@boopkit/cli 0.6.10 → 0.6.11

package/dist/capability-versions.json

@@ -13,7 +13,7 @@
   "@boopkit/cap-services": "0.4.2",
   "@boopkit/cap-skills": "0.5.4",
   "@boopkit/cap-testing": "0.5.6",
-  "@boopkit/cap-users": "0.6.0",
+  "@boopkit/cap-users": "0.7.0",
   "@boopkit/cap-ux": "0.2.2",
   "@boopkit/cap-web": "0.5.4",
   "@boopkit/cap-workflows": "0.2.0",

package/dist/commands/status.js

@@ -180,6 +180,8 @@ async function enrichWithSetupChecks(data, envValues, projectDir, projectName) {
             type: c.type,
             label: (0, interpolate_1.interpolate)(c.label, vars),
             hint: c.hint ? (0, interpolate_1.interpolate)(c.hint, vars) : undefined,
+            // Probe queries are literal SQL — pass them through untouched.
+            query: c.query,
         }));
         // Extract this capability's .prisma files for scoped prisma-migrate checks
         const prismaFiles = capDef?.files?.filter(f => f.endsWith('.prisma'));

package/dist/lib/config.d.ts

@@ -39,9 +39,16 @@ export interface CapabilityEnvVar {
     required?: 'boot' | 'runtime';
 }
 export interface CapabilitySetupCheck {
-    type: 'env-set' | 'service' | 'database' | 'prisma-migrate' | 'prisma-generate';
+    type: 'env-set' | 'service' | 'database' | 'prisma-migrate' | 'prisma-generate' | 'probe';
     label: string;
     hint?: string;
+    /**
+     * For `type: 'probe'` only — a read-only SQL query the capability asserts
+     * about its own data. The check passes when the query returns no rows. The
+     * query runs in a read-only transaction, so it cannot write. Ignored by
+     * every other check type.
+     */
+    query?: string;
 }
 export interface CapabilityPostInstall {
     prerequisites?: string[];

package/dist/lib/db-status.d.ts

@@ -51,6 +51,22 @@ export declare function isPrismaClientGenerated(projectDir: string): boolean;
  * Returns true if in sync, false if not, null if prisma not available.
  */
 export declare function checkPrismaMigrateStatus(projectDir: string): Promise<boolean | null>;
+/**
+ * Run a capability-supplied read-only data probe.
+ *
+ * The query is executed in a read-only transaction (via PGOPTIONS), so a probe
+ * that accidentally contains a write raises "cannot execute … in a read-only
+ * transaction" rather than mutating anything. The probe is a positive detector:
+ * it reports a violation ONLY when it observes one.
+ *
+ * Returns:
+ *   true  — clean: the query returned no rows.
+ *   false — violation: the query returned at least one row.
+ *   null  — could not run (psql missing, DB unreachable, table absent, or the
+ *           query errored). The caller treats this as "no violation observed"
+ *           so an un-runnable probe never raises a false alarm.
+ */
+export declare function checkDataProbe(dbUrl: string, query: string): Promise<boolean | null>;
 export interface SetupStep {
     label: string;
     done: boolean;
@@ -73,4 +89,5 @@ export declare function runSetupChecks(checks: {
     type: string;
     label: string;
     hint?: string;
+    query?: string;
 }[], envValues: Map<string, string>, projectDir: string, projectName: string, prismaFiles?: string[]): Promise<SetupStep[]>;

package/dist/lib/db-status.js

@@ -43,6 +43,7 @@ exports.checkTablesExist = checkTablesExist;
 exports.hasPrismaModels = hasPrismaModels;
 exports.isPrismaClientGenerated = isPrismaClientGenerated;
 exports.checkPrismaMigrateStatus = checkPrismaMigrateStatus;
+exports.checkDataProbe = checkDataProbe;
 exports.runSetupChecks = runSetupChecks;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
@@ -258,11 +259,46 @@ function checkPrismaMigrateStatus(projectDir) {
     });
 }
 /**
- * Run a single setup check by type. Returns true/false for pass/fail.
+ * Run a capability-supplied read-only data probe.
+ *
+ * The query is executed in a read-only transaction (via PGOPTIONS), so a probe
+ * that accidentally contains a write raises "cannot execute … in a read-only
+ * transaction" rather than mutating anything. The probe is a positive detector:
+ * it reports a violation ONLY when it observes one.
+ *
+ * Returns:
+ *   true  — clean: the query returned no rows.
+ *   false — violation: the query returned at least one row.
+ *   null  — could not run (psql missing, DB unreachable, table absent, or the
+ *           query errored). The caller treats this as "no violation observed"
+ *           so an un-runnable probe never raises a false alarm.
+ */
+function checkDataProbe(dbUrl, query) {
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)('psql', [dbUrl, '-tAc', query], {
+            timeout: 3000,
+            // Force a read-only session: any write in the query fails at the server.
+            env: { ...process.env, PGOPTIONS: '-c default_transaction_read_only=on' },
+        }, (error, stdout) => {
+            if (error) {
+                // psql not installed, DB unreachable, missing table, or a query error.
+                // None of these is an observed violation, so don't raise a false alarm.
+                resolve(null);
+            }
+            else {
+                // With -tA a zero-row result is empty output; any output means the
+                // query found a violating row.
+                resolve(stdout.trim() === '' ? true : false);
+            }
+        });
+    });
+}
+/**
+ * Run a single setup check. Returns true/false for pass/fail.
  * Checks can depend on earlier results via ctx.results.
  */
-async function runCheck(type, ctx) {
-    switch (type) {
+async function runCheck(check, ctx) {
+    switch (check.type) {
         case 'env-set': {
             const dbUrl = ctx.envValues.get('DATABASE_URL');
             return !!dbUrl;
@@ -319,6 +355,20 @@ async function runCheck(type, ctx) {
         case 'prisma-generate': {
             return isPrismaClientGenerated(ctx.projectDir);
         }
+        case 'probe': {
+            // A read-only data probe: passes when the capability's query finds no
+            // violating rows. Needs a query and a database URL; without either there
+            // is nothing to observe, so it passes rather than raising a false alarm.
+            if (!check.query)
+                return true;
+            const dbUrl = ctx.envValues.get('DATABASE_URL');
+            if (!dbUrl)
+                return true;
+            const result = await checkDataProbe(dbUrl, check.query);
+            // Only an observed violation (result === false) fails the check; a probe
+            // that could not run (null) is treated as clean.
+            return result !== false;
+        }
         default:
             return false;
     }
@@ -331,7 +381,7 @@ async function runSetupChecks(checks, envValues, projectDir, projectName, prisma
     const ctx = { envValues, projectDir, projectName, results: new Map(), prismaFiles };
     const steps = [];
     for (const check of checks) {
-        const done = await runCheck(check.type, ctx);
+        const done = await runCheck(check, ctx);
         ctx.results.set(check.type, done);
         let hint = check.hint;
         // When prisma-migrate fails and no migrations exist yet, the first

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boopkit/cli",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "description": "boop: the opinionated bootstrap for founder friendly, AI-first web apps - code plus agent skills, composable from day one.",
   "main": "dist/cli.js",
   "workspaces": [