@beignet/cli 0.0.31 → 0.0.33

package/src/inspect.ts

@@ -1,4 +1,4 @@
-import { readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { parseProviderPackageMetadata } from "@beignet/core/providers";
 import { createPainter } from "./ansi.js";
@@ -20,7 +20,10 @@ import {
   type GithubAnnotationSeverity,
 } from "./github-annotations.js";
 import {
+  createListenersRegistrySource,
+  listenersFilePath,
   providersFilePath,
+  updateListenersRegistrySource,
   wireListenersProviderSource,
 } from "./make/shared.js";
 import {
@@ -49,6 +52,12 @@ import {
   matchingDelimiterIndex,
   outboxRegistryValueInfo,
 } from "./registry-edits.js";
+import {
+  currentGeneratedPackageScripts,
+  externalVersions,
+  legacyGeneratedPackageScripts,
+} from "./templates/shared.js";
+import { testSupportTemplateFiles } from "./templates/testing.js";
 import { getCliVersion } from "./version.js";
 
 type InspectAppOptions = {
@@ -246,7 +255,7 @@ export async function applyDoctorFixes(
   const matchedRoutes = matchRoutes(contracts, routeExports);
   const fixes: InspectFix[] = [];
 
-  const packageFix = await fixMissingTestScript(targetDir, files, convention);
+  const packageFix = await fixPackageScripts(targetDir, files, convention);
   if (packageFix) fixes.push(packageFix);
 
   const routeGroupFix = await fixUnregisteredRouteGroups(
@@ -398,7 +407,11 @@ export function formatDoctor(
   return lines.join("\n");
 }
 
-const productionHardeningDiagnosticCodes = new Set([
+/**
+ * Doctor diagnostic codes that describe production hardening concerns.
+ * `beignet preflight` promotes these to gate failures.
+ */
+export const productionHardeningDiagnosticCodes = new Set([
   "BEIGNET_AUTH_ROUTE_MISSING",
   "BEIGNET_AUTH_TRUSTED_ORIGINS_MISSING",
   "BEIGNET_BETTER_AUTH_SECRET_PLACEHOLDER",
@@ -414,6 +427,7 @@ const productionHardeningDiagnosticCodes = new Set([
   "BEIGNET_PROVIDER_ENV_MISSING",
   "BEIGNET_PROVIDER_TABLE_MISSING",
   "BEIGNET_READINESS_ROUTE_MISSING",
+  "BEIGNET_SECURITY_HEADERS_MISSING",
   "BEIGNET_TENANT_HEADER_AUTHORITY",
   "BEIGNET_UPLOAD_AUTHORIZATION_MISSING",
   "BEIGNET_UPLOAD_SIZE_LIMIT_MISSING",
@@ -434,7 +448,7 @@ function productionHardeningChecklist(
     "Secrets and provider credentials are unique per environment, validated at startup, never committed, and never logged.",
     "Auth routes, tenant resolution, authorization policies, and trusted origins derive authority from verified sessions, API keys, or trusted gateway metadata.",
     "Devtools, OpenAPI, cron, webhooks, and operational routes have intentional exposure and app-owned authorization.",
-    "CORS origins, proxy IP trust, rate-limit keys, and request body limits match the production host topology.",
+    "Security headers, CORS origins, proxy IP trust, rate-limit keys, and request body limits match the production host topology.",
     "Uploads and storage define max sizes, authorization or explicit public access, object visibility, safe content headers, and short direct-upload expirations.",
     "Provider-backed dependencies have bounded readiness checks, worker shutdown behavior, webhook secrets, and least-privilege credentials.",
   ];
@@ -1428,6 +1442,12 @@ async function inspectDiagnostics(
       config,
       convention,
     )),
+    ...(await inspectRuntimeManifestDrift(
+      targetDir,
+      files,
+      config,
+      convention,
+    )),
     ...(await inspectResourceSlices(
       targetDir,
       files,
@@ -1965,6 +1985,7 @@ const readinessRelevantProviderPackages = new Set([
   "@beignet/provider-auth-better-auth",
   "@beignet/provider-db-drizzle",
   "@beignet/provider-error-reporting-sentry",
+  "@beignet/provider-event-bus-redis",
   "@beignet/provider-flags-openfeature",
   "@beignet/provider-jobs-bullmq",
   "@beignet/provider-jobs-inngest",
@@ -1973,7 +1994,7 @@ const readinessRelevantProviderPackages = new Set([
   "@beignet/provider-mail-smtp",
   "@beignet/provider-payments-stripe",
   "@beignet/provider-rate-limit-upstash",
-  "@beignet/provider-redis",
+  "@beignet/provider-cache-redis",
   "@beignet/provider-search-meilisearch",
   "@beignet/provider-storage-s3",
 ]);
@@ -1999,11 +2020,20 @@ async function inspectProductionReadiness(
     path.dirname(config.paths.infrastructurePorts),
   );
   const schemaDir = `${infrastructurePath}/db/schema`;
+  let hasSecurityHeadersHook = false;
 
   for (const file of files) {
     if (!file.endsWith(".ts") || file.endsWith(".test.ts")) continue;
 
     const source = await readCachedSource(targetDir, file, sourceCache);
+    const routeServerOrInfra = isRouteServerOrInfraFile(file, config);
+
+    if (
+      routeServerOrInfra &&
+      containsCallExpression(source, "createSecurityHeadersHooks")
+    ) {
+      hasSecurityHeadersHook = true;
+    }
 
     if (
       containsCallExpression(source, "createDevtoolsRoute") &&
@@ -2059,10 +2089,7 @@ async function inspectProductionReadiness(
       });
     }
 
-    if (
-      isRouteServerOrInfraFile(file, config) &&
-      containsRequestTenantHeaderAuthority(source)
-    ) {
+    if (routeServerOrInfra && containsRequestTenantHeaderAuthority(source)) {
       diagnostics.push({
         severity: "warning",
         code: "BEIGNET_TENANT_HEADER_AUTHORITY",
@@ -2072,7 +2099,7 @@ async function inspectProductionReadiness(
     }
 
     if (
-      isRouteServerOrInfraFile(file, config) &&
+      routeServerOrInfra &&
       containsCallExpression(source, "createCorsHooks") &&
       /\bcredentials\s*:\s*true\b/.test(source) &&
       /(?:\borigin\b|\borigins\b)\s*:\s*(?:["']\*["']|\[\s*["']\*["'])/.test(
@@ -2088,6 +2115,15 @@ async function inspectProductionReadiness(
     }
   }
 
+  if (files.includes(config.paths.server) && !hasSecurityHeadersHook) {
+    diagnostics.push({
+      severity: "warning",
+      code: "BEIGNET_SECURITY_HEADERS_MISSING",
+      file: config.paths.server,
+      message: `${config.paths.server} does not install createSecurityHeadersHooks(...). Add the hook or equivalent platform-managed headers before exposing browser traffic.`,
+    });
+  }
+
   for (const file of configFiles) {
     const source = await readCachedSource(targetDir, file, sourceCache);
 
@@ -2182,7 +2218,7 @@ async function inspectProductionReadiness(
             severity: "warning",
             code: "BEIGNET_PROVIDER_TABLE_MISSING",
             file: schemaDir,
-            message: `${provider.packageName} is installed and ${variant.displayName} is registered, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema generate, include it in your Drizzle schema/migrations, or remove the provider registration.`,
+            message: `${provider.packageName} is installed and ${variant.displayName} is registered, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema sync, include it in your Drizzle schema/migrations, or remove the provider registration.`,
           });
         }
       }
@@ -2229,7 +2265,7 @@ async function inspectProductionReadiness(
         severity: "warning",
         code: "BEIGNET_PROVIDER_TABLE_MISSING",
         file: schemaDir,
-        message: `${provider.packageName} is installed, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema generate, include it in your Drizzle schema/migrations, or remove the unused provider package.`,
+        message: `${provider.packageName} is installed, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema sync, include it in your Drizzle schema/migrations, or remove the unused provider package.`,
       });
     }
   }
@@ -3482,6 +3518,92 @@ async function inspectWorkflowRegistrationDrift(
   return diagnostics;
 }
 
+type RuntimeManifestIdentifierSets = {
+  file: string;
+  listeners: Set<string>;
+  schedules: Set<string>;
+  tasks: Set<string>;
+  events: Set<string>;
+  jobs: Set<string>;
+};
+
+async function inspectRuntimeManifestDrift(
+  targetDir: string,
+  files: string[],
+  config: ResolvedBeignetConfig,
+  convention: InspectConvention,
+): Promise<InspectDiagnostic[]> {
+  if (!convention.resourceGenerator) return [];
+
+  const manifest = await readRuntimeManifestIdentifiers(targetDir, files);
+  if (!manifest) return [];
+
+  const registries = await readFeatureWorkflowRegistries(
+    targetDir,
+    files,
+    config,
+  );
+  const diagnostics: InspectDiagnostic[] = [];
+
+  const checks: readonly {
+    kind: WorkflowRegistryKind;
+    registered: Set<string>;
+    code: string;
+    label: string;
+  }[] = [
+    {
+      kind: "listeners",
+      registered: manifest.listeners,
+      code: "BEIGNET_RUNTIME_MANIFEST_LISTENER_MISSING",
+      label: "listeners",
+    },
+    {
+      kind: "schedules",
+      registered: manifest.schedules,
+      code: "BEIGNET_RUNTIME_MANIFEST_SCHEDULE_MISSING",
+      label: "schedules",
+    },
+    {
+      kind: "tasks",
+      registered: manifest.tasks,
+      code: "BEIGNET_RUNTIME_MANIFEST_TASK_MISSING",
+      label: "tasks",
+    },
+    {
+      kind: "events",
+      registered: manifest.events,
+      code: "BEIGNET_RUNTIME_MANIFEST_OUTBOX_EVENT_MISSING",
+      label: "outbox events",
+    },
+    {
+      kind: "jobs",
+      registered: manifest.jobs,
+      code: "BEIGNET_RUNTIME_MANIFEST_OUTBOX_JOB_MISSING",
+      label: "outbox jobs",
+    },
+  ];
+
+  for (const check of checks) {
+    const missing = unregisteredWorkflowRegistries(
+      registries.filter((registry) => registry.kind === check.kind),
+      check.registered,
+    );
+
+    for (const { registry, missingMembers } of missing) {
+      for (const member of missingMembers) {
+        diagnostics.push({
+          severity: "warning",
+          code: check.code,
+          file: manifest.file,
+          message: `${workflowArtifactOrigin(registry, member)}, but it is not listed in defineRuntimeManifest(...) ${check.label} in ${manifest.file}, so runtime integrity cannot fail fast if it is omitted from a runtime registry.`,
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
 function workflowArtifactOrigin(
   registry: FeatureWorkflowRegistry,
   member: string,
@@ -3588,7 +3710,7 @@ async function workflowRegistrationDrift(
 
   const listenerRegistries = byKind("listeners");
   if (listenerRegistries.length > 0) {
-    const wiring = await listenerWiringReferences(targetDir, files);
+    const wiring = await listenerWiringReferences(targetDir, files, config);
     drift.listeners = {
       unregistered: unregisteredWorkflowRegistries(
         listenerRegistries,
@@ -3704,6 +3826,86 @@ function exportedMemberFiles(
   return memberFiles;
 }
 
+async function readRuntimeManifestIdentifiers(
+  targetDir: string,
+  files: string[],
+): Promise<RuntimeManifestIdentifierSets | undefined> {
+  for (const file of files) {
+    if (!file.endsWith(".ts") && !file.endsWith(".tsx")) continue;
+    if (file.endsWith(".d.ts") || isWorkflowTestFile(file)) continue;
+
+    const source = await readFile(path.join(targetDir, file), "utf8");
+    if (!source.includes("defineRuntimeManifest")) continue;
+
+    const identifiers = runtimeManifestIdentifiers(source);
+    if (identifiers) {
+      return {
+        file,
+        ...identifiers,
+      };
+    }
+  }
+
+  return undefined;
+}
+
+function runtimeManifestIdentifiers(
+  source: string,
+): Omit<RuntimeManifestIdentifierSets, "file"> | undefined {
+  const call = /\bdefineRuntimeManifest\s*(?:<[^>]*>\s*)?\(/.exec(source);
+  if (!call) return undefined;
+
+  const arg = firstCallArgInfo(source, call.index + call[0].length);
+  if (!arg) return undefined;
+
+  const outbox = objectPropertyValueInfo(arg.text, "outbox");
+
+  return {
+    listeners: identifiersFromPropertyArray(arg.text, "listeners"),
+    schedules: identifiersFromPropertyArray(arg.text, "schedules"),
+    tasks: identifiersFromPropertyArray(arg.text, "tasks"),
+    events: outbox
+      ? identifiersFromPropertyArray(outbox.text, "events")
+      : new Set<string>(),
+    jobs: outbox
+      ? identifiersFromPropertyArray(outbox.text, "jobs")
+      : new Set<string>(),
+  };
+}
+
+function identifiersFromPropertyArray(
+  source: string,
+  property: string,
+): Set<string> {
+  const value = objectPropertyValueInfo(source, property);
+  if (!value?.text.startsWith("[")) return new Set<string>();
+  return identifiersFromArrayExpression(value.text);
+}
+
+function objectPropertyValueInfo(
+  source: string,
+  property: string,
+): { text: string; start: number; end: number } | undefined {
+  const propertyMatch = new RegExp(`\\b${property}\\s*:`).exec(source);
+  if (!propertyMatch) return undefined;
+
+  let start = propertyMatch.index + propertyMatch[0].length;
+  while (start < source.length && /\s/.test(source[start])) start++;
+
+  const open = source[start];
+  const close = open === "[" ? "]" : open === "{" ? "}" : undefined;
+  if (!close) return undefined;
+
+  const end = matchingDelimiterIndex(source, start, open, close);
+  if (end === -1) return undefined;
+
+  return {
+    text: source.slice(start, end + 1),
+    start,
+    end: end + 1,
+  };
+}
+
 function registeredWorkflowIdentifiers(
   source: string,
   kind: "schedules" | "tasks",
@@ -3751,6 +3953,7 @@ async function listenedEventNames(
 async function listenerWiringReferences(
   targetDir: string,
   files: string[],
+  config: ResolvedBeignetConfig,
 ): Promise<{
   identifiers: Set<string>;
   wiringFile?: string;
@@ -3759,12 +3962,15 @@ async function listenerWiringReferences(
   const identifiers = new Set<string>();
   let wiringFile: string | undefined;
   let eventBusFile: string | undefined;
+  let centralListenerRegistryReferenced = false;
+  const listenerRegistryFile = listenersFilePath(config);
 
   for (const file of files) {
     if (!file.endsWith(".ts") && !file.endsWith(".tsx")) continue;
     if (file.endsWith(".d.ts") || isWorkflowTestFile(file)) continue;
 
     const source = await readFile(path.join(targetDir, file), "utf8");
+    const namedImports = parseNamedImportSources(source);
     let foundCall = false;
 
     for (const match of source.matchAll(/\bregisterListeners\s*\(/g)) {
@@ -3776,9 +3982,21 @@ async function listenerWiringReferences(
           : source.slice(openParen + 1, closeParen);
 
       foundCall = true;
-      for (const identifier of identifiersFromArrayExpression(argsText)) {
+      const callIdentifiers = identifiersFromArrayExpression(argsText);
+      for (const identifier of callIdentifiers) {
         identifiers.add(identifier);
       }
+      if (
+        callReferencesCentralListenerRegistry({
+          callIdentifiers,
+          namedImports,
+          importerFile: file,
+          listenerRegistryFile,
+          files,
+        })
+      ) {
+        centralListenerRegistryReferenced = true;
+      }
     }
 
     if (foundCall) {
@@ -3788,9 +4006,54 @@ async function listenerWiringReferences(
     }
   }
 
+  if (
+    centralListenerRegistryReferenced &&
+    files.includes(listenerRegistryFile)
+  ) {
+    const source = await readFile(
+      path.join(targetDir, listenerRegistryFile),
+      "utf8",
+    );
+    const central = arrayInitializerInfo(source, "listeners");
+    if (central) {
+      for (const identifier of identifiersFromArrayExpression(central.text)) {
+        identifiers.add(identifier);
+      }
+    }
+  }
+
   return { identifiers, wiringFile, eventBusFile };
 }
 
+function callReferencesCentralListenerRegistry(args: {
+  callIdentifiers: Set<string>;
+  namedImports: Map<string, { importedName: string; sourcePath: string }>;
+  importerFile: string;
+  listenerRegistryFile: string;
+  files: string[];
+}): boolean {
+  if (
+    args.importerFile === args.listenerRegistryFile &&
+    args.callIdentifiers.has("listeners")
+  ) {
+    return true;
+  }
+
+  for (const identifier of args.callIdentifiers) {
+    const imported = args.namedImports.get(identifier);
+    if (!imported || imported.importedName !== "listeners") continue;
+
+    const importedFile = sourceFileFromImport(
+      imported.sourcePath,
+      args.importerFile,
+      args.files,
+    );
+    if (importedFile === args.listenerRegistryFile) return true;
+  }
+
+  return false;
+}
+
 function isWorkflowTestFile(file: string): boolean {
   return (
     file.endsWith(".test.ts") ||
@@ -4111,6 +4374,15 @@ async function inspectDatabaseLifecycleDrift(
         schemaDir,
         sourceCache,
       )),
+      ...(await inspectTenantScopeRepositoryDrift(
+        targetDir,
+        files,
+        resources,
+        config,
+        infrastructurePath,
+        schemaDir,
+        sourceCache,
+      )),
     );
   }
 
@@ -4270,118 +4542,701 @@ async function inspectDatabaseLifecycleDrift(
   return diagnostics;
 }
 
-type DurableDrizzleTableRequirement = {
-  capability: string;
-  table: keyof BeignetDatabaseTables;
-  code: string;
-  factoryNames: readonly string[];
-  setupNames: readonly string[];
-  explicitFactoryPattern: string;
-  explicitSetupPattern: string;
-};
-
-const durableDrizzleTableRequirements: readonly DurableDrizzleTableRequirement[] =
-  [
-    {
-      capability: "idempotency",
-      table: "idempotency",
-      code: "BEIGNET_IDEMPOTENCY_TABLE_MISSING",
-      factoryNames: [
-        "createDrizzleSqliteIdempotencyPort",
-        "createDrizzlePostgresIdempotencyPort",
-        "createDrizzleMysqlIdempotencyPort",
-      ],
-      setupNames: [
-        "createDrizzleSqliteIdempotencySetupStatements",
-        "createDrizzlePostgresIdempotencySetupStatements",
-        "createDrizzleMysqlIdempotencySetupStatements",
-      ],
-      explicitFactoryPattern: "createDrizzle[A-Za-z]*Idempotency(?:Port)?",
-      explicitSetupPattern: "createDrizzle[A-Za-z]*IdempotencySetupStatements",
-    },
-    {
-      capability: "outbox",
-      table: "outbox",
-      code: "BEIGNET_OUTBOX_TABLE_MISSING",
-      factoryNames: [
-        "createDrizzleSqliteOutboxPort",
-        "createDrizzlePostgresOutboxPort",
-        "createDrizzleMysqlOutboxPort",
-      ],
-      setupNames: [
-        "createDrizzleSqliteOutboxSetupStatements",
-        "createDrizzlePostgresOutboxSetupStatements",
-        "createDrizzleMysqlOutboxSetupStatements",
-      ],
-      explicitFactoryPattern: "createDrizzle[A-Za-z]*Outbox(?:Port)?",
-      explicitSetupPattern: "createDrizzle[A-Za-z]*OutboxSetupStatements",
-    },
-    {
-      capability: "audit",
-      table: "audit",
-      code: "BEIGNET_AUDIT_TABLE_MISSING",
-      factoryNames: [
-        "createDrizzleSqliteAuditLogPort",
-        "createDrizzlePostgresAuditLogPort",
-        "createDrizzleMysqlAuditLogPort",
-      ],
-      setupNames: [
-        "createDrizzleSqliteAuditLogSetupStatements",
-        "createDrizzlePostgresAuditLogSetupStatements",
-        "createDrizzleMysqlAuditLogSetupStatements",
-      ],
-      explicitFactoryPattern: "createDrizzle[A-Za-z]*AuditLog(?:Port)?",
-      explicitSetupPattern: "createDrizzle[A-Za-z]*AuditLogSetupStatements",
-    },
-  ];
-
-async function inspectDurableDrizzleTableDrift(
+async function inspectTenantScopeRepositoryDrift(
   targetDir: string,
   files: string[],
+  resources: string[],
   config: ResolvedBeignetConfig,
   infrastructurePath: string,
   schemaDir: string,
   sourceCache: Map<string, string>,
 ): Promise<InspectDiagnostic[]> {
   const diagnostics: InspectDiagnostic[] = [];
-  const usageFiles = durableDrizzleUsageFiles(files, config);
+  const schemaIndexFile = `${schemaDir}/index.ts`;
+  const schemaFiles = files.filter(
+    (file) =>
+      file.startsWith(`${schemaDir}/`) &&
+      file.endsWith(".ts") &&
+      file !== schemaIndexFile,
+  );
+  const tenantScopedTables = await collectTenantScopedDrizzleTables(
+    targetDir,
+    schemaFiles,
+    sourceCache,
+  );
+  const inspectedRepositories = new Set<string>();
 
-  for (const requirement of durableDrizzleTableRequirements) {
-    const tableNames = await configuredDurableDrizzleTableNames(
+  for (const resource of resources) {
+    const singular = singularize(resource);
+    const singularPascal = pascalCase(singular);
+    const pluralCamel = camelCase(resource);
+    const schemaFile = `${schemaDir}/${resource}.ts`;
+    const portFile = resourcePortFile(resource, singular, config);
+    const drizzleRepositoryFile = drizzleRepositoryAdapterFile(
+      files,
+      `${infrastructurePath}/${resource}/`,
+      singular,
+    );
+    if (!drizzleRepositoryFile || !files.includes(schemaFile)) continue;
+
+    const schemaSource = await readCachedSource(
       targetDir,
-      usageFiles,
-      config,
-      requirement,
+      schemaFile,
       sourceCache,
     );
-    if (tableNames.size === 0) continue;
+    const schemaTenantColumns = tenantScopeColumnsFromSource(schemaSource);
+    if (schemaTenantColumns.length === 0) continue;
+    inspectedRepositories.add(drizzleRepositoryFile);
 
-    for (const tableName of tableNames) {
-      if (
-        await durableDrizzleTableExists(
-          targetDir,
-          files,
-          config,
-          infrastructurePath,
-          schemaDir,
-          requirement,
-          tableName,
-          sourceCache,
-        )
-      ) {
-        continue;
+    if (files.includes(portFile)) {
+      const portSource = await readCachedSource(
+        targetDir,
+        portFile,
+        sourceCache,
+      );
+      if (!/\b[A-Za-z_$][\w$]*\s*:\s*TenantScope\b/.test(portSource)) {
+        diagnostics.push({
+          severity: "warning",
+          code: "BEIGNET_TENANT_SCOPE_PORT_MISSING",
+          file: portFile,
+          message: `${resource} has a tenant-scoped Drizzle schema (${schemaFile}), but ${portFile} does not accept TenantScope in its ${singularPascal}Repository methods. Tenant-owned repository methods should require a branded scope argument instead of raw tenant or workspace IDs.`,
+        });
       }
-
-      diagnostics.push({
-        severity: "warning",
-        code: requirement.code,
-        file: schemaDir,
-        message: `This app wires a Drizzle-backed ${requirement.capability} port, but no ${tableName} table setup was found in ${schemaDir}/, drizzle/, or app database setup files. Add the table to your Drizzle schema/migrations, call the provider setup statements, or remove the stale ${requirement.capability} wiring before deployment.`,
-      });
     }
-  }
 
-  return diagnostics;
+    const repositorySource = await readCachedSource(
+      targetDir,
+      drizzleRepositoryFile,
+      sourceCache,
+    );
+    const tenantPredicate = `eq(schema.${pluralCamel}.tenantId, tenantScopeId(scope))`;
+    const tenantPredicateCount = countSourceOccurrences(
+      repositorySource,
+      tenantPredicate,
+    );
+    const setsTenantFromScope = repositorySource.includes(
+      "tenantId: tenantScopeId(scope)",
+    );
+    if (
+      !repositorySource.includes(`schema.${pluralCamel}`) ||
+      (tenantPredicateCount >= 4 && setsTenantFromScope) ||
+      repositoryHasScopedTenantCoverage(repositorySource, [
+        {
+          name: pluralCamel,
+          file: schemaFile,
+          columns: schemaTenantColumns,
+        },
+      ])
+    ) {
+      continue;
+    }
+
+    diagnostics.push({
+      severity: "warning",
+      code: "BEIGNET_TENANT_SCOPE_PREDICATE_MISSING",
+      file: drizzleRepositoryFile,
+      message: `${resource} has a tenant-scoped Drizzle schema (${schemaFile}), but ${drizzleRepositoryFile} does not use TenantScope consistently. Tenant-owned repository adapters should derive tenant or workspace IDs from tenantScopeId(scope) and include them in create values and read, update, and delete predicates.`,
+    });
+  }
+
+  const repositoryFiles = files.filter(
+    (file) =>
+      file.startsWith(`${infrastructurePath}/`) &&
+      file.includes("/drizzle-") &&
+      file.endsWith("-repository.ts") &&
+      !file.endsWith(".test.ts"),
+  );
+  const featuresPath = directoryPath(config.paths.features);
+
+  for (const repositoryFile of repositoryFiles) {
+    if (inspectedRepositories.has(repositoryFile)) continue;
+
+    const repositorySource = await readCachedSource(
+      targetDir,
+      repositoryFile,
+      sourceCache,
+    );
+    const referencedTables = tenantScopedTables.filter((table) =>
+      repositorySource.includes(`schema.${table.name}`),
+    );
+    if (referencedTables.length === 0) continue;
+
+    const repositoryFeature = repositoryFeatureFromPath(
+      repositoryFile,
+      infrastructurePath,
+    );
+    if (!repositoryFeature || isTenantAuthorityFeature(repositoryFeature)) {
+      continue;
+    }
+
+    const portFile = `${featuresPath}/${repositoryFeature}/ports.ts`;
+    if (!files.includes(portFile)) continue;
+
+    const portSource = await readCachedSource(targetDir, portFile, sourceCache);
+    const repositoryBlocks = repositoryInterfaceBlocks(portSource);
+    if (repositoryBlocks.length === 0) continue;
+
+    const hasTenantScopeBoundary = repositoryBlocks.some((block) =>
+      repositoryInterfaceAcceptsTenantScope(block),
+    );
+    const rawBoundaries = repositoryBlocks.flatMap((block) =>
+      rawTenantRepositoryMethodBoundaries(block, referencedTables),
+    );
+
+    if (rawBoundaries.length > 0) {
+      diagnostics.push({
+        severity: "warning",
+        code: "BEIGNET_TENANT_SCOPE_RAW_ID_BOUNDARY",
+        file: portFile,
+        message: `${portFile} declares tenant-owned repository methods (${rawBoundaries.join(
+          ", ",
+        )}) with raw tenant IDs. Use TenantScope at app-facing repository boundaries and unwrap it with tenantScopeId(scope) inside ${repositoryFile}; keep provider-correlation lookups separate from authorization.`,
+      });
+      continue;
+    }
+
+    if (
+      hasTenantScopeBoundary &&
+      !repositoryHasScopedTenantCoverage(repositorySource, referencedTables)
+    ) {
+      diagnostics.push({
+        severity: "warning",
+        code: "BEIGNET_TENANT_SCOPE_PREDICATE_MISSING",
+        file: repositoryFile,
+        message: `${repositoryFile} adapts tenant-owned tables (${referencedTables
+          .map((table) => table.name)
+          .join(
+            ", ",
+          )}), but its scoped methods do not consistently derive tenant or workspace IDs from tenantScopeId(scope). Include that derived ID in create values and read, update, and delete predicates.`,
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+const tenantScopeColumnDefinitions = [
+  {
+    property: "tenantId",
+    sqlName: "tenant_id",
+    label: "tenant",
+  },
+  {
+    property: "workspaceId",
+    sqlName: "workspace_id",
+    label: "workspace",
+  },
+] as const;
+
+type TenantScopeColumn = (typeof tenantScopeColumnDefinitions)[number];
+
+type TenantScopedDrizzleTable = {
+  name: string;
+  file: string;
+  columns: TenantScopeColumn[];
+};
+
+async function collectTenantScopedDrizzleTables(
+  targetDir: string,
+  schemaFiles: string[],
+  sourceCache: Map<string, string>,
+): Promise<TenantScopedDrizzleTable[]> {
+  const tables: TenantScopedDrizzleTable[] = [];
+
+  for (const file of schemaFiles) {
+    const source = await readCachedSource(targetDir, file, sourceCache);
+    for (const table of drizzleTablesFromSource(source, file)) {
+      if (table.columns.length > 0) tables.push(table);
+    }
+  }
+
+  return tables;
+}
+
+function drizzleTablesFromSource(
+  source: string,
+  file: string,
+): TenantScopedDrizzleTable[] {
+  const tables: TenantScopedDrizzleTable[] = [];
+  const tablePattern =
+    /\bexport\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:sqliteTable|pgTable|mysqlTable)\s*\(/g;
+
+  for (const match of source.matchAll(tablePattern)) {
+    const tableName = match[1];
+    const openIndex = source.indexOf("(", match.index ?? 0);
+    if (!tableName || openIndex === -1) continue;
+
+    const closeIndex = matchingDelimiterIndex(source, openIndex, "(", ")");
+    if (closeIndex === -1) continue;
+
+    const tableSource = source.slice(openIndex, closeIndex + 1);
+    const columns = tenantScopeColumnsFromSource(tableSource);
+    tables.push({ name: tableName, file, columns });
+  }
+
+  return tables;
+}
+
+function tenantScopeColumnsFromSource(source: string): TenantScopeColumn[] {
+  return tenantScopeColumnDefinitions.filter((column) => {
+    const propertyPattern = new RegExp(`\\b${column.property}\\s*:`);
+    return (
+      propertyPattern.test(source) ||
+      source.includes(`"${column.sqlName}"`) ||
+      source.includes(`'${column.sqlName}'`)
+    );
+  });
+}
+
+function repositoryFeatureFromPath(
+  repositoryFile: string,
+  infrastructurePath: string,
+): string | undefined {
+  const match = new RegExp(
+    `^${escapeRegExp(infrastructurePath)}/([^/]+)/`,
+  ).exec(repositoryFile);
+  return match?.[1];
+}
+
+function isTenantAuthorityFeature(feature: string): boolean {
+  return feature === "workspaces";
+}
+
+function repositoryInterfaceBlocks(source: string): string[] {
+  const blocks: string[] = [];
+  const interfacePattern =
+    /\bexport\s+interface\s+[A-Za-z_$][\w$]*Repository\s*\{/g;
+
+  for (const match of source.matchAll(interfacePattern)) {
+    const openIndex = source.indexOf("{", match.index ?? 0);
+    if (openIndex === -1) continue;
+
+    const closeIndex = matchingDelimiterIndex(source, openIndex, "{", "}");
+    if (closeIndex === -1) continue;
+
+    blocks.push(source.slice(openIndex + 1, closeIndex));
+  }
+
+  return blocks;
+}
+
+function repositoryInterfaceAcceptsTenantScope(block: string): boolean {
+  return /\b[A-Za-z_$][\w$]*\s*:\s*TenantScope\b/.test(block);
+}
+
+function rawTenantRepositoryMethodBoundaries(
+  block: string,
+  tables: readonly TenantScopedDrizzleTable[],
+): string[] {
+  const rawMethods: string[] = [];
+  for (const method of repositoryMethodSignatures(block)) {
+    if (isProviderCorrelationMethod(method.name)) continue;
+
+    const rawColumns = tenantColumnsUsedInSource(method.params, tables).filter(
+      (column) => column.property === "tenantId",
+    );
+    if (rawColumns.length === 0) continue;
+
+    rawMethods.push(method.name);
+  }
+
+  return uniqueStringValues(rawMethods);
+}
+
+function repositoryMethodSignatures(
+  block: string,
+): Array<{ name: string; params: string }> {
+  const signatures: Array<{ name: string; params: string }> = [];
+  const methodPattern = /\b([A-Za-z_$][\w$]*)\s*\(/g;
+
+  for (const match of block.matchAll(methodPattern)) {
+    const name = match[1];
+    const openIndex = block.indexOf("(", match.index ?? 0);
+    if (!name || openIndex === -1) continue;
+
+    const closeIndex = matchingDelimiterIndex(block, openIndex, "(", ")");
+    if (closeIndex === -1) continue;
+
+    const afterParams = block.slice(closeIndex + 1).trimStart();
+    if (!afterParams.startsWith(":")) continue;
+
+    signatures.push({
+      name,
+      params: block.slice(openIndex + 1, closeIndex),
+    });
+  }
+
+  return signatures;
+}
+
+function isProviderCorrelationMethod(name: string): boolean {
+  return /(?:Customer|Provider|Subscription|Checkout|Event|Delivery|External|Token)[A-Za-z0-9]*(?:Id)?$/i.test(
+    name,
+  );
+}
+
+function tenantColumnsUsedInSource(
+  source: string,
+  tables: readonly TenantScopedDrizzleTable[],
+): TenantScopeColumn[] {
+  const columns = new Map<string, TenantScopeColumn>();
+  for (const table of tables) {
+    for (const column of table.columns) {
+      const propertyPattern = new RegExp(`\\b${column.property}\\s*:`);
+      if (propertyPattern.test(source)) {
+        columns.set(column.property, column);
+      }
+    }
+  }
+
+  return [...columns.values()];
+}
+
+function repositoryHasScopedTenantCoverage(
+  source: string,
+  tables: readonly TenantScopedDrizzleTable[],
+): boolean {
+  if (!source.includes("tenantScopeId(scope)")) return false;
+
+  const allFunctions = functionLikeBlocks(source);
+  const scopedFunctions = allFunctions.filter((block) =>
+    /\bscope\b/.test(block.params),
+  );
+  if (scopedFunctions.length === 0) return false;
+
+  const functionsByName = new Map(
+    allFunctions.map((block) => [block.name, block]),
+  );
+
+  return scopedFunctions.every((block) =>
+    scopedFunctionUsesTenantScope(block, tables, functionsByName),
+  );
+}
+
+type FunctionLikeBlock = {
+  name: string;
+  params: string;
+  body: string;
+};
+
+function functionLikeBlocks(source: string): FunctionLikeBlock[] {
+  const blocks: FunctionLikeBlock[] = [];
+  const pattern = /(?:\basync\s+)?(?:function\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+
+  for (const match of source.matchAll(pattern)) {
+    const name = match[1];
+    const openParamsIndex = source.indexOf("(", match.index ?? 0);
+    if (!name || openParamsIndex === -1) continue;
+
+    const closeParamsIndex = matchingDelimiterIndex(
+      source,
+      openParamsIndex,
+      "(",
+      ")",
+    );
+    if (closeParamsIndex === -1) continue;
+
+    const afterParams = source.slice(closeParamsIndex + 1);
+    const bodyOpenOffset = afterParams.search(/\{/);
+    if (bodyOpenOffset === -1) continue;
+
+    const betweenParamsAndBody = afterParams.slice(0, bodyOpenOffset);
+    if (
+      !/^\s*(?::[^{;=]+)?\s*(?:=>\s*)?$/.test(betweenParamsAndBody) &&
+      !/^\s*$/.test(betweenParamsAndBody)
+    ) {
+      continue;
+    }
+
+    const openBodyIndex = closeParamsIndex + 1 + bodyOpenOffset;
+    const closeBodyIndex = matchingDelimiterIndex(
+      source,
+      openBodyIndex,
+      "{",
+      "}",
+    );
+    if (closeBodyIndex === -1) continue;
+
+    blocks.push({
+      name,
+      params: source.slice(openParamsIndex + 1, closeParamsIndex),
+      body: source.slice(openBodyIndex + 1, closeBodyIndex),
+    });
+  }
+
+  return blocks;
+}
+
+function scopedFunctionUsesTenantScope(
+  block: FunctionLikeBlock,
+  tables: readonly TenantScopedDrizzleTable[],
+  functionsByName: ReadonlyMap<string, FunctionLikeBlock>,
+): boolean {
+  if (bodyUsesTenantScopePredicate(block.body, tables)) return true;
+
+  for (const variable of tenantScopeVariables(block.body)) {
+    if (bodyUsesTenantScopePredicate(block.body, tables, variable)) return true;
+
+    for (const callee of functionsCalledWithVariable(block.body, variable)) {
+      const helper = functionsByName.get(callee.name);
+      if (
+        helper &&
+        helperUsesTenantVariable(helper, tables, callee.argumentIndex)
+      ) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+function tenantScopeVariables(body: string): string[] {
+  const variables = new Set<string>(["tenantScopeId(scope)"]);
+  const assignmentPattern =
+    /\b(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*tenantScopeId\(scope\)/g;
+
+  for (const match of body.matchAll(assignmentPattern)) {
+    if (match[1]) variables.add(match[1]);
+  }
+
+  return [...variables];
+}
+
+function bodyUsesTenantScopePredicate(
+  body: string,
+  tables: readonly TenantScopedDrizzleTable[],
+  variable = "tenantScopeId(scope)",
+): boolean {
+  for (const table of tables) {
+    for (const column of table.columns) {
+      if (
+        body.includes(
+          `eq(schema.${table.name}.${column.property}, ${variable})`,
+        )
+      ) {
+        return true;
+      }
+      if (body.includes(`${column.property}: ${variable}`)) {
+        return true;
+      }
+      if (
+        variable === column.property &&
+        new RegExp(`\\b${column.property}\\s*(?:,|})`).test(body)
+      ) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+function functionsCalledWithVariable(
+  body: string,
+  variable: string,
+): Array<{ name: string; argumentIndex: number }> {
+  if (variable.includes("(")) return [];
+
+  const calls: Array<{ name: string; argumentIndex: number }> = [];
+  const callPattern = /\b([A-Za-z_$][\w$]*)\s*\(/g;
+
+  for (const match of body.matchAll(callPattern)) {
+    const name = match[1];
+    const openIndex = body.indexOf("(", match.index ?? 0);
+    if (!name || openIndex === -1) continue;
+
+    const closeIndex = matchingDelimiterIndex(body, openIndex, "(", ")");
+    if (closeIndex === -1) continue;
+
+    const args = splitTopLevelArguments(body.slice(openIndex + 1, closeIndex));
+    const argumentIndex = args.findIndex(
+      (argument) => argument.trim() === variable,
+    );
+    if (argumentIndex !== -1) {
+      calls.push({ name, argumentIndex });
+    }
+  }
+
+  return calls;
+}
+
+function helperUsesTenantVariable(
+  helper: FunctionLikeBlock,
+  tables: readonly TenantScopedDrizzleTable[],
+  argumentIndex: number,
+): boolean {
+  const params = splitTopLevelArguments(helper.params);
+  const parameter = params[argumentIndex]?.trim();
+  if (!parameter) return false;
+
+  const parameterName = /^([A-Za-z_$][\w$]*)/.exec(parameter)?.[1];
+  return parameterName
+    ? bodyUsesTenantScopePredicate(helper.body, tables, parameterName)
+    : false;
+}
+
+function splitTopLevelArguments(source: string): string[] {
+  const args: string[] = [];
+  let start = 0;
+  let depth = 0;
+  let inString: string | undefined;
+  let escaped = false;
+
+  for (let index = 0; index < source.length; index++) {
+    const char = source[index];
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === inString) {
+        inString = undefined;
+      }
+      continue;
+    }
+
+    if (char === '"' || char === "'" || char === "`") {
+      inString = char;
+      continue;
+    }
+    if (char === "(" || char === "{" || char === "[") {
+      depth += 1;
+      continue;
+    }
+    if (char === ")" || char === "}" || char === "]") {
+      depth -= 1;
+      continue;
+    }
+    if (char === "," && depth === 0) {
+      args.push(source.slice(start, index));
+      start = index + 1;
+    }
+  }
+
+  args.push(source.slice(start));
+  return args;
+}
+
+function uniqueStringValues(values: readonly string[]): string[] {
+  return [...new Set(values)];
+}
+
+type DurableDrizzleTableRequirement = {
+  capability: string;
+  table: keyof BeignetDatabaseTables;
+  code: string;
+  factoryNames: readonly string[];
+  setupNames: readonly string[];
+  explicitFactoryPattern: string;
+  explicitSetupPattern: string;
+};
+
+const durableDrizzleTableRequirements: readonly DurableDrizzleTableRequirement[] =
+  [
+    {
+      capability: "idempotency",
+      table: "idempotency",
+      code: "BEIGNET_IDEMPOTENCY_TABLE_MISSING",
+      factoryNames: [
+        "createDrizzleSqliteIdempotencyPort",
+        "createDrizzlePostgresIdempotencyPort",
+        "createDrizzleMysqlIdempotencyPort",
+      ],
+      setupNames: [
+        "createDrizzleSqliteIdempotencySetupStatements",
+        "createDrizzlePostgresIdempotencySetupStatements",
+        "createDrizzleMysqlIdempotencySetupStatements",
+      ],
+      explicitFactoryPattern: "createDrizzle[A-Za-z]*Idempotency(?:Port)?",
+      explicitSetupPattern: "createDrizzle[A-Za-z]*IdempotencySetupStatements",
+    },
+    {
+      capability: "outbox",
+      table: "outbox",
+      code: "BEIGNET_OUTBOX_TABLE_MISSING",
+      factoryNames: [
+        "createDrizzleSqliteOutboxPort",
+        "createDrizzleSqliteOutboxAdminPort",
+        "createDrizzlePostgresOutboxPort",
+        "createDrizzlePostgresOutboxAdminPort",
+        "createDrizzleMysqlOutboxPort",
+        "createDrizzleMysqlOutboxAdminPort",
+      ],
+      setupNames: [
+        "createDrizzleSqliteOutboxSetupStatements",
+        "createDrizzlePostgresOutboxSetupStatements",
+        "createDrizzleMysqlOutboxSetupStatements",
+      ],
+      explicitFactoryPattern: "createDrizzle[A-Za-z]*Outbox(?:Admin)?(?:Port)?",
+      explicitSetupPattern: "createDrizzle[A-Za-z]*OutboxSetupStatements",
+    },
+    {
+      capability: "audit",
+      table: "audit",
+      code: "BEIGNET_AUDIT_TABLE_MISSING",
+      factoryNames: [
+        "createDrizzleSqliteAuditLogPort",
+        "createDrizzlePostgresAuditLogPort",
+        "createDrizzleMysqlAuditLogPort",
+      ],
+      setupNames: [
+        "createDrizzleSqliteAuditLogSetupStatements",
+        "createDrizzlePostgresAuditLogSetupStatements",
+        "createDrizzleMysqlAuditLogSetupStatements",
+      ],
+      explicitFactoryPattern: "createDrizzle[A-Za-z]*AuditLog(?:Port)?",
+      explicitSetupPattern: "createDrizzle[A-Za-z]*AuditLogSetupStatements",
+    },
+  ];
+
+async function inspectDurableDrizzleTableDrift(
+  targetDir: string,
+  files: string[],
+  config: ResolvedBeignetConfig,
+  infrastructurePath: string,
+  schemaDir: string,
+  sourceCache: Map<string, string>,
+): Promise<InspectDiagnostic[]> {
+  const diagnostics: InspectDiagnostic[] = [];
+  const usageFiles = durableDrizzleUsageFiles(files, config);
+
+  for (const requirement of durableDrizzleTableRequirements) {
+    const tableNames = await configuredDurableDrizzleTableNames(
+      targetDir,
+      usageFiles,
+      config,
+      requirement,
+      sourceCache,
+    );
+    if (tableNames.size === 0) continue;
+
+    for (const tableName of tableNames) {
+      if (
+        await durableDrizzleTableExists(
+          targetDir,
+          files,
+          config,
+          infrastructurePath,
+          schemaDir,
+          requirement,
+          tableName,
+          sourceCache,
+        )
+      ) {
+        continue;
+      }
+
+      diagnostics.push({
+        severity: "warning",
+        code: requirement.code,
+        file: schemaDir,
+        message: `This app wires a Drizzle-backed ${requirement.capability} port, but no ${tableName} table setup was found in ${schemaDir}/, drizzle/, or app database setup files. Add the table to your Drizzle schema/migrations, call the provider setup statements, or remove the stale ${requirement.capability} wiring before deployment.`,
+      });
+    }
+  }
+
+  return diagnostics;
 }
 
 function durableDrizzleUsageFiles(
@@ -4757,22 +5612,70 @@ async function inspectPackageScripts(
     await readFile(path.join(targetDir, "package.json"), "utf8"),
   ) as {
     scripts?: Record<string, string>;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
   };
 
-  if (packageJson.scripts?.test) return [];
+  const diagnostics: InspectDiagnostic[] = [];
+  const scripts = packageJson.scripts ?? {};
+  const hasDirectBunTestImports = await appUsesDirectBunTestImports(
+    targetDir,
+    files,
+  );
 
-  return [
-    {
+  if (!scripts.test) {
+    diagnostics.push({
       severity: "warning",
       code: "BEIGNET_PACKAGE_TEST_SCRIPT_MISSING",
       file: "package.json",
       message:
-        'package.json does not define a test script. Add "test": "bun test" or run beignet doctor --fix.',
-    },
-  ];
+        'package.json does not define a test script. Add "test": "tsx lib/beignet-test-runner.ts" or run beignet doctor --fix.',
+    });
+  }
+
+  const legacyScripts = hasDirectBunTestImports
+    ? []
+    : legacyGeneratedScriptNames(scripts);
+  if (legacyScripts.length > 0) {
+    diagnostics.push({
+      severity: "warning",
+      code: "BEIGNET_PACKAGE_SCRIPT_LEGACY",
+      file: "package.json",
+      message: `package.json still uses legacy generated Bun scripts for ${legacyScripts.join(", ")}. Run beignet doctor --fix to migrate them to package-manager-neutral tsx scripts.`,
+    });
+  }
+
+  const needsTsx =
+    hasCurrentGeneratedTsxScript(scripts) &&
+    !packageJson.dependencies?.tsx &&
+    !packageJson.devDependencies?.tsx;
+  if (needsTsx) {
+    diagnostics.push({
+      severity: "warning",
+      code: "BEIGNET_PACKAGE_TSX_DEPENDENCY_MISSING",
+      file: "package.json",
+      message:
+        'package.json uses generated tsx scripts but does not depend on tsx. Add "tsx" to devDependencies or run beignet doctor --fix.',
+    });
+  }
+
+  const missingSupportFiles = missingTestSupportFiles(files);
+  if (
+    scripts.test === currentGeneratedPackageScripts.test &&
+    missingSupportFiles.length > 0
+  ) {
+    diagnostics.push({
+      severity: "warning",
+      code: "BEIGNET_PACKAGE_TEST_SUPPORT_MISSING",
+      file: "package.json",
+      message: `package.json uses the generated test runner, but ${missingSupportFiles.join(", ")} ${missingSupportFiles.length === 1 ? "is" : "are"} missing. Run beignet doctor --fix to restore test support files.`,
+    });
+  }
+
+  return diagnostics;
 }
 
-async function fixMissingTestScript(
+async function fixPackageScripts(
   targetDir: string,
   files: string[],
   convention: InspectConvention,
@@ -4785,20 +5688,162 @@ async function fixMissingTestScript(
   const original = await readFile(filePath, "utf8");
   const packageJson = JSON.parse(original) as {
     scripts?: Record<string, string>;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
   };
   packageJson.scripts = packageJson.scripts ?? {};
-  if (packageJson.scripts.test) return undefined;
+  const updatedScripts: string[] = [];
+  const addedTestScript = !packageJson.scripts.test;
+  const hasDirectBunTestImports = await appUsesDirectBunTestImports(
+    targetDir,
+    files,
+  );
+
+  if (addedTestScript) {
+    packageJson.scripts.test = currentGeneratedPackageScripts.test;
+    updatedScripts.push("test");
+  }
+
+  if (!hasDirectBunTestImports) {
+    for (const [name, legacyCommand] of Object.entries(
+      legacyGeneratedPackageScripts,
+    )) {
+      if (packageJson.scripts[name] === legacyCommand) {
+        packageJson.scripts[name] = currentGeneratedPackageScripts[name];
+        if (!updatedScripts.includes(name)) updatedScripts.push(name);
+      }
+    }
+  }
+
+  const needsTsx = hasCurrentGeneratedTsxScript(packageJson.scripts);
+  const addedTsx =
+    needsTsx &&
+    !packageJson.dependencies?.tsx &&
+    !packageJson.devDependencies?.tsx;
+  if (addedTsx) {
+    packageJson.devDependencies = packageJson.devDependencies ?? {};
+    packageJson.devDependencies.tsx = externalVersions.tsx;
+  }
 
-  packageJson.scripts.test = "bun test";
   const next = `${JSON.stringify(packageJson, null, "\t")}\n`;
-  if (next === original) return undefined;
+  const createdSupportFiles = await createMissingTestSupportFiles(
+    targetDir,
+    files,
+    packageJson.scripts.test === currentGeneratedPackageScripts.test,
+  );
 
-  await writeFile(filePath, next);
-  return {
-    code: "BEIGNET_PACKAGE_TEST_SCRIPT_MISSING",
-    file: "package.json",
-    message: 'Added "test": "bun test".',
-  };
+  if (next === original && createdSupportFiles.length === 0) return undefined;
+
+  if (next !== original) await writeFile(filePath, next);
+
+  if (addedTestScript) {
+    return {
+      code: "BEIGNET_PACKAGE_TEST_SCRIPT_MISSING",
+      file: "package.json",
+      message:
+        createdSupportFiles.length > 0
+          ? `Added "test": "tsx lib/beignet-test-runner.ts" and ${createdSupportFiles.join(", ")}.`
+          : 'Added "test": "tsx lib/beignet-test-runner.ts".',
+    };
+  }
+
+  if (updatedScripts.length > 0) {
+    return {
+      code: "BEIGNET_PACKAGE_SCRIPT_LEGACY",
+      file: "package.json",
+      message: packageScriptFixMessage(
+        updatedScripts,
+        createdSupportFiles,
+        addedTsx,
+      ),
+    };
+  }
+
+  if (createdSupportFiles.length > 0) {
+    return {
+      code: "BEIGNET_PACKAGE_TEST_SUPPORT_MISSING",
+      file: "package.json",
+      message: `Restored ${createdSupportFiles.join(", ")}.`,
+    };
+  }
+
+  if (addedTsx) {
+    return {
+      code: "BEIGNET_PACKAGE_TSX_DEPENDENCY_MISSING",
+      file: "package.json",
+      message: 'Added "tsx" to devDependencies.',
+    };
+  }
+
+  return undefined;
+}
+
+function legacyGeneratedScriptNames(scripts: Record<string, string>): string[] {
+  return Object.entries(legacyGeneratedPackageScripts)
+    .filter(([name, command]) => scripts[name] === command)
+    .map(([name]) => name);
+}
+
+async function appUsesDirectBunTestImports(
+  targetDir: string,
+  files: string[],
+): Promise<boolean> {
+  for (const file of files) {
+    if (!isTestSourceFile(file)) continue;
+    const source = await readFile(path.join(targetDir, file), "utf8");
+    if (/\bfrom\s*["']bun:test["']/.test(source)) return true;
+    if (/\bimport\s*\(\s*["']bun:test["']\s*\)/.test(source)) return true;
+  }
+  return false;
+}
+
+function hasCurrentGeneratedTsxScript(
+  scripts: Record<string, string>,
+): boolean {
+  return Object.values(currentGeneratedPackageScripts).some(
+    (command) =>
+      command.startsWith("tsx ") && Object.values(scripts).includes(command),
+  );
+}
+
+function missingTestSupportFiles(files: string[]): string[] {
+  return testSupportTemplateFiles
+    .map((file) => file.path)
+    .filter((file) => !files.includes(file));
+}
+
+async function createMissingTestSupportFiles(
+  targetDir: string,
+  files: string[],
+  shouldCreate: boolean,
+): Promise<string[]> {
+  if (!shouldCreate) return [];
+  const createdSupportFiles: string[] = [];
+  for (const file of testSupportTemplateFiles) {
+    if (files.includes(file.path)) continue;
+    const destination = path.join(targetDir, file.path);
+    await mkdir(path.dirname(destination), { recursive: true });
+    await writeFile(destination, file.content);
+    createdSupportFiles.push(file.path);
+  }
+  return createdSupportFiles;
+}
+
+function packageScriptFixMessage(
+  updatedScripts: string[],
+  createdSupportFiles: string[],
+  addedTsx: boolean,
+): string {
+  const parts = [
+    `Updated generated package scripts: ${updatedScripts.join(", ")}.`,
+  ];
+  if (createdSupportFiles.length > 0) {
+    parts.push(`Restored ${createdSupportFiles.join(", ")}.`);
+  }
+  if (addedTsx) {
+    parts.push('Added "tsx" to devDependencies.');
+  }
+  return parts.join(" ");
 }
 
 function unmatchedRouteDiagnostic(
@@ -5475,14 +6520,15 @@ async function fixUnregisteredTasks(
 }
 
 /**
- * Wire fully unregistered feature listener registries into the providers
- * file with the same `<registry>Provider` block `beignet make listener`
- * generates, so both write paths stay byte-compatible.
+ * Wire fully unregistered feature listener registries into the central
+ * listener registry and ensure the providers file registers that central
+ * registry with the same block `beignet make listener` generates, so both
+ * write paths stay byte-compatible.
  *
- * Bails without writing when the providers file or its exported array is
- * missing or customized, when the app has no eventBus port to register
- * against, or when the registry name is already imported from another file.
- * The diagnostic stays in every bail case.
+ * Bails without writing when the providers file or central listener registry
+ * is customized beyond the known anchors, when the app has no eventBus port to
+ * register against, or when the registry name is already imported from another
+ * file. The diagnostic stays in every bail case.
  */
 async function fixUnregisteredListeners(
   targetDir: string,
@@ -5518,50 +6564,86 @@ async function fixUnregisteredListeners(
   if (!/\beventBus\s*[:?]/.test(portsSource)) return undefined;
 
   const providersPath = path.join(targetDir, providersFile);
-  const original = await readFile(providersPath, "utf8");
-  let next = original;
-  const registeredNames: string[] = [];
+  const originalProviders = await readFile(providersPath, "utf8");
+  const listenersFile = listenersFilePath(config);
+  const listenersPath = path.join(targetDir, listenersFile);
+  const originalListeners = files.includes(listenersFile)
+    ? await readFile(listenersPath, "utf8")
+    : undefined;
+  let nextListeners = originalListeners;
+  const candidateNames: string[] = [];
 
   for (const { registry } of candidates) {
-    const imported = parseNamedImportSources(next).get(registry.registryName);
+    candidateNames.push(registry.registryName);
+    const imported =
+      nextListeners === undefined
+        ? undefined
+        : parseNamedImportSources(nextListeners).get(registry.registryName);
     if (imported) {
       const importedFile = sourceFileFromImport(
         imported.sourcePath,
-        providersFile,
+        listenersFile,
         files,
       );
       if (importedFile !== registry.indexFile) return undefined;
     }
 
-    const result = wireListenersProviderSource(next, {
-      registryName: registry.registryName,
-      featureKebab: listenerFeatureKebab(registry.indexFile),
-      listenerModule: `@/${modulePath(registry.indexFile)}`,
-      config,
-    });
+    const listenerModule = `@/${modulePath(registry.indexFile)}`;
+    const result =
+      nextListeners === undefined
+        ? {
+            kind: "updated" as const,
+            source: createListenersRegistrySource({
+              registryName: registry.registryName,
+              listenerModule,
+            }),
+          }
+        : updateListenersRegistrySource(nextListeners, {
+            registryName: registry.registryName,
+            listenerModule,
+          });
     if (result.kind === "missing") return undefined;
     if (result.kind === "updated") {
-      next = result.source;
-      registeredNames.push(registry.registryName);
+      nextListeners = result.source;
     }
   }
 
-  if (next === original || registeredNames.length === 0) return undefined;
+  if (nextListeners === undefined || candidateNames.length === 0) {
+    return undefined;
+  }
 
-  await writeFile(providersPath, next);
+  const providerResult = wireListenersProviderSource(originalProviders, {
+    registryName: candidateNames[0] ?? "listeners",
+    featureKebab: "app",
+    listenerModule: `@/${modulePath(listenersFile)}`,
+    config,
+  });
+  if (providerResult.kind === "missing") return undefined;
+
+  const nextProviders =
+    providerResult.kind === "updated"
+      ? providerResult.source
+      : originalProviders;
+
+  if (
+    nextListeners === originalListeners &&
+    nextProviders === originalProviders
+  ) {
+    return undefined;
+  }
+
+  await mkdir(path.dirname(listenersPath), { recursive: true });
+  await writeFile(listenersPath, nextListeners);
+  if (nextProviders !== originalProviders) {
+    await writeFile(providersPath, nextProviders);
+  }
   return {
     code: "BEIGNET_LISTENER_UNREGISTERED",
-    file: providersFile,
-    message: `Registered ${registeredNames.join(", ")} with registerListeners(...) in ${providersFile}.`,
+    file: listenersFile,
+    message: `Registered ${candidateNames.join(", ")} in ${listenersFile} and wired listeners with registerListeners(...) in ${providersFile}.`,
   };
 }
 
-function listenerFeatureKebab(indexFile: string): string {
-  return path.posix.basename(
-    path.posix.dirname(path.posix.dirname(normalizePath(indexFile))),
-  );
-}
-
 async function fixUnregisteredOutboxEntries(
   targetDir: string,
   files: string[],
@@ -6266,7 +7348,9 @@ async function inspectResourceSlices(
       sourceIncludesAny(portSource, [
         `update(input: Update${singularPascal}Input)`,
         `update(input: Update${singularPascal}RepositoryInput)`,
+        `update(input: Update${singularPascal}Input, scope: TenantScope)`,
         "delete(id: string): Promise<boolean>",
+        "delete(id: string, scope: TenantScope): Promise<boolean>",
       ]);
 
     if (!hasCrudSignals) continue;
@@ -6304,6 +7388,7 @@ async function inspectResourceSlices(
         alternatives: [
           `findById(id: string): Promise<${singularPascal} | null>`,
           `findById(id: string, filter: ${singularPascal}TenantFilter): Promise<${singularPascal} | null>`,
+          `findById(id: string, scope: TenantScope): Promise<${singularPascal} | null>`,
         ],
       },
       {
@@ -6311,6 +7396,7 @@ async function inspectResourceSlices(
         alternatives: [
           `update(input: Update${singularPascal}Input)`,
           `update(input: Update${singularPascal}RepositoryInput)`,
+          `update(input: Update${singularPascal}Input, scope: TenantScope)`,
         ],
       },
       {
@@ -6318,6 +7404,7 @@ async function inspectResourceSlices(
         alternatives: [
           "delete(id: string): Promise<boolean>",
           `delete(id: string, filter: ${singularPascal}TenantFilter): Promise<boolean>`,
+          "delete(id: string, scope: TenantScope): Promise<boolean>",
         ],
       },
     ];
@@ -6460,6 +7547,16 @@ function sourceIncludesAny(
   return source ? snippets.some((snippet) => source.includes(snippet)) : false;
 }
 
+function countSourceOccurrences(source: string, snippet: string): number {
+  let count = 0;
+  let index = source.indexOf(snippet);
+  while (index !== -1) {
+    count += 1;
+    index = source.indexOf(snippet, index + snippet.length);
+  }
+  return count;
+}
+
 function sourceIncludesAll(
   source: string,
   snippets: readonly string[],