@beignet/cli 0.0.23 → 0.0.25

package/src/inspect.ts

@@ -1,16 +1,14 @@
 import { readdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
-import {
-  type ProviderPackageMetadata,
-  parseProviderPackageMetadata,
-} from "@beignet/core/providers";
+import { parseProviderPackageMetadata } from "@beignet/core/providers";
 import { createPainter } from "./ansi.js";
 import {
   type BeignetConfig,
+  type BeignetDatabaseTables,
   clientDirPath,
   clientFormsPath,
   clientIndexPath,
+  defaultBeignetConfig,
   directoryPath,
   loadBeignetConfig,
   normalizePath,
@@ -21,6 +19,21 @@ import {
   formatGithubAnnotation,
   type GithubAnnotationSeverity,
 } from "./github-annotations.js";
+import {
+  detectedProviderVariants,
+  diagnosticPackageJsonFile,
+  formatProviderMetadataIssues,
+  installedPackageNames,
+  providerDoctorRulesForInstalledPackages,
+  providerOperationalConfigFiles,
+  providerRequiredEnvExists,
+  providerRequiredTableExists,
+  providerVariantRegistrationSeverity,
+  readProviderListEntries,
+  readProviderPackageMetadataSource,
+  registrationTokenHint,
+  serverProviderFiles,
+} from "./provider-audit.js";
 import {
   type AppendResult,
   appendToArrayExpression,
@@ -363,10 +376,58 @@ export function formatDoctor(
     );
   }
 
+  const checklist = productionHardeningChecklist(result.diagnostics);
+  if (checklist.length > 0) {
+    lines.push("", paint("Production Hardening Checklist:", "bold"), "");
+    lines.push(...checklist.map((item) => `- ${item}`));
+  }
+
   lines.push("", formatDoctorFooter(result));
   return lines.join("\n");
 }
 
+const productionHardeningDiagnosticCodes = new Set([
+  "BEIGNET_AUTH_ROUTE_MISSING",
+  "BEIGNET_AUTH_TRUSTED_ORIGINS_MISSING",
+  "BEIGNET_BETTER_AUTH_SECRET_PLACEHOLDER",
+  "BEIGNET_BILLING_CHECKOUT_IDEMPOTENCY_MISSING",
+  "BEIGNET_BILLING_ENTITLEMENTS_PROVIDER_MISSING",
+  "BEIGNET_BILLING_IDEMPOTENCY_PORT_MISSING",
+  "BEIGNET_CORS_CREDENTIALS_WILDCARD",
+  "BEIGNET_CRON_SECRET_MISSING",
+  "BEIGNET_DEVTOOLS_ROUTE_EXPOSED",
+  "BEIGNET_ENTITLEMENTS_PORT_MISSING",
+  "BEIGNET_PAYMENTS_STRIPE_MEMORY_PROVIDER",
+  "BEIGNET_PAYMENTS_WEBHOOK_ROUTE_MISSING",
+  "BEIGNET_PROVIDER_ENV_MISSING",
+  "BEIGNET_PROVIDER_TABLE_MISSING",
+  "BEIGNET_READINESS_ROUTE_MISSING",
+  "BEIGNET_TENANT_HEADER_AUTHORITY",
+  "BEIGNET_UPLOAD_AUTHORIZATION_MISSING",
+  "BEIGNET_UPLOAD_SIZE_LIMIT_MISSING",
+]);
+
+function productionHardeningChecklist(
+  diagnostics: InspectDiagnostic[],
+): string[] {
+  if (
+    !diagnostics.some((diagnostic) =>
+      productionHardeningDiagnosticCodes.has(diagnostic.code),
+    )
+  ) {
+    return [];
+  }
+
+  return [
+    "Secrets and provider credentials are unique per environment, validated at startup, never committed, and never logged.",
+    "Auth routes, tenant resolution, authorization policies, and trusted origins derive authority from verified sessions, API keys, or trusted gateway metadata.",
+    "Devtools, OpenAPI, cron, webhooks, and operational routes have intentional exposure and app-owned authorization.",
+    "CORS origins, proxy IP trust, rate-limit keys, and request body limits match the production host topology.",
+    "Uploads and storage define max sizes, authorization or explicit public access, object visibility, safe content headers, and short direct-upload expirations.",
+    "Provider-backed dependencies have bounded readiness checks, worker shutdown behavior, webhook secrets, and least-privilege credentials.",
+  ];
+}
+
 function formatDoctorFooter(result: InspectAppResult): string {
   const count = (severity: InspectDiagnostic["severity"]) =>
     result.diagnostics.filter((diagnostic) => diagnostic.severity === severity)
@@ -1870,30 +1931,6 @@ async function inspectRouteErrorCatalogDrift(
   return diagnostics;
 }
 
-type ProviderDoctorVariantRule = {
-  name: string;
-  displayName: string;
-  tokens: readonly string[];
-  requiredEnv: readonly string[];
-  registrationSeverity?: "warning" | "hint";
-};
-
-type ProviderDoctorRule = {
-  packageName: string;
-  displayName: string;
-  tokens: readonly string[];
-  appPorts?: readonly { name: string; type: string }[];
-  requiredEnv?: readonly string[];
-  registrationSeverity?: "warning" | "hint";
-  variants?: readonly ProviderDoctorVariantRule[];
-};
-
-type ProviderPackageMetadataSource = {
-  packageName: string;
-  file: string;
-  metadata: unknown;
-};
-
 const readinessRelevantProviderPackages = new Set([
   "@beignet/provider-auth-better-auth",
   "@beignet/provider-db-drizzle",
@@ -1928,6 +1965,10 @@ async function inspectProductionReadiness(
     packageJson,
   );
   const configFiles = operationalConfigFiles(files, config);
+  const infrastructurePath = directoryPath(
+    path.dirname(config.paths.infrastructurePorts),
+  );
+  const schemaDir = `${infrastructurePath}/db/schema`;
 
   for (const file of files) {
     if (!file.endsWith(".ts") || file.endsWith(".test.ts")) continue;
@@ -1974,6 +2015,32 @@ async function inspectProductionReadiness(
       });
     }
 
+    if (
+      isFeatureUploadDefinition(file, config) &&
+      containsCallExpression(source, "defineUpload") &&
+      !/\bauthorize\s*(?:\(|:)/.test(source) &&
+      !/\baccess\s*:\s*["']public["']/.test(source)
+    ) {
+      diagnostics.push({
+        severity: "warning",
+        code: "BEIGNET_UPLOAD_AUTHORIZATION_MISSING",
+        file,
+        message: `${file} defines a protected upload without authorize(...). Add an authorize hook, or set access: "public" only for intentionally public uploads.`,
+      });
+    }
+
+    if (
+      isRouteServerOrInfraFile(file, config) &&
+      containsRequestTenantHeaderAuthority(source)
+    ) {
+      diagnostics.push({
+        severity: "warning",
+        code: "BEIGNET_TENANT_HEADER_AUTHORITY",
+        file,
+        message: `${file} reads x-tenant-id and turns it into tenant authority. Resolve request tenants from verified auth/session claims or trusted gateway metadata instead of a caller-controlled header.`,
+      });
+    }
+
     if (
       isRouteServerOrInfraFile(file, config) &&
       containsCallExpression(source, "createCorsHooks") &&
@@ -1991,6 +2058,19 @@ async function inspectProductionReadiness(
     }
   }
 
+  for (const file of configFiles) {
+    const source = await readCachedSource(targetDir, file, sourceCache);
+
+    if (containsBetterAuthLocalSecret(source)) {
+      diagnostics.push({
+        severity: "warning",
+        code: "BEIGNET_BETTER_AUTH_SECRET_PLACEHOLDER",
+        file,
+        message: `${file} contains the known local Better Auth placeholder secret. Keep it out of production configuration and require a unique BETTER_AUTH_SECRET before deployment.`,
+      });
+    }
+  }
+
   const providerEntries = await readProviderListEntries(
     targetDir,
     files,
@@ -2034,7 +2114,12 @@ async function inspectProductionReadiness(
       )) {
         for (const envVar of variant.requiredEnv) {
           if (
-            await anyFileContains(targetDir, configFiles, envVar, sourceCache)
+            await providerRequiredEnvExists(
+              targetDir,
+              configFiles,
+              envVar,
+              sourceCache,
+            )
           ) {
             continue;
           }
@@ -2045,12 +2130,44 @@ async function inspectProductionReadiness(
             message: `${provider.packageName} is installed and ${variant.displayName} is registered, but ${envVar} is not mentioned in app env/config files. ${variant.displayName} requires ${envVar}; add the environment variable or remove the provider registration.`,
           });
         }
+
+        for (const tableName of configuredProviderRequiredTables(
+          variant.requiredTables,
+          config,
+        )) {
+          if (
+            await providerRequiredTableExists(
+              targetDir,
+              files,
+              config,
+              infrastructurePath,
+              schemaDir,
+              tableName,
+              sourceCache,
+            )
+          ) {
+            continue;
+          }
+          diagnostics.push({
+            severity: "warning",
+            code: "BEIGNET_PROVIDER_TABLE_MISSING",
+            file: schemaDir,
+            message: `${provider.packageName} is installed and ${variant.displayName} is registered, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema generate, include it in your Drizzle schema/migrations, or remove the provider registration.`,
+          });
+        }
       }
       continue;
     }
 
     for (const envVar of provider.requiredEnv ?? []) {
-      if (await anyFileContains(targetDir, configFiles, envVar, sourceCache)) {
+      if (
+        await providerRequiredEnvExists(
+          targetDir,
+          configFiles,
+          envVar,
+          sourceCache,
+        )
+      ) {
         continue;
       }
       diagnostics.push({
@@ -2060,6 +2177,31 @@ async function inspectProductionReadiness(
         message: `${provider.packageName} is installed, but ${envVar} is not mentioned in app env/config files. Add the expected environment variable or remove the unused provider package.`,
       });
     }
+
+    for (const tableName of configuredProviderRequiredTables(
+      provider.requiredTables ?? [],
+      config,
+    )) {
+      if (
+        await providerRequiredTableExists(
+          targetDir,
+          files,
+          config,
+          infrastructurePath,
+          schemaDir,
+          tableName,
+          sourceCache,
+        )
+      ) {
+        continue;
+      }
+      diagnostics.push({
+        severity: "warning",
+        code: "BEIGNET_PROVIDER_TABLE_MISSING",
+        file: schemaDir,
+        message: `${provider.packageName} is installed, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema generate, include it in your Drizzle schema/migrations, or remove the unused provider package.`,
+      });
+    }
   }
 
   if (installedPackages.has("@beignet/provider-auth-better-auth")) {
@@ -2138,6 +2280,34 @@ function containsReadinessCheck(source: string): boolean {
   return /\bchecks\s*:/.test(source) || /\.checkHealth\s*\(/.test(source);
 }
 
+function containsBetterAuthLocalSecret(source: string): boolean {
+  if (!source.includes("local-dev-better-auth-secret-change-me")) return false;
+
+  const hasProductionRuntimeGuard =
+    /\bisProductionRuntime\s*=\s*process\.env\.NODE_ENV\s*===\s*["']production["']\s*&&\s*process\.env\.NEXT_PHASE\s*!==\s*["']phase-production-build["']/.test(
+      source,
+    ) &&
+    /BETTER_AUTH_SECRET\s*:\s*isProductionRuntime\s*\?\s*BetterAuthSecret\s*:\s*BetterAuthSecret\.default\(LOCAL_BETTER_AUTH_SECRET\)/s.test(
+      source,
+    );
+  const hasProductionGuard =
+    /BETTER_AUTH_SECRET\s*:\s*process\.env\.NODE_ENV\s*===\s*["']production["']\s*\?\s*BetterAuthSecret\s*:\s*BetterAuthSecret\.default\(LOCAL_BETTER_AUTH_SECRET\)/s.test(
+      source,
+    );
+
+  return !(hasProductionRuntimeGuard || hasProductionGuard);
+}
+
+function containsRequestTenantHeaderAuthority(source: string): boolean {
+  return (
+    /(?:(?:\breq|\brequest)\.headers|(?<!\.)\bheaders)\.get\(\s*["']x-tenant-id["']\s*\)/.test(
+      source,
+    ) &&
+    (/\bcreateTenant\s*\(/.test(source) ||
+      /\btenant\s*:\s*\{?\s*id\s*:/.test(source))
+  );
+}
+
 async function inspectEntitlementsProductionReadiness(
   targetDir: string,
   files: string[],
@@ -2571,13 +2741,7 @@ function operationalConfigFiles(
   files: string[],
   config: ResolvedBeignetConfig,
 ): string[] {
-  return files.filter((file) => {
-    if (file === ".env.example") return true;
-    if (file === "drizzle.config.ts") return true;
-    if (file === "lib/env.ts" || file === "lib/better-auth.ts") return true;
-    if (isInfraOrServerFile(file, config) && file.endsWith(".ts")) return true;
-    return false;
-  });
+  return providerOperationalConfigFiles(files, config);
 }
 
 async function readPackageJson(
@@ -2598,83 +2762,6 @@ async function readPackageJson(
   );
 }
 
-async function providerDoctorRulesForInstalledPackages(
-  targetDir: string,
-  packageJson:
-    | {
-        dependencies?: Record<string, string>;
-        devDependencies?: Record<string, string>;
-        peerDependencies?: Record<string, string>;
-      }
-    | undefined,
-): Promise<ProviderDoctorRule[]> {
-  const packageNames = [...installedPackageNames(packageJson)];
-  const rules = await Promise.all(
-    packageNames.map(async (packageName) => {
-      const source = await readProviderPackageMetadataSource(
-        targetDir,
-        packageName,
-      );
-      if (!source) return undefined;
-      const result = parseProviderPackageMetadata(source.metadata);
-      if (!result.success) return undefined;
-      return providerDoctorRuleFromMetadata(packageName, result.metadata);
-    }),
-  );
-
-  return rules.filter((rule): rule is ProviderDoctorRule => Boolean(rule));
-}
-
-async function readProviderPackageMetadataSource(
-  targetDir: string,
-  packageName: string,
-): Promise<ProviderPackageMetadataSource | undefined> {
-  for (const candidate of providerPackageJsonCandidates(
-    targetDir,
-    packageName,
-  )) {
-    const packageJson = await readJsonIfExists<{
-      beignet?: { provider?: unknown };
-    }>(candidate);
-    const metadata = packageJson?.beignet?.provider;
-    if (metadata !== undefined) {
-      return { packageName, file: candidate, metadata };
-    }
-  }
-
-  return undefined;
-}
-
-function providerPackageJsonCandidates(
-  targetDir: string,
-  packageName: string,
-): string[] {
-  const candidates = [
-    path.join(
-      targetDir,
-      "node_modules",
-      ...packageName.split("/"),
-      "package.json",
-    ),
-  ];
-
-  if (packageName.startsWith("@beignet/")) {
-    candidates.push(
-      path.resolve(
-        // import.meta.dir is Bun-only; the published bin also runs under
-        // plain Node, where only import.meta.url is available.
-        path.dirname(fileURLToPath(import.meta.url)),
-        "../../..",
-        "packages",
-        packageName.slice("@beignet/".length),
-        "package.json",
-      ),
-    );
-  }
-
-  return candidates;
-}
-
 async function readJsonIfExists<T>(file: string): Promise<T | undefined> {
   try {
     return JSON.parse(await readFile(file, "utf8")) as T;
@@ -2690,218 +2777,6 @@ async function readJsonIfExists<T>(file: string): Promise<T | undefined> {
   }
 }
 
-function providerDoctorRuleFromMetadata(
-  packageName: string,
-  metadata: ProviderPackageMetadata,
-): ProviderDoctorRule {
-  const registration = metadata.registration;
-
-  return {
-    packageName,
-    displayName: metadata.displayName ?? packageName,
-    tokens: registration?.tokens ?? [],
-    appPorts: metadata.appPorts ?? [],
-    requiredEnv: metadata.requiredEnv ?? [],
-    registrationSeverity: registrationSeverityFromMetadata(registration),
-    variants: metadata.variants?.map((variant) => ({
-      name: variant.name,
-      displayName: variant.displayName ?? variant.name,
-      tokens: variant.registration?.tokens ?? [],
-      requiredEnv: variant.requiredEnv ?? [],
-      registrationSeverity: registrationSeverityFromMetadata(
-        variant.registration,
-      ),
-    })),
-  };
-}
-
-function registrationSeverityFromMetadata(
-  registration:
-    | { required?: boolean; severity?: "warning" | "hint" }
-    | undefined,
-): "warning" | "hint" | undefined {
-  return (
-    registration?.severity ??
-    (registration?.required === true ? "warning" : undefined)
-  );
-}
-
-function detectedProviderVariants(
-  variants: readonly ProviderDoctorVariantRule[],
-  providerEntries: readonly string[],
-): ProviderDoctorVariantRule[] {
-  return variants.filter((variant) =>
-    variant.tokens.some((token) =>
-      providerEntries.some((entry) => entry.includes(token)),
-    ),
-  );
-}
-
-function providerVariantRegistrationSeverity(
-  variants: readonly ProviderDoctorVariantRule[],
-): "warning" | "hint" | undefined {
-  const severities = variants.map((variant) => variant.registrationSeverity);
-  if (severities.includes("warning")) return "warning";
-  if (severities.includes("hint")) return "hint";
-  return undefined;
-}
-
-async function readProviderListEntries(
-  targetDir: string,
-  files: string[],
-  config: ResolvedBeignetConfig,
-  sourceCache: Map<string, string>,
-): Promise<string[]> {
-  const providerFiles = serverProviderFiles(files, config);
-  const providerSource = (
-    await Promise.all(
-      providerFiles.map((file) =>
-        readCachedSource(targetDir, file, sourceCache),
-      ),
-    )
-  ).join("\n");
-  const providerListSource = extractProviderListSource(providerSource);
-  return providerListSource === undefined
-    ? []
-    : providerListEntries(providerListSource);
-}
-
-function registrationTokenHint(tokens: readonly string[]): string {
-  const token = tokens[0];
-  if (!token) return "the provider";
-  return token.startsWith("create") ? `${token}()` : token;
-}
-
-function diagnosticPackageJsonFile(targetDir: string, file: string): string {
-  const relative = normalizePath(path.relative(targetDir, file));
-  if (relative.startsWith("../")) return "package.json";
-  return relative;
-}
-
-function formatProviderMetadataIssues(
-  issues: readonly { path: string; message: string }[],
-): string {
-  return issues.map((issue) => `${issue.path} ${issue.message}`).join("; ");
-}
-
-function installedPackageNames(
-  packageJson:
-    | {
-        dependencies?: Record<string, string>;
-        devDependencies?: Record<string, string>;
-        peerDependencies?: Record<string, string>;
-      }
-    | undefined,
-): Set<string> {
-  return new Set([
-    ...Object.keys(packageJson?.dependencies ?? {}),
-    ...Object.keys(packageJson?.devDependencies ?? {}),
-    ...Object.keys(packageJson?.peerDependencies ?? {}),
-  ]);
-}
-
-function serverProviderFiles(
-  files: string[],
-  config: ResolvedBeignetConfig,
-): string[] {
-  const serverDir = directoryPath(path.dirname(config.paths.server));
-  const candidates = [`${serverDir}/providers.ts`, config.paths.server];
-  return candidates.filter((file) => files.includes(file));
-}
-
-function extractProviderListSource(source: string): string | undefined {
-  const listMatches = [
-    ...source.matchAll(/\bproviders\s*=\s*\[([\s\S]*?)\]\s*(?:;|as const)/g),
-    ...source.matchAll(/\bproviders\s*:\s*\[([\s\S]*?)\]/g),
-  ];
-  if (listMatches.length === 0) return undefined;
-  return listMatches.map((match) => match[1]).join("\n");
-}
-
-function providerListEntries(source: string): string[] {
-  const entries: string[] = [];
-  let current = "";
-  let depth = 0;
-  let quote: '"' | "'" | "`" | undefined;
-  let escaped = false;
-  let lineComment = false;
-  let blockComment = false;
-
-  for (let index = 0; index < source.length; index += 1) {
-    const char = source[index];
-    const next = source[index + 1];
-
-    if (lineComment) {
-      if (char === "\n") {
-        lineComment = false;
-        current += char;
-      }
-      continue;
-    }
-
-    if (blockComment) {
-      if (char === "*" && next === "/") {
-        blockComment = false;
-        index += 1;
-      }
-      continue;
-    }
-
-    if (quote) {
-      current += char;
-      if (escaped) {
-        escaped = false;
-        continue;
-      }
-      if (char === "\\") {
-        escaped = true;
-        continue;
-      }
-      if (char === quote) {
-        quote = undefined;
-      }
-      continue;
-    }
-
-    if (char === "/" && next === "/") {
-      lineComment = true;
-      index += 1;
-      continue;
-    }
-
-    if (char === "/" && next === "*") {
-      blockComment = true;
-      index += 1;
-      continue;
-    }
-
-    if (char === '"' || char === "'" || char === "`") {
-      quote = char;
-      current += char;
-      continue;
-    }
-
-    if (char === "(" || char === "[" || char === "{") {
-      depth += 1;
-    } else if (char === ")" || char === "]" || char === "}") {
-      depth = Math.max(0, depth - 1);
-    }
-
-    if (char === "," && depth === 0) {
-      const entry = current.trim();
-      if (entry) entries.push(entry);
-      current = "";
-      continue;
-    }
-
-    current += char;
-  }
-
-  const entry = current.trim();
-  if (entry) entries.push(entry);
-  return entries;
-}
-
 function findProviderEntryIndex(
   entries: string[],
   tokens: readonly string[],
@@ -4319,34 +4194,66 @@ async function inspectDatabaseLifecycleDrift(
 
 type DurableDrizzleTableRequirement = {
   capability: string;
-  defaultTableName: string;
+  table: keyof BeignetDatabaseTables;
   code: string;
-  factoryPattern: string;
-  setupPattern?: string;
+  factoryNames: readonly string[];
+  setupNames: readonly string[];
+  explicitFactoryPattern: string;
+  explicitSetupPattern: string;
 };
 
 const durableDrizzleTableRequirements: readonly DurableDrizzleTableRequirement[] =
   [
     {
       capability: "idempotency",
-      defaultTableName: "idempotency_records",
+      table: "idempotency",
       code: "BEIGNET_IDEMPOTENCY_TABLE_MISSING",
-      factoryPattern: "createDrizzle[A-Za-z]+IdempotencyPort",
-      setupPattern: "createDrizzle[A-Za-z]+IdempotencySetupStatements",
+      factoryNames: [
+        "createDrizzleSqliteIdempotencyPort",
+        "createDrizzlePostgresIdempotencyPort",
+        "createDrizzleMysqlIdempotencyPort",
+      ],
+      setupNames: [
+        "createDrizzleSqliteIdempotencySetupStatements",
+        "createDrizzlePostgresIdempotencySetupStatements",
+        "createDrizzleMysqlIdempotencySetupStatements",
+      ],
+      explicitFactoryPattern: "createDrizzle[A-Za-z]*Idempotency(?:Port)?",
+      explicitSetupPattern: "createDrizzle[A-Za-z]*IdempotencySetupStatements",
     },
     {
       capability: "outbox",
-      defaultTableName: "outbox_messages",
+      table: "outbox",
       code: "BEIGNET_OUTBOX_TABLE_MISSING",
-      factoryPattern: "createDrizzle[A-Za-z]+OutboxPort",
-      setupPattern: "createDrizzle[A-Za-z]+OutboxSetupStatements",
+      factoryNames: [
+        "createDrizzleSqliteOutboxPort",
+        "createDrizzlePostgresOutboxPort",
+        "createDrizzleMysqlOutboxPort",
+      ],
+      setupNames: [
+        "createDrizzleSqliteOutboxSetupStatements",
+        "createDrizzlePostgresOutboxSetupStatements",
+        "createDrizzleMysqlOutboxSetupStatements",
+      ],
+      explicitFactoryPattern: "createDrizzle[A-Za-z]*Outbox(?:Port)?",
+      explicitSetupPattern: "createDrizzle[A-Za-z]*OutboxSetupStatements",
     },
     {
       capability: "audit",
-      defaultTableName: "audit_log",
+      table: "audit",
       code: "BEIGNET_AUDIT_TABLE_MISSING",
-      factoryPattern: "createDrizzle(?:[A-Za-z]+AuditLogPort|AuditLog)",
-      setupPattern: "createDrizzle[A-Za-z]+AuditLogSetupStatements",
+      factoryNames: [
+        "createDrizzleSqliteAuditLogPort",
+        "createDrizzlePostgresAuditLogPort",
+        "createDrizzleMysqlAuditLogPort",
+      ],
+      setupNames: [
+        "createDrizzleSqliteAuditLogSetupStatements",
+        "createDrizzlePostgresAuditLogSetupStatements",
+        "createDrizzleMysqlAuditLogSetupStatements",
+      ],
+      explicitFactoryPattern: "createDrizzle[A-Za-z]*AuditLog(?:Port)?",
+      explicitSetupPattern: "createDrizzle[A-Za-z]*AuditLogSetupStatements",
     },
   ];
 
@@ -4365,6 +4272,7 @@ async function inspectDurableDrizzleTableDrift(
     const tableNames = await configuredDurableDrizzleTableNames(
       targetDir,
       usageFiles,
+      config,
       requirement,
       sourceCache,
     );
@@ -4375,6 +4283,7 @@ async function inspectDurableDrizzleTableDrift(
         await durableDrizzleTableExists(
           targetDir,
           files,
+          config,
           infrastructurePath,
           schemaDir,
           requirement,
@@ -4412,17 +4321,29 @@ function durableDrizzleUsageFiles(
 async function configuredDurableDrizzleTableNames(
   targetDir: string,
   files: string[],
+  config: ResolvedBeignetConfig,
   requirement: DurableDrizzleTableRequirement,
   sourceCache: Map<string, string>,
 ): Promise<Set<string>> {
   const tableNames = new Set<string>();
+  const providerDefaultTableName =
+    defaultBeignetConfig.database.tables[requirement.table];
+  const configuredTableName = config.database.tables[requirement.table];
 
   for (const file of files) {
     const source = await readCachedSource(targetDir, file, sourceCache);
-    for (const tableName of tableNamesFromCalls(
+    for (const tableName of tableNamesFromBeignetProviderCalls(
+      source,
+      requirement.factoryNames,
+      providerDefaultTableName,
+      configuredTableName,
+    )) {
+      tableNames.add(tableName);
+    }
+    for (const tableName of tableNamesFromExplicitCalls(
       source,
-      requirement.factoryPattern,
-      requirement.defaultTableName,
+      requirement.explicitFactoryPattern,
+      configuredTableName,
     )) {
       tableNames.add(tableName);
     }
@@ -4434,21 +4355,25 @@ async function configuredDurableDrizzleTableNames(
 async function durableDrizzleTableExists(
   targetDir: string,
   files: string[],
+  config: ResolvedBeignetConfig,
   infrastructurePath: string,
   schemaDir: string,
   requirement: DurableDrizzleTableRequirement,
   tableName: string,
   sourceCache: Map<string, string>,
 ): Promise<boolean> {
-  const schemaFiles = files.filter(
-    (file) =>
-      file.startsWith(`${schemaDir}/`) &&
-      /\.(?:ts|mts|cts)$/.test(file) &&
-      !isTestSourceFile(file),
-  );
-  for (const file of schemaFiles) {
-    const source = await readCachedSource(targetDir, file, sourceCache);
-    if (source.includes(tableName)) return true;
+  if (
+    await providerRequiredTableExists(
+      targetDir,
+      files,
+      config,
+      infrastructurePath,
+      schemaDir,
+      tableName,
+      sourceCache,
+    )
+  ) {
+    return true;
   }
 
   const setupFiles = files.filter(
@@ -4458,16 +4383,22 @@ async function durableDrizzleTableExists(
         file.startsWith(`${infrastructurePath}/db/`)) &&
       /\.(?:ts|js|mts|mjs|cts|cjs|sql)$/.test(file),
   );
+  const providerDefaultTableName =
+    defaultBeignetConfig.database.tables[requirement.table];
+  const configuredTableName = config.database.tables[requirement.table];
   for (const file of setupFiles) {
     const source = await readCachedSource(targetDir, file, sourceCache);
-    if (sourceCreatesTable(source, tableName)) return true;
-
-    if (!requirement.setupPattern) continue;
     if (
-      tableNamesFromCalls(
+      tableNamesFromBeignetProviderCalls(
         source,
-        requirement.setupPattern,
-        requirement.defaultTableName,
+        requirement.setupNames,
+        providerDefaultTableName,
+        configuredTableName,
+      ).has(tableName) ||
+      tableNamesFromExplicitCalls(
+        source,
+        requirement.explicitSetupPattern,
+        configuredTableName,
       ).has(tableName)
     ) {
       return true;
@@ -4477,17 +4408,30 @@ async function durableDrizzleTableExists(
   return false;
 }
 
-function sourceCreatesTable(source: string, tableName: string): boolean {
-  return new RegExp(
-    `\\bCREATE\\s+TABLE\\b[\\s\\S]{0,200}${escapeRegExp(tableName)}\\b`,
-    "i",
-  ).test(source);
+function tableNamesFromBeignetProviderCalls(
+  source: string,
+  exportNames: readonly string[],
+  defaultTableName: string,
+  configuredTableName: string,
+): Set<string> {
+  const tableNames = new Set<string>();
+  for (const callee of beignetProviderCallees(source, exportNames)) {
+    for (const tableName of tableNamesFromCallee(
+      source,
+      callee,
+      defaultTableName,
+      configuredTableName,
+    )) {
+      tableNames.add(tableName);
+    }
+  }
+  return tableNames;
 }
 
-function tableNamesFromCalls(
+function tableNamesFromExplicitCalls(
   source: string,
   calleePattern: string,
-  defaultTableName: string,
+  configuredTableName: string,
 ): Set<string> {
   const tableNames = new Set<string>();
   const callPattern = new RegExp(
@@ -4500,16 +4444,115 @@ function tableNamesFromCalls(
     const prefix = source.slice(Math.max(0, matchIndex - 32), matchIndex);
     if (/\bfunction\s+$/.test(prefix)) continue;
 
-    const argsSource = match[1] ?? "";
-    const tableName = /\btableName\s*:\s*["'`]([^"'`]+)["'`]/.exec(
-      argsSource,
-    )?.[1];
-    tableNames.add(tableName ?? defaultTableName);
+    const tableName = tableNameFromArgs(match[1] ?? "", configuredTableName);
+    if (tableName) tableNames.add(tableName);
+  }
+
+  return tableNames;
+}
+
+type BeignetProviderCallee =
+  | { kind: "identifier"; name: string }
+  | { kind: "namespace"; namespace: string; name: string };
+
+function beignetProviderCallees(
+  source: string,
+  exportNames: readonly string[],
+): BeignetProviderCallee[] {
+  const exportNameSet = new Set(exportNames);
+  const callees: BeignetProviderCallee[] = [];
+
+  for (const match of source.matchAll(
+    /\bimport\s+(?:type\s+)?\{([^}]*)\}\s+from\s+["']@beignet\/provider-db-drizzle\/(?:sqlite|postgres|mysql)["']/g,
+  )) {
+    for (const specifier of match[1].split(",")) {
+      const cleaned = specifier.trim().replace(/^type\s+/, "");
+      if (!cleaned) continue;
+      const [imported, local] = cleaned.split(/\s+as\s+/);
+      if (!exportNameSet.has(imported)) continue;
+      callees.push({ kind: "identifier", name: local?.trim() || imported });
+    }
+  }
+
+  for (const match of source.matchAll(
+    /\bimport\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+["']@beignet\/provider-db-drizzle\/(?:sqlite|postgres|mysql)["']/g,
+  )) {
+    for (const exportName of exportNames) {
+      callees.push({
+        kind: "namespace",
+        namespace: match[1],
+        name: exportName,
+      });
+    }
+  }
+
+  return callees;
+}
+
+function tableNamesFromCallee(
+  source: string,
+  callee: BeignetProviderCallee,
+  defaultTableName: string,
+  configuredTableName: string,
+): Set<string> {
+  const tableNames = new Set<string>();
+  const calleePattern =
+    callee.kind === "identifier"
+      ? `\\b${escapeRegExp(callee.name)}`
+      : `\\b${escapeRegExp(callee.namespace)}\\s*\\.\\s*${escapeRegExp(
+          callee.name,
+        )}`;
+  const callPattern = new RegExp(
+    `${calleePattern}\\s*\\(([\\s\\S]{0,800}?)\\)`,
+    "g",
+  );
+
+  for (const match of source.matchAll(callPattern)) {
+    const matchIndex = match.index ?? 0;
+    const prefix = source.slice(Math.max(0, matchIndex - 32), matchIndex);
+    if (/\bfunction\s+$/.test(prefix)) continue;
+
+    tableNames.add(
+      tableNameFromArgs(match[1] ?? "", configuredTableName) ??
+        defaultTableName,
+    );
   }
 
   return tableNames;
 }
 
+function tableNameFromArgs(
+  argsSource: string,
+  configuredTableName: string,
+): string | undefined {
+  const literal = /\btableName\s*:\s*["'`]([^"'`]+)["'`]/.exec(argsSource)?.[1];
+  if (literal) return literal;
+  if (/\btableName\s*:/.test(argsSource)) return configuredTableName;
+  return undefined;
+}
+
+function configuredProviderRequiredTables(
+  tableNames: readonly string[],
+  config: ResolvedBeignetConfig,
+): string[] {
+  return tableNames.map((tableName) =>
+    configuredProviderRequiredTable(tableName, config),
+  );
+}
+
+function configuredProviderRequiredTable(
+  tableName: string,
+  config: ResolvedBeignetConfig,
+): string {
+  for (const [key, defaultTableName] of Object.entries(
+    defaultBeignetConfig.database.tables,
+  ) as Array<[keyof BeignetDatabaseTables, string]>) {
+    if (tableName === defaultTableName) return config.database.tables[key];
+  }
+
+  return tableName;
+}
+
 function hasRepositoryAdapterFile(
   files: string[],
   infrastructureDir: string,