@wasp.sh/wasp-cli-darwin-arm64-unknown 0.23.0 → 0.24.0-rc.2

package/data/Cli/starters/basic/main.wasp.ts

@@ -0,0 +1,60 @@
+import { app, page, route } from "@wasp.sh/spec";
+import { App } from "./src/App" with { type: "ref" };
+import { EmailVerificationPage } from "./src/auth/email/EmailVerificationPage" with { type: "ref" };
+import { LoginPage } from "./src/auth/email/LoginPage" with { type: "ref" };
+import { PasswordResetPage } from "./src/auth/email/PasswordResetPage" with { type: "ref" };
+import { RequestPasswordResetPage } from "./src/auth/email/RequestPasswordResetPage" with { type: "ref" };
+import { SignupPage } from "./src/auth/email/SignupPage" with { type: "ref" };
+import { userSignupFields } from "./src/auth/email/userSignupFields" with { type: "ref" };
+import { tagsSpec } from "./src/tags/tags.wasp";
+import { tasksSpec } from "./src/tasks/task.wasp";
+
+export default app({
+  name: "__waspAppName__",
+  title: "__waspProjectName__",
+  wasp: { version: "__waspVersion__" },
+  head: ["<link rel='icon' href='/favicon.ico' />"],
+  auth: {
+    userEntity: "User",
+    methods: {
+      email: {
+        fromField: {
+          name: "Basic App",
+          email: "hello@example.com",
+        },
+        userSignupFields,
+        emailVerification: {
+          clientRoute: "EmailVerificationRoute",
+        },
+        passwordReset: {
+          clientRoute: "PasswordResetRoute",
+        },
+      },
+    },
+    onAuthSucceededRedirectTo: "/",
+    onAuthFailedRedirectTo: "/login",
+  },
+  emailSender: {
+    provider: "Dummy",
+  },
+  client: {
+    rootComponent: App,
+  },
+  spec: [
+    tasksSpec,
+    tagsSpec,
+    route("LoginRoute", "/login", page(LoginPage)),
+    route("SignupRoute", "/signup", page(SignupPage)),
+    route(
+      "RequestPasswordResetRoute",
+      "/request-password-reset",
+      page(RequestPasswordResetPage),
+    ),
+    route("PasswordResetRoute", "/password-reset", page(PasswordResetPage)),
+    route(
+      "EmailVerificationRoute",
+      "/email-verification",
+      page(EmailVerificationPage),
+    ),
+  ],
+});

package/data/Cli/starters/basic/package.json

@@ -15,6 +15,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.27.0",
+    "@types/node": "^24.0.0",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
     "@tailwindcss/vite": "^4.1.18",
@@ -27,6 +28,8 @@
     "prisma": "5.19.1",
     "typescript": "5.9.3",
     "typescript-eslint": "^8.32.1",
-    "vite": "^7.0.6"
+    "vite": "^7.0.6",
+    "vitest": "^4.0.16",
+    "@wasp.sh/spec": "__waspSpecPackageSpecifier__"
   }
 }

package/data/Cli/starters/basic/prettier.config.mjs

@@ -0,0 +1,9 @@
+
+/**
+ * @type {import("prettier").Config}
+ */
+const config = {
+  "plugins": ["prettier-plugin-tailwindcss"]
+}
+
+export default config;

package/data/Cli/starters/basic/src/tags/tags.wasp.ts

@@ -0,0 +1,8 @@
+import { type Spec, action, query } from "@wasp.sh/spec";
+import { createTag } from "./actions" with { type: "ref" };
+import { getTags } from "./queries" with { type: "ref" };
+
+export const tagsSpec: Spec = [
+  query(getTags, { entities: ["Tag"] }),
+  action(createTag, { entities: ["Tag"] }),
+];

package/data/Cli/starters/basic/src/tasks/task.wasp.ts

@@ -0,0 +1,16 @@
+import { type Spec, action, page, query, route } from "@wasp.sh/spec";
+import {
+  createTask,
+  deleteCompletedTasks,
+  updateTaskStatus,
+} from "./actions" with { type: "ref" };
+import { getTasks } from "./queries" with { type: "ref" };
+import { TasksPage } from "./TasksPage" with { type: "ref" };
+
+export const tasksSpec: Spec = [
+  route("TasksRoute", "/", page(TasksPage, { authRequired: true })),
+  query(getTasks, { entities: ["Task", "Tag"] }),
+  action(createTask, { entities: ["Task"] }),
+  action(updateTaskStatus, { entities: ["Task"] }),
+  action(deleteCompletedTasks, { entities: ["Task"] }),
+];

package/data/Cli/starters/minimal/main.wasp.ts

@@ -0,0 +1,12 @@
+import { app, page, route } from "@wasp.sh/spec";
+import { MainPage } from "./src/MainPage" with { type: "ref" };
+
+export default app({
+  name: "__waspAppName__",
+  title: "__waspProjectName__",
+  wasp: { version: "__waspVersion__" },
+  head: ["<link rel='icon' href='/favicon.ico' />"],
+  spec: [
+    route("RootRoute", "/", page(MainPage)),
+  ],
+});

package/data/Cli/starters/minimal/package.json

@@ -8,10 +8,13 @@
     "react-router": "^7.12.0"
   },
   "devDependencies": {
+    "@types/node": "^24.0.0",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
     "prisma": "5.19.1",
     "typescript": "5.9.3",
-    "vite": "^7.0.6"
+    "vite": "^7.0.6",
+    "vitest": "^4.0.16",
+    "@wasp.sh/spec": "__waspSpecPackageSpecifier__"
   }
 }

package/data/Cli/starters/skeleton/AGENTS.md

@@ -0,0 +1,23 @@
+## Wasp
+
+This project uses the Wasp framework.
+
+### Docs
+
+- Find docs via the index at https://wasp.sh/llms.txt
+- Pick the docs map matching the Wasp version in `main.wasp.ts`.
+- Prefer raw Markdown URLs from the docs map over guessing `wasp.sh/docs` URLs.
+- If this file conflicts with versioned Wasp docs, trust the docs and tell the user this file may be stale.
+
+### Wasp TypeScript Spec
+
+- `main.wasp.ts` contains the Wasp version and the Wasp app specification.
+- When it references app components/functions, import them from `src/` with `with { type: "ref" }`.
+- `route(name, ...)` and `crud(name, ...)` take an explicit name.
+- Other constructors take no name argument; the declaration's name is the imported identifier. For example, `job(sendReminder, { ... })` declares a job named `sendReminder`.
+- `@wasp.sh/spec` is generated by Wasp, don't install it from npm.
+
+### Verification
+
+- Run `wasp compile` to check if app is valid.
+- Do not run `tsc` directly for validation.

package/data/Cli/starters/skeleton/CLAUDE.md

@@ -0,0 +1,23 @@
+## Wasp
+
+This project uses the Wasp framework.
+
+### Docs
+
+- Find docs via the index at https://wasp.sh/llms.txt
+- Pick the docs map matching the Wasp version in `main.wasp.ts`.
+- Prefer raw Markdown URLs from the docs map over guessing `wasp.sh/docs` URLs.
+- If this file conflicts with versioned Wasp docs, trust the docs and tell the user this file may be stale.
+
+### Wasp TypeScript Spec
+
+- `main.wasp.ts` contains the Wasp version and the Wasp app specification.
+- When it references app components/functions, import them from `src/` with `with { type: "ref" }`.
+- `route(name, ...)` and `crud(name, ...)` take an explicit name.
+- Other constructors take no name argument; the declaration's name is the imported identifier. For example, `job(sendReminder, { ... })` declares a job named `sendReminder`.
+- `@wasp.sh/spec` is generated by Wasp, don't install it from npm.
+
+### Verification
+
+- Run `wasp compile` to check if app is valid.
+- Do not run `tsc` directly for validation.

package/data/Cli/starters/skeleton/tsconfig.json

@@ -1,28 +1,7 @@
-// =============================== IMPORTANT =================================
-// This file is mainly used for Wasp IDE support.
-//
-// Wasp will compile your code with slightly different (less strict) compilerOptions.
-// You can increase the configuration's strictness (e.g., by adding
-// "noUncheckedIndexedAccess": true), but you shouldn't reduce it (e.g., by
-// adding "strict": false). Just keep in mind that this will only affect your
-// IDE support, not the actual compilation.
-//
-// Full TypeScript configurability is coming very soon :)
 {
-  "compilerOptions": {
-    "module": "esnext",
-    "composite": true,
-    "target": "esnext",
-    "moduleResolution": "bundler",
-    "jsx": "preserve",
-    "strict": true,
-    "esModuleInterop": true,
-    "isolatedModules": true,
-    "moduleDetection": "force",
-    "lib": ["dom", "dom.iterable", "esnext"],
-    "skipLibCheck": true,
-    "allowJs": true,
-    "outDir": ".wasp/out/user"
-  },
-  "include": ["src"]
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.src.json" },
+    { "path": "./tsconfig.wasp.json" }
+  ]
 }

package/data/Cli/starters/{ts-minimal → skeleton}/tsconfig.src.json

@@ -24,5 +24,6 @@
     "allowJs": true,
     "outDir": ".wasp/out/user"
   },
-  "include": ["src"]
+  "include": ["src"],
+  "exclude": ["**/*.wasp.ts"]
 }

package/data/Cli/starters/{ts-minimal → skeleton}/tsconfig.wasp.json

@@ -7,9 +7,12 @@
     "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
-    "module": "NodeNext",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "jsx": "preserve",
+    "allowJs": true,
     "noEmit": true,
     "lib": ["ES2023"]
   },
-  "include": ["main.wasp.ts"]
+  "include": ["**/*.wasp.ts", ".wasp/out/types/spec"]
 }

package/data/Generator/templates/sdk/wasp/api/index.ts

@@ -1,14 +1,8 @@
-import axios, { type AxiosError, type AxiosInstance } from 'axios'
-
+import ky, { isHTTPError } from 'ky'
 import { config } from 'wasp/client'
 import { storage } from 'wasp/core/storage'
 import { apiEventsEmitter } from './events.js'
 
-// PUBLIC API
-export const api: AxiosInstance = axios.create({
-  baseURL: config.apiUrl,
-})
-
 const WASP_APP_AUTH_SESSION_ID_NAME = 'sessionId'
 
 // PRIVATE API (sdk)
@@ -36,43 +30,53 @@ export function removeLocalUserData(): void {
   apiEventsEmitter.emit('sessionId.clear')
 }
 
+// PUBLIC API
 /**
- * Axios interceptors for handling authentication
- *
- * (1) Request Interceptor:
- * If a session ID exists, it is added to the request as an `Authorization`
- * header for the server to use.
+ * A ky instance configured for the Wasp API server.
  *
- * (2) Response Interceptor:
- * - Catches 401 errors from the server.
- * - Before clearing the session ID from local storage due to a 401 error,
- *   it compares the session ID stored in the *failed request's config*
- *   with the *current* session ID in local storage.
- * - It only clears the local session ID if the two session IDs match.
- *
- * This prevents a race condition like this:
- * 1. Request A is sent with old session ID X.
- * 2. User logs out and logs back in, obtaining new session ID Y.
- * 3. Request A finally fails with a 401 (because ID X is invalid).
- * Without the check, the interceptor would clear the *current* valid session ID Y.
- * The check ensures we only clear the session if the *request that failed* used
- * the *same session ID that's currently stored*.
+ * Automatically prepends the API base URL, adds authentication headers,
+ * and handles session invalidation on 401 responses. Non-2xx responses
+ * cause ky to throw an `HTTPError`; pass it through `handleApiError` to
+ * get a `WaspHttpError` carrying the server's status code, message, and
+ * response body.
  */
-api.interceptors.request.use((config) => {
-  const sessionId = getSessionId()
-  if (sessionId !== null) {
-    config.headers['Authorization'] = `Bearer ${sessionId}`
-  }
-  return config
-})
-
-api.interceptors.response.use(undefined, (error) => {
-  const failingSessionId = getSessionIdFromAuthorizationHeader(error.config.headers['Authorization'])
-  const currentSessionId = getSessionId()
-  if (error.response?.status === 401 && failingSessionId === currentSessionId) {
-    clearSessionId()
-  }
-  return Promise.reject(error)
+export const api = ky.extend({
+  prefix: config.apiUrl,
+  hooks: {
+    beforeRequest: [
+      ({ request }) => {
+        const sessionId = getSessionId()
+        if (sessionId !== null) {
+          request.headers.set('Authorization', `Bearer ${sessionId}`)
+        }
+      },
+    ],
+    afterResponse: [
+      ({ request, response }) => {
+        if (response.status === 401) {
+          // Before clearing the session ID from local storage due to a 401 error,
+          // compare the session ID stored in the *failed request's* headers
+          // with the *current* session ID in local storage.
+          // Only clear the local session ID if the two session IDs match.
+          //
+          // This prevents a race condition like this:
+          // 1. Request A is sent with old session ID X.
+          // 2. User logs out and logs back in, obtaining new session ID Y.
+          // 3. Request A finally fails with a 401 (because ID X is invalid).
+          // Without the check, we would clear the *current* valid session ID Y.
+          // The check ensures we only clear the session if the *request that failed*
+          // used the *same session ID that's currently stored*.
+          const failingSessionId = getSessionIdFromAuthorizationHeader(
+            request.headers.get('Authorization')
+          )
+          const currentSessionId = getSessionId()
+          if (failingSessionId === currentSessionId) {
+            clearSessionId()
+          }
+        }
+      },
+    ],
+  },
 })
 
 // This makes sure that the following handler won't try to run in a non-browser
@@ -96,12 +100,12 @@ if (typeof window !== 'undefined') {
 
 // PRIVATE API (sdk)
 /**
- * Takes an error returned by the app's API (as returned by axios), and transforms into a more
+ * Takes an error returned by the app's API (as thrown by ky), and transforms it into a more
  * standard format to be further used by the client. It is also assumed that given API
  * error has been formatted as implemented by HttpError on the server.
  */
-export function handleApiError<T extends AxiosError<{ message?: string, data?: unknown }>>(error: T): T | WaspHttpError {
-  if (error?.response) {
+export function handleApiError(error: unknown): unknown {
+  if (isHTTPError(error)) {
     // If error came from HTTP response, we capture most informative message
     // and also add .statusCode information to it.
     // If error had JSON response, we assume it is of format { message, data } and
@@ -109,7 +113,7 @@ export function handleApiError<T extends AxiosError<{ message?: string, data?: u
     // TODO: We might want to use HttpError here instead of just Error, since
     //   HttpError is also used on server to throw errors like these.
     //   That would require copying HttpError code to web-app also and using it here.
-    const responseJson = error.response?.data
+    const responseJson = error.data as { message?: string; data?: unknown } | undefined
     const responseStatusCode = error.response.status
     return new WaspHttpError(responseStatusCode, responseJson?.message ?? error.message, responseJson)
   } else {
@@ -123,14 +127,14 @@ class WaspHttpError extends Error {
 
   data: unknown
 
-  constructor (statusCode: number, message: string, data: unknown) {
+  constructor(statusCode: number, message: string, data: unknown) {
     super(message)
     this.statusCode = statusCode
     this.data = data
   }
 }
 
-function getSessionIdFromAuthorizationHeader(header: string | undefined): string | null {
+function getSessionIdFromAuthorizationHeader(header: string | null): string | null {
   const prefix = 'Bearer '
   if (header && header.startsWith(prefix)) {
     return header.substring(prefix.length)

package/data/Generator/templates/sdk/wasp/auth/email/actions/login.ts

@@ -1,12 +1,15 @@
 {{={= =}=}}
 import { api, handleApiError } from 'wasp/client/api';
 import { initSession } from '../../helpers/user';
+import { SessionResponseSchema } from '../../responseSchemas';
 
 // PUBLIC API
 export async function login(data: { email: string; password: string }): Promise<void> {
     try {
-        const response = await api.post('{= loginPath =}', data);
-        await initSession(response.data.sessionId);
+        const { sessionId } = await api.post('{= loginPath =}', {
+            json: data,
+        }).json(SessionResponseSchema);
+        await initSession(sessionId);
     } catch (e) {
         throw handleApiError(e);
     }

package/data/Generator/templates/sdk/wasp/auth/email/actions/passwordReset.ts

@@ -1,11 +1,14 @@
 {{={= =}=}}
 import { api, handleApiError } from 'wasp/client/api';
+import { SuccessResponseSchema } from '../../responseSchemas';
 
 // PUBLIC API
 export async function requestPasswordReset(data: { email: string; }): Promise<{ success: boolean }> {
     try {
-        const response = await api.post('{= requestPasswordResetPath =}', data);
-        return response.data;
+        const { success } = await api.post('{= requestPasswordResetPath =}', {
+            json: data,
+        }).json(SuccessResponseSchema);
+        return { success };
     } catch (e) {
         throw handleApiError(e);
     }
@@ -14,8 +17,10 @@ export async function requestPasswordReset(data: { email: string; }): Promise<{
 // PUBLIC API
 export async function resetPassword(data: { token: string; password: string; }): Promise<{ success: boolean }> {
     try {
-        const response = await api.post('{= resetPasswordPath =}', data);
-        return response.data;
+        const { success } = await api.post('{= resetPasswordPath =}', {
+            json: data,
+        }).json(SuccessResponseSchema);
+        return { success };
     } catch (e) {
         throw handleApiError(e);
     }

package/data/Generator/templates/sdk/wasp/auth/email/actions/signup.ts

@@ -1,5 +1,6 @@
 {{={= =}=}}
 import { api, handleApiError } from 'wasp/client/api';
+import { SuccessResponseSchema } from '../../responseSchemas';
 {=# emailUserSignupFields.isDefined =}
 import { type UserEmailSignupFields } from '../../providers'
 {=/ emailUserSignupFields.isDefined =}
@@ -12,8 +13,10 @@ type EmailSignupData = {
 // PUBLIC API
 export async function signup(data: EmailSignupData): Promise<{ success: boolean }> {
   try {
-    const response = await api.post('{= signupPath =}', data);
-    return response.data;
+    const { success } = await api.post('{= signupPath =}', {
+      json: data,
+    }).json(SuccessResponseSchema);
+    return { success };
   } catch (e) {
     throw handleApiError(e);
   }

package/data/Generator/templates/sdk/wasp/auth/email/actions/verifyEmail.ts

@@ -1,13 +1,16 @@
 {{={= =}=}}
 import { api, handleApiError } from 'wasp/client/api'
+import { SuccessResponseSchema } from '../../responseSchemas'
 
 // PUBLIC API
 export async function verifyEmail(data: {
   token: string
 }): Promise<{ success: boolean; reason?: string }> {
   try {
-    const response = await api.post('{= verifyEmailPath =}', data)
-    return response.data
+    const { success, reason } = await api.post('{= verifyEmailPath =}', {
+      json: data,
+    }).json(SuccessResponseSchema)
+    return { success, reason }
   } catch (e) {
     throw handleApiError(e)
   }

package/data/Generator/templates/sdk/wasp/auth/responseSchemas.ts

@@ -0,0 +1,10 @@
+import * as z from 'zod'
+
+export const SessionResponseSchema = z.object({
+    sessionId: z.string(),
+});
+
+export const SuccessResponseSchema = z.object({
+    success: z.boolean(),
+    reason: z.string().optional(),
+});

package/data/Generator/templates/sdk/wasp/auth/useAuth.ts

@@ -21,8 +21,8 @@ function createUserGetter(): Query<void, AuthUser | null> {
   const getMeRoute = { method: HttpMethod.Get, path: `/${getMeRelativePath}` }
   const getMe: QueryFunction<void, AuthUser | null> = async () =>  {
     try {
-      const response = await api.get(getMeRoute.path)
-      const userData = deserialize<AuthUserData | null>(response.data)
+      const json = await api.get(getMeRoute.path).json()
+      const userData = deserialize<AuthUserData | null>(json as any)
       return makeAuthUserIfPossible(userData)
     } catch (error) {
       throw handleApiError(error)

package/data/Generator/templates/sdk/wasp/auth/username/actions/login.ts

@@ -1,12 +1,14 @@
 {{={= =}=}}
 import { api, handleApiError } from 'wasp/client/api'
 import { initSession } from '../../helpers/user'
+import { SessionResponseSchema } from '../../responseSchemas'
 
 export async function login(data: { username: string, password: string }): Promise<void> {
   try {
-    const response = await api.post('{= loginPath =}', data)
-
-    await initSession(response.data.sessionId)
+    const { sessionId } = await api.post('{= loginPath =}', {
+      json: data,
+    }).json(SessionResponseSchema)
+    await initSession(sessionId)
   } catch (error) {
     throw handleApiError(error)
   }

package/data/Generator/templates/sdk/wasp/auth/username/actions/signup.ts

@@ -12,9 +12,10 @@ type UsernameSignupData = {
 // PUBLIC API
 export async function signup(data: UsernameSignupData): Promise<void> {
   try {
-    await api.post('{= signupPath =}', data)
+    await api.post('{= signupPath =}', {
+      json: data,
+    })
   } catch (error) {
     throw handleApiError(error)
   }
 }
-

package/data/Generator/templates/sdk/wasp/client/app/layout.tsx

@@ -50,18 +50,6 @@ export function Layout({
           {=& head =}
 
           <title>{= title =}</title>
-        </head>
-        <body>
-          <noscript>You need to enable JavaScript to run this app.</noscript>
-
-          {
-            // We don't really need to wrap the app in a div nor name it "root",
-            // but we keep it for backwards compatibility with older Wasp
-            // versions.
-          }
-          <div id="root">
-              {shouldRenderChildren ? children : null}
-          </div>
 
           {
             // We pass that argument in SSR builds and not in client builds.
@@ -75,16 +63,21 @@ export function Layout({
               // we just add the script ourselves in the regular way.
               //
               // https://react.dev/reference/react-dom/static/prerenderToNodeStream
-              <script
-                type="module"
-                src={clientEntrySrc}
-                // We make it `async` to decouple the tag's position from its
-                // execution phase. This way Vite can move it anywhere in the
-                // document to optimize loading performance.
-                async
-              />
+              <script type="module" src={clientEntrySrc} />
             ) : null
           }
+        </head>
+        <body>
+          <noscript>You need to enable JavaScript to run this app.</noscript>
+
+          {
+            // We don't really need to wrap the app in a div nor name it "root",
+            // but we keep it for backwards compatibility with older Wasp
+            // versions.
+          }
+          <div id="root">
+              {shouldRenderChildren ? children : null}
+          </div>
         </body>
       </html>
     </StrictMode>

package/data/Generator/templates/sdk/wasp/client/app/pages/OAuthCallback.tsx

@@ -1,6 +1,5 @@
 {{={= =}=}}
 import { useState } from "react";
-import { type AxiosResponse } from "axios";
 import { Navigate, useLocation } from 'react-router'
 import { useAuth } from "../../auth";
 import { api } from "../../../api";
@@ -54,12 +53,12 @@ function useOAuthCallbackHandler() {
       }
 
       const code = location.hash.slice(1);
-      const response = await exchangeOAuthCodeForToken({ code });
-      if (!isResponseWithSessionId(response)) {
+      const data = await exchangeOAuthCodeForToken({ code });
+      if (!isDataWithSessionId(data)) {
         setError("Unable to login with the OAuth provider.");
         return;
       }
-      await initSession(response.data.sessionId);
+      await initSession(data.sessionId);
     } catch (e: unknown) {
       console.error(e);
       setError("Unable to login with the OAuth provider.");
@@ -82,13 +81,15 @@ function useOAuthCallbackHandler() {
 
 async function exchangeOAuthCodeForToken(data: {
   code: string
-}): Promise<AxiosResponse<unknown>> {
-  return api.post('/auth/exchange-code', data)
+}): Promise<unknown> {
+  return api.post('/auth/exchange-code', {
+    json: data,
+  }).json()
 }
 
-function isResponseWithSessionId(
-  response: AxiosResponse<unknown>
-): response is AxiosResponse<{ sessionId: string }> {
-  const data = response.data as any;
-  return !!data && typeof data.sessionId === 'string'
+function isDataWithSessionId(
+  data: unknown
+): data is { sessionId: string } {
+  const obj = data as any;
+  return !!obj && typeof obj.sessionId === 'string'
 }