@warlock.js/core 4.2.10 → 4.3.0

package/CHANGELOG.md

@@ -6,12 +6,36 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
-- `lowerStage3Decorators()` — shared Vite/Vitest plugin that lowers TC39 Stage-3 decorators with esbuild before oxc / the SSR rewrite mangles them. Drop it first in a config's `plugins` so model-decorated files load under Vitest 4 / Vite 8.
+## 4.3.0 - 2026-06-21
+
+### Added
+
+- `warlock update` — update every `@warlock.js/*` package in package.json to its latest version (operator preserved), then run the detected package manager's install
+- dev-server update notice — `warlock dev` checks npm on start and prints a one-line notice when a newer `@warlock.js/core` is published
+- `devServer.checkForUpdates` config flag (default `true`) to toggle the dev-server update notice
+- `fetchLatestVersion()` and `isNewerVersion()` registry/version utilities
+
+### Fixed
+
+- `warlock dev --skip-typings` and `--skip-health` long-form flags now work (were silently ignored)
+
+## 4.2.11
+
+### Added
+
+- `lowerStage3Decorators()` — Vite/Vitest plugin that lowers TC39 Stage-3 decorators with esbuild before oxc / the SSR rewrite mangles them; drop it first in a config's `plugins` so model-decorated files load under Vitest 4 / Vite 8.
+- `warlock add notifications` — installs `@warlock.js/notifications` (+ the `mail` feature), ejects `config/notifications.ts`, and scaffolds the app-owned `Notification` model + migration into `src/app/notifications/` (idempotent; async queue opt-in).
+- Notifications connector — built-in connector (priority `8`, early phase) reads `config/notifications.ts` at boot and passes it to `setNotificationConfig`; lazy-imports `@warlock.js/notifications` (config-gated), so core keeps no hard dependency on it.
+
+### Changed
+
 - `warlock add test` now scaffolds a `vite.config.ts` that includes `lowerStage3Decorators()`, so a fresh project can test decorated models out of the box.
-- `warlock add test` `test`/`test:coverage` scripts now run one-shot (`vitest run`) instead of watch mode — safe for CI by default.
-- `startHttpTestServer` now starts early-phase connectors (database, cache, logger, …) **before** loading app modules, then late-phase connectors (http, socket) after — mirroring the dev/prod boot order. Fixes a `MissingDataSourceError` when a module's `main.ts` boot side-effect queries the DB at import time under the Vitest integration harness.
-- `warlock add notifications` — new feature in the `add` command: installs `@warlock.js/notifications` (and pulls the `mail` feature for the default mail channel), ejects `config/notifications.ts` (mail + in-app channels wired), and scaffolds the app-owned `Notification` model + a timestamped migration into `src/app/notifications/`. Re-running is idempotent (the model file is the sentinel — no duplicate migration). The async queue stays opt-in (commented in the config; enable with `warlock add herald` + `heraldQueue()`).
-- **Notifications connector** — a built-in connector (priority `8`, early phase) reads `config/notifications.ts` at boot and hands its default export to `setNotificationConfig`. `@warlock.js/notifications` is lazy-imported (gated on the config's presence), so core keeps no hard dependency on it — the same pattern as the herald connector. Config files stay declarative (`export default config`); the side-effect moves out of the config file.
+- `warlock add test` `test` / `test:coverage` scripts now run one-shot (`vitest run`) instead of watch mode — CI-safe by default.
+- Bumped `@mongez/reinforcements` to 3.3.0
+
+### Fixed
+
+- `startHttpTestServer` now starts early-phase connectors (database, cache, logger, …) before loading app modules, then late-phase (http, socket) after — mirroring dev/prod boot order; fixes a `MissingDataSourceError` when a module's boot side-effect queries the DB at import under the Vitest integration harness.
 
 ## 4.2.5
 

package/esm/cli/commands/dev-server.command.mjs

@@ -1,5 +1,6 @@
 import { command } from "../cli-command.mjs";
 import { displayStartupBanner } from "../cli-commands.utils.mjs";
+import { checkForFrameworkUpdate } from "../../dev-server/check-for-updates.mjs";
 import { startDevelopmentServer } from "../../dev-server/start-development-server.mjs";
 
 //#region ../@warlock.js/core/src/cli/commands/dev-server.command.ts
@@ -20,9 +21,10 @@ const devServerCommand = command({
 	action: async (data) => {
 		await startDevelopmentServer({
 			fresh: Boolean(data.options.fresh),
-			generateTypings: data.options["skip-typings"] ? false : void 0,
-			healthCheckers: data.options["skip-health"] ? false : void 0
+			generateTypings: data.options.skipTypings ? false : void 0,
+			healthCheckers: data.options.skipHealth ? false : void 0
 		});
+		checkForFrameworkUpdate();
 	},
 	options: [
 		{

package/esm/cli/commands/dev-server.command.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.command.mjs","names":[],"sources":["../../../../../../../../@warlock.js/core/src/cli/commands/dev-server.command.ts"],"sourcesContent":["import { startDevelopmentServer } from \"../../dev-server/start-development-server\";\r\nimport { command } from \"../cli-command\";\r\nimport { displayStartupBanner } from \"../cli-commands.utils\";\r\n\r\nexport const devServerCommand = command({\r\n  name: \"dev\",\r\n  description: \"Start development server (HMR, type-gen, health checks)\",\r\n  persistent: true,\r\n  preload: {\r\n    runtimeStrategy: \"development\",\r\n    config: true, // load all config\r\n    bootstrap: true,\r\n    prestart: true, // load prestart file (if exists)\r\n    // Only the Early lifecycle phase starts here; the Late phase\r\n    // (http, socket) starts after app modules load — see\r\n    // development-server.ts STEP 8.5.\r\n    connectors: true,\r\n  },\r\n  preAction: async () => {\r\n    await displayStartupBanner({ environment: \"development\" });\r\n  },\r\n  action: async (data) => {\r\n    await startDevelopmentServer({\r\n      fresh: Boolean(data.options.fresh),\r\n      // Pass `false` only when the CLI flag is explicitly set; `undefined`\r\n      // lets `warlock.config.ts > devServer.*` defaults apply.\r\n      generateTypings: data.options[\"skip-typings\"] ? false : undefined,\r\n      healthCheckers: data.options[\"skip-health\"] ? false : undefined,\r\n    });\r\n  },\r\n  options: [\r\n    {\r\n      text: \"--fresh, -f\",\r\n      description: \"Delete .warlock/manifest.json before start (force full re-parse from disk)\",\r\n      type: \"boolean\",\r\n    },\r\n    {\r\n      text: \"--skip-typings, -st\",\r\n      description: \"Skip background type generation for this run\",\r\n      type: \"boolean\",\r\n    },\r\n    {\r\n      text: \"--skip-health, -sh\",\r\n      description: \"Skip file health checkers for this run\",\r\n      type: \"boolean\",\r\n    },\r\n  ],\r\n});\r\n"],"mappings":";;;;;AAIA,MAAa,mBAAmB,QAAQ;CACtC,MAAM;CACN,aAAa;CACb,YAAY;CACZ,SAAS;EACP,iBAAiB;EACjB,QAAQ;EACR,WAAW;EACX,UAAU;EAIV,YAAY;CACd;CACA,WAAW,YAAY;EACrB,MAAM,qBAAqB,EAAE,aAAa,cAAc,CAAC;CAC3D;CACA,QAAQ,OAAO,SAAS;EACtB,MAAM,uBAAuB;GAC3B,OAAO,QAAQ,KAAK,QAAQ,KAAK;GAGjC,iBAAiB,KAAK,QAAQ,kBAAkB,QAAQ;GACxD,gBAAgB,KAAK,QAAQ,iBAAiB,QAAQ;EACxD,CAAC;CACH;CACA,SAAS;EACP;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR;EACA;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR;EACA;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR;CACF;AACF,CAAC"}
+{"version":3,"file":"dev-server.command.mjs","names":[],"sources":["../../../../../../../../@warlock.js/core/src/cli/commands/dev-server.command.ts"],"sourcesContent":["import { checkForFrameworkUpdate } from \"../../dev-server/check-for-updates\";\r\nimport { startDevelopmentServer } from \"../../dev-server/start-development-server\";\r\nimport { command } from \"../cli-command\";\r\nimport { displayStartupBanner } from \"../cli-commands.utils\";\r\n\r\nexport const devServerCommand = command({\r\n  name: \"dev\",\r\n  description: \"Start development server (HMR, type-gen, health checks)\",\r\n  persistent: true,\r\n  preload: {\r\n    runtimeStrategy: \"development\",\r\n    config: true, // load all config\r\n    bootstrap: true,\r\n    prestart: true, // load prestart file (if exists)\r\n    // Only the Early lifecycle phase starts here; the Late phase\r\n    // (http, socket) starts after app modules load — see\r\n    // development-server.ts STEP 8.5.\r\n    connectors: true,\r\n  },\r\n  preAction: async () => {\r\n    await displayStartupBanner({ environment: \"development\" });\r\n  },\r\n  action: async (data) => {\r\n    await startDevelopmentServer({\r\n      fresh: Boolean(data.options.fresh),\r\n      // Pass `false` only when the CLI flag is explicitly set; `undefined`\r\n      // lets `warlock.config.ts > devServer.*` defaults apply.\r\n      generateTypings: data.options.skipTypings ? false : undefined,\r\n      healthCheckers: data.options.skipHealth ? false : undefined,\r\n    });\r\n\r\n    // Fire-and-forget: once the server is ready, surface a one-line notice if\r\n    // a newer @warlock.js/core has been published. Fully self-guarded — it\r\n    // never blocks startup nor breaks dev if the registry is unreachable.\r\n    void checkForFrameworkUpdate();\r\n  },\r\n  options: [\r\n    {\r\n      text: \"--fresh, -f\",\r\n      description: \"Delete .warlock/manifest.json before start (force full re-parse from disk)\",\r\n      type: \"boolean\",\r\n    },\r\n    {\r\n      text: \"--skip-typings, -st\",\r\n      description: \"Skip background type generation for this run\",\r\n      type: \"boolean\",\r\n    },\r\n    {\r\n      text: \"--skip-health, -sh\",\r\n      description: \"Skip file health checkers for this run\",\r\n      type: \"boolean\",\r\n    },\r\n  ],\r\n});\r\n"],"mappings":";;;;;;AAKA,MAAa,mBAAmB,QAAQ;CACtC,MAAM;CACN,aAAa;CACb,YAAY;CACZ,SAAS;EACP,iBAAiB;EACjB,QAAQ;EACR,WAAW;EACX,UAAU;EAIV,YAAY;CACd;CACA,WAAW,YAAY;EACrB,MAAM,qBAAqB,EAAE,aAAa,cAAc,CAAC;CAC3D;CACA,QAAQ,OAAO,SAAS;EACtB,MAAM,uBAAuB;GAC3B,OAAO,QAAQ,KAAK,QAAQ,KAAK;GAGjC,iBAAiB,KAAK,QAAQ,cAAc,QAAQ;GACpD,gBAAgB,KAAK,QAAQ,aAAa,QAAQ;EACpD,CAAC;EAKD,AAAK,wBAAwB;CAC/B;CACA,SAAS;EACP;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR;EACA;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR;EACA;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR;CACF;AACF,CAAC"}

package/esm/cli/commands/update.command.mjs

@@ -0,0 +1,20 @@
+import { command } from "../cli-command.mjs";
+import { updateWarlockPackages } from "../../updater/update-warlock-packages.mjs";
+
+//#region ../@warlock.js/core/src/cli/commands/update.command.ts
+const updateCommand = command({
+	name: "update",
+	description: "Update all @warlock.js packages in this project to their latest version",
+	action: async (data) => {
+		await updateWarlockPackages({ install: !data.options.noInstall });
+	},
+	options: [{
+		text: "--no-install",
+		description: "Rewrite the @warlock.js versions in package.json without running the package manager install",
+		type: "boolean"
+	}]
+});
+
+//#endregion
+export { updateCommand };
+//# sourceMappingURL=update.command.mjs.map

package/esm/cli/commands/update.command.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.command.mjs","names":[],"sources":["../../../../../../../../@warlock.js/core/src/cli/commands/update.command.ts"],"sourcesContent":["import { updateWarlockPackages } from \"../../updater/update-warlock-packages\";\nimport { command } from \"../cli-command\";\n\nexport const updateCommand = command({\n  name: \"update\",\n  description: \"Update all @warlock.js packages in this project to their latest version\",\n  action: async (data) => {\n    // `parseCliArgs` camelCases every flag, so `--no-install` arrives as\n    // `options.noInstall` (not `options[\"no-install\"]`).\n    await updateWarlockPackages({\n      install: !data.options.noInstall,\n    });\n  },\n  options: [\n    {\n      text: \"--no-install\",\n      description:\n        \"Rewrite the @warlock.js versions in package.json without running the package manager install\",\n      type: \"boolean\",\n    },\n  ],\n});\n"],"mappings":";;;;AAGA,MAAa,gBAAgB,QAAQ;CACnC,MAAM;CACN,aAAa;CACb,QAAQ,OAAO,SAAS;EAGtB,MAAM,sBAAsB,EAC1B,SAAS,CAAC,KAAK,QAAQ,UACzB,CAAC;CACH;CACA,SAAS,CACP;EACE,MAAM;EACN,aACE;EACF,MAAM;CACR,CACF;AACF,CAAC"}

package/esm/cli/framework-cli-commands.mjs

@@ -9,6 +9,7 @@ import { seedCommand } from "./commands/seed.command.mjs";
 import { startProductionCommand } from "./commands/start-production.command.mjs";
 import { storagePutCommand } from "./commands/storage-put.command.mjs";
 import { typingsGeneratorCommand } from "./commands/typings-generator.command.mjs";
+import { updateCommand } from "./commands/update.command.mjs";
 
 //#region ../@warlock.js/core/src/cli/framework-cli-commands.ts
 const frameworkCommands = [
@@ -21,6 +22,7 @@ const frameworkCommands = [
 	createDatabaseCommand,
 	dropTablesCommand,
 	addCommand,
+	updateCommand,
 	generateCommand,
 	generateModuleCommand,
 	generateControllerCommand,

package/esm/cli/framework-cli-commands.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"framework-cli-commands.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/cli/framework-cli-commands.ts"],"sourcesContent":["import { addCommand } from \"./commands/add.command\";\r\nimport { buildCommand } from \"./commands/build.command\";\r\nimport { createDatabaseCommand } from \"./commands/create-database.command\";\r\nimport { devServerCommand } from \"./commands/dev-server.command\";\r\nimport { dropTablesCommand } from \"./commands/drop-tables.command\";\r\nimport {\r\n  generateCommand,\r\n  generateControllerCommand,\r\n  generateMigrationCommand,\r\n  generateModelCommand,\r\n  generateModuleCommand,\r\n  generateRepositoryCommand,\r\n  generateResourceCommand,\r\n  generateServiceCommand,\r\n} from \"./commands/generate/generate.command\";\r\nimport { migrateCommand } from \"./commands/migrate.command\";\r\nimport { seedCommand } from \"./commands/seed.command\";\r\nimport { startProductionCommand } from \"./commands/start-production.command\";\r\nimport { storagePutCommand } from \"./commands/storage-put.command\";\r\nimport { typingsGeneratorCommand } from \"./commands/typings-generator.command\";\r\n\r\nexport const frameworkCommands = [\r\n  // development commands\r\n  devServerCommand,\r\n  typingsGeneratorCommand,\r\n\r\n  // production commands\r\n  buildCommand,\r\n  startProductionCommand,\r\n\r\n  // database commands\r\n  migrateCommand,\r\n  seedCommand,\r\n  createDatabaseCommand,\r\n  dropTablesCommand,\r\n\r\n  // generation/installation commands\r\n  addCommand,\r\n\r\n  // scaffolding commands\r\n  generateCommand,\r\n  generateModuleCommand,\r\n  generateControllerCommand,\r\n  generateServiceCommand,\r\n  generateModelCommand,\r\n  generateRepositoryCommand,\r\n  generateResourceCommand,\r\n  generateMigrationCommand,\r\n\r\n  // storage commands\r\n  storagePutCommand,\r\n];\r\n"],"mappings":";;;;;;;;;;;;;AAqBA,MAAa,oBAAoB;CAE/B;CACA;CAGA;CACA;CAGA;CACA;CACA;CACA;CAGA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;AACF"}
+{"version":3,"file":"framework-cli-commands.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/cli/framework-cli-commands.ts"],"sourcesContent":["import { addCommand } from \"./commands/add.command\";\r\nimport { buildCommand } from \"./commands/build.command\";\r\nimport { createDatabaseCommand } from \"./commands/create-database.command\";\r\nimport { devServerCommand } from \"./commands/dev-server.command\";\r\nimport { dropTablesCommand } from \"./commands/drop-tables.command\";\r\nimport {\r\n  generateCommand,\r\n  generateControllerCommand,\r\n  generateMigrationCommand,\r\n  generateModelCommand,\r\n  generateModuleCommand,\r\n  generateRepositoryCommand,\r\n  generateResourceCommand,\r\n  generateServiceCommand,\r\n} from \"./commands/generate/generate.command\";\r\nimport { migrateCommand } from \"./commands/migrate.command\";\r\nimport { seedCommand } from \"./commands/seed.command\";\r\nimport { startProductionCommand } from \"./commands/start-production.command\";\r\nimport { storagePutCommand } from \"./commands/storage-put.command\";\r\nimport { typingsGeneratorCommand } from \"./commands/typings-generator.command\";\r\nimport { updateCommand } from \"./commands/update.command\";\r\n\r\nexport const frameworkCommands = [\r\n  // development commands\r\n  devServerCommand,\r\n  typingsGeneratorCommand,\r\n\r\n  // production commands\r\n  buildCommand,\r\n  startProductionCommand,\r\n\r\n  // database commands\r\n  migrateCommand,\r\n  seedCommand,\r\n  createDatabaseCommand,\r\n  dropTablesCommand,\r\n\r\n  // generation/installation commands\r\n  addCommand,\r\n  updateCommand,\r\n\r\n  // scaffolding commands\r\n  generateCommand,\r\n  generateModuleCommand,\r\n  generateControllerCommand,\r\n  generateServiceCommand,\r\n  generateModelCommand,\r\n  generateRepositoryCommand,\r\n  generateResourceCommand,\r\n  generateMigrationCommand,\r\n\r\n  // storage commands\r\n  storagePutCommand,\r\n];\r\n"],"mappings":";;;;;;;;;;;;;;AAsBA,MAAa,oBAAoB;CAE/B;CACA;CAGA;CACA;CAGA;CACA;CACA;CACA;CAGA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;AACF"}

package/esm/dev-server/check-for-updates.mjs

@@ -0,0 +1,59 @@
+import { fetchLatestVersion } from "../utils/npm-registry.mjs";
+import { isNewerVersion } from "../utils/version-compare.mjs";
+import { getWarlockVersion } from "../utils/framework-vesion.mjs";
+import { warlockConfigManager } from "../warlock-config/warlock-config.manager.mjs";
+import "../warlock-config/index.mjs";
+import { colors } from "@mongez/copper";
+
+//#region ../@warlock.js/core/src/dev-server/check-for-updates.ts
+/** The package whose version represents the whole (lockstep) family. */
+const CORE_PACKAGE = "@warlock.js/core";
+/** Where developers can read what changed between releases. */
+const CHANGELOG_URL = "https://warlock.js.org/changelog/";
+/**
+* Check npm for a newer `@warlock.js/core` release and, if one exists, print
+* a short non-blocking notice to the terminal. Because the whole family is
+* released in lockstep, core's version stands in for every `@warlock.js/*`
+* package, so a single lookup is enough.
+*
+* Designed to be called fire-and-forget right after the dev server is ready:
+* it never throws, never blocks startup, and stays silent unless there is a
+* genuinely newer version to report. Automatically skipped in CI, in
+* non-interactive (non-TTY) shells, and when `devServer.checkForUpdates` is
+* set to `false`.
+*/
+async function checkForFrameworkUpdate() {
+	try {
+		if (!isUpdateCheckEnabled()) return;
+		if ((await warlockConfigManager.get("devServer"))?.checkForUpdates === false) return;
+		const currentVersion = await getWarlockVersion();
+		const latestVersion = await fetchLatestVersion(CORE_PACKAGE);
+		if (!latestVersion || !isNewerVersion(latestVersion, currentVersion)) return;
+		printUpdateNotice(currentVersion, latestVersion);
+	} catch {}
+}
+/**
+* Whether an update check should run at all in the current environment.
+* Mirrors npm's own update-notifier conventions: stay quiet in CI, in
+* non-interactive shells, and when explicitly opted out via env.
+*/
+function isUpdateCheckEnabled() {
+	if (process.env.CI) return false;
+	if (process.env.NO_UPDATE_NOTIFIER) return false;
+	if (!process.stdout.isTTY) return false;
+	return true;
+}
+/**
+* Print the "update available" notice in the dev-logger's visual style.
+*/
+function printUpdateNotice(currentVersion, latestVersion) {
+	console.log();
+	console.log(`  ${colors.yellow("⚡")} ${colors.bold("A new version of Warlock.js is available")}  ${colors.dim(currentVersion)} ${colors.dim("→")} ${colors.greenBright(latestVersion)}`);
+	console.log(`     ${colors.dim("Run")} ${colors.cyan("npx warlock update")} ${colors.dim("to update all @warlock.js packages")}`);
+	console.log(`     ${colors.dim("Changelog")} ${colors.cyan(CHANGELOG_URL)}`);
+	console.log();
+}
+
+//#endregion
+export { checkForFrameworkUpdate };
+//# sourceMappingURL=check-for-updates.mjs.map

package/esm/dev-server/check-for-updates.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-for-updates.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/dev-server/check-for-updates.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { getWarlockVersion } from \"../utils/framework-vesion\";\nimport { fetchLatestVersion } from \"../utils/npm-registry\";\nimport { isNewerVersion } from \"../utils/version-compare\";\nimport { warlockConfigManager } from \"../warlock-config\";\n\n/** The package whose version represents the whole (lockstep) family. */\nconst CORE_PACKAGE = \"@warlock.js/core\";\n\n/** Where developers can read what changed between releases. */\nconst CHANGELOG_URL = \"https://warlock.js.org/changelog/\";\n\n/**\n * Check npm for a newer `@warlock.js/core` release and, if one exists, print\n * a short non-blocking notice to the terminal. Because the whole family is\n * released in lockstep, core's version stands in for every `@warlock.js/*`\n * package, so a single lookup is enough.\n *\n * Designed to be called fire-and-forget right after the dev server is ready:\n * it never throws, never blocks startup, and stays silent unless there is a\n * genuinely newer version to report. Automatically skipped in CI, in\n * non-interactive (non-TTY) shells, and when `devServer.checkForUpdates` is\n * set to `false`.\n */\nexport async function checkForFrameworkUpdate(): Promise<void> {\n  try {\n    if (!isUpdateCheckEnabled()) {\n      return;\n    }\n\n    const devServerConfig = await warlockConfigManager.get(\"devServer\");\n\n    if (devServerConfig?.checkForUpdates === false) {\n      return;\n    }\n\n    const currentVersion = await getWarlockVersion();\n    const latestVersion = await fetchLatestVersion(CORE_PACKAGE);\n\n    if (!latestVersion || !isNewerVersion(latestVersion, currentVersion)) {\n      return;\n    }\n\n    printUpdateNotice(currentVersion, latestVersion);\n  } catch {\n    // An update check is a convenience — never let it disrupt the dev server.\n  }\n}\n\n/**\n * Whether an update check should run at all in the current environment.\n * Mirrors npm's own update-notifier conventions: stay quiet in CI, in\n * non-interactive shells, and when explicitly opted out via env.\n */\nfunction isUpdateCheckEnabled(): boolean {\n  if (process.env.CI) {\n    return false;\n  }\n\n  if (process.env.NO_UPDATE_NOTIFIER) {\n    return false;\n  }\n\n  if (!process.stdout.isTTY) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Print the \"update available\" notice in the dev-logger's visual style.\n */\nfunction printUpdateNotice(currentVersion: string, latestVersion: string): void {\n  console.log();\n  console.log(\n    `  ${colors.yellow(\"⚡\")} ${colors.bold(\"A new version of Warlock.js is available\")}  ` +\n      `${colors.dim(currentVersion)} ${colors.dim(\"→\")} ${colors.greenBright(latestVersion)}`,\n  );\n  console.log(\n    `     ${colors.dim(\"Run\")} ${colors.cyan(\"npx warlock update\")} ` +\n      `${colors.dim(\"to update all @warlock.js packages\")}`,\n  );\n  console.log(`     ${colors.dim(\"Changelog\")} ${colors.cyan(CHANGELOG_URL)}`);\n  console.log();\n}\n"],"mappings":";;;;;;;;;AAOA,MAAM,eAAe;;AAGrB,MAAM,gBAAgB;;;;;;;;;;;;;AActB,eAAsB,0BAAyC;CAC7D,IAAI;EACF,IAAI,CAAC,qBAAqB,GACxB;EAKF,KAAI,MAF0B,qBAAqB,IAAI,WAAW,EAE/C,EAAE,oBAAoB,OACvC;EAGF,MAAM,iBAAiB,MAAM,kBAAkB;EAC/C,MAAM,gBAAgB,MAAM,mBAAmB,YAAY;EAE3D,IAAI,CAAC,iBAAiB,CAAC,eAAe,eAAe,cAAc,GACjE;EAGF,kBAAkB,gBAAgB,aAAa;CACjD,QAAQ,CAER;AACF;;;;;;AAOA,SAAS,uBAAgC;CACvC,IAAI,QAAQ,IAAI,IACd,OAAO;CAGT,IAAI,QAAQ,IAAI,oBACd,OAAO;CAGT,IAAI,CAAC,QAAQ,OAAO,OAClB,OAAO;CAGT,OAAO;AACT;;;;AAKA,SAAS,kBAAkB,gBAAwB,eAA6B;CAC9E,QAAQ,IAAI;CACZ,QAAQ,IACN,KAAK,OAAO,OAAO,GAAG,EAAE,GAAG,OAAO,KAAK,0CAA0C,EAAE,IAC9E,OAAO,IAAI,cAAc,EAAE,GAAG,OAAO,IAAI,GAAG,EAAE,GAAG,OAAO,YAAY,aAAa,GACxF;CACA,QAAQ,IACN,QAAQ,OAAO,IAAI,KAAK,EAAE,GAAG,OAAO,KAAK,oBAAoB,EAAE,GAC1D,OAAO,IAAI,oCAAoC,GACtD;CACA,QAAQ,IAAI,QAAQ,OAAO,IAAI,WAAW,EAAE,GAAG,OAAO,KAAK,aAAa,GAAG;CAC3E,QAAQ,IAAI;AACd"}

package/esm/index.d.mts

@@ -123,6 +123,7 @@ import { BadSchemaUseCaseError } from "./use-cases/use-case.errors.mjs";
 import { $registerUseCase, $unregisterUseCase, addUseCaseHistory, getUseCase, getUseCaseHistory, getUseCases, increaseUseCaseFailedCalls, increaseUseCaseSuccessCalls } from "./use-cases/use-cases-registry.mjs";
 import { appLog } from "./utils/app-log.mjs";
 import { DatabaseLog, DatabaseLogOptions } from "./utils/database-log.mjs";
+import { fetchLatestVersion } from "./utils/npm-registry.mjs";
 import { appPath, cachePath, configPath, logsPath, paths, publicPath, rootPath, sanitizePath, srcPath, storagePath, tempPath, uploadsPath, warlockPath } from "./utils/paths.mjs";
 import { promiseAllObject } from "./utils/promise-all-object.mjs";
 import { Queue } from "./utils/queue.mjs";
@@ -130,6 +131,7 @@ import { sleep } from "./utils/sleep.mjs";
 import { sluggable } from "./utils/sluggable.mjs";
 import { toJson } from "./utils/to-json.mjs";
 import { assetsUrl, publicUrl, setBaseUrl, uploadsUrl, url } from "./utils/urls.mjs";
+import { isNewerVersion } from "./utils/version-compare.mjs";
 import { existsExceptCurrentIdRule } from "./validation/database/exists-except-current-id.mjs";
 import { existsExceptCurrentUserRule } from "./validation/database/exists-except-current-user.mjs";
 import { ExistsExceptCurrentIdRuleOptions, ExistsExceptCurrentUserRuleOptions, UniqueExceptCurrentIdRuleOptions, UniqueExceptCurrentUserRuleOptions } from "./validation/database/types.mjs";
@@ -145,7 +147,7 @@ import { WarlockConfigManager, isUnknownTsExtensionError, warlockConfigManager }
 import { env } from "@mongez/dotenv";
 import { colors } from "@mongez/copper";
 export * from "@mongez/localization";
-export { $registerUseCase, $unregisterUseCase, AccessConnector, AllRepositoryOptions, AppConfigurations, Application, BadRequestError, BadSchemaUseCaseError, BaseConnector, BaseHealthChecker, type BenchmarkChannel, type BenchmarkConfigurations, type BenchmarkErrorResult, type BenchmarkOptions, BenchmarkProfiler, type BenchmarkProfilerOptions, type BenchmarkResult, BenchmarkSnapshots, type BenchmarkSnapshotsOptions, type BenchmarkStats, type BenchmarkSuccessResult, CLICommand, CLICommandAction, CLICommandOption, CLICommandOptions, CLICommandPreload, CLICommandSource, CacheConnector, type CacheMiddlewareOptions, CachedRepositoryOptions, type CapturedMail, CascadeAdapter, CascadeQueryBuilder, ChunkCallback, CloudDriver, CloudStorageDriverContract, CloudStorageDriverOptions, CloudStorageFileData, CommandActionData, type ConcurrencyLimitOptions, ConfigKey, ConfigKeyRegistry, ConfigName, ConfigRegistry, ConfigSpecialHandlers, ConflictError, Connector, ConnectorLifecyclePhase, ConnectorName, ConnectorPriority, ConnectorsManager, ConsoleChannel, ContainerTypes, CookieOptions, CursorPaginationOptions, CursorPaginationResult, DOSpacesDriver, DatabaseCacheDriver, type DatabaseCacheOptions, DatabaseConnector, DatabaseLog, DatabaseLogModel, DatabaseLogOptions, DecoratorLoweringPlugin, DefineResourceOptions, DeleteManyResult, EncryptionConfigurations, EncryptionPasswordConfigurations, Environment, EslintHealthChecker, EventSubscription, ExistsExceptCurrentIdRuleOptions, ExistsExceptCurrentUserRuleOptions, FastifyInstance, FileNamingStrategy, FileValidationOptions, FileValidator, FileVisibility, FilesOrchestrator, FilterFunction, FilterOperator, FilterOptions, FilterRule, FilterRules, ForbiddenError, GroupedRoutesOptions, HeraldConnector, HttpConfigurations, HttpConnector, HttpError, HttpErrorCodes, type IdempotencyOptions, Image, ImageFormat, ImageInput, ImageTransformCallback, ImageTransformConfig, ImageTransformOptions, type IpFilterOptions, ListOptions, LocalDriver, LocalStorageDriverOptions, LocalizedObject, LogConfigurations, LoggerConnector, MAIL_EVENTS, Mail, type MailAddress, type MailAttachment, type MailConfigurations, MailError, type MailErrorCode, type MailEvents, type MailMode, type MailOptions, type MailPriority, type MailResult, MailerConnector, type MailersConfig, type MaintenanceOptions, Middleware, MiddlewareResponse, MimeTypes, NoopChannel, type NormalizedMail, NotAcceptableError, NotAllowedError, NotificationsConnector, PaginationMode, PaginationResult, PartialMiddleware, PartialPick, PipelineOptions, PrefixConfig, PrefixOptions, PresignedOptions, PresignedUploadOptions, PutDirectoryOptions, PutDirectoryResult, PutOptions, QueryBuilderContract, Queue, R2Driver, R2StorageDriverOptions, type RateLimitOptions, RegisterResource, RegisteredUseCase, RepositoryAdapterContract, RepositoryConfigurations, RepositoryEvent, RepositoryManager, RepositoryOptions, RepositoryOptionsWithCursor, RepositoryOptionsWithPages, Request, RequestContextStore, RequestController, RequestControllerContract, RequestEvent, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestLog, RequestMethod, ResolvedCLICommandOption, Resource, ResourceArraySchema, ResourceCastType, ResourceConstructor, ResourceContract, ResourceFieldBuilder, ResourceFieldBuilderDateOutputOptions, ResourceFieldConfig, ResourceMethod, ResourceNotFoundError, ResourceOutputValueCastType, ResourceSchema, ResourceSelfReference, Response, ResponseBodyValue, ResponseEvent, ResponseSSEController, ResponseSchema, ResponseStatus, ResponseStreamController, Restful, RestfulMiddleware, ReturnedResponse, Route, RouteOptions, RouteResource, Router, RouterGroupCallback, RouterStacks, S3Driver, type SESConfigurations, type SMTPConfigurations, SaveAsOptions, SaveMode, SaveOptions, ScopedStorage, ScopedStorageContract, SeedResult, Seeder, SeederMetadata, SendBufferOptions, SendFileOptions, ServerError, SocketConnector, SocketOptions, Storage, StorageConfigurations, StorageConnector, StorageCopyEventPayload, StorageDriverConfig, StorageDriverContextStore, StorageDriverContract, StorageDriverName, StorageDriverRegistry, StorageDriverType, StorageEventHandler, StorageEventPayload, StorageEventType, StorageFile, StorageFileData, StorageFileInfo, StorageManagerContract, StoragePutEventPayload, TemporaryTokenError, TemporaryTokenPayload, TemporaryTokenValidation, TypedAllRepositoryOptions, TypedRepositoryOptions, TypedRepositoryOptionsWithCursor, TypedRepositoryOptionsWithPages, TypescriptHealthChecker, UPLOADS_DEFAULTS, UnAuthorizedError, UniqueExceptCurrentIdRuleOptions, UniqueExceptCurrentUserRuleOptions, UploadedFile, UploadedFileImageOptions, UploadsConfigurations, UseCase, UseCaseAfterMiddleware, UseCaseBeforeMiddleware, UseCaseBroadcastChannel, UseCaseBroadcastEvent, UseCaseBroadcastOption, UseCaseConfigurations, UseCaseContext, UseCaseErrorResult, UseCaseEventsCallbacksMap, UseCaseGuard, UseCaseHandler, UseCaseOnExecutingContext, UseCaseResult, UseCaseRuntimeOptions, UseCaseWithSchema, ValidationConfiguration, WarlockConfig, WarlockConfigManager, WatermarkConfig, WhereOperator, addUseCaseHistory, anyMatch, app, appLog, appPath, assertMailCount, assertMailSent, assetsUrl, bootstrap, broadcastUseCaseResult, buildIdempotencyCacheKey, cachePath, captureMail, clearTestMailbox, closeAllMailers, closeMailer, colors, command, config, configPath, configSpecialHandlers, connectorsManager, container, createHttpApplication, createRequestStore, decrypt, defaultHttpConfigurations, defineConfig, defineResource, displayEnvironmentMode, encrypt, env, environment, existsExceptCurrentIdRule, existsExceptCurrentUserRule, expectJson, fileExtensionRule, fileRule, fileTypeRule, filesOrchestrator, findMailsBySubject, findMailsTo, fireLifecycleEvent, fromRequest, generateMailId, getDefaultMailConfig, getHttpServer, getLastMail, getLocalized, getMailEventName, getMailMode, getMailboxSize, getMailer, getMailerConfig, getMimeType, getPoolStats, getSocketServer, getTestMailbox, getTestServerUrl, getUseCase, getUseCaseHistory, getUseCases, globalEventsCallbacksMap, globalUseCasesEvents, hashBody, hashPassword, hmacHash, httpConfig, imageRule, increaseUseCaseFailedCalls, increaseUseCaseSuccessCalls, ipMatches, isDevelopmentMode, isProductionMode, isTestMode, isTestServerRunning, isUnknownTsExtensionError, isValidIdempotencyKey, loadS3, logResponse, logsPath, lowerStage3Decorators, mailEvents, measure, middleware, onCleanup, parseJsonResponse, parseSize, paths, promiseAllObject, publicPath, publicUrl, registerAppConfig, registerHttpPlugins, renderReact, renderReactMail, requestContext, resetMailConfig, resolveMailConfig, rootPath, router, runPipeline, sanitizePath, seeder, sendMail, setBaseUrl, setEnvironment, setLogConfigurations, setMailConfigurations, setMailMode, setupTest, sleep, sluggable, srcPath, startHttpServer, startHttpTestServer, stopHttpApplication, stopHttpTestServer, storage, storageConfig, storageConfigurations, storageDriverContext, storagePath, t, tempPath, testDelete, testGet, testPatch, testPost, testPut, testRequest, toJson, uniqueExceptCurrentIdRule, uniqueExceptCurrentUserRule, uploadedFileMetadataSchema, uploadsConfig, uploadsPath, uploadsUrl, url, useCase, useComputedModel, useComputedSlug, useCurrentUser, useHashedPassword, useRequest, useRequestStore, verifyMailer, verifyPassword, warlockConfigManager, warlockPath, wasMailSentTo, wasMailSentWithSubject, wrapResponseInDataKey };
+export { $registerUseCase, $unregisterUseCase, AccessConnector, AllRepositoryOptions, AppConfigurations, Application, BadRequestError, BadSchemaUseCaseError, BaseConnector, BaseHealthChecker, type BenchmarkChannel, type BenchmarkConfigurations, type BenchmarkErrorResult, type BenchmarkOptions, BenchmarkProfiler, type BenchmarkProfilerOptions, type BenchmarkResult, BenchmarkSnapshots, type BenchmarkSnapshotsOptions, type BenchmarkStats, type BenchmarkSuccessResult, CLICommand, CLICommandAction, CLICommandOption, CLICommandOptions, CLICommandPreload, CLICommandSource, CacheConnector, type CacheMiddlewareOptions, CachedRepositoryOptions, type CapturedMail, CascadeAdapter, CascadeQueryBuilder, ChunkCallback, CloudDriver, CloudStorageDriverContract, CloudStorageDriverOptions, CloudStorageFileData, CommandActionData, type ConcurrencyLimitOptions, ConfigKey, ConfigKeyRegistry, ConfigName, ConfigRegistry, ConfigSpecialHandlers, ConflictError, Connector, ConnectorLifecyclePhase, ConnectorName, ConnectorPriority, ConnectorsManager, ConsoleChannel, ContainerTypes, CookieOptions, CursorPaginationOptions, CursorPaginationResult, DOSpacesDriver, DatabaseCacheDriver, type DatabaseCacheOptions, DatabaseConnector, DatabaseLog, DatabaseLogModel, DatabaseLogOptions, DecoratorLoweringPlugin, DefineResourceOptions, DeleteManyResult, EncryptionConfigurations, EncryptionPasswordConfigurations, Environment, EslintHealthChecker, EventSubscription, ExistsExceptCurrentIdRuleOptions, ExistsExceptCurrentUserRuleOptions, FastifyInstance, FileNamingStrategy, FileValidationOptions, FileValidator, FileVisibility, FilesOrchestrator, FilterFunction, FilterOperator, FilterOptions, FilterRule, FilterRules, ForbiddenError, GroupedRoutesOptions, HeraldConnector, HttpConfigurations, HttpConnector, HttpError, HttpErrorCodes, type IdempotencyOptions, Image, ImageFormat, ImageInput, ImageTransformCallback, ImageTransformConfig, ImageTransformOptions, type IpFilterOptions, ListOptions, LocalDriver, LocalStorageDriverOptions, LocalizedObject, LogConfigurations, LoggerConnector, MAIL_EVENTS, Mail, type MailAddress, type MailAttachment, type MailConfigurations, MailError, type MailErrorCode, type MailEvents, type MailMode, type MailOptions, type MailPriority, type MailResult, MailerConnector, type MailersConfig, type MaintenanceOptions, Middleware, MiddlewareResponse, MimeTypes, NoopChannel, type NormalizedMail, NotAcceptableError, NotAllowedError, NotificationsConnector, PaginationMode, PaginationResult, PartialMiddleware, PartialPick, PipelineOptions, PrefixConfig, PrefixOptions, PresignedOptions, PresignedUploadOptions, PutDirectoryOptions, PutDirectoryResult, PutOptions, QueryBuilderContract, Queue, R2Driver, R2StorageDriverOptions, type RateLimitOptions, RegisterResource, RegisteredUseCase, RepositoryAdapterContract, RepositoryConfigurations, RepositoryEvent, RepositoryManager, RepositoryOptions, RepositoryOptionsWithCursor, RepositoryOptionsWithPages, Request, RequestContextStore, RequestController, RequestControllerContract, RequestEvent, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestLog, RequestMethod, ResolvedCLICommandOption, Resource, ResourceArraySchema, ResourceCastType, ResourceConstructor, ResourceContract, ResourceFieldBuilder, ResourceFieldBuilderDateOutputOptions, ResourceFieldConfig, ResourceMethod, ResourceNotFoundError, ResourceOutputValueCastType, ResourceSchema, ResourceSelfReference, Response, ResponseBodyValue, ResponseEvent, ResponseSSEController, ResponseSchema, ResponseStatus, ResponseStreamController, Restful, RestfulMiddleware, ReturnedResponse, Route, RouteOptions, RouteResource, Router, RouterGroupCallback, RouterStacks, S3Driver, type SESConfigurations, type SMTPConfigurations, SaveAsOptions, SaveMode, SaveOptions, ScopedStorage, ScopedStorageContract, SeedResult, Seeder, SeederMetadata, SendBufferOptions, SendFileOptions, ServerError, SocketConnector, SocketOptions, Storage, StorageConfigurations, StorageConnector, StorageCopyEventPayload, StorageDriverConfig, StorageDriverContextStore, StorageDriverContract, StorageDriverName, StorageDriverRegistry, StorageDriverType, StorageEventHandler, StorageEventPayload, StorageEventType, StorageFile, StorageFileData, StorageFileInfo, StorageManagerContract, StoragePutEventPayload, TemporaryTokenError, TemporaryTokenPayload, TemporaryTokenValidation, TypedAllRepositoryOptions, TypedRepositoryOptions, TypedRepositoryOptionsWithCursor, TypedRepositoryOptionsWithPages, TypescriptHealthChecker, UPLOADS_DEFAULTS, UnAuthorizedError, UniqueExceptCurrentIdRuleOptions, UniqueExceptCurrentUserRuleOptions, UploadedFile, UploadedFileImageOptions, UploadsConfigurations, UseCase, UseCaseAfterMiddleware, UseCaseBeforeMiddleware, UseCaseBroadcastChannel, UseCaseBroadcastEvent, UseCaseBroadcastOption, UseCaseConfigurations, UseCaseContext, UseCaseErrorResult, UseCaseEventsCallbacksMap, UseCaseGuard, UseCaseHandler, UseCaseOnExecutingContext, UseCaseResult, UseCaseRuntimeOptions, UseCaseWithSchema, ValidationConfiguration, WarlockConfig, WarlockConfigManager, WatermarkConfig, WhereOperator, addUseCaseHistory, anyMatch, app, appLog, appPath, assertMailCount, assertMailSent, assetsUrl, bootstrap, broadcastUseCaseResult, buildIdempotencyCacheKey, cachePath, captureMail, clearTestMailbox, closeAllMailers, closeMailer, colors, command, config, configPath, configSpecialHandlers, connectorsManager, container, createHttpApplication, createRequestStore, decrypt, defaultHttpConfigurations, defineConfig, defineResource, displayEnvironmentMode, encrypt, env, environment, existsExceptCurrentIdRule, existsExceptCurrentUserRule, expectJson, fetchLatestVersion, fileExtensionRule, fileRule, fileTypeRule, filesOrchestrator, findMailsBySubject, findMailsTo, fireLifecycleEvent, fromRequest, generateMailId, getDefaultMailConfig, getHttpServer, getLastMail, getLocalized, getMailEventName, getMailMode, getMailboxSize, getMailer, getMailerConfig, getMimeType, getPoolStats, getSocketServer, getTestMailbox, getTestServerUrl, getUseCase, getUseCaseHistory, getUseCases, globalEventsCallbacksMap, globalUseCasesEvents, hashBody, hashPassword, hmacHash, httpConfig, imageRule, increaseUseCaseFailedCalls, increaseUseCaseSuccessCalls, ipMatches, isDevelopmentMode, isNewerVersion, isProductionMode, isTestMode, isTestServerRunning, isUnknownTsExtensionError, isValidIdempotencyKey, loadS3, logResponse, logsPath, lowerStage3Decorators, mailEvents, measure, middleware, onCleanup, parseJsonResponse, parseSize, paths, promiseAllObject, publicPath, publicUrl, registerAppConfig, registerHttpPlugins, renderReact, renderReactMail, requestContext, resetMailConfig, resolveMailConfig, rootPath, router, runPipeline, sanitizePath, seeder, sendMail, setBaseUrl, setEnvironment, setLogConfigurations, setMailConfigurations, setMailMode, setupTest, sleep, sluggable, srcPath, startHttpServer, startHttpTestServer, stopHttpApplication, stopHttpTestServer, storage, storageConfig, storageConfigurations, storageDriverContext, storagePath, t, tempPath, testDelete, testGet, testPatch, testPost, testPut, testRequest, toJson, uniqueExceptCurrentIdRule, uniqueExceptCurrentUserRule, uploadedFileMetadataSchema, uploadsConfig, uploadsPath, uploadsUrl, url, useCase, useComputedModel, useComputedSlug, useCurrentUser, useHashedPassword, useRequest, useRequestStore, verifyMailer, verifyPassword, warlockConfigManager, warlockPath, wasMailSentTo, wasMailSentWithSubject, wrapResponseInDataKey };
 import "./config/types.mjs";
 import "./storage/types.mjs";
 import "./validation/types.mjs";

package/esm/index.mjs

@@ -8,6 +8,7 @@ import { DatabaseLog } from "./utils/database-log.mjs";
 import { environment, setEnvironment } from "./utils/environment.mjs";
 import { requestContext, useCurrentUser, useRequest, useRequestStore } from "./http/context/request-context.mjs";
 import { getLocalized } from "./utils/get-localized.mjs";
+import { fetchLatestVersion } from "./utils/npm-registry.mjs";
 import { appPath, cachePath, configPath, logsPath, paths, publicPath, rootPath, sanitizePath, srcPath, storagePath, tempPath, uploadsPath, warlockPath } from "./utils/paths.mjs";
 import { promiseAllObject } from "./utils/promise-all-object.mjs";
 import { Queue } from "./utils/queue.mjs";
@@ -15,6 +16,7 @@ import { sleep } from "./utils/sleep.mjs";
 import { sluggable } from "./utils/sluggable.mjs";
 import { toJson } from "./utils/to-json.mjs";
 import { assetsUrl, publicUrl, setBaseUrl, uploadsUrl, url } from "./utils/urls.mjs";
+import { isNewerVersion } from "./utils/version-compare.mjs";
 import "./utils/index.mjs";
 import { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./http/errors/errors.mjs";
 import { createRequestStore, fromRequest, t } from "./http/middleware/inject-request-context.mjs";
@@ -146,4 +148,4 @@ import { colors } from "@mongez/copper";
 
 export * from "@mongez/localization"
 
-export { $registerUseCase, $unregisterUseCase, AccessConnector, Application, BadRequestError, BadSchemaUseCaseError, BaseConnector, BaseHealthChecker, BenchmarkProfiler, BenchmarkSnapshots, CLICommand, CacheConnector, CascadeAdapter, CascadeQueryBuilder, CloudDriver, ConfigSpecialHandlers, ConflictError, ConnectorLifecyclePhase, ConnectorPriority, ConnectorsManager, ConsoleChannel, DOSpacesDriver, DatabaseCacheDriver, DatabaseConnector, DatabaseLog, DatabaseLogModel, EslintHealthChecker, FileValidator, FilesOrchestrator, ForbiddenError, HeraldConnector, HttpConnector, HttpError, HttpErrorCodes, Image, LocalDriver, LoggerConnector, MAIL_EVENTS, Mail, MailError, MailerConnector, MimeTypes, NoopChannel, NotAcceptableError, NotAllowedError, NotificationsConnector, Queue, R2Driver, RegisterResource, RepositoryManager, Request, RequestController, RequestLog, Resource, ResourceFieldBuilder, ResourceNotFoundError, Response, ResponseStatus, Restful, Router, S3Driver, ScopedStorage, ServerError, SocketConnector, Storage, StorageConnector, StorageFile, TypescriptHealthChecker, UPLOADS_DEFAULTS, UnAuthorizedError, UploadedFile, WarlockConfigManager, addUseCaseHistory, anyMatch, app, appLog, appPath, assertMailCount, assertMailSent, assetsUrl, bootstrap, broadcastUseCaseResult, buildIdempotencyCacheKey, cachePath, captureMail, clearTestMailbox, closeAllMailers, closeMailer, colors, command, config, configPath, configSpecialHandlers, connectorsManager, container, createHttpApplication, createRequestStore, decrypt, defaultHttpConfigurations, defineConfig, defineResource, displayEnvironmentMode, encrypt, env, environment, existsExceptCurrentIdRule, existsExceptCurrentUserRule, expectJson, fileExtensionRule, fileRule, fileTypeRule, filesOrchestrator, findMailsBySubject, findMailsTo, fireLifecycleEvent, fromRequest, generateMailId, getDefaultMailConfig, getHttpServer, getLastMail, getLocalized, getMailEventName, getMailMode, getMailboxSize, getMailer, getMailerConfig, getMimeType, getPoolStats, getSocketServer, getTestMailbox, getTestServerUrl, getUseCase, getUseCaseHistory, getUseCases, globalEventsCallbacksMap, globalUseCasesEvents, hashBody, hashPassword, hmacHash, httpConfig, imageRule, increaseUseCaseFailedCalls, increaseUseCaseSuccessCalls, ipMatches, isDevelopmentMode, isProductionMode, isTestMode, isTestServerRunning, isUnknownTsExtensionError, isValidIdempotencyKey, loadS3, logResponse, logsPath, lowerStage3Decorators, mailEvents, measure, middleware, onCleanup, parseJsonResponse, parseSize, paths, promiseAllObject, publicPath, publicUrl, registerAppConfig, registerHttpPlugins, renderReact, renderReactMail, requestContext, resetMailConfig, resolveMailConfig, rootPath, router, runPipeline, sanitizePath, seeder, sendMail, setBaseUrl, setEnvironment, setLogConfigurations, setMailConfigurations, setMailMode, setupTest, sleep, sluggable, srcPath, startHttpServer, startHttpTestServer, stopHttpApplication, stopHttpTestServer, storage, storageConfig, storageConfigurations, storageDriverContext, storagePath, t, tempPath, testDelete, testGet, testPatch, testPost, testPut, testRequest, toJson, uniqueExceptCurrentIdRule, uniqueExceptCurrentUserRule, uploadedFileMetadataSchema, uploadsConfig, uploadsPath, uploadsUrl, url, useCase, useComputedModel, useComputedSlug, useCurrentUser, useHashedPassword, useRequest, useRequestStore, verifyMailer, verifyPassword, warlockConfigManager, warlockPath, wasMailSentTo, wasMailSentWithSubject, wrapResponseInDataKey };
+export { $registerUseCase, $unregisterUseCase, AccessConnector, Application, BadRequestError, BadSchemaUseCaseError, BaseConnector, BaseHealthChecker, BenchmarkProfiler, BenchmarkSnapshots, CLICommand, CacheConnector, CascadeAdapter, CascadeQueryBuilder, CloudDriver, ConfigSpecialHandlers, ConflictError, ConnectorLifecyclePhase, ConnectorPriority, ConnectorsManager, ConsoleChannel, DOSpacesDriver, DatabaseCacheDriver, DatabaseConnector, DatabaseLog, DatabaseLogModel, EslintHealthChecker, FileValidator, FilesOrchestrator, ForbiddenError, HeraldConnector, HttpConnector, HttpError, HttpErrorCodes, Image, LocalDriver, LoggerConnector, MAIL_EVENTS, Mail, MailError, MailerConnector, MimeTypes, NoopChannel, NotAcceptableError, NotAllowedError, NotificationsConnector, Queue, R2Driver, RegisterResource, RepositoryManager, Request, RequestController, RequestLog, Resource, ResourceFieldBuilder, ResourceNotFoundError, Response, ResponseStatus, Restful, Router, S3Driver, ScopedStorage, ServerError, SocketConnector, Storage, StorageConnector, StorageFile, TypescriptHealthChecker, UPLOADS_DEFAULTS, UnAuthorizedError, UploadedFile, WarlockConfigManager, addUseCaseHistory, anyMatch, app, appLog, appPath, assertMailCount, assertMailSent, assetsUrl, bootstrap, broadcastUseCaseResult, buildIdempotencyCacheKey, cachePath, captureMail, clearTestMailbox, closeAllMailers, closeMailer, colors, command, config, configPath, configSpecialHandlers, connectorsManager, container, createHttpApplication, createRequestStore, decrypt, defaultHttpConfigurations, defineConfig, defineResource, displayEnvironmentMode, encrypt, env, environment, existsExceptCurrentIdRule, existsExceptCurrentUserRule, expectJson, fetchLatestVersion, fileExtensionRule, fileRule, fileTypeRule, filesOrchestrator, findMailsBySubject, findMailsTo, fireLifecycleEvent, fromRequest, generateMailId, getDefaultMailConfig, getHttpServer, getLastMail, getLocalized, getMailEventName, getMailMode, getMailboxSize, getMailer, getMailerConfig, getMimeType, getPoolStats, getSocketServer, getTestMailbox, getTestServerUrl, getUseCase, getUseCaseHistory, getUseCases, globalEventsCallbacksMap, globalUseCasesEvents, hashBody, hashPassword, hmacHash, httpConfig, imageRule, increaseUseCaseFailedCalls, increaseUseCaseSuccessCalls, ipMatches, isDevelopmentMode, isNewerVersion, isProductionMode, isTestMode, isTestServerRunning, isUnknownTsExtensionError, isValidIdempotencyKey, loadS3, logResponse, logsPath, lowerStage3Decorators, mailEvents, measure, middleware, onCleanup, parseJsonResponse, parseSize, paths, promiseAllObject, publicPath, publicUrl, registerAppConfig, registerHttpPlugins, renderReact, renderReactMail, requestContext, resetMailConfig, resolveMailConfig, rootPath, router, runPipeline, sanitizePath, seeder, sendMail, setBaseUrl, setEnvironment, setLogConfigurations, setMailConfigurations, setMailMode, setupTest, sleep, sluggable, srcPath, startHttpServer, startHttpTestServer, stopHttpApplication, stopHttpTestServer, storage, storageConfig, storageConfigurations, storageDriverContext, storagePath, t, tempPath, testDelete, testGet, testPatch, testPost, testPut, testRequest, toJson, uniqueExceptCurrentIdRule, uniqueExceptCurrentUserRule, uploadedFileMetadataSchema, uploadsConfig, uploadsPath, uploadsUrl, url, useCase, useComputedModel, useComputedSlug, useCurrentUser, useHashedPassword, useRequest, useRequestStore, verifyMailer, verifyPassword, warlockConfigManager, warlockPath, wasMailSentTo, wasMailSentWithSubject, wrapResponseInDataKey };

package/esm/updater/package-manager.mjs

@@ -0,0 +1,32 @@
+import { rootPath } from "../utils/paths.mjs";
+import "../utils/index.mjs";
+import { fileExistsAsync } from "@warlock.js/fs";
+
+//#region ../@warlock.js/core/src/updater/package-manager.ts
+/**
+* Detect the project's package manager from its lockfile, falling back to
+* npm when none is present. The lookup order matches `warlock add`, so both
+* commands agree on a project that happens to carry more than one lockfile.
+*/
+async function detectPackageManager() {
+	if (await fileExistsAsync(rootPath("package-lock.json"))) return "npm";
+	if (await fileExistsAsync(rootPath("yarn.lock"))) return "yarn";
+	if (await fileExistsAsync(rootPath("pnpm-lock.yaml"))) return "pnpm";
+	return "npm";
+}
+/**
+* The lockfile-syncing install command for the given manager. No package
+* arguments — `warlock update` rewrites the versions in package.json first,
+* then a plain install reconciles `node_modules` to match.
+*/
+function getInstallCommand(packageManager) {
+	switch (packageManager) {
+		case "yarn": return "yarn install";
+		case "pnpm": return "pnpm install";
+		default: return "npm install";
+	}
+}
+
+//#endregion
+export { detectPackageManager, getInstallCommand };
+//# sourceMappingURL=package-manager.mjs.map

package/esm/updater/package-manager.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/updater/package-manager.ts"],"sourcesContent":["import { fileExistsAsync } from \"@warlock.js/fs\";\nimport { rootPath } from \"../utils\";\n\n/** Package managers the framework knows how to drive. */\nexport type PackageManager = \"npm\" | \"yarn\" | \"pnpm\";\n\n/**\n * Detect the project's package manager from its lockfile, falling back to\n * npm when none is present. The lookup order matches `warlock add`, so both\n * commands agree on a project that happens to carry more than one lockfile.\n */\nexport async function detectPackageManager(): Promise<PackageManager> {\n  if (await fileExistsAsync(rootPath(\"package-lock.json\"))) {\n    return \"npm\";\n  }\n\n  if (await fileExistsAsync(rootPath(\"yarn.lock\"))) {\n    return \"yarn\";\n  }\n\n  if (await fileExistsAsync(rootPath(\"pnpm-lock.yaml\"))) {\n    return \"pnpm\";\n  }\n\n  return \"npm\";\n}\n\n/**\n * The lockfile-syncing install command for the given manager. No package\n * arguments — `warlock update` rewrites the versions in package.json first,\n * then a plain install reconciles `node_modules` to match.\n */\nexport function getInstallCommand(packageManager: PackageManager): string {\n  switch (packageManager) {\n    case \"yarn\":\n      return \"yarn install\";\n\n    case \"pnpm\":\n      return \"pnpm install\";\n\n    default:\n      return \"npm install\";\n  }\n}\n"],"mappings":";;;;;;;;;;AAWA,eAAsB,uBAAgD;CACpE,IAAI,MAAM,gBAAgB,SAAS,mBAAmB,CAAC,GACrD,OAAO;CAGT,IAAI,MAAM,gBAAgB,SAAS,WAAW,CAAC,GAC7C,OAAO;CAGT,IAAI,MAAM,gBAAgB,SAAS,gBAAgB,CAAC,GAClD,OAAO;CAGT,OAAO;AACT;;;;;;AAOA,SAAgB,kBAAkB,gBAAwC;CACxE,QAAQ,gBAAR;EACE,KAAK,QACH,OAAO;EAET,KAAK,QACH,OAAO;EAET,SACE,OAAO;CACX;AACF"}

package/esm/updater/update-warlock-packages.mjs

@@ -0,0 +1,134 @@
+import { fetchLatestVersion } from "../utils/npm-registry.mjs";
+import { rootPath } from "../utils/paths.mjs";
+import { isNewerVersion } from "../utils/version-compare.mjs";
+import "../utils/index.mjs";
+import { detectPackageManager, getInstallCommand } from "./package-manager.mjs";
+import { colors } from "@mongez/copper";
+import { fileExistsAsync, getJsonFileAsync, putJsonFileAsync } from "@warlock.js/fs";
+import { execSync } from "node:child_process";
+
+//#region ../@warlock.js/core/src/updater/update-warlock-packages.ts
+/** Scope prefix that identifies a Warlock framework package. */
+const WARLOCK_SCOPE = "@warlock.js/";
+/** The dependency maps in package.json we update, in display order. */
+const DEPENDENCY_SECTIONS = ["dependencies", "devDependencies"];
+/**
+* Update every `@warlock.js/*` package listed in the project's root
+* package.json to its latest published version, then reconcile `node_modules`
+* via the detected package manager.
+*
+* The original range operator on each dependency (`^`, `~`, or an exact pin)
+* is preserved; specs that aren't a plain semver — `workspace:*`, `*`,
+* `latest`, git/file URLs — are left untouched. Only genuine upgrades are
+* written, so re-running on an already-current project is a no-op.
+*/
+async function updateWarlockPackages(options = {}) {
+	const runInstall = options.install ?? true;
+	const packageJsonPath = rootPath("package.json");
+	if (!await fileExistsAsync(packageJsonPath)) {
+		console.log(`${colors.red("✖")} No package.json found at the project root.`);
+		return;
+	}
+	const packageJson = await getJsonFileAsync(packageJsonPath);
+	const dependencies = collectWarlockDependencies(packageJson);
+	if (dependencies.length === 0) {
+		console.log(`${colors.yellow("⚠")} No @warlock.js packages found in package.json.`);
+		return;
+	}
+	console.log(`${colors.cyan("›")} Checking ${colors.bold(String(dependencies.length))} @warlock.js package(s) for updates…`);
+	const updates = resolvePackageUpdates(await resolveLatestVersions(dependencies));
+	if (updates.length === 0) {
+		console.log(`${colors.green("✓")} All @warlock.js packages are already up to date.`);
+		return;
+	}
+	applyUpdates(packageJson, updates);
+	await putJsonFileAsync(packageJsonPath, packageJson);
+	printUpdates(updates);
+	if (!runInstall) {
+		console.log(colors.dim("Skipped install (--no-install). Run your package manager to apply the changes."));
+		return;
+	}
+	await installDependencies();
+}
+/** Collect every `@warlock.js/*` dependency across the relevant sections. */
+function collectWarlockDependencies(packageJson) {
+	const dependencies = [];
+	for (const section of DEPENDENCY_SECTIONS) {
+		const map = packageJson[section];
+		if (!map) continue;
+		for (const [name, current] of Object.entries(map)) if (name.startsWith(WARLOCK_SCOPE)) dependencies.push({
+			name,
+			section,
+			current
+		});
+	}
+	return dependencies;
+}
+/** Resolve each dependency's latest version from the registry in parallel. */
+async function resolveLatestVersions(dependencies) {
+	return Promise.all(dependencies.map(async (dependency) => ({
+		...dependency,
+		latest: await fetchLatestVersion(dependency.name)
+	})));
+}
+/**
+* Turn resolved dependencies into the concrete set of version bumps to write.
+* Pure (no I/O) so it can be unit-tested directly: skips lookups that failed,
+* non-semver specs, and anything already at (or ahead of) the latest version,
+* and preserves the original range operator on everything it does rewrite.
+*/
+function resolvePackageUpdates(resolved) {
+	const updates = [];
+	for (const dependency of resolved) {
+		if (!dependency.latest) continue;
+		const parsed = parseSpec(dependency.current);
+		if (!parsed) continue;
+		if (!isNewerVersion(dependency.latest, parsed.version)) continue;
+		updates.push({
+			name: dependency.name,
+			section: dependency.section,
+			from: dependency.current,
+			to: `${parsed.operator}${dependency.latest}`
+		});
+	}
+	return updates;
+}
+/**
+* Split a dependency spec into its range operator and concrete version.
+* Returns `undefined` for specs we won't touch — `workspace:*`, `*`,
+* `latest`, multi-part ranges, or git/file URLs — leaving them exactly as
+* the author wrote them.
+*/
+function parseSpec(spec) {
+	const match = spec.trim().match(/^(\^|~)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/);
+	if (!match) return;
+	return {
+		operator: match[1] ?? "",
+		version: match[2]
+	};
+}
+/** Write the resolved bumps back into the package.json object in place. */
+function applyUpdates(packageJson, updates) {
+	for (const update of updates) {
+		const map = packageJson[update.section];
+		if (map) map[update.name] = update.to;
+	}
+}
+/** Print the list of applied version bumps. */
+function printUpdates(updates) {
+	console.log(`${colors.green("✓")} Updated ${colors.bold(String(updates.length))} package(s):`);
+	for (const update of updates) console.log(`   ${colors.cyan(update.name)}  ${colors.dim(update.from)} ${colors.dim("→")} ${colors.greenBright(update.to)}`);
+}
+/** Reconcile node_modules to the rewritten package.json via the project PM. */
+async function installDependencies() {
+	const installCommand = getInstallCommand(await detectPackageManager());
+	console.log(`${colors.cyan("›")} Running ${colors.bold(installCommand)}…`);
+	execSync(installCommand, {
+		cwd: process.cwd(),
+		stdio: "inherit"
+	});
+}
+
+//#endregion
+export { updateWarlockPackages };
+//# sourceMappingURL=update-warlock-packages.mjs.map

package/esm/updater/update-warlock-packages.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-warlock-packages.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/updater/update-warlock-packages.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { fileExistsAsync, getJsonFileAsync, putJsonFileAsync } from \"@warlock.js/fs\";\nimport { execSync } from \"node:child_process\";\nimport { rootPath } from \"../utils\";\nimport { fetchLatestVersion } from \"../utils/npm-registry\";\nimport { isNewerVersion } from \"../utils/version-compare\";\nimport { detectPackageManager, getInstallCommand } from \"./package-manager\";\n\n/** Scope prefix that identifies a Warlock framework package. */\nconst WARLOCK_SCOPE = \"@warlock.js/\";\n\n/** The dependency maps in package.json we update, in display order. */\nconst DEPENDENCY_SECTIONS = [\"dependencies\", \"devDependencies\"] as const;\n\ntype DependencySection = (typeof DEPENDENCY_SECTIONS)[number];\n\ntype DependencyMap = Record<string, string>;\n\ntype PackageJson = Record<string, unknown> & {\n  dependencies?: DependencyMap;\n  devDependencies?: DependencyMap;\n};\n\n/** A `@warlock.js/*` dependency found in package.json. */\ntype WarlockDependency = {\n  name: string;\n  section: DependencySection;\n  /** The current spec exactly as written, e.g. `^4.2.0`. */\n  current: string;\n};\n\n/** A dependency whose latest version has been resolved from the registry. */\nexport type ResolvedDependency = WarlockDependency & {\n  /** Latest version from npm, or `undefined` when the lookup failed. */\n  latest: string | undefined;\n};\n\n/** A concrete version bump to write back into package.json. */\nexport type PackageUpdate = {\n  name: string;\n  section: DependencySection;\n  /** Existing spec, e.g. `^4.2.0`. */\n  from: string;\n  /** New spec with the original range operator preserved, e.g. `^4.3.0`. */\n  to: string;\n};\n\n/** Options accepted by {@link updateWarlockPackages}. */\nexport type UpdateWarlockPackagesOptions = {\n  /** Run the package manager install after rewriting versions (default true). */\n  install?: boolean;\n};\n\n/**\n * Update every `@warlock.js/*` package listed in the project's root\n * package.json to its latest published version, then reconcile `node_modules`\n * via the detected package manager.\n *\n * The original range operator on each dependency (`^`, `~`, or an exact pin)\n * is preserved; specs that aren't a plain semver — `workspace:*`, `*`,\n * `latest`, git/file URLs — are left untouched. Only genuine upgrades are\n * written, so re-running on an already-current project is a no-op.\n */\nexport async function updateWarlockPackages(\n  options: UpdateWarlockPackagesOptions = {},\n): Promise<void> {\n  const runInstall = options.install ?? true;\n  const packageJsonPath = rootPath(\"package.json\");\n\n  if (!(await fileExistsAsync(packageJsonPath))) {\n    console.log(`${colors.red(\"✖\")} No package.json found at the project root.`);\n    return;\n  }\n\n  const packageJson = (await getJsonFileAsync(packageJsonPath)) as PackageJson;\n  const dependencies = collectWarlockDependencies(packageJson);\n\n  if (dependencies.length === 0) {\n    console.log(`${colors.yellow(\"⚠\")} No @warlock.js packages found in package.json.`);\n    return;\n  }\n\n  console.log(\n    `${colors.cyan(\"›\")} Checking ${colors.bold(String(dependencies.length))} ` +\n      `@warlock.js package(s) for updates…`,\n  );\n\n  const resolved = await resolveLatestVersions(dependencies);\n  const updates = resolvePackageUpdates(resolved);\n\n  if (updates.length === 0) {\n    console.log(`${colors.green(\"✓\")} All @warlock.js packages are already up to date.`);\n    return;\n  }\n\n  applyUpdates(packageJson, updates);\n  await putJsonFileAsync(packageJsonPath, packageJson);\n\n  printUpdates(updates);\n\n  if (!runInstall) {\n    console.log(\n      colors.dim(\"Skipped install (--no-install). Run your package manager to apply the changes.\"),\n    );\n    return;\n  }\n\n  await installDependencies();\n}\n\n/** Collect every `@warlock.js/*` dependency across the relevant sections. */\nfunction collectWarlockDependencies(packageJson: PackageJson): WarlockDependency[] {\n  const dependencies: WarlockDependency[] = [];\n\n  for (const section of DEPENDENCY_SECTIONS) {\n    const map = packageJson[section];\n\n    if (!map) {\n      continue;\n    }\n\n    for (const [name, current] of Object.entries(map)) {\n      if (name.startsWith(WARLOCK_SCOPE)) {\n        dependencies.push({ name, section, current });\n      }\n    }\n  }\n\n  return dependencies;\n}\n\n/** Resolve each dependency's latest version from the registry in parallel. */\nasync function resolveLatestVersions(\n  dependencies: WarlockDependency[],\n): Promise<ResolvedDependency[]> {\n  return Promise.all(\n    dependencies.map(async (dependency) => ({\n      ...dependency,\n      latest: await fetchLatestVersion(dependency.name),\n    })),\n  );\n}\n\n/**\n * Turn resolved dependencies into the concrete set of version bumps to write.\n * Pure (no I/O) so it can be unit-tested directly: skips lookups that failed,\n * non-semver specs, and anything already at (or ahead of) the latest version,\n * and preserves the original range operator on everything it does rewrite.\n */\nexport function resolvePackageUpdates(resolved: ResolvedDependency[]): PackageUpdate[] {\n  const updates: PackageUpdate[] = [];\n\n  for (const dependency of resolved) {\n    if (!dependency.latest) {\n      continue;\n    }\n\n    const parsed = parseSpec(dependency.current);\n\n    if (!parsed) {\n      continue;\n    }\n\n    if (!isNewerVersion(dependency.latest, parsed.version)) {\n      continue;\n    }\n\n    updates.push({\n      name: dependency.name,\n      section: dependency.section,\n      from: dependency.current,\n      to: `${parsed.operator}${dependency.latest}`,\n    });\n  }\n\n  return updates;\n}\n\n/**\n * Split a dependency spec into its range operator and concrete version.\n * Returns `undefined` for specs we won't touch — `workspace:*`, `*`,\n * `latest`, multi-part ranges, or git/file URLs — leaving them exactly as\n * the author wrote them.\n */\nfunction parseSpec(spec: string): { operator: string; version: string } | undefined {\n  const match = spec.trim().match(/^(\\^|~)?(\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?)$/);\n\n  if (!match) {\n    return undefined;\n  }\n\n  return { operator: match[1] ?? \"\", version: match[2] };\n}\n\n/** Write the resolved bumps back into the package.json object in place. */\nfunction applyUpdates(packageJson: PackageJson, updates: PackageUpdate[]): void {\n  for (const update of updates) {\n    const map = packageJson[update.section];\n\n    if (map) {\n      map[update.name] = update.to;\n    }\n  }\n}\n\n/** Print the list of applied version bumps. */\nfunction printUpdates(updates: PackageUpdate[]): void {\n  console.log(`${colors.green(\"✓\")} Updated ${colors.bold(String(updates.length))} package(s):`);\n\n  for (const update of updates) {\n    console.log(\n      `   ${colors.cyan(update.name)}  ` +\n        `${colors.dim(update.from)} ${colors.dim(\"→\")} ${colors.greenBright(update.to)}`,\n    );\n  }\n}\n\n/** Reconcile node_modules to the rewritten package.json via the project PM. */\nasync function installDependencies(): Promise<void> {\n  const packageManager = await detectPackageManager();\n  const installCommand = getInstallCommand(packageManager);\n\n  console.log(`${colors.cyan(\"›\")} Running ${colors.bold(installCommand)}…`);\n\n  execSync(installCommand, { cwd: process.cwd(), stdio: \"inherit\" });\n}\n"],"mappings":";;;;;;;;;;;AASA,MAAM,gBAAgB;;AAGtB,MAAM,sBAAsB,CAAC,gBAAgB,iBAAiB;;;;;;;;;;;AAmD9D,eAAsB,sBACpB,UAAwC,CAAC,GAC1B;CACf,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,kBAAkB,SAAS,cAAc;CAE/C,IAAI,CAAE,MAAM,gBAAgB,eAAe,GAAI;EAC7C,QAAQ,IAAI,GAAG,OAAO,IAAI,GAAG,EAAE,4CAA4C;EAC3E;CACF;CAEA,MAAM,cAAe,MAAM,iBAAiB,eAAe;CAC3D,MAAM,eAAe,2BAA2B,WAAW;CAE3D,IAAI,aAAa,WAAW,GAAG;EAC7B,QAAQ,IAAI,GAAG,OAAO,OAAO,GAAG,EAAE,gDAAgD;EAClF;CACF;CAEA,QAAQ,IACN,GAAG,OAAO,KAAK,GAAG,EAAE,YAAY,OAAO,KAAK,OAAO,aAAa,MAAM,CAAC,EAAE,qCAE3E;CAGA,MAAM,UAAU,sBAAsB,MADf,sBAAsB,YAAY,CACX;CAE9C,IAAI,QAAQ,WAAW,GAAG;EACxB,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,kDAAkD;EACnF;CACF;CAEA,aAAa,aAAa,OAAO;CACjC,MAAM,iBAAiB,iBAAiB,WAAW;CAEnD,aAAa,OAAO;CAEpB,IAAI,CAAC,YAAY;EACf,QAAQ,IACN,OAAO,IAAI,gFAAgF,CAC7F;EACA;CACF;CAEA,MAAM,oBAAoB;AAC5B;;AAGA,SAAS,2BAA2B,aAA+C;CACjF,MAAM,eAAoC,CAAC;CAE3C,KAAK,MAAM,WAAW,qBAAqB;EACzC,MAAM,MAAM,YAAY;EAExB,IAAI,CAAC,KACH;EAGF,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,GAAG,GAC9C,IAAI,KAAK,WAAW,aAAa,GAC/B,aAAa,KAAK;GAAE;GAAM;GAAS;EAAQ,CAAC;CAGlD;CAEA,OAAO;AACT;;AAGA,eAAe,sBACb,cAC+B;CAC/B,OAAO,QAAQ,IACb,aAAa,IAAI,OAAO,gBAAgB;EACtC,GAAG;EACH,QAAQ,MAAM,mBAAmB,WAAW,IAAI;CAClD,EAAE,CACJ;AACF;;;;;;;AAQA,SAAgB,sBAAsB,UAAiD;CACrF,MAAM,UAA2B,CAAC;CAElC,KAAK,MAAM,cAAc,UAAU;EACjC,IAAI,CAAC,WAAW,QACd;EAGF,MAAM,SAAS,UAAU,WAAW,OAAO;EAE3C,IAAI,CAAC,QACH;EAGF,IAAI,CAAC,eAAe,WAAW,QAAQ,OAAO,OAAO,GACnD;EAGF,QAAQ,KAAK;GACX,MAAM,WAAW;GACjB,SAAS,WAAW;GACpB,MAAM,WAAW;GACjB,IAAI,GAAG,OAAO,WAAW,WAAW;EACtC,CAAC;CACH;CAEA,OAAO;AACT;;;;;;;AAQA,SAAS,UAAU,MAAiE;CAClF,MAAM,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,8CAA8C;CAE9E,IAAI,CAAC,OACH;CAGF,OAAO;EAAE,UAAU,MAAM,MAAM;EAAI,SAAS,MAAM;CAAG;AACvD;;AAGA,SAAS,aAAa,aAA0B,SAAgC;CAC9E,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,MAAM,YAAY,OAAO;EAE/B,IAAI,KACF,IAAI,OAAO,QAAQ,OAAO;CAE9B;AACF;;AAGA,SAAS,aAAa,SAAgC;CACpD,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,WAAW,OAAO,KAAK,OAAO,QAAQ,MAAM,CAAC,EAAE,aAAa;CAE7F,KAAK,MAAM,UAAU,SACnB,QAAQ,IACN,MAAM,OAAO,KAAK,OAAO,IAAI,EAAE,IAC1B,OAAO,IAAI,OAAO,IAAI,EAAE,GAAG,OAAO,IAAI,GAAG,EAAE,GAAG,OAAO,YAAY,OAAO,EAAE,GACjF;AAEJ;;AAGA,eAAe,sBAAqC;CAElD,MAAM,iBAAiB,kBAAkB,MADZ,qBAAqB,CACK;CAEvD,QAAQ,IAAI,GAAG,OAAO,KAAK,GAAG,EAAE,WAAW,OAAO,KAAK,cAAc,EAAE,EAAE;CAEzE,SAAS,gBAAgB;EAAE,KAAK,QAAQ,IAAI;EAAG,OAAO;CAAU,CAAC;AACnE"}

package/esm/utils/index.d.mts

@@ -2,10 +2,12 @@ import { LocalizedObject, getLocalized } from "./get-localized.mjs";
 import { Environment, environment, setEnvironment } from "./environment.mjs";
 import { appLog } from "./app-log.mjs";
 import { DatabaseLog, DatabaseLogOptions } from "./database-log.mjs";
+import { fetchLatestVersion } from "./npm-registry.mjs";
 import { appPath, cachePath, configPath, logsPath, paths, publicPath, rootPath, sanitizePath, srcPath, storagePath, tempPath, uploadsPath, warlockPath } from "./paths.mjs";
 import { promiseAllObject } from "./promise-all-object.mjs";
 import { Queue } from "./queue.mjs";
 import { sleep } from "./sleep.mjs";
 import { sluggable } from "./sluggable.mjs";
 import { toJson } from "./to-json.mjs";
-import { assetsUrl, publicUrl, setBaseUrl, uploadsUrl, url } from "./urls.mjs";
+import { assetsUrl, publicUrl, setBaseUrl, uploadsUrl, url } from "./urls.mjs";
+import { isNewerVersion } from "./version-compare.mjs";

package/esm/utils/index.mjs

@@ -2,6 +2,7 @@ import { appLog } from "./app-log.mjs";
 import { DatabaseLog } from "./database-log.mjs";
 import { environment, setEnvironment } from "./environment.mjs";
 import { getLocalized } from "./get-localized.mjs";
+import { fetchLatestVersion } from "./npm-registry.mjs";
 import { appPath, cachePath, configPath, logsPath, paths, publicPath, rootPath, sanitizePath, srcPath, storagePath, tempPath, uploadsPath, warlockPath } from "./paths.mjs";
 import { promiseAllObject } from "./promise-all-object.mjs";
 import { Queue } from "./queue.mjs";
@@ -9,5 +10,6 @@ import { sleep } from "./sleep.mjs";
 import { sluggable } from "./sluggable.mjs";
 import { toJson } from "./to-json.mjs";
 import { assetsUrl, publicUrl, setBaseUrl, uploadsUrl, url } from "./urls.mjs";
+import { isNewerVersion } from "./version-compare.mjs";
 
 export {  };

package/esm/utils/npm-registry.d.mts

@@ -0,0 +1,24 @@
+//#region ../@warlock.js/core/src/utils/npm-registry.d.ts
+/**
+ * Minimal npm-registry access for the framework's self-update tooling
+ * (the dev-server update notice + the `warlock update` command).
+ *
+ * No SDK and no caching layer — just the public registry over `fetch`.
+ * Every lookup is best-effort: any failure resolves to `undefined` so a
+ * registry hiccup can never break the dev server or the CLI.
+ */
+/**
+ * Fetch the latest published version of a package from the npm registry.
+ *
+ * Hits the abbreviated `/<package>/latest` endpoint, which returns only the
+ * latest dist-tag manifest (not the full packument). Resolves to `undefined`
+ * on any failure — offline, timeout, non-200 response, or malformed payload —
+ * and never throws, so callers can stay fail-silent.
+ *
+ * @param packageName Fully-qualified npm name, e.g. `@warlock.js/core`.
+ * @param timeoutMs   Abort budget in milliseconds (defaults to 2500).
+ */
+declare function fetchLatestVersion(packageName: string, timeoutMs?: number): Promise<string | undefined>;
+//#endregion
+export { fetchLatestVersion };
+//# sourceMappingURL=npm-registry.d.mts.map

package/esm/utils/npm-registry.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-registry.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/utils/npm-registry.ts"],"mappings":";;AAwBA;;;;;;;;AAGU;;;;;;;;;;iBAHY,kBAAA,CACpB,WAAA,UACA,SAAA,YACC,OAAO"}

package/esm/utils/npm-registry.mjs

@@ -0,0 +1,43 @@
+//#region ../@warlock.js/core/src/utils/npm-registry.ts
+/**
+* Minimal npm-registry access for the framework's self-update tooling
+* (the dev-server update notice + the `warlock update` command).
+*
+* No SDK and no caching layer — just the public registry over `fetch`.
+* Every lookup is best-effort: any failure resolves to `undefined` so a
+* registry hiccup can never break the dev server or the CLI.
+*/
+const REGISTRY_BASE_URL = "https://registry.npmjs.org";
+const DEFAULT_TIMEOUT_MS = 2500;
+/**
+* Fetch the latest published version of a package from the npm registry.
+*
+* Hits the abbreviated `/<package>/latest` endpoint, which returns only the
+* latest dist-tag manifest (not the full packument). Resolves to `undefined`
+* on any failure — offline, timeout, non-200 response, or malformed payload —
+* and never throws, so callers can stay fail-silent.
+*
+* @param packageName Fully-qualified npm name, e.g. `@warlock.js/core`.
+* @param timeoutMs   Abort budget in milliseconds (defaults to 2500).
+*/
+async function fetchLatestVersion(packageName, timeoutMs = DEFAULT_TIMEOUT_MS) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		const response = await fetch(`${REGISTRY_BASE_URL}/${packageName}/latest`, {
+			signal: controller.signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return;
+		const data = await response.json();
+		return typeof data.version === "string" ? data.version : void 0;
+	} catch {
+		return;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+//#endregion
+export { fetchLatestVersion };
+//# sourceMappingURL=npm-registry.mjs.map

package/esm/utils/npm-registry.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-registry.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/utils/npm-registry.ts"],"sourcesContent":["/**\n * Minimal npm-registry access for the framework's self-update tooling\n * (the dev-server update notice + the `warlock update` command).\n *\n * No SDK and no caching layer — just the public registry over `fetch`.\n * Every lookup is best-effort: any failure resolves to `undefined` so a\n * registry hiccup can never break the dev server or the CLI.\n */\n\nconst REGISTRY_BASE_URL = \"https://registry.npmjs.org\";\n\nconst DEFAULT_TIMEOUT_MS = 2500;\n\n/**\n * Fetch the latest published version of a package from the npm registry.\n *\n * Hits the abbreviated `/<package>/latest` endpoint, which returns only the\n * latest dist-tag manifest (not the full packument). Resolves to `undefined`\n * on any failure — offline, timeout, non-200 response, or malformed payload —\n * and never throws, so callers can stay fail-silent.\n *\n * @param packageName Fully-qualified npm name, e.g. `@warlock.js/core`.\n * @param timeoutMs   Abort budget in milliseconds (defaults to 2500).\n */\nexport async function fetchLatestVersion(\n  packageName: string,\n  timeoutMs: number = DEFAULT_TIMEOUT_MS,\n): Promise<string | undefined> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n\n  try {\n    const response = await fetch(`${REGISTRY_BASE_URL}/${packageName}/latest`, {\n      signal: controller.signal,\n      headers: { accept: \"application/json\" },\n    });\n\n    if (!response.ok) {\n      return undefined;\n    }\n\n    const data = (await response.json()) as { version?: unknown };\n\n    return typeof data.version === \"string\" ? data.version : undefined;\n  } catch {\n    // Best-effort: offline, DNS failure, abort/timeout, or bad JSON — all \"unknown\".\n    return undefined;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,oBAAoB;AAE1B,MAAM,qBAAqB;;;;;;;;;;;;AAa3B,eAAsB,mBACpB,aACA,YAAoB,oBACS;CAC7B,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,QAAQ,iBAAiB,WAAW,MAAM,GAAG,SAAS;CAE5D,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,GAAG,kBAAkB,GAAG,YAAY,UAAU;GACzE,QAAQ,WAAW;GACnB,SAAS,EAAE,QAAQ,mBAAmB;EACxC,CAAC;EAED,IAAI,CAAC,SAAS,IACZ;EAGF,MAAM,OAAQ,MAAM,SAAS,KAAK;EAElC,OAAO,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;CAC3D,QAAQ;EAEN;CACF,UAAU;EACR,aAAa,KAAK;CACpB;AACF"}

package/esm/utils/version-compare.d.mts

@@ -0,0 +1,20 @@
+//#region ../@warlock.js/core/src/utils/version-compare.d.ts
+/**
+ * Zero-dependency semver comparison — just enough for the framework's
+ * self-update tooling (the dev-server update notice + the `warlock update`
+ * command).
+ *
+ * We deliberately avoid pulling in a semver library: the only question these
+ * callers ask is "is the published version newer than what's installed?".
+ */
+/**
+ * Return `true` when `latest` is a strictly newer semantic version than
+ * `current`. Compares the numeric `major.minor.patch` first, then treats a
+ * stable release as newer than a prerelease of the same core
+ * (`1.2.0` > `1.2.0-beta`). Unparseable input yields `false` — we never nag
+ * on a version string we can't understand.
+ */
+declare function isNewerVersion(latest: string, current: string): boolean;
+//#endregion
+export { isNewerVersion };
+//# sourceMappingURL=version-compare.d.mts.map

package/esm/utils/version-compare.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-compare.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/utils/version-compare.ts"],"mappings":";;AAkGA;;;;AAA8D;;;;;;;;;;iBAA9C,cAAA,CAAe,MAAA,UAAgB,OAAe"}

package/esm/utils/version-compare.mjs

@@ -0,0 +1,70 @@
+//#region ../@warlock.js/core/src/utils/version-compare.ts
+/**
+* Parse a semver string into its numeric core + prerelease identifiers.
+* Tolerates a leading `v` and ignores build metadata (`+…`). Returns
+* `undefined` when the core isn't exactly three non-negative integers.
+*/
+function parseVersion(version) {
+	const [coreAndPrerelease] = version.trim().replace(/^v/i, "").split("+");
+	const [core, ...prereleaseParts] = coreAndPrerelease.split("-");
+	const segments = core.split(".");
+	if (segments.length !== 3) return;
+	const numbers = segments.map((segment) => Number(segment));
+	if (numbers.some((value) => !Number.isInteger(value) || value < 0)) return;
+	const prerelease = prereleaseParts.length > 0 ? prereleaseParts.join("-").split(".") : [];
+	return {
+		core: [
+			numbers[0],
+			numbers[1],
+			numbers[2]
+		],
+		prerelease
+	};
+}
+/**
+* Compare two prerelease identifier lists per semver rules: numeric
+* identifiers compare numerically, alphanumeric ones lexically, a numeric
+* identifier ranks below an alphanumeric one, and a longer list wins when
+* otherwise equal. Returns a negative / zero / positive number.
+*/
+function comparePrerelease(left, right) {
+	const length = Math.max(left.length, right.length);
+	for (let index = 0; index < length; index++) {
+		const a = left[index];
+		const b = right[index];
+		if (a === void 0) return -1;
+		if (b === void 0) return 1;
+		const aIsNumeric = /^\d+$/.test(a);
+		const bIsNumeric = /^\d+$/.test(b);
+		if (aIsNumeric && bIsNumeric) {
+			const diff = Number(a) - Number(b);
+			if (diff !== 0) return diff;
+			continue;
+		}
+		if (aIsNumeric !== bIsNumeric) return aIsNumeric ? -1 : 1;
+		if (a !== b) return a < b ? -1 : 1;
+	}
+	return 0;
+}
+/**
+* Return `true` when `latest` is a strictly newer semantic version than
+* `current`. Compares the numeric `major.minor.patch` first, then treats a
+* stable release as newer than a prerelease of the same core
+* (`1.2.0` > `1.2.0-beta`). Unparseable input yields `false` — we never nag
+* on a version string we can't understand.
+*/
+function isNewerVersion(latest, current) {
+	const latestParsed = parseVersion(latest);
+	const currentParsed = parseVersion(current);
+	if (!latestParsed || !currentParsed) return false;
+	for (let index = 0; index < 3; index++) if (latestParsed.core[index] !== currentParsed.core[index]) return latestParsed.core[index] > currentParsed.core[index];
+	const latestIsStable = latestParsed.prerelease.length === 0;
+	const currentIsStable = currentParsed.prerelease.length === 0;
+	if (latestIsStable && currentIsStable) return false;
+	if (latestIsStable !== currentIsStable) return latestIsStable;
+	return comparePrerelease(latestParsed.prerelease, currentParsed.prerelease) > 0;
+}
+
+//#endregion
+export { isNewerVersion };
+//# sourceMappingURL=version-compare.mjs.map

package/esm/utils/version-compare.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-compare.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/utils/version-compare.ts"],"sourcesContent":["/**\n * Zero-dependency semver comparison — just enough for the framework's\n * self-update tooling (the dev-server update notice + the `warlock update`\n * command).\n *\n * We deliberately avoid pulling in a semver library: the only question these\n * callers ask is \"is the published version newer than what's installed?\".\n */\n\ntype ParsedVersion = {\n  /** Numeric core as `[major, minor, patch]`. */\n  core: [number, number, number];\n  /** Dot-separated prerelease identifiers; empty for a stable release. */\n  prerelease: string[];\n};\n\n/**\n * Parse a semver string into its numeric core + prerelease identifiers.\n * Tolerates a leading `v` and ignores build metadata (`+…`). Returns\n * `undefined` when the core isn't exactly three non-negative integers.\n */\nfunction parseVersion(version: string): ParsedVersion | undefined {\n  const cleaned = version.trim().replace(/^v/i, \"\");\n  const [coreAndPrerelease] = cleaned.split(\"+\"); // drop build metadata\n  const [core, ...prereleaseParts] = coreAndPrerelease.split(\"-\");\n  const segments = core.split(\".\");\n\n  if (segments.length !== 3) {\n    return undefined;\n  }\n\n  const numbers = segments.map((segment) => Number(segment));\n\n  if (numbers.some((value) => !Number.isInteger(value) || value < 0)) {\n    return undefined;\n  }\n\n  const prerelease = prereleaseParts.length > 0 ? prereleaseParts.join(\"-\").split(\".\") : [];\n\n  return {\n    core: [numbers[0], numbers[1], numbers[2]],\n    prerelease,\n  };\n}\n\n/**\n * Compare two prerelease identifier lists per semver rules: numeric\n * identifiers compare numerically, alphanumeric ones lexically, a numeric\n * identifier ranks below an alphanumeric one, and a longer list wins when\n * otherwise equal. Returns a negative / zero / positive number.\n */\nfunction comparePrerelease(left: string[], right: string[]): number {\n  const length = Math.max(left.length, right.length);\n\n  for (let index = 0; index < length; index++) {\n    const a = left[index];\n    const b = right[index];\n\n    if (a === undefined) {\n      return -1;\n    }\n\n    if (b === undefined) {\n      return 1;\n    }\n\n    const aIsNumeric = /^\\d+$/.test(a);\n    const bIsNumeric = /^\\d+$/.test(b);\n\n    if (aIsNumeric && bIsNumeric) {\n      const diff = Number(a) - Number(b);\n\n      if (diff !== 0) {\n        return diff;\n      }\n\n      continue;\n    }\n\n    if (aIsNumeric !== bIsNumeric) {\n      return aIsNumeric ? -1 : 1;\n    }\n\n    if (a !== b) {\n      return a < b ? -1 : 1;\n    }\n  }\n\n  return 0;\n}\n\n/**\n * Return `true` when `latest` is a strictly newer semantic version than\n * `current`. Compares the numeric `major.minor.patch` first, then treats a\n * stable release as newer than a prerelease of the same core\n * (`1.2.0` > `1.2.0-beta`). Unparseable input yields `false` — we never nag\n * on a version string we can't understand.\n */\nexport function isNewerVersion(latest: string, current: string): boolean {\n  const latestParsed = parseVersion(latest);\n  const currentParsed = parseVersion(current);\n\n  if (!latestParsed || !currentParsed) {\n    return false;\n  }\n\n  for (let index = 0; index < 3; index++) {\n    if (latestParsed.core[index] !== currentParsed.core[index]) {\n      return latestParsed.core[index] > currentParsed.core[index];\n    }\n  }\n\n  // Equal numeric core — order by prerelease (a stable release beats a prerelease).\n  const latestIsStable = latestParsed.prerelease.length === 0;\n  const currentIsStable = currentParsed.prerelease.length === 0;\n\n  if (latestIsStable && currentIsStable) {\n    return false;\n  }\n\n  if (latestIsStable !== currentIsStable) {\n    return latestIsStable;\n  }\n\n  return comparePrerelease(latestParsed.prerelease, currentParsed.prerelease) > 0;\n}\n"],"mappings":";;;;;;AAqBA,SAAS,aAAa,SAA4C;CAEhE,MAAM,CAAC,qBADS,QAAQ,KAAK,CAAC,CAAC,QAAQ,OAAO,EACZ,CAAC,CAAC,MAAM,GAAG;CAC7C,MAAM,CAAC,MAAM,GAAG,mBAAmB,kBAAkB,MAAM,GAAG;CAC9D,MAAM,WAAW,KAAK,MAAM,GAAG;CAE/B,IAAI,SAAS,WAAW,GACtB;CAGF,MAAM,UAAU,SAAS,KAAK,YAAY,OAAO,OAAO,CAAC;CAEzD,IAAI,QAAQ,MAAM,UAAU,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,CAAC,GAC/D;CAGF,MAAM,aAAa,gBAAgB,SAAS,IAAI,gBAAgB,KAAK,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;CAExF,OAAO;EACL,MAAM;GAAC,QAAQ;GAAI,QAAQ;GAAI,QAAQ;EAAE;EACzC;CACF;AACF;;;;;;;AAQA,SAAS,kBAAkB,MAAgB,OAAyB;CAClE,MAAM,SAAS,KAAK,IAAI,KAAK,QAAQ,MAAM,MAAM;CAEjD,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,SAAS;EAC3C,MAAM,IAAI,KAAK;EACf,MAAM,IAAI,MAAM;EAEhB,IAAI,MAAM,QACR,OAAO;EAGT,IAAI,MAAM,QACR,OAAO;EAGT,MAAM,aAAa,QAAQ,KAAK,CAAC;EACjC,MAAM,aAAa,QAAQ,KAAK,CAAC;EAEjC,IAAI,cAAc,YAAY;GAC5B,MAAM,OAAO,OAAO,CAAC,IAAI,OAAO,CAAC;GAEjC,IAAI,SAAS,GACX,OAAO;GAGT;EACF;EAEA,IAAI,eAAe,YACjB,OAAO,aAAa,KAAK;EAG3B,IAAI,MAAM,GACR,OAAO,IAAI,IAAI,KAAK;CAExB;CAEA,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,QAAgB,SAA0B;CACvE,MAAM,eAAe,aAAa,MAAM;CACxC,MAAM,gBAAgB,aAAa,OAAO;CAE1C,IAAI,CAAC,gBAAgB,CAAC,eACpB,OAAO;CAGT,KAAK,IAAI,QAAQ,GAAG,QAAQ,GAAG,SAC7B,IAAI,aAAa,KAAK,WAAW,cAAc,KAAK,QAClD,OAAO,aAAa,KAAK,SAAS,cAAc,KAAK;CAKzD,MAAM,iBAAiB,aAAa,WAAW,WAAW;CAC1D,MAAM,kBAAkB,cAAc,WAAW,WAAW;CAE5D,IAAI,kBAAkB,iBACpB,OAAO;CAGT,IAAI,mBAAmB,iBACrB,OAAO;CAGT,OAAO,kBAAkB,aAAa,YAAY,cAAc,UAAU,IAAI;AAChF"}

package/esm/warlock-config/types.d.mts

@@ -82,6 +82,15 @@ type WarlockConfig = {
      * @default true
      */
     generateTypings?: boolean;
+    /**
+     * Check npm for a newer `@warlock.js/core` release when the dev server
+     * starts and print a one-line notice if one is available. Because the
+     * family is versioned in lockstep, core stands in for every package.
+     * Best-effort and non-blocking; automatically skipped in CI and in
+     * non-interactive (non-TTY) shells.
+     * @default true
+     */
+    checkForUpdates?: boolean;
     /**
      * Debug aid for the (always-on) persisted transpile cache. Names cache
      * files `<slug>.<hash>.js` (last 3 source path segments) and appends a

package/esm/warlock-config/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/warlock-config/types.ts"],"mappings":";;;;;;;AASA;;;KAAY,aAAA;EAuES;;;EAnEnB,MAAA;IACE,IAAA;IACA,IAAA;IACA,cAAA;EAAA;EAAA;;;EAMF,KAAA;IAkBE;;;;;IAZA,YAAA;IAmCA;;;;;IA7BA,OAAA;IA6DA;;;;;IAvDA,MAAA;IA+FA;;;AAOO;;IAhGP,SAAA;EAAA;;;;EAMF,GAAA;IACE,QAAA,GAAW,UAAA;EAAA;;;;EAMb,SAAA;;;;IAIE,KAAA;;;;;;MAME,OAAA;;;;;;MAMA,OAAA;IAAA;;;;IAKF,cAAA,GAAiB,yBAAA;;;;;IAKjB,eAAA;;;;;;;;;;IAUA,mBAAA;EAAA;;;;EAMF,QAAA;;;;;;;;;;;;;;;;;;IAkBE,UAAA,GAAa,KAAA,CAAM,oBAAA;EAAA;;;;;;;EASrB,OAAA;;;;;;;IAOE,OAAA;;;;;;IAOA,OAAA;EAAA;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/warlock-config/types.ts"],"mappings":";;;;;;;AASA;;;KAAY,aAAA;EAuES;;;EAnEnB,MAAA;IACE,IAAA;IACA,IAAA;IACA,cAAA;EAAA;EAAA;;;EAMF,KAAA;IAkBE;;;;;IAZA,YAAA;IAmCA;;;;;IA7BA,OAAA;IA4DA;;;;;IAtDA,MAAA;IAiGF;;;;AAcS;IAzGP,SAAA;EAAA;;;;EAMF,GAAA;IACE,QAAA,GAAW,UAAA;EAAA;;;;EAMb,SAAA;;;;IAIE,KAAA;;;;;;MAME,OAAA;;;;;;MAMA,OAAA;IAAA;;;;IAKF,cAAA,GAAiB,yBAAA;;;;;IAKjB,eAAA;;;;;;;;;IASA,eAAA;;;;;;;;;;IAUA,mBAAA;EAAA;;;;EAMF,QAAA;;;;;;;;;;;;;;;;;;IAkBE,UAAA,GAAa,KAAA,CAAM,oBAAA;EAAA;;;;;;;EASrB,OAAA;;;;;;;IAOE,OAAA;;;;;;IAOA,OAAA;EAAA;AAAA"}

package/llms-full.txt

@@ -3043,6 +3043,7 @@ export default defineConfig({
       exclude: ["**/node_modules/**", "**/dist/**", "**/.warlock/**", "**/.git/**"],
     },
     generateTypings: true,             // background type generation
+    checkForUpdates: true,             // notify on a newer @warlock.js/core at dev start
     healthCheckers: [...] /* or false */,
     transpileCacheDebug: false,        // name cache files <slug>.<hash>.js w/ // @source markers
   },
@@ -3053,6 +3054,7 @@ export default defineConfig({
 - **`generateTypings`** — turn off if you're committing generated typings and don't want them rewritten on every boot. The `--skip-typings` flag is the per-run version.
 - **`healthCheckers`** — custom file health checker contracts (or `false` to disable). The `--skip-health` flag is the per-run version.
 - **`transpileCacheDebug`** — diagnostic only. Names `.warlock/transpile/*.js` files `<slug>.<hash>.js` and appends `// @source <path>` markers so you can eyeball which cache entry came from which source. Leave off in normal use.
+- **`checkForUpdates`** — on `warlock dev` start, check npm for a newer `@warlock.js/core` and print a one-line notice if one exists. Best-effort and non-blocking; auto-skipped in CI and non-TTY shells. Run `warlock update` to upgrade. See [`update-packages/SKILL.md`](../update-packages/SKILL.md).
 
 ## `warlock build` — production bundle
 
@@ -3235,6 +3237,7 @@ NODE_OPTIONS=--max-old-space-size=4096 yarn warlock start
 - [`configure-app/SKILL.md`](../configure-app/SKILL.md) — `warlock.config.ts` shape and `defineConfig`.
 - [`use-app-context/SKILL.md`](../use-app-context/SKILL.md) — `Application.environment` vs `Application.runtimeStrategy`.
 - [`add-connector/SKILL.md`](../add-connector/SKILL.md) — Early vs Late connector phases (why HTTP/socket boot late in dev).
+- [`update-packages/SKILL.md`](../update-packages/SKILL.md) — `warlock update` + the dev-server update notice (`devServer.checkForUpdates`).
 
 
 ## send-mail  `@warlock.js/core/send-mail/SKILL.md`
@@ -4789,6 +4792,88 @@ describe("slugify", () => {
 - [`write-cli-command/SKILL.md`](../write-cli-command/SKILL.md) — `warlock add test` for the initial scaffold.
 
 
+## update-packages  `@warlock.js/core/update-packages/SKILL.md`
+
+---
+name: update-packages
+description: 'Keep a project current with `warlock update` — bump every `@warlock.js/*` dependency in package.json to its latest published version (range operator preserved), then run the lockfile-detected package manager install. Also covers the `warlock dev` update notice and the `devServer.checkForUpdates` toggle. Triggers: `warlock update`, `--no-install`, `checkForUpdates`, `fetchLatestVersion`, `isNewerVersion`; "update warlock packages", "upgrade the framework", "is there a new warlock version", "update notice in the dev server", "bump @warlock.js/* to latest"; typical CLI `warlock update`. Skip: dev/build/start runtime — `@warlock.js/core/run-app/SKILL.md`; writing a custom command — `@warlock.js/core/write-cli-command/SKILL.md`; installing a NEW feature package (auth, mail, storage) — that is `warlock add`; releasing/publishing the framework — workspace release tooling, not this command.'
+---
+
+# Warlock — update the framework
+
+`warlock update` upgrades a project's Warlock packages in one step, and `warlock dev` tells you when an upgrade is available. Because the whole `@warlock.js/*` family ships in **lockstep** — every package shares one version — keeping them in sync is the normal case, and this command does exactly that.
+
+## `warlock update`
+
+```bash
+warlock update                  # bump every @warlock.js/* dep to latest, then install
+warlock update --no-install     # rewrite package.json only; install yourself later
+```
+
+| Flag           | Type    | Purpose                                                                             |
+| -------------- | ------- | ----------------------------------------------------------------------------------- |
+| `--no-install` | boolean | Rewrite the versions in `package.json` without running the package manager install. |
+
+What it does, in order:
+
+1. Reads the project's root `package.json`.
+2. Collects every `@warlock.js/*` package across `dependencies` and `devDependencies`. Only the `@warlock.js/` scope is considered — `create-warlock` and unrelated dependencies are never touched.
+3. Looks up each package's latest version on the npm registry, in parallel.
+4. Rewrites each matching spec, **preserving the range operator**: `^4.2.0` → `^4.3.0`, `~4.2.0` → `~4.3.0`, an exact `4.2.0` → `4.3.0`. Specs that are not a plain semver — `workspace:*`, `*`, `latest`, git/file URLs — are left exactly as written, and any package already at or ahead of latest is skipped.
+5. Runs the project's install to reconcile `node_modules` — `npm install` / `yarn install` / `pnpm install`, chosen by the lockfile present (`package-lock.json` / `yarn.lock` / `pnpm-lock.yaml`, npm as the fallback). Skipped with `--no-install`.
+
+Re-running on an already-current project is a no-op: nothing resolves as newer, so it prints "All @warlock.js packages are already up to date" and exits without writing or installing.
+
+## The dev-server update notice
+
+On start, `warlock dev` checks npm for a newer `@warlock.js/core` and prints a one-line notice when one exists:
+
+```
+  ⚡ A new version of Warlock.js is available  4.2.11 → 4.3.0
+     Run  npx warlock update  to update all @warlock.js packages
+     Changelog  https://warlock.js.org/changelog/
+```
+
+Core's version stands in for the whole family (lockstep), so a single lookup is enough. The check is **best-effort and non-blocking** — it runs fire-and-forget after the server is ready, never delays or breaks startup, and stays silent on any failure (offline, registry down, timeout).
+
+It is automatically skipped when:
+
+- `process.env.CI` is set (CI runs),
+- stdout is not a TTY (piped / non-interactive shells),
+- `process.env.NO_UPDATE_NOTIFIER` is set, or
+- `devServer.checkForUpdates` is `false`.
+
+```ts title="warlock.config.ts"
+import { defineConfig } from "@warlock.js/core";
+
+export default defineConfig({
+  devServer: {
+    checkForUpdates: false, // silence the "update available" notice
+  },
+});
+```
+
+## Building blocks
+
+Two small zero-dependency utilities back the tooling and are exported from `@warlock.js/core`:
+
+- `fetchLatestVersion(name, timeoutMs?)` — the latest published version of an npm package, or `undefined` on any failure. Never throws.
+- `isNewerVersion(latest, current)` — `true` when `latest` is a strictly newer semver than `current`. Compares `major.minor.patch` and orders a stable release above its prereleases.
+
+## Gotchas
+
+- **Only the `@warlock.js/` scope is updated.** Mongez packages (`@mongez/*`), `create-warlock`, and everything else are left alone — update those with your package manager directly.
+- **Non-semver specs are intentionally skipped.** A `workspace:*` or `*` dependency stays as written; `update` will not pin it to a concrete version.
+- **The notice never blocks dev.** If npm is unreachable, `warlock dev` behaves exactly as before — no delay, no error.
+- **`warlock update` is not `warlock add`.** `add` installs a *new* feature package and runs its setup hooks; `update` only bumps the versions of packages you already depend on.
+
+## See also
+
+- [`run-app/SKILL.md`](../run-app/SKILL.md) — `warlock dev` / `build` / `start` and the `devServer.*` config knobs.
+- [`write-cli-command/SKILL.md`](../write-cli-command/SKILL.md) — author your own `warlock <cmd>`.
+- [`configure-app/SKILL.md`](../configure-app/SKILL.md) — `warlock.config.ts` shape and `defineConfig`.
+
+
 ## upload-file  `@warlock.js/core/upload-file/SKILL.md`
 
 ---

package/llms.txt

@@ -27,6 +27,7 @@
 - [store-file](@warlock.js/core/store-file/SKILL.md): Read/write/delete files via the `storage` singleton — disks, drivers (local/S3/R2/DO Spaces), `storage.use(name)`, `StorageFile` handles, presigned URLs. Triggers: `storage.put`, `storage.get`, `storage.use`, `StorageFile`, `storageConfigurations`, `getPresignedUrl`, `getPresignedUploadUrl`; "save an uploaded file", "switch between local and S3", "generate a presigned URL", "read file metadata"; typical import `import { storage } from "@warlock.js/core"`. Skip: multipart parsing + image chain — `@warlock.js/core/upload-file/SKILL.md`; image transforms — `@warlock.js/core/process-image/SKILL.md`; storage config shape — `@warlock.js/core/configure-app/SKILL.md`; competing libs `@aws-sdk/client-s3`, `multer`, `formidable`.
 - [test-http](@warlock.js/core/test-http/SKILL.md): Integration tests against a real HTTP server — `startHttpTestServer()` boots one shared server in globalSetup, then `testGet` / `testPost` / `expectJson` make typed requests against it. Triggers: `startHttpTestServer`, `stopHttpTestServer`, `testGet`, `testPost`, `testPut`, `testPatch`, `testDelete`, `expectJson`, `getTestServerUrl`, `testRequest`; "integration-test a controller", "end-to-end HTTP test", "globalSetup HTTP server", "assert status and body shape"; typical import `import { testGet, testPost, expectJson } from "@warlock.js/core"`. Skip: pure unit tests — `@warlock.js/core/test-service/SKILL.md`; controller shape — `@warlock.js/core/create-controller/SKILL.md`; competing libs `supertest`, `light-my-request`, `nock`.
 - [test-service](@warlock.js/core/test-service/SKILL.md): Pure unit tests against services, repositories, models, and use-cases — `setupTest({ connectors })` bootstraps each Vitest worker with its own DB/cache connections so you can call your code directly. Triggers: `setupTest`, `src/test-setup.ts`, `tests.connectors`, `Application.setEnvironment`; "unit-test a service", "test a repository query", "vitest setupFiles", "skip connectors for pure-logic tests"; typical import `import { setupTest } from "@warlock.js/core"`. Skip: HTTP integration — `@warlock.js/core/test-http/SKILL.md`; warlock add test scaffold — `@warlock.js/core/write-cli-command/SKILL.md`; competing tooling: jest direct, `supertest`, `nock`.
+- [update-packages](@warlock.js/core/update-packages/SKILL.md): Keep a project current with `warlock update` — bump every `@warlock.js/*` dependency in package.json to its latest published version (range operator preserved), then run the lockfile-detected package manager install. Also covers the `warlock dev` update notice and the `devServer.checkForUpdates` toggle. Triggers: `warlock update`, `--no-install`, `checkForUpdates`, `fetchLatestVersion`, `isNewerVersion`; "update warlock packages", "upgrade the framework", "is there a new warlock version", "update notice in the dev server", "bump @warlock.js/* to latest"; typical CLI `warlock update`. Skip: dev/build/start runtime — `@warlock.js/core/run-app/SKILL.md`; writing a custom command — `@warlock.js/core/write-cli-command/SKILL.md`; installing a NEW feature package (auth, mail, storage) — that is `warlock add`; releasing/publishing the framework — workspace release tooling, not this command.
 - [upload-file](@warlock.js/core/upload-file/SKILL.md): Handle multipart file uploads — read via `request.file()` or `request.validated()`, validate with `v.file()`, save via `UploadedFile.save()` or the storage layer, transform images inline. Triggers: `UploadedFile`, `request.file`, `v.file`, `.save`, `.saveAs`, `.resize`, `.format`, `.quality`, `.image`, `.mimeType`, `.maxSize`; "accept a file upload", "validate file size and mime", "save to S3 or local disk", "resize an uploaded image on save"; typical import `import type { UploadedFile, RequestHandler } from "@warlock.js/core"`. Skip: storage drivers + presigned URLs — `@warlock.js/core/store-file/SKILL.md`; image-only transforms — `@warlock.js/core/process-image/SKILL.md`; schema rules — `@warlock.js/core/validate-input/SKILL.md`; competing libs `multer`, `formidable`, `busboy`.
 - [use-app-context](@warlock.js/core/use-app-context/SKILL.md): Read app-wide context — the `Application` static class (env, version, uptime, runtime strategy) plus the `app` runtime accessor (live Fastify, socket.io, router, database via the DI container). Triggers: `Application.isProduction`, `Application.environment`, `Application.runtimeStrategy`, `Application.uptime`, `Application.version`, `app.http`, `app.socket`, `app.database`, `app.router`; "branch on environment", "reach the live Fastify instance", "framework version in health endpoint", "dev vs production runtime check"; typical import `import { Application, app } from "@warlock.js/core"`. Skip: path helpers — `@warlock.js/core/resolve-path/SKILL.md`; connector start order — `@warlock.js/core/add-connector/SKILL.md`; competing patterns: bare `process.env.NODE_ENV`, ad-hoc Fastify imports.
 - [use-localization](@warlock.js/core/use-localization/SKILL.md): Multi-locale translations via `groupedTranslations` (declare keys), `t()` / `request.t()` / `request.trans()` (look up), `request.getLocaleCode()` (detect locale from headers/query), `getLocalized` (pick the right value from a localized-array column). Triggers: `groupedTranslations`, `t`, `request.t`, `request.trans`, `request.transFrom`, `request.getLocaleCode`, `request.setLocaleCode`, `getLocalized`; "add a translation key", "resolve a localized error message", "detect request locale", "pick the right per-locale column value"; typical import `import { t, getLocalized } from "@warlock.js/core"`. Skip: resource output — `@warlock.js/core/define-resource/SKILL.md`; module scaffold — `@warlock.js/core/create-module/SKILL.md`; competing libs `i18next`, `react-intl`, raw `@mongez/localization`.

package/package.json

@@ -32,17 +32,17 @@
     "@mongez/events": "^2.2.6",
     "@mongez/http": "^3.3.8",
     "@mongez/localization": "^3.4.6",
-    "@mongez/reinforcements": "^3.2.0",
+    "@mongez/reinforcements": "^3.3.0",
     "@mongez/slug": "^1.0.7",
     "@mongez/supportive-is": "^2.1.3",
     "@mongez/time-wizard": "^1.0.6",
-    "@warlock.js/auth": "4.2.10",
-    "@warlock.js/cache": "4.2.10",
-    "@warlock.js/cascade": "4.2.10",
-    "@warlock.js/context": "4.2.10",
-    "@warlock.js/logger": "4.2.10",
-    "@warlock.js/seal": "4.2.10",
-    "@warlock.js/fs": "4.2.10",
+    "@warlock.js/auth": "4.3.0",
+    "@warlock.js/cache": "4.3.0",
+    "@warlock.js/cascade": "4.3.0",
+    "@warlock.js/context": "4.3.0",
+    "@warlock.js/logger": "4.3.0",
+    "@warlock.js/seal": "4.3.0",
+    "@warlock.js/fs": "4.3.0",
     "chokidar": "^5.0.0",
     "dayjs": "^1.11.19",
     "es-module-lexer": "^2.0.0",
@@ -68,12 +68,12 @@
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
     "@react-email/render": "^2.0.5",
-    "@warlock.js/herald": "4.2.10"
+    "@warlock.js/herald": "4.3.0"
   },
   "bin": {
     "warlock": "bin/warlock.js"
   },
-  "version": "4.2.10",
+  "version": "4.3.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",

package/skills/run-app/SKILL.md

@@ -66,6 +66,7 @@ export default defineConfig({
       exclude: ["**/node_modules/**", "**/dist/**", "**/.warlock/**", "**/.git/**"],
     },
     generateTypings: true,             // background type generation
+    checkForUpdates: true,             // notify on a newer @warlock.js/core at dev start
     healthCheckers: [...] /* or false */,
     transpileCacheDebug: false,        // name cache files <slug>.<hash>.js w/ // @source markers
   },
@@ -76,6 +77,7 @@ export default defineConfig({
 - **`generateTypings`** — turn off if you're committing generated typings and don't want them rewritten on every boot. The `--skip-typings` flag is the per-run version.
 - **`healthCheckers`** — custom file health checker contracts (or `false` to disable). The `--skip-health` flag is the per-run version.
 - **`transpileCacheDebug`** — diagnostic only. Names `.warlock/transpile/*.js` files `<slug>.<hash>.js` and appends `// @source <path>` markers so you can eyeball which cache entry came from which source. Leave off in normal use.
+- **`checkForUpdates`** — on `warlock dev` start, check npm for a newer `@warlock.js/core` and print a one-line notice if one exists. Best-effort and non-blocking; auto-skipped in CI and non-TTY shells. Run `warlock update` to upgrade. See [`update-packages/SKILL.md`](../update-packages/SKILL.md).
 
 ## `warlock build` — production bundle
 
@@ -258,3 +260,4 @@ NODE_OPTIONS=--max-old-space-size=4096 yarn warlock start
 - [`configure-app/SKILL.md`](../configure-app/SKILL.md) — `warlock.config.ts` shape and `defineConfig`.
 - [`use-app-context/SKILL.md`](../use-app-context/SKILL.md) — `Application.environment` vs `Application.runtimeStrategy`.
 - [`add-connector/SKILL.md`](../add-connector/SKILL.md) — Early vs Late connector phases (why HTTP/socket boot late in dev).
+- [`update-packages/SKILL.md`](../update-packages/SKILL.md) — `warlock update` + the dev-server update notice (`devServer.checkForUpdates`).

package/skills/update-packages/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: update-packages
+description: 'Keep a project current with `warlock update` — bump every `@warlock.js/*` dependency in package.json to its latest published version (range operator preserved), then run the lockfile-detected package manager install. Also covers the `warlock dev` update notice and the `devServer.checkForUpdates` toggle. Triggers: `warlock update`, `--no-install`, `checkForUpdates`, `fetchLatestVersion`, `isNewerVersion`; "update warlock packages", "upgrade the framework", "is there a new warlock version", "update notice in the dev server", "bump @warlock.js/* to latest"; typical CLI `warlock update`. Skip: dev/build/start runtime — `@warlock.js/core/run-app/SKILL.md`; writing a custom command — `@warlock.js/core/write-cli-command/SKILL.md`; installing a NEW feature package (auth, mail, storage) — that is `warlock add`; releasing/publishing the framework — workspace release tooling, not this command.'
+---
+
+# Warlock — update the framework
+
+`warlock update` upgrades a project's Warlock packages in one step, and `warlock dev` tells you when an upgrade is available. Because the whole `@warlock.js/*` family ships in **lockstep** — every package shares one version — keeping them in sync is the normal case, and this command does exactly that.
+
+## `warlock update`
+
+```bash
+warlock update                  # bump every @warlock.js/* dep to latest, then install
+warlock update --no-install     # rewrite package.json only; install yourself later
+```
+
+| Flag           | Type    | Purpose                                                                             |
+| -------------- | ------- | ----------------------------------------------------------------------------------- |
+| `--no-install` | boolean | Rewrite the versions in `package.json` without running the package manager install. |
+
+What it does, in order:
+
+1. Reads the project's root `package.json`.
+2. Collects every `@warlock.js/*` package across `dependencies` and `devDependencies`. Only the `@warlock.js/` scope is considered — `create-warlock` and unrelated dependencies are never touched.
+3. Looks up each package's latest version on the npm registry, in parallel.
+4. Rewrites each matching spec, **preserving the range operator**: `^4.2.0` → `^4.3.0`, `~4.2.0` → `~4.3.0`, an exact `4.2.0` → `4.3.0`. Specs that are not a plain semver — `workspace:*`, `*`, `latest`, git/file URLs — are left exactly as written, and any package already at or ahead of latest is skipped.
+5. Runs the project's install to reconcile `node_modules` — `npm install` / `yarn install` / `pnpm install`, chosen by the lockfile present (`package-lock.json` / `yarn.lock` / `pnpm-lock.yaml`, npm as the fallback). Skipped with `--no-install`.
+
+Re-running on an already-current project is a no-op: nothing resolves as newer, so it prints "All @warlock.js packages are already up to date" and exits without writing or installing.
+
+## The dev-server update notice
+
+On start, `warlock dev` checks npm for a newer `@warlock.js/core` and prints a one-line notice when one exists:
+
+```
+  ⚡ A new version of Warlock.js is available  4.2.11 → 4.3.0
+     Run  npx warlock update  to update all @warlock.js packages
+     Changelog  https://warlock.js.org/changelog/
+```
+
+Core's version stands in for the whole family (lockstep), so a single lookup is enough. The check is **best-effort and non-blocking** — it runs fire-and-forget after the server is ready, never delays or breaks startup, and stays silent on any failure (offline, registry down, timeout).
+
+It is automatically skipped when:
+
+- `process.env.CI` is set (CI runs),
+- stdout is not a TTY (piped / non-interactive shells),
+- `process.env.NO_UPDATE_NOTIFIER` is set, or
+- `devServer.checkForUpdates` is `false`.
+
+```ts title="warlock.config.ts"
+import { defineConfig } from "@warlock.js/core";
+
+export default defineConfig({
+  devServer: {
+    checkForUpdates: false, // silence the "update available" notice
+  },
+});
+```
+
+## Building blocks
+
+Two small zero-dependency utilities back the tooling and are exported from `@warlock.js/core`:
+
+- `fetchLatestVersion(name, timeoutMs?)` — the latest published version of an npm package, or `undefined` on any failure. Never throws.
+- `isNewerVersion(latest, current)` — `true` when `latest` is a strictly newer semver than `current`. Compares `major.minor.patch` and orders a stable release above its prereleases.
+
+## Gotchas
+
+- **Only the `@warlock.js/` scope is updated.** Mongez packages (`@mongez/*`), `create-warlock`, and everything else are left alone — update those with your package manager directly.
+- **Non-semver specs are intentionally skipped.** A `workspace:*` or `*` dependency stays as written; `update` will not pin it to a concrete version.
+- **The notice never blocks dev.** If npm is unreachable, `warlock dev` behaves exactly as before — no delay, no error.
+- **`warlock update` is not `warlock add`.** `add` installs a *new* feature package and runs its setup hooks; `update` only bumps the versions of packages you already depend on.
+
+## See also
+
+- [`run-app/SKILL.md`](../run-app/SKILL.md) — `warlock dev` / `build` / `start` and the `devServer.*` config knobs.
+- [`write-cli-command/SKILL.md`](../write-cli-command/SKILL.md) — author your own `warlock <cmd>`.
+- [`configure-app/SKILL.md`](../configure-app/SKILL.md) — `warlock.config.ts` shape and `defineConfig`.