create-basalt 1.12.0 → 1.13.0

package/README.md

@@ -273,7 +273,11 @@ newest release **on the app's current major** (a newer major is listed as
 `minimumReleaseAge`, read from the project's `pnpm-workspace.yaml` when set) is
 left for later so the install cannot refuse it. When a framework release
 declares a peer range the app would not meet (say `zod ^5` while zod is held on
-4), the plan warns before anything is written.
+4), the plan warns before anything is written. When a framework release
+requires an `@basaltkit/*` peer the app does not list (`@basaltkit/testing` 3
+takes `@basaltkit/mailer`), the plan adds it at its latest version (in
+`dependencies` when a runtime dependency needs it, else `devDependencies`), or
+warns when it cannot; optional peers are never added.
 
 Both `package.json` and `web/package.json` are updated, **in place**: only the
 version strings change — order, indentation and range style (`^`, `~`, exact)
@@ -466,7 +470,7 @@ Detects the manager that invoked the command from `npm_config_user_agent` (or th
 | --- | --- |
 | `runProjectCommand(argv, deps)` | Runs `update`/`add`/`doctor`/`info` and returns the exit code; every side effect (output, prompts, package-manager runs, registry fetch, codemods) is injected through `deps` |
 | `loadProject(dir, pm?)` | Reads an app: package.json (+ `web/`), manifest, detected features and package manager. Throws `NotABasaltAppError` |
-| `planUpdate(ctx, { major?, only?, tooling?, registry? })` | The update plan — entries, the full before/after of every file, tooling, warnings, framework majors. Writes nothing |
+| `planUpdate(ctx, { major?, only?, tooling?, registry? })` | The update plan — entries, the full before/after of every file, tooling, warnings, framework majors, required peers it adds (`addedPeers`). Writes nothing |
 | `planAdd(ctx, feature, { force?, resolveLatest?, registry? })` | The add plan — created/merged/skipped files and manual steps. Writes nothing |
 | `runDoctor(ctx, options)` | Doctor findings (`{ level: 'ok' \| 'info' \| 'warn' \| 'error', area, message }`) |
 | `MANIFEST_PATH`, `readManifest(dir)`, `hashContent(text)` | The scaffold manifest |

package/dist/latest-versions.d.ts

@@ -114,6 +114,8 @@ export interface LatestInfo {
     latest?: string;
     /** `peerDependencies` declared by that latest version. */
     peers: Record<string, string>;
+    /** The peers its `peerDependenciesMeta` marks optional (absent: none). */
+    optionalPeers?: string[];
     /**
      * Release age of `latest` against the window: `mature` (provably older, or
      * not probed), `recent` (inside the window) or `unknown` (could not prove it).

package/dist/latest-versions.js

@@ -153,6 +153,15 @@ function peersOf(body) {
     }
     return peers;
 }
+/** The peers `peerDependenciesMeta` marks `optional: true`. */
+function optionalPeersOf(body) {
+    const raw = body?.peerDependenciesMeta;
+    if (!raw || typeof raw !== 'object')
+        return [];
+    return Object.entries(raw)
+        .filter(([, meta]) => typeof meta === 'object' && meta !== null && meta.optional === true)
+        .map(([name]) => name);
+}
 async function lookupLatest(fetchImpl, registry, name, signal) {
     try {
         const response = await fetchImpl(latestUrl(registry, name), {
@@ -165,7 +174,9 @@ async function lookupLatest(fetchImpl, registry, name, signal) {
             return 'miss';
         const body = (await response.json());
         const version = body?.version;
-        return typeof version === 'string' && STABLE_SEMVER.test(version) ? { version, peers: peersOf(body) } : 'miss';
+        return typeof version === 'string' && STABLE_SEMVER.test(version)
+            ? { version, peers: peersOf(body), optionalPeers: optionalPeersOf(body) }
+            : 'miss';
     }
     catch {
         // Network error, per-request timeout, or malformed JSON.
@@ -223,7 +234,7 @@ export async function lookupLatestVersions(names, shouldProbe, options = {}) {
                 const age = windowMs === 0 || !shouldProbe(name, found.version)
                     ? 'mature'
                     : await probeAge(fetchImpl, registry, name, windowMs, now, AbortSignal.any([AbortSignal.timeout(timeoutMs), overall.signal]));
-                results.set(name, { latest: found.version, peers: found.peers, age });
+                results.set(name, { latest: found.version, peers: found.peers, optionalPeers: found.optionalPeers, age });
             }
         };
         const pool = Math.max(1, Math.min(options.concurrency ?? CONCURRENCY, names.length));

package/dist/project/update.d.ts

@@ -76,6 +76,17 @@ export interface UpdatePlan {
         to: string;
         changelog: string;
     }[];
+    /**
+     * Required `@basaltkit/*` peers of the framework releases the app ends up on
+     * that its package.json did not list (testing 3 takes mailer): added at their
+     * latest version, in `dependencies` when a runtime dependency needs them.
+     */
+    addedPeers: {
+        name: string;
+        range: string;
+        section: 'dependencies' | 'devDependencies';
+        requiredBy: string[];
+    }[];
     registry: string;
 }
 export interface UpdateOptions {

package/dist/project/update.js

@@ -277,6 +277,50 @@ export async function planUpdate(ctx, options = {}) {
             }
         }
     }
+    // A required @basaltkit peer the app never declared: pnpm and npm may
+    // auto-install it, but yarn PnP, `auto-install-peers=false` or
+    // `--legacy-peer-deps` do not, and `doctor` checks installed versions, not
+    // the manifest. Add it at its latest version; when that is impossible
+    // (registry, release-age window, out of range), say so.
+    const declared = new Set(entries.filter((entry) => entry.file === 'package.json').map((entry) => entry.name));
+    const missing = new Map();
+    for (const entry of entries) {
+        if (!entry.framework || (entry.status !== 'update' && entry.status !== 'current') || entry.file !== 'package.json')
+            continue;
+        const info = results.get(entry.name);
+        for (const [peer, wanted] of Object.entries(info?.peers ?? {})) {
+            if (!isFramework(peer) || declared.has(peer) || info?.optionalPeers?.includes(peer))
+                continue;
+            const prior = missing.get(peer);
+            const section = entry.section === 'dependencies' || prior?.section === 'dependencies' ? 'dependencies' : 'devDependencies';
+            const requiredBy = [...(prior?.requiredBy ?? []), `${entry.name}@${info?.latest}`];
+            missing.set(peer, { wanted: prior?.wanted ?? wanted, requiredBy: [...new Set(requiredBy)], section });
+        }
+    }
+    const addedPeers = [];
+    if (missing.size > 0) {
+        const peerLookup = await lookupLatestVersions([...missing.keys()].sort(), (name) => !exempt(name), {
+            ...options.registry,
+            minimumReleaseAge: window,
+        });
+        const additions = { dependencies: {}, devDependencies: {} };
+        for (const [peer, need] of missing) {
+            const found = peerLookup.results.get(peer);
+            if (found?.latest !== undefined && found.age === 'mature' && satisfies(found.latest, need.wanted) === true) {
+                const range = `^${found.latest}`;
+                additions[need.section][peer] = range;
+                addedPeers.push({ name: peer, range, section: need.section, requiredBy: need.requiredBy });
+            }
+            else {
+                warnings.push(`${need.requiredBy.join(', ')} requires ${peer} ${need.wanted}, which package.json does not list — add it (${ctx.pm} add ${need.section === 'devDependencies' ? '-D ' : ''}${peer})`);
+            }
+        }
+        if (addedPeers.length > 0) {
+            const merged = mergePackageJson(files['package.json']?.after ?? ctx.packageJsonText, additions);
+            if (merged.changes.length > 0)
+                files['package.json'] = { before: ctx.packageJsonText, after: merged.text };
+        }
+    }
     const failed = entries.filter((entry) => entry.status === 'failed').map((entry) => entry.name);
     if (failed.length > 0)
         warnings.push(`The registry did not answer for ${[...new Set(failed)].join(', ')} — left unchanged.`);
@@ -289,7 +333,7 @@ export async function planUpdate(ctx, options = {}) {
         changelog: changelogUrl(entry.name),
     }))
         .filter((major, i, all) => all.findIndex((other) => other.name === major.name) === i);
-    return { entries, updates, files, tooling: toolingNotes, manual, warnings, majors, registry };
+    return { entries, updates, files, tooling: toolingNotes, manual, warnings, majors, addedPeers, registry };
 }
 /** The plan as terminal lines: the update table, then notes, tooling, warnings and majors. */
 export function renderUpdatePlan(plan, colors) {
@@ -328,6 +372,12 @@ export function renderUpdatePlan(plan, colors) {
             lines.push(`  ${major.name} ${major.from} → ${major.to}: ${major.changelog}`);
         lines.push(`  Upgrade notes: ${DOCS_UPGRADING_URL}`);
     }
+    if (plan.addedPeers.length > 0) {
+        lines.push('', colors.bold('Required peers the app did not list (added):'));
+        for (const peer of plan.addedPeers) {
+            lines.push(`  ${colors.cyan(peer.name)} ${peer.range} (${peer.section}) — required by ${peer.requiredBy.join(', ')}`);
+        }
+    }
     if (plan.tooling.length > 0) {
         lines.push('', colors.bold('Project tooling:'));
         for (const note of plan.tooling)

package/dist/templates.d.ts

@@ -20,8 +20,8 @@ export { basaltBin } from './bin-template.js';
 export { SCAFFOLD_VERSIONS } from './versions.js';
 export { THIRD_PARTY_VERSIONS } from './latest-versions.js';
 /**
- * The dependency range for a @basaltkit/* package: the current release line
- * (`^<major>.<minor>.0`) of its workspace version, from the generated
+ * The dependency range for a @basaltkit/* package: its workspace version as
+ * the floor (`^<major>.<minor>.<patch>`), from the generated
  * {@link SCAFFOLD_VERSIONS} map. Throws for an unknown package rather than
  * guessing a range — a stale guess once pinned new apps to frozen 1.x lines.
  */

package/dist/templates.js

@@ -5,8 +5,8 @@ export { basaltBin } from './bin-template.js';
 export { SCAFFOLD_VERSIONS } from './versions.js';
 export { THIRD_PARTY_VERSIONS } from './latest-versions.js';
 /**
- * The dependency range for a @basaltkit/* package: the current release line
- * (`^<major>.<minor>.0`) of its workspace version, from the generated
+ * The dependency range for a @basaltkit/* package: its workspace version as
+ * the floor (`^<major>.<minor>.<patch>`), from the generated
  * {@link SCAFFOLD_VERSIONS} map. Throws for an unknown package rather than
  * guessing a range — a stale guess once pinned new apps to frozen 1.x lines.
  */
@@ -104,6 +104,10 @@ export function packageJson(options) {
     }
     const devDependencies = {
         '@basaltkit/testing': versionOf('@basaltkit/testing'),
+        // @basaltkit/testing's peer: fakeMailer() binds the app's own MAILER token,
+        // so the copy must be the app's (a package manager that skips peers would
+        // otherwise leave `@basaltkit/testing` unable to load).
+        '@basaltkit/mailer': versionOf('@basaltkit/mailer'),
         // The project commands (\`pnpm basalt update | add | doctor | info\`) — dev
         // tooling with no dependencies of its own, never imported by the app.
         'create-basalt': versionOf('create-basalt'),
@@ -725,9 +729,17 @@ model AuthApiKey {
   expiresAt  DateTime?
   lastUsedAt DateTime?
   revokedAt  DateTime?
+  // 3.0: API key lifecycle (migration \`add_api_key_lifecycle\`).
+  serviceId             String?
+  previousHash          String?   @unique
+  previousHashExpiresAt DateTime?
+  rotatedAt             DateTime?
+  allowedIps            String[]  @default([])
+  meta                  Json?
 
   @@index([tenantId])
   @@index([userId])
+  @@index([serviceId])
   @@map("auth_api_keys")
 }
 

package/dist/versions.js

@@ -1,29 +1,31 @@
 // GENERATED by scripts/sync-versions.mjs (runs before every build) — do not edit.
 // The dependency range a new app gets for each @basaltkit/* package: the
-// current release line (^<major>.<minor>.0) of the workspace version.
+// workspace version as the floor (^<major>.<minor>.<patch>), so a new app never
+// resolves an older patch of the same line.
 export const SCAFFOLD_VERSIONS = {
     '@basaltkit/admin': '^2.0.0',
-    '@basaltkit/admin-shadcn': '^1.1.0',
+    '@basaltkit/admin-shadcn': '^1.1.1',
     '@basaltkit/ai-mcp': '^0.4.0',
-    '@basaltkit/auth': '^4.2.0',
-    '@basaltkit/auth-prisma': '^2.1.0',
-    '@basaltkit/cli': '^1.4.0',
-    '@basaltkit/config': '^1.1.0',
+    '@basaltkit/auth': '^5.0.0',
+    '@basaltkit/auth-prisma': '^3.0.0',
+    '@basaltkit/cli': '^1.4.1',
+    '@basaltkit/config': '^1.1.2',
     '@basaltkit/core': '^1.6.0',
-    '@basaltkit/env': '^3.1.0',
+    '@basaltkit/env': '^3.1.1',
     '@basaltkit/events': '^1.3.0',
-    '@basaltkit/fastify': '^2.6.0',
+    '@basaltkit/fastify': '^3.0.0',
     '@basaltkit/generator': '^1.6.0',
     '@basaltkit/logger': '^1.3.0',
-    '@basaltkit/mcp': '^5.1.0',
-    '@basaltkit/prisma': '^3.1.0',
+    '@basaltkit/mailer': '^2.1.0',
+    '@basaltkit/mcp': '^6.0.0',
+    '@basaltkit/prisma': '^4.0.0',
     '@basaltkit/sdk': '^2.1.0',
-    '@basaltkit/subscriptions': '^5.0.0',
-    '@basaltkit/subscriptions-prisma': '^3.0.0',
-    '@basaltkit/teams': '^4.1.0',
+    '@basaltkit/subscriptions': '^6.0.0',
+    '@basaltkit/subscriptions-prisma': '^4.0.0',
+    '@basaltkit/teams': '^4.1.1',
     '@basaltkit/teams-prisma': '^1.1.0',
-    '@basaltkit/tenancy': '^3.2.0',
-    '@basaltkit/tenancy-prisma': '^2.1.0',
-    '@basaltkit/testing': '^2.0.0',
-    'create-basalt': '^1.12.0',
+    '@basaltkit/tenancy': '^4.0.0',
+    '@basaltkit/tenancy-prisma': '^3.0.0',
+    '@basaltkit/testing': '^3.0.0',
+    'create-basalt': '^1.13.0',
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-basalt",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "engines": {
     "node": ">=22.5.0"
   },
@@ -32,26 +32,26 @@
     "typescript": "^7.0.2",
     "vitest": "^5.0.1",
     "zod": "^4.6.5",
-    "@basaltkit/auth": "^4.2.0",
-    "@basaltkit/auth-prisma": "^2.1.0",
-    "@basaltkit/cli": "^1.4.0",
+    "@basaltkit/auth-prisma": "^3.0.0",
+    "@basaltkit/cli": "^1.4.1",
+    "@basaltkit/config": "^1.1.2",
     "@basaltkit/core": "^1.6.0",
+    "@basaltkit/auth": "^5.0.0",
     "@basaltkit/events": "^1.3.0",
-    "@basaltkit/fastify": "^2.6.0",
-    "@basaltkit/config": "^1.1.2",
+    "@basaltkit/env": "^3.1.1",
+    "@basaltkit/fastify": "^3.0.0",
+    "@basaltkit/mcp": "^6.0.0",
+    "@basaltkit/prisma": "^4.0.0",
     "@basaltkit/generator": "^1.6.0",
     "@basaltkit/logger": "^1.3.0",
-    "@basaltkit/env": "^3.1.1",
-    "@basaltkit/mcp": "^5.1.0",
-    "@basaltkit/prisma": "^3.1.0",
-    "@basaltkit/subscriptions": "^5.0.0",
-    "@basaltkit/subscriptions-prisma": "^3.0.0",
-    "@basaltkit/teams": "^4.1.0",
-    "@basaltkit/tenancy": "^3.2.0",
+    "@basaltkit/subscriptions": "^6.0.0",
+    "@basaltkit/subscriptions-prisma": "^4.0.0",
+    "@basaltkit/teams": "^4.1.1",
     "@basaltkit/teams-prisma": "^1.1.0",
-    "@basaltkit/tenancy-prisma": "^2.1.0",
-    "@basaltkit/tsconfig": "^0.24.0",
-    "@basaltkit/testing": "^2.0.3"
+    "@basaltkit/tenancy": "^4.0.0",
+    "@basaltkit/tenancy-prisma": "^3.0.0",
+    "@basaltkit/testing": "^3.0.0",
+    "@basaltkit/tsconfig": "^0.24.0"
   },
   "publishConfig": {
     "access": "public"