create-warlock 5.29.0 → 5.31.0

package/esm/ui/wrap-text.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap-text.mjs","names":[],"sources":["../../../../../../../packages/create-warlock/src/ui/wrap-text.ts"],"sourcesContent":["import { stripVTControlCharacters } from \"node:util\";\n\nconst segmenter = new Intl.Segmenter(undefined, { granularity: \"grapheme\" });\n\nexport function visibleWidth(text: string): number {\n  let width = 0;\n  for (const { segment } of segmenter.segment(stripVTControlCharacters(text))) {\n    if (/^[\\p{Mark}\\p{Control}\\p{Format}]+$/u.test(segment)) continue;\n    const point = segment.codePointAt(0)!;\n    const wide =\n      /[\\p{Extended_Pictographic}\\p{Regional_Indicator}]/u.test(segment) ||\n      (point >= 0x1100 &&\n        (point <= 0x115f ||\n          point === 0x2329 ||\n          point === 0x232a ||\n          (point >= 0x2e80 && point <= 0xa4cf) ||\n          (point >= 0xac00 && point <= 0xd7a3) ||\n          (point >= 0xf900 && point <= 0xfaff) ||\n          (point >= 0xfe10 && point <= 0xfe6f) ||\n          (point >= 0xff01 && point <= 0xff60) ||\n          (point >= 0xffe0 && point <= 0xffe6) ||\n          (point >= 0x20000 && point <= 0x3fffd)));\n    width += wide ? 2 : 1;\n  }\n  return width;\n}\n\nexport function wrapText(text: string, width: number): string[] {\n  const lines: string[] = [];\n  let line = \"\";\n  for (const word of stripVTControlCharacters(text).split(/\\s+/u)) {\n    if (line && visibleWidth(`${line} ${word}`) > width) {\n      lines.push(line);\n      line = \"\";\n    }\n    for (const { segment } of segmenter.segment(`${line ? \" \" : \"\"}${word}`)) {\n      if (visibleWidth(line + segment) > width) {\n        lines.push(line);\n        line = \"\";\n      }\n      line += segment;\n    }\n  }\n  if (line || !lines.length) lines.push(line);\n  return lines;\n}\n\nexport type StyledSegment = { text: string; style: (text: string) => string };\n\nexport function wrapStyledText(segments: StyledSegment[], width: number): string[] {\n  const text = segments.map((segment) => segment.text).join(\"\");\n  let offset = 0;\n  return wrapText(text, width).map((line) => {\n    while (/\\s/u.test(text[offset] ?? \"\") && offset < text.length) offset++;\n    const start = offset;\n    offset += line.length;\n    let segmentStart = 0;\n    return segments\n      .map((segment) => {\n        const segmentEnd = segmentStart + segment.text.length;\n        const from = Math.max(start, segmentStart);\n        const to = Math.min(offset, segmentEnd);\n        const result =\n          to > from\n            ? segment.style(segment.text.slice(from - segmentStart, to - segmentStart))\n            : \"\";\n        segmentStart = segmentEnd;\n        return result;\n      })\n      .join(\"\");\n  });\n}\n"],"mappings":";;;AAEA,MAAM,YAAY,IAAI,KAAK,UAAU,QAAW,EAAE,aAAa,WAAW,CAAC;AAE3E,SAAgB,aAAa,MAAsB;CACjD,IAAI,QAAQ;CACZ,KAAK,MAAM,EAAE,aAAa,UAAU,QAAQ,yBAAyB,IAAI,CAAC,GAAG;EAC3E,IAAI,sCAAsC,KAAK,OAAO,GAAG;EACzD,MAAM,QAAQ,QAAQ,YAAY,CAAC;EACnC,MAAM,OACJ,qDAAqD,KAAK,OAAO,KAChE,SAAS,SACP,SAAS,QACR,UAAU,QACV,UAAU,QACT,SAAS,SAAU,SAAS,SAC5B,SAAS,SAAU,SAAS,SAC5B,SAAS,SAAU,SAAS,SAC5B,SAAS,SAAU,SAAS,SAC5B,SAAS,SAAU,SAAS,SAC5B,SAAS,SAAU,SAAS,SAC5B,SAAS,UAAW,SAAS;EACpC,SAAS,OAAO,IAAI;CACtB;CACA,OAAO;AACT;AAEA,SAAgB,SAAS,MAAc,OAAyB;CAC9D,MAAM,QAAkB,CAAC;CACzB,IAAI,OAAO;CACX,KAAK,MAAM,QAAQ,yBAAyB,IAAI,CAAC,CAAC,MAAM,MAAM,GAAG;EAC/D,IAAI,QAAQ,aAAa,GAAG,KAAK,GAAG,MAAM,IAAI,OAAO;GACnD,MAAM,KAAK,IAAI;GACf,OAAO;EACT;EACA,KAAK,MAAM,EAAE,aAAa,UAAU,QAAQ,GAAG,OAAO,MAAM,KAAK,MAAM,GAAG;GACxE,IAAI,aAAa,OAAO,OAAO,IAAI,OAAO;IACxC,MAAM,KAAK,IAAI;IACf,OAAO;GACT;GACA,QAAQ;EACV;CACF;CACA,IAAI,QAAQ,CAAC,MAAM,QAAQ,MAAM,KAAK,IAAI;CAC1C,OAAO;AACT;AAIA,SAAgB,eAAe,UAA2B,OAAyB;CACjF,MAAM,OAAO,SAAS,KAAK,YAAY,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE;CAC5D,IAAI,SAAS;CACb,OAAO,SAAS,MAAM,KAAK,CAAC,CAAC,KAAK,SAAS;EACzC,OAAO,MAAM,KAAK,KAAK,WAAW,EAAE,KAAK,SAAS,KAAK,QAAQ;EAC/D,MAAM,QAAQ;EACd,UAAU,KAAK;EACf,IAAI,eAAe;EACnB,OAAO,SACJ,KAAK,YAAY;GAChB,MAAM,aAAa,eAAe,QAAQ,KAAK;GAC/C,MAAM,OAAO,KAAK,IAAI,OAAO,YAAY;GACzC,MAAM,KAAK,KAAK,IAAI,QAAQ,UAAU;GACtC,MAAM,SACJ,KAAK,OACD,QAAQ,MAAM,QAAQ,KAAK,MAAM,OAAO,cAAc,KAAK,YAAY,CAAC,IACxE;GACN,eAAe;GACf,OAAO;EACT,CAAC,CAAC,CACD,KAAK,EAAE;CACZ,CAAC;AACH"}

package/llms-full.txt

@@ -40,7 +40,7 @@ The first positional argument is the project name; it also becomes the directory
 
 1. **Default (a TTY, no `--yes`, no `--interactive`)** — asks the project name (if not already given), API-only or full-stack web (`--stack`), then a database unless `--db` or `--no-db` already supplied it. The stack is the only choice that changes the generated app's shape.
 2. **`--yes` (or no TTY at all — CI, a script, an agent harness)** — fully headless. Every answer comes from a flag or its default; nothing is ever prompted, and stdin is never read.
-3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
+3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, lint/format toolchain, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
 
 **Without a terminal, `--yes` is not required.** When stdin is not a TTY — CI, a
 script, a container, an agent harness — the scaffolder does not try to prompt,
@@ -54,7 +54,7 @@ that is just the project name, the one required answer with no default:
 ```
 A project name is required and no terminal is available to ask for one. Pass it as
 the first argument or --name=<name>. Non-interactive flags: --yes, --pm=<npm|yarn|pnpm>,
---db=<driver>|--no-db, --features=<list>, --ai=<list>, --git|--no-git, --jwt|--no-jwt.
+--db=<driver>|--no-db, --features=<list>, --ai=<list>, --lint=<oxc|eslint>, --git|--no-git, --jwt|--no-jwt.
 ```
 
 ## After scaffolding: the decisions summary
@@ -63,36 +63,42 @@ Because almost every choice defaults silently, `create-warlock` prints what it
 decided right after scaffolding, e.g.:
 
 ```
-Using npm · database: none · agent-kit targets: claude
+Using npm · database: none · lint: eslint · agent-kit targets: claude
+Features: none
   change these — package manager: --pm, database: --db/--no-db, agents: --agents,
-  features: --features, ai: --ai, git: --git/--no-git, jwt: --jwt/--no-jwt — or
+  features: --features, ai: --ai, lint: --lint, git: --git/--no-git, jwt: --jwt/--no-jwt — or
   re-run with --interactive for the full wizard.
 ```
 
 ## Flags
 
-| Flag                       | Takes value | Default        | Purpose                                                              |
-| --------------------------- | ----------- | -------------- | ------------------------------------------------------------------- |
-| `<positional>` / `--name`  | yes         | — (required)   | Project name + target directory.                                    |
-| `--stack`                  | yes         | `api`          | `api` or `web` — the structural choice; `web` seeds the `web` feature by default. |
-| `--db`                     | yes         | `mongodb`      | Database driver key (`mongodb`, `postgres`, or `none`).             |
-| `--no-db`                  | no          | —              | Opt out of a database — shorthand for `--db=none`.                  |
-| `--pm`                     | yes         | inferred (`npm_config_user_agent` / system) | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
-| `--features`                | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default. |
-| `--ai`                      | yes (CSV)   | none           | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).     |
-| `--agents`                  | yes (CSV)   | `claude`       | Comma-separated `agent-kit` targets — see below.                    |
-| `--git` / `--no-git`        | no          | off            | Initialize a Git repo (`git init` + `main` branch + initial commit).|
-| `--jwt` / `--no-jwt`        | no          | off            | Generate JWT secrets via the project's `jwt` script.               |
-
-With `--pm=pnpm`, selecting the `image` feature records only Sharp's required
-native build approval in the generated `pnpm-workspace.yaml` before install.
-An explicit existing denial is retained. If selected feature dependencies do
+| Flag                           | Takes value | Default                                                             | Purpose                                                                                                                |
+| ------------------------------ | ----------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `<positional>` / `--name`      | yes         | — (required)                                                        | Project name + target directory.                                                                                       |
+| `--stack`                      | yes         | `api`                                                               | `api` or `web` — the structural choice; `web` seeds the `web` feature by default.                                      |
+| `--db`                         | yes         | `mongodb`                                                           | Database driver key (`mongodb`, `postgres`, or `none`).                                                                |
+| `--no-db`                      | no          | —                                                                   | Opt out of a database — shorthand for `--db=none`.                                                                     |
+| `--pm`                         | yes         | inferred (`npm_config_user_agent` / system)                         | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
+| `--features`                   | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default.                |
+| `--lint`                       | yes         | `eslint`                                                            | `oxc` (Oxlint/Oxfmt) or `eslint` (ESLint/Prettier); unknown or missing values fail before writes.                      |
+| `--ai`                         | yes (CSV)   | none                                                                | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).                                                        |
+| `--agents`                     | yes (CSV)   | `claude`                                                            | Comma-separated `agent-kit` targets — see below.                                                                       |
+| `--git` / `--no-git`           | no          | off                                                                 | Initialize a Git repo (`git init` + `main` branch + initial commit).                                                   |
+| `--jwt` / `--no-jwt`           | no          | off                                                                 | Generate JWT secrets via the project's `jwt` script.                                                                   |
+| `--yes` / `-y`                 | no          | off                                                                 | Fully headless mode.                                                                                                   |
+| `--interactive`, `--customize` | no          | off                                                                 | Restore the full long-form wizard.                                                                                     |
+
+With `--pm=pnpm`, the scaffold reads `pnpm --version` and records install-script
+approvals (esbuild, and Sharp when the `image` feature is selected) where that
+version reads them: `allowBuilds` in `pnpm-workspace.yaml` on pnpm 10.26+, 11
+and 12; that file plus `onlyBuiltDependencies` on 10.5–10.25; and, before 10.5,
+no workspace file (those versions reject one without `packages:`) but
+`pnpm.onlyBuiltDependencies` in `package.json`. An explicit existing denial is
+retained. If selected feature dependencies do
 not install, JWT generation is skipped and reported rather than retried through
 the package manager.
-| `--yes` / `-y`              | no          | off            | Fully headless mode.                                                 |
-| `--interactive`, `--customize` | no       | off            | Restore the full long-form wizard.                                   |
 
-Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--features` / `--ai` / `--agents` keys fail fast before any install.
+Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--pm` / `--db` / `--features` / `--ai` / `--agents` / `--lint` values fail fast before any write or install.
 
 `--help`/`-h` and `--version`/`-v` short-circuit before anything else — no prompt, filesystem write, or network call, and `--help` wins even over a positional project name. `--version` prints the installed `create-warlock` version. `--help` lists every flag above together with its default.
 
@@ -106,18 +112,18 @@ fallback that always works — even fully offline. Any other target
 `goose`, …) is validated against the list published at
 https://mongez.js.org/agent-kit/llms.txt, fetched once and cached locally. If
 that fetch fails for an explicitly requested non-default target, the run fails
-visibly and names every target it *could* determine — it never silently
+visibly and names every target it _could_ determine — it never silently
 guesses.
 
 ## Valid keys
 
 **Database drivers** (`--db`):
 
-| Key        | Default port | Status      |
-| ---------- | ------------ | ----------- |
-| `mongodb`  | 27017        | available   |
-| `postgres` | 5432         | available   |
-| `mysql`    | 3306         | coming soon (disabled in the wizard) |
+| Key        | Default port | Status                                                                   |
+| ---------- | ------------ | ------------------------------------------------------------------------ |
+| `mongodb`  | 27017        | available                                                                |
+| `postgres` | 5432         | available                                                                |
+| `mysql`    | 3306         | coming soon (disabled in the wizard)                                     |
 | `none`     | —            | opt out — no driver, no driver package, `src/config/database.ts` removed |
 
 **Features** (`--features`): `react`, `react-email`, `mail`, `ses`, `image`, `s3`, `redis`, `scheduler`, `herald`, `socket`, `test`, `access`, `web`, `tailwind`, `shadcn`, `notifications`.
@@ -187,4 +193,48 @@ Failures surface the error and halt; there is no rollback. After it finishes, `c
 - The `create-module` topic of the `warlock-js-core` skill — generate a new module inside the project.
 - The `add-connector` topic of the `warlock-js-core` skill — what `warlock add` wires when a feature pulls a connector.
 
+The project-ready summary wraps the complete feature list to your terminal width.
+Terminals narrower than 50 columns get a plain list; piped output uses 80 columns.
+
+## Custom feature groups
+
+`--customize` opens a section menu for optional features. Open a section to edit
+its checklist; **Select all** includes the remaining features while preserving
+items you explicitly unticked. The category cursor stays on the last edited
+section. Section
+counts update when returning to the menu, and **Continue** keeps the selection.
+Flags preselect their existing feature keys. Both menus and checklists retain
+terminal paging. The decisions overview previews up to six feature/AI keys with
+a total count; the success screen shows the complete list.
+
+## Choose the linter and formatter
+
+`--lint=eslint` is the default. `--lint=oxc` (also `--lint oxc`) installs exact
+`oxlint@1.88.0` and `oxfmt@0.73.0` versions, emits `.oxlintrc.json` and
+`.oxfmtrc.json`, and removes the template's ESLint/Prettier configs and dependencies.
+The custom wizard prompts for the same choice; a flag preselects it.
+
+```bash
+npm create warlock@latest my-app -- --lint=oxc --yes
+```
+
+Both choices provide `lint`/`format` and non-mutating `lint:check`/`format:check`
+scripts. Oxc projects also configure VS Code format-on-save with the official
+`oxc.oxc-vscode` formatter, use `source.fixAll.oxc` for lint fixes and recommend
+that extension. The ESLint toolchain retains its Prettier/ESLint editor settings.
+Oxc config enables `devServer.healthCheckers: { eslint: false, oxlint: true }` and
+leaves TypeScript health checks enabled. Style matches the template's 100-column,
+double-quote, semicolon and trailing-comma settings. Import sorting is on in
+`.oxfmtrc.json`, kept to one block like the ESLint toolchain's
+`prettier-plugin-organize-imports`:
+
+```json
+{ "sortImports": { "newlinesBetween": false } }
+```
+
+`format` (`oxfmt --write ./src`) orders built-ins, then packages, then relative
+imports. Oxfmt does not delete unused imports, so remove them from Oxlint's
+`no-unused-vars` diagnostics. Scripts in both toolchains call local binaries
+(`eslint --fix ./src --max-warnings=0`, `tsc --noEmit`), never `npx`.
+
 

package/package.json

@@ -4,24 +4,25 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/warlockjs/create-warlock"
+    "url": "git+https://github.com/warlockjs/framework.git",
+    "directory": "packages/create-warlock"
   },
   "bin": {
     "create-warlock": "bin/create-app.js"
   },
   "dependencies": {
-    "@clack/prompts": "^0.7.0",
+    "@clack/prompts": "^0.8.2",
     "@mongez/copper": "^2.1.3",
-    "@warlock.js/fs": "5.29.0",
+    "@warlock.js/fs": "5.31.0",
     "@mongez/reinforcements": "^4.0.2",
     "cross-spawn": "^7.0.3",
     "rimraf": "^6.0.1",
     "which-pm-runs": "^1.1.0"
   },
   "engines": {
-    "node": ">=22.13"
+    "node": ">=22.15"
   },
-  "version": "5.29.0",
+  "version": "5.31.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",

package/skills/create-a-warlock-project/SKILL.md

@@ -32,7 +32,7 @@ The first positional argument is the project name; it also becomes the directory
 
 1. **Default (a TTY, no `--yes`, no `--interactive`)** — asks the project name (if not already given), API-only or full-stack web (`--stack`), then a database unless `--db` or `--no-db` already supplied it. The stack is the only choice that changes the generated app's shape.
 2. **`--yes` (or no TTY at all — CI, a script, an agent harness)** — fully headless. Every answer comes from a flag or its default; nothing is ever prompted, and stdin is never read.
-3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
+3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, lint/format toolchain, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
 
 **Without a terminal, `--yes` is not required.** When stdin is not a TTY — CI, a
 script, a container, an agent harness — the scaffolder does not try to prompt,
@@ -46,7 +46,7 @@ that is just the project name, the one required answer with no default:
 ```
 A project name is required and no terminal is available to ask for one. Pass it as
 the first argument or --name=<name>. Non-interactive flags: --yes, --pm=<npm|yarn|pnpm>,
---db=<driver>|--no-db, --features=<list>, --ai=<list>, --git|--no-git, --jwt|--no-jwt.
+--db=<driver>|--no-db, --features=<list>, --ai=<list>, --lint=<oxc|eslint>, --git|--no-git, --jwt|--no-jwt.
 ```
 
 ## After scaffolding: the decisions summary
@@ -55,36 +55,42 @@ Because almost every choice defaults silently, `create-warlock` prints what it
 decided right after scaffolding, e.g.:
 
 ```
-Using npm · database: none · agent-kit targets: claude
+Using npm · database: none · lint: eslint · agent-kit targets: claude
+Features: none
   change these — package manager: --pm, database: --db/--no-db, agents: --agents,
-  features: --features, ai: --ai, git: --git/--no-git, jwt: --jwt/--no-jwt — or
+  features: --features, ai: --ai, lint: --lint, git: --git/--no-git, jwt: --jwt/--no-jwt — or
   re-run with --interactive for the full wizard.
 ```
 
 ## Flags
 
-| Flag                       | Takes value | Default        | Purpose                                                              |
-| --------------------------- | ----------- | -------------- | ------------------------------------------------------------------- |
-| `<positional>` / `--name`  | yes         | — (required)   | Project name + target directory.                                    |
-| `--stack`                  | yes         | `api`          | `api` or `web` — the structural choice; `web` seeds the `web` feature by default. |
-| `--db`                     | yes         | `mongodb`      | Database driver key (`mongodb`, `postgres`, or `none`).             |
-| `--no-db`                  | no          | —              | Opt out of a database — shorthand for `--db=none`.                  |
-| `--pm`                     | yes         | inferred (`npm_config_user_agent` / system) | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
-| `--features`                | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default. |
-| `--ai`                      | yes (CSV)   | none           | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).     |
-| `--agents`                  | yes (CSV)   | `claude`       | Comma-separated `agent-kit` targets — see below.                    |
-| `--git` / `--no-git`        | no          | off            | Initialize a Git repo (`git init` + `main` branch + initial commit).|
-| `--jwt` / `--no-jwt`        | no          | off            | Generate JWT secrets via the project's `jwt` script.               |
-
-With `--pm=pnpm`, selecting the `image` feature records only Sharp's required
-native build approval in the generated `pnpm-workspace.yaml` before install.
-An explicit existing denial is retained. If selected feature dependencies do
+| Flag                           | Takes value | Default                                                             | Purpose                                                                                                                |
+| ------------------------------ | ----------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `<positional>` / `--name`      | yes         | — (required)                                                        | Project name + target directory.                                                                                       |
+| `--stack`                      | yes         | `api`                                                               | `api` or `web` — the structural choice; `web` seeds the `web` feature by default.                                      |
+| `--db`                         | yes         | `mongodb`                                                           | Database driver key (`mongodb`, `postgres`, or `none`).                                                                |
+| `--no-db`                      | no          | —                                                                   | Opt out of a database — shorthand for `--db=none`.                                                                     |
+| `--pm`                         | yes         | inferred (`npm_config_user_agent` / system)                         | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
+| `--features`                   | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default.                |
+| `--lint`                       | yes         | `eslint`                                                            | `oxc` (Oxlint/Oxfmt) or `eslint` (ESLint/Prettier); unknown or missing values fail before writes.                      |
+| `--ai`                         | yes (CSV)   | none                                                                | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).                                                        |
+| `--agents`                     | yes (CSV)   | `claude`                                                            | Comma-separated `agent-kit` targets — see below.                                                                       |
+| `--git` / `--no-git`           | no          | off                                                                 | Initialize a Git repo (`git init` + `main` branch + initial commit).                                                   |
+| `--jwt` / `--no-jwt`           | no          | off                                                                 | Generate JWT secrets via the project's `jwt` script.                                                                   |
+| `--yes` / `-y`                 | no          | off                                                                 | Fully headless mode.                                                                                                   |
+| `--interactive`, `--customize` | no          | off                                                                 | Restore the full long-form wizard.                                                                                     |
+
+With `--pm=pnpm`, the scaffold reads `pnpm --version` and records install-script
+approvals (esbuild, and Sharp when the `image` feature is selected) where that
+version reads them: `allowBuilds` in `pnpm-workspace.yaml` on pnpm 10.26+, 11
+and 12; that file plus `onlyBuiltDependencies` on 10.5–10.25; and, before 10.5,
+no workspace file (those versions reject one without `packages:`) but
+`pnpm.onlyBuiltDependencies` in `package.json`. An explicit existing denial is
+retained. If selected feature dependencies do
 not install, JWT generation is skipped and reported rather than retried through
 the package manager.
-| `--yes` / `-y`              | no          | off            | Fully headless mode.                                                 |
-| `--interactive`, `--customize` | no       | off            | Restore the full long-form wizard.                                   |
 
-Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--features` / `--ai` / `--agents` keys fail fast before any install.
+Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--pm` / `--db` / `--features` / `--ai` / `--agents` / `--lint` values fail fast before any write or install.
 
 `--help`/`-h` and `--version`/`-v` short-circuit before anything else — no prompt, filesystem write, or network call, and `--help` wins even over a positional project name. `--version` prints the installed `create-warlock` version. `--help` lists every flag above together with its default.
 
@@ -98,18 +104,18 @@ fallback that always works — even fully offline. Any other target
 `goose`, …) is validated against the list published at
 https://mongez.js.org/agent-kit/llms.txt, fetched once and cached locally. If
 that fetch fails for an explicitly requested non-default target, the run fails
-visibly and names every target it *could* determine — it never silently
+visibly and names every target it _could_ determine — it never silently
 guesses.
 
 ## Valid keys
 
 **Database drivers** (`--db`):
 
-| Key        | Default port | Status      |
-| ---------- | ------------ | ----------- |
-| `mongodb`  | 27017        | available   |
-| `postgres` | 5432         | available   |
-| `mysql`    | 3306         | coming soon (disabled in the wizard) |
+| Key        | Default port | Status                                                                   |
+| ---------- | ------------ | ------------------------------------------------------------------------ |
+| `mongodb`  | 27017        | available                                                                |
+| `postgres` | 5432         | available                                                                |
+| `mysql`    | 3306         | coming soon (disabled in the wizard)                                     |
 | `none`     | —            | opt out — no driver, no driver package, `src/config/database.ts` removed |
 
 **Features** (`--features`): `react`, `react-email`, `mail`, `ses`, `image`, `s3`, `redis`, `scheduler`, `herald`, `socket`, `test`, `access`, `web`, `tailwind`, `shadcn`, `notifications`.
@@ -178,3 +184,47 @@ Failures surface the error and halt; there is no rollback. After it finishes, `c
 - The `run-app` topic of the `warlock-js-core` skill — `warlock dev` / `build` / `start` once the project exists.
 - The `create-module` topic of the `warlock-js-core` skill — generate a new module inside the project.
 - The `add-connector` topic of the `warlock-js-core` skill — what `warlock add` wires when a feature pulls a connector.
+
+The project-ready summary wraps the complete feature list to your terminal width.
+Terminals narrower than 50 columns get a plain list; piped output uses 80 columns.
+
+## Custom feature groups
+
+`--customize` opens a section menu for optional features. Open a section to edit
+its checklist; **Select all** includes the remaining features while preserving
+items you explicitly unticked. The category cursor stays on the last edited
+section. Section
+counts update when returning to the menu, and **Continue** keeps the selection.
+Flags preselect their existing feature keys. Both menus and checklists retain
+terminal paging. The decisions overview previews up to six feature/AI keys with
+a total count; the success screen shows the complete list.
+
+## Choose the linter and formatter
+
+`--lint=eslint` is the default. `--lint=oxc` (also `--lint oxc`) installs exact
+`oxlint@1.88.0` and `oxfmt@0.73.0` versions, emits `.oxlintrc.json` and
+`.oxfmtrc.json`, and removes the template's ESLint/Prettier configs and dependencies.
+The custom wizard prompts for the same choice; a flag preselects it.
+
+```bash
+npm create warlock@latest my-app -- --lint=oxc --yes
+```
+
+Both choices provide `lint`/`format` and non-mutating `lint:check`/`format:check`
+scripts. Oxc projects also configure VS Code format-on-save with the official
+`oxc.oxc-vscode` formatter, use `source.fixAll.oxc` for lint fixes and recommend
+that extension. The ESLint toolchain retains its Prettier/ESLint editor settings.
+Oxc config enables `devServer.healthCheckers: { eslint: false, oxlint: true }` and
+leaves TypeScript health checks enabled. Style matches the template's 100-column,
+double-quote, semicolon and trailing-comma settings. Import sorting is on in
+`.oxfmtrc.json`, kept to one block like the ESLint toolchain's
+`prettier-plugin-organize-imports`:
+
+```json
+{ "sortImports": { "newlinesBetween": false } }
+```
+
+`format` (`oxfmt --write ./src`) orders built-ins, then packages, then relative
+imports. Oxfmt does not delete unused imports, so remove them from Oxlint's
+`no-unused-vars` diagnostics. Scripts in both toolchains call local binaries
+(`eslint --fix ./src --max-warnings=0`, `tsc --noEmit`), never `npx`.

package/templates/toolchains/oxc/.oxfmtrc.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": true,
+  "tabWidth": 2,
+  "printWidth": 100,
+  "singleQuote": false,
+  "arrowParens": "always",
+  "trailingComma": "all",
+  "endOfLine": "lf",
+  "sortImports": { "newlinesBetween": false },
+  "ignorePatterns": ["node_modules/", "dist/"]
+}

package/templates/toolchains/oxc/.oxlintrc.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "import", "react"],
+  "env": { "node": true, "es2021": true },
+  "categories": { "correctness": "off" },
+  "rules": {
+    "typescript/no-explicit-any": "off",
+    "no-unused-vars": [
+      "warn",
+      {
+        "vars": "all",
+        "varsIgnorePattern": "^_",
+        "args": "after-used",
+        "argsIgnorePattern": "^_"
+      }
+    ],
+    "typescript/explicit-member-accessibility": ["error", { "accessibility": "explicit" }],
+    "typescript/consistent-type-imports": [
+      "error",
+      { "prefer": "type-imports", "disallowTypeAnnotations": false }
+    ]
+  },
+  "ignorePatterns": ["node_modules/", "dist/"]
+}

package/templates/toolchains/oxc/.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+  "recommendations": ["oxc.oxc-vscode"]
+}

package/templates/toolchains/oxc/.vscode/settings.json

@@ -0,0 +1,35 @@
+{
+  "editor.defaultFormatter": "oxc.oxc-vscode",
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.oxc": "explicit",
+    "source.organizeImports": "never"
+  },
+  "[typescript]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[typescriptreact]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[javascript]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[javascriptreact]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[json]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[css]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "oxc.enable.oxlint": true,
+  "oxc.enable.oxfmt": true,
+  "oxc.requireConfig": true
+}

package/templates/warlock/AGENTS.md

@@ -80,8 +80,8 @@ automatically on `postinstall`).
 - `yarn start` — start the production server (`warlock start`)
 - `yarn migrate` / `yarn migrate.fresh` / `yarn migrate.list` — run migrations
 - `yarn seed` — run database seeders
-- `yarn lint` / `yarn format` / `yarn tsc` — lint (eslint --fix), format
-  (prettier), and type-check (`tsc --noEmit`)
+- `yarn lint` / `yarn format` / `yarn tsc` — lint and format with the selected toolchain, and type-check (`tsc --noEmit`)
+- `npx warlock check` — verify a change: typecheck, lint, the affected tests and the framework's conventions in one report (`--changed` for only what changed); run it after every change and loop until it exits 0
 - `yarn skills:sync` — re-sync skills from `node_modules` and regenerate the
   derived per-agent files from this `AGENTS.md`
 
@@ -98,6 +98,13 @@ suffixes, and JSDoc on the public surface. The bar is senior-level clean code, n
 
 - Respect **module-boundaries** — do not reach across module internals.
 - Never weaken the **security-baseline** — always validate input at boundaries.
+- `npx warlock check` enforces these rules whichever linter the project uses:
+  pass `request.validated()` (never `request.all()`) to queries and services
+  (`WL9005`), give every POST/PUT/PATCH/DELETE route auth middleware or an
+  explicit `public: true` (`WL9006`), wrap request-supplied redirect targets in
+  `safeRedirect()` (`WL9007`), keep raw emails, tokens and request bodies out of
+  logs (`WL9008`) and bound regexes that run on request input (`WL9009`). Each
+  problem carries its fix; `npx warlock explain <CODE>` prints it again.
 - Follow **git-workflow** for commits and branches; do not commit or push unless
   explicitly asked.
 - When you are unsure how a package or feature works, **stop and read its skill**
@@ -122,3 +129,16 @@ Three things that trip everyone up on a fresh app:
   instance does not expose its columns as direct properties — `post.title` is
   `undefined` at runtime and a type error. Use `post.get("title")`, or
   `post.toJSON()` in a page loader (resources are the serialization gate).
+
+## This app (generated)
+
+`warlock dev` rewrites everything between the two markers below from the
+running app — modules, routes, models, installed skills and the commands to
+verify a change. Edit outside the markers; turn it off with
+`devServer.agentsMd: false` in `warlock.config.ts`.
+
+<!-- warlock:generated:start -->
+
+Run `npx warlock dev` (or `npx warlock agents-md --write`) to fill this section.
+
+<!-- warlock:generated:end -->

package/templates/warlock/README.md

@@ -7,7 +7,7 @@ Full documentation: [warlock.js.org](https://warlock.js.org).
 
 ## Requirements
 
-- Node.js **22.13** or newer
+- Node.js **22.15** or newer
 - The database you picked when scaffolding (MongoDB or PostgreSQL), running and
   reachable with the settings in `.env` — skip this if you scaffolded with no
   database
@@ -40,8 +40,10 @@ It restarts on file changes.
 | `npm run seed` | Run the database seeders |
 | `npm run jwt` | Generate a JWT secret into `.env` |
 | `npm run tsc` | Type-check without building |
-| `npm run lint` | ESLint, auto-fixing what it can |
-| `npm run format` | Prettier over `src/` |
+| `npm run lint` | The configured linter, auto-fixing what it can |
+| `npm run format` | The configured formatter over `src/` |
+| `npm run lint:check` | Lint without changing files |
+| `npm run format:check` | Check formatting without changing files |
 | `npm run skills:sync` | Refresh the AI agent skills (see below) |
 
 The `warlock` CLI has more than the scripts expose — run `npx warlock --help`

package/templates/warlock/package.json

@@ -19,12 +19,14 @@
     "gen.mig": "warlock generate.migration",
     "gen.r": "warlock generate.repository",
     "gen.rs": "warlock generate.resource",
-    "lint": "npx eslint --fix ./src --max-warnings=0",
-    "format": "npx prettier --write ./src/**/*.{js,jsx,ts,tsx,css,md,json} --config ./.prettierrc.json",
-    "tsc": "warlock generate.typings && npx tsc --noEmit",
+    "lint": "eslint --fix ./src --max-warnings=0",
+    "format": "prettier --write \"./src/**/*.{js,jsx,ts,tsx,css,md,json}\" --config ./.prettierrc.json",
+    "tsc": "warlock generate.typings && tsc --noEmit",
     "postinstall": "agent-kit init && agent-kit sync || echo \"warning: AI agent skills were NOT synced, so coding agents will not see the @warlock.js skills. Run the skills:sync script.\"",
     "skills:sync": "agent-kit sync",
-    "skills:watch": "agent-kit watch"
+    "skills:watch": "agent-kit watch",
+    "lint:check": "eslint ./src --max-warnings=0",
+    "format:check": "prettier --check \"./src/**/*.{js,jsx,ts,tsx,css,md,json}\" --config ./.prettierrc.json"
   },
   "dependencies": {
     "@mongez/reinforcements": "^4.0.2",

package/templates/warlock/skills/api-design/SKILL.md

@@ -24,8 +24,8 @@ The list lands under the **plural name of the module's resource** — `users`, `
 
 ```typescript
 // ✅ list-users.controller.ts
-export const listUsersController: RequestHandler = async (request, response) => {
-  const { data, pagination } = await listUsersService(request.all());
+export const listUsersController: RequestHandler = async ({ request, response }) => {
+  const { data, pagination } = await listUsersService(request.validated());
 
   return response.success({
     users: data,

package/templates/warlock/skills/code-standards/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: code-standards
-description: 'Project-level TypeScript code standards for apps built on Warlock.js — `interface` vs `type`, access modifiers, no `any`, no inline-duplicated unions, file-naming suffixes (`.contract.ts` / `.type.ts` / `.service.ts` / `.model.ts` / `.resource.ts` / `.spec.ts`), single-responsibility files, FP-factory + internal-class pattern, brace-every-control-block readability with blank lines between consecutive blocks, JSDoc on public surface and non-obvious logic, error classes extending framework errors, async/await + `Promise.all`, `undefined` over `null`, Vitest co-located, ESLint + Prettier. Triggers: writing/editing any `.ts` / `.tsx` file in this project; user asks "what are the code standards / style rules / conventions"; spawning a sub-agent that will write code; reviewing a diff for style issues; deciding `interface` vs `type`, when to use a class, where helpers live, how to name a file, or whether something needs JSDoc. Skip: pure-Markdown / JSON / YAML edits with no code change; runtime / behavior questions about a specific framework primitive — load the relevant `@warlock.js/<pkg>` skill instead; package-publishing or CI workflow questions.'
+description: 'Project-level TypeScript code standards for apps built on Warlock.js — `interface` vs `type`, access modifiers, no `any`, no inline-duplicated unions, file-naming suffixes (`.contract.ts` / `.type.ts` / `.service.ts` / `.model.ts` / `.resource.ts` / `.spec.ts`), single-responsibility files, FP-factory + internal-class pattern, brace-every-control-block readability with blank lines between consecutive blocks, JSDoc on public surface and non-obvious logic, error classes extending framework errors, async/await + `Promise.all`, `undefined` over `null`, Vitest co-located, ESLint/Prettier or Oxlint/Oxfmt. Triggers: writing/editing any `.ts` / `.tsx` file in this project; user asks "what are the code standards / style rules / conventions"; spawning a sub-agent that will write code; reviewing a diff for style issues; deciding `interface` vs `type`, when to use a class, where helpers live, how to name a file, or whether something needs JSDoc. Skip: pure-Markdown / JSON / YAML edits with no code change; runtime / behavior questions about a specific framework primitive — load the relevant `@warlock.js/<pkg>` skill instead; package-publishing or CI workflow questions.'
 ---
 
 # Code Standards
@@ -551,7 +551,20 @@ A secret with no safe default (a payment key, a signing secret) should fail loud
 
 ## 11. Tooling
 
-Ship a `.eslintrc` with at least these rules on:
+Use the project's selected toolchain: `eslint.config.js` + `.prettierrc.json`, or
+`.oxlintrc.json` + `.oxfmtrc.json`. Run `npm run lint:check` and
+`npm run format:check` for non-mutating checks. The Oxc scaffold enables the
+Oxlint development health checker and retains TypeScript checking.
+
+`npx warlock check` is the one verify command, in either toolchain: it
+typechecks, runs the configured linter and the affected tests, and checks the
+framework's conventions — `request.validated()` instead of `request.all()`,
+guarded or `public: true` mutating routes, safe redirects, redacted logs,
+bounded regexes on input, one controller per file, `type` (not `kind`) as a
+union's discriminator. Each problem has a `WL` code and its fix
+(`npx warlock explain <CODE>`).
+
+For ESLint, consider enabling these additional rules:
 
 - `@typescript-eslint/explicit-member-accessibility` — enforces § 1.2
 - `@typescript-eslint/no-explicit-any` — enforces § 1.3
@@ -561,7 +574,7 @@ Ship a `.eslintrc` with at least these rules on:
 - `curly` — enforces braces (§ 4.4)
 - `no-console` — enforces § 8
 
-Match the project's `.prettierrc` exactly. If two configs are present and disagree, the one closer to the file wins (Prettier's resolution order). Don't fight the formatter — configure it, then trust it.
+Match the selected formatter config: `.prettierrc.json` or `.oxfmtrc.json`. Both use 100 columns, double quotes, semicolons and trailing commas. Oxfmt does not run `prettier-plugin-organize-imports`; maintain import order and remove unused imports separately, then run the linter.
 
 ---
 
@@ -583,7 +596,8 @@ Before any change ships:
 - [ ] JSDoc on every public export and every multi-method class
 - [ ] No `console.log`, `log.<level>(module, action, message, context)` signature used correctly
 - [ ] Tests co-located, public-surface-driven
-- [ ] `tsc --noEmit` and `eslint` pass clean
+- [ ] `tsc --noEmit`, `npm run lint:check` and `npm run format:check` pass clean
+- [ ] `npx warlock check` exits 0
 
 **Non-negotiable defaults**
 - [ ] Every untrusted input has a `@warlock.js/seal` schema at the boundary

package/templates/warlock/skills/security-baseline/SKILL.md

@@ -243,7 +243,17 @@ The framework sets `Content-Type: application/json` for `response.success(...)`
 
 ### 5.3 Open redirects
 
-If you implement a "redirect back to where the user came from" feature, validate the destination URL against a whitelist of internal paths. Never blindly follow a user-supplied URL.
+If you implement a "redirect back to where the user came from" feature, validate the destination URL against a whitelist of internal paths. Never blindly follow a user-supplied URL. `safeRedirect()` from `@warlock.js/core` does it: same-origin paths and the origins you allow pass, anything else becomes the fallback.
+
+```typescript
+import { safeRedirect, type RequestHandler } from "@warlock.js/core";
+
+export const afterLoginController: RequestHandler = async ({ request, response }) => {
+  return response.redirect(safeRedirect(request.input("next"), { fallback: "/dashboard" }));
+};
+```
+
+`npx warlock check` reports a redirect target taken from request input without it as `WL9007`.
 
 ### 5.4 CORS
 
@@ -350,3 +360,4 @@ Before merging a change that touches input, identity, secrets, or persistence:
 - [ ] Logger redaction config covers any new sensitive field introduced
 - [ ] File uploads cap size, sniff MIME, server-generate the stored filename
 - [ ] Webhooks verify signature before any other work
+- [ ] `npx warlock check` reports no `WL9005`–`WL9009` problem (unvalidated `request.all()`, unguarded mutating route, unsafe redirect, sensitive value in a log, unbounded regex on input)