function mergePnpmBuildApprovals(\n  yaml: string,\n  packages: readonly string[],\n): string {\n  let result = yaml;\n  for (const packageName of packages) {\n    result = mergeOneApproval(result, packageName);\n  }\n  return result;\n}\n\nconst quotedKey = (name: string) => `(?:${name}|\"${name}\"|'${name}')`;\n\n/** Edit one ordinary YAML mapping while preserving every untouched byte. */\nfunction mergeOneApproval(yaml: string, packageName: string): string {\n  const escaped = packageName.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  const block = /^allowBuilds:\\s*(?:#.*)?(?:\\r?\\n|$)/m.exec(yaml);\n\n  if (!block) {\n    // Flow mappings are deliberately not rewritten. A hand parser must never\n    // turn a decided flow entry into a duplicate block key.\n    if (/^(?:allowBuilds|\"allowBuilds\"|'allowBuilds')\\s*:/m.test(yaml))\n      return yaml;\n    return `${yaml.replace(/\\s*$/, \"\")}\\nallowBuilds:\\n  ${packageName}: true\\n`;\n  }\n\n  const start = block.index + block[0].length;\n  const tail = yaml.slice(start);\n  const nextTopLevel = /^(?!\\s|#|$)[^\\r\\n]+/m.exec(tail);\n  const end = nextTopLevel ? start + nextTopLevel.index : yaml.length;\n  const mapping = yaml.slice(start, end);\n  const key = quotedKey(escaped);\n  const entry = new RegExp(\n    `^(\\\\s*)${key}\\\\s*:\\\\s*([^#\\\\r\\\\n]*)(.*)$`,\n    \"m\",\n  ).exec(mapping);\n\n  if (entry) {\n    const value = entry[2]!.trim();\n    if (value === \"true\" || value === \"false\") return yaml;\n    if (\n      !/^(?:set this to true or false|\"set this to true or false\"|'set this to true or false')$/.test(\n        value,\n      )\n    )\n      return yaml;\n    // pnpm's undecided placeholder belongs to this generated mapping: decide it\n    // in place rather than emitting a duplicate YAML key.\n    const comment = entry[3] ?? \"\";\n    const replacement = `${entry[1]}${packageName}: true${comment.startsWith(\"#\") ? \" \" : \"\"}${comment}`;\n    return `${yaml.slice(0, start)}${mapping.slice(0, entry.index)}${replacement}${mapping.slice(entry.index + entry[0].length)}${yaml.slice(end)}`;\n  }\n\n  const indentation = /^([ \\t]+)\\S/m.exec(mapping)?.[1] ?? \"  \";\n  return `${yaml.slice(0, start)}${indentation}${packageName}: true\\n${mapping}${yaml.slice(end)}`;\n}\n"],"mappings":";;AACA,MAAM,0BAAuE,EAC3E,OAAO,CAAC,OAAO,EACjB;AAEA,SAAgB,2BACd,UACmB;CACnB,OAAO,CACL,GAAG,IAAI,IACL,SAAS,SAAQ,YAAW,wBAAwB,YAAY,CAAC,CAAC,CACpE,CACF;AACF;;;;;AAMA,SAAgB,wBACd,MACA,UACQ;CACR,IAAI,SAAS;CACb,KAAK,MAAM,eAAe,UACxB,SAAS,iBAAiB,QAAQ,WAAW;CAE/C,OAAO;AACT;AAEA,MAAM,aAAa,SAAiB,MAAM,KAAK,IAAI,KAAK,KAAK,KAAK;;AAGlE,SAAS,iBAAiB,MAAc,aAA6B;CACnE,MAAM,UAAU,YAAY,QAAQ,uBAAuB,MAAM;CACjE,MAAM,QAAQ,uCAAuC,KAAK,IAAI;CAE9D,IAAI,CAAC,OAAO;EAGV,IAAI,oDAAoD,KAAK,IAAI,GAC/D,OAAO;EACT,OAAO,GAAG,KAAK,QAAQ,QAAQ,EAAE,EAAE,oBAAoB,YAAY;CACrE;CAEA,MAAM,QAAQ,MAAM,QAAQ,MAAM,EAAE,CAAC;CACrC,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,MAAM,eAAe,uBAAuB,KAAK,IAAI;CACrD,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,KAAK;CAC7D,MAAM,UAAU,KAAK,MAAM,OAAO,GAAG;CACrC,MAAM,MAAM,UAAU,OAAO;CAC7B,MAAM,QAAQ,IAAI,OAChB,UAAU,IAAI,8BACd,GACF,CAAC,CAAC,KAAK,OAAO;CAEd,IAAI,OAAO;EACT,MAAM,QAAQ,MAAM,EAAE,CAAE,KAAK;EAC7B,IAAI,UAAU,UAAU,UAAU,SAAS,OAAO;EAClD,IACE,CAAC,0FAA0F,KACzF,KACF,GAEA,OAAO;EAGT,MAAM,UAAU,MAAM,MAAM;EAC5B,MAAM,cAAc,GAAG,MAAM,KAAK,YAAY,QAAQ,QAAQ,WAAW,GAAG,IAAI,MAAM,KAAK;EAC3F,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,IAAI,QAAQ,MAAM,GAAG,MAAM,KAAK,IAAI,cAAc,QAAQ,MAAM,MAAM,QAAQ,MAAM,EAAE,CAAC,MAAM,IAAI,KAAK,MAAM,GAAG;CAC9I;CAEA,MAAM,cAAc,eAAe,KAAK,OAAO,CAAC,GAAG,MAAM;CACzD,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,IAAI,cAAc,YAAY,UAAU,UAAU,KAAK,MAAM,GAAG;AAC/F"}
+{"version":3,"file":"pnpm-build-approvals.mjs","names":[],"sources":["../../../../../../../packages/create-warlock/src/helpers/pnpm-build-approvals.ts"],"sourcesContent":["/**\n * Install scripts the template itself needs, mirrored from the `allowBuilds`\n * map in templates/warlock/pnpm-workspace.yaml (a spec keeps the two equal).\n */\nexport const BASE_PNPM_BUILD_APPROVALS: readonly string[] = [\"esbuild\"];\n\n/**\n * Where a pnpm version reads build approvals from, measured by real installs\n * of an esbuild dependency (create-warlock 5.30.0, FW / macOS report):\n *\n * - `packageJson`: pnpm 7–9 and 10.0–10.4. They reject a pnpm-workspace.yaml\n *   without `packages:` (\"packages field missing or empty\"), and adding\n *   `packages: [\".\"]` makes every later `pnpm add` fail with\n *   ERR_PNPM_ADDING_TO_ROOT. So the app gets no workspace file and lists the\n *   approvals under `pnpm.onlyBuiltDependencies` in package.json, which these\n *   versions honour.\n * - `onlyBuiltDependencies`: pnpm 10.5–10.25 accept the settings-only file but\n *   ignore `allowBuilds`; they read `onlyBuiltDependencies` from it.\n * - `allowBuilds`: pnpm 10.26 and later, 11 and 12. pnpm 11+ fails the install\n *   (ERR_PNPM_IGNORED_BUILDS) when only `onlyBuiltDependencies` is present.\n *\n * An unknown version gets the current layout, `allowBuilds`.\n */\nexport type PnpmBuildApprovalLayout =\n  \"packageJson\" | \"onlyBuiltDependencies\" | \"allowBuilds\";\n\nexport function pnpmBuildApprovalLayout(\n  version: string | undefined,\n): PnpmBuildApprovalLayout {\n  const match = /^(\\d+)\\.(\\d+)\\./.exec(version?.trim() ?? \"\");\n\n  if (!match) return \"allowBuilds\";\n\n  const major = Number(match[1]);\n  const minor = Number(match[2]);\n\n  if (major < 10 || (major === 10 && minor < 5)) return \"packageJson\";\n  if (major === 10 && minor < 26) return \"onlyBuiltDependencies\";\n\n  return \"allowBuilds\";\n}\n\n/**\n * Add packages to a block-style `onlyBuiltDependencies:` list, creating it when\n * absent. A flow list or an alias is left alone rather than rewritten.\n */\nexport function mergeOnlyBuiltDependencies(\n  yaml: string,\n  packages: readonly string[],\n): string {\n  if (packages.length === 0) return yaml;\n\n  const block = /^onlyBuiltDependencies:\\s*(?:#.*)?(?:\\r?\\n|$)/m.exec(yaml);\n\n  if (!block) {\n    if (\n      /^(?:onlyBuiltDependencies|\"onlyBuiltDependencies\"|'onlyBuiltDependencies')\\s*:/m.test(\n        yaml,\n      )\n    ) {\n      return yaml;\n    }\n\n    const items = packages.map(name => `  - ${name}`).join(\"\\n\");\n\n    return `${yaml.replace(/\\s*$/, \"\")}\\n\\n# pnpm 10.5-10.25 read install-script approvals from this list.\\nonlyBuiltDependencies:\\n${items}\\n`;\n  }\n\n  const start = block.index + block[0].length;\n  const tail = yaml.slice(start);\n  const nextTopLevel = /^(?!\\s|#|$)[^\\r\\n]+/m.exec(tail);\n  const end = nextTopLevel ? start + nextTopLevel.index : yaml.length;\n  const list = yaml.slice(start, end);\n  const listed = new Set(\n    [...list.matchAll(/^\\s*-\\s*[\"']?([^\"'\\s#]+)[\"']?/gm)].map(\n      entry => entry[1],\n    ),\n  );\n  const missing = packages.filter(name => !listed.has(name));\n\n  if (missing.length === 0) return yaml;\n\n  const indentation = /^([ \\t]*)-/m.exec(list)?.[1] ?? \"  \";\n  const additions = missing.map(name => `${indentation}- ${name}\\n`).join(\"\");\n\n  return `${yaml.slice(0, start)}${additions}${list}${yaml.slice(end)}`;\n}\n\n/**\n * Add packages to `pnpm.onlyBuiltDependencies` in a parsed package.json,\n * keeping existing entries and their order.\n */\nexport function mergePackageJsonBuildApprovals(\n  packageJson: Record<string, unknown>,\n  packages: readonly string[],\n): Record<string, unknown> {\n  const pnpm = (packageJson.pnpm ?? {}) as Record<string, unknown>;\n  const current = Array.isArray(pnpm.onlyBuiltDependencies)\n    ? (pnpm.onlyBuiltDependencies as string[])\n    : [];\n  const merged = [\n    ...current,\n    ...packages.filter(name => !current.includes(name)),\n  ];\n\n  return { ...packageJson, pnpm: { ...pnpm, onlyBuiltDependencies: merged } };\n}\n\n/** Native dependency build scripts required by features the scaffold explicitly selected. */\nconst FEATURE_BUILD_APPROVALS: Readonly<Record<string, readonly string[]>> = {\n  image: [\"sharp\"],\n};\n\nexport function requiredPnpmBuildApprovals(\n  features: readonly string[],\n): readonly string[] {\n  return [\n    ...new Set(\n      features.flatMap(feature => FEATURE_BUILD_APPROVALS[feature] ?? []),\n    ),\n  ];\n}\n\n/**\n * Add only known feature-required builds to the workspace `allowBuilds` policy\n * (pnpm 10.26+, 11, 12).\n * Existing `false` values are user decisions and are never overridden.\n */\nexport function mergePnpmBuildApprovals(\n  yaml: string,\n  packages: readonly string[],\n): string {\n  let result = yaml;\n  for (const packageName of packages) {\n    result = mergeOneApproval(result, packageName);\n  }\n  return result;\n}\n\nconst quotedKey = (name: string) => `(?:${name}|\"${name}\"|'${name}')`;\n\n/** Edit one ordinary YAML mapping while preserving every untouched byte. */\nfunction mergeOneApproval(yaml: string, packageName: string): string {\n  const escaped = packageName.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  const block = /^allowBuilds:\\s*(?:#.*)?(?:\\r?\\n|$)/m.exec(yaml);\n\n  if (!block) {\n    // Flow mappings are deliberately not rewritten. A hand parser must never\n    // turn a decided flow entry into a duplicate block key.\n    if (/^(?:allowBuilds|\"allowBuilds\"|'allowBuilds')\\s*:/m.test(yaml))\n      return yaml;\n    return `${yaml.replace(/\\s*$/, \"\")}\\nallowBuilds:\\n  ${packageName}: true\\n`;\n  }\n\n  const start = block.index + block[0].length;\n  const tail = yaml.slice(start);\n  const nextTopLevel = /^(?!\\s|#|$)[^\\r\\n]+/m.exec(tail);\n  const end = nextTopLevel ? start + nextTopLevel.index : yaml.length;\n  const mapping = yaml.slice(start, end);\n  const key = quotedKey(escaped);\n  const entry = new RegExp(\n    `^(\\\\s*)${key}\\\\s*:\\\\s*([^#\\\\r\\\\n]*)(.*)$`,\n    \"m\",\n  ).exec(mapping);\n\n  if (entry) {\n    const value = entry[2]!.trim();\n    if (value === \"true\" || value === \"false\") return yaml;\n    if (\n      !/^(?:set this to true or false|\"set this to true or false\"|'set this to true or false')$/.test(\n        value,\n      )\n    )\n      return yaml;\n    // pnpm's undecided placeholder belongs to this generated mapping: decide it\n    // in place rather than emitting a duplicate YAML key.\n    const comment = entry[3] ?? \"\";\n    const replacement = `${entry[1]}${packageName}: true${comment.startsWith(\"#\") ? \" \" : \"\"}${comment}`;\n    return `${yaml.slice(0, start)}${mapping.slice(0, entry.index)}${replacement}${mapping.slice(entry.index + entry[0].length)}${yaml.slice(end)}`;\n  }\n\n  const indentation = /^([ \\t]+)\\S/m.exec(mapping)?.[1] ?? \"  \";\n  return `${yaml.slice(0, start)}${indentation}${packageName}: true\\n${mapping}${yaml.slice(end)}`;\n}\n"],"mappings":";;;;;AAIA,MAAa,4BAA+C,CAAC,SAAS;AAsBtE,SAAgB,wBACd,SACyB;CACzB,MAAM,QAAQ,kBAAkB,KAAK,SAAS,KAAK,KAAK,EAAE;CAE1D,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,QAAQ,OAAO,MAAM,EAAE;CAC7B,MAAM,QAAQ,OAAO,MAAM,EAAE;CAE7B,IAAI,QAAQ,MAAO,UAAU,MAAM,QAAQ,GAAI,OAAO;CACtD,IAAI,UAAU,MAAM,QAAQ,IAAI,OAAO;CAEvC,OAAO;AACT;;;;;AAMA,SAAgB,2BACd,MACA,UACQ;CACR,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,QAAQ,iDAAiD,KAAK,IAAI;CAExE,IAAI,CAAC,OAAO;EACV,IACE,kFAAkF,KAChF,IACF,GAEA,OAAO;EAGT,MAAM,QAAQ,SAAS,KAAI,SAAQ,OAAO,MAAM,CAAC,CAAC,KAAK,IAAI;EAE3D,OAAO,GAAG,KAAK,QAAQ,QAAQ,EAAE,EAAE,+FAA+F,MAAM;CAC1I;CAEA,MAAM,QAAQ,MAAM,QAAQ,MAAM,EAAE,CAAC;CACrC,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,MAAM,eAAe,uBAAuB,KAAK,IAAI;CACrD,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,KAAK;CAC7D,MAAM,OAAO,KAAK,MAAM,OAAO,GAAG;CAClC,MAAM,SAAS,IAAI,IACjB,CAAC,GAAG,KAAK,SAAS,iCAAiC,CAAC,CAAC,CAAC,KACpD,UAAS,MAAM,EACjB,CACF;CACA,MAAM,UAAU,SAAS,QAAO,SAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;CAEzD,IAAI,QAAQ,WAAW,GAAG,OAAO;CAEjC,MAAM,cAAc,cAAc,KAAK,IAAI,CAAC,GAAG,MAAM;CACrD,MAAM,YAAY,QAAQ,KAAI,SAAQ,GAAG,YAAY,IAAI,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE;CAE1E,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,IAAI,YAAY,OAAO,KAAK,MAAM,GAAG;AACpE;;;;;AAMA,SAAgB,+BACd,aACA,UACyB;CACzB,MAAM,OAAQ,YAAY,QAAQ,CAAC;CACnC,MAAM,UAAU,MAAM,QAAQ,KAAK,qBAAqB,IACnD,KAAK,wBACN,CAAC;CACL,MAAM,SAAS,CACb,GAAG,SACH,GAAG,SAAS,QAAO,SAAQ,CAAC,QAAQ,SAAS,IAAI,CAAC,CACpD;CAEA,OAAO;EAAE,GAAG;EAAa,MAAM;GAAE,GAAG;GAAM,uBAAuB;EAAO;CAAE;AAC5E;;AAGA,MAAM,0BAAuE,EAC3E,OAAO,CAAC,OAAO,EACjB;AAEA,SAAgB,2BACd,UACmB;CACnB,OAAO,CACL,GAAG,IAAI,IACL,SAAS,SAAQ,YAAW,wBAAwB,YAAY,CAAC,CAAC,CACpE,CACF;AACF;;;;;;AAOA,SAAgB,wBACd,MACA,UACQ;CACR,IAAI,SAAS;CACb,KAAK,MAAM,eAAe,UACxB,SAAS,iBAAiB,QAAQ,WAAW;CAE/C,OAAO;AACT;AAEA,MAAM,aAAa,SAAiB,MAAM,KAAK,IAAI,KAAK,KAAK,KAAK;;AAGlE,SAAS,iBAAiB,MAAc,aAA6B;CACnE,MAAM,UAAU,YAAY,QAAQ,uBAAuB,MAAM;CACjE,MAAM,QAAQ,uCAAuC,KAAK,IAAI;CAE9D,IAAI,CAAC,OAAO;EAGV,IAAI,oDAAoD,KAAK,IAAI,GAC/D,OAAO;EACT,OAAO,GAAG,KAAK,QAAQ,QAAQ,EAAE,EAAE,oBAAoB,YAAY;CACrE;CAEA,MAAM,QAAQ,MAAM,QAAQ,MAAM,EAAE,CAAC;CACrC,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,MAAM,eAAe,uBAAuB,KAAK,IAAI;CACrD,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,KAAK;CAC7D,MAAM,UAAU,KAAK,MAAM,OAAO,GAAG;CACrC,MAAM,MAAM,UAAU,OAAO;CAC7B,MAAM,QAAQ,IAAI,OAChB,UAAU,IAAI,8BACd,GACF,CAAC,CAAC,KAAK,OAAO;CAEd,IAAI,OAAO;EACT,MAAM,QAAQ,MAAM,EAAE,CAAE,KAAK;EAC7B,IAAI,UAAU,UAAU,UAAU,SAAS,OAAO;EAClD,IACE,CAAC,0FAA0F,KACzF,KACF,GAEA,OAAO;EAGT,MAAM,UAAU,MAAM,MAAM;EAC5B,MAAM,cAAc,GAAG,MAAM,KAAK,YAAY,QAAQ,QAAQ,WAAW,GAAG,IAAI,MAAM,KAAK;EAC3F,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,IAAI,QAAQ,MAAM,GAAG,MAAM,KAAK,IAAI,cAAc,QAAQ,MAAM,MAAM,QAAQ,MAAM,EAAE,CAAC,MAAM,IAAI,KAAK,MAAM,GAAG;CAC9I;CAEA,MAAM,cAAc,eAAe,KAAK,OAAO,CAAC,GAAG,MAAM;CACzD,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,IAAI,cAAc,YAAY,UAAU,UAAU,KAAK,MAAM,GAAG;AAC/F"}

package/esm/helpers/project-builder-helpers.mjs

@@ -6,7 +6,7 @@ import "@clack/prompts";
 import { colors } from "@mongez/copper";
 import path from "path";
 
-//#region ../create-warlock/src/helpers/project-builder-helpers.ts
+//#region ../../packages/create-warlock/src/helpers/project-builder-helpers.ts
 /**
 * Bootstrap the project's git repository.
 *

package/esm/helpers/project-builder-helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"project-builder-helpers.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/project-builder-helpers.ts"],"sourcesContent":["import { outro } from \"@clack/prompts\";\nimport { colors } from \"@mongez/copper\";\nimport {\n  copyDirectory,\n  getFile,\n  getJsonFile,\n  putFile,\n  putJsonFile,\n  renameFile,\n} from \"@warlock.js/fs\";\nimport path from \"path\";\nimport { executeCommand } from \"./exec\";\nimport { startCommand } from \"./package-manager\";\nimport { Template, template } from \"./paths\";\n\n/**\n * Bootstrap the project's git repository.\n *\n * Returns `false` as soon as a step fails, and leaves that step's captured\n * output where the caller can claim it with `takeLastCommandOutput()`. It used\n * to `return true` unconditionally, which meant a machine without git printed\n * \"Grimoire initialized!\" over a directory that was not a repository.\n */\nexport async function initializeGitRepository(appPath: string) {\n  const steps: string[][] = [\n    // initialize git repository\n    [\"init\"],\n    // switching to `main` branch\n    [\"checkout\", \"-b\", \"main\"],\n    // add files\n    [\"add\", \".\"],\n    // commit files\n    [\"commit\", \"-m\", \"Initial commit\"],\n  ];\n\n  for (const args of steps) {\n    const succeeded = await executeCommand(`git`, args, appPath);\n\n    if (!succeeded) return false;\n  }\n\n  return true;\n}\n\nexport async function updateEnvFile(appPath: string, appName: string) {\n  // update package.json file\n  const packageJson: any = getJsonFile(path.resolve(appPath, \"package.json\"));\n\n  packageJson.name = appName;\n\n  putJsonFile(path.resolve(appPath, \"package.json\"), packageJson);\n\n  // update env file\n  const dotEnv = getFile(path.resolve(appPath, \".env\"))\n    .replace(\"AppName\", appName)\n    .replace(\n      \"AppCodeName\",\n      appName\n        .split(/-|_/g)\n        .map(word => word[0])\n        .join(\"\"),\n    );\n\n  putFile(path.resolve(appPath, \".env\"), dotEnv);\n\n  // update .env.production file\n  let dotEnvProduction = getFile(path.resolve(appPath, \".env.shared\"));\n\n  dotEnvProduction = dotEnvProduction.replace(\"AppName\", appName).replace(\n    \"AppCodeName\",\n    appName\n      .split(/-|_/g)\n      .map(word => word[0])\n      .join(\"\"),\n  );\n\n  putFile(path.resolve(appPath, \".env.shared\"), dotEnvProduction);\n}\n\nexport async function copyTemplateFiles(\n  templateName: Template,\n  appPath: string,\n  _appName: string,\n) {\n  // copy project files\n  copyDirectory(template(templateName), appPath);\n\n  // replace _.gitignore to\n  renameFile(\n    path.resolve(appPath, \"_.gitignore\"),\n    path.resolve(appPath, \".gitignore\"),\n  );\n}\n\nexport async function allDone(appName: string) {\n  outro(\n    \"Awesome! Your project is ready to rock! \" +\n      \"Run the following command to start development:\",\n  );\n\n  console.log(colors.cyan(`cd ${appName} && ${startCommand()}`));\n\n  console.log();\n\n  console.log(\n    `Pro tip: Install the ${colors.yellow(\n      \"Generator Z\",\n    )} extension in VSCode for helpful code snippets and productivity boosters!`,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuBA,eAAsB,wBAAwB,SAAiB;CAY7D,KAAK,MAAM,QAAQ;EATjB,CAAC,MAAM;EAEP;GAAC;GAAY;GAAM;EAAM;EAEzB,CAAC,OAAO,GAAG;EAEX;GAAC;GAAU;GAAM;EAAgB;CAGZ,GAGrB,IAAI,CAAC,MAFmB,eAAe,OAAO,MAAM,OAAO,GAE3C,OAAO;CAGzB,OAAO;AACT"}
+{"version":3,"file":"project-builder-helpers.mjs","names":[],"sources":["../../../../../../../packages/create-warlock/src/helpers/project-builder-helpers.ts"],"sourcesContent":["import { outro } from \"@clack/prompts\";\nimport { colors } from \"@mongez/copper\";\nimport {\n  copyDirectory,\n  getFile,\n  getJsonFile,\n  putFile,\n  putJsonFile,\n  renameFile,\n} from \"@warlock.js/fs\";\nimport path from \"path\";\nimport { executeCommand } from \"./exec\";\nimport { startCommand } from \"./package-manager\";\nimport { Template, template } from \"./paths\";\n\n/**\n * Bootstrap the project's git repository.\n *\n * Returns `false` as soon as a step fails, and leaves that step's captured\n * output where the caller can claim it with `takeLastCommandOutput()`. It used\n * to `return true` unconditionally, which meant a machine without git printed\n * \"Grimoire initialized!\" over a directory that was not a repository.\n */\nexport async function initializeGitRepository(appPath: string) {\n  const steps: string[][] = [\n    // initialize git repository\n    [\"init\"],\n    // switching to `main` branch\n    [\"checkout\", \"-b\", \"main\"],\n    // add files\n    [\"add\", \".\"],\n    // commit files\n    [\"commit\", \"-m\", \"Initial commit\"],\n  ];\n\n  for (const args of steps) {\n    const succeeded = await executeCommand(`git`, args, appPath);\n\n    if (!succeeded) return false;\n  }\n\n  return true;\n}\n\nexport async function updateEnvFile(appPath: string, appName: string) {\n  // update package.json file\n  const packageJson: any = getJsonFile(path.resolve(appPath, \"package.json\"));\n\n  packageJson.name = appName;\n\n  putJsonFile(path.resolve(appPath, \"package.json\"), packageJson);\n\n  // update env file\n  const dotEnv = getFile(path.resolve(appPath, \".env\"))\n    .replace(\"AppName\", appName)\n    .replace(\n      \"AppCodeName\",\n      appName\n        .split(/-|_/g)\n        .map(word => word[0])\n        .join(\"\"),\n    );\n\n  putFile(path.resolve(appPath, \".env\"), dotEnv);\n\n  // update .env.production file\n  let dotEnvProduction = getFile(path.resolve(appPath, \".env.shared\"));\n\n  dotEnvProduction = dotEnvProduction.replace(\"AppName\", appName).replace(\n    \"AppCodeName\",\n    appName\n      .split(/-|_/g)\n      .map(word => word[0])\n      .join(\"\"),\n  );\n\n  putFile(path.resolve(appPath, \".env.shared\"), dotEnvProduction);\n}\n\nexport async function copyTemplateFiles(\n  templateName: Template,\n  appPath: string,\n  _appName: string,\n) {\n  // copy project files\n  copyDirectory(template(templateName), appPath);\n\n  // replace _.gitignore to\n  renameFile(\n    path.resolve(appPath, \"_.gitignore\"),\n    path.resolve(appPath, \".gitignore\"),\n  );\n}\n\nexport async function allDone(appName: string) {\n  outro(\n    \"Awesome! Your project is ready to rock! \" +\n      \"Run the following command to start development:\",\n  );\n\n  console.log(colors.cyan(`cd ${appName} && ${startCommand()}`));\n\n  console.log();\n\n  console.log(\n    `Pro tip: Install the ${colors.yellow(\n      \"Generator Z\",\n    )} extension in VSCode for helpful code snippets and productivity boosters!`,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuBA,eAAsB,wBAAwB,SAAiB;CAY7D,KAAK,MAAM,QAAQ;EATjB,CAAC,MAAM;EAEP;GAAC;GAAY;GAAM;EAAM;EAEzB,CAAC,OAAO,GAAG;EAEX;GAAC;GAAU;GAAM;EAAgB;CAGZ,GAGrB,IAAI,CAAC,MAFmB,eAAe,OAAO,MAAM,OAAO,GAE3C,OAAO;CAGzB,OAAO;AACT"}

package/esm/helpers/tty.mjs

@@ -1,4 +1,4 @@
-//#region ../create-warlock/src/helpers/tty.ts
+//#region ../../packages/create-warlock/src/helpers/tty.ts
 /**
 * Whether stdin is attached to an interactive terminal.
 *

package/esm/helpers/tty.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"tty.mjs","names":[],"sources":["../../../../../../create-warlock/src/helpers/tty.ts"],"sourcesContent":["/**\n * Whether stdin is attached to an interactive terminal.\n *\n * A scaffolder spawned by CI, a script, or an agent harness has no TTY on\n * stdin — `process.stdin.isTTY` is `undefined` there. Prompting anyway does\n * not fail cleanly: `@clack/prompts` tries to put a non-existent terminal\n * into raw mode and Node's libuv layer throws `TTY initialization failed:\n * uv_tty_init returned EBADF (bad file descriptor)` before a single file is\n * written. That is an internal implementation detail leaking to a developer\n * whose only mistake was not being at a keyboard.\n *\n * Isolated in its own module (rather than read inline) so tests can mock the\n * non-interactive case without spawning a real detached process every time.\n */\nexport function hasInteractiveStdin(): boolean {\n  return Boolean(process.stdin.isTTY);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,SAAgB,sBAA+B;CAC7C,OAAO,QAAQ,QAAQ,MAAM,KAAK;AACpC"}
+{"version":3,"file":"tty.mjs","names":[],"sources":["../../../../../../../packages/create-warlock/src/helpers/tty.ts"],"sourcesContent":["/**\n * Whether stdin is attached to an interactive terminal.\n *\n * A scaffolder spawned by CI, a script, or an agent harness has no TTY on\n * stdin — `process.stdin.isTTY` is `undefined` there. Prompting anyway does\n * not fail cleanly: `@clack/prompts` tries to put a non-existent terminal\n * into raw mode and Node's libuv layer throws `TTY initialization failed:\n * uv_tty_init returned EBADF (bad file descriptor)` before a single file is\n * written. That is an internal implementation detail leaking to a developer\n * whose only mistake was not being at a keyboard.\n *\n * Isolated in its own module (rather than read inline) so tests can mock the\n * non-interactive case without spawning a real detached process every time.\n */\nexport function hasInteractiveStdin(): boolean {\n  return Boolean(process.stdin.isTTY);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,SAAgB,sBAA+B;CAC7C,OAAO,QAAQ,QAAQ,MAAM,KAAK;AACpC"}

package/esm/helpers/warlock-versions.mjs

@@ -1,7 +1,7 @@
 import { packageRoot, template } from "./paths.mjs";
 import { getJsonFile } from "@warlock.js/fs";
 
-//#region ../create-warlock/src/helpers/warlock-versions.ts
+//#region ../../packages/create-warlock/src/helpers/warlock-versions.ts
 /**
 * Resolving the version to stamp onto the generated project's `@warlock.js/*`
 * dependencies.