@solcreek/cli 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -0,0 +1,49 @@
+# @solcreek/cli
+
+## 0.4.4
+
+### Features
+
+- **`creek deploy --from-github [--project <slug>]`** — trigger a deploy
+  of the latest commit on a project's production branch via its
+  stored GitHub connection, skipping the local build entirely. Same
+  server code path that a real `git push` webhook uses — runs in
+  remote-builder, deploys via the existing pipeline, posts commit
+  status. Use `--project` to target by slug or UUID, or omit it to
+  infer from `creek.toml` in the current directory.
+
+  Flow: the CLI snapshots the newest existing deployment, POSTs
+  `/github/deploy-latest`, then polls `/projects/:id/deployments`
+  every 1.5–2s to pick up the new row (handlePush runs in
+  `waitUntil` on the server, so the row appears a beat after the
+  trigger). Streams status transitions to the terminal until the
+  deployment settles on `active`, `failed`, or `cancelled`. Hard
+  cap of 15 minutes. `--json` prints a single structured result.
+
+  Pairs with the dashboard's new "Deploy latest" button on the
+  project detail page — both call the same endpoint.
+
+## 0.4.3
+
+- Cron/queue trigger support flowed through the deploy pipeline
+  (bump commit `c1110b1`).
+
+## 0.4.2
+
+- Bundled with the queue binding + worker wrapper work landed in
+  `@solcreek/runtime` 0.4.0 (bump commit `28fdb11`).
+
+## 0.4.1
+
+- Bump alongside `@solcreek/sdk` 0.4.0 (semantic resource names in
+  `creek.toml`).
+
+## 0.4.0
+
+- Version bump ahead of the cron trigger pipeline work.
+
+## 0.3.9
+
+- First tagged release via the publish-cli GitHub Actions workflow
+  (the workflow has been dormant since; 0.4.x went out via manual
+  `pnpm publish` until 0.4.4 restored automated releases).

package/dist/commands/deploy.d.ts

@@ -14,6 +14,16 @@ export declare const deployCommand: import("citty").CommandDef<{
         description: string;
         required: false;
     };
+    "from-github": {
+        type: "boolean";
+        description: string;
+        default: false;
+    };
+    project: {
+        type: "string";
+        description: string;
+        required: false;
+    };
     json: {
         type: "boolean";
         description: string;
@@ -35,6 +45,25 @@ export declare const deployCommand: import("citty").CommandDef<{
         default: false;
     };
 }>;
+export interface CliDeployment {
+    id: string;
+    version: number;
+    status: string;
+    branch: string | null;
+    failedStep: string | null;
+    errorMessage: string | null;
+    createdAt: number;
+    url: string | null;
+}
+export declare const CLI_TERMINAL_STATUSES: Set<string>;
+export declare const CLI_IN_FLIGHT_STATUSES: Set<string>;
+/**
+ * Given a deployment list and a "previous latest createdAt" snapshot,
+ * return the most recently-created deployment that arrived after the
+ * snapshot, or null if none have appeared yet. Used by `--from-github`
+ * to find the row that handlePush just inserted in the background.
+ */
+export declare function findNewDeployment(deployments: CliDeployment[], previousLatestCreatedAt: number): CliDeployment | null;
 /**
  * Patch bare Node.js module imports (e.g. `from "fs"`) to use the `node:` prefix
  * (e.g. `from "node:fs"`). Workerd requires the `node:` prefix for all built-in modules.

package/dist/commands/deploy.js

@@ -10,7 +10,7 @@ import { collectAssets } from "../utils/bundle.js";
 import { bundleSSRServer } from "../utils/ssr-bundle.js";
 import { bundleWorker } from "../utils/worker-bundle.js";
 import { sandboxDeploy, pollSandboxStatus, printSandboxSuccess } from "../utils/sandbox.js";
-import { isTTY, jsonOutput, resolveJsonMode, globalArgs, shouldAutoConfirm, NO_PROJECT_BREADCRUMBS } from "../utils/output.js";
+import { isTTY, jsonOutput, resolveJsonMode, globalArgs, shouldAutoConfirm, AUTH_BREADCRUMBS, NO_PROJECT_BREADCRUMBS } from "../utils/output.js";
 import { ensureTosAccepted } from "../utils/tos.js";
 import { buildNextjs, patchBundledWorker, hasAdapterOutput } from "../utils/nextjs.js";
 import { isRepoUrl, parseRepoUrl, validateRepoUrl, validateSubpath, RepoUrlError } from "../utils/repo-url.js";
@@ -62,6 +62,16 @@ export const deployCommand = defineCommand({
             description: "Subdirectory within repo to deploy (for monorepos)",
             required: false,
         },
+        "from-github": {
+            type: "boolean",
+            description: "Skip local build; trigger a deploy of the latest commit on the project's production branch via its GitHub connection",
+            default: false,
+        },
+        project: {
+            type: "string",
+            description: "Target project slug or UUID (required with --from-github when not run inside a project directory)",
+            required: false,
+        },
     },
     async run({ args }) {
         const jsonMode = resolveJsonMode(args);
@@ -82,6 +92,14 @@ export const deployCommand = defineCommand({
             }
             return await deployTemplate(args.template, templateData);
         }
+        // --- Trigger a deploy from the project's GitHub connection (no local build) ---
+        if (args["from-github"]) {
+            return await deployFromGithub({
+                project: args.project,
+                cwd: args.dir ? resolve(args.dir) : process.cwd(),
+                jsonMode,
+            });
+        }
         // --- Repo URL deploy (creek deploy https://github.com/user/repo) ---
         if (args.dir && isRepoUrl(args.dir)) {
             return await deployRepoUrl(args.dir, {
@@ -145,6 +163,210 @@ export const deployCommand = defineCommand({
         process.exit(1);
     },
 });
+export const CLI_TERMINAL_STATUSES = new Set(["active", "failed", "cancelled"]);
+export const CLI_IN_FLIGHT_STATUSES = new Set([
+    "queued",
+    "uploading",
+    "provisioning",
+    "deploying",
+]);
+/**
+ * Given a deployment list and a "previous latest createdAt" snapshot,
+ * return the most recently-created deployment that arrived after the
+ * snapshot, or null if none have appeared yet. Used by `--from-github`
+ * to find the row that handlePush just inserted in the background.
+ */
+export function findNewDeployment(deployments, previousLatestCreatedAt) {
+    const newer = deployments.filter((d) => d.createdAt > previousLatestCreatedAt);
+    if (newer.length === 0)
+        return null;
+    return newer.reduce((latest, d) => (d.createdAt > latest.createdAt ? d : latest), newer[0]);
+}
+/**
+ * Trigger a deploy that uses the project's github_connection instead of a
+ * local build. Polls the deployments list until the new row settles and
+ * streams status transitions to the terminal.
+ *
+ * The server endpoint (POST /github/deploy-latest) returns 200 immediately
+ * while handlePush runs in waitUntil, so we fingerprint the deployments list
+ * before the POST and look for a new row afterward.
+ */
+async function deployFromGithub(options) {
+    const { project: projectArg, cwd, jsonMode } = options;
+    const token = getToken();
+    if (!token) {
+        if (jsonMode)
+            jsonOutput({ error: "not_authenticated", message: "Run `creek login` first." }, 1, AUTH_BREADCRUMBS);
+        consola.error("Not logged in. Run `creek login` first.");
+        process.exit(1);
+    }
+    // Resolve the target project: explicit --project flag wins, otherwise
+    // fall back to the current directory's resolved config (creek.toml
+    // [project] name or inferred project name).
+    let projectSlug = projectArg;
+    if (!projectSlug) {
+        try {
+            const resolved = resolveConfig(cwd);
+            projectSlug = resolved.projectName;
+        }
+        catch (err) {
+            if (!(err instanceof ConfigNotFoundError))
+                throw err;
+        }
+    }
+    if (!projectSlug) {
+        if (jsonMode)
+            jsonOutput({ error: "validation", message: "Could not determine target project. Pass --project <slug>." }, 1, NO_PROJECT_BREADCRUMBS);
+        consola.error("Could not determine target project. Pass --project <slug> or run inside a directory with a creek.toml.");
+        process.exit(1);
+    }
+    const client = new CreekClient(getApiUrl(), token);
+    // Snapshot the current newest deployment so we can detect the one this
+    // command creates. createdAt is the cleanest marker — the version number
+    // also works but we don't need to parse it.
+    let previousLatestCreatedAt = 0;
+    try {
+        const existing = (await client.listDeployments(projectSlug));
+        previousLatestCreatedAt = existing.reduce((max, d) => Math.max(max, d.createdAt), 0);
+    }
+    catch (err) {
+        if (err instanceof CreekAuthError)
+            throw err;
+        if (jsonMode)
+            jsonOutput({ error: "not_found", message: err.message }, 1, NO_PROJECT_BREADCRUMBS);
+        consola.error(`Could not load deployments for project '${projectSlug}': ${err.message}`);
+        process.exit(1);
+    }
+    // Kick off the build
+    if (!jsonMode) {
+        section("Trigger");
+        consola.start(`  Triggering deploy of '${projectSlug}' from its GitHub connection...`);
+    }
+    let triggerResult;
+    try {
+        triggerResult = await client.deployFromGithub(projectSlug);
+    }
+    catch (err) {
+        const msg = err.message;
+        if (jsonMode)
+            jsonOutput({ error: "trigger_failed", message: msg }, 1, NO_PROJECT_BREADCRUMBS);
+        consola.error(`Trigger failed: ${msg}`);
+        process.exit(1);
+    }
+    if (!jsonMode) {
+        consola.success(`  Triggered (${triggerResult.branch} @ ${triggerResult.commitSha.slice(0, 7)})`);
+        section("Watch");
+    }
+    // Poll for the new deployment row, then follow its status until it settles.
+    // First phase: wait up to 20s for the row to appear (handlePush runs in
+    // waitUntil and may take a beat to insert).
+    const startedAt = Date.now();
+    const rowAppearDeadline = startedAt + 20_000;
+    const overallDeadline = startedAt + 15 * 60_000; // 15 min hard cap
+    let targetDeployment = null;
+    let lastStatus = null;
+    while (Date.now() < overallDeadline) {
+        let list;
+        try {
+            list = (await client.listDeployments(projectSlug));
+        }
+        catch (err) {
+            if (!jsonMode)
+                consola.warn(`  Poll failed: ${err.message}`);
+            await sleep(2000);
+            continue;
+        }
+        // Phase 1: find the new row. It's the newest deployment with a
+        // createdAt greater than our snapshot. triggerType should be 'github'
+        // but we don't require it (rollback/promote could race, but extremely
+        // unlikely in the narrow window between snapshot + poll).
+        if (!targetDeployment) {
+            const candidate = list
+                .filter((d) => d.createdAt > previousLatestCreatedAt)
+                .sort((a, b) => b.createdAt - a.createdAt)[0];
+            if (candidate) {
+                targetDeployment = candidate;
+                if (!jsonMode) {
+                    consola.info(`  v${candidate.version} ${candidate.branch ?? ""}`.trim());
+                }
+            }
+            else if (Date.now() > rowAppearDeadline) {
+                // 20s and no new row — handlePush must have errored before it could
+                // insert. Surface the timeout rather than hanging.
+                if (jsonMode)
+                    jsonOutput({ error: "no_deployment", message: "Deployment row did not appear within 20s. Check server logs." }, 1, NO_PROJECT_BREADCRUMBS);
+                consola.error("  Deployment row did not appear within 20s. Check control-plane logs.");
+                process.exit(1);
+            }
+            else {
+                await sleep(1500);
+                continue;
+            }
+        }
+        // Phase 2: follow the target row's status
+        const current = list.find((d) => d.id === targetDeployment.id);
+        if (!current) {
+            // Shouldn't happen — row was there a moment ago
+            await sleep(1500);
+            continue;
+        }
+        targetDeployment = current;
+        if (current.status !== lastStatus) {
+            lastStatus = current.status;
+            if (!jsonMode) {
+                if (CLI_IN_FLIGHT_STATUSES.has(current.status)) {
+                    consola.start(`  ${current.status}...`);
+                }
+            }
+        }
+        if (CLI_TERMINAL_STATUSES.has(current.status)) {
+            break;
+        }
+        await sleep(2000);
+    }
+    if (!targetDeployment) {
+        if (jsonMode)
+            jsonOutput({ error: "timeout", message: "Timed out waiting for deployment" }, 1, NO_PROJECT_BREADCRUMBS);
+        consola.error("Timed out waiting for deployment");
+        process.exit(1);
+    }
+    // Report the outcome
+    if (targetDeployment.status === "active") {
+        if (jsonMode) {
+            jsonOutput({
+                ok: true,
+                deploymentId: targetDeployment.id,
+                version: targetDeployment.version,
+                status: "active",
+                url: targetDeployment.url,
+            }, 0, NO_PROJECT_BREADCRUMBS);
+        }
+        else {
+            consola.success(`  Deployed v${targetDeployment.version}`);
+            if (targetDeployment.url)
+                consola.log(`  ${targetDeployment.url}`);
+        }
+        return;
+    }
+    // Failed / cancelled
+    const failureMsg = targetDeployment.errorMessage || `Deployment ${targetDeployment.status}`;
+    if (jsonMode) {
+        jsonOutput({
+            ok: false,
+            deploymentId: targetDeployment.id,
+            status: targetDeployment.status,
+            failedStep: targetDeployment.failedStep,
+            errorMessage: failureMsg,
+        }, 1, NO_PROJECT_BREADCRUMBS);
+    }
+    else {
+        consola.error(`  Deployment ${targetDeployment.status}${targetDeployment.failedStep ? ` at ${targetDeployment.failedStep}` : ""}: ${failureMsg}`);
+    }
+    process.exit(1);
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
 async function deployRepoUrl(input, options) {
     const { path: subpath, skipBuild, json: jsonMode } = options;
     try {

package/dist/commands/dev.js

@@ -58,6 +58,45 @@ export const devCommand = defineCommand({
             await server.stop();
             process.exit(1);
         }
+        // Interactive trigger commands (only if cron/queue configured)
+        if (config.cron.length > 0 || config.queue) {
+            const { createInterface } = await import("node:readline");
+            const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: false });
+            rl.on("line", async (line) => {
+                const input = line.trim();
+                if (!input)
+                    return;
+                if (input === "cron" && config.cron.length > 0) {
+                    try {
+                        await server.triggerScheduled();
+                        consola.success("Triggered scheduled()");
+                    }
+                    catch (e) {
+                        consola.error(`scheduled() error: ${e.message}`);
+                    }
+                    return;
+                }
+                if (input.startsWith("queue ") && config.queue) {
+                    const payload = input.slice(6).trim();
+                    let parsed = payload;
+                    try {
+                        parsed = JSON.parse(payload);
+                    }
+                    catch {
+                        // Not JSON, send as string
+                    }
+                    try {
+                        await server.sendQueueMessage(parsed);
+                        consola.success(`Sent message to queue()`);
+                    }
+                    catch (e) {
+                        consola.error(`queue() error: ${e.message}`);
+                    }
+                    return;
+                }
+                consola.warn(`Unknown command: ${input}`);
+            });
+        }
     },
 });
 //# sourceMappingURL=dev.js.map

package/dist/commands/queue.d.ts

@@ -0,0 +1,2 @@
+export declare const queueCommand: import("citty").CommandDef<import("citty").ArgsDef>;
+//# sourceMappingURL=queue.d.ts.map

package/dist/commands/queue.js

@@ -0,0 +1,92 @@
+import { defineCommand } from "citty";
+import consola from "consola";
+import { CreekClient, parseConfig } from "@solcreek/sdk";
+import { getToken, getApiUrl } from "../utils/config.js";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { globalArgs, resolveJsonMode, jsonOutput } from "../utils/output.js";
+function getProjectSlug() {
+    const configPath = join(process.cwd(), "creek.toml");
+    if (!existsSync(configPath)) {
+        consola.error("No creek.toml found. Run `creek init` first.");
+        process.exit(1);
+    }
+    return parseConfig(readFileSync(configPath, "utf-8")).project.name;
+}
+function getClient() {
+    const token = getToken();
+    if (!token) {
+        consola.error("Not authenticated. Run `creek login` first.");
+        process.exit(1);
+    }
+    return new CreekClient(getApiUrl(), token);
+}
+const queueSend = defineCommand({
+    meta: { name: "send", description: "Send a message to the project's queue" },
+    args: {
+        message: {
+            type: "positional",
+            description: "Message body (string, or use --json for JSON content)",
+            required: true,
+        },
+        parseJson: {
+            type: "boolean",
+            alias: "j",
+            description: "Parse message as JSON",
+            default: false,
+        },
+        project: {
+            type: "string",
+            description: "Project slug (defaults to current creek.toml)",
+        },
+        ...globalArgs,
+    },
+    async run({ args }) {
+        const jsonMode = resolveJsonMode(args);
+        const client = getClient();
+        const slug = args.project ?? getProjectSlug();
+        let payload = args.message;
+        if (args.parseJson) {
+            try {
+                payload = JSON.parse(args.message);
+            }
+            catch (err) {
+                if (jsonMode) {
+                    jsonOutput({ ok: false, error: "invalid_json", message: err instanceof Error ? err.message : String(err) }, 1, []);
+                }
+                consola.error(`Invalid JSON: ${err instanceof Error ? err.message : err}`);
+                process.exit(1);
+            }
+        }
+        try {
+            const result = await client.sendQueueMessage(slug, payload);
+            if (jsonMode) {
+                jsonOutput({ ok: true, project: slug, queueId: result.queueId }, 0, [
+                    { command: `creek deployments --project ${slug}`, description: "View deployment history" },
+                ]);
+            }
+            consola.success(`Sent message to ${slug} queue`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (jsonMode) {
+                jsonOutput({ ok: false, error: "send_failed", message: msg }, 1, [
+                    { command: `creek status --project ${slug}`, description: "Check project triggers" },
+                ]);
+            }
+            consola.error(`Failed to send: ${msg}`);
+            consola.info("Make sure your creek.toml has `queue = true` under [triggers] and the project is deployed.");
+            process.exit(1);
+        }
+    },
+});
+export const queueCommand = defineCommand({
+    meta: {
+        name: "queue",
+        description: "Send messages to the project's queue",
+    },
+    subCommands: {
+        send: queueSend,
+    },
+});
+//# sourceMappingURL=queue.js.map

package/dist/dev/server.d.ts

@@ -13,6 +13,10 @@ export declare class DevServer {
     private proxy;
     constructor(options: DevServerOptions);
     start(): Promise<void>;
+    /** Trigger the worker's scheduled() handler. */
+    triggerScheduled(): Promise<void>;
+    /** Send a message to the worker's queue() handler. */
+    sendQueueMessage(message: unknown): Promise<void>;
     stop(): Promise<void>;
 }
 //# sourceMappingURL=server.d.ts.map

package/dist/dev/server.js

@@ -47,6 +47,8 @@ export class DevServer {
                 realtimeUrl: `http://127.0.0.1:${this.realtimeServer.getPort()}`,
                 projectSlug: config.projectName,
                 vars: config.vars,
+                cron: config.cron,
+                queue: config.queue,
                 onRebuild: (ms) => {
                     consola.info(`Worker rebuilt in ${ms}ms`);
                 },
@@ -117,8 +119,38 @@ export class DevServer {
         }
         consola.info(`Realtime:  ws://localhost:${actualPort}`);
         consola.info(`Data:      .creek/dev/`);
+        if (config.cron.length > 0 || config.queue) {
+            const triggers = [];
+            if (config.cron.length > 0)
+                triggers.push(`${config.cron.length} cron`);
+            if (config.queue)
+                triggers.push("queue");
+            consola.info(`Triggers:  ${triggers.join(", ")}`);
+        }
         console.log("");
         consola.success(`Ready in ${elapsed}ms`);
+        if (config.cron.length > 0 || config.queue) {
+            console.log("");
+            consola.info("Trigger commands (type and press Enter):");
+            if (config.cron.length > 0) {
+                consola.info("  cron                      Trigger scheduled() handler");
+            }
+            if (config.queue) {
+                consola.info('  queue <message>           Send a message to queue() handler');
+            }
+        }
+    }
+    /** Trigger the worker's scheduled() handler. */
+    async triggerScheduled() {
+        if (!this.workerRunner)
+            throw new Error("Worker not running");
+        await this.workerRunner.triggerScheduled();
+    }
+    /** Send a message to the worker's queue() handler. */
+    async sendQueueMessage(message) {
+        if (!this.workerRunner)
+            throw new Error("Worker not running");
+        await this.workerRunner.sendQueueMessage(message);
     }
     async stop() {
         // Stop in reverse order

package/dist/dev/worker-runner.d.ts

@@ -16,6 +16,10 @@ export interface WorkerRunnerOptions {
     vars?: Record<string, string>;
     /** Whether the project has client assets (Worker + SPA hybrid). */
     hasClientAssets?: boolean;
+    /** Cron schedules from creek.toml [triggers].cron */
+    cron?: string[];
+    /** Whether project uses a queue (auto-provisions a local queue) */
+    queue?: boolean;
     /** Callback when worker is rebuilt. */
     onRebuild?: (durationMs: number) => void;
     /**
@@ -42,6 +46,10 @@ export declare class WorkerRunner {
     /** Dispatch a fetch request to the worker (via Miniflare). */
     dispatchFetch(input: string, init?: RequestInit): Promise<Response>;
     private buildMiniflareOptions;
+    /** Trigger the scheduled() handler manually (for local cron simulation). */
+    triggerScheduled(scheduledTime?: number, cron?: string): Promise<Response>;
+    /** Send a message to the local queue (consumed by the worker's queue() handler). */
+    sendQueueMessage(message: unknown): Promise<void>;
     private get esbuildOptions();
     private bundle;
     private startWatching;

package/dist/dev/worker-runner.js

@@ -124,8 +124,37 @@ export class WorkerRunner {
             opts.r2Buckets = { [r2BindingName]: "creek-dev-r2" };
             opts.r2Persist = persistDir ? join(persistDir, "r2") : false;
         }
+        // Queue (producer + consumer wired to the same worker)
+        if (this.options.queue) {
+            opts.queueProducers = { QUEUE: "creek-dev-queue" };
+            opts.queueConsumers = {
+                "creek-dev-queue": {
+                    maxBatchSize: 10,
+                    maxBatchTimeout: 1,
+                    maxRetries: 3,
+                },
+            };
+        }
         return opts;
     }
+    /** Trigger the scheduled() handler manually (for local cron simulation). */
+    async triggerScheduled(scheduledTime = Date.now(), cron = "* * * * *") {
+        if (!this.mf)
+            throw new Error("WorkerRunner not started");
+        const worker = await this.mf.getWorker();
+        const url = `http://placeholder/cdn-cgi/handler/scheduled?time=${scheduledTime}&cron=${encodeURIComponent(cron)}`;
+        return worker.fetch(url);
+    }
+    /** Send a message to the local queue (consumed by the worker's queue() handler). */
+    async sendQueueMessage(message) {
+        if (!this.mf)
+            throw new Error("WorkerRunner not started");
+        if (!this.options.queue) {
+            throw new Error("Queue is not enabled. Add `queue = true` to [triggers] in creek.toml.");
+        }
+        const queue = await this.mf.getQueueProducer("QUEUE");
+        await queue.send(message);
+    }
     get esbuildOptions() {
         return {
             absWorkingDir: this.options.cwd,

package/dist/index.js

@@ -17,6 +17,7 @@ import { statusCommand } from "./commands/status.js";
 import { devCommand } from "./commands/dev.js";
 import { rollbackCommand } from "./commands/rollback.js";
 import { opsCommand } from "./commands/ops.js";
+import { queueCommand } from "./commands/queue.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const cliPkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));
 // Read version from the "creek" facade package (what users install),
@@ -47,6 +48,7 @@ const main = defineCommand({
         init: initCommand,
         claim: claimCommand,
         env: envCommand,
+        queue: queueCommand,
         domains: domainsCommand,
         rollback: rollbackCommand,
         ops: opsCommand,

package/dist/utils/nextjs.d.ts

@@ -2,9 +2,10 @@
  * Next.js-specific build utilities for Creek CLI.
  *
  * Two build paths:
- * - **Adapter path** (Next.js >= 16.2): Uses @solcreek/adapter-nextjs via
+ * - **Adapter path** (Next.js >= 16.2.3): Uses @solcreek/adapter-creek via
  *   NEXT_ADAPTER_PATH. Zero workarounds, typed outputs, direct esbuild bundle.
- * - **Legacy path** (Next.js < 16.2): Uses @opennextjs/cloudflare with
+ *   Min version reflects the adapter's peerDependency (CVE-2026-23869).
+ * - **Legacy path** (Next.js < 16.2.3): Uses @opennextjs/cloudflare with
  *   workarounds (standalone patch, middleware manifest inline, etc.)
  *
  * The CLI auto-detects the Next.js version and picks the right path.
@@ -14,8 +15,11 @@ export declare function getNextVersion(cwd: string): string | null;
 /**
  * Unified Next.js build entry point.
  *
- * - Next.js >= 16.2: Creek adapter path (recommended)
- * - Next.js < 16.2: legacy opennext path (best effort)
+ * - Next.js >= 16.2.3: Creek adapter path (recommended)
+ * - Next.js < 16.2.3: legacy opennext path (best effort)
+ *
+ * Min version for the adapter path matches @solcreek/adapter-creek's
+ * peerDependency, which pins Next.js >= 16.2.3 to fix CVE-2026-23869.
  */
 export declare function buildNextjs(cwd: string, isMonorepo: boolean, projectName?: string): void;
 /** Check if the adapter output exists (vs legacy opennext output). */

package/dist/utils/nextjs.js

@@ -2,9 +2,10 @@
  * Next.js-specific build utilities for Creek CLI.
  *
  * Two build paths:
- * - **Adapter path** (Next.js >= 16.2): Uses @solcreek/adapter-nextjs via
+ * - **Adapter path** (Next.js >= 16.2.3): Uses @solcreek/adapter-creek via
  *   NEXT_ADAPTER_PATH. Zero workarounds, typed outputs, direct esbuild bundle.
- * - **Legacy path** (Next.js < 16.2): Uses @opennextjs/cloudflare with
+ *   Min version reflects the adapter's peerDependency (CVE-2026-23869).
+ * - **Legacy path** (Next.js < 16.2.3): Uses @opennextjs/cloudflare with
  *   workarounds (standalone patch, middleware manifest inline, etc.)
  *
  * The CLI auto-detects the Next.js version and picks the right path.
@@ -39,7 +40,7 @@ function semverGte(version, target) {
     return aPat >= bPat;
 }
 /**
- * Build a Next.js app using the Creek adapter (>= 16.2).
+ * Build a Next.js app using the Creek adapter (>= 16.2.3).
  *
  * Sets NEXT_ADAPTER_PATH to the adapter bundled with the CLI.
  * No opennext, no wrangler, no config patching — the adapter handles
@@ -57,7 +58,7 @@ function resolveAdapterPath() {
 function buildWithAdapter(cwd) {
     const adapterPath = resolveAdapterPath();
     if (!adapterPath) {
-        consola.warn("  @solcreek/adapter-nextjs not found — install it for optimal Next.js builds");
+        consola.warn("  @solcreek/adapter-creek not found — install it for optimal Next.js builds");
         return; // caller falls back to legacy
     }
     consola.start("  Building Next.js with Creek adapter...\n");
@@ -72,12 +73,15 @@ function buildWithAdapter(cwd) {
 /**
  * Unified Next.js build entry point.
  *
- * - Next.js >= 16.2: Creek adapter path (recommended)
- * - Next.js < 16.2: legacy opennext path (best effort)
+ * - Next.js >= 16.2.3: Creek adapter path (recommended)
+ * - Next.js < 16.2.3: legacy opennext path (best effort)
+ *
+ * Min version for the adapter path matches @solcreek/adapter-creek's
+ * peerDependency, which pins Next.js >= 16.2.3 to fix CVE-2026-23869.
  */
 export function buildNextjs(cwd, isMonorepo, projectName) {
     const version = getNextVersion(cwd);
-    const useAdapter = version && semverGte(version, "16.2.0") && resolveAdapterPath();
+    const useAdapter = version && semverGte(version, "16.2.3") && resolveAdapterPath();
     if (useAdapter) {
         buildWithAdapter(cwd);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solcreek/cli",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "CLI for the Creek deployment platform",
   "type": "module",
   "main": "./dist/index.js",
@@ -8,14 +8,9 @@
     "dist",
     "!dist/**/*.test.*",
     "!dist/**/*.map",
+    "CHANGELOG.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist"
-  },
   "keywords": [
     "creek",
     "cli",
@@ -32,14 +27,14 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@solcreek/sdk": "workspace:*",
     "ajv": "^8.17.1",
     "citty": "^0.1.6",
     "consola": "^3.4.2",
     "esbuild": "^0.25.0",
     "miniflare": "^4.20260317.3",
     "smol-toml": "^1.3.1",
-    "ws": "^8.20.0"
+    "ws": "^8.20.0",
+    "@solcreek/sdk": "0.4.1"
   },
   "devDependencies": {
     "@testing-library/dom": "^10.4.1",
@@ -53,5 +48,11 @@
     "react-dom": "^19.2.4",
     "typescript": "^5.8.2",
     "vite": "^6.3.5"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
   }
-}
+}