@beignet/cli 0.0.1 → 0.0.4

package/CHANGELOG.md

@@ -1,5 +1,236 @@
 # @beignet/cli
 
+## 0.0.4
+
+### Patch Changes
+
+- 8bcb31f: Mark package READMEs with Beignet's experimental alpha status and 0.0.x stability expectations.
+- c1a834d: Generate an app-owned client error helper and align form error handling docs with
+  the canonical React Query and React Hook Form mutation path.
+- 94de15c: Improve the standard starter first-hour workflow by printing database, route, feature, test, lint, and doctor next steps, updating generated starter docs, and adding generated-feature smoke coverage.
+- 9c23782: Clarify `make feature` and `make resource` guidance in CLI output and docs so feature slices are positioned for workflows while resources are positioned for CRUD-shaped entities.
+- df4673f: Add TanStack Query filter helpers for Beignet contract cache invalidation and update generated UI examples to use them.
+- d137044: Declare `@beignet/core` as a peer dependency with a lockstep version range in
+  every integration and provider package instead of a regular `"*"` dependency.
+  Installs now always resolve a single shared copy of core, so `instanceof`
+  checks such as `isContractError` and upload error identity keep working, and
+  mixed Beignet versions fail loudly at install time instead of at runtime.
+
+  If your package manager does not install peer dependencies automatically, add
+  `@beignet/core` to your app alongside these packages. `@beignet/nuqs` now also
+  declares `@beignet/react-query` as a peer dependency, and
+  `@beignet/provider-storage-s3` now expects you to install
+  `@aws-sdk/client-s3` and `@aws-sdk/s3-request-presigner` yourself, matching
+  how other providers treat their SDKs.
+
+- 4c1cb16: Formalize provider package manifest metadata with exported core types and
+  validation, and have doctor warn on malformed installed provider metadata before
+  using provider-derived diagnostics.
+- 56daf2b: Add `beignet outbox drain` for bounded app-owned outbox delivery from local, CI, or worker entrypoints.
+- 5e440f7: Upgrade `beignet make resource` to generate CRUD-shaped resource slices with get, update, delete, policy, repository, route, contract, test, and error-catalog wiring.
+- 6ce179c: Generate CRUD resource lists with cursor pagination, name filtering, allowlisted sorting, and matching memory and Drizzle repository behavior.
+- 50ab61b: Improve database lifecycle command preflight and doctor diagnostics for Drizzle config, schema exports, database scripts, seed/reset entrypoints, and reset guards.
+- 2da5a05: Report installed-but-unregistered optional providers as informational doctor
+  hints. Provider packages can declare `registration.severity: "hint"` in their
+  `beignet.provider` manifest metadata, and `@beignet/devtools` now uses it, so
+  removing `createDevtoolsProvider()` from `server/providers.ts` no longer fails
+  `beignet doctor --strict`.
+- 1a79090: Emit Node-compatible ESM: all relative imports in published packages now carry explicit .js extensions, fixing ERR_MODULE_NOT_FOUND when running the CLI or importing package dist files under plain Node.
+- 94082eb: Document that durable job draining runs through the outbox command while direct provider jobs use provider-owned worker entrypoints.
+- 82c48dc: Add canonical test port and context fixtures, and update generated tests to use them.
+- 9c1fcdf: Add a `make feature --with ui` addon that generates a feature-colocated React Query component for the generated list and create contracts.
+- 76692ed: Validate generated CRUD resource option combinations through typecheck, tests, lint, and strict doctor, add generated optimistic concurrency, and version doctor JSON output.
+- 21d92ba: Update generated feature and use-case tests to use Beignet test activity helpers for stable actor and request context setup.
+- 0f2dd89: Add `beignet make resource --soft-delete` and doctor drift checks for generated soft-delete resource slices.
+- 6c3134e: Improve doctor OpenAPI drift checks so they follow the registered route surface, understand `contractsFromRoutes(routes)` registries, and warn when OpenAPI lists contracts that are not registered.
+- 69b8c35: Fix `beignet lint` package bans so `@beignet/core/*` subpath entries match. Banned
+  entries such as `@beignet/core/ports` in domain files and `@beignet/core/server` in
+  use cases are now flagged, and bare package bans keep matching any subpath import.
+- 493d23b: Make the framework own context assembly with a server context blueprint and first-class service contexts.
+
+  - `createServer(...)` (and the Next/Web adapters) replace the `createContext` option with `context`. Gate-less contexts keep the plain request-factory shorthand; contexts that declare a `gate` must use the blueprint form `{ gate: (ports) => ports.gate, request, service }`. Returning `gate` from a context factory or hook addition is now a compile error.
+  - The gate port gains `gate.attach(ctx)`: it attaches a live, non-enumerable `ctx.gate` getter that re-binds against the receiving object on every access, so identity changes (including auth-hook elevation) can never authorize against a stale context, and spread copies drop the gate loudly instead of silently keeping stale identity. `bind(...)` remains the low-level primitive.
+  - Servers expose `createRequestContext(req)` and `createServiceContext(input?)`; the optional `context.service` factory powers schedule, outbox, command, and background contexts. Provider `setup`, `start`, and `stop` receive a late-bound `createServiceContext` so infra providers no longer hand-build background contexts.
+  - `createTestContextFactory(...)` now attaches the gate after all `extra` and override fields merge, fixing a stale-identity bug in tests.
+  - CLI templates, generators, and doctor diagnostics emit and check the new context blueprint and service-context wrappers.
+
+- 9d1bf0b: Clarify React Hook Form submit-error handling and align generated form examples with Beignet client error semantics.
+- 532b4e9: Wrap transaction-scoped starter audit ports with devtools instrumentation so generated write use cases appear in the devtools audit timeline.
+- d137044: Make `beignet create --preset minimal` generate working apps for the `drizzle-turso` and `better-auth` integrations. The minimal Drizzle combo now scaffolds `drizzle.config.ts`, a todos-only schema, a Drizzle todo repository, and an app-owned database provider behind a deferred `todos` port, and only emits `db:seed`/`db:reset` scripts when their entrypoints exist. The minimal Better Auth combo now wires `lib/better-auth.ts` with Better Auth's in-memory adapter, the `app/api/auth/[...all]` route, `createAuthBetterAuthProvider(...)` behind a deferred `auth` port, and an `auth` session on the request context.
+- 4949d4f: Add doctor diagnostics for partially wired CRUD resource slices, including missing generated contracts, use cases, repository methods, route entries, not-found catalog errors, and strict-mode CRUD test coverage. Rename CLI diagnostic codes from the legacy `CK_` prefix to `BEIGNET_`.
+- 44f1192: Move first-party provider diagnostics to package-owned `beignet.provider`
+  manifest metadata and have doctor read installed provider package manifests.
+- 2aa77ca: Add static provider metadata and provider wiring diagnostics for generated apps.
+- 90c2e48: Add typed operational command definitions and a `beignet make command` generator for feature-owned app commands.
+- 4af4257: Add doctor diagnostics for route-owned error catalog drift, including missing shared catalog entries, undeclared feature app errors, and strict-mode unused feature-owned route errors.
+- 5b5dfb0: Pin the standard starter to a known-good Better Auth version, narrow provider metadata to avoid clean installs floating into incompatible Better Auth adapter dependencies, and add first-screen starter links for the todo workflow, health check, OpenAPI document, devtools, and docs.
+- ac78cdf: Add `createScheduleRoute(...)` to `@beignet/next` for triggering one registered schedule from a serverless cron route, with the same fail-closed bearer auth and JSON envelope conventions as `createOutboxDrainRoute(...)`. Unknown schedule names throw when the route module loads.
+
+  The inline schedule runner in `@beignet/core/schedules` now accepts `instrumentation` and `instrumentationContext` options and records `schedule` devtools events (`started`, `completed`, `failed`) itself. Recording failures are isolated from schedule execution and reported to `onHookError`. `createScheduleRoute(...)`, `beignet schedule run`, and generated cron routes use this instead of hand-rolled lifecycle hooks.
+
+  Security: cron route bearer secrets in `createScheduleRoute(...)` and `createOutboxDrainRoute(...)` are now compared with a timing-safe SHA-256 digest comparison instead of `!==`.
+
+- 69b8c35: Require patched dependency versions for security advisories: drizzle-orm
+  `^0.45.2` (SQL injection via improperly escaped identifiers, GHSA advisory
+  patched in 0.45.2) and nodemailer `^8.0.5` (SMTP command injection fixes).
+  Generated apps now scaffold with drizzle-orm `^0.45.2` and drizzle-kit
+  `^0.31.10`.
+- a7dfb68: Add production readiness doctor warnings for devtools exposure, cron secrets, upload size limits, provider env configuration, Better Auth route setup, and credentialed wildcard CORS.
+- 89390fe: Decouple devtools from app code with server-owned instrumentation.
+
+  - `@beignet/core/tracing` is a new dependency-free subpath with the W3C trace
+    primitives (`TraceContext`, `createTraceContext`, `createChildTraceContext`,
+    `parseTraceparent`, `createTraceparent`, `createTraceId`, `createSpanId`).
+    App context types now use `Partial<TraceContext>` instead of importing
+    `DevtoolsTraceContext` from `@beignet/devtools`.
+  - `createServer(...)` owns request instrumentation through a new
+    `instrumentation` option (`ServerInstrumentationOptions | false`). The server
+    resolves request IDs and trace context before user hooks and context
+    creation, passes them to context factories as `requestId` and `trace`,
+    writes `x-request-id`/`traceparent` response headers by default, and records
+    request/error events into the instrumentation port resolved from final ports
+    (`ports.instrumentation`, then `ports.devtools`). The ambient request
+    context (`enterActiveRequestContext` and friends) moved into
+    `@beignet/core/server`.
+  - `createUseCase(...)` instruments runs by default, resolving the
+    instrumentation port from `ctx.ports` per run; opt out with
+    `instrumentation: false`. App `onRun` observers run in addition.
+  - `createInstrumentedAuditLog({ audit, instrumentation })` in
+    `@beignet/core/ports` replaces `createDevtoolsAuditLog`.
+  - `createServer(...)` gains `validateResponses` (default `true`) to skip
+    route-owned response validation, mirroring the client option.
+  - Removed from `@beignet/devtools`: `createDevtoolsHooks`,
+    `createDevtoolsUseCaseObserver`, `createDevtoolsAuditLog`, and the
+    trace/request-context modules. Apps now only need `createDevtoolsProvider()`
+    plus the devtools route; deleting both leaves the rest of the app compiling
+    and running unchanged.
+  - `@beignet/next` cron and upload helpers resolve their instrumentation sink
+    with `resolveProviderInstrumentationPort(ctx.ports)` instead of hardcoding
+    `ports.devtools`.
+  - `beignet create` templates generate the decoupled shape.
+
+- 16cc113: Clarify the canonical route registration story and align generated starters on `app-context.ts`.
+- f3cbf3d: Add `make resource` options for authorization, tenancy, and domain events so generated CRUD slices can include policy metadata, use-case gate checks, tenant-scoped repositories, policy tests, and resource event definitions.
+- 377b6e2: Add doctor warnings for authorization metadata that drifts from feature policy coverage and audit-required metadata without audit writes or test assertions.
+- 49a80df: Add strict doctor diagnostics for canonical Beignet app conformance drift.
+- ac78cdf: Split the client `validate` config flag into `validateInput` (default false)
+  and `validateResponses` (default true). Client-side input validation failures
+  now throw a client-source `ContractError` with code `INPUT_VALIDATION_ERROR`
+  and no HTTP status instead of a synthetic 422 `VALIDATION_ERROR`. Setting
+  `validateResponses: false` returns success bodies as-is and classifies non-2xx
+  responses structurally while keeping `INVALID_JSON` transport errors.
+- cca08b1: Align generated apps and package docs around the canonical auth, policy, and AppContext model.
+- d6ad8bb: Standardize generated client helpers around `client/index.ts`, add a typed
+  React Query invalidation helper, and align package docs with the canonical app
+  client entrypoint.
+- a6b386f: Expand architecture lint to catch cross-feature domain imports, infra/UI boundary drift, and provider imports in feature components.
+- a67c637: Add Beignet runtime boundary markers and extend `beignet lint` to catch client-safe roots that value-reach server-only code.
+- b46b993: Improve generated command output and lifecycle stubs for app-owned operational commands.
+- c061bd9: Add `beignet command run` for app-owned operational commands and wire generated commands into the app command registry.
+- eec217a: Align the minimal starter with the canonical feature structure by generating `features/todos/use-cases/index.ts` instead of `features/todos/use-cases.ts`, and keep minimal create next steps API-only.
+- 5a8dce6: Add a low-risk doctor fixer for feature route groups that already exist but are missing from the central route registry.
+- 493d23b: Add typed provider-contributed ports. `InferProviderPorts` (replacing
+  `ProvidedPortsOfList`) merges the ports a provider list contributes so apps can
+  type `ctx.ports` as `AppPorts & InferProviderPorts<typeof providers>` without
+  casts. The curried `definePorts<AppPorts>()({ bound, deferred })` form replaces
+  throwing stub boilerplate: deferred keys boot as descriptive placeholders and
+  `createServer(...)` fails startup with the unbound key list (configurable via
+  `onUnboundPorts: "error" | "warn" | "ignore"`). App-local providers can declare
+  required ports, app context, and service-context input through the curried
+  `createProvider<Requires, Context, ServiceInput>()` form, which types
+  `setup({ ports, createServiceContext })` and lifecycle contexts end to end.
+  CLI templates and `beignet make` generate and maintain the new forms.
+- 8063d38: Rename the contract front door to `defineContract`/`defineContractGroup`, rename operational commands to tasks (`@beignet/core/tasks`, `defineTasks`, `runTask`, `beignet task run`, `beignet make task`, `server/tasks.ts`, `features/<feature>/tasks/`, `paths.tasks`), and standardize context binding: context-free declarations stay top-level (`defineEvent`), while context-bound definitions come from per-capability factories (`createListeners`, `createJobs`, `createSchedules`, `createNotifications`, `createTasks`) called once in `lib/`. Top-level context-generic `defineListener`, `defineJob`, `defineSchedule`, and `defineNotification` are removed.
+- 192c6ad: Generated apps import `contractErrorMessage` and `rootFormError` from `@beignet/core/client` and `@beignet/react-hook-form` instead of owning a `client/errors.ts` copy, and doctor no longer requires that file.
+- 192c6ad: Rename `defineFactory` to `createFactory` and `defineEnv` to `createEnvLoader` to match the naming convention: define declares things you register, create returns runtime objects you call.
+- 192c6ad: Routes can bind a contract directly to a use case with `{ contract, useCase }` — status is inferred from a sole 2xx response, input defaults to merged path/query/body parts, and validated inputs are not re-parsed when the use case reuses the contract schema by reference. Full `handle` routes remain the escape hatch for headers, streaming, and multi-status responses.
+- 255527d: Generated apps declare their context blueprint in `server/context.ts` via `defineServerContext` and share it with route tests; test generators use the new testing defaults; doctor learns schema-directory and test-placement checks and follows the context blueprint into `server/context.ts`.
+- 1a79090: The CLI ships a single `beignet` bin (app scaffolding moves to the `create-beignet` package), generated apps install @beignet/cli locally and invoke it with `bun beignet`, and commands gain `--version`, `--cwd`, `--format github` annotations, lint line numbers, distinct usage exit codes, `create --dry-run/--json`, `schemaVersion` on all JSON output, and lazy command loading for fast startup.
+- 8ad12a9: Doctor warns when @beignet/\* package versions drift apart, `beignet create` gains an interactive TTY setup (skip with flags or `--yes`), shell completions install via `beignet completion install`, and feature/integration selection uses single comma-separated `--features`/`--integrations` flags.
+- 93e83db: Generate an isolated Drizzle/libSQL test database helper in standard starters so repository and persistence tests can reuse the app's schema, repository factory, reset, audit, and outbox wiring.
+- ac78cdf: Enforce contract `meta.idempotency` at the HTTP boundary with the new
+  `createIdempotencyHooks(...)` server hook. The hook reserves the client key
+  after request parsing, replays completed matching responses with an
+  `idempotency-replayed: true` header, and rejects in-progress and conflicting
+  keys. The server now maps uncaught `IdempotencyConflictError` and
+  `IdempotencyInProgressError` primitives to framework-owned `409` responses
+  using the new `httpErrors.IdempotencyConflict` and
+  `httpErrors.IdempotencyInProgress` catalog entries, so apps no longer need to
+  re-map idempotency primitives to app-local catalog errors.
+  `runIdempotently(...)` remains the workflow-level primitive for non-HTTP work.
+  `beignet doctor` recognizes the new `httpErrors` catalog entries.
+- c76c784: Add `beignet schedule run` for bounded app-owned schedule execution from local, CI, or worker entrypoints.
+- Updated dependencies [8bcb31f]
+- Updated dependencies [5d5e303]
+- Updated dependencies [31c7e66]
+- Updated dependencies [8297c7c]
+- Updated dependencies [4c1cb16]
+- Updated dependencies [ac78cdf]
+- Updated dependencies [2da5a05]
+- Updated dependencies [780955c]
+- Updated dependencies [1a79090]
+- Updated dependencies [7fe855b]
+- Updated dependencies [079bf59]
+- Updated dependencies [82c48dc]
+- Updated dependencies [5a51869]
+- Updated dependencies [89390fe]
+- Updated dependencies [89390fe]
+- Updated dependencies [303ba07]
+- Updated dependencies [2da5a05]
+- Updated dependencies [493d23b]
+- Updated dependencies [493d23b]
+- Updated dependencies [44f1192]
+- Updated dependencies [2aa77ca]
+- Updated dependencies [eda7b59]
+- Updated dependencies [90c2e48]
+- Updated dependencies [ac78cdf]
+- Updated dependencies [89390fe]
+- Updated dependencies [16cc113]
+- Updated dependencies [e9c3209]
+- Updated dependencies [ac78cdf]
+- Updated dependencies [cca08b1]
+- Updated dependencies [ac78cdf]
+- Updated dependencies [a67c637]
+- Updated dependencies [7b0f708]
+- Updated dependencies [246c66c]
+- Updated dependencies [242f220]
+- Updated dependencies [493d23b]
+- Updated dependencies [8063d38]
+- Updated dependencies [905da0a]
+- Updated dependencies [192c6ad]
+- Updated dependencies [192c6ad]
+- Updated dependencies [192c6ad]
+- Updated dependencies [192c6ad]
+- Updated dependencies [255527d]
+- Updated dependencies [ac78cdf]
+  - @beignet/core@0.0.4
+
+## 0.0.3
+
+### Patch Changes
+
+- 5643ae6: Add feature factory and seed generators plus database lifecycle doctor checks.
+- 80db618: Add notification generation, route-test scaffold updates, and doctor checks for upload and notification drift.
+- 3160184: Add `beignet db generate|migrate|seed|reset`, scaffold standard seed/reset database entrypoints, and expose a factory reset helper for test data workflows.
+- 03f07b2: Promote the standard starter to a golden-path Beignet app with Better Auth, Drizzle/libSQL persistence, UOW, outbox, audit logging, jobs/events/schedules, uploads, notifications, devtools, and deployment entrypoints wired by default.
+- 254ef6d: Add scoped route hooks for route and route-group policy, update auth hooks to expose public/optional/required route-hook factories, and teach CLI route inspection about curried route groups.
+- 4cb1784: Add first-class upload router primitives, a typed browser upload client, a
+  React upload adapter, Next.js upload route helper, S3-compatible direct upload
+  signing, devtools upload watcher support, an upload generator, and a
+  first-class `beignet make feature` command with optional policy, event, job,
+  and upload artifacts for the standard vertical slice. Add first-class job retry
+  helpers, outbox retry policy integration, and job retry/dead-letter devtools
+  events. Add a Next.js outbox drain route helper and doctor warnings for
+  serverless background-work footguns.
+
+## 0.0.2
+
+### Patch Changes
+
+- 90b29ad: Add pagination primitives and generate list responses with `items` and `page`.
+- a79f60c: Add first-class notification primitives, devtools notification watcher support,
+  and dependency-direction lint coverage for feature workflow folders.
+
 ## 0.0.1
 
 - Initial Beignet release under the `@beignet` npm scope.