create-warlock 5.30.0 → 5.32.0

package/llms-full.txt

@@ -40,7 +40,7 @@ The first positional argument is the project name; it also becomes the directory
 
 1. **Default (a TTY, no `--yes`, no `--interactive`)** — asks the project name (if not already given), API-only or full-stack web (`--stack`), then a database unless `--db` or `--no-db` already supplied it. The stack is the only choice that changes the generated app's shape.
 2. **`--yes` (or no TTY at all — CI, a script, an agent harness)** — fully headless. Every answer comes from a flag or its default; nothing is ever prompted, and stdin is never read.
-3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
+3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, lint/format toolchain, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
 
 **Without a terminal, `--yes` is not required.** When stdin is not a TTY — CI, a
 script, a container, an agent harness — the scaffolder does not try to prompt,
@@ -54,7 +54,7 @@ that is just the project name, the one required answer with no default:
 ```
 A project name is required and no terminal is available to ask for one. Pass it as
 the first argument or --name=<name>. Non-interactive flags: --yes, --pm=<npm|yarn|pnpm>,
---db=<driver>|--no-db, --features=<list>, --ai=<list>, --git|--no-git, --jwt|--no-jwt.
+--db=<driver>|--no-db, --features=<list>, --ai=<list>, --lint=<oxc|eslint>, --git|--no-git, --jwt|--no-jwt.
 ```
 
 ## After scaffolding: the decisions summary
@@ -63,26 +63,30 @@ Because almost every choice defaults silently, `create-warlock` prints what it
 decided right after scaffolding, e.g.:
 
 ```
-Using npm · database: none · agent-kit targets: claude
+Using npm · database: none · lint: oxc · agent-kit targets: claude
+Features: none
   change these — package manager: --pm, database: --db/--no-db, agents: --agents,
-  features: --features, ai: --ai, git: --git/--no-git, jwt: --jwt/--no-jwt — or
+  features: --features, ai: --ai, lint: --lint, git: --git/--no-git, jwt: --jwt/--no-jwt — or
   re-run with --interactive for the full wizard.
 ```
 
 ## Flags
 
-| Flag                       | Takes value | Default        | Purpose                                                              |
-| --------------------------- | ----------- | -------------- | ------------------------------------------------------------------- |
-| `<positional>` / `--name`  | yes         | — (required)   | Project name + target directory.                                    |
-| `--stack`                  | yes         | `api`          | `api` or `web` — the structural choice; `web` seeds the `web` feature by default. |
-| `--db`                     | yes         | `mongodb`      | Database driver key (`mongodb`, `postgres`, or `none`).             |
-| `--no-db`                  | no          | —              | Opt out of a database — shorthand for `--db=none`.                  |
-| `--pm`                     | yes         | inferred (`npm_config_user_agent` / system) | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
-| `--features`                | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default. |
-| `--ai`                      | yes (CSV)   | none           | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).     |
-| `--agents`                  | yes (CSV)   | `claude`       | Comma-separated `agent-kit` targets — see below.                    |
-| `--git` / `--no-git`        | no          | off            | Initialize a Git repo (`git init` + `main` branch + initial commit).|
-| `--jwt` / `--no-jwt`        | no          | off            | Generate JWT secrets via the project's `jwt` script.               |
+| Flag                           | Takes value | Default                                                             | Purpose                                                                                                                |
+| ------------------------------ | ----------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `<positional>` / `--name`      | yes         | — (required)                                                        | Project name + target directory.                                                                                       |
+| `--stack`                      | yes         | `api`                                                               | `api` or `web` — the structural choice; `web` seeds the `web` feature by default.                                      |
+| `--db`                         | yes         | `mongodb`                                                           | Database driver key (`mongodb`, `postgres`, or `none`).                                                                |
+| `--no-db`                      | no          | —                                                                   | Opt out of a database — shorthand for `--db=none`.                                                                     |
+| `--pm`                         | yes         | inferred (`npm_config_user_agent` / system)                         | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
+| `--features`                   | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default.                |
+| `--lint`                       | yes         | `oxc`                                                               | `oxc` (Oxlint/Oxfmt) or `eslint` (ESLint/Prettier); unknown or missing values fail before writes.                      |
+| `--ai`                         | yes (CSV)   | none                                                                | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).                                                        |
+| `--agents`                     | yes (CSV)   | `claude`                                                            | Comma-separated `agent-kit` targets — see below.                                                                       |
+| `--git` / `--no-git`           | no          | off                                                                 | Initialize a Git repo (`git init` + `main` branch + initial commit).                                                   |
+| `--jwt` / `--no-jwt`           | no          | off                                                                 | Generate JWT secrets via the project's `jwt` script.                                                                   |
+| `--yes` / `-y`                 | no          | off                                                                 | Fully headless mode.                                                                                                   |
+| `--interactive`, `--customize` | no          | off                                                                 | Restore the full long-form wizard.                                                                                     |
 
 With `--pm=pnpm`, the scaffold reads `pnpm --version` and records install-script
 approvals (esbuild, and Sharp when the `image` feature is selected) where that
@@ -93,10 +97,8 @@ no workspace file (those versions reject one without `packages:`) but
 retained. If selected feature dependencies do
 not install, JWT generation is skipped and reported rather than retried through
 the package manager.
-| `--yes` / `-y`              | no          | off            | Fully headless mode.                                                 |
-| `--interactive`, `--customize` | no       | off            | Restore the full long-form wizard.                                   |
 
-Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--features` / `--ai` / `--agents` keys fail fast before any install.
+Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--pm` / `--db` / `--features` / `--ai` / `--agents` / `--lint` values fail fast before any write or install.
 
 `--help`/`-h` and `--version`/`-v` short-circuit before anything else — no prompt, filesystem write, or network call, and `--help` wins even over a positional project name. `--version` prints the installed `create-warlock` version. `--help` lists every flag above together with its default.
 
@@ -110,18 +112,18 @@ fallback that always works — even fully offline. Any other target
 `goose`, …) is validated against the list published at
 https://mongez.js.org/agent-kit/llms.txt, fetched once and cached locally. If
 that fetch fails for an explicitly requested non-default target, the run fails
-visibly and names every target it *could* determine — it never silently
+visibly and names every target it _could_ determine — it never silently
 guesses.
 
 ## Valid keys
 
 **Database drivers** (`--db`):
 
-| Key        | Default port | Status      |
-| ---------- | ------------ | ----------- |
-| `mongodb`  | 27017        | available   |
-| `postgres` | 5432         | available   |
-| `mysql`    | 3306         | coming soon (disabled in the wizard) |
+| Key        | Default port | Status                                                                   |
+| ---------- | ------------ | ------------------------------------------------------------------------ |
+| `mongodb`  | 27017        | available                                                                |
+| `postgres` | 5432         | available                                                                |
+| `mysql`    | 3306         | coming soon (disabled in the wizard)                                     |
 | `none`     | —            | opt out — no driver, no driver package, `src/config/database.ts` removed |
 
 **Features** (`--features`): `react`, `react-email`, `mail`, `ses`, `image`, `s3`, `redis`, `scheduler`, `herald`, `socket`, `test`, `access`, `web`, `tailwind`, `shadcn`, `notifications`.
@@ -191,4 +193,87 @@ Failures surface the error and halt; there is no rollback. After it finishes, `c
 - The `create-module` topic of the `warlock-js-core` skill — generate a new module inside the project.
 - The `add-connector` topic of the `warlock-js-core` skill — what `warlock add` wires when a feature pulls a connector.
 
+The project-ready summary wraps the complete feature list to your terminal width.
+Terminals narrower than 50 columns get a plain list; piped output uses 80 columns.
+
+## Custom feature groups
+
+`--customize` opens a section menu for optional features. Open a section to edit
+its checklist; **Select all** includes the remaining features while preserving
+items you explicitly unticked. The category cursor stays on the last edited
+section. Section
+counts update when returning to the menu, and **Continue** keeps the selection.
+Flags preselect their existing feature keys. Both menus and checklists retain
+terminal paging. The decisions overview previews up to six feature/AI keys with
+a total count; the success screen shows the complete list.
+
+## Choose the linter and formatter
+
+`--lint=oxc` is the default. It also accepts `--lint oxc` and installs exact
+`oxlint@1.88.0` and `oxfmt@0.73.0` versions, emits `.oxlintrc.json` and
+`.oxfmtrc.json`, and removes the template's ESLint/Prettier configs and dependencies.
+Pass `--lint=eslint` to opt in to ESLint/Prettier. The custom wizard prompts for
+the same choice; a flag preselects it.
+
+```bash
+# Default: Oxlint + Oxfmt, TypeScript 7.0.2
+npm create warlock@latest my-app -- --yes
+
+# Explicit opt-in: ESLint + Prettier, TypeScript 6.0.3
+npm create warlock@latest my-eslint-app -- --lint=eslint --yes
+```
+
+Both choices provide `lint`/`format` and non-mutating `lint:check`/`format:check`
+scripts. Oxc projects also configure VS Code format-on-save with the official
+`oxc.oxc-vscode` formatter, use `source.fixAll.oxc` for lint fixes and recommend
+that extension. The ESLint toolchain retains its Prettier/ESLint editor settings.
+Oxc config enables `devServer.healthCheckers: { eslint: false, oxlint: true }` and
+leaves TypeScript health checks enabled. Style matches the template's 100-column,
+double-quote, semicolon and trailing-comma settings. Import sorting is on in
+`.oxfmtrc.json`, kept to one block like the ESLint toolchain's
+`@ianvs/prettier-plugin-sort-imports`:
+
+```json
+{ "sortImports": { "newlinesBetween": false, "internalPattern": ["app/", "web/", "@shared/"] } }
+```
+
+`format` (`oxfmt --write ./src`) orders built-ins, packages, internal aliases,
+then relative imports. Neither formatter deletes unused imports. ESLint reports
+them through `unused-imports/no-unused-imports`; Oxlint uses `no-unused-vars`.
+Scripts in both toolchains call local binaries
+(`eslint --fix ./src --max-warnings=0`, `tsc --noEmit`), never `npx`.
+
+## TypeScript 7 in 5.32
+
+Default Oxlint/Oxfmt projects pin `typescript` to `7.0.2`; `tsc` is the native Go compiler.
+The template uses `module: "ESNext"`, `moduleResolution: "bundler"`, explicit
+Node types, and `paths` relative to its tsconfig, without `baseUrl`.
+Existing apps must remove `baseUrl`, rebase alias targets, and replace
+`moduleResolution: "node"` / `"node10"` before typechecking.
+
+Explicit `--lint=eslint` projects pin `typescript` to **6.0.3**, the newest version
+supported by typescript-eslint. Its parser requires the JavaScript compiler API
+removed in TypeScript 7, and its declared peer range is `>=4.8.4 <6.1.0`
+([parser package metadata](https://registry.npmjs.org/@typescript-eslint/parser/8.71.2)).
+Both modes use the same tsconfig settings above, which are valid in TypeScript 6.
+ESLint mode prints a compatibility notice when chosen and is planned for
+deprecation in 5.33 and removal in 5.34. Both modes install with every supported package manager.
+
+### Prettier import order in ESLint mode
+
+The ESLint scaffold’s `@ianvs/prettier-plugin-sort-imports` uses Babel instead of
+the compiler API. Keep these options in `.prettierrc.json`:
+
+```json
+{
+  "plugins": ["@ianvs/prettier-plugin-sort-imports"],
+  "importOrder": ["<BUILTIN_MODULES>", "<THIRD_PARTY_MODULES>", "^(app|web|@shared)/", "^[.]"],
+  "importOrderParserPlugins": ["typescript", "jsx", "decorators"]
+}
+```
+
+Leave `importOrderTypeScriptVersion` at its default to keep type and value imports
+separate. Run `npm run format`, then `npm run lint:check`; formatting preserves
+unused imports, and `npm run lint` can apply ESLint’s unused-import fixes.
+
 

package/package.json

@@ -13,16 +13,16 @@
   "dependencies": {
     "@clack/prompts": "^0.8.2",
     "@mongez/copper": "^2.1.3",
-    "@warlock.js/fs": "5.30.0",
+    "@warlock.js/fs": "5.32.0",
     "@mongez/reinforcements": "^4.0.2",
     "cross-spawn": "^7.0.3",
     "rimraf": "^6.0.1",
     "which-pm-runs": "^1.1.0"
   },
   "engines": {
-    "node": ">=22.13"
+    "node": ">=22.15"
   },
-  "version": "5.30.0",
+  "version": "5.32.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",

package/skills/create-a-warlock-project/SKILL.md

@@ -32,7 +32,7 @@ The first positional argument is the project name; it also becomes the directory
 
 1. **Default (a TTY, no `--yes`, no `--interactive`)** — asks the project name (if not already given), API-only or full-stack web (`--stack`), then a database unless `--db` or `--no-db` already supplied it. The stack is the only choice that changes the generated app's shape.
 2. **`--yes` (or no TTY at all — CI, a script, an agent harness)** — fully headless. Every answer comes from a flag or its default; nothing is ever prompted, and stdin is never read.
-3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
+3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, lint/format toolchain, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
 
 **Without a terminal, `--yes` is not required.** When stdin is not a TTY — CI, a
 script, a container, an agent harness — the scaffolder does not try to prompt,
@@ -46,7 +46,7 @@ that is just the project name, the one required answer with no default:
 ```
 A project name is required and no terminal is available to ask for one. Pass it as
 the first argument or --name=<name>. Non-interactive flags: --yes, --pm=<npm|yarn|pnpm>,
---db=<driver>|--no-db, --features=<list>, --ai=<list>, --git|--no-git, --jwt|--no-jwt.
+--db=<driver>|--no-db, --features=<list>, --ai=<list>, --lint=<oxc|eslint>, --git|--no-git, --jwt|--no-jwt.
 ```
 
 ## After scaffolding: the decisions summary
@@ -55,26 +55,30 @@ Because almost every choice defaults silently, `create-warlock` prints what it
 decided right after scaffolding, e.g.:
 
 ```
-Using npm · database: none · agent-kit targets: claude
+Using npm · database: none · lint: oxc · agent-kit targets: claude
+Features: none
   change these — package manager: --pm, database: --db/--no-db, agents: --agents,
-  features: --features, ai: --ai, git: --git/--no-git, jwt: --jwt/--no-jwt — or
+  features: --features, ai: --ai, lint: --lint, git: --git/--no-git, jwt: --jwt/--no-jwt — or
   re-run with --interactive for the full wizard.
 ```
 
 ## Flags
 
-| Flag                       | Takes value | Default        | Purpose                                                              |
-| --------------------------- | ----------- | -------------- | ------------------------------------------------------------------- |
-| `<positional>` / `--name`  | yes         | — (required)   | Project name + target directory.                                    |
-| `--stack`                  | yes         | `api`          | `api` or `web` — the structural choice; `web` seeds the `web` feature by default. |
-| `--db`                     | yes         | `mongodb`      | Database driver key (`mongodb`, `postgres`, or `none`).             |
-| `--no-db`                  | no          | —              | Opt out of a database — shorthand for `--db=none`.                  |
-| `--pm`                     | yes         | inferred (`npm_config_user_agent` / system) | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
-| `--features`                | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default. |
-| `--ai`                      | yes (CSV)   | none           | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).     |
-| `--agents`                  | yes (CSV)   | `claude`       | Comma-separated `agent-kit` targets — see below.                    |
-| `--git` / `--no-git`        | no          | off            | Initialize a Git repo (`git init` + `main` branch + initial commit).|
-| `--jwt` / `--no-jwt`        | no          | off            | Generate JWT secrets via the project's `jwt` script.               |
+| Flag                           | Takes value | Default                                                             | Purpose                                                                                                                |
+| ------------------------------ | ----------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `<positional>` / `--name`      | yes         | — (required)                                                        | Project name + target directory.                                                                                       |
+| `--stack`                      | yes         | `api`                                                               | `api` or `web` — the structural choice; `web` seeds the `web` feature by default.                                      |
+| `--db`                         | yes         | `mongodb`                                                           | Database driver key (`mongodb`, `postgres`, or `none`).                                                                |
+| `--no-db`                      | no          | —                                                                   | Opt out of a database — shorthand for `--db=none`.                                                                     |
+| `--pm`                         | yes         | inferred (`npm_config_user_agent` / system)                         | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
+| `--features`                   | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default.                |
+| `--lint`                       | yes         | `oxc`                                                               | `oxc` (Oxlint/Oxfmt) or `eslint` (ESLint/Prettier); unknown or missing values fail before writes.                      |
+| `--ai`                         | yes (CSV)   | none                                                                | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).                                                        |
+| `--agents`                     | yes (CSV)   | `claude`                                                            | Comma-separated `agent-kit` targets — see below.                                                                       |
+| `--git` / `--no-git`           | no          | off                                                                 | Initialize a Git repo (`git init` + `main` branch + initial commit).                                                   |
+| `--jwt` / `--no-jwt`           | no          | off                                                                 | Generate JWT secrets via the project's `jwt` script.                                                                   |
+| `--yes` / `-y`                 | no          | off                                                                 | Fully headless mode.                                                                                                   |
+| `--interactive`, `--customize` | no          | off                                                                 | Restore the full long-form wizard.                                                                                     |
 
 With `--pm=pnpm`, the scaffold reads `pnpm --version` and records install-script
 approvals (esbuild, and Sharp when the `image` feature is selected) where that
@@ -85,10 +89,8 @@ no workspace file (those versions reject one without `packages:`) but
 retained. If selected feature dependencies do
 not install, JWT generation is skipped and reported rather than retried through
 the package manager.
-| `--yes` / `-y`              | no          | off            | Fully headless mode.                                                 |
-| `--interactive`, `--customize` | no       | off            | Restore the full long-form wizard.                                   |
 
-Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--features` / `--ai` / `--agents` keys fail fast before any install.
+Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--pm` / `--db` / `--features` / `--ai` / `--agents` / `--lint` values fail fast before any write or install.
 
 `--help`/`-h` and `--version`/`-v` short-circuit before anything else — no prompt, filesystem write, or network call, and `--help` wins even over a positional project name. `--version` prints the installed `create-warlock` version. `--help` lists every flag above together with its default.
 
@@ -102,18 +104,18 @@ fallback that always works — even fully offline. Any other target
 `goose`, …) is validated against the list published at
 https://mongez.js.org/agent-kit/llms.txt, fetched once and cached locally. If
 that fetch fails for an explicitly requested non-default target, the run fails
-visibly and names every target it *could* determine — it never silently
+visibly and names every target it _could_ determine — it never silently
 guesses.
 
 ## Valid keys
 
 **Database drivers** (`--db`):
 
-| Key        | Default port | Status      |
-| ---------- | ------------ | ----------- |
-| `mongodb`  | 27017        | available   |
-| `postgres` | 5432         | available   |
-| `mysql`    | 3306         | coming soon (disabled in the wizard) |
+| Key        | Default port | Status                                                                   |
+| ---------- | ------------ | ------------------------------------------------------------------------ |
+| `mongodb`  | 27017        | available                                                                |
+| `postgres` | 5432         | available                                                                |
+| `mysql`    | 3306         | coming soon (disabled in the wizard)                                     |
 | `none`     | —            | opt out — no driver, no driver package, `src/config/database.ts` removed |
 
 **Features** (`--features`): `react`, `react-email`, `mail`, `ses`, `image`, `s3`, `redis`, `scheduler`, `herald`, `socket`, `test`, `access`, `web`, `tailwind`, `shadcn`, `notifications`.
@@ -182,3 +184,86 @@ Failures surface the error and halt; there is no rollback. After it finishes, `c
 - The `run-app` topic of the `warlock-js-core` skill — `warlock dev` / `build` / `start` once the project exists.
 - The `create-module` topic of the `warlock-js-core` skill — generate a new module inside the project.
 - The `add-connector` topic of the `warlock-js-core` skill — what `warlock add` wires when a feature pulls a connector.
+
+The project-ready summary wraps the complete feature list to your terminal width.
+Terminals narrower than 50 columns get a plain list; piped output uses 80 columns.
+
+## Custom feature groups
+
+`--customize` opens a section menu for optional features. Open a section to edit
+its checklist; **Select all** includes the remaining features while preserving
+items you explicitly unticked. The category cursor stays on the last edited
+section. Section
+counts update when returning to the menu, and **Continue** keeps the selection.
+Flags preselect their existing feature keys. Both menus and checklists retain
+terminal paging. The decisions overview previews up to six feature/AI keys with
+a total count; the success screen shows the complete list.
+
+## Choose the linter and formatter
+
+`--lint=oxc` is the default. It also accepts `--lint oxc` and installs exact
+`oxlint@1.88.0` and `oxfmt@0.73.0` versions, emits `.oxlintrc.json` and
+`.oxfmtrc.json`, and removes the template's ESLint/Prettier configs and dependencies.
+Pass `--lint=eslint` to opt in to ESLint/Prettier. The custom wizard prompts for
+the same choice; a flag preselects it.
+
+```bash
+# Default: Oxlint + Oxfmt, TypeScript 7.0.2
+npm create warlock@latest my-app -- --yes
+
+# Explicit opt-in: ESLint + Prettier, TypeScript 6.0.3
+npm create warlock@latest my-eslint-app -- --lint=eslint --yes
+```
+
+Both choices provide `lint`/`format` and non-mutating `lint:check`/`format:check`
+scripts. Oxc projects also configure VS Code format-on-save with the official
+`oxc.oxc-vscode` formatter, use `source.fixAll.oxc` for lint fixes and recommend
+that extension. The ESLint toolchain retains its Prettier/ESLint editor settings.
+Oxc config enables `devServer.healthCheckers: { eslint: false, oxlint: true }` and
+leaves TypeScript health checks enabled. Style matches the template's 100-column,
+double-quote, semicolon and trailing-comma settings. Import sorting is on in
+`.oxfmtrc.json`, kept to one block like the ESLint toolchain's
+`@ianvs/prettier-plugin-sort-imports`:
+
+```json
+{ "sortImports": { "newlinesBetween": false, "internalPattern": ["app/", "web/", "@shared/"] } }
+```
+
+`format` (`oxfmt --write ./src`) orders built-ins, packages, internal aliases,
+then relative imports. Neither formatter deletes unused imports. ESLint reports
+them through `unused-imports/no-unused-imports`; Oxlint uses `no-unused-vars`.
+Scripts in both toolchains call local binaries
+(`eslint --fix ./src --max-warnings=0`, `tsc --noEmit`), never `npx`.
+
+## TypeScript 7 in 5.32
+
+Default Oxlint/Oxfmt projects pin `typescript` to `7.0.2`; `tsc` is the native Go compiler.
+The template uses `module: "ESNext"`, `moduleResolution: "bundler"`, explicit
+Node types, and `paths` relative to its tsconfig, without `baseUrl`.
+Existing apps must remove `baseUrl`, rebase alias targets, and replace
+`moduleResolution: "node"` / `"node10"` before typechecking.
+
+Explicit `--lint=eslint` projects pin `typescript` to **6.0.3**, the newest version
+supported by typescript-eslint. Its parser requires the JavaScript compiler API
+removed in TypeScript 7, and its declared peer range is `>=4.8.4 <6.1.0`
+([parser package metadata](https://registry.npmjs.org/@typescript-eslint/parser/8.71.2)).
+Both modes use the same tsconfig settings above, which are valid in TypeScript 6.
+ESLint mode prints a compatibility notice when chosen and is planned for
+deprecation in 5.33 and removal in 5.34. Both modes install with every supported package manager.
+
+### Prettier import order in ESLint mode
+
+The ESLint scaffold’s `@ianvs/prettier-plugin-sort-imports` uses Babel instead of
+the compiler API. Keep these options in `.prettierrc.json`:
+
+```json
+{
+  "plugins": ["@ianvs/prettier-plugin-sort-imports"],
+  "importOrder": ["<BUILTIN_MODULES>", "<THIRD_PARTY_MODULES>", "^(app|web|@shared)/", "^[.]"],
+  "importOrderParserPlugins": ["typescript", "jsx", "decorators"]
+}
+```
+
+Leave `importOrderTypeScriptVersion` at its default to keep type and value imports
+separate. Run `npm run format`, then `npm run lint:check`; formatting preserves
+unused imports, and `npm run lint` can apply ESLint’s unused-import fixes.

package/templates/toolchains/oxc/.oxfmtrc.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": true,
+  "tabWidth": 2,
+  "printWidth": 100,
+  "singleQuote": false,
+  "arrowParens": "always",
+  "trailingComma": "all",
+  "endOfLine": "lf",
+  "sortImports": {
+    "newlinesBetween": false,
+    "internalPattern": ["app/", "web/", "@shared/"]
+  },
+  "ignorePatterns": ["node_modules/", "dist/"]
+}

package/templates/toolchains/oxc/.oxlintrc.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "import", "react"],
+  "env": { "node": true, "es2021": true },
+  "categories": { "correctness": "off" },
+  "rules": {
+    "typescript/no-explicit-any": "off",
+    "no-unused-vars": [
+      "warn",
+      {
+        "vars": "all",
+        "varsIgnorePattern": "^_",
+        "args": "after-used",
+        "argsIgnorePattern": "^_"
+      }
+    ],
+    "typescript/explicit-member-accessibility": ["error", { "accessibility": "explicit" }],
+    "typescript/consistent-type-imports": [
+      "error",
+      { "prefer": "type-imports", "disallowTypeAnnotations": false }
+    ]
+  },
+  "ignorePatterns": ["node_modules/", "dist/"]
+}

package/templates/toolchains/oxc/.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+  "recommendations": ["oxc.oxc-vscode"]
+}

package/templates/toolchains/oxc/.vscode/settings.json

@@ -0,0 +1,35 @@
+{
+  "editor.defaultFormatter": "oxc.oxc-vscode",
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.oxc": "explicit",
+    "source.organizeImports": "never"
+  },
+  "[typescript]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[typescriptreact]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[javascript]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[javascriptreact]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[json]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[css]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "oxc.enable.oxlint": true,
+  "oxc.enable.oxfmt": true,
+  "oxc.requireConfig": true
+}

package/templates/warlock/.prettierrc.json

@@ -6,5 +6,7 @@
   "arrowParens": "always",
   "trailingComma": "all",
   "endOfLine": "lf",
-  "plugins": ["prettier-plugin-organize-imports"]
+  "plugins": ["@ianvs/prettier-plugin-sort-imports"],
+  "importOrder": ["<BUILTIN_MODULES>", "<THIRD_PARTY_MODULES>", "^(app|web|@shared)/", "^[.]"],
+  "importOrderParserPlugins": ["typescript", "jsx", "decorators"]
 }

package/templates/warlock/AGENTS.md

@@ -80,8 +80,8 @@ automatically on `postinstall`).
 - `yarn start` — start the production server (`warlock start`)
 - `yarn migrate` / `yarn migrate.fresh` / `yarn migrate.list` — run migrations
 - `yarn seed` — run database seeders
-- `yarn lint` / `yarn format` / `yarn tsc` — lint (eslint --fix), format
-  (prettier), and type-check (`tsc --noEmit`)
+- `yarn lint` / `yarn format` / `yarn tsc` — lint and format with the selected toolchain, and type-check (`tsc --noEmit`)
+- `npx warlock check` — verify a change: typecheck, lint, the affected tests and the framework's conventions in one report (`--changed` for only what changed); run it after every change and loop until it exits 0
 - `yarn skills:sync` — re-sync skills from `node_modules` and regenerate the
   derived per-agent files from this `AGENTS.md`
 
@@ -98,6 +98,13 @@ suffixes, and JSDoc on the public surface. The bar is senior-level clean code, n
 
 - Respect **module-boundaries** — do not reach across module internals.
 - Never weaken the **security-baseline** — always validate input at boundaries.
+- `npx warlock check` enforces these rules whichever linter the project uses:
+  pass `request.validated()` (never `request.all()`) to queries and services
+  (`WL9005`), give every POST/PUT/PATCH/DELETE route auth middleware or an
+  explicit `public: true` (`WL9006`), wrap request-supplied redirect targets in
+  `safeRedirect()` (`WL9007`), keep raw emails, tokens and request bodies out of
+  logs (`WL9008`) and bound regexes that run on request input (`WL9009`). Each
+  problem carries its fix; `npx warlock explain <CODE>` prints it again.
 - Follow **git-workflow** for commits and branches; do not commit or push unless
   explicitly asked.
 - When you are unsure how a package or feature works, **stop and read its skill**
@@ -122,3 +129,16 @@ Three things that trip everyone up on a fresh app:
   instance does not expose its columns as direct properties — `post.title` is
   `undefined` at runtime and a type error. Use `post.get("title")`, or
   `post.toJSON()` in a page loader (resources are the serialization gate).
+
+## This app (generated)
+
+`warlock dev` rewrites everything between the two markers below from the
+running app — modules, routes, models, installed skills and the commands to
+verify a change. Edit outside the markers; turn it off with
+`devServer.agentsMd: false` in `warlock.config.ts`.
+
+<!-- warlock:generated:start -->
+
+Run `npx warlock dev` (or `npx warlock agents-md --write`) to fill this section.
+
+<!-- warlock:generated:end -->

package/templates/warlock/README.md

@@ -7,7 +7,7 @@ Full documentation: [warlock.js.org](https://warlock.js.org).
 
 ## Requirements
 
-- Node.js **22.13** or newer
+- Node.js **22.15** or newer
 - The database you picked when scaffolding (MongoDB or PostgreSQL), running and
   reachable with the settings in `.env` — skip this if you scaffolded with no
   database
@@ -40,8 +40,10 @@ It restarts on file changes.
 | `npm run seed` | Run the database seeders |
 | `npm run jwt` | Generate a JWT secret into `.env` |
 | `npm run tsc` | Type-check without building |
-| `npm run lint` | ESLint, auto-fixing what it can |
-| `npm run format` | Prettier over `src/` |
+| `npm run lint` | The configured linter, auto-fixing what it can |
+| `npm run format` | The configured formatter over `src/` |
+| `npm run lint:check` | Lint without changing files |
+| `npm run format:check` | Check formatting without changing files |
 | `npm run skills:sync` | Refresh the AI agent skills (see below) |
 
 The `warlock` CLI has more than the scripts expose — run `npx warlock --help`
@@ -146,3 +148,16 @@ This project ships instructions and skills for AI coding agents:
 
 - [Documentation](https://warlock.js.org)
 - [Changelog](https://warlock.js.org/changelog)
+
+## TypeScript 7 in 5.32
+
+New projects pin `typescript` to `7.0.2`; `tsc` is the native Go compiler.
+The template uses `module: "ESNext"`, `moduleResolution: "bundler"`, explicit
+Node types, and `paths` relative to its tsconfig, without `baseUrl`.
+Existing apps must remove `baseUrl`, rebase alias targets, and replace
+`moduleResolution: "node"` / `"node10"` before typechecking.
+
+Use the Oxlint/Oxfmt lint mode with TS7. The optional ESLint scaffold is retained,
+but typescript-eslint's parser requires the removed JavaScript compiler API and
+does not support TS7. ESLint mode is scheduled for deprecation in 5.33 and removal
+in 5.34. A parser's bundled older TypeScript is separate from the app's native `tsc`.

package/templates/warlock/package.json

@@ -19,12 +19,14 @@
     "gen.mig": "warlock generate.migration",
     "gen.r": "warlock generate.repository",
     "gen.rs": "warlock generate.resource",
-    "lint": "npx eslint --fix ./src --max-warnings=0",
-    "format": "npx prettier --write ./src/**/*.{js,jsx,ts,tsx,css,md,json} --config ./.prettierrc.json",
-    "tsc": "warlock generate.typings && npx tsc --noEmit",
+    "lint": "eslint --fix ./src --max-warnings=0",
+    "format": "prettier --write \"./src/**/*.{js,jsx,ts,tsx,css,md,json}\" --config ./.prettierrc.json",
+    "tsc": "warlock generate.typings && tsc --noEmit",
     "postinstall": "agent-kit init && agent-kit sync || echo \"warning: AI agent skills were NOT synced, so coding agents will not see the @warlock.js skills. Run the skills:sync script.\"",
     "skills:sync": "agent-kit sync",
-    "skills:watch": "agent-kit watch"
+    "skills:watch": "agent-kit watch",
+    "lint:check": "eslint ./src --max-warnings=0",
+    "format:check": "prettier --check \"./src/**/*.{js,jsx,ts,tsx,css,md,json}\" --config ./.prettierrc.json"
   },
   "dependencies": {
     "@mongez/reinforcements": "^4.0.2",
@@ -41,6 +43,7 @@
     "dayjs": "^1.11.19"
   },
   "devDependencies": {
+    "@ianvs/prettier-plugin-sort-imports": "^4.7.1",
     "@mongez/agent-kit": "^1.3.1",
     "@types/node": "^25.0.3",
     "@types/prettier": "^3.0.0",
@@ -51,8 +54,7 @@
     "eslint-plugin-prettier": "^5.5.4",
     "eslint-plugin-unused-imports": "^4.3.0",
     "prettier": "^3.7.4",
-    "prettier-plugin-organize-imports": "^4.3.0",
-    "typescript": "^5.9.3",
+    "typescript": "7.0.2",
     "vitest": "4.0.5"
   }
 }

package/templates/warlock/skills/api-design/SKILL.md

@@ -24,8 +24,8 @@ The list lands under the **plural name of the module's resource** — `users`, `
 
 ```typescript
 // ✅ list-users.controller.ts
-export const listUsersController: RequestHandler = async (request, response) => {
-  const { data, pagination } = await listUsersService(request.all());
+export const listUsersController: RequestHandler = async ({ request, response }) => {
+  const { data, pagination } = await listUsersService(request.validated());
 
   return response.success({
     users: data,