@beignet/cli 0.0.22 → 0.0.24

package/src/mcp.ts

@@ -12,6 +12,7 @@ import {
   makeFactory,
   makeFeature,
   makeFeatureAddonChoices,
+  makeFeatureRecipeChoices,
   makeJob,
   makeListener,
   makeNotification,
@@ -76,6 +77,10 @@ const makeInputSchema = {
     .describe(
       "feature only: add feature-owned artifacts such as policy, factories, seeds, events, listeners, jobs, notifications, schedules, tasks, ui, and uploads.",
     ),
+  recipe: z
+    .enum(makeFeatureRecipeChoices)
+    .optional()
+    .describe("feature only: generate a named recipe such as full-slice."),
   event: z
     .string()
     .optional()
@@ -132,6 +137,7 @@ type MakeToolInput = {
   artifact: MakeArtifact;
   name?: string;
   with?: Array<(typeof makeFeatureAddonChoices)[number]>;
+  recipe?: (typeof makeFeatureRecipeChoices)[number];
   event?: string;
   cron?: string;
   timezone?: string;
@@ -216,7 +222,7 @@ async function runMakeTool(
     case "factory":
       return makeFactory(base);
     case "feature":
-      return makeFeature({ ...base, with: input.with });
+      return makeFeature({ ...base, with: input.with, recipe: input.recipe });
     case "job":
       return makeJob(base);
     case "listener":

package/src/templates/agents.ts

@@ -52,8 +52,9 @@ is a silent failure — the file exists but never runs:
 
 The starter ships no workflow registries — generators create them on first
 use, so their absence is fine. \`${cli} make event\`, \`${cli} make job\`,
-\`${cli} make schedule\`, \`${cli} make task\`, \`${cli} make seed\`, and
-\`${cli} make upload\` create or update their required app entrypoints.
+\`${cli} make listener\`, \`${cli} make schedule\`, \`${cli} make task\`,
+\`${cli} make seed\`, and \`${cli} make upload\` create or update their
+required app entrypoints.
 \`${cli} doctor\` detects registration drift. \`${cli} doctor --fix\` repairs
 route-group, schedule, task, and outbox registration; listener drift is
 report-only and must be fixed by hand.
@@ -62,8 +63,10 @@ report-only and must be fixed by hand.
 
 \`${cli} make <artifact> <name>\` creates correctly placed, pre-registered
 files — prefer it over hand-writing them. See \`${cli} make --help\` for the
-artifact list. After changing the Drizzle schema in \`infra/db/schema/\`, run
-\`${cli} db generate\` then \`${cli} db migrate\`.
+artifact list. Use \`${cli} make feature <name> --recipe full-slice\` when you
+need a richer reference slice with policy, client helpers, workflow artifacts,
+events, listener registration, jobs, and outbox wiring. After changing the Drizzle schema in
+\`infra/db/schema/\`, run \`${cli} db generate\` then \`${cli} db migrate\`.
 
 ## Validation loop
 
@@ -98,7 +101,8 @@ skill-loading block.
 
 - Feature artifacts live under \`features/<feature>/\`, with tests in
   \`features/<feature>/tests/\` (not \`__tests__/\`).
-- Feature-specific client data-fetching helpers and hooks may live in
+- Feature-specific client data-fetching helpers, query options, mutation
+  options, invalidation helpers, and hooks live in
   \`features/<feature>/client/\`; shared client setup stays in root \`client/\`.
 - Domain and use-case code must not import infra, providers, or React.
 - Routes must not import concrete infra.

package/src/templates/base.ts

@@ -273,6 +273,7 @@ ${cli} doctor
 \`\`\`
 
 \`make feature\` creates a contract-to-test vertical slice with Drizzle schema and repository files, so regenerate and migrate the database before running the app against the new feature.
+Use \`${cli} make feature projects --recipe full-slice\` when you want a richer reference slice with policy, feature client helpers, workflow artifacts, events, listener registration, jobs, and outbox wiring.
 
 ## App map
 
@@ -418,7 +419,7 @@ export function envExample(ctx: TemplateContext): string {
     "# Copy to .env.local and fill in values for your app.",
     "APP_URL=http://localhost:3000",
     "",
-    "# Dev-only default; remove in production.",
+    "# Dev-only default; remove or protect in production.",
     "DEVTOOLS_ENABLED=true",
     "",
     "LOG_LEVEL=info",
@@ -427,7 +428,8 @@ export function envExample(ctx: TemplateContext): string {
     "",
     ...databaseLines,
     "",
-    "BETTER_AUTH_SECRET=local-dev-better-auth-secret-change-me",
+    "# Optional for local development; required in production.",
+    "# BETTER_AUTH_SECRET=replace-with-a-random-32-character-secret",
     "BETTER_AUTH_URL=http://localhost:3000",
     "# BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000",
     "",

package/src/templates/db/mysql.ts

@@ -115,7 +115,7 @@ export const todos = mysqlTable(
 	}),
 );
 `,
-    drizzleTodoRepository: `import type { beignetServerOnly } from "@beignet/core/server-only";
+    drizzleTodoRepository: `import "@beignet/core/server-only";
 import { offsetPageResult } from "@beignet/core/pagination";
 import type { DrizzleMysqlDatabase } from "@beignet/provider-db-drizzle/mysql";
 import { count, desc, eq } from "drizzle-orm";
@@ -255,7 +255,7 @@ async function prepare(pool: Pool): Promise<void> {
 	await migrate(drizzle(pool), { migrationsFolder: "drizzle" });
 }
 `,
-    dbProvider: `import type { beignetServerOnly } from "@beignet/core/server-only";
+    dbProvider: `import "@beignet/core/server-only";
 import { createProvider } from "@beignet/core/providers";
 import {
 	createDrizzleMysqlIdempotencyPort,

package/src/templates/db/postgres.ts

@@ -105,7 +105,7 @@ export const todos = pgTable(
 	}),
 );
 `,
-    drizzleTodoRepository: `import type { beignetServerOnly } from "@beignet/core/server-only";
+    drizzleTodoRepository: `import "@beignet/core/server-only";
 import { offsetPageResult } from "@beignet/core/pagination";
 import type { DrizzlePostgresDatabase } from "@beignet/provider-db-drizzle/postgres";
 import { count, desc, eq } from "drizzle-orm";
@@ -243,7 +243,7 @@ async function prepare(pool: Pool): Promise<void> {
 	await migrate(drizzle(pool), { migrationsFolder: "drizzle" });
 }
 `,
-    dbProvider: `import type { beignetServerOnly } from "@beignet/core/server-only";
+    dbProvider: `import "@beignet/core/server-only";
 import { createProvider } from "@beignet/core/providers";
 import {
 	createDrizzlePostgresIdempotencyPort,

package/src/templates/db/sqlite.ts

@@ -101,7 +101,7 @@ export const todos = sqliteTable(
 	}),
 );
 `,
-  drizzleTodoRepository: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  drizzleTodoRepository: `import "@beignet/core/server-only";
 import { offsetPageResult } from "@beignet/core/pagination";
 import type { DrizzleSqliteDatabase } from "@beignet/provider-db-drizzle/sqlite";
 import { count, desc, eq } from "drizzle-orm";
@@ -242,7 +242,7 @@ async function prepare(client: Client): Promise<void> {
 	await migrate(drizzle(client), { migrationsFolder: "drizzle" });
 }
 `,
-  dbProvider: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  dbProvider: `import "@beignet/core/server-only";
 import { createProvider } from "@beignet/core/providers";
 import {
 	createDrizzleSqliteIdempotencyPort,

package/src/templates/index.ts

@@ -132,6 +132,7 @@ export function getTemplateFiles(ctx: TemplateContext): TemplateFile[] {
     { path: "lib/env.ts", content: env(ctx) },
     { path: "lib/auth.ts", content: serverFiles.authHelpers },
     { path: "lib/better-auth.ts", content: betterAuth(ctx) },
+    { path: "lib/tenant.ts", content: serverFiles.tenantHelper },
     { path: "lib/use-case.ts", content: serverFiles.useCaseBuilder },
     { path: "server/index.ts", content: server(ctx) },
     { path: "server/context.ts", content: serverFiles.serverContext },

package/src/templates/server.ts

@@ -8,7 +8,7 @@ import {
 export function serverProviders(ctx: TemplateContext): string {
   const db = databaseDescriptor(ctx);
   const imports = [
-    'import type { beignetServerOnly } from "@beignet/core/server-only";',
+    'import "@beignet/core/server-only";',
     'import { createDevtoolsProvider } from "@beignet/devtools";',
     'import { createAuthBetterAuthProvider } from "@beignet/provider-auth-better-auth";',
     `import { ${db.providerFactory} } from "@beignet/provider-db-drizzle/${db.subpath}";`,
@@ -155,6 +155,19 @@ export function env(ctx: TemplateContext): string {
 import { z } from "zod";
 
 const BooleanEnv = z.enum(["true", "false"]).transform((value) => value === "true");
+const LOCAL_BETTER_AUTH_SECRET = "local-dev-better-auth-secret-change-me";
+const isProductionRuntime =
+	process.env.NODE_ENV === "production" &&
+	process.env.NEXT_PHASE !== "phase-production-build";
+const BetterAuthSecret = z.string().min(32).superRefine((value, ctx) => {
+	if (isProductionRuntime && value === LOCAL_BETTER_AUTH_SECRET) {
+		ctx.addIssue({
+			code: "custom",
+			message:
+				"BETTER_AUTH_SECRET must be unique in production. Generate a strong secret instead of using the local development placeholder.",
+		});
+	}
+});
 
 export const env = createEnv({
 	server: {
@@ -163,10 +176,9 @@ export const env = createEnv({
 			.default("development"),
 		APP_URL: z.string().url().default("http://localhost:3000"),
 		DEVTOOLS_ENABLED: BooleanEnv.optional(),
-		BETTER_AUTH_SECRET: z
-			.string()
-			.min(32)
-			.default("local-dev-better-auth-secret-change-me"),
+		BETTER_AUTH_SECRET: isProductionRuntime
+			? BetterAuthSecret
+			: BetterAuthSecret.default(LOCAL_BETTER_AUTH_SECRET),
 		BETTER_AUTH_URL: z.string().url().default("http://localhost:3000"),
 		BETTER_AUTH_TRUSTED_ORIGINS: z.string().optional(),
 ${databaseEnvLines}
@@ -283,7 +295,7 @@ export function server(ctx: TemplateContext): string {
 \t\t\tDB_URL: env.${db.urlEnvVar},
 \t\t},`;
 
-  return `import type { beignetServerOnly } from "@beignet/core/server-only";
+  return `import "@beignet/core/server-only";
 import { createNextServer } from "@beignet/next";
 import { createErrorReportingHooks, createIdempotencyHooks } from "@beignet/core/server";
 import type { AppContext } from "@/app-context";
@@ -369,7 +381,7 @@ export const errors = defineErrors({
 
 export const appError = createAppError(errors);
 `,
-  useCaseBuilder: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  useCaseBuilder: `import "@beignet/core/server-only";
 import { createUseCase } from "@beignet/core/application";
 import type { AppContext } from "@/app-context";
 
@@ -403,10 +415,14 @@ export type AuthUser = {
 	id: string;
 	email?: string;
 	name?: string;
+	tenantId?: string;
+	organizationId?: string;
 };
 
 export type AuthSessionMetadata = {
 	id?: string;
+	tenantId?: string;
+	organizationId?: string;
 };
 
 export type AuthSession = BeignetAuthSession<
@@ -420,7 +436,7 @@ export type AuthPort = BeignetAuthPort<
 	AuthRequest
 >;
 `,
-  serverRoutes: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  serverRoutes: `import "@beignet/core/server-only";
 import { contractsFromRoutes, defineRoutes } from "@beignet/next";
 import type { AppContext } from "@/app-context";
 import { todoRoutes } from "@/features/todos/routes";
@@ -430,17 +446,17 @@ export const routes = defineRoutes<AppContext>([
 ]);
 export const contracts = contractsFromRoutes(routes);
 `,
-  serverContext: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  serverContext: `import "@beignet/core/server-only";
 import {
 	type ActivityActor,
 	createAnonymousActor,
 	createServiceActor,
-	createTenant,
 	createUserActor,
 } from "@beignet/core/ports";
 import { defineServerContext } from "@beignet/core/server";
 import type { TraceContext } from "@beignet/core/tracing";
 import type { AppContext, AppRuntimePorts } from "@/app-context";
+import { resolveRequestTenant, resolveServiceTenant } from "@/lib/tenant";
 
 export type AppServiceContextInput =
 	| {
@@ -456,7 +472,7 @@ export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 	gate: (ports) => ports.gate,
 	request: async ({ req, ports, requestId, trace }) => {
 		const auth = await ports.auth.getSession(req);
-		const tenantId = req.headers.get("x-tenant-id") || undefined;
+		const tenant = resolveRequestTenant({ auth });
 
 		return {
 			requestId,
@@ -466,7 +482,7 @@ export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 			auth,
 			...trace,
 			ports,
-			tenant: tenantId ? createTenant(tenantId) : undefined,
+			...(tenant ? { tenant } : {}),
 		};
 	},
 	service: ({
@@ -479,15 +495,67 @@ export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 		input: AppServiceContextInput;
 		requestId: string;
 		trace: TraceContext;
-	}) => ({
-		requestId,
-		actor: input?.actor ?? createServiceActor("beignet-service"),
-		auth: null,
-		...trace,
-		ports,
-		tenant: createTenant(input?.tenantId ?? "tenant_default"),
-	}),
+	}) => {
+		const tenant = resolveServiceTenant(input?.tenantId);
+
+		return {
+			requestId,
+			actor: input?.actor ?? createServiceActor("beignet-service"),
+			auth: null,
+			...trace,
+			ports,
+			...(tenant ? { tenant } : {}),
+		};
+	},
 });
+`,
+  tenantHelper: `import { type ActivityTenant, createTenant } from "@beignet/core/ports";
+import type { AuthSession } from "@/ports/auth";
+
+export type TenantResolutionInput = {
+	auth: AuthSession | null;
+};
+
+export function resolveRequestTenant({
+	auth,
+}: TenantResolutionInput): ActivityTenant | undefined {
+	const tenantId = auth ? tenantIdFromAuth(auth) : undefined;
+
+	return tenantId ? createTenant(tenantId) : undefined;
+}
+
+export function resolveServiceTenant(
+	tenantId: string | undefined,
+): ActivityTenant | undefined {
+	const normalizedTenantId = normalizeTenantId(tenantId);
+
+	return normalizedTenantId ? createTenant(normalizedTenantId) : undefined;
+}
+
+function tenantIdFromAuth(auth: AuthSession) {
+	return (
+		stringProperty(auth.session, "tenantId") ??
+		stringProperty(auth.session, "organizationId") ??
+		stringProperty(auth.user, "tenantId") ??
+		stringProperty(auth.user, "organizationId")
+	);
+}
+
+function stringProperty(value: unknown, key: string) {
+	if (!isRecord(value)) return undefined;
+
+	return normalizeTenantId(value[key]);
+}
+
+function normalizeTenantId(value: unknown) {
+	return typeof value === "string" && value.trim().length > 0
+		? value.trim()
+		: undefined;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null;
+}
 `,
   apiCatchAllRoute: `import { server } from "@/server";
 
@@ -553,11 +621,13 @@ export const { GET, POST } = createDevtoolsRoute(server.ports.devtools, {
 });
 `,
   openApiRoute: `import { createOpenAPIHandler } from "@beignet/next";
+import { env } from "@/lib/env";
 import { server } from "@/server";
 
 export const GET = createOpenAPIHandler(server.contracts, {
 	title: "Beignet starter API",
 	version: "0.1.0",
+	servers: [{ url: env.APP_URL }],
 });
 `,
   authRoute: `import { toNextJsHandler } from "better-auth/next-js";

package/src/templates/shell.ts

@@ -1035,12 +1035,41 @@ export function SettingsNav() {
 }
 `;
 
+const todoClientQueries = `import type { QueryClient } from "@tanstack/react-query";
+import { rq } from "@/client";
+import {
+	createTodo,
+	deleteTodo,
+	listTodos,
+	updateTodo,
+} from "@/features/todos/contracts";
+
+export function listTodosQueryOptions() {
+	return rq(listTodos).queryOptions();
+}
+
+export function createTodoMutationOptions() {
+	return rq(createTodo).mutationOptions();
+}
+
+export function updateTodoMutationOptions() {
+	return rq(updateTodo).mutationOptions();
+}
+
+export function deleteTodoMutationOptions() {
+	return rq(deleteTodo).mutationOptions();
+}
+
+export function invalidateTodos(queryClient: QueryClient) {
+	return rq(listTodos).invalidate(queryClient);
+}
+`;
+
 const todoApp = `"use client";
 
 import { rootFormError } from "@beignet/react-hook-form";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { Trash2Icon } from "lucide-react";
-import { rq } from "@/client";
 import { rhf } from "@/client/forms";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent } from "@/components/ui/card";
@@ -1048,45 +1077,44 @@ import { Checkbox } from "@/components/ui/checkbox";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import {
-	createTodo,
-	deleteTodo,
-	listTodos,
-	updateTodo,
-} from "@/features/todos/contracts";
+	createTodoMutationOptions,
+	deleteTodoMutationOptions,
+	invalidateTodos,
+	listTodosQueryOptions,
+	updateTodoMutationOptions,
+} from "@/features/todos/client/queries";
+import { createTodo } from "@/features/todos/contracts";
 import { cn } from "@/lib/utils";
 
 const createTodoForm = rhf(createTodo);
 
 export function TodoApp() {
 	const queryClient = useQueryClient();
-	const todosQuery = useQuery(rq(listTodos).queryOptions());
+	const todosQuery = useQuery(listTodosQueryOptions());
 	const form = createTodoForm.useForm({
 		defaultValues: { title: "" },
 	});
 
-	const invalidateTodos = () => rq(listTodos).invalidate(queryClient);
+	const invalidateTodoQueries = () => invalidateTodos(queryClient);
 
-	const createTodoMutation = useMutation(
-		rq(createTodo).mutationOptions({
-			onSuccess: async () => {
-				form.reset();
-				await invalidateTodos();
-			},
-			onError: (error) => {
-				form.setError("root", rootFormError(error, "Could not create the todo."));
-			},
-		}),
-	);
-	const updateTodoMutation = useMutation(
-		rq(updateTodo).mutationOptions({
-			onSuccess: invalidateTodos,
-		}),
-	);
-	const deleteTodoMutation = useMutation(
-		rq(deleteTodo).mutationOptions({
-			onSuccess: invalidateTodos,
-		}),
-	);
+	const createTodoMutation = useMutation({
+		...createTodoMutationOptions(),
+		onSuccess: async () => {
+			form.reset();
+			await invalidateTodoQueries();
+		},
+		onError: (error) => {
+			form.setError("root", rootFormError(error, "Could not create the todo."));
+		},
+	});
+	const updateTodoMutation = useMutation({
+		...updateTodoMutationOptions(),
+		onSuccess: invalidateTodoQueries,
+	});
+	const deleteTodoMutation = useMutation({
+		...deleteTodoMutationOptions(),
+		onSuccess: invalidateTodoQueries,
+	});
 
 	const onSubmit = form.handleSubmit((body) => {
 		form.clearErrors("root");
@@ -1215,6 +1243,10 @@ export function shellTemplateFiles(ctx: TemplateContext): TemplateFile[] {
     { path: "components/theme-toggle.tsx", content: themeToggle },
     { path: "components/app-sidebar.tsx", content: appSidebar },
     { path: "components/settings-nav.tsx", content: settingsNav },
+    {
+      path: "features/todos/client/queries.ts",
+      content: todoClientQueries,
+    },
     {
       path: "features/todos/components/todo-app.tsx",
       content: todoApp,

package/src/templates/todos.ts

@@ -174,7 +174,7 @@ export const todoPolicy = definePolicy({
 		authorizeOwner(ctx, todo, "delete"),
 });
 `,
-  routes: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  routes: `import "@beignet/core/server-only";
 import { defineRouteGroup } from "@beignet/next";
 import type { AppContext } from "@/app-context";
 import {
@@ -200,7 +200,7 @@ export const todoRoutes = defineRouteGroup<AppContext>()({
 	],
 });
 `,
-  listTodosUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  listTodosUseCase: `import "@beignet/core/server-only";
 import { normalizeOffsetPage } from "@beignet/core/pagination";
 import { requireUser } from "@/lib/auth";
 import { useCase } from "@/lib/use-case";
@@ -220,7 +220,7 @@ export const listTodosUseCase = useCase
 		return ctx.ports.todos.list(user.id, page);
 	});
 `,
-  createTodoUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  createTodoUseCase: `import "@beignet/core/server-only";
 import { requireUser } from "@/lib/auth";
 import { useCase } from "@/lib/use-case";
 import { CreateTodoInputSchema, TodoSchema } from "../schemas";
@@ -238,7 +238,7 @@ export const createTodoUseCase = useCase
 		);
 	});
 `,
-  updateTodoUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  updateTodoUseCase: `import "@beignet/core/server-only";
 import { appError } from "@/features/shared/errors";
 import { requireUser } from "@/lib/auth";
 import { useCase } from "@/lib/use-case";
@@ -263,7 +263,7 @@ export const updateTodoUseCase = useCase
 		});
 	});
 `,
-  deleteTodoUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  deleteTodoUseCase: `import "@beignet/core/server-only";
 import { appError } from "@/features/shared/errors";
 import { requireUser } from "@/lib/auth";
 import { useCase } from "@/lib/use-case";