create-warlock 5.32.0 → 5.34.0

package/templates/warlock/.oxfmtignore

@@ -0,0 +1,2 @@
+node_modules
+dist

package/templates/warlock/.oxfmtrc.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": true,
+  "tabWidth": 2,
+  "printWidth": 100,
+  "singleQuote": false,
+  "arrowParens": "always",
+  "trailingComma": "all",
+  "endOfLine": "lf",
+  "sortImports": {
+    "newlinesBetween": false,
+    "internalPattern": ["app/", "web/", "@shared/"]
+  },
+  "ignorePatterns": ["node_modules/", "dist/"]
+}

package/templates/warlock/.oxlintrc.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "import", "react"],
+  "env": { "node": true, "es2021": true },
+  "categories": { "correctness": "error" },
+  "rules": {
+    "typescript/no-explicit-any": "off",
+    "no-unused-vars": [
+      "warn",
+      {
+        "vars": "all",
+        "varsIgnorePattern": "^_",
+        "args": "after-used",
+        "argsIgnorePattern": "^_"
+      }
+    ],
+    "typescript/explicit-member-accessibility": ["error", { "accessibility": "explicit" }],
+    "typescript/consistent-type-imports": [
+      "error",
+      { "prefer": "type-imports", "disallowTypeAnnotations": false }
+    ]
+  },
+  "ignorePatterns": ["node_modules/", "dist/"]
+}

package/templates/warlock/.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+  "recommendations": ["oxc.oxc-vscode"]
+}

package/templates/warlock/.vscode/settings.json

@@ -1,41 +1,35 @@
 {
-  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "editor.defaultFormatter": "oxc.oxc-vscode",
   "editor.formatOnSave": true,
   "editor.codeActionsOnSave": {
-    "source.fixAll.eslint": "explicit",
+    "source.fixAll.oxc": "explicit",
     "source.organizeImports": "never"
   },
   "[typescript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.defaultFormatter": "oxc.oxc-vscode",
     "editor.formatOnSave": true
   },
   "[typescriptreact]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.defaultFormatter": "oxc.oxc-vscode",
     "editor.formatOnSave": true
   },
   "[javascript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.defaultFormatter": "oxc.oxc-vscode",
     "editor.formatOnSave": true
   },
   "[javascriptreact]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.defaultFormatter": "oxc.oxc-vscode",
     "editor.formatOnSave": true
   },
   "[json]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.defaultFormatter": "oxc.oxc-vscode",
     "editor.formatOnSave": true
   },
   "[css]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.defaultFormatter": "oxc.oxc-vscode",
     "editor.formatOnSave": true
   },
-  "prettier.configPath": ".prettierrc.json",
-  "prettier.requireConfig": true,
-  "prettier.ignorePath": ".prettierignore",
-  "prettier.documentSelectors": ["**/*.{ts,tsx,js,jsx,json,css,md}"],
-  "prettier.enable": true,
-  "prettier.useEditorConfig": false,
-  "prettier.resolveGlobalModules": false,
-  "eslint.format.enable": false,
-  "eslint.codeActionsOnSave.mode": "all"
+  "oxc.enable.oxlint": true,
+  "oxc.enable.oxfmt": true,
+  "oxc.requireConfig": true
 }

package/templates/warlock/README.md

@@ -29,22 +29,22 @@ It restarts on file changes.
 
 ## Scripts
 
-| Command | What it does |
-| --- | --- |
-| `npm run dev` | Development server with live reload |
-| `npm run build` | Type-check and build for production |
-| `npm run start` | Run the production build (run `build` first) |
-| `npm run migrate` | Run pending database migrations |
-| `npm run migrate.fresh` | Drop everything and re-run all migrations |
-| `npm run migrate.list` | List migrations and their status |
-| `npm run seed` | Run the database seeders |
-| `npm run jwt` | Generate a JWT secret into `.env` |
-| `npm run tsc` | Type-check without building |
-| `npm run lint` | The configured linter, auto-fixing what it can |
-| `npm run format` | The configured formatter over `src/` |
-| `npm run lint:check` | Lint without changing files |
-| `npm run format:check` | Check formatting without changing files |
-| `npm run skills:sync` | Refresh the AI agent skills (see below) |
+| Command                 | What it does                                   |
+| ----------------------- | ---------------------------------------------- |
+| `npm run dev`           | Development server with live reload            |
+| `npm run build`         | Type-check and build for production            |
+| `npm run start`         | Run the production build (run `build` first)   |
+| `npm run migrate`       | Run pending database migrations                |
+| `npm run migrate.fresh` | Drop everything and re-run all migrations      |
+| `npm run migrate.list`  | List migrations and their status               |
+| `npm run seed`          | Run the database seeders                       |
+| `npm run jwt`           | Generate a JWT secret into `.env`              |
+| `npm run tsc`           | Type-check without building                    |
+| `npm run lint`          | The configured linter, auto-fixing what it can |
+| `npm run format`        | The configured formatter over `src/`           |
+| `npm run lint:check`    | Lint without changing files                    |
+| `npm run format:check`  | Check formatting without changing files        |
+| `npm run skills:sync`   | Refresh the AI agent skills (see below)        |
 
 The `warlock` CLI has more than the scripts expose — run `npx warlock --help`
 for the full list. Two worth knowing:
@@ -157,7 +157,5 @@ Node types, and `paths` relative to its tsconfig, without `baseUrl`.
 Existing apps must remove `baseUrl`, rebase alias targets, and replace
 `moduleResolution: "node"` / `"node10"` before typechecking.
 
-Use the Oxlint/Oxfmt lint mode with TS7. The optional ESLint scaffold is retained,
-but typescript-eslint's parser requires the removed JavaScript compiler API and
-does not support TS7. ESLint mode is scheduled for deprecation in 5.33 and removal
-in 5.34. A parser's bundled older TypeScript is separate from the app's native `tsc`.
+Oxlint/Oxfmt is the only toolchain in 5.34.0. Correctness rules report errors;
+use `npm run lint:check` and `npm run format:check` before committing.

package/templates/warlock/package.json

@@ -19,14 +19,14 @@
     "gen.mig": "warlock generate.migration",
     "gen.r": "warlock generate.repository",
     "gen.rs": "warlock generate.resource",
-    "lint": "eslint --fix ./src --max-warnings=0",
-    "format": "prettier --write \"./src/**/*.{js,jsx,ts,tsx,css,md,json}\" --config ./.prettierrc.json",
+    "lint": "oxlint --fix ./src --max-warnings=0",
+    "format": "oxfmt --ignore-path .gitignore --ignore-path .oxfmtignore --write ./src",
     "tsc": "warlock generate.typings && tsc --noEmit",
     "postinstall": "agent-kit init && agent-kit sync || echo \"warning: AI agent skills were NOT synced, so coding agents will not see the @warlock.js skills. Run the skills:sync script.\"",
     "skills:sync": "agent-kit sync",
     "skills:watch": "agent-kit watch",
-    "lint:check": "eslint ./src --max-warnings=0",
-    "format:check": "prettier --check \"./src/**/*.{js,jsx,ts,tsx,css,md,json}\" --config ./.prettierrc.json"
+    "lint:check": "oxlint ./src --max-warnings=0",
+    "format:check": "oxfmt --ignore-path .gitignore --ignore-path .oxfmtignore --check ./src"
   },
   "dependencies": {
     "@mongez/reinforcements": "^4.0.2",
@@ -43,18 +43,11 @@
     "dayjs": "^1.11.19"
   },
   "devDependencies": {
-    "@ianvs/prettier-plugin-sort-imports": "^4.7.1",
     "@mongez/agent-kit": "^1.3.1",
     "@types/node": "^25.0.3",
-    "@types/prettier": "^3.0.0",
-    "@typescript-eslint/eslint-plugin": "^8.50.0",
-    "@typescript-eslint/parser": "^8.50.0",
-    "eslint": "^9.39.2",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.4",
-    "eslint-plugin-unused-imports": "^4.3.0",
-    "prettier": "^3.7.4",
     "typescript": "7.0.2",
-    "vitest": "4.0.5"
+    "vitest": "4.0.5",
+    "oxlint": "1.88.0",
+    "oxfmt": "0.73.0"
   }
 }

package/templates/warlock/skills/code-standards/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: code-standards
-description: 'Project-level TypeScript code standards for apps built on Warlock.js — `interface` vs `type`, access modifiers, no `any`, no inline-duplicated unions, file-naming suffixes (`.contract.ts` / `.type.ts` / `.service.ts` / `.model.ts` / `.resource.ts` / `.spec.ts`), single-responsibility files, FP-factory + internal-class pattern, brace-every-control-block readability with blank lines between consecutive blocks, JSDoc on public surface and non-obvious logic, error classes extending framework errors, async/await + `Promise.all`, `undefined` over `null`, Vitest co-located, ESLint/Prettier or Oxlint/Oxfmt. Triggers: writing/editing any `.ts` / `.tsx` file in this project; user asks "what are the code standards / style rules / conventions"; spawning a sub-agent that will write code; reviewing a diff for style issues; deciding `interface` vs `type`, when to use a class, where helpers live, how to name a file, or whether something needs JSDoc. Skip: pure-Markdown / JSON / YAML edits with no code change; runtime / behavior questions about a specific framework primitive — load the relevant `@warlock.js/<pkg>` skill instead; package-publishing or CI workflow questions.'
+description: 'Project-level TypeScript code standards for apps built on Warlock.js — `interface` vs `type`, access modifiers, no `any`, no inline-duplicated unions, file-naming suffixes (`.contract.ts` / `.type.ts` / `.service.ts` / `.model.ts` / `.resource.ts` / `.spec.ts`), single-responsibility files, FP-factory + internal-class pattern, brace-every-control-block readability with blank lines between consecutive blocks, JSDoc on public surface and non-obvious logic, error classes extending framework errors, async/await + `Promise.all`, `undefined` over `null`, Vitest co-located, Oxlint/Oxfmt. Triggers: writing/editing any `.ts` / `.tsx` file in this project; user asks "what are the code standards / style rules / conventions"; spawning a sub-agent that will write code; reviewing a diff for style issues; deciding `interface` vs `type`, when to use a class, where helpers live, how to name a file, or whether something needs JSDoc. Skip: pure-Markdown / JSON / YAML edits with no code change; runtime / behavior questions about a specific framework primitive — load the relevant `@warlock.js/<pkg>` skill instead; package-publishing or CI workflow questions.'
 ---
 
 # Code Standards
@@ -52,14 +52,16 @@ Never omit `public` / `private` / `protected`. Explicit is faster to read than i
 export class CartService {
   public readonly currency: string;
   private items: CartItem[] = [];
-  public add(item: CartItem) { /* ... */ }
+  public add(item: CartItem) {
+    /* ... */
+  }
 }
 
 // ❌
 export class CartService {
-  readonly currency: string;     // missing public
-  items: CartItem[] = [];        // missing private
-  add(item: CartItem) {}         // missing public
+  readonly currency: string; // missing public
+  items: CartItem[] = []; // missing private
+  add(item: CartItem) {} // missing public
 }
 ```
 
@@ -75,12 +77,12 @@ If a union appears in more than one place, extract it to a named exported type o
 // ✅
 export type OrderStatus = "pending" | "paid" | "shipped" | "cancelled";
 
-export type Order = { status: OrderStatus; /* ... */ };
-export type OrderEvent = { status: OrderStatus; /* ... */ };
+export type Order = { status: OrderStatus /* ... */ };
+export type OrderEvent = { status: OrderStatus /* ... */ };
 
 // ❌ inline duplication — changing the set means N edits and N chances to miss one
-export type Order = { status: "pending" | "paid" | "shipped" | "cancelled"; /* ... */ };
-export type OrderEvent = { status: "pending" | "paid" | "shipped" | "cancelled"; /* ... */ };
+export type Order = { status: "pending" | "paid" | "shipped" | "cancelled" /* ... */ };
+export type OrderEvent = { status: "pending" | "paid" | "shipped" | "cancelled" /* ... */ };
 ```
 
 ### 1.5 Constrain generics
@@ -89,10 +91,14 @@ Open generics are almost always wrong. If `T` has a contract, declare it.
 
 ```typescript
 // ✅
-export function publish<T extends DomainEvent>(event: T): void { /* ... */ }
+export function publish<T extends DomainEvent>(event: T): void {
+  /* ... */
+}
 
 // ❌
-export function publish<T>(event: T): void { /* ... */ }
+export function publish<T>(event: T): void {
+  /* ... */
+}
 ```
 
 ### 1.6 Prefer `undefined` for "absent"
@@ -102,7 +108,9 @@ Use `undefined` everywhere — optional properties, optional parameters, "not fo
 ```typescript
 // ✅
 export type User = { id: string; phone?: string };
-function find(id: string): User | undefined { /* ... */ }
+function find(id: string): User | undefined {
+  /* ... */
+}
 
 // ❌ mixed
 export type User = { id: string; phone: string | null };
@@ -162,14 +170,14 @@ Always bare: `from "./order.service"`, never `from "./order.service.ts"` or `.js
 
 ## 3. File naming
 
-| Suffix         | Purpose                              | Example                |
-| -------------- | ------------------------------------ | ---------------------- |
-| `.contract.ts` | Interface only (blueprint)           | `payment.contract.ts`  |
-| `.type.ts`     | Types only (data shapes)             | `order.type.ts`        |
-| `.service.ts`  | Service class                        | `cart.service.ts`      |
-| `.model.ts`    | Domain model class                   | `user.model.ts`        |
-| `.resource.ts` | Output mapper (model → wire format)  | `order.resource.ts`    |
-| `.spec.ts`     | Co-located test for a sibling `.ts`  | `cart.service.spec.ts` |
+| Suffix         | Purpose                             | Example                |
+| -------------- | ----------------------------------- | ---------------------- |
+| `.contract.ts` | Interface only (blueprint)          | `payment.contract.ts`  |
+| `.type.ts`     | Types only (data shapes)            | `order.type.ts`        |
+| `.service.ts`  | Service class                       | `cart.service.ts`      |
+| `.model.ts`    | Domain model class                  | `user.model.ts`        |
+| `.resource.ts` | Output mapper (model → wire format) | `order.resource.ts`    |
+| `.spec.ts`     | Co-located test for a sibling `.ts` | `cart.service.spec.ts` |
 
 **One primary export per file.** If a `.contract.ts` also defines closely-related data types used only by that contract, that's fine — but the primary export is the interface.
 
@@ -216,9 +224,15 @@ export function placeOrder(config: OrderConfig) {
 class PlacementRun {
   private items: ResolvedItem[] = [];
   private total = 0;
-  public async run(): Promise<OrderResult> { /* ... */ }
-  private async validate(): Promise<void> { /* ... */ }
-  private async charge(): Promise<void> { /* ... */ }
+  public async run(): Promise<OrderResult> {
+    /* ... */
+  }
+  private async validate(): Promise<void> {
+    /* ... */
+  }
+  private async charge(): Promise<void> {
+    /* ... */
+  }
 }
 ```
 
@@ -283,7 +297,9 @@ Identifiers carry the meaning. Add a comment only when the **why** is non-obviou
 ```typescript
 // ❌ noise
 // Loop over items
-for (const item of items) { /* ... */ }
+for (const item of items) {
+  /* ... */
+}
 
 // ✅ the WHY isn't obvious from the code
 // Stripe returns idempotency_key on retry but not on first call —
@@ -362,7 +378,7 @@ Every promise is either awaited, returned, or explicitly `.catch()`'d. A "fire a
 
 ```typescript
 // ❌
-sendWelcomeEmail(user);  // floating — if it rejects, you'll never know
+sendWelcomeEmail(user); // floating — if it rejects, you'll never know
 
 // ✅
 await sendWelcomeEmail(user);
@@ -481,7 +497,7 @@ Validation runs once at the route boundary; everything inward consumes the typed
 type Order = { totalCents: number; placedAtUtc: Date };
 
 // ❌
-type Order = { total: number; placedAt: string };  // float money, ambiguous tz
+type Order = { total: number; placedAt: string }; // float money, ambiguous tz
 ```
 
 See `skills/data-and-persistence/SKILL.md`.
@@ -551,12 +567,11 @@ A secret with no safe default (a payment key, a signing secret) should fail loud
 
 ## 11. Tooling
 
-Use the project's selected toolchain: `eslint.config.js` + `.prettierrc.json`, or
-`.oxlintrc.json` + `.oxfmtrc.json`. Run `npm run lint:check` and
+Use the project's toolchain: `.oxlintrc.json` + `.oxfmtrc.json`. Run `npm run lint:check` and
 `npm run format:check` for non-mutating checks. The Oxc scaffold enables the
 Oxlint development health checker and retains TypeScript checking.
 
-`npx warlock check` is the one verify command, in either toolchain: it
+`npx warlock check` is the one verify command, with Oxlint: it
 typechecks, runs the configured linter and the affected tests, and checks the
 framework's conventions — `request.validated()` instead of `request.all()`,
 guarded or `public: true` mutating routes, safe redirects, redacted logs,
@@ -564,17 +579,17 @@ bounded regexes on input, one controller per file, `type` (not `kind`) as a
 union's discriminator. Each problem has a `WL` code and its fix
 (`npx warlock explain <CODE>`).
 
-For ESLint, consider enabling these additional rules:
+For Oxlint, consider enabling these additional rules:
 
-- `@typescript-eslint/explicit-member-accessibility` — enforces § 1.2
-- `@typescript-eslint/no-explicit-any` — enforces § 1.3
-- `@typescript-eslint/consistent-type-definitions` — supports § 1.1
-- `@typescript-eslint/no-floating-promises` — enforces § 6.3
-- `@typescript-eslint/await-thenable`
+- `typescript/explicit-member-accessibility` — enforces § 1.2
+- `typescript/no-explicit-any` — enforces § 1.3
+- `typescript/consistent-type-definitions` — supports § 1.1
+- `typescript/no-floating-promises` — enforces § 6.3 (requires `oxlint-tsgolint` and `options.typeAware: true`)
+- `typescript/await-thenable` (same type-aware engine requirement)
 - `curly` — enforces braces (§ 4.4)
 - `no-console` — enforces § 8
 
-Match the selected formatter config: `.prettierrc.json` or `.oxfmtrc.json`. Both use 100 columns, double quotes, semicolons and trailing commas. Prettier uses `@ianvs/prettier-plugin-sort-imports` (Babel, independent of TypeScript); it sorts built-ins, packages, aliases (`app/*`, `web/*`, `@shared/*`) and relatives in one block while preserving separate type imports. Oxfmt sorts imports through its own configuration. Both retain unused imports: ESLint reports them through `unused-imports/no-unused-imports`, and Oxlint through `no-unused-vars`. Run the formatter, then the linter.
+Match `.oxfmtrc.json`: 100 columns, double quotes, semicolons, trailing commas and built-in import sorting.
 
 ---
 
@@ -583,6 +598,7 @@ Match the selected formatter config: `.prettierrc.json` or `.oxfmtrc.json`. Both
 Before any change ships:
 
 **Craft**
+
 - [ ] All class members have access modifiers
 - [ ] No `any`
 - [ ] No inline-duplicated unions or literal sets
@@ -600,6 +616,7 @@ Before any change ships:
 - [ ] `npx warlock check` exits 0
 
 **Non-negotiable defaults**
+
 - [ ] Every untrusted input has a `@warlock.js/seal` schema at the boundary
 - [ ] Money fields are integer minor units, time stored as UTC
 - [ ] IDs exposed in URLs are opaque (UUID / nanoid)

package/templates/warlock/skills/git-workflow/SKILL.md

@@ -37,18 +37,18 @@ refactor(cart): extract totals calculation into a util
 
 ### 1.2 Types
 
-| Type        | Use for                                          |
-| ----------- | ------------------------------------------------ |
-| `feat`      | New user-visible feature or capability           |
-| `fix`       | Bug fix                                          |
-| `refactor`  | Internal restructure with no behaviour change    |
-| `docs`      | Documentation only (skills, README, code docs)   |
-| `test`      | Adding or updating tests only                    |
-| `chore`     | Tooling, config, scripts — no app code change    |
-| `perf`      | Performance improvement                          |
-| `build`     | Build system or external dependencies            |
-| `ci`        | CI configuration                                 |
-| `style`     | Formatting only (rare — Prettier handles this)   |
+| Type       | Use for                                        |
+| ---------- | ---------------------------------------------- |
+| `feat`     | New user-visible feature or capability         |
+| `fix`      | Bug fix                                        |
+| `refactor` | Internal restructure with no behaviour change  |
+| `docs`     | Documentation only (skills, README, code docs) |
+| `test`     | Adding or updating tests only                  |
+| `chore`    | Tooling, config, scripts — no app code change  |
+| `perf`     | Performance improvement                        |
+| `build`    | Build system or external dependencies          |
+| `ci`       | CI configuration                               |
+| `style`    | Formatting only (rare — Oxfmt handles this)    |
 
 ### 1.3 Scope
 
@@ -143,18 +143,23 @@ Each PR is independently mergeable, independently reviewable.
 
 ```markdown
 ## What
+
 One-line summary of the change.
 
 ## Why
+
 The reason — link to a ticket, design doc, or bug report.
 
 ## How to verify
+
 Steps a reviewer can take to confirm it works.
 
 ## Screenshots / recordings
+
 If UI or output changed.
 
 ## Notes for reviewer
+
 Anything that's intentionally weird or worth knowing.
 ```
 
@@ -195,14 +200,14 @@ A drive-by approve is worse than no approve — it gives false confidence. If yo
 
 Every PR runs these. All must pass before merge. The exact commands match `package.json` scripts:
 
-| Gate                          | Command                       | Blocks on                          |
-| ----------------------------- | ----------------------------- | ---------------------------------- |
-| Type-check                    | `yarn tsc`                    | Any TS error                       |
-| Lint                          | `yarn lint`                   | Any ESLint error                   |
-| Tests                         | `yarn test --run`             | Any failed test                    |
-| Coverage (recommended floor)  | `yarn test:coverage`          | TBD per team policy                |
-| Dependency audit              | `yarn audit --level=high`     | High / critical vulnerabilities    |
-| Format check                  | `yarn format --check`         | Any unformatted file               |
+| Gate                         | Command                   | Blocks on                       |
+| ---------------------------- | ------------------------- | ------------------------------- |
+| Type-check                   | `yarn tsc`                | Any TS error                    |
+| Lint                         | `yarn lint`               | Any Oxlint error                |
+| Tests                        | `yarn test --run`         | Any failed test                 |
+| Coverage (recommended floor) | `yarn test:coverage`      | TBD per team policy             |
+| Dependency audit             | `yarn audit --level=high` | High / critical vulnerabilities |
+| Format check                 | `yarn format --check`     | Any unformatted file            |
 
 Additional rules:
 

package/templates/warlock/skills/module-boundaries/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: module-boundaries
-description: 'Architecture rules for how modules under `src/app/**` relate — each module owns one domain noun (`orders`, `users`, `carts`, `payments`); standard layout per module (`controllers/`, `services/`, `models/<noun>/`, `repositories/`, `schema/`, `resources/`, `types/`, `utils/`, `events/`, `errors/`, `routes.ts`); public surface exposed through sub-folder barrels (`services/index.ts`, `utils/index.ts`, `types/index.ts`) — NEVER a module-root `index.ts` re-exporting everything; no module reaches into another module''s internal files; zero circular dependencies between modules; inter-module communication is explicit — direct service call OR `@mongez/events` bus, never shared mutable globals; cross-cutting helpers live in `src/app/shared/`. Triggers: adding a new module under `src/app/**`; importing from another module; deciding where new code belongs; circular import error; ESLint `import/no-restricted-paths` violation; user asks "can module A use module B''s internals", "how should modules talk", "where should this code live", "I''m getting a circular dependency", "what folders does a module need", "what goes in shared". Skip: intra-module file organization (load `skills/code-standards/SKILL.md` § 4); barrel mechanics within a module (load `skills/code-standards/SKILL.md` § 2.2); deploying / packaging / monorepo questions; framework primitive details — load relevant `@warlock.js/*` skill.'
+description: 'Architecture rules for how modules under `src/app/**` relate — each module owns one domain noun (`orders`, `users`, `carts`, `payments`); standard layout per module (`controllers/`, `services/`, `models/<noun>/`, `repositories/`, `schema/`, `resources/`, `types/`, `utils/`, `events/`, `errors/`, `routes.ts`); public surface exposed through sub-folder barrels (`services/index.ts`, `utils/index.ts`, `types/index.ts`) — NEVER a module-root `index.ts` re-exporting everything; no module reaches into another module''s internal files; zero circular dependencies between modules; inter-module communication is explicit — direct service call OR `@mongez/events` bus, never shared mutable globals; cross-cutting helpers live in `src/app/shared/`. Triggers: adding a new module under `src/app/**`; importing from another module; deciding where new code belongs; circular import error; Oxlint `import/no-restricted-paths` violation; user asks "can module A use module B''s internals", "how should modules talk", "where should this code live", "I''m getting a circular dependency", "what folders does a module need", "what goes in shared". Skip: intra-module file organization (load `skills/code-standards/SKILL.md` § 4); barrel mechanics within a module (load `skills/code-standards/SKILL.md` § 2.2); deploying / packaging / monorepo questions; framework primitive details — load relevant `@warlock.js/*` skill.'
 ---
 
 # Module boundaries
@@ -116,26 +116,35 @@ See `skills/code-standards/SKILL.md` § 2.2 for the reasoning.
 - `src/app/<module>/schema/*` — schemas belong to the endpoint that uses them
 - `src/app/<module>/routes.ts` — registers routes for the framework, nobody imports it
 
-### 3.3 Enforce with ESLint
+### 3.3 Enforce with Oxlint
 
-Add `eslint-plugin-import/no-restricted-paths` rules:
+Add scoped native rules to `.oxlintrc.json`:
 
-```js
-// eslint.config.js — proposed addition
+```json
 {
-  rules: {
-    "import/no-restricted-paths": ["error", {
-      zones: [
-        { target: "src/app/*/controllers", from: "src/app/*/controllers", except: ["./"] },
-        { target: "src/app", from: "src/app/*/repositories", except: ["./*/services"] },
-        { target: "src/app", from: "src/app/*/schema", except: ["./*/controllers"] },
-      ],
-    }],
-  },
+  "overrides": [
+    {
+      "files": ["src/app/orders/**/*.ts"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": ["app/*/controllers/**", "app/*/repositories/**"],
+                "message": "Import public services instead"
+              }
+            ]
+          }
+        ]
+      }
+    }
+  ]
 }
 ```
 
-The exact rule shape depends on the eslint config — but the principle is: cross-module imports go through services / utils / types / resources / models / errors, never through the private folders.
+Cross-module imports go through public services, utils, types, resources, models
+and errors. Adapt each override to the module's public surface.
 
 ---
 
@@ -192,7 +201,7 @@ Or, if the shared concept is purely cross-cutting (not a domain), it goes to `ap
 
 ### 5.4 Detect in CI
 
-`eslint-plugin-import/no-cycle` catches cycles at lint time. Enable it.
+`import/no-cycle` catches cycles at lint time. Enable it.
 
 ---
 
@@ -244,13 +253,13 @@ Top-level mutable exports across modules are the worst kind of coupling — invi
 
 ## 7. Where shared code lives
 
-| If the code is...                       | Put it in                                     |
-| --------------------------------------- | --------------------------------------------- |
-| Used by 2+ modules, stable, cross-domain | `src/app/shared/`                            |
-| Used by 2+ modules, domain-specific      | Extract a new domain module                   |
-| Used by exactly 1 module                 | Stays inside that module's `utils/`           |
-| Third-party integration glue (SDK wrappers) | `src/app/shared/` (or a dedicated module)  |
-| Build-time config                        | `src/config/` (one file per concern)          |
+| If the code is...                           | Put it in                                 |
+| ------------------------------------------- | ----------------------------------------- |
+| Used by 2+ modules, stable, cross-domain    | `src/app/shared/`                         |
+| Used by 2+ modules, domain-specific         | Extract a new domain module               |
+| Used by exactly 1 module                    | Stays inside that module's `utils/`       |
+| Third-party integration glue (SDK wrappers) | `src/app/shared/` (or a dedicated module) |
+| Build-time config                           | `src/config/` (one file per concern)      |
 
 ### 7.1 Promotion to `shared/` is a deliberate choice
 
@@ -285,7 +294,7 @@ Before merging a change that adds, restructures, or imports across modules:
 - [ ] No module-root `index.ts` created
 - [ ] Sub-folder barrels exist for `services/`, `utils/`, `types/` where applicable
 - [ ] No imports from another module's `controllers/`, `repositories/`, `schema/`
-- [ ] No circular imports between modules (ESLint `no-cycle` clean)
+- [ ] No circular imports between modules (Oxlint `no-cycle` clean)
 - [ ] Cross-module communication uses direct service call or `@mongez/events` — never shared mutable globals
 - [ ] Shared code that's used by 2+ modules lives in `src/app/shared/`, not duplicated
 - [ ] Module has a `README.md` describing purpose, public surface, and ownership

package/templates/warlock/skills/web-code-standards/SKILL.md

@@ -292,7 +292,7 @@ and refresh primitives so state and loader data stay in sync.
 
 Apply the shared `code-standards` rules to web TypeScript as well: `type` for
 plain props/data, no `any`, no swallowed catches, no unsafe assertions used
-to hide an unknown data contract. Configure non-mutating ESLint and formatting
+to hide an unknown data contract. Configure non-mutating Oxlint and formatting
 checks to enforce rules that can be automated; do not rely on a lint command
 that rewrites files as the only quality gate.
 

package/templates/warlock/src/web/home/components/home-footer.tsx

@@ -1,5 +1,7 @@
 import { HomeLogo } from "./logo";
 
+const copyrightYear = new Date().getFullYear();
+
 export function HomeFooter() {
   return (
     <>
@@ -27,7 +29,7 @@ export function HomeFooter() {
           <a href="https://github.com/warlockjs" target="_blank" rel="noreferrer">
             GitHub
           </a>
-          <span>MIT © {new Date().getFullYear()}</span>
+          <span>MIT © {copyrightYear}</span>
         </div>
       </footer>
     </>

package/esm/prompts/ask-lint-toolchain.mjs

@@ -1,21 +0,0 @@
-import { select } from "@clack/prompts";
-
-//#region ../../packages/create-warlock/src/prompts/ask-lint-toolchain.ts
-/** The full wizard offers the same toolchain choice as --lint. */
-function askLintToolchain(initialValue = "oxc") {
-	return select({
-		message: "Choose lint and formatting tools",
-		options: [{
-			value: "eslint",
-			label: "ESLint + Prettier"
-		}, {
-			value: "oxc",
-			label: "Oxlint + Oxfmt"
-		}],
-		initialValue
-	});
-}
-
-//#endregion
-export { askLintToolchain };
-//# sourceMappingURL=ask-lint-toolchain.mjs.map

package/esm/prompts/ask-lint-toolchain.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ask-lint-toolchain.mjs","names":[],"sources":["../../../../../../../packages/create-warlock/src/prompts/ask-lint-toolchain.ts"],"sourcesContent":["import { select } from \"@clack/prompts\";\nimport type { LintToolchain } from \"../commands/create-new-app/types\";\n\n/** The full wizard offers the same toolchain choice as --lint. */\nexport function askLintToolchain(initialValue: LintToolchain = \"oxc\") {\n  return select<LintToolchain>({\n    message: \"Choose lint and formatting tools\",\n    options: [\n      { value: \"eslint\", label: \"ESLint + Prettier\" },\n      { value: \"oxc\", label: \"Oxlint + Oxfmt\" },\n    ],\n    initialValue,\n  });\n}\n"],"mappings":";;;;AAIA,SAAgB,iBAAiB,eAA8B,OAAO;CACpE,OAAO,OAAsB;EAC3B,SAAS;EACT,SAAS,CACP;GAAE,OAAO;GAAU,OAAO;EAAoB,GAC9C;GAAE,OAAO;GAAO,OAAO;EAAiB,CAC1C;EACA;CACF,CAAC;AACH"}