@beignet/cli 0.0.47 → 0.0.49

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @beignet/cli
 
+## 0.0.49
+
+### Patch Changes
+
+- e597d53: Require Node.js 22.12 or newer across every Beignet package, generated app,
+  and documented workflow.
+- 3049831: Prevent outbox job registries from silently running without a dispatcher by
+  wiring generated jobs, reporting incomplete app-port configuration, and
+  validating delivery transports before claiming messages. Jobs provider presets
+  replace only the marked generated inline fallback.
+- ea4bcf7: Inspect TypeScript module references structurally in architecture lint,
+  including require/import variants, transitive feature helpers, configured path
+  layouts, and exhaustive feature layer classification.
+- ac46aad: Inspect contracts through import-backed TypeScript syntax and local fluent-builder aliases, align lint and doctor placement diagnostics, and reject non-app roots before `beignet check` runs validation.
+- a06c5b9: Require contracts with query schemas to declare an explicit transport shared by typed clients, servers, and OpenAPI generation. Add deterministic scalar, repeated-array, and flat deep-object transports, migrate CLI generators, and diagnose legacy one-argument query declarations.
+- e597d53: Migrate the Beignet MCP server to the stable TypeScript SDK v2 packages while
+  preserving stdio transport and protocol compatibility.
+- 8c0b355: Isolate and safely frame default rate-limit buckets, fail closed for unresolved user scopes, escape Swagger script data, and require an explicit access policy for devtools routes.
+- b2188d8: Align provider production behavior by validating cache TTLs consistently,
+  requiring encrypted SMTP transport by default, and streaming unknown-size S3
+  uploads through bounded managed multipart uploads with explicit cleanup across
+  all failure stages.
+
+  The S3 provider now requires `@aws-sdk/lib-storage`; the Beignet provider
+  preset installs the compatible version automatically.
+
+- Updated dependencies [e597d53]
+- Updated dependencies [3049831]
+- Updated dependencies [60edd56]
+- Updated dependencies [a06c5b9]
+- Updated dependencies [8c0b355]
+- Updated dependencies [b2188d8]
+  - @beignet/core@0.0.49
+
+## 0.0.48
+
+### Patch Changes
+
+- 728c942: Add read-only migration status reports, connected validation, stable generated migration hashes, preflight pending detection, generated Drizzle status scripts, and serialized deployment guidance.
+- 2391a09: Harden provider failure semantics with isolated asynchronous instrumentation,
+  level-aware Pino metadata redaction and owned-transport shutdown, bounded
+  Upstash timeout policy and readiness, and validated Vercel Blob token/OIDC
+  credential alternatives.
+- Updated dependencies [2391a09]
+  - @beignet/core@0.0.48
+
 ## 0.0.47
 
 ### Patch Changes

package/README.md

@@ -6,6 +6,9 @@
 
 Command-line tools for creating and maintaining Beignet apps.
 
+Beignet requires Node.js 22.12 or newer. Bun 1.3.14 or newer is supported for
+CLI commands.
+
 The package ships a single `beignet` bin. Generated apps install
 `@beignet/cli` as a dev dependency and add a `beignet` package script, so the
 day-to-day form inside an app is:
@@ -148,6 +151,7 @@ cd my-app
 bun install
 cp .env.example .env.local
 bun beignet db migrate
+bun beignet db status
 bun run dev
 ```
 
@@ -179,6 +183,7 @@ bun beignet doctor
 bun beignet make feature projects
 bun beignet db generate
 bun beignet db migrate
+bun beignet db status
 bun run test
 bun run lint
 bun run typecheck
@@ -221,13 +226,15 @@ beignet make test <feature.action> [options] [--cwd <dir>]
 beignet make use-case <feature.action> [options] [--cwd <dir>]
 beignet db generate [--dry-run] [--json] [--cwd <dir>]
 beignet db migrate [--dry-run] [--json] [--cwd <dir>]
+beignet db status [--json] [--cwd <dir>]
 beignet db seed [--dry-run] [--json] [--cwd <dir>]
 beignet db reset [--dry-run] [--json] [--cwd <dir>]
 beignet db schema sync [--dialect sqlite|postgres|mysql] [--tables audit,idempotency,outbox] [--output <path>] [--dry-run] [--json] [--cwd <dir>]
 beignet routes [--json] [--cwd <dir>]
 beignet map [--json] [--feature <name>] [--kind <kinds>] [--cwd <dir>]
 beignet explain <kind> <target> [--json] [--cwd <dir>]
-beignet check [--json] [--fix] [--preflight] [--cwd <dir>]
+beignet check [--json] [--fix] [--preflight] [--preflight-connect] [--connect-timeout-ms <ms>] [--cwd <dir>]
+beignet preflight [--connect] [--connect-timeout-ms <ms>] [--json] [--cwd <dir>]
 beignet lint [--json] [--cwd <dir>] [--format human|json|github]
 beignet doctor [--json] [--strict] [--fix] [--dry-run] [--plan <id>] [--only <operation-ids>] [--cwd <dir>] [--format human|json|github]
 beignet provider add <preset> [--dry-run] [--json] [--cwd <dir>]
@@ -248,6 +255,8 @@ Options:
   --dry-run                   Preview create/make writes without changing files.
   --json                      Print machine-readable output.
   --cwd path/to/app           Run an existing-app command against another app directory.
+  --preflight-connect         Add connected migration and dependency checks.
+  --connect-timeout-ms 5000   Override the connected preflight per-check timeout.
   --format github             Output format for lint and doctor: human, json, or github.
   --input '{"dryRun":true}'   JSON input for `beignet task run`.
   --tenant acme               Tenant id or slug passed to the app's createTaskContext by `beignet task run`, separate from task input.
@@ -356,7 +365,13 @@ server/routes.ts
 generated route tests pass the same value to `createTestApp(...)`.
 
 Route inspection supports contract-group definitions and direct
-`defineContract({ method, path })` exports.
+`defineContract({ method, path })` exports. It reads exported declarations and
+fluent contract calls from TypeScript syntax, so nested objects, comments, and
+multiline expressions do not truncate a contract before its method or path.
+Local fluent-builder aliases and named local exports are followed. Factories
+must be value imports from `@beignet/core/contracts`; named aliases and
+namespace imports work, while same-named methods on unrelated objects are
+ignored.
 
 The standard app layout includes the files feature generators expect:
 
@@ -682,7 +697,9 @@ starter, tests, and feature-specific not-found and conflict catalog errors. Use
 resource.
 
 Generated list routes use cursor pagination with `limit`, `cursor`, `name`,
-`sortBy`, and `sortDirection` query parameters. The generated use case
+`sortBy`, and `sortDirection` query parameters. Their contract pairs the query
+schema with an explicit transport so the client, server, and OpenAPI document
+use the same URL representation. The generated use case
 normalizes cursor pages, validates opaque base64url cursors against the selected
 sort, and passes one repository query object into memory and Drizzle adapters.
 Adapters filter `name` with case-insensitive contains matching, sort only by
@@ -781,6 +798,20 @@ and `make job` create that outbox path on first use and register the feature's
 `beignet doctor` reports events and jobs the registry cannot deliver. Keep the
 route as the durable recovery sweep even when the deferred trigger is present.
 
+`make job` also ensures `jobs: JobDispatcherPort` is declared and bound. When
+the app has no job dispatcher yet, it defers the port and installs an app-owned
+inline dispatcher provider; existing direct wiring and providers such as
+Inngest are preserved. Registry membership alone is not execution wiring.
+Adding the `jobs-inngest` or `jobs-bullmq` preset later replaces only that
+marked generated fallback; an unmarked app-owned inline provider is reported
+as a conflict instead of being removed.
+`beignet doctor` warns when an outbox registry contains jobs but the configured
+ports and port-wiring files do not declare and bind or defer `jobs`. Keep that
+key and the registry's `jobs` entries explicit; doctor reports indeterminate
+registry or port-wiring shapes when they prevent it from verifying required
+wiring, and the generator stops rather than replacing custom spread- or
+helper-based wiring it cannot verify.
+
 Generators wire the provider-backed ports their output depends on. `make
 event` (and `make resource --events`) wires `eventBus: EventBusPort` with
 `createMemoryEventBusProvider()` from
@@ -834,6 +865,8 @@ The runner loads `server/outbox.ts` or `paths.outbox`. That module should export
 `stopOutboxDrainContext(...)`. The context owns app ports and provider
 lifecycle, so the CLI drain uses the same outbox, event bus, jobs,
 instrumentation, actor, and tenant decisions as the scheduled drain route.
+The drain validates all transports required by the registry before claiming a
+batch, so missing `eventBus` or `jobs` wiring does not consume attempts.
 
 Inspect and recover failed deliveries through the same app-owned operational
 context:
@@ -915,15 +948,17 @@ stable framework command surface:
 ```bash
 beignet db generate
 beignet db migrate
+beignet db status
 beignet db seed
 beignet db reset
 ```
 
 The CLI delegates to app-owned package scripts named `db:generate`,
-`db:migrate`, `db:seed`, and `db:reset`. In standard Drizzle apps, those scripts
-run Drizzle Kit and the generated `server/seed.ts` / `infra/db/reset.ts`
-entrypoints. This keeps schema generation and migration behavior Drizzle-native
-while making the lifecycle discoverable through Beignet.
+`db:migrate`, `db:status`, `db:seed`, and `db:reset`. In standard Drizzle apps,
+those scripts run Drizzle Kit and the generated status, seed, and reset
+entrypoints. Status is read-only: exit 0 means current, exit 2 means pending,
+and any other non-zero exit means inspection failed. This keeps database
+behavior app-owned while making the lifecycle discoverable through Beignet.
 
 When an app adopts Beignet's Drizzle-backed operational ports for audit,
 idempotency, or outbox, run `beignet db schema sync` first. It idempotently
@@ -934,7 +969,7 @@ Drizzle Kit script creates the matching migration.
 
 `beignet db` checks standard prerequisites before running those scripts. If the
 script is missing, Drizzle Kit has no `drizzle.config.*`, or the standard
-seed/reset entrypoint was removed, the error points to the exact file or
+status/seed/reset entrypoint was removed, the error points to the exact file or
 package script to restore.
 
 `beignet db <command> --json` retains the final 64 KiB from each output stream
@@ -957,6 +992,8 @@ Call `db_schema_sync` with `{ dialect?, tables?, output?, dryRun? }` for the
 same report as `beignet db schema sync --json`. For lifecycle commands,
 `dryRun` validates prerequisites and reports the app-owned script without
 executing it; it does not simulate the script's SQL or data changes.
+Call the separate read-only `db_status` tool with `{ timeoutMs? }` for the same
+report as `beignet db status --json`.
 
 Generate feature-owned test factories and local/demo seeds with:
 
@@ -1022,11 +1059,12 @@ every edge carries source evidence and confidence.
 
 The JSON app map retains failed local module references as explicit
 `local_import_unresolved` entries instead of silently omitting their edges. It
-also reports `contract_declaration_unresolved` when it finds an exported direct
-`defineContract(...)` declaration whose method or path cannot be derived
-statically. Registration diagnostics identify their declaration through a
-structured `subject.file` and `subject.exportName`; registration status in the
-map uses that identity rather than matching human-readable messages.
+also reports `contract_declaration_unresolved` when an exported direct or
+contract-group declaration has a method, path, or group prefix that cannot be
+derived statically. Registration diagnostics identify their declaration
+through a structured `subject.file` and `subject.exportName`; registration
+status in the map uses that identity rather than matching human-readable
+messages.
 
 `--feature` keeps that feature plus its direct relationships, while `--kind`
 accepts one or a comma-separated list of node kinds. These projections make
@@ -1080,13 +1118,20 @@ in that order. Every step runs even when an earlier one fails, so a single
 run reports everything that needs fixing; the command exits non-zero when any
 step fails. Missing package scripts are reported as skipped, never as
 failures. Failed package-script output retains at most the last 64 KiB of each
-stream.
+stream. The target package must declare `@beignet/core`, `@beignet/next`, or
+`@beignet/web` as a runtime dependency. The root must also contain
+`app-context.ts` or `beignet.config.*`; a canonical app with both `features/`
+and `server/index.ts` is accepted when `app-context.ts` is missing so doctor
+can report the drift. Other package roots stop before lint, doctor, or app
+scripts run.
 
 Use `beignet check --fix` to apply doctor's eligible low-risk fixes
 before checking, and `beignet check --json` for a versioned payload
 (`schemaVersion: 1`) with the step list, statuses, captured failure output,
-and applied fixes. Add `--preflight` to run the runtime environment gate after
-strict doctor. The individual commands below still work when you need one
+and applied fixes. Add `--preflight` to run the disconnected runtime
+environment gate after strict doctor. Use `--preflight-connect` when the same
+check should also inspect migration status and dependency health; it implies
+`--preflight`. The individual commands below still work when you need one
 check alone or its `--format github` output.
 
 ## Gate the deploy environment
@@ -1095,17 +1140,27 @@ check alone or its `--format github` output.
 beignet preflight
 beignet preflight --connect
 beignet check --preflight
+beignet check --preflight-connect
 ```
 
 `preflight` is the runtime production gate, distinct from the static `doctor`
 checks: it reads the environment the process actually runs with. It verifies
-every env var installed provider manifests mark as required, flags values
+every individually required provider env var and accepts mutually exclusive
+credentials only when one complete `requiredEnvAlternatives` configuration is
+present. Variant packages are scoped to the factories registered in the app,
+so inactive variants do not demand credentials. Preflight also flags values
 still matching `.env.example` (or common placeholder patterns) on secret-like
 keys, validates the app env schema by importing `lib/env.ts`, folds in
 `doctor`'s production hardening diagnostics with promoted severities, and
-warns when logging or error reporting is absent or inert. `--connect` boots
-the app server and runs every port's `checkHealth()` — opt-in because it
-needs network access and real credentials. `--env-file` merges a dotenv-style
+warns when logging or error reporting is absent or inert. `--connect` first
+runs the app-owned `db:status` script when available, failing before server
+boot on pending migrations or inspection failure, then runs every port's
+`checkHealth()`. Older apps without the script receive a compatibility note.
+The flag is opt-in because it needs network access and real credentials.
+Use `--connect-timeout-ms <ms>` to change the default 5000 ms limit for
+migration status and each dependency health check. Timeout findings include
+the configured duration, and bounded status output says when only the retained
+tail is shown. `--env-file` merges a dotenv-style
 file under the environment for local rehearsal, `--env-module` and
 `--server-module` override the default `lib/env.ts` and `server/index.ts`
 paths, and `--json` emits machine-readable output with `schemaVersion: 1`.
@@ -1126,14 +1181,30 @@ Run `lint` when you want the CLI to enforce Beignet dependency direction:
 beignet lint
 ```
 
-The command scans static imports and fails when app layers reach into runtime
-or framework layers. It catches domain, use case, workflow, policy, port,
-contract, route, infra, and component files importing things like `infra/`, UI
-components, route handlers, server modules, client modules, provider packages,
-Next.js, React, or database vendors in the wrong direction. It also catches
-feature-specific domain files importing another feature's domain unless the
-target is `features/shared/domain`. Workflow folders include feature-owned
-jobs, listeners, notifications, schedules, and uploads.
+The command recognizes TypeScript imports and re-exports, `require()`, import
+assignments, and literal dynamic imports. It fails when app layers reach into
+runtime or framework layers, including domain, use case, workflow, policy,
+port, contract, route, schema, seed, agent capability, feature helper, infra,
+and component files importing `infra/`, UI components, route handlers, server
+modules, client modules, provider packages, Next.js, React, or database vendors
+in the wrong direction. Computed `require()` and `import()` expressions inside
+constrained layers fail because lint cannot verify their destination; use a
+string-literal specifier or move runtime loading behind an allowed boundary.
+Client-safe graphs reject Node built-ins whether they use `node:fs` or a bare
+specifier such as `fs/promises`.
+
+Local value-import checks follow feature-root and other local helpers.
+For example, `use-case -> history.ts -> infra` reports the complete chain
+instead of treating `history.ts` as an unknown layer. Every module inside the
+configured feature root is classified; allowed feature-root helpers remain
+helpers, while near-miss canonical names such as `usecases/` report the
+expected `use-cases/` path. Feature-specific domain files still cannot import
+another feature's domain unless the target is `features/shared/domain`.
+Workflow folders include feature-owned jobs, listeners, notifications,
+schedules, tasks, and uploads. Agent capabilities may adapt use cases but core
+application layers cannot depend back on those adapters. Seeds may compose
+factories and app ports, but not concrete infra, providers, UI, or runtime
+composition.
 
 Local imports are resolved with the app's complete `tsconfig.json`
 configuration before dependency direction is classified. That includes
@@ -1141,10 +1212,10 @@ configuration before dependency direction is classified. That includes
 with multiple targets. The CLI uses TypeScript's config parser and resolver, so
 JSON comments and extended tsconfigs follow the same rules as the compiler.
 
-Import diagnostics include 1-based `line` and `column` positions. Human
-output prints clickable `file.ts:12:3` locations; runtime-boundary
-diagnostics report the chain root file and the full import chain in the
-message instead.
+Import diagnostics include 1-based `line` and `column` positions and preserve
+separate occurrences of the same module specifier. Human output prints
+clickable `file.ts:12:3` locations; transitive and runtime-boundary diagnostics
+report the chain root file and the full import chain in the message instead.
 
 Use JSON output in CI or custom scripts, or GitHub annotations in workflows:
 
@@ -1164,11 +1235,14 @@ beignet doctor
 Today it detects:
 
 - Contracts without a matching Next.js route handler
+- Contract query schemas without an explicit second `.query(...)` transport
 - Feature route groups that are not registered in the central route list
 - Feature schedules and tasks that are not registered in `server/schedules.ts`
   or `server/tasks.ts`
 - Feature events with listeners, and feature jobs, that are missing from
   `defineOutboxRegistry({...})` when the app uses outbox delivery
+- Outbox registries with jobs but no declared and bound or deferred `jobs`
+  application port
 - Feature listeners missing from `server/listeners.ts` or otherwise not
   referenced by `registerListeners(...)`
 - Opted-in runtime manifests that omit generated workflow registries
@@ -1186,6 +1260,9 @@ Today it detects:
   `features/shared/errors.ts`
 - Feature runtime `appError(...)` calls that are not declared on the feature's
   contracts
+- Feature layers whose normalized name or known alias points at a canonical
+  location, such as `usecases/` instead of `use-cases/` or `events/` instead
+  of `domain/events/`; doctor and lint report the same expected path
 - Authorization metadata whose ability is missing from feature policy coverage
 - Audit-required metadata without feature audit writes or test assertions
 - Mixed `@beignet/*` version ranges in package.json, and mixed installed
@@ -1202,7 +1279,7 @@ Today it detects:
 - Generated ports without test fakes
 - Drizzle repository adapters that are not wired through `infra/db/repositories.ts`
 - Repository ports whose infra folder has no repository adapter
-- Missing Drizzle config, schema index exports, database scripts, or standard seed/reset entrypoints
+- Missing Drizzle config, schema index exports, database scripts, or standard status/seed/reset entrypoints
 - Drizzle-backed idempotency, outbox, or audit ports without matching table
   setup in schema files, configured schema sources, migrations, provider setup
   statements, or app database setup files
@@ -1225,7 +1302,7 @@ Today it detects:
 - Billing entitlement modules that are not wired into infra or server providers
 - Stripe payments configuration paired with local memory payments provider
   wiring
-- Devtools routes that are explicitly enabled without authorization
+- Devtools routes without authorization or an explicit local-only development opt-in
 - Cron routes that do not use `CRON_SECRET`
 - Installed provider packages without expected environment configuration
 - Better Auth providers without an auth route or trusted-origin configuration
@@ -1261,8 +1338,10 @@ provider packages installed in an app. The human audit prints provider
 metadata validity, registration status, required env, required tables, and
 declared app ports. `beignet provider audit --json` returns a versioned
 `schemaVersion: 1` payload with active variants, watchers, and source locations
-for matching provider-registry entries. The command does not fail CI for missing setup; stable,
-actionable findings belong in `doctor`.
+for matching provider-registry entries. Missing alternative credential paths
+remain grouped in human diagnostics, while JSON preserves each active
+variant's accepted configurations and status. The command does not fail CI for
+missing setup; stable, actionable findings belong in `doctor`.
 
 Use `beignet doctor --strict` for CI-oriented checks that may be noisy locally,
 such as missing generated feature tests, canonical app conformance drift, and
@@ -1295,8 +1374,9 @@ event-bus wiring. Database repair requires an existing schema index, default
 Beignet table names, a missing `beignet.ts` or one that still matches
 `beignet db schema sync` output, and a schema index where the generated
 `export *` can be safely added or retained. It does not generate or apply a
-migration. Run `beignet db generate` and `beignet db migrate` after accepting
-that source change. Compatible workflow repairs that share files are combined
+migration. Run `beignet db generate`, `beignet db migrate`, and
+`beignet db status` after accepting that source change. Compatible workflow
+repairs that share files are combined
 into the selectable `workflows.register-missing` operation so apply-all remains
 atomic.
 
@@ -1346,12 +1426,16 @@ Tools:
   suggested files, and follow-up commands (read-only)
 - `check` - run the complete validation loop and return versioned step
   results, bounded failure output, durations, and overall `ok`; accepts
-  `{ preflight?: boolean, timeoutMs?: number }`, cancels the active script with
-  the MCP request, and does not apply Beignet fixes. App scripts retain their
-  normal side effects, so this is an execution tool rather than a read-only tool
+  `{ preflight?: boolean, preflightConnect?: boolean, connectTimeoutMs?: number, timeoutMs?: number }`,
+  cancels the active script with the MCP request, and does not apply Beignet
+  fixes. `preflightConnect` implies preflight and adds migration and dependency
+  checks. App scripts retain their normal side effects, so this is an
+  execution tool rather than a read-only tool
 - `db` - run `generate`, `migrate`, `seed`, or `reset` with
   `{ command, dryRun?, timeoutMs? }`; returns the matching versioned CLI report
   with bounded output, request cancellation, and a command timeout
+- `db_status` - inspect the app-owned migration history without mutating the
+  database; returns `current`, `pending`, or `failed`
 - `db_schema_sync` - sync app-owned Beignet provider-table schema re-exports
   with `{ dialect?, tables?, output?, dryRun? }`; idempotent but writes source
   unless `dryRun` is true
@@ -1377,7 +1461,7 @@ Tools:
   artifact kinds as `beignet make`
 - `provider_add` - add a provider setup preset with `{ preset, dryRun? }`
 
-The `db`, `db_schema_sync`, `task_run`, `schedule_run`, `outbox_inspect`,
+The `db`, `db_status`, `db_schema_sync`, `task_run`, `schedule_run`, `outbox_inspect`,
 `outbox_run`, `doctor_fix_plan`, and `doctor_fix` tool outputs match the
 corresponding CLI/library JSON payloads. Operational app code runs outside the
 long-lived MCP server with bounded structured results, request cancellation,

package/dist/analysis/contract-factories.d.ts

@@ -0,0 +1,17 @@
+import ts from "typescript";
+export type ContractFactoryName = "defineContract" | "defineContractGroup";
+export type ContractFactoryBindings = {
+    localNames: Record<ContractFactoryName, Set<string>>;
+    namespaceNames: Set<string>;
+};
+export type ContractBindingNames = {
+    contracts: Set<string>;
+    groups: Set<string>;
+};
+export declare function contractFactoryBindings(sourceFile: ts.SourceFile): ContractFactoryBindings;
+export declare function isImportedContractFactoryCall(call: ts.CallExpression, name: ContractFactoryName, bindings: ContractFactoryBindings): boolean;
+/** Follow imported factories through local group and contract builder aliases. */
+export declare function contractBindingNames(sourceFile: ts.SourceFile, bindings: ContractFactoryBindings): ContractBindingNames;
+/** Determine whether an expression declares a direct or group-built contract. */
+export declare function isImportedContractDeclaration(expression: ts.Expression, bindings: ContractFactoryBindings, names: ContractBindingNames): boolean;
+//# sourceMappingURL=contract-factories.d.ts.map

package/dist/analysis/contract-factories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-factories.d.ts","sourceRoot":"","sources":["../../src/analysis/contract-factories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAI5B,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE3E,MAAM,MAAM,uBAAuB,GAAG;IACpC,UAAU,EAAE,MAAM,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACrB,CAAC;AAkCF,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,EAAE,CAAC,UAAU,GACxB,uBAAuB,CAoCzB;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,EAAE,CAAC,cAAc,EACvB,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAaT;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,QAAQ,EAAE,uBAAuB,GAChC,oBAAoB,CAiDtB;AAED,iFAAiF;AACjF,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,QAAQ,EAAE,uBAAuB,EACjC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAaT"}

package/dist/analysis/contract-factories.js

@@ -0,0 +1,176 @@
+import ts from "typescript";
+const contractFactoryModule = "@beignet/core/contracts";
+const contractGroupMethods = new Set([
+    "defineContractGroup",
+    "deprecated",
+    "errors",
+    "headers",
+    "meta",
+    "namespace",
+    "prefix",
+    "responses",
+]);
+const httpContractMethods = new Set([
+    "delete",
+    "get",
+    "head",
+    "options",
+    "patch",
+    "post",
+    "put",
+]);
+export function contractFactoryBindings(sourceFile) {
+    const bindings = {
+        localNames: {
+            defineContract: new Set(),
+            defineContractGroup: new Set(),
+        },
+        namespaceNames: new Set(),
+    };
+    for (const statement of sourceFile.statements) {
+        if (!ts.isImportDeclaration(statement) ||
+            !ts.isStringLiteral(statement.moduleSpecifier) ||
+            statement.moduleSpecifier.text !== contractFactoryModule ||
+            !statement.importClause ||
+            statement.importClause.isTypeOnly) {
+            continue;
+        }
+        const namedBindings = statement.importClause.namedBindings;
+        if (namedBindings && ts.isNamespaceImport(namedBindings)) {
+            bindings.namespaceNames.add(namedBindings.name.text);
+            continue;
+        }
+        if (!namedBindings || !ts.isNamedImports(namedBindings))
+            continue;
+        for (const element of namedBindings.elements) {
+            if (element.isTypeOnly)
+                continue;
+            const importedName = (element.propertyName ?? element.name).text;
+            if (!isContractFactoryName(importedName))
+                continue;
+            bindings.localNames[importedName].add(element.name.text);
+        }
+    }
+    return bindings;
+}
+export function isImportedContractFactoryCall(call, name, bindings) {
+    const callee = unwrapExpression(call.expression);
+    if (ts.isIdentifier(callee)) {
+        return bindings.localNames[name].has(callee.text);
+    }
+    if (!ts.isPropertyAccessExpression(callee) || callee.name.text !== name) {
+        return false;
+    }
+    const receiver = unwrapExpression(callee.expression);
+    return (ts.isIdentifier(receiver) && bindings.namespaceNames.has(receiver.text));
+}
+/** Follow imported factories through local group and contract builder aliases. */
+export function contractBindingNames(sourceFile, bindings) {
+    const declarations = sourceFile.statements
+        .filter(ts.isVariableStatement)
+        .flatMap((statement) => [...statement.declarationList.declarations]);
+    const names = {
+        contracts: new Set(),
+        groups: new Set(),
+    };
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const declaration of declarations) {
+            if (!ts.isIdentifier(declaration.name) ||
+                !declaration.initializer ||
+                names.contracts.has(declaration.name.text) ||
+                names.groups.has(declaration.name.text)) {
+                continue;
+            }
+            const chain = contractCallChain(declaration.initializer);
+            if (!chain)
+                continue;
+            if (contractFactoryCall(chain, "defineContract", bindings) ||
+                (chain.baseIdentifier && names.contracts.has(chain.baseIdentifier))) {
+                names.contracts.add(declaration.name.text);
+                changed = true;
+                continue;
+            }
+            if (!isContractGroupDerived(chain, bindings, names.groups))
+                continue;
+            if (chain.calls.some((call) => httpContractMethods.has(call.name))) {
+                names.contracts.add(declaration.name.text);
+                changed = true;
+                continue;
+            }
+            if (chain.calls.some((call) => !contractGroupMethods.has(call.name))) {
+                continue;
+            }
+            names.groups.add(declaration.name.text);
+            changed = true;
+        }
+    }
+    return names;
+}
+/** Determine whether an expression declares a direct or group-built contract. */
+export function isImportedContractDeclaration(expression, bindings, names) {
+    const chain = contractCallChain(expression);
+    if (!chain)
+        return false;
+    if (contractFactoryCall(chain, "defineContract", bindings) ||
+        (chain.baseIdentifier && names.contracts.has(chain.baseIdentifier))) {
+        return true;
+    }
+    return (isContractGroupDerived(chain, bindings, names.groups) &&
+        chain.calls.some((call) => httpContractMethods.has(call.name)));
+}
+function isContractGroupDerived(chain, bindings, groupNames) {
+    return Boolean(contractFactoryCall(chain, "defineContractGroup", bindings) ||
+        (chain.baseIdentifier && groupNames.has(chain.baseIdentifier)));
+}
+function contractFactoryCall(chain, name, bindings) {
+    const calls = chain.rootCall ? [chain.rootCall, ...chain.calls] : chain.calls;
+    return calls.find((call) => isImportedContractFactoryCall(call.node, name, bindings));
+}
+function contractCallChain(rawExpression) {
+    const calls = [];
+    let expression = rawExpression;
+    while (true) {
+        expression = unwrapExpression(expression);
+        if (ts.isPropertyAccessExpression(expression)) {
+            expression = expression.expression;
+            continue;
+        }
+        if (ts.isCallExpression(expression)) {
+            const callee = unwrapExpression(expression.expression);
+            if (ts.isPropertyAccessExpression(callee)) {
+                calls.unshift({ name: callee.name.text, node: expression });
+                expression = callee.expression;
+                continue;
+            }
+            if (ts.isIdentifier(callee)) {
+                return {
+                    baseIdentifier: callee.text,
+                    rootCall: { name: callee.text, node: expression },
+                    calls,
+                };
+            }
+            return undefined;
+        }
+        if (ts.isIdentifier(expression)) {
+            return { baseIdentifier: expression.text, calls };
+        }
+        return undefined;
+    }
+}
+function isContractFactoryName(value) {
+    return value === "defineContract" || value === "defineContractGroup";
+}
+function unwrapExpression(expression) {
+    let current = expression;
+    while (ts.isParenthesizedExpression(current) ||
+        ts.isAsExpression(current) ||
+        ts.isTypeAssertionExpression(current) ||
+        ts.isNonNullExpression(current) ||
+        ts.isSatisfiesExpression(current)) {
+        current = current.expression;
+    }
+    return current;
+}
+//# sourceMappingURL=contract-factories.js.map

package/dist/analysis/contract-factories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-factories.js","sourceRoot":"","sources":["../../src/analysis/contract-factories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAyBxD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,qBAAqB;IACrB,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,MAAM;IACN,WAAW;IACX,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ;IACR,KAAK;IACL,MAAM;IACN,SAAS;IACT,OAAO;IACP,MAAM;IACN,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,UAAyB;IAEzB,MAAM,QAAQ,GAA4B;QACxC,UAAU,EAAE;YACV,cAAc,EAAE,IAAI,GAAG,EAAE;YACzB,mBAAmB,EAAE,IAAI,GAAG,EAAE;SAC/B;QACD,cAAc,EAAE,IAAI,GAAG,EAAE;KAC1B,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9C,IACE,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC;YAClC,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,eAAe,CAAC;YAC9C,SAAS,CAAC,eAAe,CAAC,IAAI,KAAK,qBAAqB;YACxD,CAAC,SAAS,CAAC,YAAY;YACvB,SAAS,CAAC,YAAY,CAAC,UAAU,EACjC,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAG,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC;QAC3D,IAAI,aAAa,IAAI,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC;YAAE,SAAS;QAElE,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,UAAU;gBAAE,SAAS;YACjC,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YACjE,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC;gBAAE,SAAS;YACnD,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAAuB,EACvB,IAAyB,EACzB,QAAiC;IAEjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO,CACL,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAClC,UAAyB,EACzB,QAAiC;IAEjC,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU;SACvC,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC;SAC9B,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAyB;QAClC,SAAS,EAAE,IAAI,GAAG,EAAE;QACpB,MAAM,EAAE,IAAI,GAAG,EAAE;KAClB,CAAC;IAEF,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,IACE,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC;gBAClC,CAAC,WAAW,CAAC,WAAW;gBACxB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EACvC,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,IACE,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,CAAC;gBACtD,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EACnE,CAAC;gBACD,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3C,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS;YACX,CAAC;YAED,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;gBAAE,SAAS;YACrE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3C,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,6BAA6B,CAC3C,UAAyB,EACzB,QAAiC,EACjC,KAA2B;IAE3B,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IACE,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,CAAC;QACtD,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,sBAAsB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;QACrD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAwB,EACxB,QAAiC,EACjC,UAA+B;IAE/B,OAAO,OAAO,CACZ,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,EAAE,QAAQ,CAAC;QACzD,CAAC,KAAK,CAAC,cAAc,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAwB,EACxB,IAAyB,EACzB,QAAiC;IAEjC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACzB,6BAA6B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,aAA4B;IAE5B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,UAAU,GAAG,aAAa,CAAC;IAE/B,OAAO,IAAI,EAAE,CAAC;QACZ,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC5D,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO;oBACL,cAAc,EAAE,MAAM,CAAC,IAAI;oBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE;oBACjD,KAAK;iBACN,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,KAAK,KAAK,gBAAgB,IAAI,KAAK,KAAK,qBAAqB,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAyB;IACjD,IAAI,OAAO,GAAG,UAAU,CAAC;IACzB,OACE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;QACrC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;QAC1B,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;QACrC,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAC/B,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,EACjC,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/analysis/layers.d.ts

@@ -0,0 +1,5 @@
+import { type ResolvedBeignetConfig } from "../config.js";
+export type SourceLayer = "app" | "app-context" | "agent-capability" | "client" | "component" | "contract" | "domain" | "feature-helper" | "feature-port" | "infra" | "lib" | "policy" | "port" | "route" | "schema" | "seed" | "server" | "test" | "use-case" | "workflow" | "unknown";
+export declare function classifySourcePath(filePath: string, config: ResolvedBeignetConfig): SourceLayer;
+export declare function canonicalFeatureLayerPath(filePath: string, config: ResolvedBeignetConfig): string | undefined;
+//# sourceMappingURL=layers.d.ts.map

package/dist/analysis/layers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layers.d.ts","sourceRoot":"","sources":["../../src/analysis/layers.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,WAAW,GACnB,KAAK,GACL,aAAa,GACb,kBAAkB,GAClB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,QAAQ,GACR,gBAAgB,GAChB,cAAc,GACd,OAAO,GACP,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,UAAU,GACV,UAAU,GACV,SAAS,CAAC;AA6Cd,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,GAC5B,WAAW,CAuEb;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,GAC5B,MAAM,GAAG,SAAS,CAmCpB"}