upgrade templates
go tool gpsystem upgrade templates [--force]
The kit copies its oapi-codegen templates into every project (api/oapi-codegen/templates/) so codegen is hermetic. The command syncs the set matching the manifest's router field: the full Fiber v3 set for fiber projects, the minimal strict overrides for chi projects. When you bump the kit version, this command brings the templates up to date.
Modification protection
gpsystem.yaml records a checksum (templatesSHA) of the template set at install time. On upgrade:
| On-disk state | Behavior |
|---|---|
| matches the embedded set | "already up to date", no writes |
| matches the recorded checksum (pristine older set) | upgraded in place |
| anything else (locally modified) | refuses; pass --force to overwrite |
Because replacing the on-disk template set is this command's whole job, it runs with overwrite enabled and prints an overwriting <path> line for every template file it replaces, so you can see exactly what changed. After a successful upgrade the manifest's checksum and kit version are updated. Then:
mise run generate # regenerate code with the new templates
Migration: enabling the policy layer in an older project
Enforcing @permission/@policy requires the template set to emit the PermissionByOperation / PolicyByOperation maps, so upgrade templates + mise run generate is mandatory when moving to a kit version with policies. The maps are emitted even when empty, so the upgrade alone breaks nothing. Wiring in pre-existing surfaces is manual (snippets only affect new add surface runs): create a policy/ package under the surface with a New() *policy.Registry constructor and chain the enforcer into the strict-middleware slice in the module's register.go; scaffold a fresh surface as a reference, or see auth, rbac & policy.