create-warlock 4.3.0 → 4.4.0

package/CHANGELOG.md

@@ -4,8 +4,6 @@ All notable changes to `create-warlock` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
-## [Unreleased]
-
 ## 4.2.11
 
 ### Changed

package/package.json

@@ -9,7 +9,7 @@
   "dependencies": {
     "@clack/prompts": "^0.7.0",
     "@mongez/copper": "^2.1.2",
-    "@warlock.js/fs": "4.3.0",
+    "@warlock.js/fs": "4.4.0",
     "@mongez/reinforcements": "^3.3.0",
     "cross-spawn": "^7.0.3",
     "rimraf": "^6.0.1",
@@ -18,7 +18,7 @@
   "bin": {
     "create-warlock": "bin/create-app.js"
   },
-  "version": "4.3.0",
+  "version": "4.4.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",

package/templates/warlock/AGENTS.md

@@ -0,0 +1,101 @@
+# AGENTS.md
+
+> This file is the single source of truth for instructions given to AI coding
+> agents working in this project. Tool-specific files (`CLAUDE.md`,
+> `.gemini/GEMINI.md`, `.github/copilot-instructions.md`, `CONVENTIONS.md`, …)
+> are **derived** from this file by
+> [agent-kit](https://github.com/hassanzohdy/agent-kit). Edit **this** file, then
+> run `yarn skills:sync` (or `npx agent-kit sync`) to regenerate them — never edit
+> the derived files directly.
+
+## Project overview
+
+This is a [Warlock.js](https://warlock.js.org) application — a TypeScript, Node.js
+framework for building APIs. The framework and its companion libraries ship under
+the `@warlock.js/*` scope (`core`, `cascade`, `cache`, `seal`, `auth`, `logger`,
+`fs`, `scheduler`, …). Application code lives under `src/app/**`, organized one
+module per domain noun.
+
+## Skills come first — read them before anything else
+
+**Before you work out how any package or framework feature works, read the
+matching skill.** Skills are the authoritative, maintained source of truth for how
+to use this project's packages and conventions. They are short and task-focused.
+
+Whenever you need to know how to use a package (`@warlock.js/*`, `@mongez/*`) or
+how to do a task (write a controller, define a model, add a migration, validate
+input, cache, schedule a job, …), follow this order **strictly**:
+
+1. **Read the relevant `SKILL.md` first.** Match the package name or the task to a
+   skill's `name` / `description` / triggers, load that skill, and follow it.
+2. **Only if no skill matches**, fall back to the package's own
+   types / source / README under `node_modules/<pkg>`.
+3. **The public internet is the last resort, not the first.** Do not web-search
+   for how a `@warlock.js/*` or `@mongez/*` API works while a skill for it exists —
+   the skill is more current and project-correct than anything online.
+
+**Do not reverse-engineer how a package works by grepping for similar or existing
+source files and copying their usage before you have checked the skills.** Existing
+code can be outdated, mid-refactor, or simply wrong; the skill is the contract.
+The rule is: **skill first, source second, web last.**
+
+## Where skills live
+
+- **Project conventions** — hand-authored skills in this repo's `skills/`
+  directory (architecture, code standards, API design, etc. — listed below).
+- **Package skills** — how to use each installed `@warlock.js/*` / `@mongez/*`
+  package. These are synced from `node_modules` into your agent's skills
+  directory on every install (Claude Code → `.claude/skills/`, Cursor →
+  `.cursor/skills/`, GitHub Copilot → `.github/skills/`, Codex → `.codex/skills/`,
+  and the equivalent directory for other agents).
+
+If a skill you expect is missing, run `yarn skills:sync` (it also runs
+automatically on `postinstall`).
+
+## Available project skills (`skills/`)
+
+- **api-design** — HTTP conventions: response envelopes, status codes, pagination,
+  typed controllers, resources, and routes.
+- **code-standards** — TypeScript style: `interface` (contracts) vs `type` (data),
+  access modifiers on every class member, no `any`, single-responsibility files
+  with the documented naming suffixes, JSDoc on the public surface.
+- **data-and-persistence** — modeling, storing, and migrating data with
+  `@warlock.js/cascade` (money as integer minor units, migrations, indexes).
+- **module-boundaries** — how modules under `src/app/**` relate; one domain noun
+  per module; what may import what.
+- **security-baseline** — input validation at every boundary via `@warlock.js/seal`
+  schemas, authentication, and secrets handling.
+- **observability-and-resilience** — structured logging, retries, timeouts, and
+  avoiding N+1 work.
+- **testing-strategy** — Vitest test pyramid with co-located `*.spec.ts` files.
+- **git-workflow** — conventional commits, branching, PRs, and CI gates.
+
+## Commands
+
+- `yarn dev` — start the dev server (`warlock dev`)
+- `yarn build` — type-check then build for production (`tsc && warlock build`)
+- `yarn start` — start the production server (`warlock start`)
+- `yarn migrate` / `yarn migrate.fresh` / `yarn migrate.list` — run migrations
+- `yarn seed` — run database seeders
+- `yarn lint` / `yarn format` / `yarn tsc` — lint (eslint --fix), format
+  (prettier), and type-check (`tsc --noEmit`)
+- `yarn skills:sync` — re-sync skills from `node_modules` and regenerate the
+  derived per-agent files from this `AGENTS.md`
+
+## Code style
+
+Follow the **code-standards** skill (`skills/code-standards/SKILL.md`) for all
+TypeScript — read it before writing or reviewing any `.ts` / `.tsx`. In short:
+`interface` for contracts and `type` for data shapes, no `any`, access modifiers
+on every class member, single-responsibility files with the documented naming
+suffixes, and JSDoc on the public surface. The bar is senior-level clean code, not
+"it compiles."
+
+## Boundaries
+
+- Respect **module-boundaries** — do not reach across module internals.
+- Never weaken the **security-baseline** — always validate input at boundaries.
+- Follow **git-workflow** for commits and branches; do not commit or push unless
+  explicitly asked.
+- When you are unsure how a package or feature works, **stop and read its skill**
+  rather than guessing from other files or the web.

package/templates/warlock/yarn.lock

@@ -1430,15 +1430,15 @@ foreground-child@^3.3.1:
     signal-exit "^4.0.1"
 
 form-data@^4.0.4:
-  version "4.0.5"
-  resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.5.tgz#b49e48858045ff4cbf6b03e1805cebcad3679053"
-  integrity sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==
+  version "4.0.6"
+  resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.6.tgz#28e864e1b786dbebb68db1f452f9635278665827"
+  integrity sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==
   dependencies:
     asynckit "^0.4.0"
     combined-stream "^1.0.8"
     es-set-tostringtag "^2.1.0"
-    hasown "^2.0.2"
-    mime-types "^2.1.12"
+    hasown "^2.0.4"
+    mime-types "^2.1.35"
 
 fsevents@~2.3.3:
   version "2.3.3"
@@ -1534,10 +1534,10 @@ has-tostringtag@^1.0.2:
   dependencies:
     has-symbols "^1.0.3"
 
-hasown@^2.0.2:
-  version "2.0.2"
-  resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.2.tgz#003eaf91be7adc372e84ec59dc37252cedb80003"
-  integrity sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==
+hasown@^2.0.2, hasown@^2.0.4:
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.4.tgz#8c62d8cb90beb2aad5d0a5b67581ad9854c3f003"
+  integrity sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==
   dependencies:
     function-bind "^1.1.2"
 
@@ -1732,7 +1732,7 @@ mime-db@1.52.0:
   resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.52.0.tgz#bbabcdc02859f4987301c856e3387ce5ec43bf70"
   integrity sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==
 
-mime-types@^2.1.12:
+mime-types@^2.1.35:
   version "2.1.35"
   resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a"
   integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
@@ -2262,9 +2262,9 @@ undici-types@~7.16.0:
   integrity sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==
 
 undici@^7.0.0:
-  version "7.18.2"
-  resolved "https://registry.yarnpkg.com/undici/-/undici-7.18.2.tgz#6cf724ef799a67d94fd55adf66b1e184176efcdf"
-  integrity sha512-y+8YjDFzWdQlSE9N5nzKMT3g4a5UBX1HKowfdXh0uvAnTaqqwqB92Jt4UXBAeKekDs5IaDKyJFR4X1gYVCgXcw==
+  version "7.28.0"
+  resolved "https://registry.yarnpkg.com/undici/-/undici-7.28.0.tgz#97d64564198b285bc281f0e8e29597e3d11fe7ec"
+  integrity sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==
 
 uri-js@^4.2.2:
   version "4.4.1"
@@ -2322,9 +2322,9 @@ wrappy@1:
   integrity sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==
 
 ws@^8.18.3:
-  version "8.19.0"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.19.0.tgz#ddc2bdfa5b9ad860204f5a72a4863a8895fd8c8b"
-  integrity sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==
+  version "8.21.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.0.tgz#012e413fc07429945121b0c153158c4343086951"
+  integrity sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==
 
 yocto-queue@^0.1.0:
   version "0.1.0"