@boopkit/cli 0.6.10 → 0.6.12

package/dist/capability-catalog.json

@@ -75,6 +75,17 @@
       "web"
     ]
   },
+  {
+    "name": "oauth-server",
+    "description": "Be an OAuth 2.1 authorization server and resource server, so Claude, Claude Code or any MCP client can act on behalf of one of your users",
+    "type": "application",
+    "package": "@boopkit/cap-oauth-server",
+    "requires": [
+      "users-and-accounts",
+      "web",
+      "database"
+    ]
+  },
   {
     "name": "product-design",
     "description": "Product design skills",

package/dist/capability-versions.json

@@ -8,12 +8,13 @@
   "@boopkit/cap-hello": "0.4.1",
   "@boopkit/cap-noticeboard": "0.4.1",
   "@boopkit/cap-oauth-client": "0.1.1",
+  "@boopkit/cap-oauth-server": "0.1.0",
   "@boopkit/cap-product-design": "0.6.7",
   "@boopkit/cap-project-mgmt": "0.4.9",
   "@boopkit/cap-services": "0.4.2",
   "@boopkit/cap-skills": "0.5.4",
   "@boopkit/cap-testing": "0.5.6",
-  "@boopkit/cap-users": "0.6.0",
+  "@boopkit/cap-users": "0.8.0",
   "@boopkit/cap-ux": "0.2.2",
   "@boopkit/cap-web": "0.5.4",
   "@boopkit/cap-workflows": "0.2.0",

package/dist/commands/status.js

@@ -180,6 +180,8 @@ async function enrichWithSetupChecks(data, envValues, projectDir, projectName) {
             type: c.type,
             label: (0, interpolate_1.interpolate)(c.label, vars),
             hint: c.hint ? (0, interpolate_1.interpolate)(c.hint, vars) : undefined,
+            // Probe queries are literal SQL — pass them through untouched.
+            query: c.query,
         }));
         // Extract this capability's .prisma files for scoped prisma-migrate checks
         const prismaFiles = capDef?.files?.filter(f => f.endsWith('.prisma'));

package/dist/lib/config.d.ts

@@ -39,9 +39,16 @@ export interface CapabilityEnvVar {
     required?: 'boot' | 'runtime';
 }
 export interface CapabilitySetupCheck {
-    type: 'env-set' | 'service' | 'database' | 'prisma-migrate' | 'prisma-generate';
+    type: 'env-set' | 'service' | 'database' | 'prisma-migrate' | 'prisma-generate' | 'probe';
     label: string;
     hint?: string;
+    /**
+     * For `type: 'probe'` only — a read-only SQL query the capability asserts
+     * about its own data. The check passes when the query returns no rows. The
+     * query runs in a read-only transaction, so it cannot write. Ignored by
+     * every other check type.
+     */
+    query?: string;
 }
 export interface CapabilityPostInstall {
     prerequisites?: string[];

package/dist/lib/db-status.d.ts

@@ -51,6 +51,22 @@ export declare function isPrismaClientGenerated(projectDir: string): boolean;
  * Returns true if in sync, false if not, null if prisma not available.
  */
 export declare function checkPrismaMigrateStatus(projectDir: string): Promise<boolean | null>;
+/**
+ * Run a capability-supplied read-only data probe.
+ *
+ * The query is executed in a read-only transaction (via PGOPTIONS), so a probe
+ * that accidentally contains a write raises "cannot execute … in a read-only
+ * transaction" rather than mutating anything. The probe is a positive detector:
+ * it reports a violation ONLY when it observes one.
+ *
+ * Returns:
+ *   true  — clean: the query returned no rows.
+ *   false — violation: the query returned at least one row.
+ *   null  — could not run (psql missing, DB unreachable, table absent, or the
+ *           query errored). The caller treats this as "no violation observed"
+ *           so an un-runnable probe never raises a false alarm.
+ */
+export declare function checkDataProbe(dbUrl: string, query: string): Promise<boolean | null>;
 export interface SetupStep {
     label: string;
     done: boolean;
@@ -73,4 +89,5 @@ export declare function runSetupChecks(checks: {
     type: string;
     label: string;
     hint?: string;
+    query?: string;
 }[], envValues: Map<string, string>, projectDir: string, projectName: string, prismaFiles?: string[]): Promise<SetupStep[]>;

package/dist/lib/db-status.js

@@ -43,6 +43,7 @@ exports.checkTablesExist = checkTablesExist;
 exports.hasPrismaModels = hasPrismaModels;
 exports.isPrismaClientGenerated = isPrismaClientGenerated;
 exports.checkPrismaMigrateStatus = checkPrismaMigrateStatus;
+exports.checkDataProbe = checkDataProbe;
 exports.runSetupChecks = runSetupChecks;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
@@ -258,11 +259,46 @@ function checkPrismaMigrateStatus(projectDir) {
     });
 }
 /**
- * Run a single setup check by type. Returns true/false for pass/fail.
+ * Run a capability-supplied read-only data probe.
+ *
+ * The query is executed in a read-only transaction (via PGOPTIONS), so a probe
+ * that accidentally contains a write raises "cannot execute … in a read-only
+ * transaction" rather than mutating anything. The probe is a positive detector:
+ * it reports a violation ONLY when it observes one.
+ *
+ * Returns:
+ *   true  — clean: the query returned no rows.
+ *   false — violation: the query returned at least one row.
+ *   null  — could not run (psql missing, DB unreachable, table absent, or the
+ *           query errored). The caller treats this as "no violation observed"
+ *           so an un-runnable probe never raises a false alarm.
+ */
+function checkDataProbe(dbUrl, query) {
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)('psql', [dbUrl, '-tAc', query], {
+            timeout: 3000,
+            // Force a read-only session: any write in the query fails at the server.
+            env: { ...process.env, PGOPTIONS: '-c default_transaction_read_only=on' },
+        }, (error, stdout) => {
+            if (error) {
+                // psql not installed, DB unreachable, missing table, or a query error.
+                // None of these is an observed violation, so don't raise a false alarm.
+                resolve(null);
+            }
+            else {
+                // With -tA a zero-row result is empty output; any output means the
+                // query found a violating row.
+                resolve(stdout.trim() === '' ? true : false);
+            }
+        });
+    });
+}
+/**
+ * Run a single setup check. Returns true/false for pass/fail.
  * Checks can depend on earlier results via ctx.results.
  */
-async function runCheck(type, ctx) {
-    switch (type) {
+async function runCheck(check, ctx) {
+    switch (check.type) {
         case 'env-set': {
             const dbUrl = ctx.envValues.get('DATABASE_URL');
             return !!dbUrl;
@@ -319,6 +355,20 @@ async function runCheck(type, ctx) {
         case 'prisma-generate': {
             return isPrismaClientGenerated(ctx.projectDir);
         }
+        case 'probe': {
+            // A read-only data probe: passes when the capability's query finds no
+            // violating rows. Needs a query and a database URL; without either there
+            // is nothing to observe, so it passes rather than raising a false alarm.
+            if (!check.query)
+                return true;
+            const dbUrl = ctx.envValues.get('DATABASE_URL');
+            if (!dbUrl)
+                return true;
+            const result = await checkDataProbe(dbUrl, check.query);
+            // Only an observed violation (result === false) fails the check; a probe
+            // that could not run (null) is treated as clean.
+            return result !== false;
+        }
         default:
             return false;
     }
@@ -331,7 +381,7 @@ async function runSetupChecks(checks, envValues, projectDir, projectName, prisma
     const ctx = { envValues, projectDir, projectName, results: new Map(), prismaFiles };
     const steps = [];
     for (const check of checks) {
-        const done = await runCheck(check.type, ctx);
+        const done = await runCheck(check, ctx);
         ctx.results.set(check.type, done);
         let hint = check.hint;
         // When prisma-migrate fails and no migrations exist yet, the first

package/dist/lib/execute.js

@@ -127,7 +127,7 @@ function executeTask(task, manifest) {
         case 'link-package': {
             const data = task.data;
             (0, scaffold_1.mergePackageJson)(targetDir, undefined, undefined, {
-                [data.packageName]: (0, scaffold_1.getBoopkitVersion)(data.packageName),
+                [data.packageName]: (0, scaffold_1.getBoopkitVersion)(data.packageName, [targetDir]),
             }, { skipBackup: true });
             break;
         }

package/dist/lib/scaffold.d.ts

@@ -64,11 +64,17 @@ export declare function linkSkillsToClaude(targetDir: string, only?: Iterable<st
  * Read the version from a @boopkit/ package's package.json and return ^version.
  * Fallback chain:
  * 1. Monorepo packages/ dir (development)
- * 2. require.resolve from CLI's node_modules
+ * 2. require.resolve from `searchPaths`, then the CLI's node_modules
  * 3. dist/capability-versions.json (baked at build time for npm installs)
  * 4. '*' (last resort)
+ *
+ * `searchPaths` is where the *project* is, and it comes before the CLI root for
+ * the same reason `planAdd` passes it: the package a project is being given may
+ * only exist under that project — npm-linked from a worktree, or installed by
+ * `boop add`'s own phase 0 — and reading only the CLI root then falls all the
+ * way through to `'*'`, which is not a version any install can resolve.
  */
-export declare function getBoopkitVersion(packageName: string): string;
+export declare function getBoopkitVersion(packageName: string, searchPaths?: string[]): string;
 /**
  * The warning shown when a dependency lands in a project's package.json with no
  * version range. Written to be actionable by an agent reading it in a

package/dist/lib/scaffold.js

@@ -128,7 +128,11 @@ function hashFile(filePath) {
  * Returns list of copied file paths relative to targetDir, and file hashes.
  */
 function copyCapabilityFiles(targetDir, capabilityName, searchPaths) {
-    const pkgDir = (0, capability_1.getPackageDir)(capabilityName, searchPaths);
+    // Default to the project itself, so this resolves the capability to the same
+    // package `planAdd` did. Without it a capability that lives only under the
+    // project resolved here to nothing, and `boop add` reported every file copied
+    // while copying none (boop-2vdy.8.5).
+    const pkgDir = (0, capability_1.getPackageDir)(capabilityName, searchPaths ?? [targetDir]);
     if (pkgDir) {
         // Read package.json for boopkit config
         const pkgJsonPath = path.join(pkgDir, 'package.json');
@@ -266,11 +270,17 @@ function updateCapabilityHashes(targetDir, capabilityName, fileHashes, version)
  * Read the version from a @boopkit/ package's package.json and return ^version.
  * Fallback chain:
  * 1. Monorepo packages/ dir (development)
- * 2. require.resolve from CLI's node_modules
+ * 2. require.resolve from `searchPaths`, then the CLI's node_modules
  * 3. dist/capability-versions.json (baked at build time for npm installs)
  * 4. '*' (last resort)
+ *
+ * `searchPaths` is where the *project* is, and it comes before the CLI root for
+ * the same reason `planAdd` passes it: the package a project is being given may
+ * only exist under that project — npm-linked from a worktree, or installed by
+ * `boop add`'s own phase 0 — and reading only the CLI root then falls all the
+ * way through to `'*'`, which is not a version any install can resolve.
  */
-function getBoopkitVersion(packageName) {
+function getBoopkitVersion(packageName, searchPaths) {
     const pkgName = packageName.replace(/^@boopkit\//, '');
     // Try monorepo packages/ directory first (development)
     const monorepoPkgJsonPath = path.join((0, config_1.getBoopRoot)(), 'packages', pkgName, 'package.json');
@@ -281,10 +291,25 @@ function getBoopkitVersion(packageName) {
     catch {
         // Not in monorepo — try require.resolve (published CLI install)
     }
+    // Then the node_modules of each search path, read straight off disk rather
+    // than through require.resolve — the package being read may have no build
+    // output yet, and a resolver is entitled to refuse a package whose `main`
+    // does not exist.
+    for (const searchPath of [...(searchPaths ?? []), (0, config_1.getBoopRoot)()]) {
+        try {
+            const installedPath = path.join(searchPath, 'node_modules', packageName, 'package.json');
+            const pkg = JSON.parse(fs.readFileSync(installedPath, 'utf-8'));
+            if (pkg.version)
+                return `^${pkg.version}`;
+        }
+        catch {
+            // Not installed under this path — try the next
+        }
+    }
     // Try resolving the installed package
     try {
         const resolvedPath = require.resolve(`${packageName}/package.json`, {
-            paths: [(0, config_1.getBoopRoot)()],
+            paths: [...(searchPaths ?? []), (0, config_1.getBoopRoot)()],
         });
         const pkg = JSON.parse(fs.readFileSync(resolvedPath, 'utf-8'));
         return `^${pkg.version}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boopkit/cli",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "boop: the opinionated bootstrap for founder friendly, AI-first web apps - code plus agent skills, composable from day one.",
   "main": "dist/cli.js",
   "workspaces": [