@beignet/cli 0.0.31 → 0.0.33

package/src/provider-add.ts

@@ -1,6 +1,10 @@
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { type ProviderPresetName, providerPresetChoices } from "./choices.js";
+import {
+  type IntegrationName,
+  type ProviderPresetName,
+  providerPresetChoices,
+} from "./choices.js";
 import {
   directoryPath,
   loadBeignetConfig,
@@ -104,12 +108,105 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet providers audit and beignet doctor --strict.",
     ],
   },
+  "jobs-bullmq": {
+    name: "jobs-bullmq",
+    displayName: "BullMQ jobs",
+    importName: "bullMQJobsProvider",
+    importFrom: "@beignet/provider-jobs-bullmq",
+    providerEntry: "bullMQJobsProvider",
+    dependencies: (packageJson) => ({
+      "@beignet/provider-jobs-bullmq": beignetDependencyVersion(packageJson),
+      bullmq: externalVersions.bullmq,
+    }),
+    appPort: {
+      key: "jobs",
+      typeName: "JobDispatcherPort",
+      importName: "JobDispatcherPort",
+      importFrom: "@beignet/core/ports",
+    },
+    envVars: ["BULLMQ_REDIS_URL"],
+    envExample: [
+      "# BullMQ jobs provider",
+      "BULLMQ_REDIS_URL=redis://localhost:6379",
+      "# BULLMQ_QUEUE_NAME=beignet-jobs",
+      "# BULLMQ_PREFIX=beignet",
+      "# BULLMQ_CONCURRENCY=5",
+      "",
+    ].join("\n"),
+    docs: [
+      "## BullMQ jobs",
+      "",
+      "- Package: `@beignet/provider-jobs-bullmq`",
+      "- Peer dependency: `bullmq`",
+      "- The preset wires `bullMQJobsProvider` in `server/providers.ts` and defers `jobs` in `infra/app-ports.ts`.",
+      "- Set `BULLMQ_REDIS_URL` before booting the app; the default points at local Redis.",
+      "- Dispatching enqueues jobs, but nothing executes them until a worker entrypoint runs `createBullMQJobWorker(...)` in a worker process. See the jobs docs page.",
+      "- Use `ctx.ports.jobs.dispatch(...)` in app code; `ctx.ports.bullMQJobs` is available as an escape hatch.",
+      "",
+    ].join("\n"),
+    nextSteps: [
+      "Run your package manager install command.",
+      "Set BULLMQ_REDIS_URL in .env.local or your deployment environment.",
+      "Add a worker entrypoint that runs createBullMQJobWorker(...) in a worker process; dispatched jobs do not execute without one. See the jobs docs page.",
+      "Run beignet providers audit and beignet doctor --strict.",
+    ],
+    conflictingProviderEntries: [
+      "inngestJobsProvider",
+      "createInngestJobsProvider",
+      "createBullMQJobsProvider",
+    ],
+  },
+  "jobs-inngest": {
+    name: "jobs-inngest",
+    displayName: "Inngest jobs",
+    importName: "inngestJobsProvider",
+    importFrom: "@beignet/provider-jobs-inngest",
+    providerEntry: "inngestJobsProvider",
+    dependencies: (packageJson) => ({
+      "@beignet/provider-jobs-inngest": beignetDependencyVersion(packageJson),
+      inngest: externalVersions.inngest,
+    }),
+    appPort: {
+      key: "jobs",
+      typeName: "JobDispatcherPort",
+      importName: "JobDispatcherPort",
+      importFrom: "@beignet/core/ports",
+    },
+    envVars: ["INNGEST_APP_NAME", "INNGEST_EVENT_KEY"],
+    envExample: [
+      "# Inngest jobs provider",
+      "INNGEST_APP_NAME=beignet-app",
+      "# INNGEST_EVENT_KEY=",
+      "",
+    ].join("\n"),
+    docs: [
+      "## Inngest jobs",
+      "",
+      "- Package: `@beignet/provider-jobs-inngest`",
+      "- Peer dependency: `inngest`",
+      "- The preset wires `inngestJobsProvider` in `server/providers.ts` and defers `jobs` in `infra/app-ports.ts`.",
+      "- Define jobs with `defineJob(...)` and dispatch them through `ctx.ports.jobs.dispatch(...)`.",
+      "- Execution needs an Inngest serve route built from `createInngestJobFunction(...)` and `serve(...)`. See the jobs docs page.",
+      "- Use `ctx.ports.inngest` only as an escape hatch for Inngest-specific workflow APIs; prefer `ctx.ports.jobs.dispatch(...)` for Beignet jobs.",
+      "",
+    ].join("\n"),
+    nextSteps: [
+      "Run your package manager install command.",
+      "Set INNGEST_APP_NAME and, for Inngest cloud, INNGEST_EVENT_KEY in .env.local or your deployment environment.",
+      "Expose an Inngest serve route with createInngestJobFunction(...) so dispatched jobs execute. See the jobs docs page.",
+      "Run beignet providers audit and beignet doctor --strict.",
+    ],
+    conflictingProviderEntries: [
+      "bullMQJobsProvider",
+      "createBullMQJobsProvider",
+    ],
+  },
   "mail-resend": {
     name: "mail-resend",
     displayName: "Resend mail",
-    importName: "mailResendProvider",
+    importName: "resendMailProvider",
     importFrom: "@beignet/provider-mail-resend",
-    providerEntry: "mailResendProvider",
+    providerEntry: "resendMailProvider",
     dependencies: (packageJson) => ({
       "@beignet/provider-mail-resend": beignetDependencyVersion(packageJson),
       resend: externalVersions.resend,
@@ -132,7 +229,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-mail-resend`",
       "- Peer dependency: `resend`",
-      "- The preset wires `mailResendProvider` in `server/providers.ts` and defers `mailer` in `infra/app-ports.ts`.",
+      "- The preset wires `resendMailProvider` in `server/providers.ts` and defers `mailer` in `infra/app-ports.ts`.",
       "- `.env.example` ships dev placeholders so the app boots; set real `RESEND_API_KEY` and `RESEND_FROM` values before sending mail.",
       "- Use `ctx.ports.mailer` in app code; `ctx.ports.resend` is available as an escape hatch.",
       "",
@@ -143,16 +240,16 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet providers audit and beignet doctor --strict.",
     ],
     conflictingProviderEntries: [
-      "mailSmtpProvider",
+      "smtpMailProvider",
       "createMemoryMailerProvider",
     ],
   },
   "mail-smtp": {
     name: "mail-smtp",
     displayName: "SMTP mail",
-    importName: "mailSmtpProvider",
+    importName: "smtpMailProvider",
     importFrom: "@beignet/provider-mail-smtp",
-    providerEntry: "mailSmtpProvider",
+    providerEntry: "smtpMailProvider",
     dependencies: (packageJson) => ({
       "@beignet/provider-mail-smtp": beignetDependencyVersion(packageJson),
       nodemailer: externalVersions.nodemailer,
@@ -178,7 +275,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-mail-smtp`",
       "- Peer dependency: `nodemailer`",
-      "- The preset wires `mailSmtpProvider` in `server/providers.ts` and defers `mailer` in `infra/app-ports.ts`.",
+      "- The preset wires `smtpMailProvider` in `server/providers.ts` and defers `mailer` in `infra/app-ports.ts`.",
       "- `.env.example` ships dev placeholders so the app boots; set real `MAIL_*` values before sending mail.",
       "- Use `ctx.ports.mailer` in app code; `ctx.ports.smtp` is available as an escape hatch.",
       "",
@@ -189,10 +286,61 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet providers audit and beignet doctor --strict.",
     ],
     conflictingProviderEntries: [
-      "mailResendProvider",
+      "resendMailProvider",
       "createMemoryMailerProvider",
     ],
   },
+  "payments-stripe": {
+    name: "payments-stripe",
+    displayName: "Stripe payments",
+    importName: "stripePaymentsProvider",
+    importFrom: "@beignet/provider-payments-stripe",
+    providerEntry: "stripePaymentsProvider",
+    dependencies: (packageJson) => ({
+      "@beignet/provider-payments-stripe":
+        beignetDependencyVersion(packageJson),
+      stripe: externalVersions.stripe,
+    }),
+    appPort: {
+      key: "payments",
+      typeName: "PaymentsPort",
+      importName: "PaymentsPort",
+      importFrom: "@beignet/core/payments",
+    },
+    envVars: [
+      "STRIPE_SECRET_KEY",
+      "STRIPE_WEBHOOK_SECRET",
+      "STRIPE_PUBLISHABLE_KEY",
+    ],
+    envExample: [
+      "# Stripe payments provider",
+      "STRIPE_SECRET_KEY=sk_test_dev-placeholder-change-me",
+      "STRIPE_WEBHOOK_SECRET=whsec_dev-placeholder-change-me",
+      "# STRIPE_PUBLISHABLE_KEY=",
+      "",
+    ].join("\n"),
+    docs: [
+      "## Stripe payments",
+      "",
+      "- Package: `@beignet/provider-payments-stripe`",
+      "- Peer dependency: `stripe`",
+      "- The preset wires `stripePaymentsProvider` in `server/providers.ts` and defers `payments` in `infra/app-ports.ts`.",
+      "- `.env.example` ships dev placeholders so the app boots; set real `STRIPE_SECRET_KEY` and `STRIPE_WEBHOOK_SECRET` values before taking payments.",
+      "- Stripe requires a webhook route: run `beignet make payments` for the full billing slice, including a `createPaymentWebhookRoute(...)` route.",
+      "- Use `ctx.ports.payments` in app code; `ctx.ports.stripe` is available as an escape hatch.",
+      "",
+    ].join("\n"),
+    nextSteps: [
+      "Run your package manager install command.",
+      "Set STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET in .env.local or your deployment environment.",
+      "Run beignet make payments for the full billing slice; Stripe needs its webhook route before subscription state can sync.",
+      "Run beignet providers audit and beignet doctor --strict.",
+    ],
+    conflictingProviderEntries: [
+      "createMemoryPaymentsProvider",
+      "createStripePaymentsProvider",
+    ],
+  },
   "search-meilisearch": {
     name: "search-meilisearch",
     displayName: "Meilisearch search",
@@ -271,11 +419,11 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
   "redis-cache": {
     name: "redis-cache",
     displayName: "Redis cache",
-    importName: "redisProvider",
-    importFrom: "@beignet/provider-redis",
-    providerEntry: "redisProvider",
+    importName: "redisCacheProvider",
+    importFrom: "@beignet/provider-cache-redis",
+    providerEntry: "redisCacheProvider",
     dependencies: (packageJson) => ({
-      "@beignet/provider-redis": beignetDependencyVersion(packageJson),
+      "@beignet/provider-cache-redis": beignetDependencyVersion(packageJson),
       ioredis: externalVersions.ioredis,
     }),
     appPort: {
@@ -294,9 +442,9 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
     docs: [
       "## Redis cache",
       "",
-      "- Package: `@beignet/provider-redis`",
+      "- Package: `@beignet/provider-cache-redis`",
       "- Peer dependency: `ioredis`",
-      "- The preset wires `redisProvider` in `server/providers.ts` and defers `cache` in `infra/app-ports.ts`.",
+      "- The preset wires `redisCacheProvider` in `server/providers.ts` and defers `cache` in `infra/app-ports.ts`.",
       "- Set `REDIS_URL` before booting the app.",
       "- Use `ctx.ports.cache` in app code; `ctx.ports.redis` is available as an escape hatch.",
       "",
@@ -307,6 +455,53 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet providers audit and beignet doctor --strict.",
     ],
   },
+  "event-bus-redis": {
+    name: "event-bus-redis",
+    displayName: "Redis event bus",
+    importName: "redisEventBusProvider",
+    importFrom: "@beignet/provider-event-bus-redis",
+    providerEntry: "redisEventBusProvider",
+    dependencies: (packageJson) => ({
+      "@beignet/provider-event-bus-redis":
+        beignetDependencyVersion(packageJson),
+      ioredis: externalVersions.ioredis,
+    }),
+    appPort: {
+      key: "eventBus",
+      typeName: "EventBusPort",
+      importName: "EventBusPort",
+      importFrom: "@beignet/core/ports",
+    },
+    envVars: ["REDIS_EVENT_BUS_URL"],
+    envExample: [
+      "# Redis event bus provider",
+      "REDIS_EVENT_BUS_URL=redis://localhost:6379",
+      "# REDIS_EVENT_BUS_DB=0",
+      "# REDIS_EVENT_BUS_CHANNEL_PREFIX=beignet:event-bus:",
+      "",
+    ].join("\n"),
+    docs: [
+      "## Redis event bus",
+      "",
+      "- Package: `@beignet/provider-event-bus-redis`",
+      "- Peer dependency: `ioredis`",
+      "- The preset wires `redisEventBusProvider` in `server/providers.ts` and defers `eventBus` in `infra/app-ports.ts`.",
+      "- Set `REDIS_EVENT_BUS_URL` before booting the app.",
+      "- Redis Pub/Sub delivery is best-effort and cross-process, but not durable: use outbox/jobs for side effects that need retry, replay, or dead-letter handling.",
+      "- Use `ctx.ports.eventBus` in app code; `ctx.ports.redisEventBus` is available as an escape hatch.",
+      "",
+    ].join("\n"),
+    nextSteps: [
+      "Run your package manager install command.",
+      "Set REDIS_EVENT_BUS_URL in .env.local or your deployment environment.",
+      "Keep durable side effects on the outbox/jobs path; Redis Pub/Sub does not replay missed events.",
+      "Run beignet providers audit and beignet doctor --strict.",
+    ],
+    conflictingProviderEntries: [
+      "createInMemoryEventBusProvider",
+      "createRedisEventBusProvider",
+    ],
+  },
   "redis-locks": {
     name: "redis-locks",
     displayName: "Redis locks",
@@ -364,7 +559,19 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       importName: "StoragePort",
       importFrom: "@beignet/core/storage",
     },
-    envVars: ["STORAGE_S3_BUCKET"],
+    envVars: [
+      "STORAGE_S3_BUCKET",
+      "STORAGE_S3_REGION",
+      "STORAGE_S3_ENDPOINT",
+      "STORAGE_S3_PUBLIC_BASE_URL",
+      "STORAGE_S3_FORCE_PATH_STYLE",
+      "STORAGE_S3_KEY_PREFIX",
+      "STORAGE_S3_MAX_ATTEMPTS",
+      "STORAGE_S3_RETRY_MODE",
+      "STORAGE_S3_ACCESS_KEY_ID",
+      "STORAGE_S3_SECRET_ACCESS_KEY",
+      "STORAGE_S3_SESSION_TOKEN",
+    ],
     envExample: [
       "# S3-compatible storage provider",
       "STORAGE_S3_BUCKET=beignet-assets",
@@ -373,6 +580,8 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "# STORAGE_S3_PUBLIC_BASE_URL=",
       "# STORAGE_S3_FORCE_PATH_STYLE=false",
       "# STORAGE_S3_KEY_PREFIX=",
+      "# STORAGE_S3_MAX_ATTEMPTS=3",
+      "# STORAGE_S3_RETRY_MODE=standard",
       "# STORAGE_S3_ACCESS_KEY_ID=",
       "# STORAGE_S3_SECRET_ACCESS_KEY=",
       "# STORAGE_S3_SESSION_TOKEN=",
@@ -496,6 +705,51 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
 
 const providerPresetSet = new Set<string>(providerPresetChoices);
 
+/**
+ * Provider entries the starter template wires for each create-time
+ * integration, used to pre-validate preset selections at create time.
+ */
+const integrationProviderEntries: Record<IntegrationName, string> = {
+  inngest: "inngestJobsProvider",
+  resend: "resendMailProvider",
+  "upstash-rate-limit": "upstashRateLimitProvider",
+};
+
+/**
+ * Whether a preset ships `.env.example` entries the user must fill in.
+ */
+export function providerPresetNeedsEnv(name: ProviderPresetName): boolean {
+  return presets[name].envVars.length > 0;
+}
+
+/**
+ * Fail fast when a create-time selection combines presets or template
+ * integrations that fill the same app port, before any files are written.
+ */
+export function assertCompatibleCreatePresets(
+  presetNames: readonly ProviderPresetName[],
+  integrations: readonly IntegrationName[],
+): void {
+  const selectedEntries = new Map<string, string>();
+  for (const integration of integrations) {
+    selectedEntries.set(integrationProviderEntries[integration], integration);
+  }
+  for (const name of presetNames) {
+    selectedEntries.set(presets[name].providerEntry, name);
+  }
+
+  for (const name of presetNames) {
+    for (const conflict of presets[name].conflictingProviderEntries ?? []) {
+      const other = selectedEntries.get(conflict);
+      if (other !== undefined && other !== name) {
+        throw new Error(
+          `--integrations selections "${name}" and "${other}" fill the same app port. Pick one of them.`,
+        );
+      }
+    }
+  }
+}
+
 export async function addProviderPreset(
   options: AddProviderPresetOptions,
 ): Promise<AddProviderPresetResult> {

package/src/task.ts

@@ -50,7 +50,7 @@ export async function runAppTask(
   const task = findTask(taskModule.tasks, options.name, modulePath);
   // Loaded lazily so CLI commands that never touch the app runtime, such as
   // `beignet lint`, work without a built @beignet/core.
-  const { parseTaskInput } = await import("@beignet/core/tasks");
+  const { parseTaskInput, runTask } = await import("@beignet/core/tasks");
   const parsedInput = await parseTaskInput(task, rawInput);
   const contextArgs: TaskRunContextArgs = {
     task,
@@ -63,8 +63,7 @@ export async function runAppTask(
     : {};
 
   try {
-    const output = await task.handle({
-      task,
+    const output = await runTask(task, {
       input: parsedInput,
       ctx,
     });

package/src/templates/agents.ts

@@ -27,7 +27,9 @@ export function agentsMd(ctx: TemplateContext): string {
   const intent = intentRunner(ctx);
   const capabilityClientRow = ctx.api
     ? ""
-    : "\n| Query cache keys and invalidation | `rq(contract).invalidate(queryClient, params?)`, `.key(...)`, `.filter(...)` from `client/` (`@beignet/react-query`). Thin named wrappers in `features/<feature>/client/` are the convention — hand-built key arrays are not. |";
+    : "\n| Query cache keys and invalidation | `rq(contract).invalidate(queryClient, params?)`, `.key(...)`, `.filter(...)` from `client/` (`@beignet/react-query`). Thin named wrappers in `features/<feature>/client/` are the convention — hand-built key arrays are not. |" +
+      "\n| Server Component request context | Use an app-owned server-only helper such as `lib/server-context.ts` that wraps `server.createContextFromNext()` in React `cache(...)`. Layouts may read `ctx.auth`, `ctx.tenant`, and request metadata for redirects and shell state; feature data still belongs behind use cases. |" +
+      "\n| Server Component React Query prefetch | Use an app-owned helper such as `lib/server-react-query.ts` on top of the request context: keep the `rq(contract).queryOptions(...)` key, replace only the server `queryFn` with the direct use case call, and do not create a parallel `rqServer` abstraction. |";
   const specificSkills = ctx.api
     ? "`@beignet/next#routes-server`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`"
     : "`@beignet/next#routes-server`, `@beignet/react-query#client`, `@beignet/react-hook-form#forms`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`";
@@ -50,8 +52,8 @@ is a silent failure — the file exists but never runs:
 - Tasks must be added to \`defineTasks([...])\` in \`server/tasks.ts\`.
 - Outbox events and jobs must be registered in \`defineOutboxRegistry({...})\`
   in \`server/outbox.ts\`.
-- Listeners must be wired through a \`registerListeners(...)\` call in infra
-  wiring.
+- Listeners must be added to the \`listeners\` array in \`server/listeners.ts\`
+  and wired through a \`registerListeners(...)\` call in server provider wiring.
 
 The starter ships no workflow registries — generators create them on first
 use, so their absence is fine. \`${cli} make event\`, \`${cli} make job\`,
@@ -81,6 +83,7 @@ apps have reimplemented by accident:
 | Ports outside a request — auth callbacks, module-level helpers | \`const { ports } = await getServer()\` (dynamic \`import("@/server")\` breaks module cycles). Do not construct parallel provider clients or fall back to \`console.*\` when \`ports.logger\` exists. |
 | Routes that cannot be contracts — webhooks, third-party callbacks, streaming | \`createWebhookRoute\`, \`createPaymentWebhookRoute\`, \`createScheduleRoute\`, \`createOutboxDrainRoute\` from \`@beignet/next\`; \`server.rawRoute(...)\` for anything else. All run the hooks pipeline — never hand-enforce rate limits in a route body. |
 | Rate limiting or idempotency on a route | Declare \`metadata.rateLimit\` / \`metadata.idempotency\` on the contract (or the \`pipeline\` option on raw routes); hooks enforce it. |
+| Tenant-owned repository access | Pass \`TenantScope\` through app-facing repository methods and unwrap it with \`tenantScopeId(scope)\` in adapters. Raw provider-correlation lookups such as webhook customer IDs are not tenant authorization. |
 | Route-level tests that exercise real hooks | \`createTestApp\` / \`createTestRequester\` from \`@beignet/web/testing\`. Bind the rate-limit and idempotency ports in the test app when asserting 429s or replay. |
 | Environment configuration | \`lib/env.ts\` (\`createEnv\`), never ad-hoc \`process.env\` reads in app code. |
 | The same lookup runs several times in one request — context, policy, use case | Wrap the repository read in \`createMemo(...)\` from \`@beignet/core/memo\` where the adapter is wired in infra. The cache lives for exactly one request; pair mutations with \`.invalidate(...)\`. Never hand-roll per-request caches. |

package/src/templates/base.ts

@@ -67,11 +67,11 @@ export function packageJson(ctx: TemplateContext): string {
     "@beignet/cli": ctx.beignetVersion,
     "@beignet/web": ctx.beignetVersion,
     "@biomejs/biome": externalVersions.biome,
-    "@types/bun": externalVersions.typesBun,
     "@types/node": externalVersions.typesNode,
     "@types/react": externalVersions.typesReact,
     "@types/react-dom": externalVersions.typesReactDom,
     "drizzle-kit": externalVersions.drizzleKit,
+    tsx: externalVersions.tsx,
     typescript: externalVersions.typescript,
   };
 
@@ -97,11 +97,11 @@ export function packageJson(ctx: TemplateContext): string {
     start: "next start",
     lint: "biome lint .",
     format: "biome format --write .",
-    test: "bun test",
+    test: "tsx lib/beignet-test-runner.ts",
     typecheck: "tsc --noEmit",
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
-    "db:reset": "bun infra/db/reset.ts",
+    "db:reset": "tsx infra/db/reset.ts",
   };
 
   return json({
@@ -159,18 +159,10 @@ export function readme(ctx: TemplateContext): string {
     ctx.packageManager === "npm"
       ? "npm run test"
       : `${ctx.packageManager} run test`;
-  const lint =
-    ctx.packageManager === "npm"
-      ? "npm run lint"
-      : `${ctx.packageManager} run lint`;
   const format =
     ctx.packageManager === "npm"
       ? "npm run format"
       : `${ctx.packageManager} run format`;
-  const typecheck =
-    ctx.packageManager === "npm"
-      ? "npm run typecheck"
-      : `${ctx.packageManager} run typecheck`;
   const cli = packageRunner(ctx);
 
   const firstOpen = ctx.api
@@ -393,7 +385,7 @@ export function integrationsDoc(ctx: TemplateContext): string {
   for (const integration of ctx.integrations) {
     if (integration === "inngest") {
       lines.push(
-        "## Inngest",
+        "## Inngest jobs",
         "",
         "- Package: `@beignet/core` (`@beignet/core/events`, `@beignet/core/jobs`)",
         "- Package: `@beignet/provider-jobs-inngest`",
@@ -411,7 +403,7 @@ export function integrationsDoc(ctx: TemplateContext): string {
         "",
         "- Package: `@beignet/provider-mail-resend`",
         "- Peer dependency: `resend`",
-        "- The starter wires `mailResendProvider` in `server/providers.ts`.",
+        "- The starter wires `resendMailProvider` in `server/providers.ts`.",
         "- `.env.example` ships dev placeholders so the app boots; set real `RESEND_API_KEY` and `RESEND_FROM` values before sending mail.",
         "",
       );

package/src/templates/index.ts

@@ -28,6 +28,7 @@ import {
 import { shadcnTemplateFiles } from "./shadcn.js";
 import type { TemplateContext, TemplateFile } from "./shared.js";
 import { shellTemplateFiles } from "./shell.js";
+import { testSupportTemplateFiles } from "./testing.js";
 import { todosFiles } from "./todos.js";
 
 /**
@@ -133,6 +134,7 @@ export function getTemplateFiles(ctx: TemplateContext): TemplateFile[] {
     { path: "lib/auth.ts", content: serverFiles.authHelpers },
     { path: "lib/better-auth.ts", content: betterAuth(ctx) },
     { path: "lib/tenant.ts", content: serverFiles.tenantHelper },
+    ...testSupportTemplateFiles,
     { path: "lib/use-case.ts", content: serverFiles.useCaseBuilder },
     { path: "server/index.ts", content: server(ctx) },
     { path: "server/context.ts", content: serverFiles.serverContext },

package/src/templates/server.ts

@@ -15,9 +15,9 @@ export function serverProviders(ctx: TemplateContext): string {
     hasIntegration(ctx, "inngest")
       ? 'import { inngestJobsProvider } from "@beignet/provider-jobs-inngest";'
       : undefined,
-    'import { loggerPinoProvider } from "@beignet/provider-logger-pino";',
+    'import { pinoLoggerProvider } from "@beignet/provider-logger-pino";',
     hasIntegration(ctx, "resend")
-      ? 'import { mailResendProvider } from "@beignet/provider-mail-resend";'
+      ? 'import { resendMailProvider } from "@beignet/provider-mail-resend";'
       : undefined,
     hasIntegration(ctx, "upstash-rate-limit")
       ? 'import { upstashRateLimitProvider } from "@beignet/provider-rate-limit-upstash";'
@@ -31,11 +31,11 @@ export function serverProviders(ctx: TemplateContext): string {
   const entries = [
     "\tcreateDevtoolsProvider(),",
     "\tcreateAuthBetterAuthProvider<AuthUser, AuthSessionMetadata>(auth),",
-    "\tloggerPinoProvider,",
+    "\tpinoLoggerProvider,",
     `\t${db.providerInstance},`,
     "\tstarterDatabaseProvider,",
     hasIntegration(ctx, "inngest") ? "\tinngestJobsProvider," : undefined,
-    hasIntegration(ctx, "resend") ? "\tmailResendProvider," : undefined,
+    hasIntegration(ctx, "resend") ? "\tresendMailProvider," : undefined,
     hasIntegration(ctx, "upstash-rate-limit")
       ? "\tupstashRateLimitProvider,"
       : undefined,
@@ -297,7 +297,11 @@ export function server(ctx: TemplateContext): string {
 
   return `import "@beignet/core/server-only";
 import { createNextServer, createNextServerLoader } from "@beignet/next";
-import { createErrorReportingHooks, createIdempotencyHooks } from "@beignet/core/server";
+import {
+	createErrorReportingHooks,
+	createIdempotencyHooks,
+	createSecurityHeadersHooks,
+} from "@beignet/core/server";
 import type { AppContext } from "@/app-context";
 import { appPorts } from "@/infra/app-ports";
 import { env } from "@/lib/env";
@@ -314,6 +318,7 @@ export const getServer = createNextServerLoader(async () => {
 ${providerConfigEntries}
 	},
 	hooks: [
+		createSecurityHeadersHooks<AppContext>(),
 		createErrorReportingHooks<AppContext>(),
 		createIdempotencyHooks<AppContext>(),
 	],

package/src/templates/shared.ts

@@ -35,8 +35,8 @@ export const externalVersions = {
   next: "^16.2.4",
   react: "^19.2.5",
   reactDom: "^19.2.5",
+  tsx: "^4.22.4",
   typescript: "^5.3.0",
-  typesBun: "^1.3.13",
   typesNode: "^20.10.0",
   typesReact: "^19.0.0",
   typesReactDom: "^19.0.0",
@@ -45,6 +45,7 @@ export const externalVersions = {
   hookformResolvers: "^5.0.0",
   reactHookForm: "^7.74.0",
   betterAuth: "1.6.20",
+  bullmq: "^5.0.0",
   drizzleKit: "^0.31.10",
   drizzleOrm: "^0.45.2",
   inngest: "^3.0.0",
@@ -56,6 +57,7 @@ export const externalVersions = {
   pino: "^9.7.0",
   resend: "^6.14.0",
   sentryNode: "^10.58.0",
+  stripe: "^22.2.1",
   nodemailer: "^8.0.5",
   openFeatureServerSdk: "^1.22.0",
   typesPg: "^8.11.0",
@@ -65,6 +67,18 @@ export const externalVersions = {
   upstashRedis: "^1.0.0",
 };
 
+export const legacyGeneratedPackageScripts: Record<string, string> = {
+  "db:reset": "bun infra/db/reset.ts",
+  "db:seed": "bun server/seed.ts",
+  test: "bun test",
+};
+
+export const currentGeneratedPackageScripts: Record<string, string> = {
+  "db:reset": "tsx infra/db/reset.ts",
+  "db:seed": "tsx server/seed.ts",
+  test: "tsx lib/beignet-test-runner.ts",
+};
+
 /**
  * Dialect-specific names used when rendering database-aware templates.
  */