@beignet/cli 0.0.42 → 0.0.44

package/src/make/tenancy.ts

@@ -952,7 +952,7 @@ export const workspaceMemberWithUserSchema = workspaceMemberSchema.extend({
 export const workspaceInviteSchema = z.object({
 \tid: z.string().min(1),
 \tworkspaceId: z.string().min(1),
-\temail: z.string().email(),
+\temail: z.email(),
 \trole: workspaceRoleSchema,
 \ttoken: z.string().min(1),
 \tinvitedByUserId: z.string().min(1),
@@ -1019,7 +1019,7 @@ export const listInvitesOutputSchema = z.object({
 });
 
 export const createInviteInputSchema = z.object({
-\temail: z.string().email(),
+\temail: z.email(),
 \trole: workspaceRoleSchema.default("member"),
 });
 
@@ -2005,7 +2005,7 @@ const invitePayloadSchema = z.object({
 \tinviteId: z.string().min(1),
 \tworkspaceId: z.string().min(1),
 \tworkspaceName: z.string().min(1),
-\temail: z.string().email(),
+\temail: z.email(),
 \trole: z.enum(["admin", "member"]),
 \ttoken: z.string().min(1),
 \tinvitedByName: z.string().optional(),
@@ -3242,9 +3242,7 @@ export const workspaces = ${dialect.tableFunction}(
 \t\tcreatedAt: ${column("created_at")}.notNull(),
 \t\tupdatedAt: ${column("updated_at")}.notNull(),
 \t},
-\t(table) => ({
-\t\tslugUnique: uniqueIndex("workspaces_slug_unique").on(table.slug),
-\t}),
+\t(table) => [uniqueIndex("workspaces_slug_unique").on(table.slug)],
 );
 
 export const workspaceMembers = ${dialect.tableFunction}(
@@ -3256,12 +3254,12 @@ export const workspaceMembers = ${dialect.tableFunction}(
 \t\trole: ${column("role")}.$type<WorkspaceRole>().notNull(),
 \t\tjoinedAt: ${column("joined_at")}.notNull(),
 \t},
-\t(table) => ({
-\t\tworkspaceUserUnique: uniqueIndex(
+\t(table) => [
+\t\tuniqueIndex(
 \t\t\t"workspace_members_workspace_user_unique",
 \t\t).on(table.workspaceId, table.userId),
-\t\tuserIdx: index("workspace_members_user_idx").on(table.userId),
-\t}),
+\t\tindex("workspace_members_user_idx").on(table.userId),
+\t],
 );
 
 export const workspaceInvites = ${dialect.tableFunction}(
@@ -3278,15 +3276,15 @@ export const workspaceInvites = ${dialect.tableFunction}(
 \t\tacceptedAt: ${column("accepted_at")},
 \t\tcreatedAt: ${column("created_at")}.notNull(),
 \t},
-\t(table) => ({
-\t\ttokenUnique: uniqueIndex("workspace_invites_token_unique").on(
+\t(table) => [
+\t\tuniqueIndex("workspace_invites_token_unique").on(
 \t\t\ttable.token,
 \t\t),
-\t\tworkspaceStatusIdx: index("workspace_invites_workspace_status_idx").on(
+\t\tindex("workspace_invites_workspace_status_idx").on(
 \t\t\ttable.workspaceId,
 \t\t\ttable.status,
 \t\t),
-\t}),
+\t],
 );
 `;
 }

package/src/make.ts

@@ -1575,7 +1575,8 @@ const cronSecretEnvEntry = `\t\tCRON_SECRET: z.string().min(1).optional(),`;
 
 // The literal APP_URL line every generated lib/env.ts ships with. CRON_SECRET
 // slots in directly below it, matching the documented env shape.
-const cronSecretEnvAnchor = `\t\tAPP_URL: z.string().url().default("http://localhost:3000"),`;
+const cronSecretEnvAnchor = `\t\tAPP_URL: z.url().default("http://localhost:3000"),`;
+const legacyCronSecretEnvAnchor = `\t\tAPP_URL: z.string().url().default("http://localhost:3000"),`;
 
 type CronSecretWiringPlan = {
   files: Array<GeneratedFile & { result: "created" | "updated" }>;
@@ -1596,10 +1597,15 @@ async function planCronSecretWiring(
       `Could not find the generated env file ${cronSecretEnvFile}. ${manualInstruction}`,
     );
   }
+  const envAnchor = envSource.includes(cronSecretEnvAnchor)
+    ? cronSecretEnvAnchor
+    : envSource.includes(legacyCronSecretEnvAnchor)
+      ? legacyCronSecretEnvAnchor
+      : undefined;
 
   if (/\bCRON_SECRET\b/.test(envSource)) {
     plan.skippedFiles.push(cronSecretEnvFile);
-  } else if (!envSource.includes(cronSecretEnvAnchor)) {
+  } else if (envAnchor === undefined) {
     throw new Error(
       `Could not find the generated APP_URL server entry in ${cronSecretEnvFile}. ${manualInstruction}`,
     );
@@ -1607,8 +1613,8 @@ async function planCronSecretWiring(
     plan.files.push({
       path: cronSecretEnvFile,
       content: envSource.replace(
-        cronSecretEnvAnchor,
-        `${cronSecretEnvAnchor}\n${cronSecretEnvEntry}`,
+        envAnchor,
+        `${envAnchor}\n${cronSecretEnvEntry}`,
       ),
       result: "updated",
     });
@@ -2218,6 +2224,10 @@ export async function makeUpload(
       dryRun: true,
     },
   );
+  // Validate central registration before generating feature files or applying
+  // provider wiring. Customized routes require an explicit manual edit rather
+  // than a successful-looking partial generation.
+  await updateUploadRoute(targetDir, names, config, { dryRun: true });
 
   const result = await makeFeatureArtifact({
     targetDir,
@@ -3716,7 +3726,9 @@ async function updateUploadRoute(
 
   const registry = defineUploadsInitializerInfo(next, "uploadRegistry");
   if (!registry) {
-    return "skipped";
+    throw new Error(
+      `Cannot register ${registryName} in ${file}: expected an uploadRegistry initialized with defineUploads({ ... }). Restore that registry shape or add ${registryKey}: ${registryName} manually before rerunning beignet make upload.`,
+    );
   }
   if (!new RegExp(`\\b${registryKey}\\s*:`).test(registry.text)) {
     next = `${next.slice(0, registry.end)}\t${registryKey}: ${registryName},\n${next.slice(
@@ -3912,7 +3924,7 @@ function schemasFile(
   return `import { z } from "zod";
 
 export const ${names.singularPascal}Schema = z.object({
-	id: z.string().uuid(),
+	id: z.uuid(),
 ${options.tenantScoped ? `\ttenantId: z.string().min(1),\n` : ""}	name: z.string().min(1),
 	version: z.number().int().min(1),
 	createdAt: z.string().datetime(),
@@ -3926,7 +3938,7 @@ const ${names.singularPascal}CursorPayloadSchema = z.object({
 	sortBy: ${names.singularPascal}SortBySchema,
 	sortDirection: ${names.singularPascal}SortDirectionSchema,
 	sortValue: z.string(),
-	id: z.string().uuid(),
+	id: z.uuid(),
 });
 
 export type ${names.singularPascal}SortBy = z.infer<
@@ -4019,7 +4031,7 @@ ${
   mode === "resource"
     ? `
 export const ${names.singularPascal}IdInputSchema = z.object({
-	id: z.string().uuid(),
+	id: z.uuid(),
 });
 
 export const Update${names.singularPascal}BodySchema = z.object({
@@ -4479,16 +4491,16 @@ export const outboxMessages = mysqlTable(
 \t\tcreatedAt: varchar("created_at", { length: 32 }).notNull(),
 \t\tupdatedAt: varchar("updated_at", { length: 32 }).notNull(),
 \t},
-\t(table) => ({
-\t\tavailableIdx: index("outbox_messages_available_idx").on(
+\t(table) => [
+\t\tindex("outbox_messages_available_idx").on(
 \t\t\ttable.status,
 \t\t\ttable.availableAt,
 \t\t),
-\t\tlockedIdx: index("outbox_messages_locked_idx").on(
+\t\tindex("outbox_messages_locked_idx").on(
 \t\t\ttable.status,
 \t\t\ttable.lockedUntil,
 \t\t),
-\t}),
+\t],
 );
 `;
   }
@@ -4515,16 +4527,16 @@ export const outboxMessages = ${dialect.tableFunction}(
 \t\tcreatedAt: text("created_at").notNull(),
 \t\tupdatedAt: text("updated_at").notNull(),
 \t},
-\t(table) => ({
-\t\tavailableIdx: index("outbox_messages_available_idx").on(
+\t(table) => [
+\t\tindex("outbox_messages_available_idx").on(
 \t\t\ttable.status,
 \t\t\ttable.availableAt,
 \t\t),
-\t\tlockedIdx: index("outbox_messages_locked_idx").on(
+\t\tindex("outbox_messages_locked_idx").on(
 \t\t\ttable.status,
 \t\t\ttable.lockedUntil,
 \t\t),
-\t}),
+\t],
 );
 `;
 }
@@ -4912,7 +4924,7 @@ const ${names.pluralCamel} = defineContractGroup()
 	});
 
 export const ${names.singularCamel}Schema = z.object({
-	id: z.string().uuid(),
+	id: z.uuid(),
 	name: z.string().min(1),
 });
 
@@ -5121,19 +5133,19 @@ import { z } from "zod";
 
 export const ${names.singularPascal}Created = defineEvent("${names.pluralCamel}.created", {
 	payload: z.object({
-		id: z.string().uuid(),
+		id: z.uuid(),
 	}),
 });
 
 export const ${names.singularPascal}Updated = defineEvent("${names.pluralCamel}.updated", {
 	payload: z.object({
-		id: z.string().uuid(),
+		id: z.uuid(),
 	}),
 });
 
 export const ${names.singularPascal}Deleted = defineEvent("${names.pluralCamel}.deleted", {
 	payload: z.object({
-		id: z.string().uuid(),
+		id: z.uuid(),
 	}),
 });
 
@@ -5209,7 +5221,7 @@ function eventFile(names: EventNames): string {
 import { z } from "zod";
 
 export const ${names.payloadSchemaName} = z.object({
-\tid: z.string().uuid(),
+\tid: z.uuid(),
 });
 
 export type ${names.payloadTypeName} = z.infer<typeof ${names.payloadSchemaName}>;
@@ -5226,7 +5238,7 @@ import { z } from "zod";
 import { defineJob } from "${aliasModule(config.paths.jobsBuilder)}";
 
 export const ${names.payloadSchemaName} = z.object({
-\tid: z.string().uuid(),
+\tid: z.uuid(),
 });
 
 export type ${names.payloadTypeName} = z.infer<typeof ${names.payloadSchemaName}>;
@@ -5317,9 +5329,9 @@ import { z } from "zod";
 import { defineNotification } from "${aliasModule(config.paths.notificationsBuilder)}";
 
 export const ${names.payloadSchemaName} = z.object({
-\tid: z.string().uuid(),
+\tid: z.uuid(),
 \tsubject: z.string(),
-\trecipientEmail: z.string().email(),
+\trecipientEmail: z.email(),
 });
 
 export type ${names.payloadTypeName} = z.infer<typeof ${names.payloadSchemaName}>;

package/src/registry-edits.ts

@@ -1,3 +1,5 @@
+import ts from "typescript";
+
 /**
  * Shared string-edit helpers for registry files.
  *
@@ -28,21 +30,35 @@ export type AppendResult =
   | { kind: "missing" };
 
 /**
- * Find the index of the delimiter closing the one at `openIndex`, skipping
- * string literals.
+ * Yield indexes that belong to executable source, excluding string literals
+ * and line/block comments. Registry scanners share this lexer so delimiters
+ * in user comments cannot corrupt their depth tracking.
  */
-export function matchingDelimiterIndex(
+export function* codeCharacterIndexes(
   source: string,
-  openIndex: number,
-  open: string,
-  close: string,
-): number {
-  let depth = 0;
+  start = 0,
+  end = source.length,
+): Generator<number> {
   let inString: string | undefined;
   let escaped = false;
+  let inLineComment = false;
+  let inBlockComment = false;
 
-  for (let index = openIndex; index < source.length; index++) {
+  for (let index = start; index < end; index++) {
     const char = source[index];
+    const next = source[index + 1];
+
+    if (inLineComment) {
+      if (char === "\n" || char === "\r") inLineComment = false;
+      continue;
+    }
+    if (inBlockComment) {
+      if (char === "*" && next === "/") {
+        inBlockComment = false;
+        index++;
+      }
+      continue;
+    }
     if (inString) {
       if (escaped) {
         escaped = false;
@@ -54,11 +70,40 @@ export function matchingDelimiterIndex(
       continue;
     }
 
+    if (char === "/" && next === "/") {
+      inLineComment = true;
+      index++;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      inBlockComment = true;
+      index++;
+      continue;
+    }
     if (char === '"' || char === "'" || char === "`") {
       inString = char;
       continue;
     }
 
+    yield index;
+  }
+}
+
+/**
+ * Find the index of the delimiter closing the one at `openIndex`, skipping
+ * string literals and comments.
+ */
+export function matchingDelimiterIndex(
+  source: string,
+  openIndex: number,
+  open: string,
+  close: string,
+): number {
+  let depth = 0;
+
+  for (const index of codeCharacterIndexes(source, openIndex)) {
+    const char = source[index];
+
     if (char === open) {
       depth++;
       continue;
@@ -77,21 +122,32 @@ export function matchingDelimiterIndex(
  * Insert a line directly after the last top-level import statement.
  */
 export function insertAfterImports(source: string, line: string): string {
-  const lines = source.split("\n");
-  let lastImportIndex = -1;
-
-  for (let index = 0; index < lines.length; index++) {
-    if (lines[index].startsWith("import ")) {
-      lastImportIndex = index;
-    }
+  const sourceFile = ts.createSourceFile(
+    "registry.ts",
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TS,
+  );
+  let lastImport: ts.ImportDeclaration | undefined;
+  for (const statement of sourceFile.statements) {
+    if (ts.isImportDeclaration(statement)) lastImport = statement;
   }
 
-  if (lastImportIndex === -1) {
+  if (!lastImport) {
     return `${line}\n${source}`;
   }
 
-  lines.splice(lastImportIndex + 1, 0, line);
-  return lines.join("\n");
+  const lineBreak = source.includes("\r\n") ? "\r\n" : "\n";
+  const lineEnd = source.indexOf(lineBreak, lastImport.end);
+  if (lineEnd === -1) {
+    return `${source}${lineBreak}${line}${lineBreak}`;
+  }
+
+  const insertAt = lineEnd + lineBreak.length;
+  return `${source.slice(0, insertAt)}${line}${lineBreak}${source.slice(
+    insertAt,
+  )}`;
 }
 
 /**
@@ -147,11 +203,14 @@ export function addNamedValueImport(
 export function identifiersFromArrayExpression(
   expression: string,
 ): Set<string> {
-  const withoutBrackets = expression.replace(/^\[/, "").replace(/\]$/, "");
+  const code = Array.from({ length: expression.length }, () => " ");
+  for (const index of codeCharacterIndexes(expression)) {
+    code[index] = expression[index];
+  }
 
   return new Set(
     Array.from(
-      withoutBrackets.matchAll(/\b[A-Za-z_$][\w$]*\b/g),
+      code.join("").matchAll(/\b[A-Za-z_$][\w$]*\b/g),
       ([name]) => name,
     ),
   );
@@ -342,26 +401,9 @@ function topLevelValueSlice(
   if (start >= hardEnd) return undefined;
 
   let depth = 0;
-  let inString: string | undefined;
-  let escaped = false;
 
-  for (let index = start; index <= hardEnd; index++) {
+  for (const index of codeCharacterIndexes(source, start, hardEnd + 1)) {
     const char = source[index];
-    if (inString) {
-      if (escaped) {
-        escaped = false;
-      } else if (char === "\\") {
-        escaped = true;
-      } else if (char === inString) {
-        inString = undefined;
-      }
-      continue;
-    }
-
-    if (char === '"' || char === "'" || char === "`") {
-      inString = char;
-      continue;
-    }
 
     if (char === "[" || char === "(" || char === "{") {
       depth++;

package/src/templates/agents.ts

@@ -31,8 +31,8 @@ export function agentsMd(ctx: TemplateContext): string {
       "\n| Server Component request context | Use an app-owned server-only helper such as `lib/server-context.ts` that wraps `server.createContextFromNext()` in React `cache(...)`. Layouts may read `ctx.auth`, `ctx.tenant`, and request metadata for redirects and shell state; feature data still belongs behind use cases. |" +
       "\n| Server Component React Query prefetch | Use an app-owned helper such as `lib/server-react-query.ts` on top of the request context: keep the `rq(contract).queryOptions(...)` key, replace only the server `queryFn` with the direct use case call, and do not create a parallel `rqServer` abstraction. |";
   const specificSkills = ctx.api
-    ? "`@beignet/next#routes-server`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`"
-    : "`@beignet/next#routes-server`, `@beignet/react-query#client`, `@beignet/react-hook-form#forms`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`";
+    ? "`@beignet/next#routes-server`, `@beignet/web#fetch-server`, `@beignet/devtools#runtime-safety`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`"
+    : "`@beignet/next#routes-server`, `@beignet/web#fetch-server`, `@beignet/devtools#runtime-safety`, `@beignet/react-query#client`, `@beignet/react-hook-form#forms`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`";
 
   return `# ${ctx.name} — agent guide
 
@@ -62,6 +62,9 @@ use, so their absence is fine. \`${cli} make event\`, \`${cli} make job\`,
 \`${cli} make listener\`, \`${cli} make schedule\`, \`${cli} make task\`,
 \`${cli} make seed\`, and \`${cli} make upload\` create or update their
 required app entrypoints.
+Upload generation validates the central \`uploadRegistry = defineUploads({ ... })\`
+shape before writing; when a custom route cannot be edited safely, follow the
+manual registry instruction in the error.
 \`${cli} doctor\` detects registration drift. Preview exact repair patches
 with \`${cli} doctor --fix --dry-run\`, then apply the returned plan with
 \`${cli} doctor --fix --plan <plan-id>\` and optional
@@ -115,7 +118,11 @@ need one check alone.
 
 Before exploring unfamiliar code, run \`${cli} map\` for the human inventory
 or \`${cli} map --json --feature <name>\` for an evidence-backed graph scoped
-to one feature.
+to one feature. The graph honors the app's complete TypeScript \`baseUrl\` and
+\`paths\` configuration. Fix \`local_import_unresolved\` and
+\`contract_declaration_unresolved\` entries rather than treating their missing
+edges as proof that no relationship exists. Registration diagnostics expose
+the declaration as \`subject.file\` and \`subject.exportName\`.
 
 ## Package skills
 

package/src/templates/base.ts

@@ -122,7 +122,9 @@ export function packageJson(ctx: TemplateContext): string {
 function intentSkillPackages(ctx: TemplateContext): string[] {
   const packages = [
     "@beignet/core",
+    "@beignet/devtools",
     "@beignet/next",
+    "@beignet/web",
     "@beignet/cli",
     "@beignet/provider-auth-better-auth",
     "@beignet/provider-db-drizzle",
@@ -362,7 +364,7 @@ ${optionalAuthRedirects}
       ? ""
       : "; it refuses non-local hosts unless `BEIGNET_ALLOW_DATABASE_RESET=true`"
   }.
-- Remove \`DEVTOOLS_ENABLED=true\` in production unless you add authentication and stricter redaction.
+- Remove \`DEVTOOLS_ENABLED=true\` outside development unless you add authentication and stricter redaction.
 - Set \`APP_URL\`, \`BETTER_AUTH_SECRET\`, \`LOG_LEVEL\`, and provider-specific variables in your hosting environment.
 - Set \`BETTER_AUTH_TRUSTED_ORIGINS\` before serving auth across multiple origins.
 - Review the starter authorization policy before exposing user-owned data.
@@ -463,7 +465,7 @@ export function envExample(ctx: TemplateContext): string {
     "# Copy to .env.local and fill in values for your app.",
     "APP_URL=http://localhost:3000",
     "",
-    "# Dev-only default; remove or protect in production.",
+    "# Local-development default; remove or protect outside development.",
     "DEVTOOLS_ENABLED=true",
     "",
     "LOG_LEVEL=info",

package/src/templates/db/mysql.ts

@@ -126,9 +126,9 @@ export const todos = mysqlTable(
 		// unmapped, and list ordering compares the strings lexicographically.
 		createdAt: varchar("created_at", { length: 32 }).notNull(),
 	},
-	(table) => ({
-		userIdx: index("todos_user_idx").on(table.userId, table.createdAt),
-	}),
+	(table) => [
+		index("todos_user_idx").on(table.userId, table.createdAt),
+	],
 );
 `,
     drizzleTodoRepository: `import "@beignet/core/server-only";

package/src/templates/db/postgres.ts

@@ -116,9 +116,9 @@ export const todos = pgTable(
 		// unmapped, and list ordering compares the strings lexicographically.
 		createdAt: text("created_at").notNull(),
 	},
-	(table) => ({
-		userIdx: index("todos_user_idx").on(table.userId, table.createdAt),
-	}),
+	(table) => [
+		index("todos_user_idx").on(table.userId, table.createdAt),
+	],
 );
 `,
     drizzleTodoRepository: `import "@beignet/core/server-only";

package/src/templates/db/sqlite.ts

@@ -112,9 +112,9 @@ export const todos = sqliteTable(
 			.default(false),
 		createdAt: text("created_at").notNull(),
 	},
-	(table) => ({
-		userIdx: index("todos_user_idx").on(table.userId, table.createdAt),
-	}),
+	(table) => [
+		index("todos_user_idx").on(table.userId, table.createdAt),
+	],
 );
 `,
   drizzleTodoRepository: `import "@beignet/core/server-only";

package/src/templates/server.ts

@@ -34,7 +34,7 @@ export function serverProviders(ctx: TemplateContext): string {
 
   const entries = [
     "\tcreateDevtoolsProvider(),",
-    "\tcreateBetterAuthProvider<AuthUser, AuthSessionMetadata>(auth),",
+    "\tcreateBetterAuthProvider<AuthUser, AuthSessionMetadata>({ auth }),",
     "\tcreatePinoLoggerProvider(),",
     `\t${db.providerInstance},`,
     "\tstarterDatabaseProvider,",
@@ -196,12 +196,12 @@ export const env = createEnv({
 		NODE_ENV: z
 			.enum(["development", "test", "production"])
 			.default("development"),
-		APP_URL: z.string().url().default("http://localhost:3000"),
+		APP_URL: z.url().default("http://localhost:3000"),
 		DEVTOOLS_ENABLED: BooleanEnv.optional(),
 		BETTER_AUTH_SECRET: isProductionRuntime
 			? BetterAuthSecret
 			: BetterAuthSecret.default(LOCAL_BETTER_AUTH_SECRET),
-		BETTER_AUTH_URL: z.string().url().default("http://localhost:3000"),
+		BETTER_AUTH_URL: z.url().default("http://localhost:3000"),
 		BETTER_AUTH_TRUSTED_ORIGINS: z.string().optional(),
 ${databaseEnvLines}
 		LOG_LEVEL: z
@@ -217,7 +217,7 @@ ${inngestEnvLines}
 export const isProduction = env.NODE_ENV === "production";
 
 export const isDevtoolsEnabled =
-	env.DEVTOOLS_ENABLED ?? process.env.NODE_ENV !== "production";
+	env.DEVTOOLS_ENABLED ?? env.NODE_ENV === "development";
 `;
 }
 

package/src/templates/todos.ts

@@ -2,7 +2,7 @@ const files = {
   schemas: `import { z } from "zod";
 
 export const TodoSchema = z.object({
-	id: z.string().uuid(),
+	id: z.uuid(),
 	userId: z.string(),
 	title: z.string().min(1),
 	completed: z.boolean(),
@@ -26,7 +26,7 @@ export const ListTodosOutputSchema = z.object({
 });
 
 export const TodoIdInputSchema = z.object({
-	id: z.string().uuid(),
+	id: z.uuid(),
 });
 
 export const CreateTodoInputSchema = z.object({