@agentic-kit/pi 0.2.0

package/esm/provision-database/create-database-provision.js

@@ -0,0 +1,48 @@
+// Provision a database through the modules endpoint's createDatabaseProvisionModule
+// mutation — an insert into database_provision_modules whose BEFORE INSERT trigger
+// creates the database, domain, API, and module set before the row returns (the
+// same contract constructive-client's admin app uses). The retired requestDatabase
+// mutation only ever existed on dev builds of the api endpoint; production
+// deployments (modules.launchql.dev) expose this one. bootstrapUser: true copies
+// the owner into the new database so its per-DB API recognizes the account user.
+// The generated ORM's default adapter is plain fetch, so the SDK's FetchAdapter is
+// injected to keep *.localhost DNS/Host routing working in Node.
+import { api, modules } from '@constructive-io/sdk';
+export async function createDatabaseProvision(args) {
+    const db = modules.createClient({
+        adapter: new api.FetchAdapter(args.endpoint, {
+            Authorization: `Bearer ${args.bearer}`,
+        }),
+    });
+    const result = await db.databaseProvisionModule
+        .create({
+        data: {
+            databaseName: args.databaseName,
+            subdomain: args.databaseName,
+            domain: args.domain,
+            ownerId: args.ownerId,
+            modules: args.modules,
+            bootstrapUser: true,
+        },
+        select: {
+            id: true,
+            databaseId: true,
+            status: true,
+            errorMessage: true,
+            completedAt: true,
+        },
+    })
+        .unwrap();
+    const record = result.createDatabaseProvisionModule?.databaseProvisionModule;
+    if (!record)
+        throw new Error('createDatabaseProvisionModule returned no provision record.');
+    if (record.status === 'failed') {
+        throw new Error(record.errorMessage ?? 'provisioning failed');
+    }
+    if (record.status !== 'completed') {
+        throw new Error(record.errorMessage ?? `provisioning did not complete (status: ${record.status ?? 'unknown'})`);
+    }
+    if (!record.databaseId)
+        throw new Error('provisioning completed but returned no databaseId.');
+    return { databaseId: record.databaseId };
+}

package/esm/provision-database/credential.d.ts

@@ -0,0 +1,14 @@
+export type AccountCredential = {
+    userId: string;
+    accessToken: string;
+    apiKey?: string;
+};
+export type ProvisionCredential = {
+    mode: 'account';
+    ownerId: string;
+    bearer: string;
+} | {
+    mode: 'error';
+    reason: string;
+};
+export declare function selectProvisionCredential(account: AccountCredential | null | undefined): ProvisionCredential;

package/esm/provision-database/credential.js

@@ -0,0 +1,19 @@
+// Pure: decide which credential authenticates a project's provisioning. Under the
+// account gate a signed-in session is guaranteed, so every new project provisions
+// UNDER the account (account-owned + enumerable): the database's owner_id is the
+// account's own userId, and the account's API key (falling back to its session
+// token) is the bearer that authenticates the provision mutation and lands in the
+// project .env as ACCESS_TOKEN (refreshed on every provision run, including the
+// skip path). A signed-in session with no usable bearer (keychain locked) is an
+// explicit error, never a silent throwaway owner.
+// Side-effect-free so the branch is unit-testable without runtime/network.
+export function selectProvisionCredential(account) {
+    const bearer = account?.apiKey ?? account?.accessToken;
+    if (account?.userId && bearer) {
+        return { mode: 'account', ownerId: account.userId, bearer };
+    }
+    return {
+        mode: 'error',
+        reason: 'No usable account credential. Sign in (or unlock your session) before provisioning a database.',
+    };
+}

package/esm/provision-database/env-file.d.ts

@@ -0,0 +1,37 @@
+export type EnvVars = Record<string, string>;
+/**
+ * Upsert `vars` into the existing `.env` `content`. Existing keys are replaced
+ * in place (preserving surrounding lines/comments); new keys are appended.
+ * Returns the new file body, trailing-newline-terminated.
+ */
+export declare function mergeEnv(content: string, vars: EnvVars): string;
+/** The credential keys provision_database owns in a project's .env. */
+export declare const PROVISION_ENV_KEYS: readonly ["DATABASE_ID", "DATABASE_NAME", "OWNER_ID", "ACCESS_TOKEN", "PGDATABASE", "API_ENDPOINT", "MODULES_ENDPOINT"];
+/**
+ * Keys archived as comments on reprovision — the binding identity: which
+ * database, under whom, on which backend. ACCESS_TOKEN is the account login
+ * token, identical across bindings, so it is overwritten in place rather than
+ * archived.
+ */
+export declare const ARCHIVED_BINDING_KEYS: readonly ["DATABASE_ID", "DATABASE_NAME", "OWNER_ID", "PGDATABASE", "API_ENDPOINT", "MODULES_ENDPOINT"];
+/**
+ * Build the provisioning credential block written to a project's .env. The
+ * endpoint pins record which backend owns this binding — outside-app consumers
+ * (verify-feature.sh, skill scripts, dev-server shells) resolve them instead of
+ * falling back to localhost defaults when the app targets a hosted backend.
+ */
+export declare function provisionEnvVars(args: {
+    databaseId: string;
+    databaseName: string;
+    ownerId: string;
+    accessToken: string;
+    apiEndpoint: string;
+    modulesEndpoint: string;
+}): EnvVars;
+/**
+ * Comment out the given keys in place (`# archived <date>: KEY=value`) so a
+ * reprovision keeps the previous binding readable in the file instead of
+ * silently overwriting it. Every other line — including existing comments and
+ * already-archived entries — passes through untouched.
+ */
+export declare function archiveBindingKeys(content: string, keys: readonly string[], archivedOn: string): string;

package/esm/provision-database/env-file.js

@@ -0,0 +1,85 @@
+// Pure .env merge — used by provision_database to persist provisioning
+// credentials without clobbering existing keys: replace a key in place if
+// present, else append.
+// Kept side-effect-free so it is unit-testable (the tool does the fs write).
+/**
+ * Upsert `vars` into the existing `.env` `content`. Existing keys are replaced
+ * in place (preserving surrounding lines/comments); new keys are appended.
+ * Returns the new file body, trailing-newline-terminated.
+ */
+export function mergeEnv(content, vars) {
+    let out = content;
+    for (const [key, val] of Object.entries(vars)) {
+        // Escape the key for the regex, and use a replacement function so `$`
+        // sequences in the value are never treated as replacement specials.
+        const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const regex = new RegExp(`^${escapedKey}=.*`, 'm');
+        if (regex.test(out))
+            out = out.replace(regex, () => `${key}=${val}`);
+        else
+            out += `\n${key}=${val}`;
+    }
+    return out.trim() + '\n';
+}
+/** The credential keys provision_database owns in a project's .env. */
+export const PROVISION_ENV_KEYS = [
+    'DATABASE_ID',
+    'DATABASE_NAME',
+    'OWNER_ID',
+    'ACCESS_TOKEN',
+    'PGDATABASE',
+    'API_ENDPOINT',
+    'MODULES_ENDPOINT',
+];
+/**
+ * Keys archived as comments on reprovision — the binding identity: which
+ * database, under whom, on which backend. ACCESS_TOKEN is the account login
+ * token, identical across bindings, so it is overwritten in place rather than
+ * archived.
+ */
+export const ARCHIVED_BINDING_KEYS = [
+    'DATABASE_ID',
+    'DATABASE_NAME',
+    'OWNER_ID',
+    'PGDATABASE',
+    'API_ENDPOINT',
+    'MODULES_ENDPOINT',
+];
+/**
+ * Build the provisioning credential block written to a project's .env. The
+ * endpoint pins record which backend owns this binding — outside-app consumers
+ * (verify-feature.sh, skill scripts, dev-server shells) resolve them instead of
+ * falling back to localhost defaults when the app targets a hosted backend.
+ */
+export function provisionEnvVars(args) {
+    return {
+        DATABASE_ID: args.databaseId,
+        DATABASE_NAME: args.databaseName,
+        OWNER_ID: args.ownerId,
+        ACCESS_TOKEN: args.accessToken,
+        PGDATABASE: args.databaseName,
+        API_ENDPOINT: args.apiEndpoint,
+        MODULES_ENDPOINT: args.modulesEndpoint,
+    };
+}
+/**
+ * Comment out the given keys in place (`# archived <date>: KEY=value`) so a
+ * reprovision keeps the previous binding readable in the file instead of
+ * silently overwriting it. Every other line — including existing comments and
+ * already-archived entries — passes through untouched.
+ */
+export function archiveBindingKeys(content, keys, archivedOn) {
+    const keySet = new Set(keys);
+    return content
+        .split('\n')
+        .map((line) => {
+        if (line.trimStart().startsWith('#'))
+            return line;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            return line;
+        const key = line.slice(0, eq).trim();
+        return keySet.has(key) ? `# archived ${archivedOn}: ${line.trim()}` : line;
+    })
+        .join('\n');
+}

package/esm/provision-database/modules.d.ts

@@ -0,0 +1,2 @@
+export type ProvisionModule = string | [string, Record<string, unknown>];
+export declare const DEFAULT_PROVISION_MODULES: ProvisionModule[];

package/esm/provision-database/modules.js

@@ -0,0 +1,40 @@
+export const DEFAULT_PROVISION_MODULES = [
+    'users_module',
+    'membership_types_module',
+    ['permissions_module', { scope: 'app' }],
+    ['permissions_module', { scope: 'org' }],
+    ['limits_module', { scope: 'app' }],
+    ['limits_module', { scope: 'org' }],
+    ['levels_module', { scope: 'app' }],
+    ['levels_module', { scope: 'org' }],
+    ['memberships_module', { scope: 'app' }],
+    ['memberships_module', { scope: 'org' }],
+    'sessions_module',
+    'user_state_module',
+    'user_credentials_module',
+    ['internal_secrets_module', { scope: 'app' }],
+    'emails_module',
+    'rls_module',
+    'user_auth_module',
+    'session_secrets_module',
+    'rate_limits_module',
+    'connected_accounts_module',
+    ['identity_providers_module', { scope: 'app' }],
+    'webauthn_credentials_module',
+    'webauthn_auth_module',
+    'phone_numbers_module',
+    ['profiles_module', { scope: 'app' }],
+    ['profiles_module', { scope: 'org' }],
+    ['hierarchy_module', { scope: 'org' }],
+    ['invites_module', { scope: 'app' }],
+    ['invites_module', { scope: 'org' }],
+    // Mirrors constructive-client: api_name links storage to the same api-<slug>
+    // endpoint the generated SDK targets (without it uploads fail with "not
+    // enabled for this endpoint"), prefix keeps app_buckets/app_files names off
+    // user tables, and buckets seeds the public bucket row uploads need.
+    [
+        'storage_module',
+        { scope: 'app', api_name: 'api', prefix: 'app', buckets: [{ key: 'public', is_public: true }] },
+    ],
+    'devices_module',
+];

package/esm/provision-database/pg-fixups.d.ts

@@ -0,0 +1,16 @@
+export type FixupResult = {
+    applied: boolean;
+    note: string;
+};
+export type PgEnv = {
+    host?: string;
+    port?: string;
+    user?: string;
+    password?: string;
+};
+export declare function parsePgpmEnv(stdout: string): PgEnv;
+export declare function resolvePgEnv(): Promise<PgEnv | null>;
+export declare function applySqlFixups(args: {
+    databaseName: string;
+    physicalDb: string;
+}): Promise<FixupResult>;

package/esm/provision-database/pg-fixups.js

@@ -0,0 +1,132 @@
+// Post-provision SQL fixups for a freshly provisioned database.
+//
+// Two things must happen at the Postgres level that the provisioning GraphQL API
+// does not do for us:
+//
+//  1. Naming settings — `constructive.simple_schema_names` and
+//     `schema_use_underscores` make later `provision_blueprint` calls create an
+//     `app_public` schema (which resolveSchemaId looks for) instead of a
+//     hyphenated `<db>-<hex>-app-public` one. These ALTER DATABASE settings
+//     PERSIST, so we set them once here, before any blueprint construction.
+//
+//  2. Membership defaults — new sign-ups otherwise land with
+//     is_approved=false/is_verified=false, the AuthzEntityMembership policy then
+//     denies every insert/select, and CRUD rows silently never persist
+//     (BLUEPRINT-PENDING-001). We flip the defaults (future sign-ups) AND any
+//     memberships already created during provisioning.
+//
+// All SQL targets the PHYSICAL control-plane database (`constructive`), NOT the
+// app's database name — that name is only a schema prefix (MEMBERSHIP-DB-001).
+//
+// Connection creds come from the ambient PG* env vars, falling back to sourcing
+// `pgpm env` (the same mechanism the old `eval "$(pgpm env)"` shell step used).
+// If neither yields a connection, provisioning still succeeded — we return a
+// note so the tool can warn the user that sign-in/CRUD may need a manual fixup.
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+// Parse `pgpm env` output. It prints shell assignments (optionally `export`-
+// prefixed), one per line: `export PGHOST=localhost`. Quotes are stripped.
+export function parsePgpmEnv(stdout) {
+    const env = {};
+    for (const rawLine of stdout.split('\n')) {
+        const line = rawLine.trim().replace(/^export\s+/, '');
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        let value = line.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        env[key] = value;
+    }
+    return {
+        host: env.PGHOST,
+        port: env.PGPORT,
+        user: env.PGUSER,
+        password: env.PGPASSWORD,
+    };
+}
+export async function resolvePgEnv() {
+    if (process.env.PGHOST) {
+        return {
+            host: process.env.PGHOST,
+            port: process.env.PGPORT,
+            user: process.env.PGUSER,
+            password: process.env.PGPASSWORD,
+        };
+    }
+    try {
+        const { stdout } = await execFileAsync('pgpm', ['env'], { timeout: 15_000 });
+        const parsed = parsePgpmEnv(stdout);
+        return parsed.host ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Find the memberships schema for this app. Schema names use hyphens locally
+// (`<db>-<hex>-memberships-public`) but may use underscores when the naming
+// settings are active — match both, scoped to this app's name prefix.
+const MEMBERSHIPS_SCHEMA_QUERY = `
+  SELECT schema_name FROM information_schema.schemata
+   WHERE (schema_name LIKE '%memberships-public' OR schema_name LIKE '%memberships_public')
+         AND (schema_name LIKE $1 OR schema_name LIKE $2)
+   ORDER BY schema_name DESC LIMIT 1`;
+export async function applySqlFixups(args) {
+    const pgEnv = await resolvePgEnv();
+    if (!pgEnv) {
+        return {
+            applied: false,
+            note: 'Could not reach Postgres (no PGHOST and `pgpm env` unavailable). Database provisioned, but membership defaults were not enabled — sign-in/CRUD may fail until the constructive DB is fixed up manually.',
+        };
+    }
+    // pg is dynamically imported so the main bundle never loads it unless a
+    // provision actually runs with Postgres access. The import lives inside the
+    // try: fixups are best-effort, so even a broken pg module must degrade to a
+    // note instead of failing the tool after the database is already provisioned.
+    let pool;
+    try {
+        const { Pool } = await import('pg');
+        pool = new Pool({
+            host: pgEnv.host,
+            port: pgEnv.port ? Number(pgEnv.port) : undefined,
+            user: pgEnv.user,
+            password: pgEnv.password,
+            database: args.physicalDb,
+        });
+        const db = args.physicalDb;
+        // Persistent naming settings — so future provision_blueprint calls land an
+        // `app_public` schema resolveSchemaId can find.
+        await pool.query(`ALTER DATABASE "${db}" SET constructive.simple_schema_names = 'true'`);
+        await pool.query(`ALTER DATABASE "${db}" SET constructive.schema_use_underscores = 'true'`);
+        const schemaResult = await pool.query(MEMBERSHIPS_SCHEMA_QUERY, [
+            `${args.databaseName}-%`,
+            `${args.databaseName}\\_%`,
+        ]);
+        if (schemaResult.rows.length === 0) {
+            return {
+                applied: true,
+                note: `Naming settings applied, but no memberships schema was found for "${args.databaseName}" — sign-in may need a manual membership fixup.`,
+            };
+        }
+        const membershipsSchema = schemaResult.rows[0].schema_name;
+        await pool.query(`UPDATE "${membershipsSchema}".app_membership_defaults SET is_approved = TRUE, is_verified = TRUE`);
+        await pool.query(`UPDATE "${membershipsSchema}".app_memberships
+         SET is_approved = TRUE, is_verified = TRUE
+       WHERE is_approved = FALSE OR is_verified = FALSE`);
+        return { applied: true, note: `Membership defaults enabled (schema: ${membershipsSchema}).` };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            applied: false,
+            note: `Database provisioned, but SQL fixups failed (${message}). Sign-in/CRUD may fail until membership defaults are enabled manually.`,
+        };
+    }
+    finally {
+        await pool?.end().catch(() => { });
+    }
+}

package/esm/records/meta.d.ts

@@ -0,0 +1,41 @@
+import type { Table, TableInflection } from '@constructive-io/graphql-query/types/schema';
+export declare const META_QUERY = "\n  query DbToolsMeta {\n    _meta {\n      tables {\n        name\n        query { all one create update delete }\n        inflection {\n          allRows\n          conditionType\n          connection\n          createInputType\n          createPayloadType\n          deletePayloadType\n          edge\n          filterType\n          orderByType\n          patchType\n          tableType\n          updatePayloadType\n        }\n        fields {\n          name\n          isNotNull\n          hasDefault\n          type {\n            gqlType\n            isArray\n            pgType\n            subtype\n            isNotNull\n            hasDefault\n          }\n        }\n      }\n    }\n  }\n";
+type RawType = {
+    gqlType: string;
+    isArray: boolean;
+    modifier?: string | number | null;
+    pgAlias?: string | null;
+    pgType?: string | null;
+    subtype?: string | null;
+    typmod?: number | null;
+    isNotNull?: boolean | null;
+    hasDefault?: boolean | null;
+};
+type RawField = {
+    name: string;
+    isNotNull?: boolean | null;
+    hasDefault?: boolean | null;
+    type: RawType;
+};
+type RawInflection = Partial<Record<keyof TableInflection, string | null>>;
+type RawQuery = {
+    all: string;
+    one?: string | null;
+    create?: string | null;
+    update?: string | null;
+    delete?: string | null;
+};
+export type RawMetaTable = {
+    name: string;
+    query?: RawQuery | null;
+    inflection?: RawInflection | null;
+    fields?: (RawField | null)[] | null;
+};
+export type MetaResponse = {
+    _meta?: {
+        tables?: (RawMetaTable | null)[] | null;
+    } | null;
+};
+export declare function cleanTable(meta: RawMetaTable): Table;
+export declare function findMetaTable(tables: RawMetaTable[], requested: string): RawMetaTable | undefined;
+export {};

package/esm/records/meta.js

@@ -0,0 +1,170 @@
+// Vendored from constructive-client's `@constructive-io/data` (not published to
+// the registry). We query the per-DB data endpoint's `_meta` introspection and
+// reshape each table into the `Table` shape `buildPostGraphileCreate` expects.
+// Relations are intentionally left empty: the create-mutation builder only reads
+// them to skip relational fields in the return selection, and every `_meta` field
+// is a real scalar column, so selecting them all is valid.
+//
+// Only fields the live backend's `_meta` actually exposes are selected here —
+// over-selecting (e.g. MetaType.modifier or MetaInflection.createField) fails
+// GraphQL validation. The reshapers below tolerate the omitted fields.
+export const META_QUERY = `
+  query DbToolsMeta {
+    _meta {
+      tables {
+        name
+        query { all one create update delete }
+        inflection {
+          allRows
+          conditionType
+          connection
+          createInputType
+          createPayloadType
+          deletePayloadType
+          edge
+          filterType
+          orderByType
+          patchType
+          tableType
+          updatePayloadType
+        }
+        fields {
+          name
+          isNotNull
+          hasDefault
+          type {
+            gqlType
+            isArray
+            pgType
+            subtype
+            isNotNull
+            hasDefault
+          }
+        }
+      }
+    }
+  }
+`;
+function pgFieldToCamelCase(name) {
+    return name.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+function convertInflection(inflection) {
+    if (!inflection)
+        return undefined;
+    const s = (key) => inflection[key] ?? '';
+    const n = (key) => inflection[key] ?? null;
+    return {
+        allRows: s('allRows'),
+        allRowsSimple: s('allRowsSimple'),
+        conditionType: s('conditionType'),
+        connection: s('connection'),
+        createField: s('createField'),
+        createInputType: s('createInputType'),
+        createPayloadType: s('createPayloadType'),
+        deleteByPrimaryKey: n('deleteByPrimaryKey'),
+        deletePayloadType: s('deletePayloadType'),
+        edge: s('edge'),
+        edgeField: s('edgeField'),
+        enumType: s('enumType'),
+        filterType: n('filterType'),
+        inputType: s('inputType'),
+        orderByType: s('orderByType'),
+        patchField: s('patchField'),
+        patchType: n('patchType'),
+        tableFieldName: s('tableFieldName'),
+        tableType: s('tableType'),
+        typeName: s('typeName'),
+        updateByPrimaryKey: n('updateByPrimaryKey'),
+        updatePayloadType: n('updatePayloadType'),
+    };
+}
+function convertQuery(query) {
+    if (!query)
+        return undefined;
+    return {
+        all: query.all,
+        one: query.one ?? null,
+        create: query.create ?? '',
+        update: query.update ?? null,
+        delete: query.delete ?? null,
+    };
+}
+export function cleanTable(meta) {
+    return {
+        name: meta.name,
+        inflection: convertInflection(meta.inflection),
+        query: convertQuery(meta.query),
+        fields: (meta.fields ?? [])
+            .filter((f) => Boolean(f))
+            .map((field) => ({
+            name: pgFieldToCamelCase(field.name),
+            type: {
+                gqlType: field.type.gqlType,
+                isArray: field.type.isArray,
+                modifier: field.type.modifier,
+                pgAlias: field.type.pgAlias,
+                pgType: field.type.pgType,
+                subtype: field.type.subtype,
+                typmod: field.type.typmod,
+            },
+            isNotNull: field.isNotNull ?? field.type.isNotNull ?? null,
+            hasDefault: field.hasDefault ?? field.type.hasDefault ?? null,
+        })),
+        relations: { belongsTo: [], hasOne: [], hasMany: [], manyToMany: [] },
+    };
+}
+function normalizeTableLookupKey(value) {
+    return (value ?? '')
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]/g, '');
+}
+function getTableLookupVariants(value) {
+    const normalized = normalizeTableLookupKey(value);
+    if (!normalized)
+        return [];
+    const variants = new Set([normalized]);
+    if (normalized.endsWith('y')) {
+        variants.add(`${normalized}s`);
+        variants.add(`${normalized.slice(0, -1)}ies`);
+    }
+    if (normalized.endsWith('ies')) {
+        variants.add(`${normalized.slice(0, -3)}y`);
+    }
+    if (/(s|x|z|ch|sh)$/.test(normalized))
+        variants.add(`${normalized}es`);
+    if (normalized.endsWith('es'))
+        variants.add(normalized.slice(0, -2));
+    if (!normalized.endsWith('s'))
+        variants.add(`${normalized}s`);
+    if (normalized.endsWith('s'))
+        variants.add(normalized.slice(0, -1));
+    return [...variants].filter(Boolean);
+}
+// Resolve a user-supplied table name (snake_case singular or plural) against the
+// PascalCase-singular `_meta` table names, tolerating pluralization differences.
+export function findMetaTable(tables, requested) {
+    const index = new Map();
+    for (const table of tables) {
+        const keys = [
+            table.name,
+            table.query?.all,
+            table.query?.one,
+            table.inflection?.tableType,
+            table.inflection?.tableFieldName,
+            table.inflection?.allRows,
+        ];
+        for (const key of keys) {
+            for (const variant of getTableLookupVariants(key)) {
+                if (!index.has(variant))
+                    index.set(variant, table);
+            }
+        }
+    }
+    for (const variant of getTableLookupVariants(requested)) {
+        const match = index.get(variant);
+        if (match)
+            return match;
+    }
+    return undefined;
+}

package/esm/run-codegen/barrels.d.ts

@@ -0,0 +1,3 @@
+/** Rewrite directory barrel specifiers under `root` in place. Returns the count
+ * of files changed. No-op (returns 0) when `root` does not exist. */
+export declare function normalizeSdkBarrels(root: string): number;

package/esm/run-codegen/barrels.js

@@ -0,0 +1,48 @@
+// Turbopack barrel normalization (TURBOPACK-BARREL-001).
+//
+// Codegen emits directory barrel re-exports like `export * from './hooks'` where
+// `./hooks` is a directory with an index.ts. Next.js 16's Turbopack cannot
+// resolve directory specifiers — it needs an explicit `./hooks/index`. This pass
+// rewrites `./X` -> `./X/index` only when X resolves to a sibling DIRECTORY,
+// leaving file specifiers (and ones already ending in /index) untouched.
+//
+// Pure-ish: operates on a real directory tree (so it's exercised with a temp
+// fixture in tests) and is idempotent — safe to re-run.
+import fs from 'node:fs';
+import path from 'node:path';
+const SPEC_RE = /((?:export|import)[^\n]*?from\s*["'])(\.\.?\/[^"']+?)(["'])/g;
+const FILE_EXT_RE = /\.(tsx?|jsx?|json|css)$/;
+/** Rewrite directory barrel specifiers under `root` in place. Returns the count
+ * of files changed. No-op (returns 0) when `root` does not exist. */
+export function normalizeSdkBarrels(root) {
+    if (!fs.existsSync(root))
+        return 0;
+    let changed = 0;
+    const walk = (dir) => {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const p = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(p);
+                continue;
+            }
+            if (!/\.tsx?$/.test(entry.name))
+                continue;
+            const orig = fs.readFileSync(p, 'utf8');
+            const next = orig.replace(SPEC_RE, (match, pre, spec, post) => {
+                if (FILE_EXT_RE.test(spec))
+                    return match; // already a file
+                const abs = path.resolve(path.dirname(p), spec);
+                if (fs.existsSync(abs) && fs.statSync(abs).isDirectory()) {
+                    return pre + spec.replace(/\/$/, '') + '/index' + post;
+                }
+                return match;
+            });
+            if (next !== orig) {
+                fs.writeFileSync(p, next);
+                changed++;
+            }
+        }
+    };
+    walk(root);
+    return changed;
+}