@beignet/cli 0.0.43 → 0.0.45

package/src/task.ts

@@ -1,4 +1,4 @@
-import { readFile, stat } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import path from "node:path";
 import type { TaskDef, TaskRunContextArgs } from "@beignet/core/tasks";
 import { createJiti } from "jiti";
@@ -8,6 +8,8 @@ import {
   type OperationalErrorReportingContext,
   reportOperationalFailure,
 } from "./operational-error-reporting.js";
+import { runWithOperationalCleanup } from "./operational-lifecycle.js";
+import { resolveAppOperationalModulePath } from "./operational-path.js";
 
 /**
  * Options for running an app-owned operational task.
@@ -15,7 +17,8 @@ import {
 export type RunAppTaskOptions = {
   name: string;
   cwd?: string;
-  input?: string | Record<string, unknown>;
+  /** Pre-parsed input validated by the registered task schema. */
+  input?: unknown;
   tenant?: string;
   modulePath?: string;
 };
@@ -49,7 +52,7 @@ export async function runAppTask(
   const cwd = path.resolve(options.cwd ?? process.cwd());
   const config = await loadBeignetConfig(cwd);
   const modulePath = normalizePath(options.modulePath ?? config.paths.tasks);
-  const rawInput = parseTaskInputFlag(options.input);
+  const rawInput = options.input === undefined ? {} : options.input;
   const startedAt = performance.now();
   const taskModule = await loadTaskModule(cwd, modulePath);
   const task = findTask(taskModule.tasks, options.name, modulePath);
@@ -67,51 +70,56 @@ export async function runAppTask(
     ? await taskModule.createTaskContext(contextArgs)
     : {};
 
-  try {
-    let output: unknown;
-    try {
-      output = await runTask(task, {
-        input: parsedInput,
-        ctx,
-      });
-    } catch (error) {
-      await reportOperationalFailure({
-        ctx: toOperationalContext(ctx),
-        error,
-        reportOptions: {
-          level: "error",
-          mechanism: "beignet.task.cli",
-          handled: false,
-          tags: {
-            "beignet.kind": "task",
-            "beignet.task": task.name,
-          },
-          contexts: {
-            task: {
-              name: task.name,
-              tenant: options.tenant ?? null,
-              source: "beignet-cli",
+  return runWithOperationalCleanup({
+    operation: `Task "${task.name}"`,
+    cleanupLabel: "stopTaskContext",
+    run: async () => {
+      let output: unknown;
+      try {
+        output = await runTask(task, {
+          input: parsedInput,
+          ctx,
+        });
+      } catch (error) {
+        await reportOperationalFailure({
+          ctx: toOperationalContext(ctx),
+          error,
+          reportOptions: {
+            level: "error",
+            mechanism: "beignet.task.cli",
+            handled: false,
+            tags: {
+              "beignet.kind": "task",
+              "beignet.task": task.name,
+            },
+            contexts: {
+              task: {
+                name: task.name,
+                tenant: options.tenant ?? null,
+                source: "beignet-cli",
+              },
             },
           },
-        },
-      });
-      throw error;
-    }
-
-    return {
-      schemaVersion: 1,
-      name: task.name,
-      cwd,
-      modulePath,
-      input: parsedInput,
-      ...(options.tenant !== undefined ? { tenant: options.tenant } : {}),
-      output,
-      durationMs: Math.round(performance.now() - startedAt),
-    };
-  } finally {
-    await flushOperationalErrorReporter(toOperationalContext(ctx));
-    await taskModule.stopTaskContext?.(ctx, contextArgs);
-  }
+        });
+        throw error;
+      }
+
+      return {
+        schemaVersion: 1,
+        name: task.name,
+        cwd,
+        modulePath,
+        input: parsedInput,
+        ...(options.tenant !== undefined ? { tenant: options.tenant } : {}),
+        output,
+        durationMs: Math.round(performance.now() - startedAt),
+      };
+    },
+    cleanup: async () => {
+      await flushOperationalErrorReporter(toOperationalContext(ctx));
+      await taskModule.stopTaskContext?.(ctx, contextArgs);
+    },
+  });
 }
 
 function toOperationalContext(ctx: unknown): OperationalErrorReportingContext {
@@ -120,27 +128,15 @@ function toOperationalContext(ctx: unknown): OperationalErrorReportingContext {
     : {};
 }
 
-function parseTaskInputFlag(input: RunAppTaskOptions["input"]): unknown {
-  if (input === undefined) return {};
-  if (typeof input !== "string") return input;
-
-  try {
-    return JSON.parse(input) as unknown;
-  } catch (error) {
-    throw new Error(
-      `Invalid --input JSON: ${error instanceof Error ? error.message : String(error)}`,
-    );
-  }
-}
-
 async function loadTaskModule(
   cwd: string,
   modulePath: string,
 ): Promise<TaskModule> {
-  const absolutePath = path.join(cwd, modulePath);
+  let absolutePath: string;
   try {
-    await stat(absolutePath);
-  } catch {
+    absolutePath = await resolveAppOperationalModulePath(cwd, modulePath);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
     throw new Error(
       `Could not find app task registry at ${modulePath}. Create it with beignet make task <feature.name> or configure paths.tasks in beignet.config.ts.`,
     );

package/src/templates/agents.ts

@@ -31,8 +31,8 @@ export function agentsMd(ctx: TemplateContext): string {
       "\n| Server Component request context | Use an app-owned server-only helper such as `lib/server-context.ts` that wraps `server.createContextFromNext()` in React `cache(...)`. Layouts may read `ctx.auth`, `ctx.tenant`, and request metadata for redirects and shell state; feature data still belongs behind use cases. |" +
       "\n| Server Component React Query prefetch | Use an app-owned helper such as `lib/server-react-query.ts` on top of the request context: keep the `rq(contract).queryOptions(...)` key, replace only the server `queryFn` with the direct use case call, and do not create a parallel `rqServer` abstraction. |";
   const specificSkills = ctx.api
-    ? "`@beignet/next#routes-server`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`"
-    : "`@beignet/next#routes-server`, `@beignet/react-query#client`, `@beignet/react-hook-form#forms`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`";
+    ? "`@beignet/next#routes-server`, `@beignet/web#fetch-server`, `@beignet/devtools#runtime-safety`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`"
+    : "`@beignet/next#routes-server`, `@beignet/web#fetch-server`, `@beignet/devtools#runtime-safety`, `@beignet/react-query#client`, `@beignet/react-hook-form#forms`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`";
 
   return `# ${ctx.name} — agent guide
 
@@ -81,7 +81,9 @@ events, listener registration, jobs, and outbox wiring. After changing the Drizz
 \`infra/db/schema/\`, run \`${cli} db generate\` then \`${cli} db migrate\`.
 When MCP is available, use \`db_schema_sync\` for Beignet provider table
 re-exports and \`db\` for \`generate\`, \`migrate\`, \`seed\`, or \`reset\`
-instead of falling back to a shell.
+instead of falling back to a shell. Use \`task_run\`, \`schedule_run\`,
+\`outbox_inspect\`, and \`outbox_run\` for registered operational workflows
+and outbox recovery.
 
 ## The framework already solves these
 
@@ -94,7 +96,7 @@ apps have reimplemented by accident:
 | Ports outside a request — auth callbacks, module-level helpers | \`const { ports } = await getServer()\` (dynamic \`import("@/server")\` breaks module cycles). Do not construct parallel provider clients or fall back to \`console.*\` when \`ports.logger\` exists. |
 | Routes that cannot be contracts — webhooks, third-party callbacks, streaming | \`createWebhookRoute\`, \`createPaymentWebhookRoute\`, \`createScheduleRoute\`, \`createOutboxDrainRoute\` from \`@beignet/next\`; \`server.rawRoute(...)\` for anything else. All run the hooks pipeline — never hand-enforce rate limits in a route body. |
 | Rate limiting or idempotency on a route | Declare \`metadata.rateLimit\` / \`metadata.idempotency\` on the contract (or the \`pipeline\` option on raw routes); hooks enforce it. |
-| Tenant-owned repository access | Pass \`TenantScope\` through app-facing repository methods and unwrap it with \`tenantScopeId(scope)\` in adapters. Raw provider-correlation lookups such as webhook customer IDs are not tenant authorization. |
+| Tenant-owned repository access | Resolve the request tenant from membership-backed app state or provider claims the app explicitly treats as authoritative and current; never trust caller-supplied tenant IDs or unverified session fields. Pass \`TenantScope\` through app-facing repository methods and unwrap it with \`tenantScopeId(scope)\` in adapters. Raw provider-correlation lookups such as webhook customer IDs are not tenant authorization. |
 | Route-level tests that exercise real hooks | \`createTestApp\` / \`createTestRequester\` from \`@beignet/web/testing\`. Bind the rate-limit and idempotency ports in the test app when asserting 429s or replay. |
 | Environment configuration | \`lib/env.ts\` (\`createEnv\`), never ad-hoc \`process.env\` reads in app code. |
 | The same lookup runs several times in one request — context, policy, use case | Wrap the repository read in \`createMemo(...)\` from \`@beignet/core/memo\` where the adapter is wired in infra. The cache lives for exactly one request; pair mutations with \`.invalidate(...)\`. Never hand-roll per-request caches. |
@@ -159,10 +161,13 @@ skill-loading block.
 ## MCP server
 
 \`.mcp.json\` registers the app-local \`@beignet/cli\` bin at
-\`./node_modules/.bin/beignet mcp\`, which exposes the app map, validation, and
-generators as structured tools named exactly: \`app_map\`, \`explain\`,
-\`check\`, \`db\`, \`db_schema_sync\`, \`routes\`, \`doctor\`,
+\`./node_modules/.bin/beignet mcp\`, which exposes app context, validation,
+generation, and operations as structured tools named exactly: \`app_map\`,
+\`explain\`, \`check\`, \`db\`, \`db_schema_sync\`, \`task_run\`,
+\`schedule_run\`, \`outbox_inspect\`, \`outbox_run\`, \`routes\`, \`doctor\`,
 \`doctor_fix_plan\`, \`doctor_fix\`, \`lint\`, \`make\`, \`provider_add\`.
+It also publishes \`beignet://app/guidance\` and focused
+\`beignet://app/features/{feature}\` resources.
 Use \`doctor_fix_plan\` to inspect
 stable operation IDs, hashes, exact patches, and current diagnostics before
 passing its \`planId\` and optional \`fixIds\` to \`doctor_fix\`. Guarded
@@ -180,7 +185,15 @@ with \`generate\` and \`migrate\`; database output is bounded, commands time
 out, and cancellation stops the active process tree. Treat \`seed\` and
 especially \`reset\` as app-owned mutations. Lifecycle \`dryRun\` validates
 and reports the script without executing it; it does not simulate SQL or data
-changes. Clients that do not read \`.mcp.json\` can use the same command from
+changes. Use \`task_run\` and \`schedule_run\` for registered operational
+workflows, \`outbox_inspect\` for read-only \`list\` and \`show\`, and
+\`outbox_run\` for \`drain\`, \`requeue\`, \`purge\`, or \`prune\`; purge and
+prune support \`dryRun\`. Operational commands run in isolated process trees
+with bounded results, cancellation, and timeouts. Optional \`module\` overrides
+must remain inside the app root where the MCP server started. Cancellation and
+timeouts cannot roll back side effects that already completed. Inspect app
+state before retrying an interrupted operation or one that reports a cleanup
+failure. Clients that do not read \`.mcp.json\` can use the same command from
 the app root; use \`${cli} mcp\` only for terminal debugging.
 `;
 }

package/src/templates/base.ts

@@ -122,7 +122,9 @@ export function packageJson(ctx: TemplateContext): string {
 function intentSkillPackages(ctx: TemplateContext): string[] {
   const packages = [
     "@beignet/core",
+    "@beignet/devtools",
     "@beignet/next",
+    "@beignet/web",
     "@beignet/cli",
     "@beignet/provider-auth-better-auth",
     "@beignet/provider-db-drizzle",

package/src/templates/server.ts

@@ -601,7 +601,9 @@ export type TenantResolutionInput = {
 export function resolveRequestTenant({
 	auth,
 }: TenantResolutionInput): ActivityTenant | undefined {
-	const tenantId = auth ? tenantIdFromAuth(auth) : undefined;
+	const tenantId = auth
+		? tenantIdFromAuthoritativeAuthClaims(auth)
+		: undefined;
 
 	return tenantId ? createTenant(tenantId) : undefined;
 }
@@ -614,7 +616,12 @@ export function resolveServiceTenant(
 	return normalizedTenantId ? createTenant(normalizedTenantId) : undefined;
 }
 
-function tenantIdFromAuth(auth: AuthSession) {
+/**
+ * Resolve only provider-issued claims that the application treats as
+ * authoritative. Multi-tenant apps must replace this starter seam with a
+ * membership-backed lookup before authorizing tenant-owned resources.
+ */
+function tenantIdFromAuthoritativeAuthClaims(auth: AuthSession) {
 	return (
 		stringProperty(auth.session, "tenantId") ??
 		stringProperty(auth.session, "organizationId") ??

package/src/templates/shadcn.ts

@@ -186,7 +186,9 @@ const appGlobalsCss = `@import "tailwindcss";
 }
 `;
 
-const uiButton = `import { cva, type VariantProps } from "class-variance-authority";
+const uiButton = `"use client";
+
+import { cva, type VariantProps } from "class-variance-authority";
 import { Slot } from "radix-ui";
 import type * as React from "react";