gipity 1.0.422 → 1.0.424

package/dist/knowledge.js

@@ -37,9 +37,9 @@ Kits are reusable building blocks added to an existing app, not whole templates
     - \`gipity add chatbot\` - Drop-in chatbot - configurable persona, scope guardrails, static knowledge (20k budget), streaming responses. Headless engine + bubble widget; bring your own UI if you want. Works in any app.
     - \`gipity add audio-align\` - Audio + lyrics -> word-level timing JSON. Demucs vocal isolation + MMS_FA forced alignment, runs as a Modal L4 GPU job (~$0.01 per 3-min song). For karaoke captions, subtitling, language learning, dubbing alignment.
     - \`gipity add i18n\` - Multi-language for web apps - language picker, locale persistence, RTL, plural/translation lookup. Scaffolds src/js/strings.js and wires it up; move your copy there and read it with t('key'). Web only.
-    - \`gipity add records\` - Registry-driven records: declare objects/fields as data, get generic CRUD functions with validation, full-text search, soft delete, ACTOR provenance, and an audit event spine - every write is transactional (row + event). Field types include relations ({id,label}), currency, emails/phones/links composites. Ships backend functions + migrations. Needs a database (web-fullstack/api template).
-    - \`gipity add views\` - Generic UI over records-kit objects: sortable/filterable table with full-text search, create/edit/delete forms with type-appropriate widgets, kanban board with drag-to-update. Renders entirely from the field registry - zero per-object UI code. Requires the records kit.
-    - \`gipity add agent-api\` - Make your app agent-operable: named API keys (kit_api_keys) let agents and scripts write through the records kit's single write path with AGENT/API actor attribution - machine writes land on the same audit spine as human edits. Requires the records kit.
+    - \`gipity add records\` - Registry-driven records: declare objects/fields as data, get generic CRUD functions with validation, full-text search, soft delete, ACTOR provenance, and an audit event spine - every write is transactional (row + event). Field types include relations ({id,label}), currency, emails/phones/links composites. Ships backend functions + migrations. Needs a database (web-fullstack/api template). See the \`app-records\` skill.
+    - \`gipity add views\` - Generic UI over records-kit objects: sortable/filterable table with full-text search, create/edit/delete forms with type-appropriate widgets, kanban board with drag-to-update. Renders entirely from the field registry - zero per-object UI code. Requires the records kit. See the \`app-records\` skill.
+    - \`gipity add agent-api\` - Make your app agent-operable: named API keys (kit_api_keys) let agents and scripts write through the records kit's single write path with AGENT/API actor attribution - machine writes land on the same audit spine as human edits. Requires the records kit. See the \`app-records\` skill.
     - \`gipity add contacts\` - Source-agnostic contact data layer for lead-gen/CRM apps: import people from LinkedIn CSV + Gmail + pasted lists, resolve duplicates into one person while keeping EVERY value from every source with provenance (multi-valued attributes, never overwrites). Exact email/URL auto-merge; fuzzy name+company goes to a human merge-review queue (reversible). Re-imports detect job changes and emit signals. User-definable tags, full-text search, and a transactional event spine. Ships backend functions + migrations. Needs a database (web-fullstack/api template).
     - \`gipity add stripe\` - Charge your app's end-users for one-time purchases and subscriptions via Stripe. Owner connects their own Stripe account through Gipity-hosted onboarding (no API keys to paste); money lands in their account, Gipity takes a small platform fee. Ships a buy-button / pricing component, a subscription-status helper for gating UI, a webhook-verified fulfillment function, and the payments/subscriptions tables. The platform brokers checkout + signature-verified webhooks. Needs a database (web-fullstack/api template).
     - \`gipity add notify\` - Web push notifications for any web app, including iOS home-screen web apps (iOS 16.4+). The platform owns the VAPID keys, encryption, and delivery — no keys to paste, no crypto, no server. Ships a <gipity-notify-button>, a service worker, and a PWA manifest; the device subscribes itself and self-heals stale subscriptions. Send from a function with the injected notify() service (one flat credit per send, owner-billed) or test with \`gipity notify test\`. Works in any template — no database required.`;
@@ -88,7 +88,7 @@ Prefer a live Gipity URL over an ephemeral artifact. When you'd otherwise reach
 
 The full "when to add a template" rule and the definition of done are spelled out in the two sections at the end of this document. In short: if the user wants something deployable (web app, game, API), \`gipity add <template>\` first (default \`web-simple\`); for a one-off task (analysis, PDFs, data work), use \`gipity sandbox run\` instead; to add a reusable building block to an existing app (e.g. multiplayer), \`gipity add <kit>\`.
 
-Build loop: \`gipity add\` → edit files → \`gipity deploy dev\` → \`gipity page inspect <url>\` → fix any errors → repeat until the definition of done is met.
+Build loop: \`gipity add\` → edit files → \`gipity deploy dev --inspect\` → fix any errors → repeat until the definition of done is met. \`deploy --inspect\` deploys and then runs the page-inspect report on the live URL in one command; use a standalone \`gipity page inspect <url>\` only when re-checking without deploying.
 
 \`add\` writes real files to disk - Read a scaffolded file before your first Write/Edit to it, or the call fails \`"File has not been read yet"\`. Don't rewrite from memory of the template.
 
@@ -193,6 +193,7 @@ App development skills:
 - \`web-ui-patterns\` - default Gipity look (theme tokens) + web UI recipes - feeds, copy-to-clipboard
 
 Kit skills (reusable building blocks - \`gipity add <kit>\`):
+- \`app-records\` - the records + views kits: registry-driven CRUD with search + audit history, and generated tables/kanban/forms (gipity add records)
 - \`audio-align\` - the audio-align kit: forced alignment of audio + lyrics into word-level timing JSON
 - \`chatbot\` - the chatbot kit: persona + scope guardrails + static knowledge, bubble widget or headless engine
 
@@ -202,7 +203,7 @@ Other key skills:
 - \`tts\` - agent-side speech tools (different from the \`app-tts\` HTTP service)`;
 export const DEFINITION_OF_DONE = `## Definition of done (build tasks)
 1. \`gipity deploy dev\` succeeds and you have a live URL.
-2. \`gipity page inspect <url>\` returns no console errors and the page loads (HTTP 200, no blank screen).
+2. \`gipity page inspect <url>\` returns no console errors and the page loads (HTTP 200, no blank screen). (\`gipity deploy dev --inspect\` covers 1 and 2 in one command.)
 3. For apps with functions: \`gipity test\` passes.
 4. Non-rendered files the task called for (\`llms.txt\`, \`AGENTS.md\`, \`SKILL.md\`, \`robots.txt\`, served JSON, etc.): \`page inspect\` only sees rendered HTML, so verify them with \`gipity page fetch <url> <files...>\`. It flags any that 404 or come back as the static-host shell (a missing file is served as \`index.html\` with a 200, so a bare status check would pass) and checks each \`content-type\`.
 5. You told the user the live URL.

package/dist/sync.js

@@ -664,6 +664,35 @@ export function effectiveIgnore(root, configIgnore) {
     const base = configIgnore && configIgnore.length ? configIgnore : DEFAULT_SYNC_IGNORE;
     return [...base, GIPITY_IGNORE_FILE, ...readGipityIgnore(root)];
 }
+/** Fast, LOCAL-ONLY dirtiness probe: true when every local file matches its
+ *  baseline entry by size+mtime and nothing was added or deleted since the
+ *  last sync. Lets pre-action syncs (deploy) skip their server round trip:
+ *  deploy reads server-side (VFS) state, so with nothing to push the sync
+ *  adds no correctness, only latency. Conservative on purpose - any size or
+ *  mtime movement reads as dirty (no hashing here), never-synced projects
+ *  read as dirty, and callers then run the real sync(). */
+export function isLocalTreeClean() {
+    try {
+        const config = requireConfig();
+        const root = projectDir();
+        const baseline = readBaseline(config.projectGuid);
+        if (!baseline.lastFullSync)
+            return false;
+        const local = walkLocal(root, effectiveIgnore(root, config.ignore), baseline.files);
+        const baselineFiles = baseline.files;
+        if (local.size !== Object.keys(baselineFiles).length)
+            return false;
+        for (const [path, info] of local) {
+            const prior = baselineFiles[path];
+            if (!prior || prior.size !== info.size || prior.mtime !== info.mtime)
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function sync(opts = {}) {
     const config = requireConfig();
     const root = projectDir();

package/dist/updater/check.js

@@ -1,101 +1,176 @@
 #!/usr/bin/env node
-// Background updater. Invoked detached by the shim; can also be invoked
-// directly by `gipity update --force`.
-import { appendFileSync, existsSync } from 'fs';
-import { LOCAL_DIR, LOCAL_ENTRY, UPDATE_LOG, readState, writeState, updatesDisabled } from './state.js';
-import { resolveCommand, spawnSyncCommand } from '../platform.js';
-const CHECK_INTERVAL_MS = 4 * 60 * 60 * 1000; // 4 hours
+import { createRequire as __cliCreateRequire } from 'module';
+const require = __cliCreateRequire(import.meta.url);
+
+// src/updater/check.ts
+import { appendFileSync, existsSync as existsSync2 } from "fs";
+
+// src/updater/state.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var GIPITY_DIR = join(homedir(), ".gipity");
+var LOCAL_DIR = join(GIPITY_DIR, "local");
+var LOCAL_PKG_DIR = join(LOCAL_DIR, "node_modules", "gipity");
+var LOCAL_ENTRY = join(LOCAL_PKG_DIR, "dist", "index.js");
+var STATE_FILE = join(GIPITY_DIR, "update-state.json");
+var SETTINGS_FILE = join(GIPITY_DIR, "settings.json");
+var UPDATE_LOG = join(GIPITY_DIR, "update.log");
+var DEFAULT_STATE = {
+  installedVersion: null,
+  lastCheckAt: 0,
+  lastError: null,
+  updateChannel: "stable"
+};
+var DEFAULT_SETTINGS = {
+  autoUpdates: true
+};
+function ensureDir() {
+  mkdirSync(GIPITY_DIR, { recursive: true });
+}
+function readState() {
+  if (!existsSync(STATE_FILE)) return { ...DEFAULT_STATE };
+  try {
+    return { ...DEFAULT_STATE, ...JSON.parse(readFileSync(STATE_FILE, "utf-8")) };
+  } catch {
+    return { ...DEFAULT_STATE };
+  }
+}
+function writeState(state) {
+  ensureDir();
+  writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+}
+function readSettings() {
+  if (!existsSync(SETTINGS_FILE)) return { ...DEFAULT_SETTINGS };
+  try {
+    return { ...DEFAULT_SETTINGS, ...JSON.parse(readFileSync(SETTINGS_FILE, "utf-8")) };
+  } catch {
+    return { ...DEFAULT_SETTINGS };
+  }
+}
+function updatesDisabled() {
+  if (process.env["DISABLE_AUTOUPDATER"] === "1") return { disabled: true, reason: "DISABLE_AUTOUPDATER=1" };
+  if (process.env["CI"]) return { disabled: true, reason: "CI environment" };
+  if (!readSettings().autoUpdates) return { disabled: true, reason: "autoUpdates: false in settings.json" };
+  return { disabled: false };
+}
+
+// src/platform.ts
+import { execSync, spawn, spawnSync } from "child_process";
+function resolveCommand(cmd) {
+  if (process.platform !== "win32") return cmd;
+  try {
+    const lines = execSync(`where ${cmd}`, { encoding: "utf-8", windowsHide: true }).split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    return lines.find((l) => l.endsWith(".exe")) || lines.find((l) => l.endsWith(".cmd")) || cmd;
+  } catch {
+    return `${cmd}.cmd`;
+  }
+}
+function isBatchShim(cmd) {
+  return process.platform === "win32" && /\.(cmd|bat)$/i.test(cmd);
+}
+function winBatchInvocation(cmd, args) {
+  const comspec = process.env.ComSpec || "cmd.exe";
+  const quote = (t) => `"${String(t).replace(/"/g, '""')}"`;
+  const line = [cmd, ...args].map(quote).join(" ");
+  return { file: comspec, args: ["/d", "/s", "/c", `"${line}"`] };
+}
+function spawnSyncCommand(cmd, args = [], options = {}) {
+  if (isBatchShim(cmd)) {
+    const inv = winBatchInvocation(cmd, args);
+    return spawnSync(inv.file, inv.args, { windowsHide: true, ...options, windowsVerbatimArguments: true });
+  }
+  return spawnSync(cmd, [...args], { windowsHide: true, ...options });
+}
+
+// src/updater/check.ts
+var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
 function log(line) {
-    try {
-        appendFileSync(UPDATE_LOG, `[${new Date().toISOString()}] ${line}\n`);
-    }
-    catch { /* ignore */ }
+  try {
+    appendFileSync(UPDATE_LOG, `[${(/* @__PURE__ */ new Date()).toISOString()}] ${line}
+`);
+  } catch {
+  }
 }
-export function compareSemver(a, b) {
-    const pa = a.split('.').map(Number);
-    const pb = b.split('.').map(Number);
-    for (let i = 0; i < 3; i++) {
-        const da = pa[i] ?? 0;
-        const db = pb[i] ?? 0;
-        if (da !== db)
-            return da - db;
-    }
-    return 0;
+function compareSemver(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    const da = pa[i] ?? 0;
+    const db = pb[i] ?? 0;
+    if (da !== db) return da - db;
+  }
+  return 0;
 }
 async function fetchLatestVersion() {
-    const res = await fetch('https://registry.npmjs.org/gipity/latest', {
-        headers: { accept: 'application/json' },
-    });
-    if (!res.ok)
-        throw new Error(`registry HTTP ${res.status}`);
-    const json = await res.json();
-    if (!json.version)
-        throw new Error('no version in registry response');
-    return json.version;
+  const res = await fetch("https://registry.npmjs.org/gipity/latest", {
+    headers: { accept: "application/json" }
+  });
+  if (!res.ok) throw new Error(`registry HTTP ${res.status}`);
+  const json = await res.json();
+  if (!json.version) throw new Error("no version in registry response");
+  return json.version;
 }
 function installVersion(version) {
-    // --ignore-scripts: this runs unattended in the background, so don't let a
-    // compromised package's install lifecycle hooks execute. gipity ships
-    // precompiled (dist/) and its deps need no build step, so nothing is lost.
-    const res = spawnSyncCommand(resolveCommand('npm'), ['install', '--silent', '--no-audit', '--no-fund', '--ignore-scripts', `gipity@${version}`], {
-        cwd: LOCAL_DIR,
-        stdio: 'ignore',
-    });
-    if (res.error)
-        log(`npm spawn failed: ${res.error.message}`);
-    return res.status === 0 && existsSync(LOCAL_ENTRY);
+  const res = spawnSyncCommand(resolveCommand("npm"), ["install", "--silent", "--no-audit", "--no-fund", "--ignore-scripts", `gipity@${version}`], {
+    cwd: LOCAL_DIR,
+    stdio: "ignore"
+  });
+  if (res.error) log(`npm spawn failed: ${res.error.message}`);
+  return res.status === 0 && existsSync2(LOCAL_ENTRY);
 }
-export async function runCheck(opts = {}) {
-    const state = readState();
-    if (!opts.force) {
-        const dis = updatesDisabled();
-        if (dis.disabled) {
-            log(`skipped: ${dis.reason}`);
-            return { updated: false, reason: dis.reason };
-        }
-        if (Date.now() - state.lastCheckAt < CHECK_INTERVAL_MS) {
-            return { updated: false, reason: 'cache-fresh' };
-        }
-    }
-    let latest;
-    try {
-        latest = await fetchLatestVersion();
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        state.lastError = `fetch failed: ${msg}`;
-        state.lastCheckAt = Date.now();
-        writeState(state);
-        log(state.lastError);
-        return { updated: false, reason: state.lastError };
+async function runCheck(opts = {}) {
+  const state = readState();
+  if (!opts.force) {
+    const dis = updatesDisabled();
+    if (dis.disabled) {
+      log(`skipped: ${dis.reason}`);
+      return { updated: false, reason: dis.reason };
     }
-    const current = state.installedVersion ?? '0.0.0';
-    if (compareSemver(latest, current) <= 0) {
-        state.lastError = null;
-        state.lastCheckAt = Date.now();
-        writeState(state);
-        log(`up-to-date (current=${current}, latest=${latest})`);
-        return { updated: false, reason: 'up-to-date' };
+    if (Date.now() - state.lastCheckAt < CHECK_INTERVAL_MS) {
+      return { updated: false, reason: "cache-fresh" };
     }
-    log(`upgrading ${current} → ${latest}`);
-    const ok = installVersion(latest);
+  }
+  let latest;
+  try {
+    latest = await fetchLatestVersion();
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    state.lastError = `fetch failed: ${msg}`;
     state.lastCheckAt = Date.now();
-    if (ok) {
-        state.installedVersion = latest;
-        state.lastError = null;
-        writeState(state);
-        log(`upgraded to ${latest}`);
-        return { updated: true, from: current, to: latest };
-    }
-    state.lastError = `npm install gipity@${latest} failed`;
     writeState(state);
     log(state.lastError);
     return { updated: false, reason: state.lastError };
+  }
+  const current = state.installedVersion ?? "0.0.0";
+  if (compareSemver(latest, current) <= 0) {
+    state.lastError = null;
+    state.lastCheckAt = Date.now();
+    writeState(state);
+    log(`up-to-date (current=${current}, latest=${latest})`);
+    return { updated: false, reason: "up-to-date" };
+  }
+  log(`upgrading ${current} \u2192 ${latest}`);
+  const ok = installVersion(latest);
+  state.lastCheckAt = Date.now();
+  if (ok) {
+    state.installedVersion = latest;
+    state.lastError = null;
+    writeState(state);
+    log(`upgraded to ${latest}`);
+    return { updated: true, from: current, to: latest };
+  }
+  state.lastError = `npm install gipity@${latest} failed`;
+  writeState(state);
+  log(state.lastError);
+  return { updated: false, reason: state.lastError };
 }
-// Direct invocation (detached background)
-const isDirect = import.meta.url === `file://${process.argv[1]}`;
+var isDirect = import.meta.url === `file://${process.argv[1]}`;
 if (isDirect) {
-    const force = process.argv.includes('--force');
-    runCheck({ force }).catch((e) => log(`unhandled: ${e instanceof Error ? e.message : String(e)}`));
+  const force = process.argv.includes("--force");
+  runCheck({ force }).catch((e) => log(`unhandled: ${e instanceof Error ? e.message : String(e)}`));
 }
-//# sourceMappingURL=check.js.map
+export {
+  compareSemver,
+  runCheck
+};

package/dist/updater/shim.js

@@ -1,78 +1,160 @@
 #!/usr/bin/env node
-// Thin launcher. Resolves the user-local install at ~/.gipity/local/, exec's
-// it, and kicks off a detached background updater. Modeled on Claude Code.
-import { spawnCommand, spawnSyncCommand } from '../platform.js';
-import { existsSync, readFileSync } from 'fs';
-import { fileURLToPath } from 'url';
-import { dirname, resolve, join } from 'path';
-import { LOCAL_ENTRY } from './state.js';
-import { isBootstrapped, bootstrap } from './bootstrap.js';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const pkgRoot = resolve(__dirname, '..', '..');
-const shimPkg = JSON.parse(readFileSync(join(pkgRoot, 'package.json'), 'utf-8'));
-// Dev-link detection. Published tarballs ship `dist/**` only (see package.json
-// `files`), so a sibling `src/` means `gipity` was `npm link`ed from a source
-// checkout. In that case run THIS checkout's own dist and skip the bootstrap +
-// background updater entirely - otherwise the shim would defer to the last
-// PUBLISHED build in ~/.gipity/local/ and silently shadow your local changes.
-// Nothing persistent is written, so `just cli-unlink` (npm unlink) is the only
-// cleanup needed: once `gipity` no longer resolves to this checkout, dev mode
-// stops applying on its own.
-const isDevLink = existsSync(join(pkgRoot, 'src'));
-function startBackgroundUpdater() {
-    const checkScript = join(__dirname, 'check.js');
-    try {
-        const child = spawnCommand(process.execPath, [checkScript], {
-            detached: true,
-            stdio: 'ignore',
-            env: process.env,
-        });
-        // Async spawn 'error' bypasses the try/catch; swallow so the best-effort
-        // updater never crashes the CLI.
-        child.on('error', () => { });
-        child.unref();
+import { createRequire as __cliCreateRequire } from 'module';
+const require = __cliCreateRequire(import.meta.url);
+
+// src/platform.ts
+import { execSync, spawn, spawnSync } from "child_process";
+function resolveCommand(cmd) {
+  if (process.platform !== "win32") return cmd;
+  try {
+    const lines = execSync(`where ${cmd}`, { encoding: "utf-8", windowsHide: true }).split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    return lines.find((l) => l.endsWith(".exe")) || lines.find((l) => l.endsWith(".cmd")) || cmd;
+  } catch {
+    return `${cmd}.cmd`;
+  }
+}
+function isBatchShim(cmd) {
+  return process.platform === "win32" && /\.(cmd|bat)$/i.test(cmd);
+}
+function winBatchInvocation(cmd, args) {
+  const comspec = process.env.ComSpec || "cmd.exe";
+  const quote = (t) => `"${String(t).replace(/"/g, '""')}"`;
+  const line = [cmd, ...args].map(quote).join(" ");
+  return { file: comspec, args: ["/d", "/s", "/c", `"${line}"`] };
+}
+function spawnCommand(cmd, args = [], options = {}) {
+  if (isBatchShim(cmd)) {
+    const inv = winBatchInvocation(cmd, args);
+    return spawn(inv.file, inv.args, { windowsHide: true, ...options, windowsVerbatimArguments: true });
+  }
+  return spawn(cmd, [...args], { windowsHide: true, ...options });
+}
+function spawnSyncCommand(cmd, args = [], options = {}) {
+  if (isBatchShim(cmd)) {
+    const inv = winBatchInvocation(cmd, args);
+    return spawnSync(inv.file, inv.args, { windowsHide: true, ...options, windowsVerbatimArguments: true });
+  }
+  return spawnSync(cmd, [...args], { windowsHide: true, ...options });
+}
+
+// src/updater/shim.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { fileURLToPath, pathToFileURL } from "url";
+import { dirname, resolve, join as join3 } from "path";
+
+// src/updater/state.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var GIPITY_DIR = join(homedir(), ".gipity");
+var LOCAL_DIR = join(GIPITY_DIR, "local");
+var LOCAL_PKG_DIR = join(LOCAL_DIR, "node_modules", "gipity");
+var LOCAL_ENTRY = join(LOCAL_PKG_DIR, "dist", "index.js");
+var STATE_FILE = join(GIPITY_DIR, "update-state.json");
+var SETTINGS_FILE = join(GIPITY_DIR, "settings.json");
+var UPDATE_LOG = join(GIPITY_DIR, "update.log");
+var DEFAULT_STATE = {
+  installedVersion: null,
+  lastCheckAt: 0,
+  lastError: null,
+  updateChannel: "stable"
+};
+function ensureDir() {
+  mkdirSync(GIPITY_DIR, { recursive: true });
+}
+function readState() {
+  if (!existsSync(STATE_FILE)) return { ...DEFAULT_STATE };
+  try {
+    return { ...DEFAULT_STATE, ...JSON.parse(readFileSync(STATE_FILE, "utf-8")) };
+  } catch {
+    return { ...DEFAULT_STATE };
+  }
+}
+function writeState(state) {
+  ensureDir();
+  writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+}
+
+// src/updater/bootstrap.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2 } from "path";
+function isBootstrapped() {
+  return existsSync2(LOCAL_ENTRY);
+}
+function bootstrap(version, quiet = false) {
+  mkdirSync2(LOCAL_DIR, { recursive: true });
+  const pkgJsonPath = join2(LOCAL_DIR, "package.json");
+  if (!existsSync2(pkgJsonPath)) {
+    writeFileSync2(pkgJsonPath, JSON.stringify({ name: "gipity-local", private: true, version: "0.0.0" }, null, 2));
+  }
+  if (!quiet) process.stderr.write(`Setting up gipity local install at ~/.gipity/local (one-time)...
+`);
+  const res = spawnSyncCommand(resolveCommand("npm"), ["install", "--no-audit", "--no-fund", "--ignore-scripts", `gipity@${version}`], {
+    cwd: LOCAL_DIR,
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8"
+  });
+  if (res.status !== 0 || !existsSync2(LOCAL_ENTRY)) {
+    if (!quiet) {
+      const stderr = (res.stderr || "").toString();
+      const notPublished = /E404|No matching version|notarget/i.test(stderr);
+      if (notPublished) {
+        process.stderr.write(`gipity v${version} is not yet published to npm - using the currently installed build.
+`);
+      } else {
+        const firstLine = stderr.split("\n").map((l) => l.trim()).find((l) => l.length > 0) || (res.error ? res.error.message : `npm exit ${res.status}`);
+        const reason = firstLine.length > 160 ? firstLine.slice(0, 157) + "..." : firstLine;
+        process.stderr.write(`gipity: could not set up local install (${reason}). Using the currently installed build.
+`);
+      }
     }
-    catch { /* updater is best-effort, never block */ }
+    return false;
+  }
+  const state = readState();
+  state.installedVersion = version;
+  writeState(state);
+  if (!quiet) process.stderr.write(`Done.
+`);
+  return true;
 }
-function execLocal() {
-    const args = process.argv.slice(2);
-    const res = spawnSyncCommand(process.execPath, [LOCAL_ENTRY, ...args], {
-        stdio: 'inherit',
-        env: process.env,
+
+// src/updater/shim.ts
+var __dirname = dirname(fileURLToPath(import.meta.url));
+var pkgRoot = resolve(__dirname, "..", "..");
+var shimPkg = JSON.parse(readFileSync2(join3(pkgRoot, "package.json"), "utf-8"));
+var isDevLink = existsSync3(join3(pkgRoot, "src"));
+function startBackgroundUpdater() {
+  const checkScript = join3(__dirname, "check.js");
+  try {
+    const child = spawnCommand(process.execPath, [checkScript], {
+      detached: true,
+      stdio: "ignore",
+      env: process.env
     });
-    process.exit(res.status ?? 1);
-}
-function execSelf() {
-    // Run our own dist/index.js (this checkout/install), bypassing the local
-    // bootstrapped copy. Used for dev links and as the bootstrap-failure fallback
-    // so the user is never blocked (they can retry via `gipity update --force`).
-    const ownEntry = resolve(__dirname, '..', 'index.js');
-    const args = process.argv.slice(2);
-    const res = spawnSyncCommand(process.execPath, [ownEntry, ...args], {
-        stdio: 'inherit',
-        env: process.env,
+    child.on("error", () => {
     });
-    process.exit(res.status ?? 1);
+    child.unref();
+  } catch {
+  }
+}
+async function runEntry(entry) {
+  try {
+    await import(pathToFileURL(entry).href);
+  } catch (err) {
+    console.error(err instanceof Error ? err.stack ?? err.message : String(err));
+    process.exit(1);
+  }
 }
-// Loud startup output (bootstrap status, npm-fallback notice) is reserved for
-// the handful of commands where users expect a visible chrome banner. All other
-// subcommands - scaffold, skills, fn, test, deploy, etc. - run silently so
-// their output stays clean in transcripts and agent tool results.
-const rawArgs = process.argv.slice(2);
-const firstArg = rawArgs[0];
-const isLoud = rawArgs.length === 0 ||
-    firstArg === 'claude' ||
-    firstArg === '--version' ||
-    firstArg === '-v' ||
-    firstArg === 'version';
-// Dev link: run this checkout's own build, no bootstrap, no auto-update.
-if (isDevLink)
-    execSelf();
-if (!isBootstrapped()) {
-    const ok = bootstrap(shimPkg.version, !isLoud);
-    if (!ok)
-        execSelf();
+var execLocal = () => runEntry(LOCAL_ENTRY);
+var execSelf = () => runEntry(resolve(__dirname, "..", "index.js"));
+var rawArgs = process.argv.slice(2);
+var firstArg = rawArgs[0];
+var isLoud = rawArgs.length === 0 || firstArg === "claude" || firstArg === "--version" || firstArg === "-v" || firstArg === "version";
+if (isDevLink) {
+  await execSelf();
+} else if (!isBootstrapped() && !bootstrap(shimPkg.version, !isLoud)) {
+  await execSelf();
+} else {
+  startBackgroundUpdater();
+  await execLocal();
 }
-startBackgroundUpdater();
-execLocal();
-//# sourceMappingURL=shim.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gipity",
-  "version": "1.0.422",
+  "version": "1.0.424",
   "description": "The full-stack platform tuned for AI agents. Database, storage, auth, functions, deploy, and drop-in kits - all agent-tuned. Pair with Claude Code or use standalone.",
   "bin": {
     "gipity": "dist/updater/shim.js",
@@ -9,11 +9,12 @@
   },
   "type": "module",
   "scripts": {
-    "build": "tsc && chmod +x dist/index.js dist/gipcc.js dist/gipccd.js dist/updater/shim.js dist/updater/check.js",
+    "build": "tsc && node scripts/bundle.mjs && chmod +x dist/index.js dist/gipcc.js dist/gipccd.js dist/updater/shim.js dist/updater/check.js",
     "postbuild": "node scripts/gen-build-info.mjs",
+    "prepack": "npm run build",
     "dev": "tsc --watch",
     "test": "npm run test:smoke",
-    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/platform.test.js dist/__tests__/colors.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-lock.test.js dist/__tests__/auth-lock.test.js dist/__tests__/api-401-retry.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-diagnostics.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/ingest-queue.test.js dist/__tests__/stream-delta.test.js dist/__tests__/phase-tracker.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/capture-lock.test.js dist/__tests__/capture-resolve.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/client-context.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-storage.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-setup.test.js dist/__tests__/cli-cmd-doctor.test.js dist/__tests__/claude-setup.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
+    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/platform.test.js dist/__tests__/colors.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-clean-check.test.js dist/__tests__/sync-lock.test.js dist/__tests__/auth-lock.test.js dist/__tests__/api-401-retry.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-diagnostics.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/ingest-queue.test.js dist/__tests__/stream-delta.test.js dist/__tests__/phase-tracker.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/capture-lock.test.js dist/__tests__/capture-resolve.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/client-context.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-storage.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-setup.test.js dist/__tests__/cli-cmd-doctor.test.js dist/__tests__/claude-setup.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
     "test:smoke:quick": "node scripts/smoke-quick.mjs",
     "test:e2e": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-live.test.js dist/__tests__/cli-e2e-sync-live.test.js dist/__tests__/cli-e2e-sync-stress-live.test.js dist/__tests__/cli-e2e-rollback-live.test.js dist/__tests__/cli-e2e-services-media-live.test.js dist/__tests__/cli-e2e-workflow-live.test.js dist/__tests__/cli-e2e-sandbox-live.test.js dist/__tests__/cli-e2e-page-fetch-live.test.js dist/__tests__/cli-e2e-page-test-live.test.js",
     "test:e2e:sync": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-sync-live.test.js",
@@ -29,6 +30,7 @@
   "devDependencies": {
     "@types/node": "^20.0.0",
     "@types/tar-stream": "^3.1.4",
+    "esbuild": "^0.28.1",
     "typescript": "5.9.3"
   },
   "engines": {