create-warlock 5.30.0 → 5.31.0

package/skills/create-a-warlock-project/SKILL.md

@@ -32,7 +32,7 @@ The first positional argument is the project name; it also becomes the directory
 
 1. **Default (a TTY, no `--yes`, no `--interactive`)** — asks the project name (if not already given), API-only or full-stack web (`--stack`), then a database unless `--db` or `--no-db` already supplied it. The stack is the only choice that changes the generated app's shape.
 2. **`--yes` (or no TTY at all — CI, a script, an agent harness)** — fully headless. Every answer comes from a flag or its default; nothing is ever prompted, and stdin is never read.
-3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
+3. **`--interactive` (alias `--customize`)** — the full long-form wizard: project name, package manager, database driver, features, AI providers, lint/format toolchain, git, JWT — one prompt after another, exactly like earlier `create-warlock` releases.
 
 **Without a terminal, `--yes` is not required.** When stdin is not a TTY — CI, a
 script, a container, an agent harness — the scaffolder does not try to prompt,
@@ -46,7 +46,7 @@ that is just the project name, the one required answer with no default:
 ```
 A project name is required and no terminal is available to ask for one. Pass it as
 the first argument or --name=<name>. Non-interactive flags: --yes, --pm=<npm|yarn|pnpm>,
---db=<driver>|--no-db, --features=<list>, --ai=<list>, --git|--no-git, --jwt|--no-jwt.
+--db=<driver>|--no-db, --features=<list>, --ai=<list>, --lint=<oxc|eslint>, --git|--no-git, --jwt|--no-jwt.
 ```
 
 ## After scaffolding: the decisions summary
@@ -55,26 +55,30 @@ Because almost every choice defaults silently, `create-warlock` prints what it
 decided right after scaffolding, e.g.:
 
 ```
-Using npm · database: none · agent-kit targets: claude
+Using npm · database: none · lint: eslint · agent-kit targets: claude
+Features: none
   change these — package manager: --pm, database: --db/--no-db, agents: --agents,
-  features: --features, ai: --ai, git: --git/--no-git, jwt: --jwt/--no-jwt — or
+  features: --features, ai: --ai, lint: --lint, git: --git/--no-git, jwt: --jwt/--no-jwt — or
   re-run with --interactive for the full wizard.
 ```
 
 ## Flags
 
-| Flag                       | Takes value | Default        | Purpose                                                              |
-| --------------------------- | ----------- | -------------- | ------------------------------------------------------------------- |
-| `<positional>` / `--name`  | yes         | — (required)   | Project name + target directory.                                    |
-| `--stack`                  | yes         | `api`          | `api` or `web` — the structural choice; `web` seeds the `web` feature by default. |
-| `--db`                     | yes         | `mongodb`      | Database driver key (`mongodb`, `postgres`, or `none`).             |
-| `--no-db`                  | no          | —              | Opt out of a database — shorthand for `--db=none`.                  |
-| `--pm`                     | yes         | inferred (`npm_config_user_agent` / system) | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
-| `--features`                | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default. |
-| `--ai`                      | yes (CSV)   | none           | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).     |
-| `--agents`                  | yes (CSV)   | `claude`       | Comma-separated `agent-kit` targets — see below.                    |
-| `--git` / `--no-git`        | no          | off            | Initialize a Git repo (`git init` + `main` branch + initial commit).|
-| `--jwt` / `--no-jwt`        | no          | off            | Generate JWT secrets via the project's `jwt` script.               |
+| Flag                           | Takes value | Default                                                             | Purpose                                                                                                                |
+| ------------------------------ | ----------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `<positional>` / `--name`      | yes         | — (required)                                                        | Project name + target directory.                                                                                       |
+| `--stack`                      | yes         | `api`                                                               | `api` or `web` — the structural choice; `web` seeds the `web` feature by default.                                      |
+| `--db`                         | yes         | `mongodb`                                                           | Database driver key (`mongodb`, `postgres`, or `none`).                                                                |
+| `--no-db`                      | no          | —                                                                   | Opt out of a database — shorthand for `--db=none`.                                                                     |
+| `--pm`                         | yes         | inferred (`npm_config_user_agent` / system)                         | Package manager — must be one of `npm` / `yarn` / `pnpm` / `bun`; anything else is rejected before scaffolding starts. |
+| `--features`                   | yes (CSV)   | none, or `["web"]` when `--stack=web` and `--features` is not given | Comma-separated optional feature keys. An explicit `--features` always wins over the `--stack` default.                |
+| `--lint`                       | yes         | `eslint`                                                            | `oxc` (Oxlint/Oxfmt) or `eslint` (ESLint/Prettier); unknown or missing values fail before writes.                      |
+| `--ai`                         | yes (CSV)   | none                                                                | Comma-separated AI provider keys (auto-pulls `@warlock.js/ai`).                                                        |
+| `--agents`                     | yes (CSV)   | `claude`                                                            | Comma-separated `agent-kit` targets — see below.                                                                       |
+| `--git` / `--no-git`           | no          | off                                                                 | Initialize a Git repo (`git init` + `main` branch + initial commit).                                                   |
+| `--jwt` / `--no-jwt`           | no          | off                                                                 | Generate JWT secrets via the project's `jwt` script.                                                                   |
+| `--yes` / `-y`                 | no          | off                                                                 | Fully headless mode.                                                                                                   |
+| `--interactive`, `--customize` | no          | off                                                                 | Restore the full long-form wizard.                                                                                     |
 
 With `--pm=pnpm`, the scaffold reads `pnpm --version` and records install-script
 approvals (esbuild, and Sharp when the `image` feature is selected) where that
@@ -85,10 +89,8 @@ no workspace file (those versions reject one without `packages:`) but
 retained. If selected feature dependencies do
 not install, JWT generation is skipped and reported rather than retried through
 the package manager.
-| `--yes` / `-y`              | no          | off            | Fully headless mode.                                                 |
-| `--interactive`, `--customize` | no       | off            | Restore the full long-form wizard.                                   |
 
-Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--features` / `--ai` / `--agents` keys fail fast before any install.
+Value flags accept either `--db=postgres` or `--db postgres`. Unknown `--pm` / `--db` / `--features` / `--ai` / `--agents` / `--lint` values fail fast before any write or install.
 
 `--help`/`-h` and `--version`/`-v` short-circuit before anything else — no prompt, filesystem write, or network call, and `--help` wins even over a positional project name. `--version` prints the installed `create-warlock` version. `--help` lists every flag above together with its default.
 
@@ -102,18 +104,18 @@ fallback that always works — even fully offline. Any other target
 `goose`, …) is validated against the list published at
 https://mongez.js.org/agent-kit/llms.txt, fetched once and cached locally. If
 that fetch fails for an explicitly requested non-default target, the run fails
-visibly and names every target it *could* determine — it never silently
+visibly and names every target it _could_ determine — it never silently
 guesses.
 
 ## Valid keys
 
 **Database drivers** (`--db`):
 
-| Key        | Default port | Status      |
-| ---------- | ------------ | ----------- |
-| `mongodb`  | 27017        | available   |
-| `postgres` | 5432         | available   |
-| `mysql`    | 3306         | coming soon (disabled in the wizard) |
+| Key        | Default port | Status                                                                   |
+| ---------- | ------------ | ------------------------------------------------------------------------ |
+| `mongodb`  | 27017        | available                                                                |
+| `postgres` | 5432         | available                                                                |
+| `mysql`    | 3306         | coming soon (disabled in the wizard)                                     |
 | `none`     | —            | opt out — no driver, no driver package, `src/config/database.ts` removed |
 
 **Features** (`--features`): `react`, `react-email`, `mail`, `ses`, `image`, `s3`, `redis`, `scheduler`, `herald`, `socket`, `test`, `access`, `web`, `tailwind`, `shadcn`, `notifications`.
@@ -182,3 +184,47 @@ Failures surface the error and halt; there is no rollback. After it finishes, `c
 - The `run-app` topic of the `warlock-js-core` skill — `warlock dev` / `build` / `start` once the project exists.
 - The `create-module` topic of the `warlock-js-core` skill — generate a new module inside the project.
 - The `add-connector` topic of the `warlock-js-core` skill — what `warlock add` wires when a feature pulls a connector.
+
+The project-ready summary wraps the complete feature list to your terminal width.
+Terminals narrower than 50 columns get a plain list; piped output uses 80 columns.
+
+## Custom feature groups
+
+`--customize` opens a section menu for optional features. Open a section to edit
+its checklist; **Select all** includes the remaining features while preserving
+items you explicitly unticked. The category cursor stays on the last edited
+section. Section
+counts update when returning to the menu, and **Continue** keeps the selection.
+Flags preselect their existing feature keys. Both menus and checklists retain
+terminal paging. The decisions overview previews up to six feature/AI keys with
+a total count; the success screen shows the complete list.
+
+## Choose the linter and formatter
+
+`--lint=eslint` is the default. `--lint=oxc` (also `--lint oxc`) installs exact
+`oxlint@1.88.0` and `oxfmt@0.73.0` versions, emits `.oxlintrc.json` and
+`.oxfmtrc.json`, and removes the template's ESLint/Prettier configs and dependencies.
+The custom wizard prompts for the same choice; a flag preselects it.
+
+```bash
+npm create warlock@latest my-app -- --lint=oxc --yes
+```
+
+Both choices provide `lint`/`format` and non-mutating `lint:check`/`format:check`
+scripts. Oxc projects also configure VS Code format-on-save with the official
+`oxc.oxc-vscode` formatter, use `source.fixAll.oxc` for lint fixes and recommend
+that extension. The ESLint toolchain retains its Prettier/ESLint editor settings.
+Oxc config enables `devServer.healthCheckers: { eslint: false, oxlint: true }` and
+leaves TypeScript health checks enabled. Style matches the template's 100-column,
+double-quote, semicolon and trailing-comma settings. Import sorting is on in
+`.oxfmtrc.json`, kept to one block like the ESLint toolchain's
+`prettier-plugin-organize-imports`:
+
+```json
+{ "sortImports": { "newlinesBetween": false } }
+```
+
+`format` (`oxfmt --write ./src`) orders built-ins, then packages, then relative
+imports. Oxfmt does not delete unused imports, so remove them from Oxlint's
+`no-unused-vars` diagnostics. Scripts in both toolchains call local binaries
+(`eslint --fix ./src --max-warnings=0`, `tsc --noEmit`), never `npx`.

package/templates/toolchains/oxc/.oxfmtrc.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": true,
+  "tabWidth": 2,
+  "printWidth": 100,
+  "singleQuote": false,
+  "arrowParens": "always",
+  "trailingComma": "all",
+  "endOfLine": "lf",
+  "sortImports": { "newlinesBetween": false },
+  "ignorePatterns": ["node_modules/", "dist/"]
+}

package/templates/toolchains/oxc/.oxlintrc.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "import", "react"],
+  "env": { "node": true, "es2021": true },
+  "categories": { "correctness": "off" },
+  "rules": {
+    "typescript/no-explicit-any": "off",
+    "no-unused-vars": [
+      "warn",
+      {
+        "vars": "all",
+        "varsIgnorePattern": "^_",
+        "args": "after-used",
+        "argsIgnorePattern": "^_"
+      }
+    ],
+    "typescript/explicit-member-accessibility": ["error", { "accessibility": "explicit" }],
+    "typescript/consistent-type-imports": [
+      "error",
+      { "prefer": "type-imports", "disallowTypeAnnotations": false }
+    ]
+  },
+  "ignorePatterns": ["node_modules/", "dist/"]
+}

package/templates/toolchains/oxc/.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+  "recommendations": ["oxc.oxc-vscode"]
+}

package/templates/toolchains/oxc/.vscode/settings.json

@@ -0,0 +1,35 @@
+{
+  "editor.defaultFormatter": "oxc.oxc-vscode",
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.oxc": "explicit",
+    "source.organizeImports": "never"
+  },
+  "[typescript]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[typescriptreact]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[javascript]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[javascriptreact]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[json]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "[css]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true
+  },
+  "oxc.enable.oxlint": true,
+  "oxc.enable.oxfmt": true,
+  "oxc.requireConfig": true
+}

package/templates/warlock/AGENTS.md

@@ -80,8 +80,8 @@ automatically on `postinstall`).
 - `yarn start` — start the production server (`warlock start`)
 - `yarn migrate` / `yarn migrate.fresh` / `yarn migrate.list` — run migrations
 - `yarn seed` — run database seeders
-- `yarn lint` / `yarn format` / `yarn tsc` — lint (eslint --fix), format
-  (prettier), and type-check (`tsc --noEmit`)
+- `yarn lint` / `yarn format` / `yarn tsc` — lint and format with the selected toolchain, and type-check (`tsc --noEmit`)
+- `npx warlock check` — verify a change: typecheck, lint, the affected tests and the framework's conventions in one report (`--changed` for only what changed); run it after every change and loop until it exits 0
 - `yarn skills:sync` — re-sync skills from `node_modules` and regenerate the
   derived per-agent files from this `AGENTS.md`
 
@@ -98,6 +98,13 @@ suffixes, and JSDoc on the public surface. The bar is senior-level clean code, n
 
 - Respect **module-boundaries** — do not reach across module internals.
 - Never weaken the **security-baseline** — always validate input at boundaries.
+- `npx warlock check` enforces these rules whichever linter the project uses:
+  pass `request.validated()` (never `request.all()`) to queries and services
+  (`WL9005`), give every POST/PUT/PATCH/DELETE route auth middleware or an
+  explicit `public: true` (`WL9006`), wrap request-supplied redirect targets in
+  `safeRedirect()` (`WL9007`), keep raw emails, tokens and request bodies out of
+  logs (`WL9008`) and bound regexes that run on request input (`WL9009`). Each
+  problem carries its fix; `npx warlock explain <CODE>` prints it again.
 - Follow **git-workflow** for commits and branches; do not commit or push unless
   explicitly asked.
 - When you are unsure how a package or feature works, **stop and read its skill**
@@ -122,3 +129,16 @@ Three things that trip everyone up on a fresh app:
   instance does not expose its columns as direct properties — `post.title` is
   `undefined` at runtime and a type error. Use `post.get("title")`, or
   `post.toJSON()` in a page loader (resources are the serialization gate).
+
+## This app (generated)
+
+`warlock dev` rewrites everything between the two markers below from the
+running app — modules, routes, models, installed skills and the commands to
+verify a change. Edit outside the markers; turn it off with
+`devServer.agentsMd: false` in `warlock.config.ts`.
+
+<!-- warlock:generated:start -->
+
+Run `npx warlock dev` (or `npx warlock agents-md --write`) to fill this section.
+
+<!-- warlock:generated:end -->

package/templates/warlock/README.md

@@ -7,7 +7,7 @@ Full documentation: [warlock.js.org](https://warlock.js.org).
 
 ## Requirements
 
-- Node.js **22.13** or newer
+- Node.js **22.15** or newer
 - The database you picked when scaffolding (MongoDB or PostgreSQL), running and
   reachable with the settings in `.env` — skip this if you scaffolded with no
   database
@@ -40,8 +40,10 @@ It restarts on file changes.
 | `npm run seed` | Run the database seeders |
 | `npm run jwt` | Generate a JWT secret into `.env` |
 | `npm run tsc` | Type-check without building |
-| `npm run lint` | ESLint, auto-fixing what it can |
-| `npm run format` | Prettier over `src/` |
+| `npm run lint` | The configured linter, auto-fixing what it can |
+| `npm run format` | The configured formatter over `src/` |
+| `npm run lint:check` | Lint without changing files |
+| `npm run format:check` | Check formatting without changing files |
 | `npm run skills:sync` | Refresh the AI agent skills (see below) |
 
 The `warlock` CLI has more than the scripts expose — run `npx warlock --help`

package/templates/warlock/package.json

@@ -19,12 +19,14 @@
     "gen.mig": "warlock generate.migration",
     "gen.r": "warlock generate.repository",
     "gen.rs": "warlock generate.resource",
-    "lint": "npx eslint --fix ./src --max-warnings=0",
-    "format": "npx prettier --write ./src/**/*.{js,jsx,ts,tsx,css,md,json} --config ./.prettierrc.json",
-    "tsc": "warlock generate.typings && npx tsc --noEmit",
+    "lint": "eslint --fix ./src --max-warnings=0",
+    "format": "prettier --write \"./src/**/*.{js,jsx,ts,tsx,css,md,json}\" --config ./.prettierrc.json",
+    "tsc": "warlock generate.typings && tsc --noEmit",
     "postinstall": "agent-kit init && agent-kit sync || echo \"warning: AI agent skills were NOT synced, so coding agents will not see the @warlock.js skills. Run the skills:sync script.\"",
     "skills:sync": "agent-kit sync",
-    "skills:watch": "agent-kit watch"
+    "skills:watch": "agent-kit watch",
+    "lint:check": "eslint ./src --max-warnings=0",
+    "format:check": "prettier --check \"./src/**/*.{js,jsx,ts,tsx,css,md,json}\" --config ./.prettierrc.json"
   },
   "dependencies": {
     "@mongez/reinforcements": "^4.0.2",

package/templates/warlock/skills/api-design/SKILL.md

@@ -24,8 +24,8 @@ The list lands under the **plural name of the module's resource** — `users`, `
 
 ```typescript
 // ✅ list-users.controller.ts
-export const listUsersController: RequestHandler = async (request, response) => {
-  const { data, pagination } = await listUsersService(request.all());
+export const listUsersController: RequestHandler = async ({ request, response }) => {
+  const { data, pagination } = await listUsersService(request.validated());
 
   return response.success({
     users: data,

package/templates/warlock/skills/code-standards/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: code-standards
-description: 'Project-level TypeScript code standards for apps built on Warlock.js — `interface` vs `type`, access modifiers, no `any`, no inline-duplicated unions, file-naming suffixes (`.contract.ts` / `.type.ts` / `.service.ts` / `.model.ts` / `.resource.ts` / `.spec.ts`), single-responsibility files, FP-factory + internal-class pattern, brace-every-control-block readability with blank lines between consecutive blocks, JSDoc on public surface and non-obvious logic, error classes extending framework errors, async/await + `Promise.all`, `undefined` over `null`, Vitest co-located, ESLint + Prettier. Triggers: writing/editing any `.ts` / `.tsx` file in this project; user asks "what are the code standards / style rules / conventions"; spawning a sub-agent that will write code; reviewing a diff for style issues; deciding `interface` vs `type`, when to use a class, where helpers live, how to name a file, or whether something needs JSDoc. Skip: pure-Markdown / JSON / YAML edits with no code change; runtime / behavior questions about a specific framework primitive — load the relevant `@warlock.js/<pkg>` skill instead; package-publishing or CI workflow questions.'
+description: 'Project-level TypeScript code standards for apps built on Warlock.js — `interface` vs `type`, access modifiers, no `any`, no inline-duplicated unions, file-naming suffixes (`.contract.ts` / `.type.ts` / `.service.ts` / `.model.ts` / `.resource.ts` / `.spec.ts`), single-responsibility files, FP-factory + internal-class pattern, brace-every-control-block readability with blank lines between consecutive blocks, JSDoc on public surface and non-obvious logic, error classes extending framework errors, async/await + `Promise.all`, `undefined` over `null`, Vitest co-located, ESLint/Prettier or Oxlint/Oxfmt. Triggers: writing/editing any `.ts` / `.tsx` file in this project; user asks "what are the code standards / style rules / conventions"; spawning a sub-agent that will write code; reviewing a diff for style issues; deciding `interface` vs `type`, when to use a class, where helpers live, how to name a file, or whether something needs JSDoc. Skip: pure-Markdown / JSON / YAML edits with no code change; runtime / behavior questions about a specific framework primitive — load the relevant `@warlock.js/<pkg>` skill instead; package-publishing or CI workflow questions.'
 ---
 
 # Code Standards
@@ -551,7 +551,20 @@ A secret with no safe default (a payment key, a signing secret) should fail loud
 
 ## 11. Tooling
 
-Ship a `.eslintrc` with at least these rules on:
+Use the project's selected toolchain: `eslint.config.js` + `.prettierrc.json`, or
+`.oxlintrc.json` + `.oxfmtrc.json`. Run `npm run lint:check` and
+`npm run format:check` for non-mutating checks. The Oxc scaffold enables the
+Oxlint development health checker and retains TypeScript checking.
+
+`npx warlock check` is the one verify command, in either toolchain: it
+typechecks, runs the configured linter and the affected tests, and checks the
+framework's conventions — `request.validated()` instead of `request.all()`,
+guarded or `public: true` mutating routes, safe redirects, redacted logs,
+bounded regexes on input, one controller per file, `type` (not `kind`) as a
+union's discriminator. Each problem has a `WL` code and its fix
+(`npx warlock explain <CODE>`).
+
+For ESLint, consider enabling these additional rules:
 
 - `@typescript-eslint/explicit-member-accessibility` — enforces § 1.2
 - `@typescript-eslint/no-explicit-any` — enforces § 1.3
@@ -561,7 +574,7 @@ Ship a `.eslintrc` with at least these rules on:
 - `curly` — enforces braces (§ 4.4)
 - `no-console` — enforces § 8
 
-Match the project's `.prettierrc` exactly. If two configs are present and disagree, the one closer to the file wins (Prettier's resolution order). Don't fight the formatter — configure it, then trust it.
+Match the selected formatter config: `.prettierrc.json` or `.oxfmtrc.json`. Both use 100 columns, double quotes, semicolons and trailing commas. Oxfmt does not run `prettier-plugin-organize-imports`; maintain import order and remove unused imports separately, then run the linter.
 
 ---
 
@@ -583,7 +596,8 @@ Before any change ships:
 - [ ] JSDoc on every public export and every multi-method class
 - [ ] No `console.log`, `log.<level>(module, action, message, context)` signature used correctly
 - [ ] Tests co-located, public-surface-driven
-- [ ] `tsc --noEmit` and `eslint` pass clean
+- [ ] `tsc --noEmit`, `npm run lint:check` and `npm run format:check` pass clean
+- [ ] `npx warlock check` exits 0
 
 **Non-negotiable defaults**
 - [ ] Every untrusted input has a `@warlock.js/seal` schema at the boundary

package/templates/warlock/skills/security-baseline/SKILL.md

@@ -243,7 +243,17 @@ The framework sets `Content-Type: application/json` for `response.success(...)`
 
 ### 5.3 Open redirects
 
-If you implement a "redirect back to where the user came from" feature, validate the destination URL against a whitelist of internal paths. Never blindly follow a user-supplied URL.
+If you implement a "redirect back to where the user came from" feature, validate the destination URL against a whitelist of internal paths. Never blindly follow a user-supplied URL. `safeRedirect()` from `@warlock.js/core` does it: same-origin paths and the origins you allow pass, anything else becomes the fallback.
+
+```typescript
+import { safeRedirect, type RequestHandler } from "@warlock.js/core";
+
+export const afterLoginController: RequestHandler = async ({ request, response }) => {
+  return response.redirect(safeRedirect(request.input("next"), { fallback: "/dashboard" }));
+};
+```
+
+`npx warlock check` reports a redirect target taken from request input without it as `WL9007`.
 
 ### 5.4 CORS
 
@@ -350,3 +360,4 @@ Before merging a change that touches input, identity, secrets, or persistence:
 - [ ] Logger redaction config covers any new sensitive field introduced
 - [ ] File uploads cap size, sniff MIME, server-generate the stored filename
 - [ ] Webhooks verify signature before any other work
+- [ ] `npx warlock check` reports no `WL9005`–`WL9009` problem (unvalidated `request.all()`, unguarded mutating route, unsafe redirect, sensitive value in a log, unbounded regex on input)

package/templates/warlock/skills/testing-strategy/SKILL.md

@@ -170,6 +170,23 @@ vi.advanceTimersByTime(1000);
 
 A test that sleeps is a test that's slow and flaky. Stub the clock.
 
+Code that reads time through `clock.now()` / `clock.timestamp()` from `@warlock.js/core` gets a frozen clock in tests already (`clockFake.travel(ms)` moves it), with no fake timers involved.
+
+### 4.5 Mail, queue, cache, storage — fakes are already on
+
+In the test environment `setupTest()` installs fakes for mail, queue, cache, storage, clock and ids. Assert on them instead of mocking the drivers:
+
+```typescript
+import { mailFake, queueFake } from "@warlock.js/core/tests";
+
+const order = { id: 42 }; // what the code under test placed
+
+mailFake.assertSent({ to: "ada@example.test" });
+queueFake.assertPushed("invoices.send", { orderId: order.id });
+```
+
+Fixtures come from `defineFactory()` (deterministic, no faker). Opt out of a fake in `src/config/tests.ts` (`fakes: { cache: false }`). `warlock test --changed` runs only the tests a change affects. See the `test-fakes` and `model-factories` skills of `@warlock.js/core`.
+
 ---
 
 ## 5. AAA structure

package/templates/warlock/src/app/auth/routes.ts

@@ -1,3 +1,8 @@
+import {
+  loginThrottleMiddleware,
+  tokenConsumeThrottleMiddleware,
+  tokenIssueThrottleMiddleware,
+} from "@warlock.js/auth";
 import { router } from "@warlock.js/core";
 import { guarded } from "app/shared/utils/router";
 import { forgotPasswordController } from "./controllers/forgot-password.controller";
@@ -8,12 +13,27 @@ import { meController } from "./controllers/me.controller";
 import { refreshTokenController } from "./controllers/refresh-token.controller";
 import { resetPasswordController } from "./controllers/reset-password.controller";
 
-// Auth routes
+// Auth routes. Sign-in and password recovery are open by design (`public: true`)
+// and throttled; the rest need a signed-in user.
 router.prefix("/auth", () => {
-  router.post("/login", loginController);
-  router.post("/refresh-token", refreshTokenController);
-  router.post("/forgot-password", forgotPasswordController);
-  router.post("/reset-password", resetPasswordController);
+  // Failed sign-ins lock the account and the IP after 5 tries in 15 minutes.
+  router.post("/login", loginController, {
+    public: true,
+    middleware: [loginThrottleMiddleware()],
+  });
+  router.post("/refresh-token", refreshTokenController, {
+    public: true,
+    rateLimit: { max: 30, timeWindow: 60_000 },
+  });
+  // Reset mails: 3 per hour per email and per IP. Reset attempts: 10 failures per 15 minutes.
+  router.post("/forgot-password", forgotPasswordController, {
+    public: true,
+    middleware: [tokenIssueThrottleMiddleware()],
+  });
+  router.post("/reset-password", resetPasswordController, {
+    public: true,
+    middleware: [tokenConsumeThrottleMiddleware()],
+  });
   guarded(() => {
     router.post("/logout", logoutController);
     router.post("/logout-all", logoutAllController);

package/templates/warlock/src/app/auth/utils/types.ts

@@ -7,4 +7,9 @@ export type OTPChannel = "email" | "sms" | "whatsapp" | "push";
  * Common OTP types
  */
 export type OTPType =
-  "password-reset" | "email-verification" | "phone-verification" | "two-factor" | string;
+  | "password-reset"
+  | "email-verification"
+  | "phone-verification"
+  | "two-factor"
+  // Applications may also define their own OTP purposes.
+  | string;

package/templates/warlock/src/app/contact/routes.ts

@@ -1,4 +1,4 @@
 import { router } from "@warlock.js/core";
 import { contactController } from "./controllers/contact.controller";
 
-router.post("/api/contact", contactController);
+router.post("/api/contact", contactController, { public: true });

package/templates/warlock/src/app/locale/routes.ts

@@ -1,4 +1,4 @@
 import { router } from "@warlock.js/core";
 import { localeController } from "./controllers/locale.controller";
 
-router.post("/api/locale", localeController);
+router.post("/api/locale", localeController, { public: true });

package/templates/warlock/src/app/users/controllers/list-users.controller.ts

@@ -1,8 +1,12 @@
 import { type GuardedRequestHandler } from "app/auth/requests/guarded.request";
 import { usersRepository } from "../repositories/users.repository";
+import { type ListUsersSchema, listUsersSchema } from "../schema/list-users.schema";
 
-export const listUsersController: GuardedRequestHandler = async ({ request, response }) => {
-  const users = await usersRepository.listCached(request.all());
+export const listUsersController: GuardedRequestHandler<ListUsersSchema> = async ({
+  request,
+  response,
+}) => {
+  const users = await usersRepository.listCached(request.validated());
 
   return response.success({
     users,
@@ -10,3 +14,7 @@ export const listUsersController: GuardedRequestHandler = async ({ request, resp
 };
 
 listUsersController.description = "List Users Controller";
+
+listUsersController.validation = {
+  schema: listUsersSchema,
+};

package/templates/warlock/src/app/users/schema/list-users.schema.ts

@@ -0,0 +1,15 @@
+import { type Infer, v } from "@warlock.js/seal";
+
+/**
+ * Query parameters the user list accepts. Unknown keys are stripped, so a
+ * smuggled operator (`?email[$ne]=`) never reaches the repository filters.
+ */
+export const listUsersSchema = v.object({
+  id: v.string().optional(),
+  name: v.string().max(100).optional(),
+  email: v.string().max(255).optional(),
+  page: v.numeric().min(1).optional(),
+  limit: v.numeric().min(1).max(100).optional(),
+});
+
+export type ListUsersSchema = Infer<typeof listUsersSchema>;

package/templates/warlock/src/config/tests.ts

@@ -1,5 +1,13 @@
 const testsConfigurations = {
+  // In tests, mail, queue, cache, storage, clock and ids are faked by default:
+  // nothing is delivered, pushed to Redis or uploaded, and assertions such as
+  // mailFake.assertSent(...) work (see @warlock.js/core/tests).
   //
+  // Opt out of every fake, keeping the real drivers:
+  // fakes: false,
+  //
+  // ...or of one, e.g. keep the configured cache driver:
+  // fakes: { cache: false },
 };
 
 export default testsConfigurations;

package/templates/warlock/src/web/404.css

@@ -14,12 +14,8 @@
   padding-inline: clamp(1.5rem, 7vw, 8rem);
   background: #fafafa;
   color: #18181b;
-  font-family:
-    system-ui,
-    -apple-system,
-    BlinkMacSystemFont,
-    "Segoe UI",
-    sans-serif;
+  /* prettier-ignore */
+  font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
 }
 
 .not-found__content {