create-warlock 4.2.11 → 4.4.0

package/CHANGELOG.md

@@ -1,39 +1,37 @@
-# Changelog — create-warlock
-
-All notable changes to `create-warlock` are documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
-
-## [Unreleased]
-
-## 4.2.11
-
-### Changed
-
-- Bumped `@mongez/reinforcements` to 3.3.0 (package dependency + project template)
-
-## 4.2.10
-
-### Changed
-
-- The project template now pins the latest `@mongez/*` versions — `@mongez/reinforcements@^3.2.0` and `@mongez/agent-kit@^1.2.0` — so freshly scaffolded apps start on current dependencies. (`@warlock.js/*` versions in the template are still rewritten to the scaffolder's own version at install time.)
-
-## 4.2.7
-
-### Fixed
-
-- The published package now ships its `templates/` folder, so scaffolding a new project works from the installed package — it was missing from the build, which made the wizard fail with "Something went wrong" at the template-copy step. The rest of the family is re-published at 4.2.7 to keep the lockstep version line; no other functional changes.
-
-## 4.2.6
-
-### Fixed
-
-- The published package now ships its `bin` folder again, so the `create-warlock` CLI works from the installed package — it was omitted from the 4.2.5 build. The rest of the family is re-published at 4.2.6 to keep the lockstep version line; no other functional changes.
-
-## 4.2.5
-
-- The feature wizard now offers **Notifications** (`@warlock.js/notifications`) under "Jobs & Messaging" — opt-in; selecting it delegates to `warlock add notifications` (ejects config + scaffolds the in-app model/migration).
-
-## 4.1.15
-
-- Baseline — per-package changelog tracking starts at this version.
+# Changelog — create-warlock
+
+All notable changes to `create-warlock` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
+
+## 4.2.11
+
+### Changed
+
+- Bumped `@mongez/reinforcements` to 3.3.0 (package dependency + project template)
+
+## 4.2.10
+
+### Changed
+
+- The project template now pins the latest `@mongez/*` versions — `@mongez/reinforcements@^3.2.0` and `@mongez/agent-kit@^1.2.0` — so freshly scaffolded apps start on current dependencies. (`@warlock.js/*` versions in the template are still rewritten to the scaffolder's own version at install time.)
+
+## 4.2.7
+
+### Fixed
+
+- The published package now ships its `templates/` folder, so scaffolding a new project works from the installed package — it was missing from the build, which made the wizard fail with "Something went wrong" at the template-copy step. The rest of the family is re-published at 4.2.7 to keep the lockstep version line; no other functional changes.
+
+## 4.2.6
+
+### Fixed
+
+- The published package now ships its `bin` folder again, so the `create-warlock` CLI works from the installed package — it was omitted from the 4.2.5 build. The rest of the family is re-published at 4.2.6 to keep the lockstep version line; no other functional changes.
+
+## 4.2.5
+
+- The feature wizard now offers **Notifications** (`@warlock.js/notifications`) under "Jobs & Messaging" — opt-in; selecting it delegates to `warlock add notifications` (ejects config + scaffolds the in-app model/migration).
+
+## 4.1.15
+
+- Baseline — per-package changelog tracking starts at this version.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) Hassan Zohdy
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) Hassan Zohdy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/esm/features/features-map.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"features-map.mjs","names":[],"sources":["../../../../../../@warlock.js/create-warlock/src/features/features-map.ts"],"sourcesContent":["/**\n * Presentation manifest for the scaffolder's feature prompts.\n *\n * This file is **display metadata only** — keys, labels, hints, grouping, and\n * default selections. It deliberately holds NO dependency names or versions:\n * the single source of truth for what each feature installs is the `add`\n * command's feature map in `@warlock.js/core`\n * (`src/generations/add-command.action.ts`). The scaffolder collects the\n * selections here and delegates the actual install to `warlock add`, so the\n * two never drift on versions again.\n *\n * Every `key` below MUST exist in core's `allowedFeatures`; a CI guard should\n * assert that subset relationship so a typo fails the build instead of shipping.\n */\n\nexport type FeatureGroup =\n  | \"Auth & Access\"\n  | \"Rendering & Mail\"\n  | \"Media\"\n  | \"Storage & Cache\"\n  | \"Jobs & Messaging\"\n  | \"Realtime\"\n  | \"API Docs\"\n  | \"Tooling\";\n\nexport type FeatureOption = {\n  /** Must match a key in core's `add` feature map. */\n  key: string;\n  label: string;\n  hint: string;\n  group: FeatureGroup;\n  defaultSelected?: boolean;\n};\n\n/**\n * Optional features offered in the general multiselect step. The database\n * driver (its own select) and AI providers (their own step) are intentionally\n * NOT here — they have dedicated prompts.\n */\nexport const features: FeatureOption[] = [\n  // Auth & Access\n  {\n    key: \"access\",\n    label: \"Access (authorization)\",\n    hint: \"RBAC permission checks, ABAC policies, and roles — pairs with auth\",\n    group: \"Auth & Access\",\n  },\n\n  // Rendering & Mail\n  {\n    key: \"react\",\n    label: \"React (rendering & mails)\",\n    hint: \"React + ReactDOM for non-interactive rendering and HTML/email generation\",\n    group: \"Rendering & Mail\",\n    defaultSelected: true,\n  },\n  {\n    key: \"react-email\",\n    label: \"React Email\",\n    hint: \"Build email templates with React + Tailwind (pulls react + mail)\",\n    group: \"Rendering & Mail\",\n  },\n  {\n    key: \"mail\",\n    label: \"Mail (Nodemailer)\",\n    hint: \"Send emails via SMTP\",\n    group: \"Rendering & Mail\",\n  },\n  {\n    key: \"ses\",\n    label: \"Amazon SES\",\n    hint: \"Send emails via the AWS SES API\",\n    group: \"Rendering & Mail\",\n  },\n\n  // Media\n  {\n    key: \"image\",\n    label: \"Image processing (Sharp)\",\n    hint: \"Resize, convert, and optimize images\",\n    group: \"Media\",\n  },\n\n  // Storage & Cache\n  {\n    key: \"s3\",\n    label: \"S3 storage\",\n    hint: \"AWS S3 for cloud file storage\",\n    group: \"Storage & Cache\",\n  },\n  {\n    key: \"redis\",\n    label: \"Redis cache\",\n    hint: \"Redis driver for the cache layer\",\n    group: \"Storage & Cache\",\n  },\n\n  // Jobs & Messaging\n  {\n    key: \"scheduler\",\n    label: \"Scheduler\",\n    hint: \"Background tasks and cron jobs\",\n    group: \"Jobs & Messaging\",\n  },\n  {\n    key: \"herald\",\n    label: \"Herald (RabbitMQ)\",\n    hint: \"Message broker for event-driven architecture\",\n    group: \"Jobs & Messaging\",\n  },\n  {\n    key: \"notifications\",\n    label: \"Notifications\",\n    hint: \"Multi-channel notifications — mail + in-app database, preferences, idempotency\",\n    group: \"Jobs & Messaging\",\n  },\n\n  // Realtime\n  {\n    key: \"socket\",\n    label: \"Socket.IO\",\n    hint: \"Realtime websocket server\",\n    group: \"Realtime\",\n  },\n\n  // API Docs (swagger / postman / openapi) — not shipped yet; they will arrive\n  // together in the unified @warlock.js/api-docs package. Re-add the selection\n  // once that package exists. (Removed so the wizard can't offer unbuilt features.)\n\n  // Tooling\n  {\n    key: \"test\",\n    label: \"Testing (Vitest)\",\n    hint: \"Vitest + coverage + per-worker DB/cache test setup\",\n    group: \"Tooling\",\n  },\n];\n\nexport type AiProviderOption = {\n  /** Must match a provider key in core's `add` feature map. */\n  key: string;\n  label: string;\n  hint: string;\n};\n\n/**\n * AI providers offered in the dedicated AI step. Selecting any of these pulls\n * the core `@warlock.js/ai` package automatically via the provider's `requires`\n * in core's feature map — the scaffolder never lists `ai` as a standalone pick.\n */\nexport const aiProviders: AiProviderOption[] = [\n  { key: \"openai\", label: \"OpenAI\", hint: \"GPT models via the OpenAI API\" },\n  { key: \"google\", label: \"Google (Gemini)\", hint: \"Gemini models via Google AI\" },\n  { key: \"anthropic\", label: \"Anthropic (Claude)\", hint: \"Claude models via the Anthropic API\" },\n  { key: \"bedrock\", label: \"AWS Bedrock\", hint: \"Foundation models via Amazon Bedrock\" },\n  { key: \"ollama\", label: \"Ollama\", hint: \"Local models via Ollama\" },\n];\n\n/**\n * Feature options for the multiselect prompt, ordered by group with the group\n * surfaced in the hint (keeps a flat list scannable without group widgets).\n */\nexport function getFeatureOptions() {\n  return features.map(feature => ({\n    value: feature.key,\n    label: feature.label,\n    hint: `${feature.group} — ${feature.hint}`,\n  }));\n}\n\n/**\n * Keys pre-checked in the feature multiselect.\n */\nexport function getDefaultFeatureKeys(): string[] {\n  return features.filter(feature => feature.defaultSelected).map(feature => feature.key);\n}\n\n/**\n * AI provider options for the dedicated AI multiselect step.\n */\nexport function getAiProviderOptions() {\n  return aiProviders.map(provider => ({\n    value: provider.key,\n    label: provider.label,\n    hint: provider.hint,\n  }));\n}\n\n/**\n * Every selectable key the scaffolder knows about (features + AI providers).\n * Used to validate `--features` / `--ai` flags in non-interactive mode.\n */\nexport function getAllFeatureKeys(): string[] {\n  return [...features.map(feature => feature.key), ...aiProviders.map(provider => provider.key)];\n}\n"],"mappings":";;;;;;AAuCA,MAAa,WAA4B;CAEvC;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;EACP,iBAAiB;CACnB;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAOA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;AACF;;;;;;AAcA,MAAa,cAAkC;CAC7C;EAAE,KAAK;EAAU,OAAO;EAAU,MAAM;CAAgC;CACxE;EAAE,KAAK;EAAU,OAAO;EAAmB,MAAM;CAA8B;CAC/E;EAAE,KAAK;EAAa,OAAO;EAAsB,MAAM;CAAsC;CAC7F;EAAE,KAAK;EAAW,OAAO;EAAe,MAAM;CAAuC;CACrF;EAAE,KAAK;EAAU,OAAO;EAAU,MAAM;CAA0B;AACpE;;;;;AAMA,SAAgB,oBAAoB;CAClC,OAAO,SAAS,KAAI,aAAY;EAC9B,OAAO,QAAQ;EACf,OAAO,QAAQ;EACf,MAAM,GAAG,QAAQ,MAAM,KAAK,QAAQ;CACtC,EAAE;AACJ;;;;AAKA,SAAgB,wBAAkC;CAChD,OAAO,SAAS,QAAO,YAAW,QAAQ,eAAe,CAAC,CAAC,KAAI,YAAW,QAAQ,GAAG;AACvF;;;;AAKA,SAAgB,uBAAuB;CACrC,OAAO,YAAY,KAAI,cAAa;EAClC,OAAO,SAAS;EAChB,OAAO,SAAS;EAChB,MAAM,SAAS;CACjB,EAAE;AACJ;;;;;AAMA,SAAgB,oBAA8B;CAC5C,OAAO,CAAC,GAAG,SAAS,KAAI,YAAW,QAAQ,GAAG,GAAG,GAAG,YAAY,KAAI,aAAY,SAAS,GAAG,CAAC;AAC/F"}
+{"version":3,"file":"features-map.mjs","names":[],"sources":["../../../../../../@warlock.js/create-warlock/src/features/features-map.ts"],"sourcesContent":["/**\r\n * Presentation manifest for the scaffolder's feature prompts.\r\n *\r\n * This file is **display metadata only** — keys, labels, hints, grouping, and\r\n * default selections. It deliberately holds NO dependency names or versions:\r\n * the single source of truth for what each feature installs is the `add`\r\n * command's feature map in `@warlock.js/core`\r\n * (`src/generations/add-command.action.ts`). The scaffolder collects the\r\n * selections here and delegates the actual install to `warlock add`, so the\r\n * two never drift on versions again.\r\n *\r\n * Every `key` below MUST exist in core's `allowedFeatures`; a CI guard should\r\n * assert that subset relationship so a typo fails the build instead of shipping.\r\n */\r\n\r\nexport type FeatureGroup =\r\n  | \"Auth & Access\"\r\n  | \"Rendering & Mail\"\r\n  | \"Media\"\r\n  | \"Storage & Cache\"\r\n  | \"Jobs & Messaging\"\r\n  | \"Realtime\"\r\n  | \"API Docs\"\r\n  | \"Tooling\";\r\n\r\nexport type FeatureOption = {\r\n  /** Must match a key in core's `add` feature map. */\r\n  key: string;\r\n  label: string;\r\n  hint: string;\r\n  group: FeatureGroup;\r\n  defaultSelected?: boolean;\r\n};\r\n\r\n/**\r\n * Optional features offered in the general multiselect step. The database\r\n * driver (its own select) and AI providers (their own step) are intentionally\r\n * NOT here — they have dedicated prompts.\r\n */\r\nexport const features: FeatureOption[] = [\r\n  // Auth & Access\r\n  {\r\n    key: \"access\",\r\n    label: \"Access (authorization)\",\r\n    hint: \"RBAC permission checks, ABAC policies, and roles — pairs with auth\",\r\n    group: \"Auth & Access\",\r\n  },\r\n\r\n  // Rendering & Mail\r\n  {\r\n    key: \"react\",\r\n    label: \"React (rendering & mails)\",\r\n    hint: \"React + ReactDOM for non-interactive rendering and HTML/email generation\",\r\n    group: \"Rendering & Mail\",\r\n    defaultSelected: true,\r\n  },\r\n  {\r\n    key: \"react-email\",\r\n    label: \"React Email\",\r\n    hint: \"Build email templates with React + Tailwind (pulls react + mail)\",\r\n    group: \"Rendering & Mail\",\r\n  },\r\n  {\r\n    key: \"mail\",\r\n    label: \"Mail (Nodemailer)\",\r\n    hint: \"Send emails via SMTP\",\r\n    group: \"Rendering & Mail\",\r\n  },\r\n  {\r\n    key: \"ses\",\r\n    label: \"Amazon SES\",\r\n    hint: \"Send emails via the AWS SES API\",\r\n    group: \"Rendering & Mail\",\r\n  },\r\n\r\n  // Media\r\n  {\r\n    key: \"image\",\r\n    label: \"Image processing (Sharp)\",\r\n    hint: \"Resize, convert, and optimize images\",\r\n    group: \"Media\",\r\n  },\r\n\r\n  // Storage & Cache\r\n  {\r\n    key: \"s3\",\r\n    label: \"S3 storage\",\r\n    hint: \"AWS S3 for cloud file storage\",\r\n    group: \"Storage & Cache\",\r\n  },\r\n  {\r\n    key: \"redis\",\r\n    label: \"Redis cache\",\r\n    hint: \"Redis driver for the cache layer\",\r\n    group: \"Storage & Cache\",\r\n  },\r\n\r\n  // Jobs & Messaging\r\n  {\r\n    key: \"scheduler\",\r\n    label: \"Scheduler\",\r\n    hint: \"Background tasks and cron jobs\",\r\n    group: \"Jobs & Messaging\",\r\n  },\r\n  {\r\n    key: \"herald\",\r\n    label: \"Herald (RabbitMQ)\",\r\n    hint: \"Message broker for event-driven architecture\",\r\n    group: \"Jobs & Messaging\",\r\n  },\r\n  {\r\n    key: \"notifications\",\r\n    label: \"Notifications\",\r\n    hint: \"Multi-channel notifications — mail + in-app database, preferences, idempotency\",\r\n    group: \"Jobs & Messaging\",\r\n  },\r\n\r\n  // Realtime\r\n  {\r\n    key: \"socket\",\r\n    label: \"Socket.IO\",\r\n    hint: \"Realtime websocket server\",\r\n    group: \"Realtime\",\r\n  },\r\n\r\n  // API Docs (swagger / postman / openapi) — not shipped yet; they will arrive\r\n  // together in the unified @warlock.js/api-docs package. Re-add the selection\r\n  // once that package exists. (Removed so the wizard can't offer unbuilt features.)\r\n\r\n  // Tooling\r\n  {\r\n    key: \"test\",\r\n    label: \"Testing (Vitest)\",\r\n    hint: \"Vitest + coverage + per-worker DB/cache test setup\",\r\n    group: \"Tooling\",\r\n  },\r\n];\r\n\r\nexport type AiProviderOption = {\r\n  /** Must match a provider key in core's `add` feature map. */\r\n  key: string;\r\n  label: string;\r\n  hint: string;\r\n};\r\n\r\n/**\r\n * AI providers offered in the dedicated AI step. Selecting any of these pulls\r\n * the core `@warlock.js/ai` package automatically via the provider's `requires`\r\n * in core's feature map — the scaffolder never lists `ai` as a standalone pick.\r\n */\r\nexport const aiProviders: AiProviderOption[] = [\r\n  { key: \"openai\", label: \"OpenAI\", hint: \"GPT models via the OpenAI API\" },\r\n  { key: \"google\", label: \"Google (Gemini)\", hint: \"Gemini models via Google AI\" },\r\n  { key: \"anthropic\", label: \"Anthropic (Claude)\", hint: \"Claude models via the Anthropic API\" },\r\n  { key: \"bedrock\", label: \"AWS Bedrock\", hint: \"Foundation models via Amazon Bedrock\" },\r\n  { key: \"ollama\", label: \"Ollama\", hint: \"Local models via Ollama\" },\r\n];\r\n\r\n/**\r\n * Feature options for the multiselect prompt, ordered by group with the group\r\n * surfaced in the hint (keeps a flat list scannable without group widgets).\r\n */\r\nexport function getFeatureOptions() {\r\n  return features.map(feature => ({\r\n    value: feature.key,\r\n    label: feature.label,\r\n    hint: `${feature.group} — ${feature.hint}`,\r\n  }));\r\n}\r\n\r\n/**\r\n * Keys pre-checked in the feature multiselect.\r\n */\r\nexport function getDefaultFeatureKeys(): string[] {\r\n  return features.filter(feature => feature.defaultSelected).map(feature => feature.key);\r\n}\r\n\r\n/**\r\n * AI provider options for the dedicated AI multiselect step.\r\n */\r\nexport function getAiProviderOptions() {\r\n  return aiProviders.map(provider => ({\r\n    value: provider.key,\r\n    label: provider.label,\r\n    hint: provider.hint,\r\n  }));\r\n}\r\n\r\n/**\r\n * Every selectable key the scaffolder knows about (features + AI providers).\r\n * Used to validate `--features` / `--ai` flags in non-interactive mode.\r\n */\r\nexport function getAllFeatureKeys(): string[] {\r\n  return [...features.map(feature => feature.key), ...aiProviders.map(provider => provider.key)];\r\n}\r\n"],"mappings":";;;;;;AAuCA,MAAa,WAA4B;CAEvC;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;EACP,iBAAiB;CACnB;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CACA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAGA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;CAOA;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,OAAO;CACT;AACF;;;;;;AAcA,MAAa,cAAkC;CAC7C;EAAE,KAAK;EAAU,OAAO;EAAU,MAAM;CAAgC;CACxE;EAAE,KAAK;EAAU,OAAO;EAAmB,MAAM;CAA8B;CAC/E;EAAE,KAAK;EAAa,OAAO;EAAsB,MAAM;CAAsC;CAC7F;EAAE,KAAK;EAAW,OAAO;EAAe,MAAM;CAAuC;CACrF;EAAE,KAAK;EAAU,OAAO;EAAU,MAAM;CAA0B;AACpE;;;;;AAMA,SAAgB,oBAAoB;CAClC,OAAO,SAAS,KAAI,aAAY;EAC9B,OAAO,QAAQ;EACf,OAAO,QAAQ;EACf,MAAM,GAAG,QAAQ,MAAM,KAAK,QAAQ;CACtC,EAAE;AACJ;;;;AAKA,SAAgB,wBAAkC;CAChD,OAAO,SAAS,QAAO,YAAW,QAAQ,eAAe,CAAC,CAAC,KAAI,YAAW,QAAQ,GAAG;AACvF;;;;AAKA,SAAgB,uBAAuB;CACrC,OAAO,YAAY,KAAI,cAAa;EAClC,OAAO,SAAS;EAChB,OAAO,SAAS;EAChB,MAAM,SAAS;CACjB,EAAE;AACJ;;;;;AAMA,SAAgB,oBAA8B;CAC5C,OAAO,CAAC,GAAG,SAAS,KAAI,YAAW,QAAQ,GAAG,GAAG,GAAG,YAAY,KAAI,aAAY,SAAS,GAAG,CAAC;AAC/F"}

package/package.json

@@ -9,7 +9,7 @@
   "dependencies": {
     "@clack/prompts": "^0.7.0",
     "@mongez/copper": "^2.1.2",
-    "@warlock.js/fs": "4.2.11",
+    "@warlock.js/fs": "4.4.0",
     "@mongez/reinforcements": "^3.3.0",
     "cross-spawn": "^7.0.3",
     "rimraf": "^6.0.1",
@@ -18,7 +18,7 @@
   "bin": {
     "create-warlock": "bin/create-app.js"
   },
-  "version": "4.2.11",
+  "version": "4.4.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",

package/templates/warlock/AGENTS.md

@@ -0,0 +1,101 @@
+# AGENTS.md
+
+> This file is the single source of truth for instructions given to AI coding
+> agents working in this project. Tool-specific files (`CLAUDE.md`,
+> `.gemini/GEMINI.md`, `.github/copilot-instructions.md`, `CONVENTIONS.md`, …)
+> are **derived** from this file by
+> [agent-kit](https://github.com/hassanzohdy/agent-kit). Edit **this** file, then
+> run `yarn skills:sync` (or `npx agent-kit sync`) to regenerate them — never edit
+> the derived files directly.
+
+## Project overview
+
+This is a [Warlock.js](https://warlock.js.org) application — a TypeScript, Node.js
+framework for building APIs. The framework and its companion libraries ship under
+the `@warlock.js/*` scope (`core`, `cascade`, `cache`, `seal`, `auth`, `logger`,
+`fs`, `scheduler`, …). Application code lives under `src/app/**`, organized one
+module per domain noun.
+
+## Skills come first — read them before anything else
+
+**Before you work out how any package or framework feature works, read the
+matching skill.** Skills are the authoritative, maintained source of truth for how
+to use this project's packages and conventions. They are short and task-focused.
+
+Whenever you need to know how to use a package (`@warlock.js/*`, `@mongez/*`) or
+how to do a task (write a controller, define a model, add a migration, validate
+input, cache, schedule a job, …), follow this order **strictly**:
+
+1. **Read the relevant `SKILL.md` first.** Match the package name or the task to a
+   skill's `name` / `description` / triggers, load that skill, and follow it.
+2. **Only if no skill matches**, fall back to the package's own
+   types / source / README under `node_modules/<pkg>`.
+3. **The public internet is the last resort, not the first.** Do not web-search
+   for how a `@warlock.js/*` or `@mongez/*` API works while a skill for it exists —
+   the skill is more current and project-correct than anything online.
+
+**Do not reverse-engineer how a package works by grepping for similar or existing
+source files and copying their usage before you have checked the skills.** Existing
+code can be outdated, mid-refactor, or simply wrong; the skill is the contract.
+The rule is: **skill first, source second, web last.**
+
+## Where skills live
+
+- **Project conventions** — hand-authored skills in this repo's `skills/`
+  directory (architecture, code standards, API design, etc. — listed below).
+- **Package skills** — how to use each installed `@warlock.js/*` / `@mongez/*`
+  package. These are synced from `node_modules` into your agent's skills
+  directory on every install (Claude Code → `.claude/skills/`, Cursor →
+  `.cursor/skills/`, GitHub Copilot → `.github/skills/`, Codex → `.codex/skills/`,
+  and the equivalent directory for other agents).
+
+If a skill you expect is missing, run `yarn skills:sync` (it also runs
+automatically on `postinstall`).
+
+## Available project skills (`skills/`)
+
+- **api-design** — HTTP conventions: response envelopes, status codes, pagination,
+  typed controllers, resources, and routes.
+- **code-standards** — TypeScript style: `interface` (contracts) vs `type` (data),
+  access modifiers on every class member, no `any`, single-responsibility files
+  with the documented naming suffixes, JSDoc on the public surface.
+- **data-and-persistence** — modeling, storing, and migrating data with
+  `@warlock.js/cascade` (money as integer minor units, migrations, indexes).
+- **module-boundaries** — how modules under `src/app/**` relate; one domain noun
+  per module; what may import what.
+- **security-baseline** — input validation at every boundary via `@warlock.js/seal`
+  schemas, authentication, and secrets handling.
+- **observability-and-resilience** — structured logging, retries, timeouts, and
+  avoiding N+1 work.
+- **testing-strategy** — Vitest test pyramid with co-located `*.spec.ts` files.
+- **git-workflow** — conventional commits, branching, PRs, and CI gates.
+
+## Commands
+
+- `yarn dev` — start the dev server (`warlock dev`)
+- `yarn build` — type-check then build for production (`tsc && warlock build`)
+- `yarn start` — start the production server (`warlock start`)
+- `yarn migrate` / `yarn migrate.fresh` / `yarn migrate.list` — run migrations
+- `yarn seed` — run database seeders
+- `yarn lint` / `yarn format` / `yarn tsc` — lint (eslint --fix), format
+  (prettier), and type-check (`tsc --noEmit`)
+- `yarn skills:sync` — re-sync skills from `node_modules` and regenerate the
+  derived per-agent files from this `AGENTS.md`
+
+## Code style
+
+Follow the **code-standards** skill (`skills/code-standards/SKILL.md`) for all
+TypeScript — read it before writing or reviewing any `.ts` / `.tsx`. In short:
+`interface` for contracts and `type` for data shapes, no `any`, access modifiers
+on every class member, single-responsibility files with the documented naming
+suffixes, and JSDoc on the public surface. The bar is senior-level clean code, not
+"it compiles."
+
+## Boundaries
+
+- Respect **module-boundaries** — do not reach across module internals.
+- Never weaken the **security-baseline** — always validate input at boundaries.
+- Follow **git-workflow** for commits and branches; do not commit or push unless
+  explicitly asked.
+- When you are unsure how a package or feature works, **stop and read its skill**
+  rather than guessing from other files or the web.

package/templates/warlock/yarn.lock

@@ -1430,15 +1430,15 @@ foreground-child@^3.3.1:
     signal-exit "^4.0.1"
 
 form-data@^4.0.4:
-  version "4.0.5"
-  resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.5.tgz#b49e48858045ff4cbf6b03e1805cebcad3679053"
-  integrity sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==
+  version "4.0.6"
+  resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.6.tgz#28e864e1b786dbebb68db1f452f9635278665827"
+  integrity sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==
   dependencies:
     asynckit "^0.4.0"
     combined-stream "^1.0.8"
     es-set-tostringtag "^2.1.0"
-    hasown "^2.0.2"
-    mime-types "^2.1.12"
+    hasown "^2.0.4"
+    mime-types "^2.1.35"
 
 fsevents@~2.3.3:
   version "2.3.3"
@@ -1534,10 +1534,10 @@ has-tostringtag@^1.0.2:
   dependencies:
     has-symbols "^1.0.3"
 
-hasown@^2.0.2:
-  version "2.0.2"
-  resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.2.tgz#003eaf91be7adc372e84ec59dc37252cedb80003"
-  integrity sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==
+hasown@^2.0.2, hasown@^2.0.4:
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.4.tgz#8c62d8cb90beb2aad5d0a5b67581ad9854c3f003"
+  integrity sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==
   dependencies:
     function-bind "^1.1.2"
 
@@ -1732,7 +1732,7 @@ mime-db@1.52.0:
   resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.52.0.tgz#bbabcdc02859f4987301c856e3387ce5ec43bf70"
   integrity sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==
 
-mime-types@^2.1.12:
+mime-types@^2.1.35:
   version "2.1.35"
   resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a"
   integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
@@ -2262,9 +2262,9 @@ undici-types@~7.16.0:
   integrity sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==
 
 undici@^7.0.0:
-  version "7.18.2"
-  resolved "https://registry.yarnpkg.com/undici/-/undici-7.18.2.tgz#6cf724ef799a67d94fd55adf66b1e184176efcdf"
-  integrity sha512-y+8YjDFzWdQlSE9N5nzKMT3g4a5UBX1HKowfdXh0uvAnTaqqwqB92Jt4UXBAeKekDs5IaDKyJFR4X1gYVCgXcw==
+  version "7.28.0"
+  resolved "https://registry.yarnpkg.com/undici/-/undici-7.28.0.tgz#97d64564198b285bc281f0e8e29597e3d11fe7ec"
+  integrity sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==
 
 uri-js@^4.2.2:
   version "4.4.1"
@@ -2322,9 +2322,9 @@ wrappy@1:
   integrity sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==
 
 ws@^8.18.3:
-  version "8.19.0"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.19.0.tgz#ddc2bdfa5b9ad860204f5a72a4863a8895fd8c8b"
-  integrity sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==
+  version "8.21.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.0.tgz#012e413fc07429945121b0c153158c4343086951"
+  integrity sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==
 
 yocto-queue@^0.1.0:
   version "0.1.0"