@dokebi/cli 0.4.1 → 0.4.26

package/dist/recipe.js

@@ -3,22 +3,61 @@
 // package that provides it. Without every answer nothing is installed (ANSWERS_REQUIRED). With
 // answers each step calls the existing transactional command, in order, skipping steps that are
 // already satisfied and stopping at the first failure with the steps that completed.
-import { spawn } from 'node:child_process';
-import { readFile } from 'node:fs/promises';
+import { readdir, readFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { parse } from 'yaml';
+import { ANSWER_SOURCES, ASK_AND_WAIT } from './capability-guide.js';
 import { HOST_CAPABILITY, loadCatalog, providersOf, } from './catalog.js';
-import { CONFIG_FILE, parseProjectConfig } from './configuration.js';
+import { runDevCompose } from './dev-compose.js';
+import { AUTO_DOMAIN, devHost, readProjectHostLabel } from './dev-host.js';
 import { COMPOSE_FILE, commandOnPath, composeServiceRunning, DB_SERVICE, dockerAvailable, freePortAfter, portInUse, portQuestion, URL_PLACEHOLDER_PREFIX, } from './dev-infra.js';
 import { debug, describeError, isMissing } from './diagnostics.js';
 import { CliError } from './errors.js';
 import { exists } from './filesystem.js';
-import { OutputTail } from './npm-client.js';
+import { describeFirstAdmin, firstAdminPhrase } from './first-admin.js';
 import { initFolder } from './project.js';
-import { saveAppliedRecipe } from './recipe-record.js';
+import { csrfNotice, factOf, factToken, plannedText, SEAL_HEAD, SEAL_HTTP_MODULE, SESSION_OFFER, } from './recipe-facts.js';
+import { ADMIN_LOGIN, ADMIN_PASSWORD_KEY, ADMIN_PATH, EXTENSION_FILE, LOGIN_NAME_SOURCES, loginFiles, MIGRATIONS_DIRECTORY, migrationPath, ROUTES_FILE, recipeAdminSection, recipeLoginNames, SEED_FILE, withLoginRoutes, } from './recipe-login.js';
+import { checkMailCompose, mailSteps } from './recipe-mail.js';
+import { APP_URL_PLACEHOLDER, FIRST_ADMIN_PLACEHOLDER, LOGIN_PAGES, NO_SCREENS_BUILT, saveAppliedRecipe, } from './recipe-record.js';
+import { checkSite, sealedSiteApp, siteDefinition, siteSteps } from './recipe-site.js';
+import { provider, shell, view } from './recipe-step.js';
 import * as server from './server.js';
-/** The first sentence of `next` (and of the guide and AGENTS.md §1), word for word. */
-export const ASK_AND_WAIT = 'Ask these questions and end your turn; do not run recipe/add/config until the user answers. Only use --defaults if the user said to decide.';
+import { AI_REASON_MAX, aiReasonFits } from './view-choice.js';
+// The notice sentences live with the facts they state (D-0137); the names stay importable here.
+export { csrfNotice, SEAL_HEAD, SEAL_HTTP_MODULE, sealNotice, ssrSealNotice, } from './recipe-facts.js';
+/**
+ * D-0098: a recipe that builds no browser screens (`screens: false`, the api recipe) answers the
+ * view with `none`. It is not a question (the recipe is the choice) and not a value the recipe
+ * fixes: who chose no screens is recorded like an answer, the user's unless the AI names `view`
+ * in `--ai-chose` (or the user left every choice to it), and verify's tellUser says it. Its app
+ * skeleton (the first app, which `add @dokebi/app` writes) has an EJS home page, but no screens
+ * for people. An app added later with `app add` inherits view none (no views, a JSON API) unless
+ * it says `--view ejs` or `--inertia` (M50).
+ */
+export const SCREENS = 'view';
+/** The view answer of a recipe without browser screens. */
+export const NO_SCREENS = 'none';
+/** The recipes that ask the view (blog, site): where a service people use in a browser goes. */
+export function screenRecipes(catalog) {
+    return catalog.recipes
+        .filter((recipe) => recipe.questions.includes('view') && !recipe.fixed?.view)
+        .map((recipe) => recipe.name);
+}
+/** The words of a list: `blog or site`. */
+function either(names) {
+    return names.length > 1
+        ? `${names.slice(0, -1).join(', ')} or ${names.at(-1)}`
+        : (names[0] ?? '');
+}
+/** What a recipe without screens tells the AI before and after planning (D-0098). */
+export function noScreensNotice(recipe, browserRecipes) {
+    return `The ${recipe} recipe builds no browser screens: a JSON API whose clients are other programs (Bearer tokens, server to server). When people use the service in a browser (sign up, browse, press buttons, read lists), it is a browser app: use the ${either(browserRecipes)} recipe instead (they ask the view; default Inertia + Vue). No screens (API only) is a product choice: unless the user or the request said so, it is yours, allowed only when the user left it to you; then pass --ai-chose ${SCREENS} with --ai-reason ${SCREENS}=<why> and tell the user in the first lines of your final message.`;
+}
+/** The recorded notice of a recipe without screens: verify's tellUser tells the user (D-0098). */
+export function noScreensRecord(recipe, browserRecipes) {
+    return `No browser screens (${recipe} recipe): ${NO_SCREENS_BUILT} Browser screens come from the ${either(browserRecipes)} recipe (default view Inertia + Vue).`;
+}
 /** `dokebi recipe list`. */
 export async function listRecipes() {
     const catalog = await loadCatalog();
@@ -57,6 +96,19 @@ function applies(choice, answers) {
     }
     return true;
 }
+/** An option's own `when` (admin login needs a database): unmet when an answer contradicts it. */
+function unmet(option, answers, flagOf) {
+    for (const [id, rule] of Object.entries(option.when ?? {})) {
+        const value = answers[id];
+        if (value === undefined)
+            continue;
+        if (rule.startsWith('!') ? value === rule.slice(1) : value !== rule)
+            return rule.startsWith('!')
+                ? `Not available with ${flagOf(id)} ${value}`
+                : `Only available with ${flagOf(id)} ${rule}`;
+    }
+    return undefined;
+}
 function variantOf(catalog, capability) {
     if (!capability)
         return undefined;
@@ -66,15 +118,6 @@ function variantOf(catalog, capability) {
                 return variant;
     return undefined;
 }
-/** The plugin package that provides a capability (the recipe never names packages). */
-function provider(catalog, capability) {
-    const found = providersOf(catalog, capability).find((item) => item.kind === 'plugin');
-    if (!found)
-        throw new CliError('CATALOG_INVALID', `No plugin provides ${capability}`, {
-            details: { capability },
-        });
-    return found.package;
-}
 /** The devInfra docker note when `docker` is not on PATH (the default stays; the user decides). */
 export const DOCKER_NOT_FOUND = 'docker was not found on PATH: install and start Docker before applying with docker, or choose url (a database server you already have)';
 /** Question list with options adjusted to the answers given so far (docker per db variant). */
@@ -83,11 +126,16 @@ function questions(catalog, recipe, answers, dockerOnPath = () => commandOnPath(
     const db = catalog.choices
         .find((item) => item.id === 'db')
         ?.options.find((option) => option.value === values.db);
+    const flagOf = (id) => choiceOf(catalog, id).flag;
     return recipe.questions
         .filter((id) => !recipe.fixed?.[id])
         .map((id) => {
         const choice = choiceOf(catalog, id);
         const options = choice.options.map((option) => {
+            // An option another answer rules out (admin login with db none) is shown unavailable.
+            const why = option.available ? unmet(option, values, flagOf) : undefined;
+            if (why)
+                return { ...option, available: false, why };
             if (id !== 'devInfra' || option.value !== 'docker' || !db?.capability)
                 return option;
             const docker = variantOf(catalog, db.capability)?.devInfra?.docker;
@@ -110,6 +158,7 @@ function questions(catalog, recipe, answers, dockerOnPath = () => commandOnPath(
             flag: choice.flag,
             question: choice.question,
             options: shown,
+            ...(choice.input ? { input: choice.input } : {}),
             default: choice.default,
             defaultReason: missingDocker && choice.default === 'docker'
                 ? `${choice.defaultReason}. Note: ${DOCKER_NOT_FOUND}`
@@ -119,7 +168,104 @@ function questions(catalog, recipe, answers, dockerOnPath = () => commandOnPath(
         };
     });
 }
-/** Collects answers from flags, recipe-fixed values and (when asked) defaults; validates them. */
+/** Where the answers came from: `--answers-from`, else `--defaults` alone; undefined: not said. */
+function answerSource(request) {
+    return request.answersFrom ?? (request.defaults ? 'defaults' : undefined);
+}
+/**
+ * The given answers the agent chose (D-0095 `--ai-chose`) and its reasons (`--ai-reason`),
+ * checked against the recipe: an id it does not ask, one it fixes, one without its flag, and a
+ * reason for an id that is not an AI choice are refused before anything is planned.
+ */
+function aiChoices(catalog, recipe, request) {
+    // D-0098: a recipe without screens records view = none, which --ai-chose can name (view, --view).
+    const screens = recipe.screens === false ? [SCREENS] : [];
+    const asked = [...recipe.questions.filter((id) => !recipe.fixed?.[id]), ...screens];
+    // A question id (devInfra) or its flag name (dev-infra, --dev-infra) names the same question.
+    // The recipe's fixed answers count too, so naming one is AI_CHOICE_FIXED, not unknown.
+    const ids = [...recipe.questions, ...Object.keys(recipe.fixed ?? {})];
+    const idOf = (name) => {
+        if (ids.includes(name) || screens.includes(name))
+            return name;
+        const flag = `--${name.replace(/^-+/, '')}`;
+        return [...ids, ...screens].find((id) => choiceOf(catalog, id).flag === flag);
+    };
+    const known = (name, flag) => {
+        const id = idOf(name);
+        if (!id)
+            throw new CliError('AI_CHOICE_UNKNOWN', `The ${recipe.name} recipe does not ask ${name}`, {
+                details: {
+                    recipe: recipe.name,
+                    [flag === '--ai-chose' ? 'aiChose' : 'aiReason']: name,
+                    questions: asked,
+                    fix: `name only question ids of this recipe in ${flag}: ${asked.join(', ')}`,
+                },
+                phase: 'arguments',
+            });
+        return id;
+    };
+    const chose = new Set();
+    for (const name of request.aiChose ?? []) {
+        const id = known(name, '--ai-chose');
+        const fixed = recipe.fixed?.[id];
+        if (fixed !== undefined)
+            throw new CliError('AI_CHOICE_FIXED', `The ${recipe.name} recipe fixes ${id} (${fixed}); it is not a choice the AI made`, {
+                details: {
+                    recipe: recipe.name,
+                    question: id,
+                    value: fixed,
+                    fix: `drop ${id} from --ai-chose`,
+                },
+                phase: 'arguments',
+            });
+        if (!screens.includes(id) && request.answers[id] === undefined) {
+            const flag = choiceOf(catalog, id).flag;
+            throw new CliError('AI_CHOICE_WITHOUT_ANSWER', `--ai-chose names ${id}, but ${flag} is not given`, {
+                details: {
+                    recipe: recipe.name,
+                    question: id,
+                    fix: `pass ${flag} <your choice> with --ai-chose ${id}, or drop ${id} from --ai-chose and add --defaults to take the default (only when the user left the choice to you)`,
+                },
+                phase: 'arguments',
+            });
+        }
+        chose.add(id);
+    }
+    const reasons = new Map();
+    for (const [name, text] of Object.entries(request.aiReasons ?? {})) {
+        const id = known(name, '--ai-reason');
+        if (!chose.has(id))
+            throw new CliError('AI_REASON_WITHOUT_CHOICE', `--ai-reason ${id} is given, but ${id} is not in --ai-chose`, {
+                details: {
+                    recipe: recipe.name,
+                    question: id,
+                    aiChose: [...chose],
+                    fix: `add ${id} to --ai-chose if you chose it because the user left it to you; a reason for the user's own answer is not recorded`,
+                },
+                phase: 'arguments',
+            });
+        const reason = text.trim();
+        if (!aiReasonFits(reason))
+            throw new CliError('INVALID_AI_REASON', `--ai-reason ${id} must be one line of 1 to ${AI_REASON_MAX} characters`, {
+                details: {
+                    recipe: recipe.name,
+                    question: id,
+                    length: reason.length,
+                    fix: `give one short line the user reads: why you chose ${request.answers[id] ?? 'none'} for ${id}`,
+                },
+                phase: 'arguments',
+            });
+        reasons.set(id, reason);
+    }
+    if (chose.size)
+        debug('recipe: answers the AI chose', { ids: [...chose], reasons: reasons.size });
+    return { chose, reasons };
+}
+/**
+ * Collects answers from flags, recipe-fixed values and (when asked) defaults; validates them.
+ * Each given answer is the user's, or the agent's when it is in `aiChose` or when the user left
+ * every choice to the agent (`--defaults` alone, D-0095).
+ */
 function answer(catalog, recipe, request) {
     const answers = {};
     for (const id of Object.keys(request.answers))
@@ -131,6 +277,14 @@ function answer(catalog, recipe, request) {
                 },
                 phase: 'arguments',
             });
+    const { chose, reasons } = aiChoices(catalog, recipe, request);
+    const delegatedAll = answerSource(request) === 'defaults';
+    const fromFlag = (id, value) => {
+        if (!chose.has(id) && !delegatedAll)
+            return { value, answeredBy: 'user' };
+        const reason = reasons.get(id);
+        return { value, answeredBy: 'ai', ...(reason ? { aiReason: reason } : {}) };
+    };
     for (const [id, value] of Object.entries(recipe.fixed ?? {}))
         answers[id] = { value, answeredBy: 'recipe' };
     for (const id of recipe.questions) {
@@ -140,6 +294,14 @@ function answer(catalog, recipe, request) {
         const given = request.answers[id];
         if (given === undefined)
             continue;
+        if (choice.input === 'text') {
+            if (!given.trim() || given.length > 2048)
+                throw new CliError('INVALID_ANSWER', `${choice.flag} requires at most 2048 characters`, {
+                    phase: 'arguments',
+                });
+            answers[id] = fromFlag(id, given);
+            continue;
+        }
         const option = choice.options.find((item) => item.value === given);
         if (!option)
             throw new CliError('INVALID_ANSWER', `${choice.flag} ${given} is not an option`, {
@@ -151,7 +313,7 @@ function answer(catalog, recipe, request) {
                 details: { question: id, option: given, why: option.why ?? null },
                 phase: 'arguments',
             });
-        answers[id] = { value: given, answeredBy: 'flag' };
+        answers[id] = fromFlag(id, given);
     }
     const missing = [];
     const values = () => Object.fromEntries(Object.entries(answers).map(([id, item]) => [id, item.value]));
@@ -161,7 +323,7 @@ function answer(catalog, recipe, request) {
         const choice = choiceOf(catalog, id);
         if (!applies(choice, values()))
             continue;
-        if (request.defaults || request.answersFrom === 'defaults')
+        if (request.defaults || answerSource(request) === 'defaults')
             answers[id] = {
                 value: choice.default,
                 answeredBy: 'default',
@@ -174,27 +336,26 @@ function answer(catalog, recipe, request) {
     for (const id of Object.keys(answers))
         if (!applies(choiceOf(catalog, id), values()))
             delete answers[id];
-    return { answers, missing };
-}
-async function view(root) {
-    let stateText;
-    try {
-        stateText = await readFile(join(root, '.dokebi/state.json'), 'utf8');
-    }
-    catch (error) {
-        if (isMissing(error))
-            return undefined;
-        throw error;
+    // An answer another answer rules out (--admin login with --db none, D-0076 §6).
+    for (const [id, item] of Object.entries(answers)) {
+        const choice = choiceOf(catalog, id);
+        const option = choice.options.find((entry) => entry.value === item.value);
+        const why = option && unmet(option, values(), (other) => choiceOf(catalog, other).flag);
+        if (why)
+            throw new CliError('OPTION_NOT_APPLICABLE', `${choice.flag} ${item.value}: ${why}`, {
+                details: {
+                    question: id,
+                    option: item.value,
+                    when: option?.when ?? null,
+                    fix: `ask the user to choose another ${choice.flag} or change the answer it depends on`,
+                },
+                phase: 'arguments',
+            });
     }
-    const state = JSON.parse(stateText);
-    const options = parseProjectConfig(await readFile(join(root, CONFIG_FILE), 'utf8')).options;
-    return {
-        installed: new Set((state.plugins ?? []).map((plugin) => plugin.id)),
-        packages: new Set((state.plugins ?? []).flatMap((plugin) => plugin.packageName ?? [])),
-        apps: state.apps ?? [],
-        modules: state.modules ?? [],
-        options,
-    };
+    // D-0098: the recipe itself is the choice of no browser screens; who made it is recorded.
+    if (recipe.screens === false)
+        answers[SCREENS] = fromFlag(SCREENS, NO_SCREENS);
+    return { answers, missing };
 }
 function option(options, path) {
     let current = options;
@@ -205,42 +366,38 @@ function option(options, path) {
     }
     return current;
 }
+/** The CSRF next step of both views ends with this rule (one text, D-0110 §5). */
+const CSRF_NEVER_OFF = "Never turn the check off to make a test pass; a webhook route that verifies its own signature, an @dokebi/auth Bearer-only route (auth: { via: 'token' }) or the token refresh route (it calls tokens.refresh) takes config: { csrf: false }";
 /**
- * Runs a command in the project folder; a failure becomes STEP_COMMAND_FAILED with the bounded,
- * redacted end of its output (`OutputTail` of npm-client).
+ * The tellUser line of `--admin login`: where to sign in and where the first password is.
+ * `appUrl` is the app's `<scheme>://<domain>:<port>`, or APP_URL_PLACEHOLDER in the recipe record
+ * (verify fills in the address of the moment, AI-M05). `firstAdmin` is firstAdminPhrase, or
+ * FIRST_ADMIN_PLACEHOLDER in the record: verify reads the login and the section from the project
+ * as it is then (D-0115: the builder may rename the section or sign the admin in by email).
  */
-export async function shell(root, command, args, timeoutMs) {
-    const npmPath = process.env.npm_execpath;
-    const viaNode = command === 'npm' && npmPath?.endsWith('npm-cli.js');
-    const file = viaNode ? process.execPath : command;
-    const argv = viaNode ? [npmPath, ...args] : args;
-    debug('recipe: running', { command, args, root });
-    await new Promise((done, fail) => {
-        const child = spawn(file, argv, { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] });
-        const output = new OutputTail();
-        const keep = (chunk) => output.push(chunk);
-        child.stdout.on('data', keep);
-        child.stderr.on('data', keep);
-        const timer = setTimeout(() => child.kill('SIGKILL'), timeoutMs);
-        child.once('error', (cause) => {
-            clearTimeout(timer);
-            fail(new CliError('STEP_COMMAND_FAILED', `${command} could not run`, { cause }));
-        });
-        child.once('close', (code, signal) => {
-            clearTimeout(timer);
-            if (code === 0)
-                done();
-            else
-                fail(new CliError('STEP_COMMAND_FAILED', `${command} ${args.join(' ')} failed`, {
-                    details: { exitCode: code, signal, output: output.text() },
-                }));
-        });
-    });
+export function loginNotice(appUrl, devInfra, firstAdmin = FIRST_ADMIN_PLACEHOLDER) {
+    const ready = devInfra === 'docker'
+        ? ''
+        : ' The account exists after npx dokebi-migrate up and npx dokebi-migrate seed (run them once the database URL is in dokebi.yaml).';
+    return `Admin login is on (@dokebi/auth): sign in at ${appUrl}/login ${firstAdmin}; ${LOGIN_PAGES}${ready}`;
 }
-/** The no-CSRF warning of a plan with HTML forms, with the catalog's `instead` for csrf. */
-function noCsrf(catalog) {
-    const csrf = catalog.absent.find((entry) => entry.capability === 'csrf');
-    return `No CSRF protection: csrf is absent from Dokebi${csrf ? ` — instead: ${csrf.instead}` : ''}.`;
+/**
+ * The hosts of a blog/api plan (D-0102): the recipe's `web.domain` is `auto`, the project's own
+ * development hosts `main.<label>.localhost` and `admin.<label>.localhost`, so two projects on one
+ * machine never share cookies. A recipe naming a domain keeps it (admin then on `admin.<domain>`).
+ * An app that already exists keeps the first domain dokebi.yaml maps to it (`options`), so a plan
+ * applied again to an older project (main on `localhost`) seals and links the host it really has.
+ */
+export function recipeHosts(recipe, label, options = {}) {
+    const domains = option(options, ['dokebi-app', 'domains']);
+    const mapped = (app) => domains && typeof domains === 'object'
+        ? Object.entries(domains).find(([, target]) => target?.app === app)?.[0]
+        : undefined;
+    const domain = recipe.web.domain;
+    const defaults = domain === AUTO_DOMAIN
+        ? { main: devHost('main', label), admin: devHost('admin', label) }
+        : { main: domain, admin: `admin.${domain}` };
+    return { main: mapped('main') ?? defaults.main, admin: mapped('admin') ?? defaults.admin };
 }
 /** Builds the plan steps for the answers (capability → package through the catalog). */
 function steps(catalog, recipe, answers, context) {
@@ -252,13 +409,13 @@ function steps(catalog, recipe, answers, context) {
     /** Installed by package name: the app and module hosts come from the catalog (D-0070). */
     const hasPackage = async (name) => (await now())?.packages.has(name) ?? false;
     const plugin = (capability) => provider(catalog, capability);
-    const viewChoice = catalog.choices
-        .find((item) => item.id === 'view')
-        ?.options.find((item) => item.value === (value('view') ?? 'ejs'));
+    // Without an answer (a recipe that neither asks nor fixes the view) the catalog default holds.
+    const viewQuestion = catalog.choices.find((item) => item.id === 'view');
+    const viewChoice = viewQuestion?.options.find((item) => item.value === (value('view') ?? viewQuestion.default));
     const inertia = viewChoice?.capability?.startsWith('view.inertia') ?? false;
     const ssr = viewChoice?.capability === 'view.inertia-vue-ssr';
     const appFlags = inertia ? ` --inertia${ssr ? ' --ssr' : ''}` : '';
-    const domain = recipe.web.domain;
+    const { main: domain, admin: adminDomain } = recipeHosts(recipe, context.hostLabel);
     if (context.init)
         result.push({
             id: 'init',
@@ -269,6 +426,16 @@ function steps(catalog, recipe, answers, context) {
                 await project.init(root);
             },
         });
+    const logger = plugin('logging.targets');
+    result.push({
+        id: 'logger-plugin',
+        command: `npx dokebi add ${logger}`,
+        why: 'the app logger (D-0151): JSON lines on stdout, readable lines in dokebi dev, redaction, and a rotating file target to turn on in production; init adds it, this step adds it to an older project',
+        satisfied: () => hasPackage(logger),
+        run: async () => {
+            await project.add(root, logger);
+        },
+    });
     const apps = plugin('web.apps');
     result.push({
         id: 'app-plugin',
@@ -292,13 +459,48 @@ function steps(catalog, recipe, answers, context) {
             ]);
         },
     });
-    // HTML forms (the blog's write form) post application/x-www-form-urlencoded, which dokebi-web
-    // refuses (415 FORM_BODY_DISABLED) until formBody is on (AI-M02). Inertia posts JSON.
+    // The consumer convention seals every browser app (D-0092 §1, D-0062): a recipe with write
+    // forms is a browser app, so @dokebi/seal is installed and its hosts get seal: true. EJS: the
+    // shared layout (template-ejs) writes the seal head and @dokebi/seal/forms seals its forms.
+    // Inertia: the generated views/app.js awaits sealInertia before createInertiaApp, which opens
+    // the sealed first page and seals every visit. Server rendering cannot be sealed (SSR writes
+    // the props into plain HTML: SEAL_SSR_CONFLICT), so an SSR plan stays plain and its notice
+    // tells the user. The api recipe answers API clients (Bearer, server to server) and stays plain.
+    const sealed = recipe.web.forms === true && !ssr;
+    const sealEjs = sealed && !inertia;
+    if (sealed) {
+        const seal = plugin('security.seal');
+        result.push({
+            id: 'seal-plugin',
+            command: `npx dokebi add ${seal}`,
+            why: inertia
+                ? `browser apps are sealed (the consumer convention): ${seal} seals the first page, the Inertia visits and the JSON bodies of the host and serves ${SEAL_HTTP_MODULE}, which views/app.js imports (as @dokebi/seal/http, through dokebiInertia() of vite.config.ts) for sealInertia before createInertiaApp`
+                : `browser apps are sealed (the consumer convention): ${seal} seals the JSON bodies of the host and serves /dokebi/seal/forms.mjs, which the shared layout loads with ${SEAL_HEAD}`,
+            satisfied: () => has('dokebi-seal'),
+            run: async () => {
+                await project.add(root, seal);
+            },
+        });
+    }
+    if (sealEjs)
+        result.push({
+            id: 'seal-domain',
+            command: `npx dokebi config set dokebi-app.domains.${domain}.seal=true`,
+            why: `seal the browser host ${domain}: page navigations stay plain HTML, every <form method="post"> goes sealed through @dokebi/seal/forms and a plain form post is refused (415 SEAL_REQUIRED); never turn this off to make a form work`,
+            satisfied: async () => option((await now())?.options ?? {}, ['dokebi-app', 'domains', domain, 'seal']) === true,
+            run: async () => {
+                await project.configSet(root, [
+                    { plugin: 'dokebi-app', set: { path: ['domains', domain, 'seal'], value: true } },
+                ]);
+            },
+        });
+    // HTML forms (the blog's write form) are form bodies, which dokebi-web refuses (415
+    // FORM_BODY_DISABLED) until formBody is on (AI-M02), sealed or not. Inertia posts JSON.
     if (recipe.web.forms && !inertia)
         result.push({
             id: 'form-body',
             command: 'npx dokebi config set dokebi-web.formBody=true',
-            why: `HTML forms post application/x-www-form-urlencoded; dokebi-web refuses it (415 FORM_BODY_DISABLED) until formBody is on. ${noCsrf(catalog)}`,
+            why: `HTML forms are form bodies, sealed by @dokebi/seal/forms on a sealed host or not; dokebi-web refuses them (415 FORM_BODY_DISABLED) until formBody is on. ${csrfNotice(false)} The layout writes ${SEAL_HEAD} in its <head>: @dokebi/seal/forms then seals every post form (no per-form code), and the handler gets the same body.`,
             satisfied: async () => option((await now())?.options ?? {}, ['dokebi-web', 'formBody']) === true,
             run: async () => {
                 await project.configSet(root, [
@@ -319,11 +521,11 @@ function steps(catalog, recipe, answers, context) {
         });
         result.push({
             id: 'main-app',
-            command: `npx dokebi app add main${appFlags} --domain ${domain}`,
-            why: `the app main on ${domain} with Vue pages (adds vite.config.ts, the build script, Vite and Vue)`,
+            command: `npx dokebi app add main${appFlags} --domain ${domain}${sealed ? ' --seal' : ''}`,
+            why: `the app main on ${domain} with Vue pages (adds vite.config.ts, the build script, Vite and Vue)${sealed ? '; --seal seals its host: the first page and every visit go sealed and a plain JSON body is refused (415 SEAL_REQUIRED); never turn this off to make a request work' : ''}`,
             satisfied: async () => (await now())?.apps.includes('main') ?? false,
             run: async () => {
-                await project.appAdd(root, 'main', { domains: [domain], inertia: true, ssr });
+                await project.appAdd(root, 'main', { domains: [domain], inertia: true, ssr, seal: sealed });
             },
         });
     }
@@ -407,7 +609,7 @@ function steps(catalog, recipe, answers, context) {
             result.push({
                 id: 'dev-infra',
                 command: `npx dokebi dev-infra${context.dbPort ? ` --db-port ${context.dbPort}` : ''}`,
-                why: 'compose.yaml, a generated password in .env (git-ignored) and the matching URL in dokebi.yaml',
+                why: 'compose.yaml and a generated database URL/password only in dokebi.yaml',
                 satisfied: async () => {
                     const url = option((await now())?.options ?? {}, [
                         'dokebi-db',
@@ -426,34 +628,143 @@ function steps(catalog, recipe, answers, context) {
             });
             result.push({
                 id: 'dev-db-up',
-                command: 'docker compose up -d --wait',
+                command: 'npx dokebi dev-infra up --json',
                 why: `start the ${variant.name} container and wait until it is healthy`,
                 satisfied: () => composeServiceRunning(root),
-                run: () => shell(root, 'docker', ['compose', 'up', '-d', '--wait'], 300_000),
+                run: async () => {
+                    await runDevCompose(root, 'up');
+                },
             });
         }
     }
-    if (value('admin') === 'app-code') {
+    result.push(...mailSteps({ root, project, choice: value('mail'), now }));
+    const admin = value('admin');
+    if (admin === 'app-code' || admin === 'login') {
         const session = plugin('web.session');
         result.push({
             id: 'session',
             command: `npx dokebi add ${session}`,
-            why: 'server-side sessions for the admin login the app writes (Dokebi has no auth plugin); add also generates the cookie-signing secret DOKEBI_SESSION_SECRETS into .env (git-ignored, read by dev, start and verify; the value is never printed)',
+            why: `server-side sessions for the admin login${admin === 'login' ? ' (@dokebi/auth keeps it there)' : ' the app writes'}; add also writes the generated cookie-signing secret into dokebi.yaml (dokebi-session.secrets; 0600, kept out of Git; the value is never printed)`,
             satisfied: () => has('dokebi-session'),
             run: async () => {
                 await project.add(root, session);
             },
         });
+    }
+    // D-0076 §6: every write form gets CSRF protection, without a question (a security default).
+    if (recipe.web.forms) {
+        const csrf = plugin('csrf');
+        result.push({
+            id: 'csrf',
+            command: `npx dokebi add ${csrf}`,
+            why: `CSRF protection for the write forms (an origin check and a signed token on every POST, PUT, PATCH and DELETE): ${inertia ? 'Inertia sends the token by itself' : 'every EJS form writes <%- data.csrf.field %>'}; add writes its generated secret into dokebi.yaml (dokebi-csrf.secrets, never printed)`,
+            satisfied: () => has('dokebi-csrf'),
+            run: async () => {
+                await project.add(root, csrf);
+            },
+        });
+    }
+    const dialect = variant?.name;
+    if (admin === 'login' && dialect) {
+        const auth = plugin('auth');
+        result.push({
+            id: 'auth',
+            command: `npx dokebi add ${auth} --set homePath=${ADMIN_PATH}`,
+            why: `session login on the app's own user table (@dokebi/auth): it hashes and checks passwords, throttles logins and protects routes with config.auth; a signed-in user on the login page goes to ${ADMIN_PATH}; add writes its generated secret into dokebi.yaml (dokebi-auth.secrets, never printed)`,
+            satisfied: () => has('dokebi-auth'),
+            run: async () => {
+                await project.add(root, auth, false, [{ path: ['homePath'], value: ADMIN_PATH }]);
+            },
+        });
+        const files = async () => {
+            let existing = [];
+            try {
+                existing = await readdir(join(root, MIGRATIONS_DIRECTORY));
+            }
+            catch (error) {
+                if (!isMissing(error))
+                    throw error;
+            }
+            return loginFiles(dialect, inertia ? 'inertia' : 'ejs', migrationPath(existing, new Date(), context.loginNames), await has('dokebi-mail'), context.adminSection, context.loginNames);
+        };
+        result.push({
+            id: 'login-code',
+            command: `write ${EXTENSION_FILE}, src/shared/models/members.ts, src/shared/services/members.ts, ${MIGRATIONS_DIRECTORY}/<time>_${context.loginNames.migration}.ts, ${SEED_FILE}, src/apps/main/routes/auth.ts, src/apps/main/controllers/auth.ts and its two pages, loginRoutes(route) in ${ROUTES_FILE}, dokebi.yaml options.${context.adminSection} (login ${context.adminLogin}, a generated ${ADMIN_PASSWORD_KEY} unless one is there)`,
+            why: `the admin login as user code (no command writes it): the extension class maps the app's own table ${context.loginNames.table} (${dialect}), the migration creates it, the seed adds the first admin (${context.adminLogin}) with passwords.hash of the generated initial password (never printed), and the main app gets GET/POST /login, POST /logout and ${ADMIN_PATH} (config.auth)`,
+            satisfied: async () => {
+                // Not the password key: it may be removed once the admin exists (it is never regenerated).
+                try {
+                    for (const file of await files())
+                        if ((await readFile(join(root, file.path), 'utf8')) !== file.content)
+                            return false;
+                    return /\bloginRoutes\(/.test(await readFile(join(root, ROUTES_FILE), 'utf8'));
+                }
+                catch (error) {
+                    if (isMissing(error))
+                        return false;
+                    throw error;
+                }
+            },
+            run: async () => {
+                const recovery = await has('dokebi-mail');
+                await project.writeRecipeFiles(root, {
+                    files: await files(),
+                    edits: [{ path: ROUTES_FILE, edit: withLoginRoutes }],
+                    config: {
+                        section: context.adminSection,
+                        values: [{ key: 'login', value: ADMIN_LOGIN }, { key: ADMIN_PASSWORD_KEY }],
+                    },
+                });
+                if (recovery) {
+                    const current = (await now())?.options ?? {};
+                    const sets = [
+                        { plugin: 'dokebi-web', set: { path: ['formBody'], value: true } },
+                    ];
+                    if (option(current, ['dokebi-auth', 'passwordReset']) === undefined)
+                        sets.push({
+                            plugin: 'dokebi-auth',
+                            set: {
+                                path: ['passwordReset', 'url'],
+                                value: `http://${domain}:${context.port}/password/reset`,
+                            },
+                        });
+                    await project.configSet(root, sets);
+                }
+            },
+        });
+        if (value('devInfra') === 'docker') {
+            const migrateBin = join(root, 'node_modules/.bin/dokebi-migrate');
+            result.push({
+                id: 'migrate-up',
+                command: 'npx dokebi-migrate up',
+                why: `create ${context.loginNames.table} in the development database (nothing to do when it is there)`,
+                satisfied: async () => false,
+                run: () => shell(root, migrateBin, ['up'], 300_000),
+            });
+            result.push({
+                id: 'seed',
+                command: 'npx dokebi-migrate seed',
+                why: `add the first admin (${context.adminLogin}) unless it exists; the initial password is hashed with passwords.hash`,
+                satisfied: async () => false,
+                run: () => shell(root, migrateBin, ['seed'], 300_000),
+            });
+        }
+    }
+    if (admin === 'app-code')
         result.push({
             id: 'admin-app',
-            command: `npx dokebi app add admin${appFlags} --domain admin.${domain}`,
-            why: `a separate admin app on admin.${domain}; its login and permission checks are app code`,
+            command: `npx dokebi app add admin${appFlags} --domain ${adminDomain}${sealed ? ' --seal' : ''}`,
+            why: `a separate admin app on ${adminDomain}${sealed ? ' (sealed like the main host)' : ''}; its login (with @dokebi/auth) and permission checks are app code`,
             satisfied: async () => (await now())?.apps.includes('admin') ?? false,
             run: async () => {
-                await project.appAdd(root, 'admin', { domains: [`admin.${domain}`], inertia, ssr });
+                await project.appAdd(root, 'admin', {
+                    domains: [adminDomain],
+                    inertia,
+                    ssr,
+                    seal: sealed,
+                });
             },
         });
-    }
     if (inertia)
         result.push({
             id: 'build',
@@ -468,6 +779,62 @@ async function preflight(root, answers, catalog, plan, port, dbPort,
 /** The user left the choices to the agent (--defaults / --answers-from defaults). */
 delegated) {
     const result = [];
+    const current = await view(root);
+    const mail = answers.mail?.value;
+    if (mail === 'mailpit') {
+        await checkMailCompose(root);
+        const docker = await dockerAvailable();
+        if (!docker.ok)
+            result.push({
+                code: 'DOCKER_MISSING',
+                severity: 'error',
+                message: 'Mailpit requires running Docker with compose',
+                fix: 'Start Docker or ask the user to choose another --mail option.',
+            });
+        if (!(await exists(join(root, 'compose.mail.yaml'))) &&
+            (option(current?.options ?? {}, ['dokebi-nats', 'connections', 'recipeMail']) !== undefined ||
+                option(current?.options ?? {}, ['dokebi-job', 'queues', 'recipeMail']) !== undefined))
+            result.push({
+                code: 'MAIL_CONFIGURATION_REQUIRED',
+                severity: 'error',
+                message: 'The recipeMail connection or queue name is already in use',
+                fix: 'Keep the existing infrastructure and configure mail manually.',
+            });
+        // An existing mail setup belongs to the developer, unless this recipe created it.
+        if (current?.installed.has('dokebi-mail') && !(await exists(join(root, 'compose.mail.yaml'))))
+            result.push({
+                code: 'MAIL_CONFIGURATION_REQUIRED',
+                severity: 'error',
+                message: 'Mail is already configured outside this recipe',
+                fix: 'Keep it with --mail smtp or --mail ses; do not replace an existing transport implicitly.',
+            });
+    }
+    if (mail === 'smtp' || mail === 'ses') {
+        if (!current?.installed.has('dokebi-mail') ||
+            option(current.options, ['dokebi-mail', 'transport', 'driver']) !== mail)
+            result.push({
+                code: 'MAIL_CONFIGURATION_REQUIRED',
+                severity: 'error',
+                message: `Configure the selected ${mail} mail service before applying`,
+                fix: 'Run npx dokebi add @dokebi/mail, read its AI.md, and edit transport and from in dokebi.yaml. Never put credentials on a command line.',
+            });
+    }
+    if (mail !== 'mailpit' &&
+        plan.some((step) => step.id === 'login-code') &&
+        current?.installed.has('dokebi-mail')) {
+        const queues = option(current.options, ['dokebi-job', 'queues']);
+        const selected = option(current.options, ['dokebi-mail', 'queue']);
+        const names = queues && typeof queues === 'object' ? Object.keys(queues) : [];
+        if (!current.installed.has('dokebi-job') ||
+            !names.length ||
+            (typeof selected === 'string' && !names.includes(selected)))
+            result.push({
+                code: 'MAIL_QUEUE_REQUIRED',
+                severity: 'error',
+                message: 'Login recovery with @dokebi/mail requires a configured @dokebi/job queue',
+                fix: 'Install and configure @dokebi/job with a NATS connection, provision its queue, and set dokebi-mail.queue to that queue before applying this recipe. See @dokebi/job AI.md.',
+            });
+    }
     const devInfra = plan.find((step) => step.id === 'dev-infra');
     if (devInfra) {
         const docker = await dockerAvailable();
@@ -506,7 +873,7 @@ delegated) {
         }
     }
     const running = (await view(root)) ? (await server.status(root)).running : false;
-    if (!running && (await portInUse(port))) {
+    if (!(answers.apps?.value === 'none') && !running && (await portInUse(port))) {
         const alternative = await freePortAfter(port);
         debug('recipe: web port in use', { port, alternative, delegated });
         result.push({
@@ -522,7 +889,7 @@ delegated) {
         result.push({
             code: 'VITE_BUILD',
             severity: 'info',
-            message: 'vite, vue, @inertiajs/vue3 and @vitejs/plugin-vue are installed and npm run build runs',
+            message: 'vite, vue, @inertiajs/vue3, @vitejs/plugin-vue, vue-tsc and @typescript/typescript6 are installed, npm run build runs and npm run typecheck checks the .vue files',
         });
     if (plan.some((step) => step.id === 'db'))
         result.push({
@@ -546,6 +913,40 @@ function portAsks(checks) {
         next: [...new Set(ports.map((item) => item.next))].join(' '),
     };
 }
+/** The first-admin seed an earlier recipe wrote, if any (D-0115: it may read the older section). */
+async function readSeed(root) {
+    try {
+        return { file: SEED_FILE, text: await readFile(join(root, SEED_FILE), 'utf8') };
+    }
+    catch (error) {
+        if (isMissing(error))
+            return undefined;
+        throw error;
+    }
+}
+/** The login names of the project: its migrations and login files (recipeLoginNames). */
+async function readLoginNames(root) {
+    let migrations = [];
+    try {
+        migrations = await readdir(join(root, MIGRATIONS_DIRECTORY));
+    }
+    catch (error) {
+        if (!isMissing(error))
+            throw error;
+    }
+    const sources = [];
+    for (const file of LOGIN_NAME_SOURCES)
+        try {
+            sources.push(await readFile(join(root, file), 'utf8'));
+        }
+        catch (error) {
+            if (!isMissing(error))
+                throw error;
+        }
+    const names = recipeLoginNames(migrations, sources);
+    debug('recipe: login names', { table: names.table, migration: names.migration });
+    return names;
+}
 async function composePort(root) {
     try {
         const document = parse(await readFile(join(root, COMPOSE_FILE), 'utf8'));
@@ -558,7 +959,18 @@ async function composePort(root) {
         throw new CliError('COMPOSE_INVALID', `${COMPOSE_FILE} cannot be read`, { cause: error });
     }
 }
-function nextSteps(catalog, recipe, answers, plan, port) {
+function nextSteps(catalog, recipe, answers, plan, port, answersFrom, adminSection, loginNames, adminLogin) {
+    if (recipe.name === 'site')
+        return [
+            {
+                command: 'read SITE.md',
+                why: 'app domains, realm extension hooks and worker configuration before serving traffic',
+            },
+            {
+                command: 'npx dokebi verify --json',
+                why: 'verify the configured site and report its remaining app-code work',
+            },
+        ];
     const result = [];
     // The app and module hosts by capability (D-0070), the rest by the step that installed them.
     const ids = new Set([HOST_CAPABILITY.apps, HOST_CAPABILITY.modules].flatMap((capability) => providersOf(catalog, capability).find((item) => item.kind === 'plugin')?.id ?? []));
@@ -572,6 +984,12 @@ function nextSteps(catalog, recipe, answers, plan, port) {
         ids.add('dokebi-migrate');
     if (plan.some((step) => step.id === 'session'))
         ids.add('dokebi-session');
+    if (plan.some((step) => step.id === 'csrf'))
+        ids.add('dokebi-csrf');
+    if (plan.some((step) => step.id === 'auth'))
+        ids.add('dokebi-auth');
+    if (plan.some((step) => step.id === 'seal-plugin'))
+        ids.add('dokebi-seal');
     for (const id of ids)
         result.push({
             command: `npx dokebi plugins doc ${id} --json`,
@@ -582,18 +1000,39 @@ function nextSteps(catalog, recipe, answers, plan, port) {
     if (answers.devInfra?.value === 'url')
         result.push({
             command: 'edit dokebi.yaml: options.dokebi-db.connections.main.options.url',
-            why: 'url mode: write the existing database URL (with its password) here; never pass it with --set',
+            why: 'url mode: write the existing database URL (with its password) here with your file editor, npx dokebi config set or npx dokebi config secret <path> --stdin (or ask the user to)',
         });
-    if (answers.admin?.value === 'app-code')
+    const login = plan.some((step) => step.id === 'login-code');
+    if (login && !plan.some((step) => step.id === 'seed'))
+        result.push({
+            command: 'npx dokebi-migrate up && npx dokebi-migrate seed',
+            why: `after the database URL is in dokebi.yaml: creates ${loginNames.table} and the first admin (${adminLogin}); until then nobody can sign in`,
+        });
+    if (login) {
         result.push({
-            command: 'edit src/apps/admin: login form, password hash (node:crypto scrypt), session check, CSRF token',
-            why: 'Dokebi has no auth or csrf plugin (absent): the admin app writes them',
+            command: `edit: the write routes (GET /posts/new, POST /posts) — { config: { auth: 'required' } } (or { can: '${loginNames.ability}' }); a link to /login and a sign-out form where data.auth.user (Inertia: auth.user) is set`,
+            why: `only signed-in users reach the write routes: a visitor without a login gets 303 to /login (JSON clients 401). Login, sign-out and ${ADMIN_PATH} are in src/apps/main/routes/auth.ts; the role rule is authorize in ${EXTENSION_FILE}`,
         });
-    if (plan.some((step) => step.id === 'form-body'))
         result.push({
-            command: 'edit: every HTML form that changes data (the write form) — a CSRF token check in app code',
-            why: `dokebi-web.formBody is on so forms post; ${noCsrf(catalog)} Tell the user the forms have no CSRF protection until the app adds it.`,
+            command: `edit: a password change page for signed-in users (${ADMIN_PATH}/password) — check the current password with passwords.verify, store passwords.hash(new) and a new logout_key, then await request.auth.logoutOtherDevices()`,
+            why: `the first admin's password is the generated options.${adminSection}.${ADMIN_PASSWORD_KEY} in dokebi.yaml: tell the user to change it before going live and then remove the key. Never compare or hash passwords yourself (use the plugin's passwords helpers; npx dokebi check: plain-password-compare)`,
         });
+    }
+    if (answers.admin?.value === 'app-code')
+        result.push({
+            command: "edit src/apps/admin: the login with @dokebi/auth (npx dokebi add @dokebi/auth, then the three hooks of src/infra/auth/extension.ts on your user table), the login page and routes with config: { auth: 'required' }",
+            why: '@dokebi/auth checks passwords, throttles logins and keeps the session: never compare or hash passwords yourself (passwords.hash for new ones) and show one sentence for every failed login. CSRF protection is already on (@dokebi/csrf)',
+        });
+    if (plan.some((step) => step.id === 'csrf'))
+        result.push(plan.some((step) => step.id === 'view-plugin')
+            ? {
+                command: 'nothing to write for CSRF in Inertia forms: the XSRF-TOKEN cookie becomes the X-XSRF-TOKEN header by itself; a fetch call sends that header',
+                why: `@dokebi/csrf refuses a POST, PUT, PATCH or DELETE without its token (403 CSRF_FAILED). ${CSRF_NEVER_OFF}`,
+            }
+            : {
+                command: 'edit: every <form method="post"> (write form, sign-out) — <%- data.csrf.field %> inside the form; a fetch call sends the XSRF-TOKEN cookie as the X-XSRF-TOKEN header',
+                why: `@dokebi/csrf refuses a POST without its token (403 CSRF_FAILED; an expired form comes back with data.errors._form). npx dokebi check warns: form-without-csrf. ${CSRF_NEVER_OFF}`,
+            });
     // D-0074: how a write form refuses input and shows it, the same for the schema and the app.
     if (recipe.web.forms)
         result.push(plan.some((step) => step.id === 'view-plugin')
@@ -602,17 +1041,25 @@ function nextSteps(catalog, recipe, answers, plan, port) {
                 why: 'a refused field comes back to the form (422 → 303 back with errors, @dokebi/session); only keeps the GET after the redirect to the props that changed (npx dokebi check warns: inertia-form-only)',
             }
             : {
-                command: 'edit: every write form — <form method="post">, each field value="<%= data.old.<field> ?? \'\' %>" and its message from data.errors.<field>; in the handler throw validationError({ <field>: \'<message>\' }) from @dokebi/web',
+                command: 'edit: every write form — <form method="post"> with <%- data.csrf.field %> first, each field value="<%= data.old.<field> ?? \'\' %>" and its message from data.errors.<field>; in the handler throw validationError({ <field>: \'<message>\' }) from @dokebi/web',
                 why: plan.some((step) => step.id === 'session')
                     ? 'a refused route schema and the app check give the same 422 VALIDATION_FAILED (D-0074); with @dokebi/session (in this plan) the refused form comes back to its page (303) with data.errors and data.old; never send a hand-made 422'
                     : 'a refused route schema and the app check give the same 422 VALIDATION_FAILED (D-0074); never send a hand-made 422. Without a session the refused form shows views/default/errors/422.ejs (else errors/error.ejs) with fields, errors and old',
             });
     // D-0074 addendum 1: an EJS write form comes back to its page only with a session.
     if (recipe.web.forms && !plan.some((step) => step.id === 'view-plugin' || step.id === 'session'))
-        result.push({
-            command: 'npx dokebi add @dokebi/session',
-            why: 'so a refused HTML form goes back to its page with the typed values and the field messages (D-0074 addendum 1) instead of the 422 page; ask the user first (it writes DOKEBI_SESSION_SECRETS into .env and keeps sessions in memory until another store is configured)',
-        });
+        result.push(
+        // AI-M05 F3: the defaults are the plan. A plugin outside it is not the agent's choice, with
+        // --defaults or without: the user hears about it (a tellUser notice) and decides.
+        answersFrom === 'defaults'
+            ? {
+                command: 'nothing to add: @dokebi/session is not part of the defaults',
+                why: `do not add it now (the user left the recipe's choices to you, not extra plugins); verify's tellUser tells the user that a refused form shows the 422 page and that ${SESSION_OFFER}`,
+            }
+            : {
+                command: 'npx dokebi add @dokebi/session',
+                why: `so a refused HTML form goes back to its page with the typed values and the field messages (D-0074 addendum 1) instead of the 422 page; only if the user wants it: ask first (it writes a generated signing secret into dokebi.yaml and keeps sessions in memory until another store is configured). verify's tellUser offers it to the user too`,
+            });
     const absent = catalog.absent.map((entry) => entry.capability).join(', ');
     result.push({
         command: 'npx dokebi plugins search <feature> --json',
@@ -620,41 +1067,92 @@ function nextSteps(catalog, recipe, answers, plan, port) {
     });
     result.push({
         command: 'npx dokebi verify --json',
-        why: `doctor, typecheck, build, start on port ${port}, HTTP checks, stop — say done only when ok is true`,
+        why: `doctor, check, typecheck, build, the project's tests, start on port ${port}, HTTP checks, stop — say done only when ok is true`,
     });
     if (answers.devInfra?.value === 'docker')
         result.push({
-            command: 'docker compose down',
-            why: 'stop the development database when you are done (docker compose up -d --wait starts it again)',
+            command: 'npx dokebi dev-infra down --json',
+            why: 'stop the development database when you are done (npx dokebi dev-infra up starts it again)',
         });
     return result;
 }
 /** The lines to tell the user (RecipeOutcome.report). */
-function report(catalog, answers, answersFrom, plan) {
+function report(answers, answersFrom, plan, context) {
     const lines = [];
-    const list = (by) => Object.entries(answers).filter(([, item]) => item.answeredBy === by);
+    // D-0098: view = none of a recipe without screens has its own line (below).
+    const list = (by) => Object.entries(answers).filter(([id, item]) => !(context.noScreens && id === SCREENS) && item.answeredBy === by);
     const defaults = list('default');
     if (defaults.length)
         lines.push(`Chosen by default (tell the user): ${defaults
             .map(([id, item]) => `${id}=${item.value} (${item.defaultReason})`)
             .join('; ')}`);
-    const given = list('flag')
+    const given = list('user')
         .map(([id, item]) => `${id}=${item.value}`)
         .join(', ');
     if (given)
         lines.push(answersFrom === 'user'
             ? `Answers from the user: ${given}`
-            : answersFrom === 'defaults'
-                ? `Chosen by you while the user left the choice to you (tell the user): ${given}`
-                : `Answers not yet confirmed (${given}): apply needs --answers-from user (only answers the user gave) or --defaults (only when the user said to decide)`);
-    lines.push(...notices(catalog, plan));
+            : `Answers not yet confirmed (${given}): apply needs --answers-from user (only choices the user or the request explicitly made; name yours in --ai-chose) or --defaults (only when the user said to decide)`);
+    // D-0095: the agent's own choices, each with the reason it gave.
+    const chosen = list('ai')
+        .map(([id, item]) => `${id}=${item.value}${item.aiReason ? ` (${item.aiReason})` : ''}`)
+        .join('; ');
+    if (chosen)
+        lines.push(`Chosen by you while the user left the choice to you (tell the user): ${chosen}`);
+    const screens = context.noScreens ? answers[SCREENS] : undefined;
+    if (screens)
+        lines.push(`${SCREENS}=${NO_SCREENS} (${context.recipe} recipe, no browser screens): ${screens.answeredBy === 'ai'
+            ? `chosen by you while the user left the choice to you (tell the user in the first lines of your final message)${screens.aiReason ? `: ${screens.aiReason}` : ''}`
+            : answersFrom === 'user'
+                ? "the user's choice (the request asks for an API that other programs call)"
+                : `not yet confirmed: apply with --answers-from user only when the user or the request asked for an API without screens; otherwise it is your choice (--ai-chose ${SCREENS}) or a browser app (another recipe)`}`);
+    // The record keeps the placeholders; the report names the address and the first admin the
+    // plan uses (verify reads them from the project again).
+    // D-0137: a fact notice says what the plan does (verify says what it finds in the project).
+    lines.push(...notices(plan, context).map((line) => {
+        const fact = factOf(line);
+        if (fact)
+            return plannedText(fact, context.planFacts);
+        return line
+            .replaceAll(APP_URL_PLACEHOLDER, `http://${context.domain}:${context.port}`)
+            .replaceAll(FIRST_ADMIN_PLACEHOLDER, context.firstAdmin);
+    }));
     return lines.join('\n');
 }
-/** What the user must know about the applied plan (in the report and `.dokebi/recipe.json`). */
-function notices(catalog, plan) {
-    return plan.some((step) => step.id === 'form-body')
-        ? [`HTML forms are on (dokebi-web.formBody=true). ${noCsrf(catalog)}`]
-        : [];
+/**
+ * What the user must know about the applied plan (in the report and `.dokebi/recipe.json`). A
+ * notice that states a fact of the project is a `{fact:…}` token (D-0137): the report says it as
+ * the plan makes it, verify as it finds it in the project.
+ */
+function notices(plan, context) {
+    const lines = [];
+    const has = (id) => plan.some((step) => step.id === id);
+    const fact = (value) => lines.push(factToken(value));
+    if (context.noScreens)
+        lines.push(noScreensRecord(context.recipe, context.browserRecipes));
+    if (has('site-files'))
+        fact({ id: 'site' });
+    if (has('csrf')) {
+        if (has('site-files')) {
+            fact({ id: 'csrf', mode: 'site-api' });
+            if (has('app-web') || has('app-admin'))
+                fact({ id: 'csrf', mode: has('view-plugin') ? 'site-inertia' : 'site-ejs' });
+        }
+        else
+            fact({ id: 'csrf', mode: has('form-body') ? 'form-body' : 'inertia' });
+    }
+    if (context.sealed.length)
+        fact({ id: 'seal', view: context.sealedView, domains: context.sealed });
+    if (context.unsealedSsr.length)
+        fact({ id: 'ssr-seal', domains: context.unsealedSsr });
+    if (has('login-code'))
+        lines.push(loginNotice(APP_URL_PLACEHOLDER, context.devInfra));
+    if (has('mail-infra'))
+        fact({ id: 'mail' });
+    // AI-M05 F3: an EJS blog without a session; not installed behind the user's back.
+    if (context.forms && !has('view-plugin') && !has('session'))
+        fact({ id: 'session' });
+    return lines;
 }
 /** A dry run's first next step: the same command applied, with the answer source to state. */
 function applyStep(recipe, request, answersFrom) {
@@ -663,6 +1161,11 @@ function applyStep(recipe, request, answersFrom) {
         db: '--db',
         devInfra: '--dev-infra',
         admin: '--admin',
+        mail: '--mail',
+        apps: '--apps',
+        domains: '--domains',
+        realms: '--realms',
+        worker: '--worker',
     };
     const parts = [`npx dokebi recipe ${recipe.name}`];
     if (request.dir !== undefined)
@@ -681,6 +1184,11 @@ function applyStep(recipe, request, answersFrom) {
         if (request.defaults)
             parts.push('--defaults');
     }
+    // D-0095: the answers the agent chose, and its reasons, stay what they were in the dry run.
+    if (request.aiChose?.length)
+        parts.push(`--ai-chose ${request.aiChose.join(',')}`);
+    for (const [id, reason] of Object.entries(request.aiReasons ?? {}))
+        parts.push(`--ai-reason ${JSON.stringify(`${id}=${reason}`)}`);
     parts.push('--json');
     return {
         command: parts.join(' '),
@@ -699,25 +1207,27 @@ export async function runRecipe(request, project) {
             .filter((id) => !recipe.fixed?.[id])
             .map((id) => `${choiceOf(catalog, id).flag} <${id}>`)
             .join(' ');
+        const notice = recipe.screens === false ? noScreensNotice(recipe.name, screenRecipes(catalog)) : undefined;
         return {
             status: 'needs-answers',
             recipe: recipe.name,
             summary: recipe.summary,
             questions: questions(catalog, recipe, answers),
             missing,
-            next: `${ASK_AND_WAIT} Show every question with its options, pros/cons and the default with its reason. After the user answers: npx dokebi recipe ${recipe.name} ${flags} --answers-from user --dry-run --json, then the same without --dry-run. If the user said to decide: --defaults instead of the answers, and tell them the report.`,
+            next: `${ASK_AND_WAIT}${notice ? ` ${notice}` : ''} Show every question with its options, pros/cons and the default with its reason. After the user answers: npx dokebi recipe ${recipe.name} ${flags} --answers-from user --dry-run --json, then the same without --dry-run. ${ANSWER_SOURCES} Tell the user the report.`,
+            ...(notice ? { notice } : {}),
             waitForUser: true,
         };
     }
-    const answersFrom = request.answersFrom ?? (request.defaults ? 'defaults' : undefined);
+    const answersFrom = answerSource(request);
     // D-0065 §11 (AI-M02): an agent printed the questions and installed anyway. Applying needs the
     // agent to say where the answers came from; it is recorded in the result (answersFrom, report).
     if (!request.dryRun && answersFrom === undefined)
-        throw new CliError('ANSWERS_SOURCE_REQUIRED', 'Say where the answers came from: --answers-from user (the user answered these questions) or --defaults (the user said to decide). If the user has not answered yet, ask and end your turn.', {
+        throw new CliError('ANSWERS_SOURCE_REQUIRED', 'Say where the answers came from: --answers-from user (the user or the request made these choices; name the ones you chose in --ai-chose) or --defaults (the user said to decide). If the user has not answered yet, ask and end your turn.', {
             phase: 'arguments',
             details: {
                 answers: Object.fromEntries(Object.entries(answers).map(([id, item]) => [id, item.value])),
-                fix: `${ASK_AND_WAIT} Then run the same command with --answers-from user (or --defaults when the user left the choice to you).`,
+                fix: `${ASK_AND_WAIT} Then run the same command with --answers-from user (or --defaults when the user left the choice to you). ${ANSWER_SOURCES}`,
             },
         });
     const root = resolve(request.dir ?? process.cwd());
@@ -731,14 +1241,72 @@ export async function runRecipe(request, project) {
         init = true;
     }
     const port = request.port ?? recipe.web.port;
-    const plan = steps(catalog, recipe, answers, {
+    // D-0102: the default hosts carry the project's name (package.json, else the folder name).
+    const hostLabel = await readProjectHostLabel(root);
+    const hosts = recipeHosts(recipe, hostLabel, current?.options);
+    const site = recipe.name === 'site' ? siteDefinition(answers, hostLabel) : undefined;
+    if (site)
+        await checkSite(root, answers, hostLabel);
+    // D-0115: a project an older recipe gave options.blog-admin keeps that section.
+    const seed = await readSeed(root);
+    const adminSection = recipeAdminSection(current?.options ?? {}, seed?.text);
+    const firstAdmin = describeFirstAdmin(current?.options ?? {}, seed);
+    // D-0137: the login the plan names is the one it writes: an existing login key is kept.
+    const adminLogin = firstAdmin.section === adminSection && firstAdmin.identity?.key === 'login'
+        ? firstAdmin.identity.value
+        : ADMIN_LOGIN;
+    // D-0115: a project an older recipe gave the blog_authors table keeps it (and its migration).
+    const loginNames = await readLoginNames(root);
+    const plan = (recipe.name === 'site' ? siteSteps : steps)(catalog, recipe, answers, {
         root,
         project,
         port,
+        hostLabel,
         ...(request.dbPort !== undefined ? { dbPort: request.dbPort } : {}),
         init,
         ...(request.dir !== undefined ? { dir: request.dir } : {}),
+        adminSection,
+        adminLogin,
+        loginNames,
     });
+    const has = (id) => plan.some((step) => step.id === id);
+    // The browser hosts of the plan: the site's page apps, or the blog's main (and admin) host.
+    const browserHosts = site
+        ? site.apps.filter((app) => app !== 'api').map((app) => site.domains[app])
+        : recipe.web.forms === true
+            ? [hosts.main, ...(has('admin-app') ? [hosts.admin] : [])]
+            : [];
+    const ssrView = answers.view?.value === 'inertia-vue-ssr';
+    const noScreens = recipe.screens === false;
+    const noticeContext = {
+        recipe: recipe.name,
+        browserRecipes: screenRecipes(catalog),
+        noScreens,
+        port,
+        domain: site?.domains[site.apps[0] ?? ''] ?? hosts.main,
+        devInfra: answers.devInfra?.value,
+        // What the plan writes (an existing login key in that section is kept by the recipe).
+        firstAdmin: firstAdminPhrase({
+            section: adminSection,
+            identity: { key: 'login', value: adminLogin, kind: 'login' },
+            candidates: [],
+        }),
+        planFacts: {
+            recipe: recipe.name,
+            ...(site ? { site } : {}),
+            ...(has('login-code') ? { adminLogin } : {}),
+        },
+        forms: recipe.web.forms === true,
+        sealed: site
+            ? site.apps
+                .filter((app) => sealedSiteApp(site, app))
+                .map((app) => site.domains[app])
+            : has('seal-plugin')
+                ? browserHosts
+                : [],
+        sealedView: has('view-plugin') ? 'inertia' : 'ejs',
+        unsealedSsr: ssrView ? browserHosts : [],
+    };
     const checks = await preflight(root, answers, catalog, plan, port, request.dbPort, answersFrom === 'defaults');
     const asks = portAsks(checks);
     const base = {
@@ -746,12 +1314,13 @@ export async function runRecipe(request, project) {
         root,
         answers,
         answersFrom: answersFrom ?? null,
-        report: report(catalog, answers, answersFrom, plan),
+        report: report(answers, answersFrom, plan, noticeContext),
         plan: { steps: plan.map(({ id, command, why }) => ({ id, command, why })) },
+        ...(noScreens ? { notice: noScreensNotice(recipe.name, noticeContext.browserRecipes) } : {}),
         preflight: checks,
         nextSteps: [
             ...(request.dryRun ? [applyStep(recipe, request, answersFrom)] : []),
-            ...nextSteps(catalog, recipe, answers, plan, port),
+            ...nextSteps(catalog, recipe, answers, plan, port, answersFrom, adminSection, loginNames, adminLogin),
         ],
     };
     const blocking = checks.filter((item) => item.severity === 'error');
@@ -794,8 +1363,11 @@ export async function runRecipe(request, project) {
         appliedAt: new Date().toISOString(),
         answersFrom: answersFrom,
         // In the recipe's question order, the order the user saw them in.
-        answers: Object.fromEntries(recipe.questions.flatMap((id) => (answers[id] ? [[id, answers[id]]] : []))),
-        notices: notices(catalog, plan),
-    });
+        answers: Object.fromEntries([...recipe.questions, ...(noScreens ? [SCREENS] : [])].flatMap((id) => answers[id] ? [[id, answers[id]]] : [])),
+        notices: notices(plan, noticeContext),
+        domain: site?.domains[site.apps[0] ?? ''] ?? hosts.main,
+    }, 
+    // D-0098: the recipe's answers replace the recorded views of the apps it made.
+    site ? [...site.apps] : ['main', ...(has('admin-app') ? ['admin'] : [])]);
     return { status: 'applied', ...base, completedSteps, skippedSteps };
 }