@beignet/cli 0.0.51 → 0.0.53

package/src/lint.ts

@@ -3,15 +3,25 @@ import path from "node:path";
 import ts from "typescript";
 import {
   canonicalFeatureLayerPath,
-  classifySourcePath as classifyPath,
+  classifyWorkspaceSourcePath as classifyPath,
   type SourceLayer,
 } from "./analysis/layers.js";
+import {
+  isAnalysisSourceFile,
+  isAnalysisSourceFileExtension,
+  stripSourceFileExtension,
+} from "./analysis/source-files.js";
 import {
   type ModuleReference,
   moduleReferences,
 } from "./analysis/source-index.js";
 import {
+  type AnalysisWorkspace,
   createAnalysisWorkspace,
+  findProjectForFile,
+  projectForFile,
+  projectPath,
+  projectSource,
   resolveLocalModulePath,
 } from "./analysis/workspace.js";
 import { createPainter } from "./ansi.js";
@@ -77,12 +87,19 @@ export async function lintApp(
   const importGraph: ImportGraph = new Map();
 
   for (const file of sourceFiles) {
-    const sourceLayer = classifyPath(file, config);
+    const sourceLayer = classifyPath(file, workspace);
+    const source = projectSource(workspace, file);
     const sourceFile = await workspace.readSourceFile(file);
     sourceFileByPath.set(file, sourceFile);
     importGraph.set(file, await parseImports(workspace, file));
 
-    const canonicalLayerPath = canonicalFeatureLayerPath(file, config);
+    const localCanonicalPath = canonicalFeatureLayerPath(
+      source.file,
+      source.project.config,
+    );
+    const canonicalLayerPath = localCanonicalPath
+      ? projectPath(source.project, localCanonicalPath)
+      : undefined;
     if (canonicalLayerPath) {
       diagnostics.push({
         severity: "error",
@@ -95,10 +112,17 @@ export async function lintApp(
       });
     }
 
+    for (const reference of importGraph.get(file) ?? []) {
+      const issue = workspaceImportViolation(workspace, file, reference);
+      if (issue) diagnostics.push(issue);
+    }
     if (sourceLayer === "test" || sourceLayer === "unknown") continue;
 
-    if (isLegacySharedDomainPath(file, config)) {
-      const canonicalSharedDomain = sharedDomainPath(config);
+    if (isLegacySharedDomainPath(source.file, source.project.config)) {
+      const canonicalSharedDomain = projectPath(
+        source.project,
+        sharedDomainPath(source.project.config),
+      );
       diagnostics.push({
         severity: "error",
         code: "BEIGNET_CANONICAL_STRUCTURE",
@@ -115,7 +139,7 @@ export async function lintApp(
         lintUnresolvedModuleReference(file, sourceLayer, reference) ??
         (sourceLayer === "schema"
           ? undefined
-          : lintImport(file, sourceLayer, reference, config));
+          : lintImport(file, sourceLayer, reference, workspace));
       if (diagnostic) {
         diagnostics.push({
           ...diagnostic,
@@ -128,14 +152,14 @@ export async function lintApp(
 
   diagnostics.push(
     ...lintTransitiveBoundaries({
-      config,
+      workspace,
       graph: importGraph,
     }),
   );
 
   diagnostics.push(
     ...lintRuntimeBoundary({
-      config,
+      workspace,
       graph: importGraph,
       sourceFileByPath,
     }),
@@ -202,10 +226,7 @@ export function formatLintGithub(result: LintAppResult): string {
 }
 
 function lintSourceFiles(files: string[]): string[] {
-  return files.filter((file) => {
-    if (/\.d\.(c|m)?ts$/.test(file)) return false;
-    return /\.(c|m)?tsx?$/.test(file);
-  });
+  return files.filter(isAnalysisSourceFile);
 }
 
 async function parseImports(
@@ -237,22 +258,27 @@ function packageName(importPath: string): string {
 }
 
 function stripKnownExtension(filePath: string): string {
-  return filePath.replace(/\.(c|m)?tsx?$/, "");
+  return stripSourceFileExtension(filePath);
 }
 
 function lintImport(
   file: string,
   sourceLayer: SourceLayer,
   reference: ImportReference,
-  config: ResolvedBeignetConfig,
+  workspace: AnalysisWorkspace,
 ): LintDiagnostic | undefined {
   if (reference.kind === "type") return undefined;
 
   const targetLayer = reference.resolvedPath
-    ? classifyPath(reference.resolvedPath, config)
+    ? classifyPath(reference.resolvedPath, workspace)
     : undefined;
   const featureImport = reference.resolvedPath
-    ? featureImportViolation(file, sourceLayer, reference.resolvedPath, config)
+    ? featureImportViolation(
+        file,
+        sourceLayer,
+        reference.resolvedPath,
+        workspace,
+      )
     : undefined;
   if (featureImport) {
     return {
@@ -579,16 +605,16 @@ function matchBeignetProviderPackage(importPath: string): string | undefined {
 }
 
 function lintTransitiveBoundaries({
-  config,
+  workspace,
   graph,
 }: {
-  config: ResolvedBeignetConfig;
+  workspace: AnalysisWorkspace;
   graph: ImportGraph;
 }): LintDiagnostic[] {
   const diagnostics: LintDiagnostic[] = [];
 
   for (const root of graph.keys()) {
-    const rootLayer = classifyPath(root, config);
+    const rootLayer = classifyPath(root, workspace);
     if (
       ![
         "agent-capability",
@@ -608,7 +634,7 @@ function lintTransitiveBoundaries({
     }
 
     diagnostics.push(
-      ...lintTransitiveBoundaryRoot({ config, graph, root, rootLayer }),
+      ...lintTransitiveBoundaryRoot({ workspace, graph, root, rootLayer }),
     );
   }
 
@@ -616,12 +642,12 @@ function lintTransitiveBoundaries({
 }
 
 function lintTransitiveBoundaryRoot({
-  config,
+  workspace,
   graph,
   root,
   rootLayer,
 }: {
-  config: ResolvedBeignetConfig;
+  workspace: AnalysisWorkspace;
   graph: ImportGraph;
   root: string;
   rootLayer: SourceLayer;
@@ -648,7 +674,7 @@ function lintTransitiveBoundaryRoot({
         current.file === root
           ? undefined
           : (lintUnresolvedModuleReference(root, rootLayer, reference) ??
-            lintImport(root, rootLayer, reference, config));
+            lintImport(root, rootLayer, reference, workspace));
 
       if (violation) {
         diagnostics.push({
@@ -663,7 +689,7 @@ function lintTransitiveBoundaryRoot({
         reference.resolvedPath &&
         graph.has(reference.resolvedPath) &&
         isTransparentArchitectureLayer(
-          classifyPath(reference.resolvedPath, config),
+          classifyPath(reference.resolvedPath, workspace),
         )
       ) {
         queue.push({ file: reference.resolvedPath, chain });
@@ -679,11 +705,11 @@ function isTransparentArchitectureLayer(layer: SourceLayer): boolean {
 }
 
 function lintRuntimeBoundary({
-  config,
+  workspace,
   graph,
   sourceFileByPath,
 }: {
-  config: ResolvedBeignetConfig;
+  workspace: AnalysisWorkspace;
   graph: ImportGraph;
   sourceFileByPath: Map<string, ts.SourceFile>;
 }): LintDiagnostic[] {
@@ -693,7 +719,7 @@ function lintRuntimeBoundary({
     const rootKind = runtimeBoundaryRootKind(
       file,
       sourceFileByPath.get(file),
-      config,
+      workspace,
     );
     if (!rootKind) continue;
 
@@ -701,7 +727,7 @@ function lintRuntimeBoundary({
       ...lintRuntimeBoundaryRoot({
         root: file,
         rootKind,
-        config,
+        workspace,
         graph,
       }),
     );
@@ -713,12 +739,12 @@ function lintRuntimeBoundary({
 function lintRuntimeBoundaryRoot({
   root,
   rootKind,
-  config,
+  workspace,
   graph,
 }: {
   root: string;
   rootKind: RuntimeBoundaryRootKind;
-  config: ResolvedBeignetConfig;
+  workspace: AnalysisWorkspace;
   graph: ImportGraph;
 }): LintDiagnostic[] {
   const diagnostics: LintDiagnostic[] = [];
@@ -744,7 +770,11 @@ function lintRuntimeBoundaryRoot({
       const chain = reference.resolvedPath
         ? [...current.chain, reference.resolvedPath]
         : current.chain;
-      const violation = runtimeBoundaryViolation(reference, config, rootKind);
+      const violation = runtimeBoundaryViolation(
+        reference,
+        workspace,
+        rootKind,
+      );
 
       if (violation) {
         diagnostics.push({
@@ -772,14 +802,16 @@ function lintRuntimeBoundaryRoot({
 function runtimeBoundaryRootKind(
   file: string,
   sourceFile: ts.SourceFile | undefined,
-  config: ResolvedBeignetConfig,
+  workspace: AnalysisWorkspace,
 ): RuntimeBoundaryRootKind | undefined {
-  const layer = classifyPath(file, config);
+  const layer = classifyPath(file, workspace);
   if (layer === "contract") return "contract";
   if (layer === "schema") return "schema";
   if (layer === "client") return "client";
   if (sourceFile && hasUseClientDirective(sourceFile)) return "client";
-  if (isGeneratedClientAdapter(file, config)) return "client";
+  const source = projectSource(workspace, file);
+  if (isGeneratedClientAdapter(source.file, source.project.config))
+    return "client";
   return undefined;
 }
 
@@ -808,7 +840,7 @@ function isGeneratedClientAdapter(
 
 function runtimeBoundaryViolation(
   reference: ImportReference,
-  config: ResolvedBeignetConfig,
+  workspace: AnalysisWorkspace,
   rootKind: RuntimeBoundaryRootKind,
 ): string | undefined {
   if (!reference.staticallyResolvable) {
@@ -816,7 +848,7 @@ function runtimeBoundaryViolation(
   }
 
   if (reference.resolvedPath) {
-    const targetLayer = classifyPath(reference.resolvedPath, config);
+    const targetLayer = classifyPath(reference.resolvedPath, workspace);
     const prohibitedLayer =
       rootKind === "client"
         ? undefined
@@ -900,25 +932,30 @@ function featureImportViolation(
   file: string,
   sourceLayer: SourceLayer,
   resolvedPath: string,
-  config: ResolvedBeignetConfig,
+  workspace: AnalysisWorkspace,
 ): string | undefined {
   if (sourceLayer !== "domain") return undefined;
 
-  const sourceFeature = featureLayerInfo(file, config);
-  const targetFeature = featureLayerInfo(resolvedPath, config);
+  const sourceFeature = featureLayerInfo(file, workspace);
+  const targetFeature = featureLayerInfo(resolvedPath, workspace);
   if (!sourceFeature || !targetFeature) return undefined;
   if (sourceFeature.layer !== "domain" || targetFeature.layer !== "domain") {
     return undefined;
   }
-  if (sourceFeature.feature === targetFeature.feature) return undefined;
+  if (
+    sourceFeature.feature === targetFeature.feature &&
+    sourceFeature.owner === targetFeature.owner
+  )
+    return undefined;
   if (targetFeature.feature === "shared") return undefined;
 
   return `feature-specific domain files must not import another feature's domain (${stripKnownExtension(
     resolvedPath,
-  )}). Move shared-kernel domain concepts to ${sharedDomainPath(config)}.`;
+  )}). Move shared-kernel domain concepts to ${sharedDomainPath(projectForFile(workspace, file).config)}.`;
 }
 
 const domainBannedPackages = new Set([
+  "@beignet/core/encryption",
   "@aws-sdk/client-s3",
   "@aws-sdk/lib-storage",
   "@aws-sdk/s3-request-presigner",
@@ -927,12 +964,14 @@ const domainBannedPackages = new Set([
   "@beignet/core/errors",
   "@beignet/next",
   "@beignet/core/ports",
+  "@beignet/react-form",
   "@beignet/react-hook-form",
   "@beignet/react-query",
   "@hookform/resolvers",
   "@libsql/client",
   "@neondatabase/serverless",
   "@planetscale/database",
+  "@tanstack/react-form",
   "@tanstack/react-query",
   "@upstash/ratelimit",
   "@upstash/redis",
@@ -959,12 +998,14 @@ const coreBannedPackages = new Set([
   "@aws-sdk/lib-storage",
   "@aws-sdk/s3-request-presigner",
   "@beignet/core/client",
+  "@beignet/react-form",
   "@beignet/react-hook-form",
   "@beignet/react-query",
   "@hookform/resolvers",
   "@libsql/client",
   "@neondatabase/serverless",
   "@planetscale/database",
+  "@tanstack/react-form",
   "@tanstack/react-query",
   "@upstash/ratelimit",
   "@upstash/redis",
@@ -987,6 +1028,7 @@ const coreBannedPackages = new Set([
 ]);
 
 const serverRuntimePackages = new Set([
+  "@beignet/core/encryption",
   "@beignet/devtools",
   "@beignet/next",
   "@beignet/core/openapi",
@@ -1032,19 +1074,22 @@ function featureRelativePath(
 
 function featureLayerInfo(
   filePath: string,
-  config: ResolvedBeignetConfig,
-): { feature: string; layer: SourceLayer } | undefined {
-  const normalizedPath = stripKnownExtension(normalizePath(filePath));
+  workspace: AnalysisWorkspace,
+): { feature: string; owner: string; layer: SourceLayer } | undefined {
+  const source = projectSource(workspace, filePath);
+  const normalizedPath = stripKnownExtension(source.file);
   const relativePath = featureRelativePath(
     normalizedPath,
-    directoryPath(config.paths.features),
+    directoryPath(source.project.config.paths.features),
   );
   if (!relativePath) return undefined;
-
   const [feature] = relativePath.split("/");
   if (!feature) return undefined;
-
-  return { feature, layer: classifyPath(filePath, config) };
+  return {
+    feature,
+    owner: source.project.prefix,
+    layer: classifyPath(filePath, workspace),
+  };
 }
 
 function legacySharedDomainPath(config: ResolvedBeignetConfig): string {
@@ -1091,3 +1136,62 @@ function dedupeDiagnostics(diagnostics: LintDiagnostic[]): LintDiagnostic[] {
 
   return deduped;
 }
+
+function workspaceImportViolation(
+  workspace: AnalysisWorkspace,
+  file: string,
+  reference: ImportReference,
+): LintDiagnostic | undefined {
+  if (workspace.projects.length === 1 || !reference.staticallyResolvable)
+    return undefined;
+  const importer = projectForFile(workspace, file);
+  const namedPackage = workspace.projects.find(
+    (project) =>
+      project.name &&
+      (reference.importPath === project.name ||
+        reference.importPath.startsWith(`${project.name}/`)),
+  );
+  const target = reference.resolvedPath
+    ? findProjectForFile(workspace, reference.resolvedPath)
+    : namedPackage;
+  let message: string | undefined;
+  if (
+    importer.localDependencies.has(packageName(reference.importPath)) &&
+    !namedPackage
+  ) {
+    message = `Add the source directory for ${packageName(reference.importPath)} to workspace.packages so Beignet can inspect this local dependency.`;
+  } else if (reference.resolvedPath && !target) {
+    message = `Cannot inspect ${reference.importPath}: its source is outside the configured workspace. Add the owning package directory to workspace.packages.`;
+  } else if (
+    target &&
+    target !== importer &&
+    (!target.name || !importer.dependencies.has(target.name))
+  ) {
+    message = `Declare ${target.name ?? target.prefix} in ${projectPath(importer, "package.json")} before importing its source.`;
+  } else if (
+    (namedPackage &&
+      (!path.posix.extname(reference.importPath) ||
+        isAnalysisSourceFileExtension(
+          path.posix.extname(reference.importPath),
+        )) &&
+      (!reference.resolvedPath ||
+        !workspace.fileSet.has(reference.resolvedPath))) ||
+    (target?.prefix &&
+      reference.resolvedPath &&
+      (!workspace.fileSet.has(reference.resolvedPath) ||
+        !isAnalysisSourceFile(reference.resolvedPath)))
+  ) {
+    message = `Cannot inspect ${reference.importPath}. Install workspace dependencies and expose source files through package exports and the importing package's TypeScript configuration. Build output is not inspected.`;
+  }
+  return message
+    ? {
+        severity: "error",
+        code: "BEIGNET_WORKSPACE_IMPORT",
+        file,
+        importPath: reference.importPath,
+        line: reference.line,
+        column: reference.column,
+        message,
+      }
+    : undefined;
+}

package/src/make/shared.ts

@@ -1130,7 +1130,7 @@ export function beignetDependencyVersion(packageJson: PackageJsonLike): string {
 export function tanstackReactQueryDependencyVersion(
   packageJson: PackageJsonLike,
 ): string {
-  return packageJson.dependencies?.["@tanstack/react-query"] ?? "^5.100.7";
+  return packageJson.dependencies?.["@tanstack/react-query"] ?? "^5.102.0";
 }
 
 export async function updatePackageJson(

package/src/make.ts

@@ -3173,6 +3173,13 @@ async function missingFeatureUiFormsFiles(
   config: ResolvedBeignetConfig,
 ): Promise<GeneratedFile[]> {
   const formsPath = clientFormsPath(config);
+
+  if (await appDependsOn(targetDir, "@beignet/react-form")) {
+    throw new Error(
+      "beignet make feature --with ui generates React Hook Form components, but this app depends on @beignet/react-form. Generate the feature without --with ui and write the TanStack Form component by hand; the @beignet/react-form#forms skill shows the pattern.",
+    );
+  }
+
   const existing = await readOptionalFile(path.join(targetDir, formsPath));
 
   if (existing === undefined) {
@@ -3196,6 +3203,29 @@ export const rhf = createReactHookForm();
   return [];
 }
 
+async function appDependsOn(
+  targetDir: string,
+  packageName: string,
+): Promise<boolean> {
+  const source = await readOptionalFile(path.join(targetDir, "package.json"));
+  if (source === undefined) return false;
+
+  let packageJson: {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+  };
+  try {
+    packageJson = JSON.parse(source);
+  } catch {
+    return false;
+  }
+
+  return Boolean(
+    packageJson.dependencies?.[packageName] ??
+      packageJson.devDependencies?.[packageName],
+  );
+}
+
 async function assertUploadUiApp(
   targetDir: string,
   config: ResolvedBeignetConfig,
@@ -4187,7 +4217,7 @@ export function decode${names.singularPascal}Cursor(cursor: string): ${names.sin
 export const List${names.pluralPascal}InputSchema = z
 	.object({
 		limit: z.number().int().min(1).max(100).default(20),
-		cursor: z.string().optional().transform((value) => value ?? null),
+		cursor: z.string().optional(),
 		name: z.string().trim().min(1).max(120).optional(),
 		sortBy: ${names.singularPascal}SortBySchema.default("createdAt"),
 		sortDirection: ${names.singularPascal}SortDirectionSchema.default("desc"),

package/src/mcp.ts

@@ -687,7 +687,7 @@ export function buildBeignetMcpServer(options: McpServerOptions): McpServer {
     "check",
     {
       description:
-        "Run the full Beignet app validation loop: Beignet lint, strict doctor, optional disconnected or connected preflight, and the app's lint, typecheck, and test scripts. Returns the same versioned JSON as beignet check --json, including every step, bounded failure output, durations, and overall ok status. Does not apply Beignet fixes, but app-owned scripts run with their normal side effects.",
+        "Run the full Beignet app validation loop: Beignet lint, strict doctor, optional disconnected or connected preflight, and the app's lint, typecheck, and test scripts. Returns the same versioned JSON as beignet check --json, including every step, bounded failure output, durations, source-state provenance, and overall ok status. An ending fingerprint that differs from the baseline makes the result stale and unsuccessful. Does not apply Beignet fixes, but app-owned scripts run with their normal side effects.",
       inputSchema: {
         preflight: z
           .boolean()

package/src/provider-add.ts

@@ -584,7 +584,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       key: "storage",
       typeName: "StoragePort",
       importName: "StoragePort",
-      importFrom: "@beignet/core/storage",
+      importFrom: "@beignet/core/ports",
     },
     envVars: [
       "STORAGE_S3_BUCKET",
@@ -649,7 +649,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       key: "storage",
       typeName: "StoragePort",
       importName: "StoragePort",
-      importFrom: "@beignet/core/storage",
+      importFrom: "@beignet/core/ports",
     },
     envVars: ["BLOB_READ_WRITE_TOKEN"],
     envExample: [

package/src/provider-audit.ts

@@ -5,6 +5,7 @@ import {
   type ProviderPackageMetadata,
   parseProviderPackageMetadata,
 } from "@beignet/core/providers";
+import { analyzePortWiringFiles } from "./analysis/port-wiring.js";
 import {
   type BeignetDatabaseTables,
   defaultBeignetConfig,
@@ -169,6 +170,10 @@ export async function auditProviders(
   const portsSource = files.includes(config.paths.ports)
     ? await readCachedSource(targetDir, config.paths.ports, sourceCache)
     : "";
+  const declaredAppPorts =
+    config.workspace.packages.length > 0
+      ? (await analyzePortWiringFiles({ targetDir, files, config })).declared
+      : undefined;
   const infrastructurePath = directoryPath(
     path.dirname(config.paths.portWiring),
   );
@@ -211,6 +216,7 @@ export async function auditProviders(
         schemaDir,
         sourceCache,
         portsSource,
+        declaredAppPorts,
         providerEntries,
         providerEntryRecords,
         sourceFile: source.file,
@@ -334,10 +340,12 @@ export async function readProviderPackageMetadataSource(
     const packageJson = await readJsonIfExists<{
       beignet?: { provider?: unknown };
     }>(candidate);
+    if (packageJson === undefined) continue;
     const metadata = packageJson?.beignet?.provider;
     if (metadata !== undefined) {
       return { packageName, file: candidate, metadata };
     }
+    return undefined;
   }
 
   return undefined;
@@ -1169,14 +1177,21 @@ function providerPackageJsonCandidates(
   targetDir: string,
   packageName: string,
 ): string[] {
-  const candidates = [
-    path.join(
-      targetDir,
-      "node_modules",
-      ...packageName.split("/"),
-      "package.json",
-    ),
-  ];
+  const candidates: string[] = [];
+  let directory = path.resolve(targetDir);
+  while (true) {
+    candidates.push(
+      path.join(
+        directory,
+        "node_modules",
+        ...packageName.split("/"),
+        "package.json",
+      ),
+    );
+    const parent = path.dirname(directory);
+    if (parent === directory) break;
+    directory = parent;
+  }
 
   if (packageName.startsWith("@beignet/")) {
     candidates.push(
@@ -1217,6 +1232,7 @@ async function providerAuditEntryForRule(options: {
   schemaDir: string;
   sourceCache: Map<string, string>;
   portsSource: string;
+  declaredAppPorts?: ReadonlySet<string>;
   providerEntries: string[];
   providerEntryRecords: ProviderListEntryRecord[];
   sourceFile: string;
@@ -1288,6 +1304,7 @@ async function providerAuditEntryForRule(options: {
   const appPorts = appPortsAudit(
     options.rule.appPorts ?? [],
     options.portsSource,
+    options.declaredAppPorts,
   );
   const notes = providerAuditNotes({
     metadataStatus: "valid",
@@ -1629,11 +1646,14 @@ function aggregateVariantRequirement(
 function appPortsAudit(
   required: readonly { name: string; type: string }[],
   portsSource: string,
+  declaredAppPorts?: ReadonlySet<string>,
 ): ProviderAppPortsAudit {
   if (required.length === 0) return emptyAppPorts();
 
-  const missing = required.filter(
-    (port) => !portsSource.includes(`${port.name}:`),
+  const missing = required.filter((port) =>
+    declaredAppPorts
+      ? !declaredAppPorts.has(port.name)
+      : !portsSource.includes(`${port.name}:`),
   );
   return {
     status: missing.length === 0 ? "present" : "missing",