create-warlock 5.16.0 → 5.17.0

package/CHANGELOG.md

@@ -4,6 +4,72 @@ All notable changes to `create-warlock` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.17.0 - 2026-09-21
+
+### Changed
+
+- Web scaffold pages use the 5.17 `config` export with `PageConfig`, keeping loaders and components as separate exports. New apps depend on `@mongez/localization:^3.5.0` for scoped route translations.
+- New Web scaffolds set `strictMode: true` in `src/web/root.tsx`'s `RootConfig`, so the hydrated page, layout, and navigation tree receives React's development Strict Mode checks. Existing applications keep the framework default of `false` until they opt in.
+- The CLI's source formatting check is part of `test`. Interactive project naming and preset selection preserve the entered name when Customize advances to package-manager selection.
+
+### Security
+
+- **BREAKING:** the scaffolded `GET /uploads/*` route resized images to any `?w=&h=` a client sent. This was a denial-of-service vector, because every new size forced a full decode and resize and nothing was cached. The route also resolved the path without a containment check. The generated `src/app/uploads/controllers/fetch-uploaded-file.controller.ts` is gone. `src/app/uploads/routes.ts` now mounts core's `uploadedFileController`, which keeps the request inside the storage root and only renders the named variants the app declares. `?w=` and `?h=` now return 400. **Existing projects should apply the same change:**
+
+  ```diff
+  // src/app/uploads/routes.ts
+  - import { router } from "@warlock.js/core";
+  - import { fetchUploadedFileController } from "./controllers/fetch-uploaded-file.controller";
+  -
+  - router.get("/uploads/*", fetchUploadedFileController);
+  + import { router, uploadedFileController } from "@warlock.js/core";
+  +
+  + router.get("/uploads/*", uploadedFileController);
+  ```
+
+  Then delete `src/app/uploads/controllers/fetch-uploaded-file.controller.ts`. To keep resized images, declare named variants in `src/config/uploads.ts` (the template has no such file, so create one) and replace `?w=320` in your URLs with `?variant=thumb`:
+
+  ```ts
+  // src/config/uploads.ts
+  import type { UploadsConfigurations } from "@warlock.js/core";
+
+  const uploadsConfigurations: UploadsConfigurations = {
+    images: {
+      variants: {
+        thumb: { width: 320 },
+        card: { width: 640 },
+        hero: { width: 1280 },
+      },
+      formats: ["webp"], // allows &format=webp
+    },
+  };
+
+  export default uploadsConfigurations;
+  ```
+
+### Fixed
+
+- The scaffolded `src/config/cache.ts` namespaced every cache key by `request.originDomain || request.header("domain") || request.input("domain")`. A browser GET carries no `Origin` while a CSRF-protected POST does, so the same visitor resolved two different prefixes and a write could never invalidate what a read had cached — repository caches and page-cache tags went silently stale (verified live on a real app). None of those three inputs are server-validated either, so any visitor could pick `?domain=anything` or a `domain` header to land in an arbitrary namespace and grow the in-memory store without bound. `globalPrefix` is now a fixed, app-owned string derived from `APP_NAME`, with no request data read at all. **Existing projects should apply the same change** to `src/config/cache.ts`:
+
+  ```diff
+  - const globalPrefix = () => {
+  -   const { request } = useRequestStore();
+  -   let cachePrefix = "store";
+  -   if (!request) return cachePrefix;
+  -   const domain = request.originDomain || request.header("domain") || request.input("domain");
+  -   if (!domain) return cachePrefix;
+  -   return `${cachePrefix}.${domain}`;
+  - };
+  + const globalPrefix = () => env("APP_NAME", "store");
+  ```
+
+  Genuine multi-tenancy still needs per-tenant isolation — do that with a tenant id your own middleware has already validated against your tenants table (e.g. `request.locals.tenant`), never the raw `Origin`, `Host`, a header, or query input. See the updated template's `src/config/cache.ts` for a commented example. Guarded by a new check in `specs/template-integrity.spec.ts`.
+
+### Added
+
+- `pnpm typecheck:template` runs `tsc --noEmit` on `templates/warlock/src/` against this checkout's own `@warlock.js/*` source (via `tsconfig.template-check.json`), catching a template import that no longer exists in the framework — the class of bug that let a removed-but-still-used import pass all 291 tests. Enforced on every run by `specs/template-typecheck.spec.ts`, complementing the slower registry-install `typecheck:scaffold` gate.
+- The scaffolded `src/config/http.ts` now sets `trustProxy: false` explicitly, with a comment on when/how to enable it behind a proxy or load balancer, and ships a commented-out, nonce-based `csp` starter block so both are discoverable instead of silently absent.
+
 ## 5.15.0 - 2026-09-18
 
 ### Added

package/esm/commands/create-new-app/index.mjs

@@ -1,16 +1,21 @@
-import { getDatabaseDriver, getDatabaseDriverOptions, isNoDatabase } from "../../features/database-drivers.mjs";
-import { getAiPackageOptions, getAiProviderOptions, getAllFeatureKeys, getDefaultFeatureKeys, getFeatureOptions } from "../../features/features-map.mjs";
 import { resolveAgentTargets } from "../../features/agent-kit-targets.mjs";
-import { ALLOWED_PACKAGE_MANAGERS, detectPackageManagers, getPackageManager, getPreferredPackageManager, getSystemPackageManagers, isValidPackageManager, setPackageManager } from "../../helpers/package-manager.mjs";
+import { getDatabaseDriver, getDatabaseDriverOptions, isNoDatabase } from "../../features/database-drivers.mjs";
+import { getAiPackageOptions, getAiProviderOptions, getAllFeatureKeys, getFeatureOptions } from "../../features/features-map.mjs";
+import { hasInteractiveStdin } from "../../helpers/tty.mjs";
+import { assertFlagCombinations } from "../../flags/assert-flag-combinations.mjs";
+import { detectPackageManagers, getPackageManager, getPreferredPackageManager, getSystemPackageManagers, setPackageManager } from "../../helpers/package-manager.mjs";
+import { assertPackageManagerAvailable } from "../../flags/assert-package-manager.mjs";
+import { seedFromFlags } from "../../flags/seed-from-flags.mjs";
 import { packageRoot } from "../../helpers/paths.mjs";
 import { App } from "../../helpers/app.mjs";
-import { hasInteractiveStdin } from "../../helpers/tty.mjs";
+import { askAgentTargets } from "../../prompts/ask-agent-targets.mjs";
+import { askProjectName } from "../../prompts/ask-project-name.mjs";
 import { askStack } from "../../prompts/ask-stack.mjs";
 import { showIntroBanner } from "../../ui/banner.mjs";
 import { createWarlockApp } from "../create-warlock-app/index.mjs";
 import getAppPath from "./get-app-path.mjs";
 import { getJsonFile } from "@warlock.js/fs";
-import { cancel, confirm, isCancel, multiselect, select, text } from "@clack/prompts";
+import { cancel, confirm, isCancel, multiselect, select } from "@clack/prompts";
 import { colors } from "@mongez/copper";
 
 //#region ../create-warlock/src/commands/create-new-app/index.ts
@@ -24,6 +29,7 @@ async function createNewApp(cli = {}) {
 		cancel("Node.js version must be at least 20.0.0");
 		process.exit(0);
 	}
+	assertFlagCombinations(cli);
 	if (cli.yes || !hasInteractiveStdin()) {
 		await createNonInteractive(cli);
 		return;
@@ -41,24 +47,25 @@ async function createNewApp(cli = {}) {
 * rule that a reversible choice never prompts by default.
 */
 async function createFullWizard(cli, pmDetectionPromise) {
-	const appName = await text({
-		message: "What shall we call your project?",
-		placeholder: "my-warlock-app"
-	});
-	if (isCancel(appName) || !appName.trim()) {
-		cancel("A project name is required to continue");
-		process.exit(0);
-	}
+	const appName = cli.name ?? await askProjectName();
 	const appPath = getAppPath(appName);
 	if (!appPath) return;
+	try {
+		resolveNonInteractiveOptions(cli);
+	} catch (error) {
+		cancel(error.message);
+		process.exit(1);
+	}
+	const seeds = seedFromFlags(cli);
 	await pmDetectionPromise;
+	assertPackageManagerAvailable(cli.pm);
 	const packageManager = await select({
 		message: "Which package manager do you want to use?",
 		options: getSystemPackageManagers().map((pm) => ({
 			value: pm,
 			label: pm
 		})),
-		initialValue: getPreferredPackageManager()
+		initialValue: seeds.packageManager
 	});
 	if (isCancel(packageManager)) {
 		cancel("Package manager selection cancelled");
@@ -67,7 +74,8 @@ async function createFullWizard(cli, pmDetectionPromise) {
 	setPackageManager(packageManager);
 	const databaseDriver = await select({
 		message: "Choose your database driver",
-		options: getDatabaseDriverOptions()
+		options: getDatabaseDriverOptions(),
+		initialValue: seeds.databaseDriver
 	});
 	if (isCancel(databaseDriver)) {
 		cancel("Database selection cancelled");
@@ -77,7 +85,7 @@ async function createFullWizard(cli, pmDetectionPromise) {
 	const selectedFeatures = await multiselect({
 		message: "Select optional features to include",
 		options: getFeatureOptions(),
-		initialValues: getDefaultFeatureKeys(),
+		initialValues: seeds.features,
 		required: false
 	});
 	if (isCancel(selectedFeatures)) {
@@ -87,29 +95,30 @@ async function createFullWizard(cli, pmDetectionPromise) {
 	const selectedAiProviders = await multiselect({
 		message: "Add AI packages? Providers + capabilities — the core AI package is included automatically",
 		options: [...getAiProviderOptions(), ...getAiPackageOptions()],
+		initialValues: seeds.aiProviders,
 		required: false
 	});
 	if (isCancel(selectedAiProviders)) {
 		cancel("AI provider selection cancelled");
 		process.exit(0);
 	}
-	const useGit = await confirm({ message: "Initialize a Git repository?" }) === true;
+	const useGit = await confirm({
+		message: "Initialize a Git repository?",
+		initialValue: seeds.useGit
+	}) === true;
 	if (isCancel(useGit)) {
 		cancel("Setup cancelled");
 		process.exit(0);
 	}
-	const useJWT = await confirm({ message: "Generate JWT secret keys?" }) === true;
+	const useJWT = await confirm({
+		message: "Generate JWT secret keys?",
+		initialValue: seeds.useJWT
+	}) === true;
 	if (isCancel(useJWT)) {
 		cancel("Setup cancelled");
 		process.exit(0);
 	}
-	let agents;
-	try {
-		agents = await resolveAgentTargets(cli.agents);
-	} catch (error) {
-		cancel(error.message);
-		process.exit(1);
-	}
+	const agents = await askAgentTargets(cli.agents);
 	await scaffold({
 		appName,
 		appType: "warlock",
@@ -135,27 +144,21 @@ async function createFullWizard(cli, pmDetectionPromise) {
 * `createNonInteractive` — flags, with defaults, never a prompt.
 */
 async function createDefaultInteractive(cli, pmDetectionPromise) {
-	let appName = cli.name;
-	if (!appName) {
-		const answer = await text({
-			message: "What shall we call your project?",
-			placeholder: "my-warlock-app"
-		});
-		if (isCancel(answer) || !answer.trim()) {
-			cancel("A project name is required to continue");
-			process.exit(0);
-		}
-		appName = answer;
-	}
+	const appName = cli.name ?? await askProjectName();
 	const appPath = getAppPath(appName);
 	if (!appPath) return;
-	const stack = cli.stack ?? await askStack();
+	const choice = cli.stack ?? await askStack();
+	if (choice === "customize") {
+		await createFullWizard({
+			...cli,
+			name: appName
+		}, pmDetectionPromise);
+		return;
+	}
+	const stack = choice;
 	await pmDetectionPromise;
 	const packageManager = cli.pm ?? getPreferredPackageManager();
-	if (!isValidPackageManager(packageManager)) {
-		cancel(`Unknown package manager "${packageManager}" — expected one of: ${ALLOWED_PACKAGE_MANAGERS.join(", ")}`);
-		process.exit(1);
-	}
+	assertPackageManagerAvailable(cli.pm);
 	setPackageManager(packageManager);
 	let options;
 	try {
@@ -197,7 +200,7 @@ async function scaffold(appDetails) {
 * default — the one structural choice — but an explicit `--features` always
 * wins, so a user who spells out the feature list is never second-guessed.
 *
-* Throws on an unknown driver or feature key so the caller can fail fast
+* Throws on an unknown driver, feature, or AI key so the caller can fail fast
 * before any file is written.
 */
 function resolveNonInteractiveOptions(cli) {
@@ -209,8 +212,13 @@ function resolveNonInteractiveOptions(cli) {
 	const features = cli.features ?? (stack === "web" ? ["web"] : []);
 	const aiProviders = cli.ai ?? [];
 	const allowedKeys = getAllFeatureKeys();
-	const invalidKeys = [...features, ...aiProviders].filter((key) => !allowedKeys.includes(key));
-	if (invalidKeys.length > 0) throw new Error(`Unknown feature(s): ${invalidKeys.join(",")}`);
+	const invalidFeatureKeys = features.filter((key) => !allowedKeys.includes(key));
+	const errors = [];
+	if (invalidFeatureKeys.length > 0) errors.push(`Unknown feature(s): ${invalidFeatureKeys.join(",")}`);
+	const aiFeatureKeys = [...getAiProviderOptions(), ...getAiPackageOptions()].map((option) => option.value);
+	const invalidAiKeys = aiProviders.filter((key) => !aiFeatureKeys.includes(key));
+	if (invalidAiKeys.length > 0) errors.push(`Unknown AI feature(s): ${invalidAiKeys.join(",")}. Valid AI choices: ${aiFeatureKeys.join(", ")}`);
+	if (errors.length > 0) throw new Error(errors.join("\n"));
 	return {
 		databaseDriver,
 		databasePort: driver?.defaultPort ?? 27017,
@@ -243,17 +251,14 @@ async function resolveAppOptions(cli) {
 async function createNonInteractive(cli) {
 	const appName = (cli.name ?? "").trim();
 	if (!appName) {
-		cancel("A project name is required and no terminal is available to ask for one. Pass it as the first argument or --name=<name>. Non-interactive flags: --yes, --pm=<npm|yarn|pnpm>, --db=<driver>|--no-db, --features=<list>, --ai=<list>, --git|--no-git, --jwt|--no-jwt.");
+		cancel("A project name is required and no terminal is available to ask for one. Pass it as the first argument or --name=<name>. Non-interactive flags: --yes, --pm=<npm|yarn|pnpm|bun>, --db=<driver>|--no-db, --features=<list>, --ai=<list>, --git|--no-git, --jwt|--no-jwt.");
 		process.exit(1);
 	}
 	const appPath = getAppPath(appName);
 	if (!appPath) return;
 	await detectPackageManagers();
 	const packageManager = cli.pm ?? getPreferredPackageManager();
-	if (!isValidPackageManager(packageManager)) {
-		cancel(`Unknown package manager "${packageManager}" — expected one of: ${ALLOWED_PACKAGE_MANAGERS.join(", ")}`);
-		process.exit(1);
-	}
+	assertPackageManagerAvailable(cli.pm);
 	setPackageManager(packageManager);
 	let options;
 	try {

package/esm/commands/create-new-app/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../create-warlock/src/commands/create-new-app/index.ts"],"sourcesContent":["import {\r\n  cancel,\r\n  confirm,\r\n  isCancel,\r\n  multiselect,\r\n  select,\r\n  text,\r\n} from \"@clack/prompts\";\r\nimport { colors } from \"@mongez/copper\";\r\nimport { getJsonFile } from \"@warlock.js/fs\";\r\nimport {\r\n  getDatabaseDriver,\r\n  getDatabaseDriverOptions,\r\n  isNoDatabase,\r\n} from \"../../features/database-drivers\";\r\nimport {\r\n  getAiPackageOptions,\r\n  getAiProviderOptions,\r\n  getAllFeatureKeys,\r\n  getDefaultFeatureKeys,\r\n  getFeatureOptions,\r\n} from \"../../features/features-map\";\r\nimport { resolveAgentTargets } from \"../../features/agent-kit-targets\";\r\nimport { App } from \"../../helpers/app\";\r\nimport {\r\n  ALLOWED_PACKAGE_MANAGERS,\r\n  detectPackageManagers,\r\n  getPackageManager,\r\n  getPreferredPackageManager,\r\n  getSystemPackageManagers,\r\n  isValidPackageManager,\r\n  setPackageManager,\r\n} from \"../../helpers/package-manager\";\r\nimport { packageRoot } from \"../../helpers/paths\";\r\nimport { hasInteractiveStdin } from \"../../helpers/tty\";\r\nimport { askStack } from \"../../prompts/ask-stack\";\r\nimport { showIntroBanner } from \"../../ui/banner\";\r\nimport { createWarlockApp } from \"../create-warlock-app\";\r\nimport getAppPath from \"./get-app-path\";\r\nimport { AppOptions, App as AppType, CliFlags, Stack } from \"./types\";\r\n\r\nexport default async function createNewApp(cli: CliFlags = {}) {\r\n  // Start detecting package managers in the background to avoid delay later\r\n  const pmDetectionPromise = detectPackageManagers();\r\n\r\n  // Get version from package.json\r\n  const packageJson: any = getJsonFile(packageRoot(\"package.json\"));\r\n  const createWarlockVersion = packageJson.version;\r\n\r\n  // Show the intro banner\r\n  showIntroBanner(createWarlockVersion);\r\n\r\n  console.log(colors.cyan(\"Let's create something magical! \\n\"));\r\n\r\n  // Validate Node.js version (minimum v20)\r\n  const [major] = process.versions.node.split(\".\").map(Number);\r\n  if (major < 20) {\r\n    cancel(\"Node.js version must be at least 20.0.0\");\r\n    process.exit(0);\r\n  }\r\n\r\n  // Non-interactive path: build everything from flags and skip the prompts.\r\n  //\r\n  // Triggered by --yes, OR automatically the moment stdin has no TTY — CI, a\r\n  // script, an agent harness. This check MUST run before the first prompt\r\n  // call: attempting `text()`/`select()` on a non-TTY stdin does not fail\r\n  // cleanly, it crashes with a libuv internal (\"TTY initialization failed:\r\n  // uv_tty_init returned EBADF\") before any app directory exists, no matter\r\n  // how the run was invoked.\r\n  //\r\n  // Prompting is the fallback, not the precondition: a project name is the\r\n  // only answer with no sane default, so when a name is already available\r\n  // (positional arg or --name) the run proceeds exactly as --yes would, TTY\r\n  // or not. When the name is ALSO missing and there is no TTY to ask for one,\r\n  // createNonInteractive fails loudly — naming --yes and every non-interactive\r\n  // flag — instead of ever reaching a prompt. Every other prompt already has a\r\n  // default; see resolveNonInteractiveOptions below for the full table.\r\n  if (cli.yes || !hasInteractiveStdin()) {\r\n    await createNonInteractive(cli);\r\n    return;\r\n  }\r\n\r\n  // `--interactive` (alias `--customize`) restores the full long-form wizard\r\n  // below. Everyone else with a TTY falls through to the default path, which\r\n  // asks at most ONE structural question — see createDefaultInteractive.\r\n  if (cli.interactive) {\r\n    await createFullWizard(cli, pmDetectionPromise);\r\n    return;\r\n  }\r\n\r\n  await createDefaultInteractive(cli, pmDetectionPromise);\r\n}\r\n\r\n/**\r\n * The full long-form wizard (`--interactive` / `--customize`): every prompt,\r\n * one after another. This is the ORIGINAL default flow, preserved verbatim —\r\n * only its trigger moved from \"any TTY\" to an explicit opt-in flag, per the\r\n * rule that a reversible choice never prompts by default.\r\n */\r\nasync function createFullWizard(\r\n  cli: CliFlags,\r\n  pmDetectionPromise: Promise<void>,\r\n) {\r\n  // Step 1: Project name\r\n  const appName = await text({\r\n    message: \"What shall we call your project?\",\r\n    placeholder: \"my-warlock-app\",\r\n  });\r\n\r\n  if (isCancel(appName) || !appName.trim()) {\r\n    cancel(\"A project name is required to continue\");\r\n    process.exit(0);\r\n  }\r\n\r\n  const appPath = getAppPath(appName);\r\n  if (!appPath) return;\r\n\r\n  // Step 2: Package Manager selection\r\n  await pmDetectionPromise; // Ensure detection is complete\r\n\r\n  const packageManager = await select({\r\n    message: \"Which package manager do you want to use?\",\r\n    options: getSystemPackageManagers().map(pm => ({\r\n      value: pm,\r\n      label: pm,\r\n    })),\r\n    initialValue: getPreferredPackageManager(),\r\n  });\r\n\r\n  if (isCancel(packageManager)) {\r\n    cancel(\"Package manager selection cancelled\");\r\n    process.exit(0);\r\n  }\r\n\r\n  setPackageManager(packageManager as string);\r\n\r\n  // Step 3: Database driver selection\r\n  const databaseDriver = await select({\r\n    message: \"Choose your database driver\",\r\n    options: getDatabaseDriverOptions(),\r\n  });\r\n\r\n  if (isCancel(databaseDriver)) {\r\n    cancel(\"Database selection cancelled\");\r\n    process.exit(0);\r\n  }\r\n\r\n  const selectedDriver = getDatabaseDriver(databaseDriver as string);\r\n\r\n  // Step 4: Features selection\r\n  const selectedFeatures = await multiselect({\r\n    message: \"Select optional features to include\",\r\n    options: getFeatureOptions(),\r\n    initialValues: getDefaultFeatureKeys(),\r\n    required: false,\r\n  });\r\n\r\n  if (isCancel(selectedFeatures)) {\r\n    cancel(\"Feature selection cancelled\");\r\n    process.exit(0);\r\n  }\r\n\r\n  // Step 4b: AI providers + capability packages — selecting any pulls\r\n  // @warlock.js/ai automatically. The result still flows through the\r\n  // `selectedAiProviders` → `aiProviders` pipeline, which now also carries the\r\n  // capability packages (ai-tools / ai-panoptic / ai-workspace).\r\n  const selectedAiProviders = await multiselect({\r\n    message:\r\n      \"Add AI packages? Providers + capabilities — the core AI package is included automatically\",\r\n    options: [...getAiProviderOptions(), ...getAiPackageOptions()],\r\n    required: false,\r\n  });\r\n\r\n  if (isCancel(selectedAiProviders)) {\r\n    cancel(\"AI provider selection cancelled\");\r\n    process.exit(0);\r\n  }\r\n\r\n  // Step 5: Git initialization\r\n  const useGit =\r\n    (await confirm({\r\n      message: \"Initialize a Git repository?\",\r\n    })) === true;\r\n\r\n  if (isCancel(useGit)) {\r\n    cancel(\"Setup cancelled\");\r\n    process.exit(0);\r\n  }\r\n\r\n  // Step 6: JWT secret generation\r\n  const useJWT =\r\n    (await confirm({\r\n      message: \"Generate JWT secret keys?\",\r\n    })) === true;\r\n\r\n  if (isCancel(useJWT)) {\r\n    cancel(\"Setup cancelled\");\r\n    process.exit(0);\r\n  }\r\n\r\n  // agent-kit targets are not part of the long-form wizard (a reversible,\r\n  // low-stakes choice) — they still come from --agents, defaulting to claude.\r\n  let agents: string[];\r\n  try {\r\n    agents = await resolveAgentTargets(cli.agents);\r\n  } catch (error) {\r\n    cancel((error as Error).message);\r\n    process.exit(1);\r\n  }\r\n\r\n  // Build app details\r\n  const appDetails: Required<AppType> = {\r\n    appName: appName,\r\n    appType: \"warlock\",\r\n    appPath: appPath,\r\n    pkgManager: getPackageManager(),\r\n    options: {\r\n      databaseDriver: databaseDriver as string,\r\n      databasePort: selectedDriver?.defaultPort || 27017,\r\n      features: selectedFeatures as string[],\r\n      aiProviders: selectedAiProviders as string[],\r\n      useGit,\r\n      useJWT,\r\n      agents,\r\n    },\r\n  };\r\n\r\n  // Create the app\r\n  await scaffold(appDetails);\r\n}\r\n\r\n/**\r\n * The default TTY path: neither `--yes` nor `--interactive` was given, but a\r\n * terminal is available. Asks the project name when missing (a required\r\n * answer with no sane default — same treatment as the non-interactive path)\r\n * plus the ONE structural question (API-only vs full-stack web) when `--stack`\r\n * was not already supplied. Every other choice is resolved exactly like\r\n * `createNonInteractive` — flags, with defaults, never a prompt.\r\n */\r\nasync function createDefaultInteractive(\r\n  cli: CliFlags,\r\n  pmDetectionPromise: Promise<void>,\r\n) {\r\n  let appName = cli.name;\r\n\r\n  if (!appName) {\r\n    const answer = await text({\r\n      message: \"What shall we call your project?\",\r\n      placeholder: \"my-warlock-app\",\r\n    });\r\n\r\n    if (isCancel(answer) || !answer.trim()) {\r\n      cancel(\"A project name is required to continue\");\r\n      process.exit(0);\r\n    }\r\n\r\n    appName = answer as string;\r\n  }\r\n\r\n  const appPath = getAppPath(appName);\r\n  if (!appPath) return;\r\n\r\n  const stack: Stack = cli.stack ?? (await askStack());\r\n\r\n  await pmDetectionPromise;\r\n\r\n  const packageManager = cli.pm ?? getPreferredPackageManager();\r\n\r\n  if (!isValidPackageManager(packageManager)) {\r\n    cancel(\r\n      `Unknown package manager \"${packageManager}\" — expected one of: ${ALLOWED_PACKAGE_MANAGERS.join(\", \")}`,\r\n    );\r\n    process.exit(1);\r\n  }\r\n\r\n  setPackageManager(packageManager);\r\n\r\n  let options: AppOptions;\r\n\r\n  try {\r\n    options = await resolveAppOptions({ ...cli, stack });\r\n  } catch (error) {\r\n    cancel((error as Error).message);\r\n    process.exit(1);\r\n  }\r\n\r\n  const appDetails: Required<AppType> = {\r\n    appName,\r\n    appType: \"warlock\",\r\n    appPath,\r\n    pkgManager: getPackageManager(),\r\n    options,\r\n  };\r\n\r\n  await scaffold(appDetails);\r\n}\r\n\r\n/**\r\n * Run the scaffold and make the process's exit code tell the truth: anything\r\n * the user asked for that did not happen leaves the shell with a non-zero\r\n * status, so scripts and CI cannot mistake a half-built project for a finished\r\n * one. The problems themselves are printed by the scaffolder.\r\n */\r\nasync function scaffold(appDetails: Required<AppType>) {\r\n  const outcome = await createWarlockApp(new App(appDetails));\r\n\r\n  if (outcome && !outcome.ok) {\r\n    process.exitCode = 1;\r\n  }\r\n}\r\n\r\n/** Everything {@link resolveNonInteractiveOptions} can resolve without the network. */\r\nexport type SyncAppOptions = Omit<AppOptions, \"agents\">;\r\n\r\n/**\r\n * Resolve every flag-or-default `AppOptions` field EXCEPT `agents` from parsed\r\n * CLI flags — applying the non-interactive defaults, validating the database\r\n * driver and feature/provider keys, and handling the `none` (no database)\r\n * selection. `agents` is resolved separately by {@link resolveAppOptions}\r\n * because it can require a network fetch; this function stays synchronous so\r\n * the rest of the flag → app mapping remains trivially unit-testable.\r\n *\r\n * `--stack=web` (or the equivalent wizard answer) seeds the `web` feature by\r\n * default — the one structural choice — but an explicit `--features` always\r\n * wins, so a user who spells out the feature list is never second-guessed.\r\n *\r\n * Throws on an unknown driver or feature key so the caller can fail fast\r\n * before any file is written.\r\n */\r\nexport function resolveNonInteractiveOptions(cli: CliFlags): SyncAppOptions {\r\n  const databaseDriver = cli.db ?? \"mongodb\";\r\n  const noDatabase = isNoDatabase(databaseDriver);\r\n  const driver = noDatabase ? undefined : getDatabaseDriver(databaseDriver);\r\n\r\n  if (!noDatabase && !driver) {\r\n    throw new Error(`Unknown database driver \"${databaseDriver}\"`);\r\n  }\r\n\r\n  const stack: Stack = cli.stack ?? \"api\";\r\n  const features = cli.features ?? (stack === \"web\" ? [\"web\"] : []);\r\n  const aiProviders = cli.ai ?? [];\r\n\r\n  const allowedKeys = getAllFeatureKeys();\r\n  const invalidKeys = [...features, ...aiProviders].filter(\r\n    key => !allowedKeys.includes(key),\r\n  );\r\n\r\n  if (invalidKeys.length > 0) {\r\n    throw new Error(`Unknown feature(s): ${invalidKeys.join(\",\")}`);\r\n  }\r\n\r\n  return {\r\n    databaseDriver,\r\n    databasePort: driver?.defaultPort ?? 27017,\r\n    features,\r\n    aiProviders,\r\n    useGit: cli.git ?? false,\r\n    useJWT: cli.jwt ?? false,\r\n  };\r\n}\r\n\r\n/**\r\n * Resolve the FULL `AppOptions` — {@link resolveNonInteractiveOptions} plus\r\n * the validated `agents` list. Async because a non-default `--agents`\r\n * selection may need {@link resolveAgentTargets}'s network fetch; the default\r\n * (`claude`) never does.\r\n */\r\nexport async function resolveAppOptions(cli: CliFlags): Promise<AppOptions> {\r\n  const options = resolveNonInteractiveOptions(cli);\r\n  const agents = await resolveAgentTargets(cli.agents);\r\n\r\n  return { ...options, agents };\r\n}\r\n\r\n/**\r\n * Non-interactive scaffold path for `--yes`. Builds the app from flags with\r\n * sensible defaults and skips every prompt — a single command scaffolds the\r\n * entire app. Validation lives in `resolveNonInteractiveOptions`; a typo fails\r\n * fast here instead of mid-install.\r\n */\r\nasync function createNonInteractive(cli: CliFlags) {\r\n  const appName = (cli.name ?? \"\").trim();\r\n\r\n  if (!appName) {\r\n    // Reached either because --yes was passed with no name, or because stdin\r\n    // has no TTY to prompt for one — either way, nothing is left to fall back\r\n    // to. Name --yes AND every non-interactive flag so a CI log is enough to\r\n    // fix the invocation without hunting for docs.\r\n    cancel(\r\n      \"A project name is required and no terminal is available to ask for one. \" +\r\n        \"Pass it as the first argument or --name=<name>. Non-interactive flags: \" +\r\n        \"--yes, --pm=<npm|yarn|pnpm>, --db=<driver>|--no-db, --features=<list>, \" +\r\n        \"--ai=<list>, --git|--no-git, --jwt|--no-jwt.\",\r\n    );\r\n    process.exit(1);\r\n  }\r\n\r\n  const appPath = getAppPath(appName);\r\n\r\n  if (!appPath) return;\r\n\r\n  await detectPackageManagers();\r\n\r\n  const packageManager = cli.pm ?? getPreferredPackageManager();\r\n\r\n  if (!isValidPackageManager(packageManager)) {\r\n    cancel(\r\n      `Unknown package manager \"${packageManager}\" — expected one of: ${ALLOWED_PACKAGE_MANAGERS.join(\", \")}`,\r\n    );\r\n    process.exit(1);\r\n  }\r\n\r\n  setPackageManager(packageManager);\r\n\r\n  let options: AppOptions;\r\n\r\n  try {\r\n    options = await resolveAppOptions(cli);\r\n  } catch (error) {\r\n    cancel((error as Error).message);\r\n    process.exit(1);\r\n  }\r\n\r\n  const appDetails: Required<AppType> = {\r\n    appName,\r\n    appType: \"warlock\",\r\n    appPath,\r\n    pkgManager: getPackageManager(),\r\n    options,\r\n  };\r\n\r\n  await scaffold(appDetails);\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;AAyCA,eAA8B,aAAa,MAAgB,CAAC,GAAG;CAE7D,MAAM,qBAAqB,sBAAsB;CAIjD,MAAM,uBADmB,YAAY,YAAY,cAAc,CACxB,CAAC,CAAC;CAGzC,gBAAgB,oBAAoB;CAEpC,QAAQ,IAAI,OAAO,KAAK,oCAAoC,CAAC;CAG7D,MAAM,CAAC,SAAS,QAAQ,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CAC3D,IAAI,QAAQ,IAAI;EACd,OAAO,yCAAyC;EAChD,QAAQ,KAAK,CAAC;CAChB;CAkBA,IAAI,IAAI,OAAO,CAAC,oBAAoB,GAAG;EACrC,MAAM,qBAAqB,GAAG;EAC9B;CACF;CAKA,IAAI,IAAI,aAAa;EACnB,MAAM,iBAAiB,KAAK,kBAAkB;EAC9C;CACF;CAEA,MAAM,yBAAyB,KAAK,kBAAkB;AACxD;;;;;;;AAQA,eAAe,iBACb,KACA,oBACA;CAEA,MAAM,UAAU,MAAM,KAAK;EACzB,SAAS;EACT,aAAa;CACf,CAAC;CAED,IAAI,SAAS,OAAO,KAAK,CAAC,QAAQ,KAAK,GAAG;EACxC,OAAO,wCAAwC;EAC/C,QAAQ,KAAK,CAAC;CAChB;CAEA,MAAM,UAAU,WAAW,OAAO;CAClC,IAAI,CAAC,SAAS;CAGd,MAAM;CAEN,MAAM,iBAAiB,MAAM,OAAO;EAClC,SAAS;EACT,SAAS,yBAAyB,CAAC,CAAC,KAAI,QAAO;GAC7C,OAAO;GACP,OAAO;EACT,EAAE;EACF,cAAc,2BAA2B;CAC3C,CAAC;CAED,IAAI,SAAS,cAAc,GAAG;EAC5B,OAAO,qCAAqC;EAC5C,QAAQ,KAAK,CAAC;CAChB;CAEA,kBAAkB,cAAwB;CAG1C,MAAM,iBAAiB,MAAM,OAAO;EAClC,SAAS;EACT,SAAS,yBAAyB;CACpC,CAAC;CAED,IAAI,SAAS,cAAc,GAAG;EAC5B,OAAO,8BAA8B;EACrC,QAAQ,KAAK,CAAC;CAChB;CAEA,MAAM,iBAAiB,kBAAkB,cAAwB;CAGjE,MAAM,mBAAmB,MAAM,YAAY;EACzC,SAAS;EACT,SAAS,kBAAkB;EAC3B,eAAe,sBAAsB;EACrC,UAAU;CACZ,CAAC;CAED,IAAI,SAAS,gBAAgB,GAAG;EAC9B,OAAO,6BAA6B;EACpC,QAAQ,KAAK,CAAC;CAChB;CAMA,MAAM,sBAAsB,MAAM,YAAY;EAC5C,SACE;EACF,SAAS,CAAC,GAAG,qBAAqB,GAAG,GAAG,oBAAoB,CAAC;EAC7D,UAAU;CACZ,CAAC;CAED,IAAI,SAAS,mBAAmB,GAAG;EACjC,OAAO,iCAAiC;EACxC,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,SACH,MAAM,QAAQ,EACb,SAAS,+BACX,CAAC,MAAO;CAEV,IAAI,SAAS,MAAM,GAAG;EACpB,OAAO,iBAAiB;EACxB,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,SACH,MAAM,QAAQ,EACb,SAAS,4BACX,CAAC,MAAO;CAEV,IAAI,SAAS,MAAM,GAAG;EACpB,OAAO,iBAAiB;EACxB,QAAQ,KAAK,CAAC;CAChB;CAIA,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,oBAAoB,IAAI,MAAM;CAC/C,SAAS,OAAO;EACd,OAAQ,MAAgB,OAAO;EAC/B,QAAQ,KAAK,CAAC;CAChB;CAoBA,MAAM,SAAS;EAhBJ;EACT,SAAS;EACA;EACT,YAAY,kBAAkB;EAC9B,SAAS;GACS;GAChB,cAAc,gBAAgB,eAAe;GAC7C,UAAU;GACV,aAAa;GACb;GACA;GACA;EACF;CAIsB,CAAC;AAC3B;;;;;;;;;AAUA,eAAe,yBACb,KACA,oBACA;CACA,IAAI,UAAU,IAAI;CAElB,IAAI,CAAC,SAAS;EACZ,MAAM,SAAS,MAAM,KAAK;GACxB,SAAS;GACT,aAAa;EACf,CAAC;EAED,IAAI,SAAS,MAAM,KAAK,CAAC,OAAO,KAAK,GAAG;GACtC,OAAO,wCAAwC;GAC/C,QAAQ,KAAK,CAAC;EAChB;EAEA,UAAU;CACZ;CAEA,MAAM,UAAU,WAAW,OAAO;CAClC,IAAI,CAAC,SAAS;CAEd,MAAM,QAAe,IAAI,SAAU,MAAM,SAAS;CAElD,MAAM;CAEN,MAAM,iBAAiB,IAAI,MAAM,2BAA2B;CAE5D,IAAI,CAAC,sBAAsB,cAAc,GAAG;EAC1C,OACE,4BAA4B,eAAe,uBAAuB,yBAAyB,KAAK,IAAI,GACtG;EACA,QAAQ,KAAK,CAAC;CAChB;CAEA,kBAAkB,cAAc;CAEhC,IAAI;CAEJ,IAAI;EACF,UAAU,MAAM,kBAAkB;GAAE,GAAG;GAAK;EAAM,CAAC;CACrD,SAAS,OAAO;EACd,OAAQ,MAAgB,OAAO;EAC/B,QAAQ,KAAK,CAAC;CAChB;CAUA,MAAM,SAAS;EAPb;EACA,SAAS;EACT;EACA,YAAY,kBAAkB;EAC9B;CAGsB,CAAC;AAC3B;;;;;;;AAQA,eAAe,SAAS,YAA+B;CACrD,MAAM,UAAU,MAAM,iBAAiB,IAAI,IAAI,UAAU,CAAC;CAE1D,IAAI,WAAW,CAAC,QAAQ,IACtB,QAAQ,WAAW;AAEvB;;;;;;;;;;;;;;;;AAoBA,SAAgB,6BAA6B,KAA+B;CAC1E,MAAM,iBAAiB,IAAI,MAAM;CACjC,MAAM,aAAa,aAAa,cAAc;CAC9C,MAAM,SAAS,aAAa,SAAY,kBAAkB,cAAc;CAExE,IAAI,CAAC,cAAc,CAAC,QAClB,MAAM,IAAI,MAAM,4BAA4B,eAAe,EAAE;CAG/D,MAAM,QAAe,IAAI,SAAS;CAClC,MAAM,WAAW,IAAI,aAAa,UAAU,QAAQ,CAAC,KAAK,IAAI,CAAC;CAC/D,MAAM,cAAc,IAAI,MAAM,CAAC;CAE/B,MAAM,cAAc,kBAAkB;CACtC,MAAM,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC,CAAC,QAChD,QAAO,CAAC,YAAY,SAAS,GAAG,CAClC;CAEA,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MAAM,uBAAuB,YAAY,KAAK,GAAG,GAAG;CAGhE,OAAO;EACL;EACA,cAAc,QAAQ,eAAe;EACrC;EACA;EACA,QAAQ,IAAI,OAAO;EACnB,QAAQ,IAAI,OAAO;CACrB;AACF;;;;;;;AAQA,eAAsB,kBAAkB,KAAoC;CAC1E,MAAM,UAAU,6BAA6B,GAAG;CAChD,MAAM,SAAS,MAAM,oBAAoB,IAAI,MAAM;CAEnD,OAAO;EAAE,GAAG;EAAS;CAAO;AAC9B;;;;;;;AAQA,eAAe,qBAAqB,KAAe;CACjD,MAAM,WAAW,IAAI,QAAQ,GAAE,CAAE,KAAK;CAEtC,IAAI,CAAC,SAAS;EAKZ,OACE,oQAIF;EACA,QAAQ,KAAK,CAAC;CAChB;CAEA,MAAM,UAAU,WAAW,OAAO;CAElC,IAAI,CAAC,SAAS;CAEd,MAAM,sBAAsB;CAE5B,MAAM,iBAAiB,IAAI,MAAM,2BAA2B;CAE5D,IAAI,CAAC,sBAAsB,cAAc,GAAG;EAC1C,OACE,4BAA4B,eAAe,uBAAuB,yBAAyB,KAAK,IAAI,GACtG;EACA,QAAQ,KAAK,CAAC;CAChB;CAEA,kBAAkB,cAAc;CAEhC,IAAI;CAEJ,IAAI;EACF,UAAU,MAAM,kBAAkB,GAAG;CACvC,SAAS,OAAO;EACd,OAAQ,MAAgB,OAAO;EAC/B,QAAQ,KAAK,CAAC;CAChB;CAUA,MAAM,SAAS;EAPb;EACA,SAAS;EACT;EACA,YAAY,kBAAkB;EAC9B;CAGsB,CAAC;AAC3B"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../create-warlock/src/commands/create-new-app/index.ts"],"sourcesContent":["import { cancel, confirm, isCancel, multiselect, select } from \"@clack/prompts\";\nimport { colors } from \"@mongez/copper\";\nimport { getJsonFile } from \"@warlock.js/fs\";\nimport { resolveAgentTargets } from \"../../features/agent-kit-targets\";\nimport {\n  getDatabaseDriver,\n  getDatabaseDriverOptions,\n  isNoDatabase,\n} from \"../../features/database-drivers\";\nimport {\n  getAiPackageOptions,\n  getAiProviderOptions,\n  getAllFeatureKeys,\n  getFeatureOptions,\n} from \"../../features/features-map\";\nimport { assertFlagCombinations } from \"../../flags/assert-flag-combinations\";\nimport { assertPackageManagerAvailable } from \"../../flags/assert-package-manager\";\nimport { seedFromFlags } from \"../../flags/seed-from-flags\";\nimport { App } from \"../../helpers/app\";\nimport {\n  detectPackageManagers,\n  getPackageManager,\n  getPreferredPackageManager,\n  getSystemPackageManagers,\n  setPackageManager,\n} from \"../../helpers/package-manager\";\nimport { packageRoot } from \"../../helpers/paths\";\nimport { hasInteractiveStdin } from \"../../helpers/tty\";\nimport { askAgentTargets } from \"../../prompts/ask-agent-targets\";\nimport { askProjectName } from \"../../prompts/ask-project-name\";\nimport { askStack } from \"../../prompts/ask-stack\";\nimport { showIntroBanner } from \"../../ui/banner\";\nimport { createWarlockApp } from \"../create-warlock-app\";\nimport getAppPath from \"./get-app-path\";\nimport {\n  AppOptions,\n  App as AppType,\n  CliFlags,\n  SetupChoice,\n  Stack,\n} from \"./types\";\n\nexport default async function createNewApp(cli: CliFlags = {}) {\n  // Start detecting package managers in the background to avoid delay later\n  const pmDetectionPromise = detectPackageManagers();\n\n  // Get version from package.json\n  const packageJson: any = getJsonFile(packageRoot(\"package.json\"));\n  const createWarlockVersion = packageJson.version;\n\n  // Show the intro banner\n  showIntroBanner(createWarlockVersion);\n\n  console.log(colors.cyan(\"Let's create something magical! \\n\"));\n\n  // Validate Node.js version (minimum v20)\n  const [major] = process.versions.node.split(\".\").map(Number);\n  if (major < 20) {\n    cancel(\"Node.js version must be at least 20.0.0\");\n    process.exit(0);\n  }\n\n  // Refuse contradictory flag combinations LOUDLY, before anything else looks\n  // at them — `--customize --yes` used to drop `--customize` without a word.\n  assertFlagCombinations(cli);\n\n  // Non-interactive path: build everything from flags and skip the prompts.\n  //\n  // Triggered by --yes, OR automatically the moment stdin has no TTY — CI, a\n  // script, an agent harness. This check MUST run before the first prompt\n  // call: attempting `text()`/`select()` on a non-TTY stdin does not fail\n  // cleanly, it crashes with a libuv internal (\"TTY initialization failed:\n  // uv_tty_init returned EBADF\") before any app directory exists, no matter\n  // how the run was invoked.\n  //\n  // Prompting is the fallback, not the precondition: a project name is the\n  // only answer with no sane default, so when a name is already available\n  // (positional arg or --name) the run proceeds exactly as --yes would, TTY\n  // or not. When the name is ALSO missing and there is no TTY to ask for one,\n  // createNonInteractive fails loudly — naming --yes and every non-interactive\n  // flag — instead of ever reaching a prompt. Every other prompt already has a\n  // default; see resolveNonInteractiveOptions below for the full table.\n  if (cli.yes || !hasInteractiveStdin()) {\n    await createNonInteractive(cli);\n    return;\n  }\n\n  // `--interactive` (alias `--customize`) restores the full long-form wizard\n  // below. Everyone else with a TTY falls through to the default path, which\n  // asks at most ONE structural question — see createDefaultInteractive.\n  if (cli.interactive) {\n    await createFullWizard(cli, pmDetectionPromise);\n    return;\n  }\n\n  await createDefaultInteractive(cli, pmDetectionPromise);\n}\n\n/**\n * The full long-form wizard (`--interactive` / `--customize`): every prompt,\n * one after another. This is the ORIGINAL default flow, preserved verbatim —\n * only its trigger moved from \"any TTY\" to an explicit opt-in flag, per the\n * rule that a reversible choice never prompts by default.\n */\nasync function createFullWizard(\n  cli: CliFlags,\n  pmDetectionPromise: Promise<void>,\n) {\n  // Step 1: Project name — but only when it is not already known. It arrives\n  // answered from `--name`/the positional arg, and from the default path when\n  // the user picked \"Customize\" AFTER being asked for a name. Re-asking for an\n  // answer we already hold is the double-prompt this branch exists to avoid.\n  const appName = cli.name ?? (await askProjectName());\n\n  const appPath = getAppPath(appName);\n  if (!appPath) return;\n\n  // A flag passed alongside --customize is an answer given early, not a\n  // contradiction: it pre-selects the matching prompt instead of being\n  // dropped. Validate the ones that CAN be wrong through the same function\n  // the non-interactive path uses, so an unknown driver or feature key fails\n  // here rather than showing a prompt that quietly ignores it.\n  try {\n    resolveNonInteractiveOptions(cli);\n  } catch (error) {\n    cancel((error as Error).message);\n    process.exit(1);\n  }\n\n  const seeds = seedFromFlags(cli);\n\n  // Step 2: Package Manager selection\n  await pmDetectionPromise; // Ensure detection is complete\n\n  // Only now can availability be judged: detection is what fills\n  // getSystemPackageManagers(), and the prompt below is built from it.\n  assertPackageManagerAvailable(cli.pm);\n\n  const packageManager = await select({\n    message: \"Which package manager do you want to use?\",\n    options: getSystemPackageManagers().map(pm => ({\n      value: pm,\n      label: pm,\n    })),\n    initialValue: seeds.packageManager,\n  });\n\n  if (isCancel(packageManager)) {\n    cancel(\"Package manager selection cancelled\");\n    process.exit(0);\n  }\n\n  setPackageManager(packageManager as string);\n\n  // Step 3: Database driver selection\n  const databaseDriver = await select({\n    message: \"Choose your database driver\",\n    options: getDatabaseDriverOptions(),\n    initialValue: seeds.databaseDriver,\n  });\n\n  if (isCancel(databaseDriver)) {\n    cancel(\"Database selection cancelled\");\n    process.exit(0);\n  }\n\n  const selectedDriver = getDatabaseDriver(databaseDriver as string);\n\n  // Step 4: Features selection\n  const selectedFeatures = await multiselect({\n    message: \"Select optional features to include\",\n    options: getFeatureOptions(),\n    initialValues: seeds.features,\n    required: false,\n  });\n\n  if (isCancel(selectedFeatures)) {\n    cancel(\"Feature selection cancelled\");\n    process.exit(0);\n  }\n\n  // Step 4b: AI providers + capability packages — selecting any pulls\n  // @warlock.js/ai automatically. The result still flows through the\n  // `selectedAiProviders` → `aiProviders` pipeline, which now also carries the\n  // capability packages (ai-tools / ai-panoptic / ai-workspace).\n  const selectedAiProviders = await multiselect({\n    message:\n      \"Add AI packages? Providers + capabilities — the core AI package is included automatically\",\n    options: [...getAiProviderOptions(), ...getAiPackageOptions()],\n    initialValues: seeds.aiProviders,\n    required: false,\n  });\n\n  if (isCancel(selectedAiProviders)) {\n    cancel(\"AI provider selection cancelled\");\n    process.exit(0);\n  }\n\n  // Step 5: Git initialization\n  const useGit =\n    (await confirm({\n      message: \"Initialize a Git repository?\",\n      initialValue: seeds.useGit,\n    })) === true;\n\n  if (isCancel(useGit)) {\n    cancel(\"Setup cancelled\");\n    process.exit(0);\n  }\n\n  // Step 6: JWT secret generation\n  const useJWT =\n    (await confirm({\n      message: \"Generate JWT secret keys?\",\n      initialValue: seeds.useJWT,\n    })) === true;\n\n  if (isCancel(useJWT)) {\n    cancel(\"Setup cancelled\");\n    process.exit(0);\n  }\n\n  // Step 7: agent-kit targets. Asked here rather than left to --agents,\n  // because Customize means every choice is offered (owner ruling, seq 1028).\n  // --agents pre-ticks the selection, like every other flag.\n  const agents = await askAgentTargets(cli.agents);\n\n  // Build app details\n  const appDetails: Required<AppType> = {\n    appName: appName,\n    appType: \"warlock\",\n    appPath: appPath,\n    pkgManager: getPackageManager(),\n    options: {\n      databaseDriver: databaseDriver as string,\n      databasePort: selectedDriver?.defaultPort || 27017,\n      features: selectedFeatures as string[],\n      aiProviders: selectedAiProviders as string[],\n      useGit,\n      useJWT,\n      agents,\n    },\n  };\n\n  // Create the app\n  await scaffold(appDetails);\n}\n\n/**\n * The default TTY path: neither `--yes` nor `--interactive` was given, but a\n * terminal is available. Asks the project name when missing (a required\n * answer with no sane default — same treatment as the non-interactive path)\n * plus the ONE structural question (API-only vs full-stack web) when `--stack`\n * was not already supplied. Every other choice is resolved exactly like\n * `createNonInteractive` — flags, with defaults, never a prompt.\n */\nasync function createDefaultInteractive(\n  cli: CliFlags,\n  pmDetectionPromise: Promise<void>,\n) {\n  const appName = cli.name ?? (await askProjectName());\n\n  const appPath = getAppPath(appName);\n  if (!appPath) return;\n\n  const choice: SetupChoice = cli.stack ?? (await askStack());\n\n  // \"Customize\" is not a third stack — it is the wizard, chosen from the menu\n  // instead of from a flag nobody was told about. Hand over the name we just\n  // collected so the wizard starts at its SECOND question.\n  if (choice === \"customize\") {\n    await createFullWizard({ ...cli, name: appName }, pmDetectionPromise);\n    return;\n  }\n\n  const stack: Stack = choice;\n\n  await pmDetectionPromise;\n\n  const packageManager = cli.pm ?? getPreferredPackageManager();\n\n  assertPackageManagerAvailable(cli.pm);\n\n  setPackageManager(packageManager);\n\n  let options: AppOptions;\n\n  try {\n    options = await resolveAppOptions({ ...cli, stack });\n  } catch (error) {\n    cancel((error as Error).message);\n    process.exit(1);\n  }\n\n  const appDetails: Required<AppType> = {\n    appName,\n    appType: \"warlock\",\n    appPath,\n    pkgManager: getPackageManager(),\n    options,\n  };\n\n  await scaffold(appDetails);\n}\n\n/**\n * Run the scaffold and make the process's exit code tell the truth: anything\n * the user asked for that did not happen leaves the shell with a non-zero\n * status, so scripts and CI cannot mistake a half-built project for a finished\n * one. The problems themselves are printed by the scaffolder.\n */\nasync function scaffold(appDetails: Required<AppType>) {\n  const outcome = await createWarlockApp(new App(appDetails));\n\n  if (outcome && !outcome.ok) {\n    process.exitCode = 1;\n  }\n}\n\n/** Everything {@link resolveNonInteractiveOptions} can resolve without the network. */\nexport type SyncAppOptions = Omit<AppOptions, \"agents\">;\n\n/**\n * Resolve every flag-or-default `AppOptions` field EXCEPT `agents` from parsed\n * CLI flags — applying the non-interactive defaults, validating the database\n * driver and feature/provider keys, and handling the `none` (no database)\n * selection. `agents` is resolved separately by {@link resolveAppOptions}\n * because it can require a network fetch; this function stays synchronous so\n * the rest of the flag → app mapping remains trivially unit-testable.\n *\n * `--stack=web` (or the equivalent wizard answer) seeds the `web` feature by\n * default — the one structural choice — but an explicit `--features` always\n * wins, so a user who spells out the feature list is never second-guessed.\n *\n * Throws on an unknown driver, feature, or AI key so the caller can fail fast\n * before any file is written.\n */\nexport function resolveNonInteractiveOptions(cli: CliFlags): SyncAppOptions {\n  const databaseDriver = cli.db ?? \"mongodb\";\n  const noDatabase = isNoDatabase(databaseDriver);\n  const driver = noDatabase ? undefined : getDatabaseDriver(databaseDriver);\n\n  if (!noDatabase && !driver) {\n    throw new Error(`Unknown database driver \"${databaseDriver}\"`);\n  }\n\n  const stack: Stack = cli.stack ?? \"api\";\n  const features = cli.features ?? (stack === \"web\" ? [\"web\"] : []);\n  const aiProviders = cli.ai ?? [];\n\n  const allowedKeys = getAllFeatureKeys();\n  const invalidFeatureKeys = features.filter(key => !allowedKeys.includes(key));\n  const errors: string[] = [];\n\n  if (invalidFeatureKeys.length > 0) {\n    errors.push(`Unknown feature(s): ${invalidFeatureKeys.join(\",\")}`);\n  }\n\n  const aiFeatureKeys = [\n    ...getAiProviderOptions(),\n    ...getAiPackageOptions(),\n  ].map(option => option.value);\n  const invalidAiKeys = aiProviders.filter(key => !aiFeatureKeys.includes(key));\n\n  if (invalidAiKeys.length > 0) {\n    errors.push(\n      `Unknown AI feature(s): ${invalidAiKeys.join(\",\")}. ` +\n        `Valid AI choices: ${aiFeatureKeys.join(\", \")}`,\n    );\n  }\n\n  if (errors.length > 0) {\n    throw new Error(errors.join(\"\\n\"));\n  }\n\n  return {\n    databaseDriver,\n    databasePort: driver?.defaultPort ?? 27017,\n    features,\n    aiProviders,\n    useGit: cli.git ?? false,\n    useJWT: cli.jwt ?? false,\n  };\n}\n\n/**\n * Resolve the FULL `AppOptions` — {@link resolveNonInteractiveOptions} plus\n * the validated `agents` list. Async because a non-default `--agents`\n * selection may need {@link resolveAgentTargets}'s network fetch; the default\n * (`claude`) never does.\n */\nexport async function resolveAppOptions(cli: CliFlags): Promise<AppOptions> {\n  const options = resolveNonInteractiveOptions(cli);\n  const agents = await resolveAgentTargets(cli.agents);\n\n  return { ...options, agents };\n}\n\n/**\n * Non-interactive scaffold path for `--yes`. Builds the app from flags with\n * sensible defaults and skips every prompt — a single command scaffolds the\n * entire app. Validation lives in `resolveNonInteractiveOptions`; a typo fails\n * fast here instead of mid-install.\n */\nasync function createNonInteractive(cli: CliFlags) {\n  const appName = (cli.name ?? \"\").trim();\n\n  if (!appName) {\n    // Reached either because --yes was passed with no name, or because stdin\n    // has no TTY to prompt for one — either way, nothing is left to fall back\n    // to. Name --yes AND every non-interactive flag so a CI log is enough to\n    // fix the invocation without hunting for docs.\n    cancel(\n      \"A project name is required and no terminal is available to ask for one. \" +\n        \"Pass it as the first argument or --name=<name>. Non-interactive flags: \" +\n        \"--yes, --pm=<npm|yarn|pnpm|bun>, --db=<driver>|--no-db, --features=<list>, \" +\n        \"--ai=<list>, --git|--no-git, --jwt|--no-jwt.\",\n    );\n    process.exit(1);\n  }\n\n  const appPath = getAppPath(appName);\n\n  if (!appPath) return;\n\n  await detectPackageManagers();\n\n  const packageManager = cli.pm ?? getPreferredPackageManager();\n\n  assertPackageManagerAvailable(cli.pm);\n\n  setPackageManager(packageManager);\n\n  let options: AppOptions;\n\n  try {\n    options = await resolveAppOptions(cli);\n  } catch (error) {\n    cancel((error as Error).message);\n    process.exit(1);\n  }\n\n  const appDetails: Required<AppType> = {\n    appName,\n    appType: \"warlock\",\n    appPath,\n    pkgManager: getPackageManager(),\n    options,\n  };\n\n  await scaffold(appDetails);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0CA,eAA8B,aAAa,MAAgB,CAAC,GAAG;CAE7D,MAAM,qBAAqB,sBAAsB;CAIjD,MAAM,uBADmB,YAAY,YAAY,cAAc,CACxB,CAAC,CAAC;CAGzC,gBAAgB,oBAAoB;CAEpC,QAAQ,IAAI,OAAO,KAAK,oCAAoC,CAAC;CAG7D,MAAM,CAAC,SAAS,QAAQ,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CAC3D,IAAI,QAAQ,IAAI;EACd,OAAO,yCAAyC;EAChD,QAAQ,KAAK,CAAC;CAChB;CAIA,uBAAuB,GAAG;CAkB1B,IAAI,IAAI,OAAO,CAAC,oBAAoB,GAAG;EACrC,MAAM,qBAAqB,GAAG;EAC9B;CACF;CAKA,IAAI,IAAI,aAAa;EACnB,MAAM,iBAAiB,KAAK,kBAAkB;EAC9C;CACF;CAEA,MAAM,yBAAyB,KAAK,kBAAkB;AACxD;;;;;;;AAQA,eAAe,iBACb,KACA,oBACA;CAKA,MAAM,UAAU,IAAI,QAAS,MAAM,eAAe;CAElD,MAAM,UAAU,WAAW,OAAO;CAClC,IAAI,CAAC,SAAS;CAOd,IAAI;EACF,6BAA6B,GAAG;CAClC,SAAS,OAAO;EACd,OAAQ,MAAgB,OAAO;EAC/B,QAAQ,KAAK,CAAC;CAChB;CAEA,MAAM,QAAQ,cAAc,GAAG;CAG/B,MAAM;CAIN,8BAA8B,IAAI,EAAE;CAEpC,MAAM,iBAAiB,MAAM,OAAO;EAClC,SAAS;EACT,SAAS,yBAAyB,CAAC,CAAC,KAAI,QAAO;GAC7C,OAAO;GACP,OAAO;EACT,EAAE;EACF,cAAc,MAAM;CACtB,CAAC;CAED,IAAI,SAAS,cAAc,GAAG;EAC5B,OAAO,qCAAqC;EAC5C,QAAQ,KAAK,CAAC;CAChB;CAEA,kBAAkB,cAAwB;CAG1C,MAAM,iBAAiB,MAAM,OAAO;EAClC,SAAS;EACT,SAAS,yBAAyB;EAClC,cAAc,MAAM;CACtB,CAAC;CAED,IAAI,SAAS,cAAc,GAAG;EAC5B,OAAO,8BAA8B;EACrC,QAAQ,KAAK,CAAC;CAChB;CAEA,MAAM,iBAAiB,kBAAkB,cAAwB;CAGjE,MAAM,mBAAmB,MAAM,YAAY;EACzC,SAAS;EACT,SAAS,kBAAkB;EAC3B,eAAe,MAAM;EACrB,UAAU;CACZ,CAAC;CAED,IAAI,SAAS,gBAAgB,GAAG;EAC9B,OAAO,6BAA6B;EACpC,QAAQ,KAAK,CAAC;CAChB;CAMA,MAAM,sBAAsB,MAAM,YAAY;EAC5C,SACE;EACF,SAAS,CAAC,GAAG,qBAAqB,GAAG,GAAG,oBAAoB,CAAC;EAC7D,eAAe,MAAM;EACrB,UAAU;CACZ,CAAC;CAED,IAAI,SAAS,mBAAmB,GAAG;EACjC,OAAO,iCAAiC;EACxC,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,SACH,MAAM,QAAQ;EACb,SAAS;EACT,cAAc,MAAM;CACtB,CAAC,MAAO;CAEV,IAAI,SAAS,MAAM,GAAG;EACpB,OAAO,iBAAiB;EACxB,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,SACH,MAAM,QAAQ;EACb,SAAS;EACT,cAAc,MAAM;CACtB,CAAC,MAAO;CAEV,IAAI,SAAS,MAAM,GAAG;EACpB,OAAO,iBAAiB;EACxB,QAAQ,KAAK,CAAC;CAChB;CAKA,MAAM,SAAS,MAAM,gBAAgB,IAAI,MAAM;CAoB/C,MAAM,SAAS;EAhBJ;EACT,SAAS;EACA;EACT,YAAY,kBAAkB;EAC9B,SAAS;GACS;GAChB,cAAc,gBAAgB,eAAe;GAC7C,UAAU;GACV,aAAa;GACb;GACA;GACA;EACF;CAIsB,CAAC;AAC3B;;;;;;;;;AAUA,eAAe,yBACb,KACA,oBACA;CACA,MAAM,UAAU,IAAI,QAAS,MAAM,eAAe;CAElD,MAAM,UAAU,WAAW,OAAO;CAClC,IAAI,CAAC,SAAS;CAEd,MAAM,SAAsB,IAAI,SAAU,MAAM,SAAS;CAKzD,IAAI,WAAW,aAAa;EAC1B,MAAM,iBAAiB;GAAE,GAAG;GAAK,MAAM;EAAQ,GAAG,kBAAkB;EACpE;CACF;CAEA,MAAM,QAAe;CAErB,MAAM;CAEN,MAAM,iBAAiB,IAAI,MAAM,2BAA2B;CAE5D,8BAA8B,IAAI,EAAE;CAEpC,kBAAkB,cAAc;CAEhC,IAAI;CAEJ,IAAI;EACF,UAAU,MAAM,kBAAkB;GAAE,GAAG;GAAK;EAAM,CAAC;CACrD,SAAS,OAAO;EACd,OAAQ,MAAgB,OAAO;EAC/B,QAAQ,KAAK,CAAC;CAChB;CAUA,MAAM,SAAS;EAPb;EACA,SAAS;EACT;EACA,YAAY,kBAAkB;EAC9B;CAGsB,CAAC;AAC3B;;;;;;;AAQA,eAAe,SAAS,YAA+B;CACrD,MAAM,UAAU,MAAM,iBAAiB,IAAI,IAAI,UAAU,CAAC;CAE1D,IAAI,WAAW,CAAC,QAAQ,IACtB,QAAQ,WAAW;AAEvB;;;;;;;;;;;;;;;;AAoBA,SAAgB,6BAA6B,KAA+B;CAC1E,MAAM,iBAAiB,IAAI,MAAM;CACjC,MAAM,aAAa,aAAa,cAAc;CAC9C,MAAM,SAAS,aAAa,SAAY,kBAAkB,cAAc;CAExE,IAAI,CAAC,cAAc,CAAC,QAClB,MAAM,IAAI,MAAM,4BAA4B,eAAe,EAAE;CAG/D,MAAM,QAAe,IAAI,SAAS;CAClC,MAAM,WAAW,IAAI,aAAa,UAAU,QAAQ,CAAC,KAAK,IAAI,CAAC;CAC/D,MAAM,cAAc,IAAI,MAAM,CAAC;CAE/B,MAAM,cAAc,kBAAkB;CACtC,MAAM,qBAAqB,SAAS,QAAO,QAAO,CAAC,YAAY,SAAS,GAAG,CAAC;CAC5E,MAAM,SAAmB,CAAC;CAE1B,IAAI,mBAAmB,SAAS,GAC9B,OAAO,KAAK,uBAAuB,mBAAmB,KAAK,GAAG,GAAG;CAGnE,MAAM,gBAAgB,CACpB,GAAG,qBAAqB,GACxB,GAAG,oBAAoB,CACzB,CAAC,CAAC,KAAI,WAAU,OAAO,KAAK;CAC5B,MAAM,gBAAgB,YAAY,QAAO,QAAO,CAAC,cAAc,SAAS,GAAG,CAAC;CAE5E,IAAI,cAAc,SAAS,GACzB,OAAO,KACL,0BAA0B,cAAc,KAAK,GAAG,EAAE,sBAC3B,cAAc,KAAK,IAAI,GAChD;CAGF,IAAI,OAAO,SAAS,GAClB,MAAM,IAAI,MAAM,OAAO,KAAK,IAAI,CAAC;CAGnC,OAAO;EACL;EACA,cAAc,QAAQ,eAAe;EACrC;EACA;EACA,QAAQ,IAAI,OAAO;EACnB,QAAQ,IAAI,OAAO;CACrB;AACF;;;;;;;AAQA,eAAsB,kBAAkB,KAAoC;CAC1E,MAAM,UAAU,6BAA6B,GAAG;CAChD,MAAM,SAAS,MAAM,oBAAoB,IAAI,MAAM;CAEnD,OAAO;EAAE,GAAG;EAAS;CAAO;AAC9B;;;;;;;AAQA,eAAe,qBAAqB,KAAe;CACjD,MAAM,WAAW,IAAI,QAAQ,GAAE,CAAE,KAAK;CAEtC,IAAI,CAAC,SAAS;EAKZ,OACE,wQAIF;EACA,QAAQ,KAAK,CAAC;CAChB;CAEA,MAAM,UAAU,WAAW,OAAO;CAElC,IAAI,CAAC,SAAS;CAEd,MAAM,sBAAsB;CAE5B,MAAM,iBAAiB,IAAI,MAAM,2BAA2B;CAE5D,8BAA8B,IAAI,EAAE;CAEpC,kBAAkB,cAAc;CAEhC,IAAI;CAEJ,IAAI;EACF,UAAU,MAAM,kBAAkB,GAAG;CACvC,SAAS,OAAO;EACd,OAAQ,MAAgB,OAAO;EAC/B,QAAQ,KAAK,CAAC;CAChB;CAUA,MAAM,SAAS;EAPb;EACA,SAAS;EACT;EACA,YAAY,kBAAkB;EAC9B;CAGsB,CAAC;AAC3B"}

package/esm/commands/create-new-app/types.d.mts

@@ -3,7 +3,7 @@
 type Stack = "api" | "web";
 /**
  * Flags parsed from the command line for non-interactive scaffolding
- * (`create-warlock my-app --db=postgres --features=test,herald --ai=openai --yes`).
+ * (`create-warlock my-app --db=postgres --features=test,herald --ai=ai-openai --yes`).
  */
 type CliFlags = {
   yes?: boolean;

package/esm/commands/create-warlock-app/index.mjs

@@ -1,12 +1,12 @@
 import { getDatabaseLabel, isNoDatabase } from "../../features/database-drivers.mjs";
-import { takeLastCommandOutput } from "../../helpers/exec.mjs";
 import { getPackageManager, runPackageManagerCommand } from "../../helpers/package-manager.mjs";
+import { takeLastCommandOutput } from "../../helpers/exec.mjs";
 import { resolveWarlockVersions } from "../../helpers/warlock-versions.mjs";
 import { showSuccessScreen } from "../../ui/banner.mjs";
+import { printDecisionsSummary } from "../../summary.mjs";
 import { failFatally, installFailureHints, showNotes, showPartialScreen, showProblems } from "../../ui/report.mjs";
 import { spinner } from "../../ui/spinner.mjs";
 import { spinnerMessages } from "../../ui/spinners.mjs";
-import { printDecisionsSummary } from "../../summary.mjs";
 
 //#region ../create-warlock/src/commands/create-warlock-app/index.ts
 /** One-line "why did this fail" pulled out of a captured command. */

package/esm/commands/create-warlock-app/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../create-warlock/src/commands/create-warlock-app/index.ts"],"sourcesContent":["import {\n  getDatabaseLabel,\n  isNoDatabase,\n} from \"../../features/database-drivers\";\nimport { App } from \"../../helpers/app\";\nimport { CommandResult, takeLastCommandOutput } from \"../../helpers/exec\";\nimport {\n  getPackageManager,\n  runPackageManagerCommand,\n} from \"../../helpers/package-manager\";\nimport { resolveWarlockVersions } from \"../../helpers/warlock-versions\";\nimport { showSuccessScreen } from \"../../ui/banner\";\nimport {\n  failFatally,\n  installFailureHints,\n  Problem,\n  showNotes,\n  showPartialScreen,\n  showProblems,\n} from \"../../ui/report\";\nimport { spinner } from \"../../ui/spinner\";\nimport { spinnerMessages } from \"../../ui/spinners\";\nimport { printDecisionsSummary } from \"../../summary\";\n\n/**\n * What the scaffold actually achieved. `ok` is false when ANY step the user\n * asked for did not happen; the caller turns that into a non-zero exit code so\n * a script never mistakes a half-built project for a finished one.\n */\nexport type ScaffoldOutcome = {\n  ok: boolean;\n  problems: Problem[];\n};\n\n/** One-line \"why did this fail\" pulled out of a captured command. */\nfunction reasonFrom(result: CommandResult | undefined): string {\n  if (!result) return \"the command reported a failure (no output captured)\";\n\n  if (result.error) {\n    return result.error.message || String(result.error);\n  }\n\n  const lastLine = `${result.stderr}\\n${result.stdout}`\n    .split(/\\r?\\n/)\n    .map(line => line.trim())\n    .filter(Boolean)\n    .pop();\n\n  const status =\n    result.code === null\n      ? `killed by ${result.signal ?? \"an unknown signal\"}`\n      : `exit code ${result.code}`;\n\n  return lastLine ? `${status} — ${lastLine}` : status;\n}\n\nexport async function createWarlockApp(\n  application: App,\n): Promise<ScaffoldOutcome> {\n  const options = application.options;\n  const { useGit, useJWT, features, aiProviders, databaseDriver } = options;\n  const noDatabase = isNoDatabase(databaseDriver);\n  const problems: Problem[] = [];\n\n  // Resolve the versions to pin BEFORE anything is written. The scaffolder's\n  // own version is only used when the registry confirms it exists — see\n  // helpers/warlock-versions.ts for why an unverified pin broke every install.\n  const { versions, notes } = await resolveWarlockVersions();\n\n  // Step 1: Initialize and copy template\n  const templateSpinner = spinner();\n  templateSpinner.start(spinnerMessages.copyingTemplate);\n\n  try {\n    application\n      .init()\n      .use(\"warlock\")\n      .updatePackageJson(versions)\n      .updateDotEnv();\n\n    // Wire the chosen database driver into .env — or, when the user opted out,\n    // strip the database config entirely so the app boots with no database.\n    if (noDatabase) {\n      application.removeDatabaseConfig();\n    } else {\n      application.configureDatabaseEnv(databaseDriver);\n      application.configureDatabaseConfig(databaseDriver);\n    }\n\n    application.configureWebStarter(features.includes(\"web\"));\n    application.configureAgentKitTargets(options.agents ?? [\"claude\"]);\n  } catch (error) {\n    templateSpinner.stop(spinnerMessages.templateFailed);\n\n    failFatally({\n      step: \"Template copy\",\n      detail: `The project files could not be written: ${(error as Error).message}`,\n      hints: [\n        \"Check that the target directory is writable and that no file is locked by another process.\",\n      ],\n    });\n  }\n\n  templateSpinner.stop(spinnerMessages.templateCopied);\n\n  showNotes(notes);\n\n  // Step 2: Install base dependencies (so the `warlock` binary is available).\n  // Nothing downstream works without this, so a failure ends the run — loudly,\n  // with the command, its exit code and its output.\n  const installSpinner = spinner();\n  installSpinner.start(spinnerMessages.installingDeps);\n\n  const baseInstall = application.install();\n  const baseInstalled = await baseInstall.install;\n  const baseInstallResult = await baseInstall.result;\n\n  if (!baseInstalled) {\n    installSpinner.stop(spinnerMessages.depsFailed);\n\n    failFatally({\n      step: \"Dependency install\",\n      detail: \"The project's dependencies were not installed.\",\n      result: baseInstallResult,\n      hints: installFailureHints(baseInstallResult),\n    });\n  }\n\n  installSpinner.stop(spinnerMessages.depsInstalled);\n\n  // Step 3: Add features via `warlock add --no-install`, then one batched install.\n  // The DB driver, optional features, and AI providers all go through the single\n  // source of truth (core's feature map) so versions never drift. When no\n  // database was chosen, the driver is omitted (there is no `none` feature).\n  const selectedFeatures = [\n    ...(noDatabase ? [] : [databaseDriver]),\n    ...features,\n    ...aiProviders,\n  ];\n\n  // Features the user asked for that are not in the project when we finish.\n  const failedFeatures: { feature: string; reason: string }[] = [];\n\n  if (selectedFeatures.length > 0) {\n    const featuresSpinner = spinner();\n    featuresSpinner.start(spinnerMessages.addingFeatures);\n\n    let addedFeatures = selectedFeatures;\n\n    if (!(await application.installFeatures(selectedFeatures))) {\n      // The batch is all-or-nothing, so it cannot say WHICH feature broke it.\n      // Retry them one at a time: every feature that can be added still gets\n      // added, and every one that cannot gets its own reason.\n      const batchFailure = takeLastCommandOutput();\n\n      addedFeatures = [];\n\n      for (const feature of selectedFeatures) {\n        if (await application.installFeatures([feature])) {\n          addedFeatures.push(feature);\n        } else {\n          failedFeatures.push({\n            feature,\n            reason: reasonFrom(takeLastCommandOutput() ?? batchFailure),\n          });\n        }\n      }\n    }\n\n    let featureInstall: CommandResult | undefined;\n\n    if (addedFeatures.length > 0) {\n      // `warlock add` records the feature dependencies but does not reconcile\n      // them with each other. The `web` feature brings `vite` while the\n      // template always brings `vitest`, whose own vite range resolves to a\n      // different major — two copies, and yarn 1 aborts the whole link phase\n      // on them. Pin one copy BEFORE the batched install, not after.\n      application.pinViteResolution();\n\n      const install = application.install();\n      const installed = await install.install;\n\n      featureInstall = await install.result;\n\n      if (!installed) {\n        // The dependencies were recorded but never fetched — the features are\n        // not usable, so they are failures, not successes.\n        const reason = `their packages were not installed (${reasonFrom(featureInstall)})`;\n\n        for (const feature of addedFeatures) {\n          failedFeatures.push({ feature, reason });\n        }\n\n        addedFeatures = [];\n      }\n    }\n\n    if (failedFeatures.length === 0) {\n      featuresSpinner.stop(spinnerMessages.featuresAdded);\n    } else {\n      featuresSpinner.stop(\n        addedFeatures.length > 0\n          ? spinnerMessages.featuresPartial\n          : spinnerMessages.featuresFailed,\n      );\n\n      problems.push({\n        step: \"Features\",\n        detail: failedFeatures\n          .map(({ feature, reason }) => `${feature}: ${reason}`)\n          .join(\"\\n     \"),\n        result: featureInstall?.ok === false ? featureInstall : undefined,\n        hints: [\n          `Retry inside the project with: npx warlock add ${failedFeatures\n            .map(({ feature }) => feature)\n            .join(\" \")}`,\n        ],\n      });\n    }\n  }\n\n  // Step 4: Initialize Git repository if requested\n  if (useGit) {\n    const gitSpinner = spinner();\n    gitSpinner.start(spinnerMessages.initializingGit);\n\n    const initialized = await application.git();\n\n    gitSpinner.stop(\n      initialized ? spinnerMessages.gitInitialized : spinnerMessages.gitFailed,\n    );\n\n    if (!initialized) {\n      const failure = takeLastCommandOutput();\n\n      problems.push({\n        step: \"Git repository\",\n        detail: `The repository was not initialized: ${reasonFrom(failure)}`,\n        result: failure,\n        hints: [\n          \"Check that git is installed and that user.name / user.email are configured, then run `git init` yourself.\",\n        ],\n      });\n    }\n  }\n\n  // Step 5: Generate JWT or warm cache\n  if (useJWT) {\n    const jwtSpinner = spinner();\n    jwtSpinner.start(spinnerMessages.generatingJwt);\n\n    const command = runPackageManagerCommand(\"jwt\");\n    const generated = await application.exec(command);\n\n    jwtSpinner.stop(\n      generated ? spinnerMessages.jwtGenerated : spinnerMessages.jwtFailed,\n    );\n\n    if (!generated) {\n      const failure = takeLastCommandOutput();\n\n      problems.push({\n        step: \"JWT secrets\",\n        detail: `No JWT secrets were written to .env: ${reasonFrom(failure)}`,\n        result: failure,\n        hints: [`Run \\`${command}\\` inside the project before starting it.`],\n      });\n    }\n  } else {\n    // The warm cache is a start-up optimisation, not something the user asked\n    // for: report it, but it does not make the scaffold a failure.\n    const warmSpinner = spinner();\n    warmSpinner.start(spinnerMessages.warmingCache);\n\n    const warmed = await application.exec(\"npx warlock --warm-cache\");\n\n    warmSpinner.stop(\n      warmed ? spinnerMessages.cacheWarmed : spinnerMessages.cacheWarmFailed,\n    );\n\n    if (!warmed) takeLastCommandOutput();\n  }\n\n  // Step 6: Report what actually happened — the summary may only advertise\n  // features that are really in the project.\n  const requestedFeatures = [...features, ...aiProviders];\n  const missingFeatures = failedFeatures\n    .map(({ feature }) => feature)\n    .filter(feature => requestedFeatures.includes(feature));\n  const installedFeatures = requestedFeatures.filter(\n    feature => !missingFeatures.includes(feature),\n  );\n\n  if (problems.length > 0) {\n    showProblems(problems);\n\n    showPartialScreen({\n      projectName: application.name,\n      database: getDatabaseLabel(databaseDriver),\n      features: installedFeatures,\n      missingFeatures,\n      packageManager: getPackageManager(),\n    });\n\n    printDecisionsSummary({ packageManager: getPackageManager(), options });\n\n    return { ok: false, problems };\n  }\n\n  showSuccessScreen({\n    projectName: application.name,\n    database: getDatabaseLabel(databaseDriver),\n    features: installedFeatures,\n    packageManager: getPackageManager(),\n  });\n\n  printDecisionsSummary({ packageManager: getPackageManager(), options });\n\n  return { ok: true, problems };\n}\n"],"mappings":";;;;;;;;;;;;AAmCA,SAAS,WAAW,QAA2C;CAC7D,IAAI,CAAC,QAAQ,OAAO;CAEpB,IAAI,OAAO,OACT,OAAO,OAAO,MAAM,WAAW,OAAO,OAAO,KAAK;CAGpD,MAAM,WAAW,GAAG,OAAO,OAAO,IAAI,OAAO,SAC1C,MAAM,OAAO,CAAC,CACd,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,CACxB,OAAO,OAAO,CAAC,CACf,IAAI;CAEP,MAAM,SACJ,OAAO,SAAS,OACZ,aAAa,OAAO,UAAU,wBAC9B,aAAa,OAAO;CAE1B,OAAO,WAAW,GAAG,OAAO,KAAK,aAAa;AAChD;AAEA,eAAsB,iBACpB,aAC0B;CAC1B,MAAM,UAAU,YAAY;CAC5B,MAAM,EAAE,QAAQ,QAAQ,UAAU,aAAa,mBAAmB;CAClE,MAAM,aAAa,aAAa,cAAc;CAC9C,MAAM,WAAsB,CAAC;CAK7B,MAAM,EAAE,UAAU,UAAU,MAAM,uBAAuB;CAGzD,MAAM,kBAAkB,QAAQ;CAChC,gBAAgB,MAAM,gBAAgB,eAAe;CAErD,IAAI;EACF,YACG,KAAK,CAAC,CACN,IAAI,SAAS,CAAC,CACd,kBAAkB,QAAQ,CAAC,CAC3B,aAAa;EAIhB,IAAI,YACF,YAAY,qBAAqB;OAC5B;GACL,YAAY,qBAAqB,cAAc;GAC/C,YAAY,wBAAwB,cAAc;EACpD;EAEA,YAAY,oBAAoB,SAAS,SAAS,KAAK,CAAC;EACxD,YAAY,yBAAyB,QAAQ,UAAU,CAAC,QAAQ,CAAC;CACnE,SAAS,OAAO;EACd,gBAAgB,KAAK,gBAAgB,cAAc;EAEnD,YAAY;GACV,MAAM;GACN,QAAQ,2CAA4C,MAAgB;GACpE,OAAO,CACL,4FACF;EACF,CAAC;CACH;CAEA,gBAAgB,KAAK,gBAAgB,cAAc;CAEnD,UAAU,KAAK;CAKf,MAAM,iBAAiB,QAAQ;CAC/B,eAAe,MAAM,gBAAgB,cAAc;CAEnD,MAAM,cAAc,YAAY,QAAQ;CACxC,MAAM,gBAAgB,MAAM,YAAY;CACxC,MAAM,oBAAoB,MAAM,YAAY;CAE5C,IAAI,CAAC,eAAe;EAClB,eAAe,KAAK,gBAAgB,UAAU;EAE9C,YAAY;GACV,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,OAAO,oBAAoB,iBAAiB;EAC9C,CAAC;CACH;CAEA,eAAe,KAAK,gBAAgB,aAAa;CAMjD,MAAM,mBAAmB;EACvB,GAAI,aAAa,CAAC,IAAI,CAAC,cAAc;EACrC,GAAG;EACH,GAAG;CACL;CAGA,MAAM,iBAAwD,CAAC;CAE/D,IAAI,iBAAiB,SAAS,GAAG;EAC/B,MAAM,kBAAkB,QAAQ;EAChC,gBAAgB,MAAM,gBAAgB,cAAc;EAEpD,IAAI,gBAAgB;EAEpB,IAAI,CAAE,MAAM,YAAY,gBAAgB,gBAAgB,GAAI;GAI1D,MAAM,eAAe,sBAAsB;GAE3C,gBAAgB,CAAC;GAEjB,KAAK,MAAM,WAAW,kBACpB,IAAI,MAAM,YAAY,gBAAgB,CAAC,OAAO,CAAC,GAC7C,cAAc,KAAK,OAAO;QAE1B,eAAe,KAAK;IAClB;IACA,QAAQ,WAAW,sBAAsB,KAAK,YAAY;GAC5D,CAAC;EAGP;EAEA,IAAI;EAEJ,IAAI,cAAc,SAAS,GAAG;GAM5B,YAAY,kBAAkB;GAE9B,MAAM,UAAU,YAAY,QAAQ;GACpC,MAAM,YAAY,MAAM,QAAQ;GAEhC,iBAAiB,MAAM,QAAQ;GAE/B,IAAI,CAAC,WAAW;IAGd,MAAM,SAAS,sCAAsC,WAAW,cAAc,EAAE;IAEhF,KAAK,MAAM,WAAW,eACpB,eAAe,KAAK;KAAE;KAAS;IAAO,CAAC;IAGzC,gBAAgB,CAAC;GACnB;EACF;EAEA,IAAI,eAAe,WAAW,GAC5B,gBAAgB,KAAK,gBAAgB,aAAa;OAC7C;GACL,gBAAgB,KACd,cAAc,SAAS,IACnB,gBAAgB,kBAChB,gBAAgB,cACtB;GAEA,SAAS,KAAK;IACZ,MAAM;IACN,QAAQ,eACL,KAAK,EAAE,SAAS,aAAa,GAAG,QAAQ,IAAI,QAAQ,CAAC,CACrD,KAAK,SAAS;IACjB,QAAQ,gBAAgB,OAAO,QAAQ,iBAAiB;IACxD,OAAO,CACL,kDAAkD,eAC/C,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,KAAK,GAAG,GACb;GACF,CAAC;EACH;CACF;CAGA,IAAI,QAAQ;EACV,MAAM,aAAa,QAAQ;EAC3B,WAAW,MAAM,gBAAgB,eAAe;EAEhD,MAAM,cAAc,MAAM,YAAY,IAAI;EAE1C,WAAW,KACT,cAAc,gBAAgB,iBAAiB,gBAAgB,SACjE;EAEA,IAAI,CAAC,aAAa;GAChB,MAAM,UAAU,sBAAsB;GAEtC,SAAS,KAAK;IACZ,MAAM;IACN,QAAQ,uCAAuC,WAAW,OAAO;IACjE,QAAQ;IACR,OAAO,CACL,2GACF;GACF,CAAC;EACH;CACF;CAGA,IAAI,QAAQ;EACV,MAAM,aAAa,QAAQ;EAC3B,WAAW,MAAM,gBAAgB,aAAa;EAE9C,MAAM,UAAU,yBAAyB,KAAK;EAC9C,MAAM,YAAY,MAAM,YAAY,KAAK,OAAO;EAEhD,WAAW,KACT,YAAY,gBAAgB,eAAe,gBAAgB,SAC7D;EAEA,IAAI,CAAC,WAAW;GACd,MAAM,UAAU,sBAAsB;GAEtC,SAAS,KAAK;IACZ,MAAM;IACN,QAAQ,wCAAwC,WAAW,OAAO;IAClE,QAAQ;IACR,OAAO,CAAC,SAAS,QAAQ,0CAA0C;GACrE,CAAC;EACH;CACF,OAAO;EAGL,MAAM,cAAc,QAAQ;EAC5B,YAAY,MAAM,gBAAgB,YAAY;EAE9C,MAAM,SAAS,MAAM,YAAY,KAAK,0BAA0B;EAEhE,YAAY,KACV,SAAS,gBAAgB,cAAc,gBAAgB,eACzD;EAEA,IAAI,CAAC,QAAQ,sBAAsB;CACrC;CAIA,MAAM,oBAAoB,CAAC,GAAG,UAAU,GAAG,WAAW;CACtD,MAAM,kBAAkB,eACrB,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,QAAO,YAAW,kBAAkB,SAAS,OAAO,CAAC;CACxD,MAAM,oBAAoB,kBAAkB,QAC1C,YAAW,CAAC,gBAAgB,SAAS,OAAO,CAC9C;CAEA,IAAI,SAAS,SAAS,GAAG;EACvB,aAAa,QAAQ;EAErB,kBAAkB;GAChB,aAAa,YAAY;GACzB,UAAU,iBAAiB,cAAc;GACzC,UAAU;GACV;GACA,gBAAgB,kBAAkB;EACpC,CAAC;EAED,sBAAsB;GAAE,gBAAgB,kBAAkB;GAAG;EAAQ,CAAC;EAEtE,OAAO;GAAE,IAAI;GAAO;EAAS;CAC/B;CAEA,kBAAkB;EAChB,aAAa,YAAY;EACzB,UAAU,iBAAiB,cAAc;EACzC,UAAU;EACV,gBAAgB,kBAAkB;CACpC,CAAC;CAED,sBAAsB;EAAE,gBAAgB,kBAAkB;EAAG;CAAQ,CAAC;CAEtE,OAAO;EAAE,IAAI;EAAM;CAAS;AAC9B"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../create-warlock/src/commands/create-warlock-app/index.ts"],"sourcesContent":["import {\n  getDatabaseLabel,\n  isNoDatabase,\n} from \"../../features/database-drivers\";\nimport { App } from \"../../helpers/app\";\nimport { CommandResult, takeLastCommandOutput } from \"../../helpers/exec\";\nimport {\n  getPackageManager,\n  runPackageManagerCommand,\n} from \"../../helpers/package-manager\";\nimport { resolveWarlockVersions } from \"../../helpers/warlock-versions\";\nimport { printDecisionsSummary } from \"../../summary\";\nimport { showSuccessScreen } from \"../../ui/banner\";\nimport {\n  failFatally,\n  installFailureHints,\n  Problem,\n  showNotes,\n  showPartialScreen,\n  showProblems,\n} from \"../../ui/report\";\nimport { spinner } from \"../../ui/spinner\";\nimport { spinnerMessages } from \"../../ui/spinners\";\n\n/**\n * What the scaffold actually achieved. `ok` is false when ANY step the user\n * asked for did not happen; the caller turns that into a non-zero exit code so\n * a script never mistakes a half-built project for a finished one.\n */\nexport type ScaffoldOutcome = {\n  ok: boolean;\n  problems: Problem[];\n};\n\n/** One-line \"why did this fail\" pulled out of a captured command. */\nfunction reasonFrom(result: CommandResult | undefined): string {\n  if (!result) return \"the command reported a failure (no output captured)\";\n\n  if (result.error) {\n    return result.error.message || String(result.error);\n  }\n\n  const lastLine = `${result.stderr}\\n${result.stdout}`\n    .split(/\\r?\\n/)\n    .map(line => line.trim())\n    .filter(Boolean)\n    .pop();\n\n  const status =\n    result.code === null\n      ? `killed by ${result.signal ?? \"an unknown signal\"}`\n      : `exit code ${result.code}`;\n\n  return lastLine ? `${status} — ${lastLine}` : status;\n}\n\nexport async function createWarlockApp(\n  application: App,\n): Promise<ScaffoldOutcome> {\n  const options = application.options;\n  const { useGit, useJWT, features, aiProviders, databaseDriver } = options;\n  const noDatabase = isNoDatabase(databaseDriver);\n  const problems: Problem[] = [];\n\n  // Resolve the versions to pin BEFORE anything is written. The scaffolder's\n  // own version is only used when the registry confirms it exists — see\n  // helpers/warlock-versions.ts for why an unverified pin broke every install.\n  const { versions, notes } = await resolveWarlockVersions();\n\n  // Step 1: Initialize and copy template\n  const templateSpinner = spinner();\n  templateSpinner.start(spinnerMessages.copyingTemplate);\n\n  try {\n    application\n      .init()\n      .use(\"warlock\")\n      .updatePackageJson(versions)\n      .updateDotEnv();\n\n    // Wire the chosen database driver into .env — or, when the user opted out,\n    // strip the database config entirely so the app boots with no database.\n    if (noDatabase) {\n      application.removeDatabaseConfig();\n    } else {\n      application.configureDatabaseEnv(databaseDriver);\n      application.configureDatabaseConfig(databaseDriver);\n    }\n\n    application.configureWebStarter(features.includes(\"web\"));\n    application.configureAgentKitTargets(options.agents ?? [\"claude\"]);\n  } catch (error) {\n    templateSpinner.stop(spinnerMessages.templateFailed);\n\n    failFatally({\n      step: \"Template copy\",\n      detail: `The project files could not be written: ${(error as Error).message}`,\n      hints: [\n        \"Check that the target directory is writable and that no file is locked by another process.\",\n      ],\n    });\n  }\n\n  templateSpinner.stop(spinnerMessages.templateCopied);\n\n  showNotes(notes);\n\n  // Step 2: Install base dependencies (so the `warlock` binary is available).\n  // Nothing downstream works without this, so a failure ends the run — loudly,\n  // with the command, its exit code and its output.\n  const installSpinner = spinner();\n  installSpinner.start(spinnerMessages.installingDeps);\n\n  const baseInstall = application.install();\n  const baseInstalled = await baseInstall.install;\n  const baseInstallResult = await baseInstall.result;\n\n  if (!baseInstalled) {\n    installSpinner.stop(spinnerMessages.depsFailed);\n\n    failFatally({\n      step: \"Dependency install\",\n      detail: \"The project's dependencies were not installed.\",\n      result: baseInstallResult,\n      hints: installFailureHints(baseInstallResult),\n    });\n  }\n\n  installSpinner.stop(spinnerMessages.depsInstalled);\n\n  // Step 3: Add features via `warlock add --no-install`, then one batched install.\n  // The DB driver, optional features, and AI providers all go through the single\n  // source of truth (core's feature map) so versions never drift. When no\n  // database was chosen, the driver is omitted (there is no `none` feature).\n  const selectedFeatures = [\n    ...(noDatabase ? [] : [databaseDriver]),\n    ...features,\n    ...aiProviders,\n  ];\n\n  // Features the user asked for that are not in the project when we finish.\n  const failedFeatures: { feature: string; reason: string }[] = [];\n\n  if (selectedFeatures.length > 0) {\n    const featuresSpinner = spinner();\n    featuresSpinner.start(spinnerMessages.addingFeatures);\n\n    let addedFeatures = selectedFeatures;\n\n    if (!(await application.installFeatures(selectedFeatures))) {\n      // The batch is all-or-nothing, so it cannot say WHICH feature broke it.\n      // Retry them one at a time: every feature that can be added still gets\n      // added, and every one that cannot gets its own reason.\n      const batchFailure = takeLastCommandOutput();\n\n      addedFeatures = [];\n\n      for (const feature of selectedFeatures) {\n        if (await application.installFeatures([feature])) {\n          addedFeatures.push(feature);\n        } else {\n          failedFeatures.push({\n            feature,\n            reason: reasonFrom(takeLastCommandOutput() ?? batchFailure),\n          });\n        }\n      }\n    }\n\n    let featureInstall: CommandResult | undefined;\n\n    if (addedFeatures.length > 0) {\n      // `warlock add` records the feature dependencies but does not reconcile\n      // them with each other. The `web` feature brings `vite` while the\n      // template always brings `vitest`, whose own vite range resolves to a\n      // different major — two copies, and yarn 1 aborts the whole link phase\n      // on them. Pin one copy BEFORE the batched install, not after.\n      application.pinViteResolution();\n\n      const install = application.install();\n      const installed = await install.install;\n\n      featureInstall = await install.result;\n\n      if (!installed) {\n        // The dependencies were recorded but never fetched — the features are\n        // not usable, so they are failures, not successes.\n        const reason = `their packages were not installed (${reasonFrom(featureInstall)})`;\n\n        for (const feature of addedFeatures) {\n          failedFeatures.push({ feature, reason });\n        }\n\n        addedFeatures = [];\n      }\n    }\n\n    if (failedFeatures.length === 0) {\n      featuresSpinner.stop(spinnerMessages.featuresAdded);\n    } else {\n      featuresSpinner.stop(\n        addedFeatures.length > 0\n          ? spinnerMessages.featuresPartial\n          : spinnerMessages.featuresFailed,\n      );\n\n      problems.push({\n        step: \"Features\",\n        detail: failedFeatures\n          .map(({ feature, reason }) => `${feature}: ${reason}`)\n          .join(\"\\n     \"),\n        result: featureInstall?.ok === false ? featureInstall : undefined,\n        hints: [\n          `Retry inside the project with: npx warlock add ${failedFeatures\n            .map(({ feature }) => feature)\n            .join(\" \")}`,\n        ],\n      });\n    }\n  }\n\n  // Step 4: Initialize Git repository if requested\n  if (useGit) {\n    const gitSpinner = spinner();\n    gitSpinner.start(spinnerMessages.initializingGit);\n\n    const initialized = await application.git();\n\n    gitSpinner.stop(\n      initialized ? spinnerMessages.gitInitialized : spinnerMessages.gitFailed,\n    );\n\n    if (!initialized) {\n      const failure = takeLastCommandOutput();\n\n      problems.push({\n        step: \"Git repository\",\n        detail: `The repository was not initialized: ${reasonFrom(failure)}`,\n        result: failure,\n        hints: [\n          \"Check that git is installed and that user.name / user.email are configured, then run `git init` yourself.\",\n        ],\n      });\n    }\n  }\n\n  // Step 5: Generate JWT or warm cache\n  if (useJWT) {\n    const jwtSpinner = spinner();\n    jwtSpinner.start(spinnerMessages.generatingJwt);\n\n    const command = runPackageManagerCommand(\"jwt\");\n    const generated = await application.exec(command);\n\n    jwtSpinner.stop(\n      generated ? spinnerMessages.jwtGenerated : spinnerMessages.jwtFailed,\n    );\n\n    if (!generated) {\n      const failure = takeLastCommandOutput();\n\n      problems.push({\n        step: \"JWT secrets\",\n        detail: `No JWT secrets were written to .env: ${reasonFrom(failure)}`,\n        result: failure,\n        hints: [`Run \\`${command}\\` inside the project before starting it.`],\n      });\n    }\n  } else {\n    // The warm cache is a start-up optimisation, not something the user asked\n    // for: report it, but it does not make the scaffold a failure.\n    const warmSpinner = spinner();\n    warmSpinner.start(spinnerMessages.warmingCache);\n\n    const warmed = await application.exec(\"npx warlock --warm-cache\");\n\n    warmSpinner.stop(\n      warmed ? spinnerMessages.cacheWarmed : spinnerMessages.cacheWarmFailed,\n    );\n\n    if (!warmed) takeLastCommandOutput();\n  }\n\n  // Step 6: Report what actually happened — the summary may only advertise\n  // features that are really in the project.\n  const requestedFeatures = [...features, ...aiProviders];\n  const missingFeatures = failedFeatures\n    .map(({ feature }) => feature)\n    .filter(feature => requestedFeatures.includes(feature));\n  const installedFeatures = requestedFeatures.filter(\n    feature => !missingFeatures.includes(feature),\n  );\n\n  if (problems.length > 0) {\n    showProblems(problems);\n\n    showPartialScreen({\n      projectName: application.name,\n      database: getDatabaseLabel(databaseDriver),\n      features: installedFeatures,\n      missingFeatures,\n      packageManager: getPackageManager(),\n    });\n\n    printDecisionsSummary({ packageManager: getPackageManager(), options });\n\n    return { ok: false, problems };\n  }\n\n  showSuccessScreen({\n    projectName: application.name,\n    database: getDatabaseLabel(databaseDriver),\n    features: installedFeatures,\n    packageManager: getPackageManager(),\n  });\n\n  printDecisionsSummary({ packageManager: getPackageManager(), options });\n\n  return { ok: true, problems };\n}\n"],"mappings":";;;;;;;;;;;;AAmCA,SAAS,WAAW,QAA2C;CAC7D,IAAI,CAAC,QAAQ,OAAO;CAEpB,IAAI,OAAO,OACT,OAAO,OAAO,MAAM,WAAW,OAAO,OAAO,KAAK;CAGpD,MAAM,WAAW,GAAG,OAAO,OAAO,IAAI,OAAO,SAC1C,MAAM,OAAO,CAAC,CACd,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,CACxB,OAAO,OAAO,CAAC,CACf,IAAI;CAEP,MAAM,SACJ,OAAO,SAAS,OACZ,aAAa,OAAO,UAAU,wBAC9B,aAAa,OAAO;CAE1B,OAAO,WAAW,GAAG,OAAO,KAAK,aAAa;AAChD;AAEA,eAAsB,iBACpB,aAC0B;CAC1B,MAAM,UAAU,YAAY;CAC5B,MAAM,EAAE,QAAQ,QAAQ,UAAU,aAAa,mBAAmB;CAClE,MAAM,aAAa,aAAa,cAAc;CAC9C,MAAM,WAAsB,CAAC;CAK7B,MAAM,EAAE,UAAU,UAAU,MAAM,uBAAuB;CAGzD,MAAM,kBAAkB,QAAQ;CAChC,gBAAgB,MAAM,gBAAgB,eAAe;CAErD,IAAI;EACF,YACG,KAAK,CAAC,CACN,IAAI,SAAS,CAAC,CACd,kBAAkB,QAAQ,CAAC,CAC3B,aAAa;EAIhB,IAAI,YACF,YAAY,qBAAqB;OAC5B;GACL,YAAY,qBAAqB,cAAc;GAC/C,YAAY,wBAAwB,cAAc;EACpD;EAEA,YAAY,oBAAoB,SAAS,SAAS,KAAK,CAAC;EACxD,YAAY,yBAAyB,QAAQ,UAAU,CAAC,QAAQ,CAAC;CACnE,SAAS,OAAO;EACd,gBAAgB,KAAK,gBAAgB,cAAc;EAEnD,YAAY;GACV,MAAM;GACN,QAAQ,2CAA4C,MAAgB;GACpE,OAAO,CACL,4FACF;EACF,CAAC;CACH;CAEA,gBAAgB,KAAK,gBAAgB,cAAc;CAEnD,UAAU,KAAK;CAKf,MAAM,iBAAiB,QAAQ;CAC/B,eAAe,MAAM,gBAAgB,cAAc;CAEnD,MAAM,cAAc,YAAY,QAAQ;CACxC,MAAM,gBAAgB,MAAM,YAAY;CACxC,MAAM,oBAAoB,MAAM,YAAY;CAE5C,IAAI,CAAC,eAAe;EAClB,eAAe,KAAK,gBAAgB,UAAU;EAE9C,YAAY;GACV,MAAM;GACN,QAAQ;GACR,QAAQ;GACR,OAAO,oBAAoB,iBAAiB;EAC9C,CAAC;CACH;CAEA,eAAe,KAAK,gBAAgB,aAAa;CAMjD,MAAM,mBAAmB;EACvB,GAAI,aAAa,CAAC,IAAI,CAAC,cAAc;EACrC,GAAG;EACH,GAAG;CACL;CAGA,MAAM,iBAAwD,CAAC;CAE/D,IAAI,iBAAiB,SAAS,GAAG;EAC/B,MAAM,kBAAkB,QAAQ;EAChC,gBAAgB,MAAM,gBAAgB,cAAc;EAEpD,IAAI,gBAAgB;EAEpB,IAAI,CAAE,MAAM,YAAY,gBAAgB,gBAAgB,GAAI;GAI1D,MAAM,eAAe,sBAAsB;GAE3C,gBAAgB,CAAC;GAEjB,KAAK,MAAM,WAAW,kBACpB,IAAI,MAAM,YAAY,gBAAgB,CAAC,OAAO,CAAC,GAC7C,cAAc,KAAK,OAAO;QAE1B,eAAe,KAAK;IAClB;IACA,QAAQ,WAAW,sBAAsB,KAAK,YAAY;GAC5D,CAAC;EAGP;EAEA,IAAI;EAEJ,IAAI,cAAc,SAAS,GAAG;GAM5B,YAAY,kBAAkB;GAE9B,MAAM,UAAU,YAAY,QAAQ;GACpC,MAAM,YAAY,MAAM,QAAQ;GAEhC,iBAAiB,MAAM,QAAQ;GAE/B,IAAI,CAAC,WAAW;IAGd,MAAM,SAAS,sCAAsC,WAAW,cAAc,EAAE;IAEhF,KAAK,MAAM,WAAW,eACpB,eAAe,KAAK;KAAE;KAAS;IAAO,CAAC;IAGzC,gBAAgB,CAAC;GACnB;EACF;EAEA,IAAI,eAAe,WAAW,GAC5B,gBAAgB,KAAK,gBAAgB,aAAa;OAC7C;GACL,gBAAgB,KACd,cAAc,SAAS,IACnB,gBAAgB,kBAChB,gBAAgB,cACtB;GAEA,SAAS,KAAK;IACZ,MAAM;IACN,QAAQ,eACL,KAAK,EAAE,SAAS,aAAa,GAAG,QAAQ,IAAI,QAAQ,CAAC,CACrD,KAAK,SAAS;IACjB,QAAQ,gBAAgB,OAAO,QAAQ,iBAAiB;IACxD,OAAO,CACL,kDAAkD,eAC/C,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,KAAK,GAAG,GACb;GACF,CAAC;EACH;CACF;CAGA,IAAI,QAAQ;EACV,MAAM,aAAa,QAAQ;EAC3B,WAAW,MAAM,gBAAgB,eAAe;EAEhD,MAAM,cAAc,MAAM,YAAY,IAAI;EAE1C,WAAW,KACT,cAAc,gBAAgB,iBAAiB,gBAAgB,SACjE;EAEA,IAAI,CAAC,aAAa;GAChB,MAAM,UAAU,sBAAsB;GAEtC,SAAS,KAAK;IACZ,MAAM;IACN,QAAQ,uCAAuC,WAAW,OAAO;IACjE,QAAQ;IACR,OAAO,CACL,2GACF;GACF,CAAC;EACH;CACF;CAGA,IAAI,QAAQ;EACV,MAAM,aAAa,QAAQ;EAC3B,WAAW,MAAM,gBAAgB,aAAa;EAE9C,MAAM,UAAU,yBAAyB,KAAK;EAC9C,MAAM,YAAY,MAAM,YAAY,KAAK,OAAO;EAEhD,WAAW,KACT,YAAY,gBAAgB,eAAe,gBAAgB,SAC7D;EAEA,IAAI,CAAC,WAAW;GACd,MAAM,UAAU,sBAAsB;GAEtC,SAAS,KAAK;IACZ,MAAM;IACN,QAAQ,wCAAwC,WAAW,OAAO;IAClE,QAAQ;IACR,OAAO,CAAC,SAAS,QAAQ,0CAA0C;GACrE,CAAC;EACH;CACF,OAAO;EAGL,MAAM,cAAc,QAAQ;EAC5B,YAAY,MAAM,gBAAgB,YAAY;EAE9C,MAAM,SAAS,MAAM,YAAY,KAAK,0BAA0B;EAEhE,YAAY,KACV,SAAS,gBAAgB,cAAc,gBAAgB,eACzD;EAEA,IAAI,CAAC,QAAQ,sBAAsB;CACrC;CAIA,MAAM,oBAAoB,CAAC,GAAG,UAAU,GAAG,WAAW;CACtD,MAAM,kBAAkB,eACrB,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,QAAO,YAAW,kBAAkB,SAAS,OAAO,CAAC;CACxD,MAAM,oBAAoB,kBAAkB,QAC1C,YAAW,CAAC,gBAAgB,SAAS,OAAO,CAC9C;CAEA,IAAI,SAAS,SAAS,GAAG;EACvB,aAAa,QAAQ;EAErB,kBAAkB;GAChB,aAAa,YAAY;GACzB,UAAU,iBAAiB,cAAc;GACzC,UAAU;GACV;GACA,gBAAgB,kBAAkB;EACpC,CAAC;EAED,sBAAsB;GAAE,gBAAgB,kBAAkB;GAAG;EAAQ,CAAC;EAEtE,OAAO;GAAE,IAAI;GAAO;EAAS;CAC/B;CAEA,kBAAkB;EAChB,aAAa,YAAY;EACzB,UAAU,iBAAiB,cAAc;EACzC,UAAU;EACV,gBAAgB,kBAAkB;CACpC,CAAC;CAED,sBAAsB;EAAE,gBAAgB,kBAAkB;EAAG;CAAQ,CAAC;CAEtE,OAAO;EAAE,IAAI;EAAM;CAAS;AAC9B"}

package/esm/features/agent-kit-targets.mjs

@@ -25,6 +25,19 @@ const BUILTIN_AGENT_KIT_TARGETS = ["claude"];
 /** The default `--agents` value when the flag is not passed. */
 const DEFAULT_AGENT_KIT_TARGET = "claude";
 const AGENT_KIT_LLMS_URL = "https://mongez.js.org/agent-kit/llms.txt";
+/**
+* How long the whole remote lookup may take.
+*
+* An unbounded `fetch` does not fail on a stalled network — it WAITS, and a
+* caller that only handles rejection never gets to run its fallback. The
+* scaffolder's wizard asks this question six answers in, so "hangs forever"
+* is strictly worse than "gives up and offers the built-ins".
+*
+* Each request carries an abort signal so the socket is actually torn down,
+* and {@link getValidAgentKitTargets} additionally races the whole operation,
+* because an injected `fetchImpl` is under no obligation to honour a signal.
+*/
+const AGENT_KIT_FETCH_TIMEOUT_MS = 5e3;
 /** Local cache of the last successfully fetched/derived target list. */
 function cacheFilePath() {
 	const base = process.env.XDG_CACHE_HOME ?? path.join(homedir(), ".cache");
@@ -69,13 +82,13 @@ function readInstalledPackageTargets() {
 * itself), so the concrete slug list is parsed from the source rather than
 * retyped here.
 */
-async function fetchRemoteAgentKitTargets(fetchImpl = fetch) {
-	const indexResponse = await fetchImpl(AGENT_KIT_LLMS_URL);
+async function fetchRemoteAgentKitTargets(fetchImpl = fetch, timeoutMs = AGENT_KIT_FETCH_TIMEOUT_MS) {
+	const indexResponse = await fetchImpl(AGENT_KIT_LLMS_URL, { signal: AbortSignal.timeout(timeoutMs) });
 	if (!indexResponse.ok) throw new Error(`agent-kit llms.txt request failed with HTTP ${indexResponse.status}`);
 	const docUrl = (await indexResponse.text()).match(/\[Agent integrations\]\((https:\/\/[^)]+agent-integrations[^)]*)\)/)?.[1]?.replace("github.com", "raw.githubusercontent.com").replace("/blob/", "/");
 	const targets = /* @__PURE__ */ new Set();
 	if (docUrl) {
-		const docResponse = await fetchImpl(docUrl);
+		const docResponse = await fetchImpl(docUrl, { signal: AbortSignal.timeout(timeoutMs) });
 		if (docResponse.ok) {
 			const doc = await docResponse.text();
 			for (const match of doc.matchAll(/--target[= ]([a-z][a-z0-9-]*)/gi)) {
@@ -95,11 +108,11 @@ async function fetchRemoteAgentKitTargets(fetchImpl = fetch) {
 * explicitly requested NON-default target, where a silent fallback to a
 * stale or guessed list would be worse than a clear failure.
 */
-async function getValidAgentKitTargets(fetchImpl = fetch) {
+async function getValidAgentKitTargets(fetchImpl = fetch, timeoutMs = AGENT_KIT_FETCH_TIMEOUT_MS) {
 	const installed = readInstalledPackageTargets();
 	if (installed && installed.length > 0) return dedupe([...BUILTIN_AGENT_KIT_TARGETS, ...installed]);
 	try {
-		const fetched = await fetchRemoteAgentKitTargets(fetchImpl);
+		const fetched = await withTimeout(fetchRemoteAgentKitTargets(fetchImpl, timeoutMs), timeoutMs);
 		writeCache(fetched);
 		return dedupe([...BUILTIN_AGENT_KIT_TARGETS, ...fetched]);
 	} catch (fetchError) {
@@ -108,6 +121,24 @@ async function getValidAgentKitTargets(fetchImpl = fetch) {
 		throw new Error(`Could not determine the valid agent-kit targets (fetch failed and no cache exists): ${fetchError.message}`);
 	}
 }
+/**
+* Reject if `work` has not settled within `timeoutMs`.
+*
+* The abort signals on each request cover the real network; this covers the
+* case they cannot — a `fetchImpl` that ignores its signal, or a promise that
+* simply never settles. Without it "bounded" would be a property of the
+* happy path only.
+*/
+async function withTimeout(work, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([work, new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`agent-kit target lookup timed out after ${timeoutMs}ms`)), timeoutMs);
+		})]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
 function dedupe(values) {
 	return [...new Set(values)];
 }
@@ -130,5 +161,5 @@ async function resolveAgentTargets(requested, fetchImpl = fetch) {
 }
 
 //#endregion
-export { resolveAgentTargets };
+export { BUILTIN_AGENT_KIT_TARGETS, DEFAULT_AGENT_KIT_TARGET, getValidAgentKitTargets, resolveAgentTargets };
 //# sourceMappingURL=agent-kit-targets.mjs.map

package/esm/features/agent-kit-targets.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"agent-kit-targets.mjs","names":[],"sources":["../../../../../../create-warlock/src/features/agent-kit-targets.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport { homedir, tmpdir } from \"node:os\";\nimport path from \"node:path\";\n\nconst requireFromHere = createRequire(import.meta.url);\n\n/**\n * `agent-kit` target selection for the scaffolder's `--agents` flag.\n *\n * The valid target list is NOT hardcoded here as a literal source of truth —\n * it is derived, in order of preference, from:\n *\n *   1. The `@mongez/agent-kit` package installed alongside `create-warlock`\n *      itself, when its own metadata exposes a target list.\n *   2. A runtime fetch of https://mongez.js.org/agent-kit/llms.txt, cached\n *      locally so repeated runs do not refetch.\n *\n * The one exception is `claude`, the default target: it MUST work fully\n * offline, so it is a tiny built-in fallback rather than something that ever\n * depends on a successful network call.\n */\n\n/** The only target guaranteed valid with no network access and no cache. */\nexport const BUILTIN_AGENT_KIT_TARGETS: readonly string[] = [\"claude\"];\n\n/** The default `--agents` value when the flag is not passed. */\nexport const DEFAULT_AGENT_KIT_TARGET = \"claude\";\n\nconst AGENT_KIT_LLMS_URL = \"https://mongez.js.org/agent-kit/llms.txt\";\n\n/** Local cache of the last successfully fetched/derived target list. */\nfunction cacheFilePath(): string {\n  const base = process.env.XDG_CACHE_HOME ?? path.join(homedir(), \".cache\");\n  return path.join(base, \"create-warlock\", \"agent-kit-targets.json\");\n}\n\nfunction readCache(): string[] | undefined {\n  try {\n    const raw = readFileSync(cacheFilePath(), \"utf8\");\n    const parsed = JSON.parse(raw) as { targets?: unknown };\n    if (Array.isArray(parsed.targets)) {\n      return parsed.targets.filter(\n        (value): value is string => typeof value === \"string\",\n      );\n    }\n    return undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction writeCache(targets: string[]): void {\n  try {\n    const filePath = cacheFilePath();\n    mkdirSync(path.dirname(filePath), { recursive: true });\n    writeFileSync(\n      filePath,\n      JSON.stringify({ targets, fetchedAt: new Date().toISOString() }),\n      \"utf8\",\n    );\n  } catch {\n    // The cache is a best-effort convenience — a read-only filesystem must\n    // never turn a successful fetch into a failed run.\n  }\n}\n\n/**\n * Best-effort read of the installed `@mongez/agent-kit` package's own\n * declared target list, when it publishes one. Returns `undefined` (never\n * throws) when the package is not installed or exposes no such metadata —\n * the caller falls back to the network source.\n */\nfunction readInstalledPackageTargets(): string[] | undefined {\n  for (const base of [process.cwd(), tmpdir()]) {\n    try {\n      const packageJsonPath = requireFromHere.resolve(\n        \"@mongez/agent-kit/package.json\",\n        { paths: [base] },\n      );\n      const pkg = JSON.parse(readFileSync(packageJsonPath, \"utf8\")) as {\n        agentKit?: { targets?: unknown };\n      };\n      if (Array.isArray(pkg.agentKit?.targets)) {\n        return pkg.agentKit.targets.filter(\n          (value): value is string => typeof value === \"string\",\n        );\n      }\n    } catch {\n      // Not installed, or no metadata — try the next base / fall through.\n    }\n  }\n  return undefined;\n}\n\n/**\n * Pull the agent-integrations doc's raw `--target <slug>` occurrences out of\n * `agent-kit`'s own llms.txt index (following the link it documents for\n * itself), so the concrete slug list is parsed from the source rather than\n * retyped here.\n */\nexport async function fetchRemoteAgentKitTargets(\n  fetchImpl: typeof fetch = fetch,\n): Promise<string[]> {\n  const indexResponse = await fetchImpl(AGENT_KIT_LLMS_URL);\n  if (!indexResponse.ok) {\n    throw new Error(\n      `agent-kit llms.txt request failed with HTTP ${indexResponse.status}`,\n    );\n  }\n  const index = await indexResponse.text();\n\n  const rawLinkMatch = index.match(\n    /\\[Agent integrations\\]\\((https:\\/\\/[^)]+agent-integrations[^)]*)\\)/,\n  );\n\n  const docUrl = rawLinkMatch?.[1]\n    ?.replace(\"github.com\", \"raw.githubusercontent.com\")\n    .replace(\"/blob/\", \"/\");\n\n  const targets = new Set<string>();\n\n  if (docUrl) {\n    const docResponse = await fetchImpl(docUrl);\n    if (docResponse.ok) {\n      const doc = await docResponse.text();\n      for (const match of doc.matchAll(/--target[= ]([a-z][a-z0-9-]*)/gi)) {\n        const target = match[1];\n\n        if (target) targets.add(target.toLowerCase());\n      }\n    }\n  }\n\n  if (targets.size === 0) {\n    throw new Error(\n      \"Could not parse any agent-kit target names out of the fetched docs\",\n    );\n  }\n\n  return [...targets];\n}\n\n/**\n * Resolve the full list of valid `agent-kit` targets, trying the installed\n * package first, then the cache-backed network fetch.\n *\n * Throws when neither source succeeds — the caller only reaches this for an\n * explicitly requested NON-default target, where a silent fallback to a\n * stale or guessed list would be worse than a clear failure.\n */\nexport async function getValidAgentKitTargets(\n  fetchImpl: typeof fetch = fetch,\n): Promise<string[]> {\n  const installed = readInstalledPackageTargets();\n  if (installed && installed.length > 0) {\n    return dedupe([...BUILTIN_AGENT_KIT_TARGETS, ...installed]);\n  }\n\n  try {\n    const fetched = await fetchRemoteAgentKitTargets(fetchImpl);\n    writeCache(fetched);\n    return dedupe([...BUILTIN_AGENT_KIT_TARGETS, ...fetched]);\n  } catch (fetchError) {\n    const cached = readCache();\n    if (cached && cached.length > 0) {\n      return dedupe([...BUILTIN_AGENT_KIT_TARGETS, ...cached]);\n    }\n    throw new Error(\n      `Could not determine the valid agent-kit targets (fetch failed and no cache exists): ${\n        (fetchError as Error).message\n      }`,\n    );\n  }\n}\n\nfunction dedupe(values: string[]): string[] {\n  return [...new Set(values)];\n}\n\n/**\n * Resolve and validate the `--agents` selection.\n *\n * An unset or empty selection resolves to `[DEFAULT_AGENT_KIT_TARGET]`\n * without touching the disk or the network. A selection made entirely of\n * built-in targets (today, just `claude`) is likewise resolved offline. Only\n * an explicit NON-default target triggers {@link getValidAgentKitTargets},\n * and an invalid one throws, naming every valid target it found.\n */\nexport async function resolveAgentTargets(\n  requested: string[] | undefined,\n  fetchImpl: typeof fetch = fetch,\n): Promise<string[]> {\n  const targets =\n    requested && requested.length > 0\n      ? requested\n      : [DEFAULT_AGENT_KIT_TARGET];\n\n  const needsValidation = targets.some(\n    target => !BUILTIN_AGENT_KIT_TARGETS.includes(target),\n  );\n\n  if (!needsValidation) {\n    return targets;\n  }\n\n  const valid = await getValidAgentKitTargets(fetchImpl);\n  const invalid = targets.filter(target => !valid.includes(target));\n\n  if (invalid.length > 0) {\n    throw new Error(\n      `Unknown agent-kit target(s): ${invalid.join(\", \")} — valid targets: ${valid\n        .slice()\n        .sort()\n        .join(\", \")}`,\n    );\n  }\n\n  return targets;\n}\n"],"mappings":";;;;;;AAKA,MAAM,kBAAkB,cAAc,OAAO,KAAK,GAAG;;;;;;;;;;;;;;;;;AAmBrD,MAAa,4BAA+C,CAAC,QAAQ;;AAGrE,MAAa,2BAA2B;AAExC,MAAM,qBAAqB;;AAG3B,SAAS,gBAAwB;CAC/B,MAAM,OAAO,QAAQ,IAAI,kBAAkB,KAAK,KAAK,QAAQ,GAAG,QAAQ;CACxE,OAAO,KAAK,KAAK,MAAM,kBAAkB,wBAAwB;AACnE;AAEA,SAAS,YAAkC;CACzC,IAAI;EACF,MAAM,MAAM,aAAa,cAAc,GAAG,MAAM;EAChD,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IAAI,MAAM,QAAQ,OAAO,OAAO,GAC9B,OAAO,OAAO,QAAQ,QACnB,UAA2B,OAAO,UAAU,QAC/C;EAEF;CACF,QAAQ;EACN;CACF;AACF;AAEA,SAAS,WAAW,SAAyB;CAC3C,IAAI;EACF,MAAM,WAAW,cAAc;EAC/B,UAAU,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EACrD,cACE,UACA,KAAK,UAAU;GAAE;GAAS,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;EAAE,CAAC,GAC/D,MACF;CACF,QAAQ,CAGR;AACF;;;;;;;AAQA,SAAS,8BAAoD;CAC3D,KAAK,MAAM,QAAQ,CAAC,QAAQ,IAAI,GAAG,OAAO,CAAC,GACzC,IAAI;EACF,MAAM,kBAAkB,gBAAgB,QACtC,kCACA,EAAE,OAAO,CAAC,IAAI,EAAE,CAClB;EACA,MAAM,MAAM,KAAK,MAAM,aAAa,iBAAiB,MAAM,CAAC;EAG5D,IAAI,MAAM,QAAQ,IAAI,UAAU,OAAO,GACrC,OAAO,IAAI,SAAS,QAAQ,QACzB,UAA2B,OAAO,UAAU,QAC/C;CAEJ,QAAQ,CAER;AAGJ;;;;;;;AAQA,eAAsB,2BACpB,YAA0B,OACP;CACnB,MAAM,gBAAgB,MAAM,UAAU,kBAAkB;CACxD,IAAI,CAAC,cAAc,IACjB,MAAM,IAAI,MACR,+CAA+C,cAAc,QAC/D;CAQF,MAAM,UAJe,MAFD,cAAc,KAAK,EAEb,CAAC,MACzB,oEAGwB,CAAC,GAAG,EAAE,EAC5B,QAAQ,cAAc,2BAA2B,CAAC,CACnD,QAAQ,UAAU,GAAG;CAExB,MAAM,0BAAU,IAAI,IAAY;CAEhC,IAAI,QAAQ;EACV,MAAM,cAAc,MAAM,UAAU,MAAM;EAC1C,IAAI,YAAY,IAAI;GAClB,MAAM,MAAM,MAAM,YAAY,KAAK;GACnC,KAAK,MAAM,SAAS,IAAI,SAAS,iCAAiC,GAAG;IACnE,MAAM,SAAS,MAAM;IAErB,IAAI,QAAQ,QAAQ,IAAI,OAAO,YAAY,CAAC;GAC9C;EACF;CACF;CAEA,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MACR,oEACF;CAGF,OAAO,CAAC,GAAG,OAAO;AACpB;;;;;;;;;AAUA,eAAsB,wBACpB,YAA0B,OACP;CACnB,MAAM,YAAY,4BAA4B;CAC9C,IAAI,aAAa,UAAU,SAAS,GAClC,OAAO,OAAO,CAAC,GAAG,2BAA2B,GAAG,SAAS,CAAC;CAG5D,IAAI;EACF,MAAM,UAAU,MAAM,2BAA2B,SAAS;EAC1D,WAAW,OAAO;EAClB,OAAO,OAAO,CAAC,GAAG,2BAA2B,GAAG,OAAO,CAAC;CAC1D,SAAS,YAAY;EACnB,MAAM,SAAS,UAAU;EACzB,IAAI,UAAU,OAAO,SAAS,GAC5B,OAAO,OAAO,CAAC,GAAG,2BAA2B,GAAG,MAAM,CAAC;EAEzD,MAAM,IAAI,MACR,uFACG,WAAqB,SAE1B;CACF;AACF;AAEA,SAAS,OAAO,QAA4B;CAC1C,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;;;;;;;;;;AAWA,eAAsB,oBACpB,WACA,YAA0B,OACP;CACnB,MAAM,UACJ,aAAa,UAAU,SAAS,IAC5B,YACA,CAAC,wBAAwB;CAM/B,IAAI,CAJoB,QAAQ,MAC9B,WAAU,CAAC,0BAA0B,SAAS,MAAM,CAGnC,GACjB,OAAO;CAGT,MAAM,QAAQ,MAAM,wBAAwB,SAAS;CACrD,MAAM,UAAU,QAAQ,QAAO,WAAU,CAAC,MAAM,SAAS,MAAM,CAAC;CAEhE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MACR,gCAAgC,QAAQ,KAAK,IAAI,EAAE,oBAAoB,MACpE,MAAM,CAAC,CACP,KAAK,CAAC,CACN,KAAK,IAAI,GACd;CAGF,OAAO;AACT"}
+{"version":3,"file":"agent-kit-targets.mjs","names":[],"sources":["../../../../../../create-warlock/src/features/agent-kit-targets.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport { homedir, tmpdir } from \"node:os\";\nimport path from \"node:path\";\n\nconst requireFromHere = createRequire(import.meta.url);\n\n/**\n * `agent-kit` target selection for the scaffolder's `--agents` flag.\n *\n * The valid target list is NOT hardcoded here as a literal source of truth —\n * it is derived, in order of preference, from:\n *\n *   1. The `@mongez/agent-kit` package installed alongside `create-warlock`\n *      itself, when its own metadata exposes a target list.\n *   2. A runtime fetch of https://mongez.js.org/agent-kit/llms.txt, cached\n *      locally so repeated runs do not refetch.\n *\n * The one exception is `claude`, the default target: it MUST work fully\n * offline, so it is a tiny built-in fallback rather than something that ever\n * depends on a successful network call.\n */\n\n/** The only target guaranteed valid with no network access and no cache. */\nexport const BUILTIN_AGENT_KIT_TARGETS: readonly string[] = [\"claude\"];\n\n/** The default `--agents` value when the flag is not passed. */\nexport const DEFAULT_AGENT_KIT_TARGET = \"claude\";\n\nconst AGENT_KIT_LLMS_URL = \"https://mongez.js.org/agent-kit/llms.txt\";\n\n/**\n * How long the whole remote lookup may take.\n *\n * An unbounded `fetch` does not fail on a stalled network — it WAITS, and a\n * caller that only handles rejection never gets to run its fallback. The\n * scaffolder's wizard asks this question six answers in, so \"hangs forever\"\n * is strictly worse than \"gives up and offers the built-ins\".\n *\n * Each request carries an abort signal so the socket is actually torn down,\n * and {@link getValidAgentKitTargets} additionally races the whole operation,\n * because an injected `fetchImpl` is under no obligation to honour a signal.\n */\nexport const AGENT_KIT_FETCH_TIMEOUT_MS = 5_000;\n\n/** Local cache of the last successfully fetched/derived target list. */\nfunction cacheFilePath(): string {\n  const base = process.env.XDG_CACHE_HOME ?? path.join(homedir(), \".cache\");\n  return path.join(base, \"create-warlock\", \"agent-kit-targets.json\");\n}\n\nfunction readCache(): string[] | undefined {\n  try {\n    const raw = readFileSync(cacheFilePath(), \"utf8\");\n    const parsed = JSON.parse(raw) as { targets?: unknown };\n    if (Array.isArray(parsed.targets)) {\n      return parsed.targets.filter(\n        (value): value is string => typeof value === \"string\",\n      );\n    }\n    return undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction writeCache(targets: string[]): void {\n  try {\n    const filePath = cacheFilePath();\n    mkdirSync(path.dirname(filePath), { recursive: true });\n    writeFileSync(\n      filePath,\n      JSON.stringify({ targets, fetchedAt: new Date().toISOString() }),\n      \"utf8\",\n    );\n  } catch {\n    // The cache is a best-effort convenience — a read-only filesystem must\n    // never turn a successful fetch into a failed run.\n  }\n}\n\n/**\n * Best-effort read of the installed `@mongez/agent-kit` package's own\n * declared target list, when it publishes one. Returns `undefined` (never\n * throws) when the package is not installed or exposes no such metadata —\n * the caller falls back to the network source.\n */\nfunction readInstalledPackageTargets(): string[] | undefined {\n  for (const base of [process.cwd(), tmpdir()]) {\n    try {\n      const packageJsonPath = requireFromHere.resolve(\n        \"@mongez/agent-kit/package.json\",\n        { paths: [base] },\n      );\n      const pkg = JSON.parse(readFileSync(packageJsonPath, \"utf8\")) as {\n        agentKit?: { targets?: unknown };\n      };\n      if (Array.isArray(pkg.agentKit?.targets)) {\n        return pkg.agentKit.targets.filter(\n          (value): value is string => typeof value === \"string\",\n        );\n      }\n    } catch {\n      // Not installed, or no metadata — try the next base / fall through.\n    }\n  }\n  return undefined;\n}\n\n/**\n * Pull the agent-integrations doc's raw `--target <slug>` occurrences out of\n * `agent-kit`'s own llms.txt index (following the link it documents for\n * itself), so the concrete slug list is parsed from the source rather than\n * retyped here.\n */\nexport async function fetchRemoteAgentKitTargets(\n  fetchImpl: typeof fetch = fetch,\n  timeoutMs: number = AGENT_KIT_FETCH_TIMEOUT_MS,\n): Promise<string[]> {\n  const indexResponse = await fetchImpl(AGENT_KIT_LLMS_URL, {\n    signal: AbortSignal.timeout(timeoutMs),\n  });\n  if (!indexResponse.ok) {\n    throw new Error(\n      `agent-kit llms.txt request failed with HTTP ${indexResponse.status}`,\n    );\n  }\n  const index = await indexResponse.text();\n\n  const rawLinkMatch = index.match(\n    /\\[Agent integrations\\]\\((https:\\/\\/[^)]+agent-integrations[^)]*)\\)/,\n  );\n\n  const docUrl = rawLinkMatch?.[1]\n    ?.replace(\"github.com\", \"raw.githubusercontent.com\")\n    .replace(\"/blob/\", \"/\");\n\n  const targets = new Set<string>();\n\n  if (docUrl) {\n    const docResponse = await fetchImpl(docUrl, {\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n    if (docResponse.ok) {\n      const doc = await docResponse.text();\n      for (const match of doc.matchAll(/--target[= ]([a-z][a-z0-9-]*)/gi)) {\n        const target = match[1];\n\n        if (target) targets.add(target.toLowerCase());\n      }\n    }\n  }\n\n  if (targets.size === 0) {\n    throw new Error(\n      \"Could not parse any agent-kit target names out of the fetched docs\",\n    );\n  }\n\n  return [...targets];\n}\n\n/**\n * Resolve the full list of valid `agent-kit` targets, trying the installed\n * package first, then the cache-backed network fetch.\n *\n * Throws when neither source succeeds — the caller only reaches this for an\n * explicitly requested NON-default target, where a silent fallback to a\n * stale or guessed list would be worse than a clear failure.\n */\nexport async function getValidAgentKitTargets(\n  fetchImpl: typeof fetch = fetch,\n  timeoutMs: number = AGENT_KIT_FETCH_TIMEOUT_MS,\n): Promise<string[]> {\n  const installed = readInstalledPackageTargets();\n  if (installed && installed.length > 0) {\n    return dedupe([...BUILTIN_AGENT_KIT_TARGETS, ...installed]);\n  }\n\n  try {\n    const fetched = await withTimeout(\n      fetchRemoteAgentKitTargets(fetchImpl, timeoutMs),\n      timeoutMs,\n    );\n    writeCache(fetched);\n    return dedupe([...BUILTIN_AGENT_KIT_TARGETS, ...fetched]);\n  } catch (fetchError) {\n    const cached = readCache();\n    if (cached && cached.length > 0) {\n      return dedupe([...BUILTIN_AGENT_KIT_TARGETS, ...cached]);\n    }\n    throw new Error(\n      `Could not determine the valid agent-kit targets (fetch failed and no cache exists): ${\n        (fetchError as Error).message\n      }`,\n    );\n  }\n}\n\n/**\n * Reject if `work` has not settled within `timeoutMs`.\n *\n * The abort signals on each request cover the real network; this covers the\n * case they cannot — a `fetchImpl` that ignores its signal, or a promise that\n * simply never settles. Without it \"bounded\" would be a property of the\n * happy path only.\n */\nexport async function withTimeout<T>(\n  work: Promise<T>,\n  timeoutMs: number,\n): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n\n  try {\n    return await Promise.race([\n      work,\n      new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(\n          () =>\n            reject(\n              new Error(\n                `agent-kit target lookup timed out after ${timeoutMs}ms`,\n              ),\n            ),\n          timeoutMs,\n        );\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nfunction dedupe(values: string[]): string[] {\n  return [...new Set(values)];\n}\n\n/**\n * Resolve and validate the `--agents` selection.\n *\n * An unset or empty selection resolves to `[DEFAULT_AGENT_KIT_TARGET]`\n * without touching the disk or the network. A selection made entirely of\n * built-in targets (today, just `claude`) is likewise resolved offline. Only\n * an explicit NON-default target triggers {@link getValidAgentKitTargets},\n * and an invalid one throws, naming every valid target it found.\n */\nexport async function resolveAgentTargets(\n  requested: string[] | undefined,\n  fetchImpl: typeof fetch = fetch,\n): Promise<string[]> {\n  const targets =\n    requested && requested.length > 0 ? requested : [DEFAULT_AGENT_KIT_TARGET];\n\n  const needsValidation = targets.some(\n    target => !BUILTIN_AGENT_KIT_TARGETS.includes(target),\n  );\n\n  if (!needsValidation) {\n    return targets;\n  }\n\n  const valid = await getValidAgentKitTargets(fetchImpl);\n  const invalid = targets.filter(target => !valid.includes(target));\n\n  if (invalid.length > 0) {\n    throw new Error(\n      `Unknown agent-kit target(s): ${invalid.join(\", \")} — valid targets: ${valid\n        .slice()\n        .sort()\n        .join(\", \")}`,\n    );\n  }\n\n  return targets;\n}\n"],"mappings":";;;;;;AAKA,MAAM,kBAAkB,cAAc,OAAO,KAAK,GAAG;;;;;;;;;;;;;;;;;AAmBrD,MAAa,4BAA+C,CAAC,QAAQ;;AAGrE,MAAa,2BAA2B;AAExC,MAAM,qBAAqB;;;;;;;;;;;;;AAc3B,MAAa,6BAA6B;;AAG1C,SAAS,gBAAwB;CAC/B,MAAM,OAAO,QAAQ,IAAI,kBAAkB,KAAK,KAAK,QAAQ,GAAG,QAAQ;CACxE,OAAO,KAAK,KAAK,MAAM,kBAAkB,wBAAwB;AACnE;AAEA,SAAS,YAAkC;CACzC,IAAI;EACF,MAAM,MAAM,aAAa,cAAc,GAAG,MAAM;EAChD,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IAAI,MAAM,QAAQ,OAAO,OAAO,GAC9B,OAAO,OAAO,QAAQ,QACnB,UAA2B,OAAO,UAAU,QAC/C;EAEF;CACF,QAAQ;EACN;CACF;AACF;AAEA,SAAS,WAAW,SAAyB;CAC3C,IAAI;EACF,MAAM,WAAW,cAAc;EAC/B,UAAU,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EACrD,cACE,UACA,KAAK,UAAU;GAAE;GAAS,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;EAAE,CAAC,GAC/D,MACF;CACF,QAAQ,CAGR;AACF;;;;;;;AAQA,SAAS,8BAAoD;CAC3D,KAAK,MAAM,QAAQ,CAAC,QAAQ,IAAI,GAAG,OAAO,CAAC,GACzC,IAAI;EACF,MAAM,kBAAkB,gBAAgB,QACtC,kCACA,EAAE,OAAO,CAAC,IAAI,EAAE,CAClB;EACA,MAAM,MAAM,KAAK,MAAM,aAAa,iBAAiB,MAAM,CAAC;EAG5D,IAAI,MAAM,QAAQ,IAAI,UAAU,OAAO,GACrC,OAAO,IAAI,SAAS,QAAQ,QACzB,UAA2B,OAAO,UAAU,QAC/C;CAEJ,QAAQ,CAER;AAGJ;;;;;;;AAQA,eAAsB,2BACpB,YAA0B,OAC1B,YAAoB,4BACD;CACnB,MAAM,gBAAgB,MAAM,UAAU,oBAAoB,EACxD,QAAQ,YAAY,QAAQ,SAAS,EACvC,CAAC;CACD,IAAI,CAAC,cAAc,IACjB,MAAM,IAAI,MACR,+CAA+C,cAAc,QAC/D;CAQF,MAAM,UAJe,MAFD,cAAc,KAAK,EAEb,CAAC,MACzB,oEAGwB,CAAC,GAAG,EAAE,EAC5B,QAAQ,cAAc,2BAA2B,CAAC,CACnD,QAAQ,UAAU,GAAG;CAExB,MAAM,0BAAU,IAAI,IAAY;CAEhC,IAAI,QAAQ;EACV,MAAM,cAAc,MAAM,UAAU,QAAQ,EAC1C,QAAQ,YAAY,QAAQ,SAAS,EACvC,CAAC;EACD,IAAI,YAAY,IAAI;GAClB,MAAM,MAAM,MAAM,YAAY,KAAK;GACnC,KAAK,MAAM,SAAS,IAAI,SAAS,iCAAiC,GAAG;IACnE,MAAM,SAAS,MAAM;IAErB,IAAI,QAAQ,QAAQ,IAAI,OAAO,YAAY,CAAC;GAC9C;EACF;CACF;CAEA,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MACR,oEACF;CAGF,OAAO,CAAC,GAAG,OAAO;AACpB;;;;;;;;;AAUA,eAAsB,wBACpB,YAA0B,OAC1B,YAAoB,4BACD;CACnB,MAAM,YAAY,4BAA4B;CAC9C,IAAI,aAAa,UAAU,SAAS,GAClC,OAAO,OAAO,CAAC,GAAG,2BAA2B,GAAG,SAAS,CAAC;CAG5D,IAAI;EACF,MAAM,UAAU,MAAM,YACpB,2BAA2B,WAAW,SAAS,GAC/C,SACF;EACA,WAAW,OAAO;EAClB,OAAO,OAAO,CAAC,GAAG,2BAA2B,GAAG,OAAO,CAAC;CAC1D,SAAS,YAAY;EACnB,MAAM,SAAS,UAAU;EACzB,IAAI,UAAU,OAAO,SAAS,GAC5B,OAAO,OAAO,CAAC,GAAG,2BAA2B,GAAG,MAAM,CAAC;EAEzD,MAAM,IAAI,MACR,uFACG,WAAqB,SAE1B;CACF;AACF;;;;;;;;;AAUA,eAAsB,YACpB,MACA,WACY;CACZ,IAAI;CAEJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,MACA,IAAI,SAAgB,UAAU,WAAW;GACvC,QAAQ,iBAEJ,uBACE,IAAI,MACF,2CAA2C,UAAU,GACvD,CACF,GACF,SACF;EACF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,SAAS,OAAO,QAA4B;CAC1C,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;;;;;;;;;;AAWA,eAAsB,oBACpB,WACA,YAA0B,OACP;CACnB,MAAM,UACJ,aAAa,UAAU,SAAS,IAAI,YAAY,CAAC,wBAAwB;CAM3E,IAAI,CAJoB,QAAQ,MAC9B,WAAU,CAAC,0BAA0B,SAAS,MAAM,CAGnC,GACjB,OAAO;CAGT,MAAM,QAAQ,MAAM,wBAAwB,SAAS;CACrD,MAAM,UAAU,QAAQ,QAAO,WAAU,CAAC,MAAM,SAAS,MAAM,CAAC;CAEhE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MACR,gCAAgC,QAAQ,KAAK,IAAI,EAAE,oBAAoB,MACpE,MAAM,CAAC,CACP,KAAK,CAAC,CACN,KAAK,IAAI,GACd;CAGF,OAAO;AACT"}