create-warlock 5.30.0 → 5.32.0

package/templates/warlock/skills/code-standards/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: code-standards
-description: 'Project-level TypeScript code standards for apps built on Warlock.js — `interface` vs `type`, access modifiers, no `any`, no inline-duplicated unions, file-naming suffixes (`.contract.ts` / `.type.ts` / `.service.ts` / `.model.ts` / `.resource.ts` / `.spec.ts`), single-responsibility files, FP-factory + internal-class pattern, brace-every-control-block readability with blank lines between consecutive blocks, JSDoc on public surface and non-obvious logic, error classes extending framework errors, async/await + `Promise.all`, `undefined` over `null`, Vitest co-located, ESLint + Prettier. Triggers: writing/editing any `.ts` / `.tsx` file in this project; user asks "what are the code standards / style rules / conventions"; spawning a sub-agent that will write code; reviewing a diff for style issues; deciding `interface` vs `type`, when to use a class, where helpers live, how to name a file, or whether something needs JSDoc. Skip: pure-Markdown / JSON / YAML edits with no code change; runtime / behavior questions about a specific framework primitive — load the relevant `@warlock.js/<pkg>` skill instead; package-publishing or CI workflow questions.'
+description: 'Project-level TypeScript code standards for apps built on Warlock.js — `interface` vs `type`, access modifiers, no `any`, no inline-duplicated unions, file-naming suffixes (`.contract.ts` / `.type.ts` / `.service.ts` / `.model.ts` / `.resource.ts` / `.spec.ts`), single-responsibility files, FP-factory + internal-class pattern, brace-every-control-block readability with blank lines between consecutive blocks, JSDoc on public surface and non-obvious logic, error classes extending framework errors, async/await + `Promise.all`, `undefined` over `null`, Vitest co-located, ESLint/Prettier or Oxlint/Oxfmt. Triggers: writing/editing any `.ts` / `.tsx` file in this project; user asks "what are the code standards / style rules / conventions"; spawning a sub-agent that will write code; reviewing a diff for style issues; deciding `interface` vs `type`, when to use a class, where helpers live, how to name a file, or whether something needs JSDoc. Skip: pure-Markdown / JSON / YAML edits with no code change; runtime / behavior questions about a specific framework primitive — load the relevant `@warlock.js/<pkg>` skill instead; package-publishing or CI workflow questions.'
 ---
 
 # Code Standards
@@ -551,7 +551,20 @@ A secret with no safe default (a payment key, a signing secret) should fail loud
 
 ## 11. Tooling
 
-Ship a `.eslintrc` with at least these rules on:
+Use the project's selected toolchain: `eslint.config.js` + `.prettierrc.json`, or
+`.oxlintrc.json` + `.oxfmtrc.json`. Run `npm run lint:check` and
+`npm run format:check` for non-mutating checks. The Oxc scaffold enables the
+Oxlint development health checker and retains TypeScript checking.
+
+`npx warlock check` is the one verify command, in either toolchain: it
+typechecks, runs the configured linter and the affected tests, and checks the
+framework's conventions — `request.validated()` instead of `request.all()`,
+guarded or `public: true` mutating routes, safe redirects, redacted logs,
+bounded regexes on input, one controller per file, `type` (not `kind`) as a
+union's discriminator. Each problem has a `WL` code and its fix
+(`npx warlock explain <CODE>`).
+
+For ESLint, consider enabling these additional rules:
 
 - `@typescript-eslint/explicit-member-accessibility` — enforces § 1.2
 - `@typescript-eslint/no-explicit-any` — enforces § 1.3
@@ -561,7 +574,7 @@ Ship a `.eslintrc` with at least these rules on:
 - `curly` — enforces braces (§ 4.4)
 - `no-console` — enforces § 8
 
-Match the project's `.prettierrc` exactly. If two configs are present and disagree, the one closer to the file wins (Prettier's resolution order). Don't fight the formatter — configure it, then trust it.
+Match the selected formatter config: `.prettierrc.json` or `.oxfmtrc.json`. Both use 100 columns, double quotes, semicolons and trailing commas. Prettier uses `@ianvs/prettier-plugin-sort-imports` (Babel, independent of TypeScript); it sorts built-ins, packages, aliases (`app/*`, `web/*`, `@shared/*`) and relatives in one block while preserving separate type imports. Oxfmt sorts imports through its own configuration. Both retain unused imports: ESLint reports them through `unused-imports/no-unused-imports`, and Oxlint through `no-unused-vars`. Run the formatter, then the linter.
 
 ---
 
@@ -583,7 +596,8 @@ Before any change ships:
 - [ ] JSDoc on every public export and every multi-method class
 - [ ] No `console.log`, `log.<level>(module, action, message, context)` signature used correctly
 - [ ] Tests co-located, public-surface-driven
-- [ ] `tsc --noEmit` and `eslint` pass clean
+- [ ] `tsc --noEmit`, `npm run lint:check` and `npm run format:check` pass clean
+- [ ] `npx warlock check` exits 0
 
 **Non-negotiable defaults**
 - [ ] Every untrusted input has a `@warlock.js/seal` schema at the boundary

package/templates/warlock/skills/security-baseline/SKILL.md

@@ -243,7 +243,17 @@ The framework sets `Content-Type: application/json` for `response.success(...)`
 
 ### 5.3 Open redirects
 
-If you implement a "redirect back to where the user came from" feature, validate the destination URL against a whitelist of internal paths. Never blindly follow a user-supplied URL.
+If you implement a "redirect back to where the user came from" feature, validate the destination URL against a whitelist of internal paths. Never blindly follow a user-supplied URL. `safeRedirect()` from `@warlock.js/core` does it: same-origin paths and the origins you allow pass, anything else becomes the fallback.
+
+```typescript
+import { safeRedirect, type RequestHandler } from "@warlock.js/core";
+
+export const afterLoginController: RequestHandler = async ({ request, response }) => {
+  return response.redirect(safeRedirect(request.input("next"), { fallback: "/dashboard" }));
+};
+```
+
+`npx warlock check` reports a redirect target taken from request input without it as `WL9007`.
 
 ### 5.4 CORS
 
@@ -350,3 +360,4 @@ Before merging a change that touches input, identity, secrets, or persistence:
 - [ ] Logger redaction config covers any new sensitive field introduced
 - [ ] File uploads cap size, sniff MIME, server-generate the stored filename
 - [ ] Webhooks verify signature before any other work
+- [ ] `npx warlock check` reports no `WL9005`–`WL9009` problem (unvalidated `request.all()`, unguarded mutating route, unsafe redirect, sensitive value in a log, unbounded regex on input)

package/templates/warlock/skills/testing-strategy/SKILL.md

@@ -170,6 +170,23 @@ vi.advanceTimersByTime(1000);
 
 A test that sleeps is a test that's slow and flaky. Stub the clock.
 
+Code that reads time through `clock.now()` / `clock.timestamp()` from `@warlock.js/core` gets a frozen clock in tests already (`clockFake.travel(ms)` moves it), with no fake timers involved.
+
+### 4.5 Mail, queue, cache, storage — fakes are already on
+
+In the test environment `setupTest()` installs fakes for mail, queue, cache, storage, clock and ids. Assert on them instead of mocking the drivers:
+
+```typescript
+import { mailFake, queueFake } from "@warlock.js/core/tests";
+
+const order = { id: 42 }; // what the code under test placed
+
+mailFake.assertSent({ to: "ada@example.test" });
+queueFake.assertPushed("invoices.send", { orderId: order.id });
+```
+
+Fixtures come from `defineFactory()` (deterministic, no faker). Opt out of a fake in `src/config/tests.ts` (`fakes: { cache: false }`). `warlock test --changed` runs only the tests a change affects. See the `test-fakes` and `model-factories` skills of `@warlock.js/core`.
+
 ---
 
 ## 5. AAA structure

package/templates/warlock/src/app/auth/controllers/login.controller.ts

@@ -1,5 +1,5 @@
 import { type Request, type RequestHandler } from "@warlock.js/core";
-import { type LoginSchema, loginSchema } from "../schema/login.schema";
+import { loginSchema, type LoginSchema } from "../schema/login.schema";
 import { loginService } from "../services/auth.service";
 
 /**

package/templates/warlock/src/app/auth/routes.ts

@@ -1,3 +1,8 @@
+import {
+  loginThrottleMiddleware,
+  tokenConsumeThrottleMiddleware,
+  tokenIssueThrottleMiddleware,
+} from "@warlock.js/auth";
 import { router } from "@warlock.js/core";
 import { guarded } from "app/shared/utils/router";
 import { forgotPasswordController } from "./controllers/forgot-password.controller";
@@ -8,12 +13,27 @@ import { meController } from "./controllers/me.controller";
 import { refreshTokenController } from "./controllers/refresh-token.controller";
 import { resetPasswordController } from "./controllers/reset-password.controller";
 
-// Auth routes
+// Auth routes. Sign-in and password recovery are open by design (`public: true`)
+// and throttled; the rest need a signed-in user.
 router.prefix("/auth", () => {
-  router.post("/login", loginController);
-  router.post("/refresh-token", refreshTokenController);
-  router.post("/forgot-password", forgotPasswordController);
-  router.post("/reset-password", resetPasswordController);
+  // Failed sign-ins lock the account and the IP after 5 tries in 15 minutes.
+  router.post("/login", loginController, {
+    public: true,
+    middleware: [loginThrottleMiddleware()],
+  });
+  router.post("/refresh-token", refreshTokenController, {
+    public: true,
+    rateLimit: { max: 30, timeWindow: 60_000 },
+  });
+  // Reset mails: 3 per hour per email and per IP. Reset attempts: 10 failures per 15 minutes.
+  router.post("/forgot-password", forgotPasswordController, {
+    public: true,
+    middleware: [tokenIssueThrottleMiddleware()],
+  });
+  router.post("/reset-password", resetPasswordController, {
+    public: true,
+    middleware: [tokenConsumeThrottleMiddleware()],
+  });
   guarded(() => {
     router.post("/logout", logoutController);
     router.post("/logout-all", logoutAllController);

package/templates/warlock/src/app/auth/utils/types.ts

@@ -7,4 +7,9 @@ export type OTPChannel = "email" | "sms" | "whatsapp" | "push";
  * Common OTP types
  */
 export type OTPType =
-  "password-reset" | "email-verification" | "phone-verification" | "two-factor" | string;
+  | "password-reset"
+  | "email-verification"
+  | "phone-verification"
+  | "two-factor"
+  // Applications may also define their own OTP purposes.
+  | string;

package/templates/warlock/src/app/contact/controllers/contact.controller.ts

@@ -1,6 +1,6 @@
-import { contactSchema } from "@shared/contact.schema";
 import { type Request, type RequestHandler } from "@warlock.js/core";
 import { type Infer } from "@warlock.js/seal";
+import { contactSchema } from "@shared/contact.schema";
 
 export type ContactSchema = Infer.Output<typeof contactSchema>;
 

package/templates/warlock/src/app/contact/routes.ts

@@ -1,4 +1,4 @@
 import { router } from "@warlock.js/core";
 import { contactController } from "./controllers/contact.controller";
 
-router.post("/api/contact", contactController);
+router.post("/api/contact", contactController, { public: true });

package/templates/warlock/src/app/locale/controllers/locale.controller.ts

@@ -1,5 +1,5 @@
-import { localeSchema, type LocaleSchema } from "@shared/locale.schema";
 import { type Request, type RequestHandler } from "@warlock.js/core";
+import { localeSchema, type LocaleSchema } from "@shared/locale.schema";
 
 /** POST /api/locale — persists the visitor's locale preference in a cookie. */
 export const localeController: RequestHandler<Request<LocaleSchema>> = async ({

package/templates/warlock/src/app/locale/routes.ts

@@ -1,4 +1,4 @@
 import { router } from "@warlock.js/core";
 import { localeController } from "./controllers/locale.controller";
 
-router.post("/api/locale", localeController);
+router.post("/api/locale", localeController, { public: true });

package/templates/warlock/src/app/posts/controllers/create-new-post.controller.ts

@@ -1,6 +1,6 @@
 import { type GuardedRequestHandler } from "app/auth/requests/guarded.request";
 import { Post } from "../models/post/post.model";
-import { type CreatePostSchema, createPostSchema } from "../schema/create-post.schema";
+import { createPostSchema, type CreatePostSchema } from "../schema/create-post.schema";
 
 export const createNewPostController: GuardedRequestHandler<CreatePostSchema> = async ({
   request,

package/templates/warlock/src/app/posts/controllers/update-post.controller.ts

@@ -1,6 +1,6 @@
 import { type GuardedRequestHandler } from "app/auth/requests/guarded.request";
 import { Post } from "../models/post/post.model";
-import { type UpdatePostSchema, updatePostSchema } from "../schema/update-post.schema";
+import { updatePostSchema, type UpdatePostSchema } from "../schema/update-post.schema";
 
 export const updatePostController: GuardedRequestHandler<UpdatePostSchema> = async ({
   request,

package/templates/warlock/src/app/posts/models/post/post.model.ts

@@ -1,6 +1,6 @@
 import { Model, RegisterModel } from "@warlock.js/cascade";
 import { useComputedSlug } from "@warlock.js/core";
-import { type Infer, v } from "@warlock.js/seal";
+import { v, type Infer } from "@warlock.js/seal";
 import { PostResource } from "app/posts/resources/post.resource";
 
 export const postSchema = v.object({

package/templates/warlock/src/app/posts/schema/create-post.schema.ts

@@ -1,4 +1,4 @@
-import { type Infer, v } from "@warlock.js/seal";
+import { v, type Infer } from "@warlock.js/seal";
 
 export const createPostSchema = v.object({
   title: v.string(),

package/templates/warlock/src/app/posts/schema/update-post.schema.ts

@@ -1,4 +1,4 @@
-import { type Infer, v } from "@warlock.js/seal";
+import { v, type Infer } from "@warlock.js/seal";
 
 export const updatePostSchema = v.object({
   title: v.string(),

package/templates/warlock/src/app/users/controllers/create-new-user.controller.ts

@@ -1,6 +1,6 @@
 import { type GuardedRequestHandler } from "app/auth/requests/guarded.request";
 import { User } from "../models/user";
-import { type CreateUserSchema, createUserSchema } from "../schema/create-user.schema";
+import { createUserSchema, type CreateUserSchema } from "../schema/create-user.schema";
 
 export const createNewUserController: GuardedRequestHandler<CreateUserSchema> = async ({
   request,

package/templates/warlock/src/app/users/controllers/list-users.controller.ts

@@ -1,8 +1,12 @@
 import { type GuardedRequestHandler } from "app/auth/requests/guarded.request";
 import { usersRepository } from "../repositories/users.repository";
+import { listUsersSchema, type ListUsersSchema } from "../schema/list-users.schema";
 
-export const listUsersController: GuardedRequestHandler = async ({ request, response }) => {
-  const users = await usersRepository.listCached(request.all());
+export const listUsersController: GuardedRequestHandler<ListUsersSchema> = async ({
+  request,
+  response,
+}) => {
+  const users = await usersRepository.listCached(request.validated());
 
   return response.success({
     users,
@@ -10,3 +14,7 @@ export const listUsersController: GuardedRequestHandler = async ({ request, resp
 };
 
 listUsersController.description = "List Users Controller";
+
+listUsersController.validation = {
+  schema: listUsersSchema,
+};

package/templates/warlock/src/app/users/models/user/user.model.ts

@@ -1,7 +1,7 @@
 import { Auth } from "@warlock.js/auth";
 import { RegisterModel } from "@warlock.js/cascade";
 import { useHashedPassword } from "@warlock.js/core";
-import { type Infer, v } from "@warlock.js/seal";
+import { v, type Infer } from "@warlock.js/seal";
 import { UserResource } from "app/users/resources/user.resource";
 
 export const userSchema = v.object({

package/templates/warlock/src/app/users/schema/create-user.schema.ts

@@ -1,4 +1,4 @@
-import { type Infer, v } from "@warlock.js/seal";
+import { v, type Infer } from "@warlock.js/seal";
 import { User } from "../models/user";
 
 export const createUserSchema = v.object({

package/templates/warlock/src/app/users/schema/list-users.schema.ts

@@ -0,0 +1,15 @@
+import { v, type Infer } from "@warlock.js/seal";
+
+/**
+ * Query parameters the user list accepts. Unknown keys are stripped, so a
+ * smuggled operator (`?email[$ne]=`) never reaches the repository filters.
+ */
+export const listUsersSchema = v.object({
+  id: v.string().optional(),
+  name: v.string().max(100).optional(),
+  email: v.string().max(255).optional(),
+  page: v.numeric().min(1).optional(),
+  limit: v.numeric().min(1).max(100).optional(),
+});
+
+export type ListUsersSchema = Infer<typeof listUsersSchema>;

package/templates/warlock/src/config/storage.ts

@@ -1,8 +1,8 @@
 import {
   env,
-  type StorageConfigurations,
   storageConfigurations,
   uploadsPath,
+  type StorageConfigurations,
 } from "@warlock.js/core";
 
 const storageOptions: StorageConfigurations = {

package/templates/warlock/src/config/tests.ts

@@ -1,5 +1,13 @@
 const testsConfigurations = {
+  // In tests, mail, queue, cache, storage, clock and ids are faked by default:
+  // nothing is delivered, pushed to Redis or uploaded, and assertions such as
+  // mailFake.assertSent(...) work (see @warlock.js/core/tests).
   //
+  // Opt out of every fake, keeping the real drivers:
+  // fakes: false,
+  //
+  // ...or of one, e.g. keep the configured cache driver:
+  // fakes: { cache: false },
 };
 
 export default testsConfigurations;

package/templates/warlock/src/web/404.css

@@ -14,12 +14,8 @@
   padding-inline: clamp(1.5rem, 7vw, 8rem);
   background: #fafafa;
   color: #18181b;
-  font-family:
-    system-ui,
-    -apple-system,
-    BlinkMacSystemFont,
-    "Segoe UI",
-    sans-serif;
+  /* prettier-ignore */
+  font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
 }
 
 .not-found__content {

package/templates/warlock/src/web/assets.d.ts

@@ -0,0 +1,2 @@
+/** Styles imported by the web build are loaded for their side effects. */
+declare module "*.css" {}

package/templates/warlock/src/web/home/components/contact-form-controls.tsx

@@ -1,4 +1,4 @@
-import { type FormControlProps, useFormControl, useSubmitButton } from "@mongez/react-form";
+import { useFormControl, useSubmitButton, type FormControlProps } from "@mongez/react-form";
 import { type ReactNode } from "react";
 
 type ContactFieldProps = FormControlProps & {

package/templates/warlock/src/web/home/components/hero-section.tsx

@@ -1,4 +1,5 @@
 import { RuntimePreview } from "./runtime-preview";
+
 type HeroSectionProps = { statusMessage: string };
 export function HeroSection({ statusMessage }: HeroSectionProps) {
   return (

package/templates/warlock/tsconfig.json

@@ -1,5 +1,6 @@
 {
   "compilerOptions": {
+    "types": ["node"],
     "target": "ESNext",
     "lib": ["esnext", "dom"],
     "allowJs": false,
@@ -7,7 +8,6 @@
     "experimentalDecorators": false,
     "esModuleInterop": true,
     "allowSyntheticDefaultImports": true,
-    "downlevelIteration": true,
     "strict": true,
     "forceConsistentCasingInFileNames": true,
     "noFallthroughCasesInSwitch": true,