@beignet/cli 0.0.45 → 0.0.47

package/src/make/tenancy.ts

@@ -3857,7 +3857,7 @@ export type AppServiceContextInput =
  */
 export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 \tgate: (ports) => ports.gate,
-\trequest: async ({ req, ports, requestId, trace }) => {
+\trequest: async ({ req, requestInfo, ports, requestId, trace }) => {
 \t\tconst auth = await ports.auth.getSession(req);
 \t\tconst { tenant, membership } = await resolveRequestWorkspace({
 \t\t\tauth,
@@ -3876,6 +3876,7 @@ export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 \t\t\t\t\t})
 \t\t\t\t: createAnonymousActor(),
 \t\t\tauth,
+\t\t\trequestInfo,
 \t\t\t...trace,
 \t\t\tports,
 \t\t\t...(tenant ? { tenant } : {}),

package/src/mcp.ts

@@ -995,7 +995,7 @@ export function buildBeignetMcpServer(options: McpServerOptions): McpServer {
     "doctor_fix_plan",
     {
       description:
-        "Plan every currently available low-risk doctor repair without changing files. Returns stable operation IDs, exact unified patches, file hashes, and a plan ID for guarded doctor_fix application.",
+        "Plan every currently available low-risk doctor repair without changing files, including eligible registration drift and managed default provider-table exports. Returns stable operation IDs, exact unified patches, file hashes, and a plan ID for guarded doctor_fix application.",
       inputSchema: {
         strict: z
           .boolean()
@@ -1021,7 +1021,7 @@ export function buildBeignetMcpServer(options: McpServerOptions): McpServer {
     "doctor_fix",
     {
       description:
-        "Apply low-risk doctor repairs, then re-check the app. With no planId, preserves the legacy apply-all behavior. Pass the planId returned by doctor_fix_plan for stale-file protection, optionally with fixIds to select repair operations.",
+        "Apply eligible low-risk doctor repairs, then re-check the app; custom or ambiguous code remains diagnostic-only. With no planId, preserves the legacy apply-all behavior. Pass the planId returned by doctor_fix_plan for stale-file protection, optionally with fixIds to select repair operations.",
       inputSchema: {
         strict: z
           .boolean()

package/src/templates/agents.ts

@@ -56,6 +56,10 @@ is a silent failure — the file exists but never runs:
   in \`server/outbox.ts\`.
 - Listeners must be added to the \`listeners\` array in \`server/listeners.ts\`
   and wired through a \`registerListeners(...)\` call in server provider wiring.
+- Apps using Inngest must also spread feature job registries into
+  \`inngestJobs\` in \`server/inngest.ts\`.
+- Apps using runtime integrity must list workflow registries in
+  \`defineRuntimeManifest({...})\`.
 
 The starter ships no workflow registries — generators create them on first
 use, so their absence is fine. \`${cli} make event\`, \`${cli} make job\`,
@@ -69,7 +73,14 @@ manual registry instruction in the error.
 with \`${cli} doctor --fix --dry-run\`, then apply the returned plan with
 \`${cli} doctor --fix --plan <plan-id>\` and optional
 \`--only <operation-ids>\`. Plain \`${cli} doctor --fix\` remains the
-apply-all shortcut.
+apply-all shortcut. Doctor can append fully unregistered artifacts to
+existing central, Inngest, and runtime-manifest arrays when their imports and
+array anchors are unambiguous. It also syncs missing default Beignet
+provider-table exports when \`infra/db/schema/beignet.ts\` is missing or still
+matches \`${cli} db schema sync\` output and the schema index has no custom
+named re-export for that file. Run \`${cli} db generate\` and
+\`${cli} db migrate\` after accepting that source repair. Custom or ambiguous
+code stays diagnostic-only.
 
 ## Prefer generators
 
@@ -96,6 +107,7 @@ apps have reimplemented by accident:
 | Ports outside a request — auth callbacks, module-level helpers | \`const { ports } = await getServer()\` (dynamic \`import("@/server")\` breaks module cycles). Do not construct parallel provider clients or fall back to \`console.*\` when \`ports.logger\` exists. |
 | Routes that cannot be contracts — webhooks, third-party callbacks, streaming | \`createWebhookRoute\`, \`createPaymentWebhookRoute\`, \`createScheduleRoute\`, \`createOutboxDrainRoute\` from \`@beignet/next\`; \`server.rawRoute(...)\` for anything else. All run the hooks pipeline — never hand-enforce rate limits in a route body. |
 | Rate limiting or idempotency on a route | Declare \`metadata.rateLimit\` / \`metadata.idempotency\` on the contract (or the \`pipeline\` option on raw routes); hooks enforce it. |
+| External URL, origin, host, protocol, or client IP behind a proxy | Configure one \`trustedProxy\` policy on the server and read its resolved \`requestInfo\` in the context factory or server hooks. Forwarding headers are untrusted by default; do not persist client IPs automatically. |
 | Tenant-owned repository access | Resolve the request tenant from membership-backed app state or provider claims the app explicitly treats as authoritative and current; never trust caller-supplied tenant IDs or unverified session fields. Pass \`TenantScope\` through app-facing repository methods and unwrap it with \`tenantScopeId(scope)\` in adapters. Raw provider-correlation lookups such as webhook customer IDs are not tenant authorization. |
 | Route-level tests that exercise real hooks | \`createTestApp\` / \`createTestRequester\` from \`@beignet/web/testing\`. Bind the rate-limit and idempotency ports in the test app when asserting 429s or replay. |
 | Environment configuration | \`lib/env.ts\` (\`createEnv\`), never ad-hoc \`process.env\` reads in app code. |
@@ -113,7 +125,7 @@ ${cli} check
 It runs \`${cli} lint\` (Beignet's dependency-direction lint),
 \`${cli} doctor --strict\`, and the app's \`lint\` (Biome), \`typecheck\`, and
 \`test\` scripts in one pass, reporting every failure. Add \`--fix\` to apply
-doctor's low-risk registration fixes first. Use \`${format}\` to apply
+doctor's eligible low-risk fixes first. Use \`${format}\` to apply
 formatting. The individual commands (\`${lint}\`, \`${cli} lint\`,
 \`${cli} doctor --strict\`, \`${test}\`, \`${typecheck}\`) still work when you
 need one check alone.

package/src/templates/server.ts

@@ -416,6 +416,7 @@ async function stopServerAndDatabase(server: {
 const files = {
   appContext: `import type { ActivityActor, ActivityTenant } from "@beignet/core/ports";
 import type { InferProviderPorts } from "@beignet/core/providers";
+import type { TrustedRequestInfo } from "@beignet/core/server";
 import type { TraceContext } from "@beignet/core/tracing";
 import type { AppGate, AppPorts } from "@/ports";
 import type { AuthSession } from "@/ports/auth";
@@ -432,6 +433,7 @@ export type AppContext = {
 	auth: AuthSession | null;
 	gate: AppGate;
 	ports: AppRuntimePorts;
+	requestInfo?: TrustedRequestInfo;
 	tenant?: ActivityTenant;
 } & Partial<TraceContext>;
 `,
@@ -552,7 +554,7 @@ export type AppServiceContextInput =
  */
 export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 	gate: (ports) => ports.gate,
-	request: async ({ req, ports, requestId, trace }) => {
+	request: async ({ req, requestInfo, ports, requestId, trace }) => {
 		const auth = await ports.auth.getSession(req);
 		const tenant = resolveRequestTenant({ auth });
 
@@ -562,6 +564,7 @@ export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 				? createUserActor(auth.user.id, { displayName: auth.user.name })
 				: createAnonymousActor(),
 			auth,
+			requestInfo,
 			...trace,
 			ports,
 			...(tenant ? { tenant } : {}),

package/src/templates/shared.ts

@@ -44,7 +44,7 @@ export const externalVersions = {
   tanstackReactQuery: "^5.100.7",
   hookformResolvers: "^5.0.0",
   reactHookForm: "^7.74.0",
-  betterAuth: "1.6.20",
+  betterAuth: "1.6.25",
   bullmq: "^5.0.0",
   drizzleKit: "^0.31.10",
   drizzleOrm: "^0.45.2",