@beignet/cli 0.0.23 → 0.0.25

package/dist/inspect.js

@@ -1,10 +1,10 @@
 import { readdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { parseProviderPackageMetadata, } from "@beignet/core/providers";
+import { parseProviderPackageMetadata } from "@beignet/core/providers";
 import { createPainter } from "./ansi.js";
-import { clientDirPath, clientFormsPath, clientIndexPath, directoryPath, loadBeignetConfig, normalizePath, resolveConfig, } from "./config.js";
+import { clientDirPath, clientFormsPath, clientIndexPath, defaultBeignetConfig, directoryPath, loadBeignetConfig, normalizePath, resolveConfig, } from "./config.js";
 import { formatGithubAnnotation, } from "./github-annotations.js";
+import { detectedProviderVariants, diagnosticPackageJsonFile, formatProviderMetadataIssues, installedPackageNames, providerDoctorRulesForInstalledPackages, providerOperationalConfigFiles, providerRequiredEnvExists, providerRequiredTableExists, providerVariantRegistrationSeverity, readProviderListEntries, readProviderPackageMetadataSource, registrationTokenHint, serverProviderFiles, } from "./provider-audit.js";
 import { appendToArrayExpression, appendToNamedArray, appendToOutboxRegistryArray, arrayInitializerInfo, identifiersFromArrayExpression, insertAfterImports, matchingDelimiterIndex, outboxRegistryValueInfo, } from "./registry-edits.js";
 import { getCliVersion } from "./version.js";
 export async function inspectApp(options = {}) {
@@ -135,9 +135,47 @@ export function formatDoctor(result, options = {}) {
   ${diagnostic.message}`;
         }));
     }
+    const checklist = productionHardeningChecklist(result.diagnostics);
+    if (checklist.length > 0) {
+        lines.push("", paint("Production Hardening Checklist:", "bold"), "");
+        lines.push(...checklist.map((item) => `- ${item}`));
+    }
     lines.push("", formatDoctorFooter(result));
     return lines.join("\n");
 }
+const productionHardeningDiagnosticCodes = new Set([
+    "BEIGNET_AUTH_ROUTE_MISSING",
+    "BEIGNET_AUTH_TRUSTED_ORIGINS_MISSING",
+    "BEIGNET_BETTER_AUTH_SECRET_PLACEHOLDER",
+    "BEIGNET_BILLING_CHECKOUT_IDEMPOTENCY_MISSING",
+    "BEIGNET_BILLING_ENTITLEMENTS_PROVIDER_MISSING",
+    "BEIGNET_BILLING_IDEMPOTENCY_PORT_MISSING",
+    "BEIGNET_CORS_CREDENTIALS_WILDCARD",
+    "BEIGNET_CRON_SECRET_MISSING",
+    "BEIGNET_DEVTOOLS_ROUTE_EXPOSED",
+    "BEIGNET_ENTITLEMENTS_PORT_MISSING",
+    "BEIGNET_PAYMENTS_STRIPE_MEMORY_PROVIDER",
+    "BEIGNET_PAYMENTS_WEBHOOK_ROUTE_MISSING",
+    "BEIGNET_PROVIDER_ENV_MISSING",
+    "BEIGNET_PROVIDER_TABLE_MISSING",
+    "BEIGNET_READINESS_ROUTE_MISSING",
+    "BEIGNET_TENANT_HEADER_AUTHORITY",
+    "BEIGNET_UPLOAD_AUTHORIZATION_MISSING",
+    "BEIGNET_UPLOAD_SIZE_LIMIT_MISSING",
+]);
+function productionHardeningChecklist(diagnostics) {
+    if (!diagnostics.some((diagnostic) => productionHardeningDiagnosticCodes.has(diagnostic.code))) {
+        return [];
+    }
+    return [
+        "Secrets and provider credentials are unique per environment, validated at startup, never committed, and never logged.",
+        "Auth routes, tenant resolution, authorization policies, and trusted origins derive authority from verified sessions, API keys, or trusted gateway metadata.",
+        "Devtools, OpenAPI, cron, webhooks, and operational routes have intentional exposure and app-owned authorization.",
+        "CORS origins, proxy IP trust, rate-limit keys, and request body limits match the production host topology.",
+        "Uploads and storage define max sizes, authorization or explicit public access, object visibility, safe content headers, and short direct-upload expirations.",
+        "Provider-backed dependencies have bounded readiness checks, worker shutdown behavior, webhook secrets, and least-privilege credentials.",
+    ];
+}
 function formatDoctorFooter(result) {
     const count = (severity) => result.diagnostics.filter((diagnostic) => diagnostic.severity === severity)
         .length;
@@ -1187,6 +1225,8 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
     const installedPackages = installedPackageNames(packageJson);
     const providerDoctorRules = await providerDoctorRulesForInstalledPackages(targetDir, packageJson);
     const configFiles = operationalConfigFiles(files, config);
+    const infrastructurePath = directoryPath(path.dirname(config.paths.infrastructurePorts));
+    const schemaDir = `${infrastructurePath}/db/schema`;
     for (const file of files) {
         if (!file.endsWith(".ts") || file.endsWith(".test.ts"))
             continue;
@@ -1222,6 +1262,26 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
                 message: `${file} defines an upload without maxSizeBytes. Add an explicit size limit so upload behavior is predictable before deployment.`,
             });
         }
+        if (isFeatureUploadDefinition(file, config) &&
+            containsCallExpression(source, "defineUpload") &&
+            !/\bauthorize\s*(?:\(|:)/.test(source) &&
+            !/\baccess\s*:\s*["']public["']/.test(source)) {
+            diagnostics.push({
+                severity: "warning",
+                code: "BEIGNET_UPLOAD_AUTHORIZATION_MISSING",
+                file,
+                message: `${file} defines a protected upload without authorize(...). Add an authorize hook, or set access: "public" only for intentionally public uploads.`,
+            });
+        }
+        if (isRouteServerOrInfraFile(file, config) &&
+            containsRequestTenantHeaderAuthority(source)) {
+            diagnostics.push({
+                severity: "warning",
+                code: "BEIGNET_TENANT_HEADER_AUTHORITY",
+                file,
+                message: `${file} reads x-tenant-id and turns it into tenant authority. Resolve request tenants from verified auth/session claims or trusted gateway metadata instead of a caller-controlled header.`,
+            });
+        }
         if (isRouteServerOrInfraFile(file, config) &&
             containsCallExpression(source, "createCorsHooks") &&
             /\bcredentials\s*:\s*true\b/.test(source) &&
@@ -1234,6 +1294,17 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
             });
         }
     }
+    for (const file of configFiles) {
+        const source = await readCachedSource(targetDir, file, sourceCache);
+        if (containsBetterAuthLocalSecret(source)) {
+            diagnostics.push({
+                severity: "warning",
+                code: "BEIGNET_BETTER_AUTH_SECRET_PLACEHOLDER",
+                file,
+                message: `${file} contains the known local Better Auth placeholder secret. Keep it out of production configuration and require a unique BETTER_AUTH_SECRET before deployment.`,
+            });
+        }
+    }
     const providerEntries = await readProviderListEntries(targetDir, files, config, sourceCache);
     const stripeMemoryProviderMismatch = await hasStripeMemoryProviderMismatch(targetDir, sourceCache, configFiles, installedPackages, providerEntries);
     diagnostics.push(...(await inspectEntitlementsProductionReadiness(targetDir, files, config, sourceCache)), ...(await inspectPaymentsProductionReadiness(targetDir, files, config, sourceCache, installedPackages, stripeMemoryProviderMismatch)));
@@ -1245,7 +1316,7 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
             // app actually registers; an unused variant must not warn.
             for (const variant of detectedProviderVariants(provider.variants, providerEntries)) {
                 for (const envVar of variant.requiredEnv) {
-                    if (await anyFileContains(targetDir, configFiles, envVar, sourceCache)) {
+                    if (await providerRequiredEnvExists(targetDir, configFiles, envVar, sourceCache)) {
                         continue;
                     }
                     diagnostics.push({
@@ -1255,11 +1326,22 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
                         message: `${provider.packageName} is installed and ${variant.displayName} is registered, but ${envVar} is not mentioned in app env/config files. ${variant.displayName} requires ${envVar}; add the environment variable or remove the provider registration.`,
                     });
                 }
+                for (const tableName of configuredProviderRequiredTables(variant.requiredTables, config)) {
+                    if (await providerRequiredTableExists(targetDir, files, config, infrastructurePath, schemaDir, tableName, sourceCache)) {
+                        continue;
+                    }
+                    diagnostics.push({
+                        severity: "warning",
+                        code: "BEIGNET_PROVIDER_TABLE_MISSING",
+                        file: schemaDir,
+                        message: `${provider.packageName} is installed and ${variant.displayName} is registered, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema generate, include it in your Drizzle schema/migrations, or remove the provider registration.`,
+                    });
+                }
             }
             continue;
         }
         for (const envVar of provider.requiredEnv ?? []) {
-            if (await anyFileContains(targetDir, configFiles, envVar, sourceCache)) {
+            if (await providerRequiredEnvExists(targetDir, configFiles, envVar, sourceCache)) {
                 continue;
             }
             diagnostics.push({
@@ -1269,6 +1351,17 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
                 message: `${provider.packageName} is installed, but ${envVar} is not mentioned in app env/config files. Add the expected environment variable or remove the unused provider package.`,
             });
         }
+        for (const tableName of configuredProviderRequiredTables(provider.requiredTables ?? [], config)) {
+            if (await providerRequiredTableExists(targetDir, files, config, infrastructurePath, schemaDir, tableName, sourceCache)) {
+                continue;
+            }
+            diagnostics.push({
+                severity: "warning",
+                code: "BEIGNET_PROVIDER_TABLE_MISSING",
+                file: schemaDir,
+                message: `${provider.packageName} is installed, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema generate, include it in your Drizzle schema/migrations, or remove the unused provider package.`,
+            });
+        }
     }
     if (installedPackages.has("@beignet/provider-auth-better-auth")) {
         if (!hasBetterAuthRoute(files, config)) {
@@ -1323,6 +1416,19 @@ function containsReadinessCheck(source) {
         return false;
     return /\bchecks\s*:/.test(source) || /\.checkHealth\s*\(/.test(source);
 }
+function containsBetterAuthLocalSecret(source) {
+    if (!source.includes("local-dev-better-auth-secret-change-me"))
+        return false;
+    const hasProductionRuntimeGuard = /\bisProductionRuntime\s*=\s*process\.env\.NODE_ENV\s*===\s*["']production["']\s*&&\s*process\.env\.NEXT_PHASE\s*!==\s*["']phase-production-build["']/.test(source) &&
+        /BETTER_AUTH_SECRET\s*:\s*isProductionRuntime\s*\?\s*BetterAuthSecret\s*:\s*BetterAuthSecret\.default\(LOCAL_BETTER_AUTH_SECRET\)/s.test(source);
+    const hasProductionGuard = /BETTER_AUTH_SECRET\s*:\s*process\.env\.NODE_ENV\s*===\s*["']production["']\s*\?\s*BetterAuthSecret\s*:\s*BetterAuthSecret\.default\(LOCAL_BETTER_AUTH_SECRET\)/s.test(source);
+    return !(hasProductionRuntimeGuard || hasProductionGuard);
+}
+function containsRequestTenantHeaderAuthority(source) {
+    return (/(?:(?:\breq|\brequest)\.headers|(?<!\.)\bheaders)\.get\(\s*["']x-tenant-id["']\s*\)/.test(source) &&
+        (/\bcreateTenant\s*\(/.test(source) ||
+            /\btenant\s*:\s*\{?\s*id\s*:/.test(source)));
+}
 async function inspectEntitlementsProductionReadiness(targetDir, files, config, sourceCache) {
     if (!(await usesEntitlementChecks(targetDir, files, sourceCache)) ||
         (await appPortsIncludesPort(targetDir, files, config, sourceCache, "entitlements"))) {
@@ -1599,58 +1705,13 @@ function isFeatureUploadDefinition(file, config) {
     return new RegExp(`^${escapeRegExp(featuresPath)}/[^/]+/uploads/[^/]+\\.ts$`).test(file);
 }
 function operationalConfigFiles(files, config) {
-    return files.filter((file) => {
-        if (file === ".env.example")
-            return true;
-        if (file === "drizzle.config.ts")
-            return true;
-        if (file === "lib/env.ts" || file === "lib/better-auth.ts")
-            return true;
-        if (isInfraOrServerFile(file, config) && file.endsWith(".ts"))
-            return true;
-        return false;
-    });
+    return providerOperationalConfigFiles(files, config);
 }
 async function readPackageJson(targetDir, files) {
     if (!files.includes("package.json"))
         return undefined;
     return JSON.parse(await readFile(path.join(targetDir, "package.json"), "utf8"));
 }
-async function providerDoctorRulesForInstalledPackages(targetDir, packageJson) {
-    const packageNames = [...installedPackageNames(packageJson)];
-    const rules = await Promise.all(packageNames.map(async (packageName) => {
-        const source = await readProviderPackageMetadataSource(targetDir, packageName);
-        if (!source)
-            return undefined;
-        const result = parseProviderPackageMetadata(source.metadata);
-        if (!result.success)
-            return undefined;
-        return providerDoctorRuleFromMetadata(packageName, result.metadata);
-    }));
-    return rules.filter((rule) => Boolean(rule));
-}
-async function readProviderPackageMetadataSource(targetDir, packageName) {
-    for (const candidate of providerPackageJsonCandidates(targetDir, packageName)) {
-        const packageJson = await readJsonIfExists(candidate);
-        const metadata = packageJson?.beignet?.provider;
-        if (metadata !== undefined) {
-            return { packageName, file: candidate, metadata };
-        }
-    }
-    return undefined;
-}
-function providerPackageJsonCandidates(targetDir, packageName) {
-    const candidates = [
-        path.join(targetDir, "node_modules", ...packageName.split("/"), "package.json"),
-    ];
-    if (packageName.startsWith("@beignet/")) {
-        candidates.push(path.resolve(
-        // import.meta.dir is Bun-only; the published bin also runs under
-        // plain Node, where only import.meta.url is available.
-        path.dirname(fileURLToPath(import.meta.url)), "../../..", "packages", packageName.slice("@beignet/".length), "package.json"));
-    }
-    return candidates;
-}
 async function readJsonIfExists(file) {
     try {
         return JSON.parse(await readFile(file, "utf8"));
@@ -1664,158 +1725,6 @@ async function readJsonIfExists(file) {
         throw error;
     }
 }
-function providerDoctorRuleFromMetadata(packageName, metadata) {
-    const registration = metadata.registration;
-    return {
-        packageName,
-        displayName: metadata.displayName ?? packageName,
-        tokens: registration?.tokens ?? [],
-        appPorts: metadata.appPorts ?? [],
-        requiredEnv: metadata.requiredEnv ?? [],
-        registrationSeverity: registrationSeverityFromMetadata(registration),
-        variants: metadata.variants?.map((variant) => ({
-            name: variant.name,
-            displayName: variant.displayName ?? variant.name,
-            tokens: variant.registration?.tokens ?? [],
-            requiredEnv: variant.requiredEnv ?? [],
-            registrationSeverity: registrationSeverityFromMetadata(variant.registration),
-        })),
-    };
-}
-function registrationSeverityFromMetadata(registration) {
-    return (registration?.severity ??
-        (registration?.required === true ? "warning" : undefined));
-}
-function detectedProviderVariants(variants, providerEntries) {
-    return variants.filter((variant) => variant.tokens.some((token) => providerEntries.some((entry) => entry.includes(token))));
-}
-function providerVariantRegistrationSeverity(variants) {
-    const severities = variants.map((variant) => variant.registrationSeverity);
-    if (severities.includes("warning"))
-        return "warning";
-    if (severities.includes("hint"))
-        return "hint";
-    return undefined;
-}
-async function readProviderListEntries(targetDir, files, config, sourceCache) {
-    const providerFiles = serverProviderFiles(files, config);
-    const providerSource = (await Promise.all(providerFiles.map((file) => readCachedSource(targetDir, file, sourceCache)))).join("\n");
-    const providerListSource = extractProviderListSource(providerSource);
-    return providerListSource === undefined
-        ? []
-        : providerListEntries(providerListSource);
-}
-function registrationTokenHint(tokens) {
-    const token = tokens[0];
-    if (!token)
-        return "the provider";
-    return token.startsWith("create") ? `${token}()` : token;
-}
-function diagnosticPackageJsonFile(targetDir, file) {
-    const relative = normalizePath(path.relative(targetDir, file));
-    if (relative.startsWith("../"))
-        return "package.json";
-    return relative;
-}
-function formatProviderMetadataIssues(issues) {
-    return issues.map((issue) => `${issue.path} ${issue.message}`).join("; ");
-}
-function installedPackageNames(packageJson) {
-    return new Set([
-        ...Object.keys(packageJson?.dependencies ?? {}),
-        ...Object.keys(packageJson?.devDependencies ?? {}),
-        ...Object.keys(packageJson?.peerDependencies ?? {}),
-    ]);
-}
-function serverProviderFiles(files, config) {
-    const serverDir = directoryPath(path.dirname(config.paths.server));
-    const candidates = [`${serverDir}/providers.ts`, config.paths.server];
-    return candidates.filter((file) => files.includes(file));
-}
-function extractProviderListSource(source) {
-    const listMatches = [
-        ...source.matchAll(/\bproviders\s*=\s*\[([\s\S]*?)\]\s*(?:;|as const)/g),
-        ...source.matchAll(/\bproviders\s*:\s*\[([\s\S]*?)\]/g),
-    ];
-    if (listMatches.length === 0)
-        return undefined;
-    return listMatches.map((match) => match[1]).join("\n");
-}
-function providerListEntries(source) {
-    const entries = [];
-    let current = "";
-    let depth = 0;
-    let quote;
-    let escaped = false;
-    let lineComment = false;
-    let blockComment = false;
-    for (let index = 0; index < source.length; index += 1) {
-        const char = source[index];
-        const next = source[index + 1];
-        if (lineComment) {
-            if (char === "\n") {
-                lineComment = false;
-                current += char;
-            }
-            continue;
-        }
-        if (blockComment) {
-            if (char === "*" && next === "/") {
-                blockComment = false;
-                index += 1;
-            }
-            continue;
-        }
-        if (quote) {
-            current += char;
-            if (escaped) {
-                escaped = false;
-                continue;
-            }
-            if (char === "\\") {
-                escaped = true;
-                continue;
-            }
-            if (char === quote) {
-                quote = undefined;
-            }
-            continue;
-        }
-        if (char === "/" && next === "/") {
-            lineComment = true;
-            index += 1;
-            continue;
-        }
-        if (char === "/" && next === "*") {
-            blockComment = true;
-            index += 1;
-            continue;
-        }
-        if (char === '"' || char === "'" || char === "`") {
-            quote = char;
-            current += char;
-            continue;
-        }
-        if (char === "(" || char === "[" || char === "{") {
-            depth += 1;
-        }
-        else if (char === ")" || char === "]" || char === "}") {
-            depth = Math.max(0, depth - 1);
-        }
-        if (char === "," && depth === 0) {
-            const entry = current.trim();
-            if (entry)
-                entries.push(entry);
-            current = "";
-            continue;
-        }
-        current += char;
-    }
-    const entry = current.trim();
-    if (entry)
-        entries.push(entry);
-    return entries;
-}
 function findProviderEntryIndex(entries, tokens) {
     return entries.findIndex((entry) => tokens.some((token) => entry.includes(token)));
 }
@@ -2713,35 +2622,65 @@ async function inspectDatabaseLifecycleDrift(targetDir, files, config, conventio
 const durableDrizzleTableRequirements = [
     {
         capability: "idempotency",
-        defaultTableName: "idempotency_records",
+        table: "idempotency",
         code: "BEIGNET_IDEMPOTENCY_TABLE_MISSING",
-        factoryPattern: "createDrizzle[A-Za-z]+IdempotencyPort",
-        setupPattern: "createDrizzle[A-Za-z]+IdempotencySetupStatements",
+        factoryNames: [
+            "createDrizzleSqliteIdempotencyPort",
+            "createDrizzlePostgresIdempotencyPort",
+            "createDrizzleMysqlIdempotencyPort",
+        ],
+        setupNames: [
+            "createDrizzleSqliteIdempotencySetupStatements",
+            "createDrizzlePostgresIdempotencySetupStatements",
+            "createDrizzleMysqlIdempotencySetupStatements",
+        ],
+        explicitFactoryPattern: "createDrizzle[A-Za-z]*Idempotency(?:Port)?",
+        explicitSetupPattern: "createDrizzle[A-Za-z]*IdempotencySetupStatements",
     },
     {
         capability: "outbox",
-        defaultTableName: "outbox_messages",
+        table: "outbox",
         code: "BEIGNET_OUTBOX_TABLE_MISSING",
-        factoryPattern: "createDrizzle[A-Za-z]+OutboxPort",
-        setupPattern: "createDrizzle[A-Za-z]+OutboxSetupStatements",
+        factoryNames: [
+            "createDrizzleSqliteOutboxPort",
+            "createDrizzlePostgresOutboxPort",
+            "createDrizzleMysqlOutboxPort",
+        ],
+        setupNames: [
+            "createDrizzleSqliteOutboxSetupStatements",
+            "createDrizzlePostgresOutboxSetupStatements",
+            "createDrizzleMysqlOutboxSetupStatements",
+        ],
+        explicitFactoryPattern: "createDrizzle[A-Za-z]*Outbox(?:Port)?",
+        explicitSetupPattern: "createDrizzle[A-Za-z]*OutboxSetupStatements",
     },
     {
         capability: "audit",
-        defaultTableName: "audit_log",
+        table: "audit",
         code: "BEIGNET_AUDIT_TABLE_MISSING",
-        factoryPattern: "createDrizzle(?:[A-Za-z]+AuditLogPort|AuditLog)",
-        setupPattern: "createDrizzle[A-Za-z]+AuditLogSetupStatements",
+        factoryNames: [
+            "createDrizzleSqliteAuditLogPort",
+            "createDrizzlePostgresAuditLogPort",
+            "createDrizzleMysqlAuditLogPort",
+        ],
+        setupNames: [
+            "createDrizzleSqliteAuditLogSetupStatements",
+            "createDrizzlePostgresAuditLogSetupStatements",
+            "createDrizzleMysqlAuditLogSetupStatements",
+        ],
+        explicitFactoryPattern: "createDrizzle[A-Za-z]*AuditLog(?:Port)?",
+        explicitSetupPattern: "createDrizzle[A-Za-z]*AuditLogSetupStatements",
     },
 ];
 async function inspectDurableDrizzleTableDrift(targetDir, files, config, infrastructurePath, schemaDir, sourceCache) {
     const diagnostics = [];
     const usageFiles = durableDrizzleUsageFiles(files, config);
     for (const requirement of durableDrizzleTableRequirements) {
-        const tableNames = await configuredDurableDrizzleTableNames(targetDir, usageFiles, requirement, sourceCache);
+        const tableNames = await configuredDurableDrizzleTableNames(targetDir, usageFiles, config, requirement, sourceCache);
         if (tableNames.size === 0)
             continue;
         for (const tableName of tableNames) {
-            if (await durableDrizzleTableExists(targetDir, files, infrastructurePath, schemaDir, requirement, tableName, sourceCache)) {
+            if (await durableDrizzleTableExists(targetDir, files, config, infrastructurePath, schemaDir, requirement, tableName, sourceCache)) {
                 continue;
             }
             diagnostics.push({
@@ -2759,45 +2698,50 @@ function durableDrizzleUsageFiles(files, config) {
         !isTestSourceFile(file) &&
         isInfraOrServerFile(file, config));
 }
-async function configuredDurableDrizzleTableNames(targetDir, files, requirement, sourceCache) {
+async function configuredDurableDrizzleTableNames(targetDir, files, config, requirement, sourceCache) {
     const tableNames = new Set();
+    const providerDefaultTableName = defaultBeignetConfig.database.tables[requirement.table];
+    const configuredTableName = config.database.tables[requirement.table];
     for (const file of files) {
         const source = await readCachedSource(targetDir, file, sourceCache);
-        for (const tableName of tableNamesFromCalls(source, requirement.factoryPattern, requirement.defaultTableName)) {
+        for (const tableName of tableNamesFromBeignetProviderCalls(source, requirement.factoryNames, providerDefaultTableName, configuredTableName)) {
+            tableNames.add(tableName);
+        }
+        for (const tableName of tableNamesFromExplicitCalls(source, requirement.explicitFactoryPattern, configuredTableName)) {
             tableNames.add(tableName);
         }
     }
     return tableNames;
 }
-async function durableDrizzleTableExists(targetDir, files, infrastructurePath, schemaDir, requirement, tableName, sourceCache) {
-    const schemaFiles = files.filter((file) => file.startsWith(`${schemaDir}/`) &&
-        /\.(?:ts|mts|cts)$/.test(file) &&
-        !isTestSourceFile(file));
-    for (const file of schemaFiles) {
-        const source = await readCachedSource(targetDir, file, sourceCache);
-        if (source.includes(tableName))
-            return true;
+async function durableDrizzleTableExists(targetDir, files, config, infrastructurePath, schemaDir, requirement, tableName, sourceCache) {
+    if (await providerRequiredTableExists(targetDir, files, config, infrastructurePath, schemaDir, tableName, sourceCache)) {
+        return true;
     }
     const setupFiles = files.filter((file) => !isTestSourceFile(file) &&
         (file.startsWith("drizzle/") ||
             file.startsWith(`${infrastructurePath}/db/`)) &&
         /\.(?:ts|js|mts|mjs|cts|cjs|sql)$/.test(file));
+    const providerDefaultTableName = defaultBeignetConfig.database.tables[requirement.table];
+    const configuredTableName = config.database.tables[requirement.table];
     for (const file of setupFiles) {
         const source = await readCachedSource(targetDir, file, sourceCache);
-        if (sourceCreatesTable(source, tableName))
-            return true;
-        if (!requirement.setupPattern)
-            continue;
-        if (tableNamesFromCalls(source, requirement.setupPattern, requirement.defaultTableName).has(tableName)) {
+        if (tableNamesFromBeignetProviderCalls(source, requirement.setupNames, providerDefaultTableName, configuredTableName).has(tableName) ||
+            tableNamesFromExplicitCalls(source, requirement.explicitSetupPattern, configuredTableName).has(tableName)) {
             return true;
         }
     }
     return false;
 }
-function sourceCreatesTable(source, tableName) {
-    return new RegExp(`\\bCREATE\\s+TABLE\\b[\\s\\S]{0,200}${escapeRegExp(tableName)}\\b`, "i").test(source);
+function tableNamesFromBeignetProviderCalls(source, exportNames, defaultTableName, configuredTableName) {
+    const tableNames = new Set();
+    for (const callee of beignetProviderCallees(source, exportNames)) {
+        for (const tableName of tableNamesFromCallee(source, callee, defaultTableName, configuredTableName)) {
+            tableNames.add(tableName);
+        }
+    }
+    return tableNames;
 }
-function tableNamesFromCalls(source, calleePattern, defaultTableName) {
+function tableNamesFromExplicitCalls(source, calleePattern, configuredTableName) {
     const tableNames = new Set();
     const callPattern = new RegExp(`\\b${calleePattern}\\s*\\(([\\s\\S]{0,800}?)\\)`, "g");
     for (const match of source.matchAll(callPattern)) {
@@ -2805,12 +2749,71 @@ function tableNamesFromCalls(source, calleePattern, defaultTableName) {
         const prefix = source.slice(Math.max(0, matchIndex - 32), matchIndex);
         if (/\bfunction\s+$/.test(prefix))
             continue;
-        const argsSource = match[1] ?? "";
-        const tableName = /\btableName\s*:\s*["'`]([^"'`]+)["'`]/.exec(argsSource)?.[1];
-        tableNames.add(tableName ?? defaultTableName);
+        const tableName = tableNameFromArgs(match[1] ?? "", configuredTableName);
+        if (tableName)
+            tableNames.add(tableName);
     }
     return tableNames;
 }
+function beignetProviderCallees(source, exportNames) {
+    const exportNameSet = new Set(exportNames);
+    const callees = [];
+    for (const match of source.matchAll(/\bimport\s+(?:type\s+)?\{([^}]*)\}\s+from\s+["']@beignet\/provider-db-drizzle\/(?:sqlite|postgres|mysql)["']/g)) {
+        for (const specifier of match[1].split(",")) {
+            const cleaned = specifier.trim().replace(/^type\s+/, "");
+            if (!cleaned)
+                continue;
+            const [imported, local] = cleaned.split(/\s+as\s+/);
+            if (!exportNameSet.has(imported))
+                continue;
+            callees.push({ kind: "identifier", name: local?.trim() || imported });
+        }
+    }
+    for (const match of source.matchAll(/\bimport\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+["']@beignet\/provider-db-drizzle\/(?:sqlite|postgres|mysql)["']/g)) {
+        for (const exportName of exportNames) {
+            callees.push({
+                kind: "namespace",
+                namespace: match[1],
+                name: exportName,
+            });
+        }
+    }
+    return callees;
+}
+function tableNamesFromCallee(source, callee, defaultTableName, configuredTableName) {
+    const tableNames = new Set();
+    const calleePattern = callee.kind === "identifier"
+        ? `\\b${escapeRegExp(callee.name)}`
+        : `\\b${escapeRegExp(callee.namespace)}\\s*\\.\\s*${escapeRegExp(callee.name)}`;
+    const callPattern = new RegExp(`${calleePattern}\\s*\\(([\\s\\S]{0,800}?)\\)`, "g");
+    for (const match of source.matchAll(callPattern)) {
+        const matchIndex = match.index ?? 0;
+        const prefix = source.slice(Math.max(0, matchIndex - 32), matchIndex);
+        if (/\bfunction\s+$/.test(prefix))
+            continue;
+        tableNames.add(tableNameFromArgs(match[1] ?? "", configuredTableName) ??
+            defaultTableName);
+    }
+    return tableNames;
+}
+function tableNameFromArgs(argsSource, configuredTableName) {
+    const literal = /\btableName\s*:\s*["'`]([^"'`]+)["'`]/.exec(argsSource)?.[1];
+    if (literal)
+        return literal;
+    if (/\btableName\s*:/.test(argsSource))
+        return configuredTableName;
+    return undefined;
+}
+function configuredProviderRequiredTables(tableNames, config) {
+    return tableNames.map((tableName) => configuredProviderRequiredTable(tableName, config));
+}
+function configuredProviderRequiredTable(tableName, config) {
+    for (const [key, defaultTableName] of Object.entries(defaultBeignetConfig.database.tables)) {
+        if (tableName === defaultTableName)
+            return config.database.tables[key];
+    }
+    return tableName;
+}
 function hasRepositoryAdapterFile(files, infrastructureDir) {
     return files.some((file) => file.startsWith(infrastructureDir) &&
         file.endsWith("-repository.ts") &&