create-warlock 5.11.0 → 5.13.0

package/esm/prompts/ask-stack.mjs

@@ -0,0 +1,35 @@
+import { cancel, isCancel, select } from "@clack/prompts";
+
+//#region ../create-warlock/src/prompts/ask-stack.ts
+/**
+* The ONE structural question the default (non-`--interactive`) interactive
+* path is allowed to ask: does the generated app need server-rendered web
+* pages, or is it an API only? This is the sole fork that changes the shape
+* of the generated project — every other choice (database, features,
+* package manager, agent-kit targets, …) is reversible within minutes and
+* ships as a flag with a default instead.
+*/
+async function askStack() {
+	const answer = await select({
+		message: "What are we building?",
+		options: [{
+			value: "api",
+			label: "API only",
+			hint: "A REST/GraphQL API, no server-rendered pages"
+		}, {
+			value: "web",
+			label: "Full-stack web",
+			hint: "API + server-rendered React pages (SSR)"
+		}],
+		initialValue: "api"
+	});
+	if (isCancel(answer)) {
+		cancel("Setup cancelled");
+		process.exit(0);
+	}
+	return answer;
+}
+
+//#endregion
+export { askStack };
+//# sourceMappingURL=ask-stack.mjs.map

package/esm/prompts/ask-stack.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ask-stack.mjs","names":[],"sources":["../../../../../../create-warlock/src/prompts/ask-stack.ts"],"sourcesContent":["import { cancel, isCancel, select } from \"@clack/prompts\";\nimport type { Stack } from \"../commands/create-new-app/types\";\n\n/**\n * The ONE structural question the default (non-`--interactive`) interactive\n * path is allowed to ask: does the generated app need server-rendered web\n * pages, or is it an API only? This is the sole fork that changes the shape\n * of the generated project — every other choice (database, features,\n * package manager, agent-kit targets, …) is reversible within minutes and\n * ships as a flag with a default instead.\n */\nexport async function askStack(): Promise<Stack> {\n  const answer = await select({\n    message: \"What are we building?\",\n    options: [\n      {\n        value: \"api\",\n        label: \"API only\",\n        hint: \"A REST/GraphQL API, no server-rendered pages\",\n      },\n      {\n        value: \"web\",\n        label: \"Full-stack web\",\n        hint: \"API + server-rendered React pages (SSR)\",\n      },\n    ],\n    initialValue: \"api\",\n  });\n\n  if (isCancel(answer)) {\n    cancel(\"Setup cancelled\");\n    process.exit(0);\n  }\n\n  return answer as Stack;\n}\n"],"mappings":";;;;;;;;;;;AAWA,eAAsB,WAA2B;CAC/C,MAAM,SAAS,MAAM,OAAO;EAC1B,SAAS;EACT,SAAS,CACP;GACE,OAAO;GACP,OAAO;GACP,MAAM;EACR,GACA;GACE,OAAO;GACP,OAAO;GACP,MAAM;EACR,CACF;EACA,cAAc;CAChB,CAAC;CAED,IAAI,SAAS,MAAM,GAAG;EACpB,OAAO,iBAAiB;EACxB,QAAQ,KAAK,CAAC;CAChB;CAEA,OAAO;AACT"}

package/esm/summary.mjs

@@ -0,0 +1,25 @@
+import { getDatabaseLabel } from "./features/database-drivers.mjs";
+import { colors } from "@mongez/copper";
+
+//#region ../create-warlock/src/summary.ts
+/**
+* Print what the scaffolder decided on the user's behalf, and how to change
+* each decision — required because almost every choice is now a default
+* rather than a prompt, so this is the only place a user sees them.
+*/
+function printDecisionsSummary({ packageManager, options }) {
+	const databaseLabel = getDatabaseLabel(options.databaseDriver);
+	const headline = [
+		`Using ${packageManager}`,
+		`database: ${databaseLabel}`,
+		`agent-kit targets: ${options.agents.join(", ")}`
+	].join(" · ");
+	console.log();
+	console.log(colors.cyan(headline));
+	console.log(colors.dim("  change these — package manager: --pm, database: --db/--no-db, agents: --agents, features: --features, ai: --ai, git: --git/--no-git, jwt: --jwt/--no-jwt — or re-run with --interactive for the full wizard. Package-manager-level choices (husky, lint config, etc.) can also be edited directly in the generated project."));
+	console.log();
+}
+
+//#endregion
+export { printDecisionsSummary };
+//# sourceMappingURL=summary.mjs.map

package/esm/summary.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary.mjs","names":[],"sources":["../../../../../create-warlock/src/summary.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { getDatabaseLabel } from \"./features/database-drivers\";\nimport { AppOptions } from \"./commands/create-new-app/types\";\n\n/** What decisions.spec.ts / the terminal actually needs to render the summary. */\nexport type Decisions = {\n  packageManager: string;\n  options: AppOptions;\n};\n\n/**\n * Print what the scaffolder decided on the user's behalf, and how to change\n * each decision — required because almost every choice is now a default\n * rather than a prompt, so this is the only place a user sees them.\n */\nexport function printDecisionsSummary({ packageManager, options }: Decisions): void {\n  const databaseLabel = getDatabaseLabel(options.databaseDriver);\n\n  const headline = [\n    `Using ${packageManager}`,\n    `database: ${databaseLabel}`,\n    `agent-kit targets: ${options.agents.join(\", \")}`,\n  ].join(\" · \");\n\n  console.log();\n  console.log(colors.cyan(headline));\n  console.log(\n    colors.dim(\n      \"  change these — package manager: --pm, database: --db/--no-db, agents: --agents, \" +\n        \"features: --features, ai: --ai, git: --git/--no-git, jwt: --jwt/--no-jwt — \" +\n        \"or re-run with --interactive for the full wizard. Package-manager-level choices \" +\n        \"(husky, lint config, etc.) can also be edited directly in the generated project.\",\n    ),\n  );\n  console.log();\n}\n"],"mappings":";;;;;;;;;AAeA,SAAgB,sBAAsB,EAAE,gBAAgB,WAA4B;CAClF,MAAM,gBAAgB,iBAAiB,QAAQ,cAAc;CAE7D,MAAM,WAAW;EACf,SAAS;EACT,aAAa;EACb,sBAAsB,QAAQ,OAAO,KAAK,IAAI;CAChD,CAAC,CAAC,KAAK,KAAK;CAEZ,QAAQ,IAAI;CACZ,QAAQ,IAAI,OAAO,KAAK,QAAQ,CAAC;CACjC,QAAQ,IACN,OAAO,IACL,+TAIF,CACF;CACA,QAAQ,IAAI;AACd"}

package/llms-full.txt

@@ -8,52 +8,48 @@
 
 ---
 name: create-a-warlock-project
-description: 'Scaffold a brand-new Warlock.js project with `create-warlock` — the interactive wizard and its non-interactive flag set. A single `--yes` command scaffolds the entire app from flags. Every flag (`--name`, `--db`, `--pm`, `--features`, `--ai`, `--git/--no-git`, `--jwt/--no-jwt`, `--no-db`, `--yes`), every valid database-driver / feature / AI-provider key, opting out of a database (`--db=none` / `--no-db`, which removes `src/config/database.ts`), and the directory tree the template emits. Triggers: `create-warlock`, `npm create warlock`, `npx create-warlock`; "scaffold a warlock app", "start a new warlock project", "create-warlock flags", "non-interactive warlock scaffold", "scaffold without a database", "which features can I pass to create-warlock". Skip: running an already-created project (`@warlock.js/core/run-app/SKILL.md`); adding a feature to an existing project (`warlock add`, `@warlock.js/core/add-connector/SKILL.md`); generating a module inside a project (`@warlock.js/core/create-module/SKILL.md`).'
+description: 'Scaffold a brand-new Warlock.js project with `create-warlock` — fully headless by default (at most one prompt — API-only vs full-stack web) plus `--interactive`/`--customize` for the full long-form wizard. Every flag (`--name`, `--stack`, `--db`, `--pm`, `--features`, `--ai`, `--agents`, `--git/--no-git`, `--jwt/--no-jwt`, `--no-db`, `--yes`, `--interactive`), every valid database-driver / feature / AI-provider / agent-kit-target key, opting out of a database (`--db=none` / `--no-db`, which removes `src/config/database.ts`), the post-scaffold decisions summary, and the directory tree the template emits. Triggers: `create-warlock`, `npm create warlock`, `npx create-warlock`; "scaffold a warlock app", "start a new warlock project", "create-warlock flags", "non-interactive warlock scaffold", "scaffold without a database", "which features can I pass to create-warlock", "agent-kit targets". Skip: running an already-created project (`@warlock.js/core/run-app/SKILL.md`); adding a feature to an existing project (`warlock add`, `@warlock.js/core/add-connector/SKILL.md`); generating a module inside a project (`@warlock.js/core/create-module/SKILL.md`).'
 ---
 
 # create-warlock — scaffold a new project
 
-`create-warlock` builds a fresh Warlock.js project: it copies the `warlock` template, substitutes the project name, wires the chosen database driver into `.env` (or, when you opt out with `--db=none`, removes `src/config/database.ts`), then delegates every optional package install to the project's own `warlock add` so dependency versions are never duplicated by the scaffolder.
+`create-warlock` builds a fresh Warlock.js project: it copies the `warlock` template, substitutes the project name, wires the chosen database driver into `.env` (or, when you opt out with `--db=none`, removes `src/config/database.ts`), derives `agent-kit` targets into the generated project, then delegates every optional package install to the project's own `warlock add` so dependency versions are never duplicated by the scaffolder.
 
 ## The shape
 
 ```bash
-# Interactive wizard (recommended for humans)
-npm create warlock@latest
-# or: npx create-warlock
+# Default: at most ONE prompt (API-only vs full-stack web) — everything else is a flag/default
+npx create-warlock my-app
 
-# Non-interactive (CI, agents, reproducible setups) — one command scaffolds the whole app
+# Fully headless — one command scaffolds the whole app, no prompts at all
 npx create-warlock my-app --yes --db=postgres --features=test,redis --ai=ai-openai
 
+# The one structural fork
+npx create-warlock my-web-app --yes --stack=web
+
 # No database at all
 npx create-warlock my-api --yes --no-db --features=test
+
+# The full long-form wizard, one prompt at a time
+npx create-warlock --interactive
 ```
 
 The first positional argument is the project name; it also becomes the directory created under the current working directory. If that directory already exists, the command aborts — it never overwrites.
 
-## Interactive flow
-
-The wizard asks, in order:
-
-1. **Project name** — required.
-2. **Package manager** — chosen from the managers detected on the system (npm is always offered; yarn / pnpm appear if installed).
-3. **Database driver** — a single select: a driver, or **None** to scaffold without a database (see keys below).
-4. **Features** — a multiselect of optional packages (`react` is pre-checked).
-5. **AI providers** — a multiselect; picking any one pulls `@warlock.js/ai` automatically.
-6. **Initialize Git?** — yes/no.
-7. **Generate JWT secret keys?** — yes/no. If no, the cache is warmed instead.
+## Three modes
 
-## Non-interactive flags
-
-Pass `--yes` (or `-y`) to skip every prompt and build from flags with defaults.
+1. **Default (a TTY, no `--yes`, no `--interactive`)** — asks the project name (if not already given) plus AT MOST ONE structural question: API-only or full-stack web (`--stack`). This is the only choice that changes the generated app's shape; every other choice below is reversible within minutes of scaffolding, so it is a flag with a sensible default, never a prompt.
+2. **`--yes` (or no TTY at all — CI, a script, an agent harness)** — fully headless. Every answer comes from a flag or its default; nothing is ever prompted, and stdin is never read.
+3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
 
 **Without a terminal, `--yes` is not required.** When stdin is not a TTY — CI, a
-script, a container, an agent harness — the scaffolder does not try to prompt.
-If the flags already answer everything it needs, it simply scaffolds. Prompting
-is the fallback, not the precondition.
+script, a container, an agent harness — the scaffolder does not try to prompt,
+regardless of which of the three modes was requested. If the flags already
+answer everything it needs, it simply scaffolds. Prompting is the fallback,
+not the precondition.
 
 Only a question that genuinely cannot be answered stops the run, and in practice
-that is just the project name, the one prompt with no default:
+that is just the project name, the one required answer with no default:
 
 ```
 A project name is required and no terminal is available to ask for one. Pass it as
@@ -61,21 +57,51 @@ the first argument or --name=<name>. Non-interactive flags: --yes, --pm=<npm|yar
 --db=<driver>|--no-db, --features=<list>, --ai=<list>, --git|--no-git, --jwt|--no-jwt.
 ```
 
-| Flag                     | Takes value | Default        | Purpose                                                              |
-| ------------------------ | ----------- | -------------- | ------------------------------------------------------------------- |
-| `<positional>` / `--name`| yes         | — (required)   | Project name + target directory.                                    |
-| `--db`                   | yes         | `mongodb`      | Database driver key (`mongodb`, `postgres`, or `none`).             |
-| `--no-db`                | no          | —              | Opt out of a database — shorthand for `--db=none`.                  |
-| `--pm`                   | yes         | auto-detected  | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
-| `--features`             | yes (CSV)   | none           | Comma-separated optional feature keys.                              |
-| `--ai`                   | yes (CSV)   | none           | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).     |
-| `--git` / `--no-git`     | no          | off            | Initialize a Git repo (`git init` + `main` branch + initial commit).|
-| `--jwt` / `--no-jwt`     | no          | off            | Generate JWT secrets via the project's `jwt` script.               |
-| `--yes` / `-y`           | no          | off            | Non-interactive mode.                                               |
+## After scaffolding: the decisions summary
+
+Because almost every choice defaults silently, `create-warlock` prints what it
+decided right after scaffolding, e.g.:
 
-Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--features` / `--ai` keys fail fast before any install.
+```
+Using npm · database: none · agent-kit targets: claude
+  change these — package manager: --pm, database: --db/--no-db, agents: --agents,
+  features: --features, ai: --ai, git: --git/--no-git, jwt: --jwt/--no-jwt — or
+  re-run with --interactive for the full wizard.
+```
 
-`--help`/`-h` and `--version`/`-v` short-circuit before anything else — no prompt, filesystem write, or network call, and `--help` wins even over a positional project name. `--version` prints the installed `create-warlock` version.
+## Flags
+
+| Flag                       | Takes value | Default        | Purpose                                                              |
+| --------------------------- | ----------- | -------------- | ------------------------------------------------------------------- |
+| `<positional>` / `--name`  | yes         | — (required)   | Project name + target directory.                                    |
+| `--stack`                  | yes         | `api`          | `api` or `web` — the one structural question; `web` seeds the `web` feature by default. |
+| `--db`                     | yes         | `mongodb`      | Database driver key (`mongodb`, `postgres`, or `none`).             |
+| `--no-db`                  | no          | —              | Opt out of a database — shorthand for `--db=none`.                  |
+| `--pm`                     | yes         | inferred (`npm_config_user_agent` / system) | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
+| `--features`                | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default. |
+| `--ai`                      | yes (CSV)   | none           | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).     |
+| `--agents`                  | yes (CSV)   | `claude`       | Comma-separated `agent-kit` targets — see below.                    |
+| `--git` / `--no-git`        | no          | off            | Initialize a Git repo (`git init` + `main` branch + initial commit).|
+| `--jwt` / `--no-jwt`        | no          | off            | Generate JWT secrets via the project's `jwt` script.               |
+| `--yes` / `-y`              | no          | off            | Fully headless mode.                                                 |
+| `--interactive`, `--customize` | no       | off            | Restore the full long-form wizard.                                   |
+
+Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--features` / `--ai` / `--agents` keys fail fast before any install.
+
+`--help`/`-h` and `--version`/`-v` short-circuit before anything else — no prompt, filesystem write, or network call, and `--help` wins even over a positional project name. `--version` prints the installed `create-warlock` version. `--help` lists every flag above together with its default.
+
+## `--agents` and agent-kit targets
+
+`--agents` picks which `agent-kit` targets the generated project derives
+docs/skills for (written into the scaffolded `package.json`'s `agentKit.targets`
+when it differs from the default). The default, `claude`, is a tiny built-in
+fallback that always works — even fully offline. Any other target
+(`cursor`, `codex`, `kiro`, `copilot`, `antigravity`, `opencode`, `amp`,
+`goose`, …) is validated against the list published at
+https://mongez.js.org/agent-kit/llms.txt, fetched once and cached locally. If
+that fetch fails for an explicitly requested non-default target, the run fails
+visibly and names every target it *could* determine — it never silently
+guesses.
 
 ## Valid keys
 
@@ -118,11 +144,12 @@ The template ships a working auth module (login / logout / logout-all / refresh
 
 ## Setup steps the scaffolder runs
 
-1. Copy template → substitute name → wire `DB_DRIVER` / `DB_PORT` into `.env` (or, for `--db=none`, remove `src/config/database.ts`).
+1. Copy template → substitute name → wire `DB_DRIVER` / `DB_PORT` into `.env` (or, for `--db=none`, remove `src/config/database.ts`) → record non-default `--agents` targets into `package.json`'s `agentKit.targets`.
 2. Install base dependencies (so the `warlock` binary exists).
 3. `warlock add <driver> <features...> <ai...> --no-install`, then one batched install. The `<driver>` is omitted for `--db=none`.
 4. `git init` (if `--git`).
 5. `jwt` script (if `--jwt`) — otherwise `warlock --warm-cache`.
+6. Print the decisions summary.
 
 Failures surface the error and halt; there is no rollback. After it finishes, `cd my-app` and run the dev server.
 

package/llms.txt

@@ -6,4 +6,4 @@
 
 ## Skills
 
-- [create-a-warlock-project](create-warlock/create-a-warlock-project/SKILL.md): Scaffold a brand-new Warlock.js project with `create-warlock` — the interactive wizard and its non-interactive flag set. A single `--yes` command scaffolds the entire app from flags. Every flag (`--name`, `--db`, `--pm`, `--features`, `--ai`, `--git/--no-git`, `--jwt/--no-jwt`, `--no-db`, `--yes`), every valid database-driver / feature / AI-provider key, opting out of a database (`--db=none` / `--no-db`, which removes `src/config/database.ts`), and the directory tree the template emits. Triggers: `create-warlock`, `npm create warlock`, `npx create-warlock`; "scaffold a warlock app", "start a new warlock project", "create-warlock flags", "non-interactive warlock scaffold", "scaffold without a database", "which features can I pass to create-warlock". Skip: running an already-created project (`@warlock.js/core/run-app/SKILL.md`); adding a feature to an existing project (`warlock add`, `@warlock.js/core/add-connector/SKILL.md`); generating a module inside a project (`@warlock.js/core/create-module/SKILL.md`).
+- [create-a-warlock-project](create-warlock/create-a-warlock-project/SKILL.md): Scaffold a brand-new Warlock.js project with `create-warlock` — fully headless by default (at most one prompt — API-only vs full-stack web) plus `--interactive`/`--customize` for the full long-form wizard. Every flag (`--name`, `--stack`, `--db`, `--pm`, `--features`, `--ai`, `--agents`, `--git/--no-git`, `--jwt/--no-jwt`, `--no-db`, `--yes`, `--interactive`), every valid database-driver / feature / AI-provider / agent-kit-target key, opting out of a database (`--db=none` / `--no-db`, which removes `src/config/database.ts`), the post-scaffold decisions summary, and the directory tree the template emits. Triggers: `create-warlock`, `npm create warlock`, `npx create-warlock`; "scaffold a warlock app", "start a new warlock project", "create-warlock flags", "non-interactive warlock scaffold", "scaffold without a database", "which features can I pass to create-warlock", "agent-kit targets". Skip: running an already-created project (`@warlock.js/core/run-app/SKILL.md`); adding a feature to an existing project (`warlock add`, `@warlock.js/core/add-connector/SKILL.md`); generating a module inside a project (`@warlock.js/core/create-module/SKILL.md`).

package/package.json

@@ -12,7 +12,7 @@
   "dependencies": {
     "@clack/prompts": "^0.7.0",
     "@mongez/copper": "^2.1.2",
-    "@warlock.js/fs": "5.11.0",
+    "@warlock.js/fs": "5.13.0",
     "@mongez/reinforcements": "^4.0.1",
     "cross-spawn": "^7.0.3",
     "rimraf": "^6.0.1",
@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=22.13"
   },
-  "version": "5.11.0",
+  "version": "5.13.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",

package/skills/create-a-warlock-project/SKILL.md

@@ -1,51 +1,47 @@
 ---
 name: create-a-warlock-project
-description: 'Scaffold a brand-new Warlock.js project with `create-warlock` — the interactive wizard and its non-interactive flag set. A single `--yes` command scaffolds the entire app from flags. Every flag (`--name`, `--db`, `--pm`, `--features`, `--ai`, `--git/--no-git`, `--jwt/--no-jwt`, `--no-db`, `--yes`), every valid database-driver / feature / AI-provider key, opting out of a database (`--db=none` / `--no-db`, which removes `src/config/database.ts`), and the directory tree the template emits. Triggers: `create-warlock`, `npm create warlock`, `npx create-warlock`; "scaffold a warlock app", "start a new warlock project", "create-warlock flags", "non-interactive warlock scaffold", "scaffold without a database", "which features can I pass to create-warlock". Skip: running an already-created project (`@warlock.js/core/run-app/SKILL.md`); adding a feature to an existing project (`warlock add`, `@warlock.js/core/add-connector/SKILL.md`); generating a module inside a project (`@warlock.js/core/create-module/SKILL.md`).'
+description: 'Scaffold a brand-new Warlock.js project with `create-warlock` — fully headless by default (at most one prompt — API-only vs full-stack web) plus `--interactive`/`--customize` for the full long-form wizard. Every flag (`--name`, `--stack`, `--db`, `--pm`, `--features`, `--ai`, `--agents`, `--git/--no-git`, `--jwt/--no-jwt`, `--no-db`, `--yes`, `--interactive`), every valid database-driver / feature / AI-provider / agent-kit-target key, opting out of a database (`--db=none` / `--no-db`, which removes `src/config/database.ts`), the post-scaffold decisions summary, and the directory tree the template emits. Triggers: `create-warlock`, `npm create warlock`, `npx create-warlock`; "scaffold a warlock app", "start a new warlock project", "create-warlock flags", "non-interactive warlock scaffold", "scaffold without a database", "which features can I pass to create-warlock", "agent-kit targets". Skip: running an already-created project (`@warlock.js/core/run-app/SKILL.md`); adding a feature to an existing project (`warlock add`, `@warlock.js/core/add-connector/SKILL.md`); generating a module inside a project (`@warlock.js/core/create-module/SKILL.md`).'
 ---
 
 # create-warlock — scaffold a new project
 
-`create-warlock` builds a fresh Warlock.js project: it copies the `warlock` template, substitutes the project name, wires the chosen database driver into `.env` (or, when you opt out with `--db=none`, removes `src/config/database.ts`), then delegates every optional package install to the project's own `warlock add` so dependency versions are never duplicated by the scaffolder.
+`create-warlock` builds a fresh Warlock.js project: it copies the `warlock` template, substitutes the project name, wires the chosen database driver into `.env` (or, when you opt out with `--db=none`, removes `src/config/database.ts`), derives `agent-kit` targets into the generated project, then delegates every optional package install to the project's own `warlock add` so dependency versions are never duplicated by the scaffolder.
 
 ## The shape
 
 ```bash
-# Interactive wizard (recommended for humans)
-npm create warlock@latest
-# or: npx create-warlock
+# Default: at most ONE prompt (API-only vs full-stack web) — everything else is a flag/default
+npx create-warlock my-app
 
-# Non-interactive (CI, agents, reproducible setups) — one command scaffolds the whole app
+# Fully headless — one command scaffolds the whole app, no prompts at all
 npx create-warlock my-app --yes --db=postgres --features=test,redis --ai=ai-openai
 
+# The one structural fork
+npx create-warlock my-web-app --yes --stack=web
+
 # No database at all
 npx create-warlock my-api --yes --no-db --features=test
+
+# The full long-form wizard, one prompt at a time
+npx create-warlock --interactive
 ```
 
 The first positional argument is the project name; it also becomes the directory created under the current working directory. If that directory already exists, the command aborts — it never overwrites.
 
-## Interactive flow
-
-The wizard asks, in order:
-
-1. **Project name** — required.
-2. **Package manager** — chosen from the managers detected on the system (npm is always offered; yarn / pnpm appear if installed).
-3. **Database driver** — a single select: a driver, or **None** to scaffold without a database (see keys below).
-4. **Features** — a multiselect of optional packages (`react` is pre-checked).
-5. **AI providers** — a multiselect; picking any one pulls `@warlock.js/ai` automatically.
-6. **Initialize Git?** — yes/no.
-7. **Generate JWT secret keys?** — yes/no. If no, the cache is warmed instead.
+## Three modes
 
-## Non-interactive flags
-
-Pass `--yes` (or `-y`) to skip every prompt and build from flags with defaults.
+1. **Default (a TTY, no `--yes`, no `--interactive`)** — asks the project name (if not already given) plus AT MOST ONE structural question: API-only or full-stack web (`--stack`). This is the only choice that changes the generated app's shape; every other choice below is reversible within minutes of scaffolding, so it is a flag with a sensible default, never a prompt.
+2. **`--yes` (or no TTY at all — CI, a script, an agent harness)** — fully headless. Every answer comes from a flag or its default; nothing is ever prompted, and stdin is never read.
+3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
 
 **Without a terminal, `--yes` is not required.** When stdin is not a TTY — CI, a
-script, a container, an agent harness — the scaffolder does not try to prompt.
-If the flags already answer everything it needs, it simply scaffolds. Prompting
-is the fallback, not the precondition.
+script, a container, an agent harness — the scaffolder does not try to prompt,
+regardless of which of the three modes was requested. If the flags already
+answer everything it needs, it simply scaffolds. Prompting is the fallback,
+not the precondition.
 
 Only a question that genuinely cannot be answered stops the run, and in practice
-that is just the project name, the one prompt with no default:
+that is just the project name, the one required answer with no default:
 
 ```
 A project name is required and no terminal is available to ask for one. Pass it as
@@ -53,21 +49,51 @@ the first argument or --name=<name>. Non-interactive flags: --yes, --pm=<npm|yar
 --db=<driver>|--no-db, --features=<list>, --ai=<list>, --git|--no-git, --jwt|--no-jwt.
 ```
 
-| Flag                     | Takes value | Default        | Purpose                                                              |
-| ------------------------ | ----------- | -------------- | ------------------------------------------------------------------- |
-| `<positional>` / `--name`| yes         | — (required)   | Project name + target directory.                                    |
-| `--db`                   | yes         | `mongodb`      | Database driver key (`mongodb`, `postgres`, or `none`).             |
-| `--no-db`                | no          | —              | Opt out of a database — shorthand for `--db=none`.                  |
-| `--pm`                   | yes         | auto-detected  | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
-| `--features`             | yes (CSV)   | none           | Comma-separated optional feature keys.                              |
-| `--ai`                   | yes (CSV)   | none           | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).     |
-| `--git` / `--no-git`     | no          | off            | Initialize a Git repo (`git init` + `main` branch + initial commit).|
-| `--jwt` / `--no-jwt`     | no          | off            | Generate JWT secrets via the project's `jwt` script.               |
-| `--yes` / `-y`           | no          | off            | Non-interactive mode.                                               |
+## After scaffolding: the decisions summary
+
+Because almost every choice defaults silently, `create-warlock` prints what it
+decided right after scaffolding, e.g.:
 
-Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--features` / `--ai` keys fail fast before any install.
+```
+Using npm · database: none · agent-kit targets: claude
+  change these — package manager: --pm, database: --db/--no-db, agents: --agents,
+  features: --features, ai: --ai, git: --git/--no-git, jwt: --jwt/--no-jwt — or
+  re-run with --interactive for the full wizard.
+```
 
-`--help`/`-h` and `--version`/`-v` short-circuit before anything else — no prompt, filesystem write, or network call, and `--help` wins even over a positional project name. `--version` prints the installed `create-warlock` version.
+## Flags
+
+| Flag                       | Takes value | Default        | Purpose                                                              |
+| --------------------------- | ----------- | -------------- | ------------------------------------------------------------------- |
+| `<positional>` / `--name`  | yes         | — (required)   | Project name + target directory.                                    |
+| `--stack`                  | yes         | `api`          | `api` or `web` — the one structural question; `web` seeds the `web` feature by default. |
+| `--db`                     | yes         | `mongodb`      | Database driver key (`mongodb`, `postgres`, or `none`).             |
+| `--no-db`                  | no          | —              | Opt out of a database — shorthand for `--db=none`.                  |
+| `--pm`                     | yes         | inferred (`npm_config_user_agent` / system) | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
+| `--features`                | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default. |
+| `--ai`                      | yes (CSV)   | none           | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).     |
+| `--agents`                  | yes (CSV)   | `claude`       | Comma-separated `agent-kit` targets — see below.                    |
+| `--git` / `--no-git`        | no          | off            | Initialize a Git repo (`git init` + `main` branch + initial commit).|
+| `--jwt` / `--no-jwt`        | no          | off            | Generate JWT secrets via the project's `jwt` script.               |
+| `--yes` / `-y`              | no          | off            | Fully headless mode.                                                 |
+| `--interactive`, `--customize` | no       | off            | Restore the full long-form wizard.                                   |
+
+Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--features` / `--ai` / `--agents` keys fail fast before any install.
+
+`--help`/`-h` and `--version`/`-v` short-circuit before anything else — no prompt, filesystem write, or network call, and `--help` wins even over a positional project name. `--version` prints the installed `create-warlock` version. `--help` lists every flag above together with its default.
+
+## `--agents` and agent-kit targets
+
+`--agents` picks which `agent-kit` targets the generated project derives
+docs/skills for (written into the scaffolded `package.json`'s `agentKit.targets`
+when it differs from the default). The default, `claude`, is a tiny built-in
+fallback that always works — even fully offline. Any other target
+(`cursor`, `codex`, `kiro`, `copilot`, `antigravity`, `opencode`, `amp`,
+`goose`, …) is validated against the list published at
+https://mongez.js.org/agent-kit/llms.txt, fetched once and cached locally. If
+that fetch fails for an explicitly requested non-default target, the run fails
+visibly and names every target it *could* determine — it never silently
+guesses.
 
 ## Valid keys
 
@@ -110,11 +136,12 @@ The template ships a working auth module (login / logout / logout-all / refresh
 
 ## Setup steps the scaffolder runs
 
-1. Copy template → substitute name → wire `DB_DRIVER` / `DB_PORT` into `.env` (or, for `--db=none`, remove `src/config/database.ts`).
+1. Copy template → substitute name → wire `DB_DRIVER` / `DB_PORT` into `.env` (or, for `--db=none`, remove `src/config/database.ts`) → record non-default `--agents` targets into `package.json`'s `agentKit.targets`.
 2. Install base dependencies (so the `warlock` binary exists).
 3. `warlock add <driver> <features...> <ai...> --no-install`, then one batched install. The `<driver>` is omitted for `--db=none`.
 4. `git init` (if `--git`).
 5. `jwt` script (if `--jwt`) — otherwise `warlock --warm-cache`.
+6. Print the decisions summary.
 
 Failures surface the error and halt; there is no rollback. After it finishes, `cd my-app` and run the dev server.
 

package/templates/warlock/AGENTS.md

@@ -110,7 +110,7 @@ Three things that trip everyone up on a fresh app:
   field is required" message), but it is redundant on a plain field, so the
   generated code and these docs don't use it.
 - **Declare server-set foreign keys on the MODEL schema.** A controller that
-  sets a column the client doesn't send (e.g. `authorId: request.user.id`) must
+  sets a column the client doesn't send (e.g. `authorId: request.locals.user.id`) must
   still have that column declared on the model's seal schema
   (`authorId: v.number()`), or `Model.create()` rejects it as an unknown key.
   The client-facing request schema and the model schema are separate, so this

package/templates/warlock/skills/api-design/SKILL.md

@@ -354,11 +354,11 @@ createLeadController.validation = {
 
 | Route kind                       | Controller type                       | What it adds                          |
 | -------------------------------- | ------------------------------------- | ------------------------------------- |
-| Guarded (auth required) + body   | `GuardedRequestHandler<Schema>`       | typed `request.validated()` + `request.user` |
+| Guarded (auth required) + body   | `GuardedRequestHandler<Schema>`       | typed `request.validated()` + `request.locals.user` |
 | Public + body                    | `RequestHandler<Request<Schema>>`     | typed `request.validated()`           |
 | Read / list (no body)            | `RequestHandler`                      | nothing extra                         |
 
-`GuardedRequestHandler<Schema>` (defined in `app/auth/requests/guarded.request.ts`) is `RequestHandler<GuardedRequest<Schema>>` — it both types the validated payload and guarantees `request.user` is present.
+`GuardedRequestHandler<Schema>` (defined in `app/auth/requests/guarded.request.ts`) is `RequestHandler<GuardedRequest<Schema>>` — it both types the validated payload and guarantees `request.locals.user` is present.
 
 ### 6.3 Accessing inputs
 

package/templates/warlock/skills/security-baseline/SKILL.md

@@ -95,7 +95,7 @@ AuthN proves who you are. AuthZ decides what you can do. Conflating them is how
 const order = await ordersRepository.find({ id, userId: request.input("userId") });
 
 // ✅ identity from the authenticated session
-const user = request.user;
+const user = request.locals.user;
 const order = await ordersRepository.find({ id, userId: user.id });
 ```
 

package/templates/warlock/src/app/auth/controllers/logout-all.controller.ts

@@ -9,7 +9,7 @@ import { logoutAllService } from "../services/auth.service";
  * Guarded route — see the note on `logoutController`.
  */
 export const logoutAllController: GuardedRequestHandler = async ({ request, response }) => {
-  await logoutAllService(request.user);
+  await logoutAllService(request.locals.user);
 
   return response.success({
     message: t("auth.loggedOutAll"),

package/templates/warlock/src/app/auth/controllers/logout.controller.ts

@@ -7,11 +7,11 @@ import { logoutService } from "../services/auth.service";
  * POST /auth/logout
  *
  * Typed as `GuardedRequestHandler` because the route sits inside `guarded()`
- * (see `../routes.ts`). A plain `RequestHandler` types `request.user` as
- * `RequestUser | undefined`, which is not assignable to `logoutService`.
+ * (see `../routes.ts`). A plain `RequestHandler` types `request.locals.user`
+ * as `RequestUser | undefined`, which is not assignable to `logoutService`.
  */
 export const logoutController: GuardedRequestHandler = async ({ request, response }) => {
-  await logoutService(request.user);
+  await logoutService(request.locals.user);
 
   return response.success({
     message: t("auth.loggedOut"),

package/templates/warlock/src/app/auth/controllers/me.controller.ts

@@ -11,7 +11,7 @@ import { type GuardedRequestHandler } from "app/auth/requests/guarded.request";
  */
 export const meController: GuardedRequestHandler = async ({ request, response }) => {
   return response.success({
-    user: request.user,
+    user: request.locals.user,
   });
 };
 

package/templates/warlock/src/app/auth/requests/guarded.request.ts

@@ -1,8 +1,8 @@
-import type { Request, RequestHandler } from "@warlock.js/core";
+import type { Request, RequestHandler, RequestLocals } from "@warlock.js/core";
 import type { User } from "app/users/models/user";
 
 export type GuardedRequest<RequestPayload = unknown> = Request<RequestPayload> & {
-  user: User;
+  locals: RequestLocals & { user: User };
 };
 
 export type GuardedRequestHandler<RequestPayload = unknown> = RequestHandler<

package/templates/warlock/src/app/posts/controllers/create-new-post.controller.ts

@@ -8,7 +8,7 @@ export const createNewPostController: GuardedRequestHandler<CreatePostSchema> =
 }) => {
   const post = await Post.create({
     ...request.validated(),
-    authorId: request.user.id,
+    authorId: request.locals.user.id,
   });
 
   return response.successCreate({

package/templates/warlock/src/app/users/models/user/migrations/11-12-2025_23-58-03-user.migration.ts

@@ -8,5 +8,6 @@ export default Migration.create(User, {
   image: string(500).nullable(),
   imageMetadata: json().nullable(),
   lastLogin: timestamp().nullable(),
+  emailVerifiedAt: timestamp().nullable(),
   deletedAt: timestamp().nullable(),
 });

package/templates/warlock/src/app/users/models/user/user.model.ts

@@ -7,13 +7,21 @@ import { UserResource } from "app/users/resources/user.resource";
 export const userSchema = v.object({
   name: v.string().required(),
   email: v.email().requiredIfEmpty("id"),
-  image: v.string(),
+  // Required at the controller layer (`create-user.schema.ts`) on
+  // registration, but not here: a freshly-registered user's record is
+  // written before that upload completes, and a seeded/social-login user may
+  // never get an avatar at all.
+  image: v.string().optional(),
   password: v.string().min(6).requiredIfEmpty("id").addTransformer(useHashedPassword()),
   // Written by the social-login handler (`app/users/services/login-social.ts`).
   // A field only reachable through `save({ merge })` still has to be declared
   // here — `merge` is typed against this schema, so an undeclared key is a
-  // compile error, not a silent write.
-  lastLogin: v.date(),
+  // compile error, not a silent write. Optional: a user who has never logged
+  // in (freshly registered or freshly seeded) has no lastLogin yet.
+  lastLogin: v.date().optional(),
+  // Stamped by `@warlock.js/auth`'s `verifyEmail()` (the `auth.verification.field`
+  // default). Absent/undefined means unverified — see the `verified` scope below.
+  emailVerifiedAt: v.date().optional(),
 });
 
 export type UserSchema = Infer<typeof userSchema>;
@@ -54,7 +62,7 @@ export class User extends Auth<UserSchema> {
     });
 
     this.addScope("verified", (query) => {
-      query.where("emailVerified", true);
+      query.whereNotNull("emailVerifiedAt");
     });
   }
 }

package/templates/warlock/src/app/users/services/login-social.ts

@@ -5,11 +5,12 @@ import type { GuardedRequestHandler } from "app/auth/requests/guarded.request";
  *
  * Despite living under `services/`, this is a route handler: it consumes the
  * request and returns a response. It is typed as a `GuardedRequestHandler` so
- * it can be wired straight into a route, and so `request.user` resolves to the
- * app's `User` model rather than core's optional `RequestUser`.
+ * it can be wired straight into a route, and so `request.locals.user`
+ * resolves to the app's `User` model rather than core's optional
+ * `RequestUser`.
  */
 const loginSocial: GuardedRequestHandler = async ({ request, response }) => {
-  const user = request.user;
+  const user = request.locals.user;
 
   const auth = await user.generateAccessToken();
 

package/templates/warlock/src/config/database.postgres.ts

@@ -14,6 +14,10 @@ const databaseConfigurations: ConnectionOptions<never, PostgresPoolConfig> = {
   defaultDeleteStrategy: "permanent",
 
   clientOptions: {
+    // `PostgresPoolConfig` extends the connection config, so `database` is
+    // required here too even though it duplicates the top-level value above.
+    database: env("DB_NAME"),
+
     // Native `pg` pool options — tune these for your workload.
     // max: 10,
     // min: 0,