@beignet/cli 0.0.31 → 0.0.33

package/dist/inspect.js

@@ -1,12 +1,14 @@
-import { readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { parseProviderPackageMetadata } from "@beignet/core/providers";
 import { createPainter } from "./ansi.js";
 import { clientDirPath, clientFormsPath, clientIndexPath, defaultBeignetConfig, directoryPath, loadBeignetConfig, normalizePath, resolveConfig, } from "./config.js";
 import { formatGithubAnnotation, } from "./github-annotations.js";
-import { providersFilePath, wireListenersProviderSource, } from "./make/shared.js";
+import { createListenersRegistrySource, listenersFilePath, providersFilePath, updateListenersRegistrySource, wireListenersProviderSource, } from "./make/shared.js";
 import { detectedProviderVariants, diagnosticPackageJsonFile, formatProviderMetadataIssues, installedPackageNames, providerDoctorRulesForInstalledPackages, providerOperationalConfigFiles, providerRequiredEnvExists, providerRequiredTableExists, providerVariantRegistrationSeverity, readProviderListEntries, readProviderPackageMetadataSource, registrationTokenHint, serverProviderFiles, } from "./provider-audit.js";
 import { appendToArrayExpression, appendToNamedArray, appendToOutboxRegistryArray, arrayInitializerInfo, identifiersFromArrayExpression, insertAfterImports, matchingDelimiterIndex, outboxRegistryValueInfo, } from "./registry-edits.js";
+import { currentGeneratedPackageScripts, externalVersions, legacyGeneratedPackageScripts, } from "./templates/shared.js";
+import { testSupportTemplateFiles } from "./templates/testing.js";
 import { getCliVersion } from "./version.js";
 export async function inspectApp(options = {}) {
     const targetDir = path.resolve(options.cwd ?? process.cwd());
@@ -48,7 +50,7 @@ export async function applyDoctorFixes(options = {}) {
     const routeExports = await readRouteExports(targetDir, routeFiles, config);
     const matchedRoutes = matchRoutes(contracts, routeExports);
     const fixes = [];
-    const packageFix = await fixMissingTestScript(targetDir, files, convention);
+    const packageFix = await fixPackageScripts(targetDir, files, convention);
     if (packageFix)
         fixes.push(packageFix);
     const routeGroupFix = await fixUnregisteredRouteGroups(targetDir, files, config);
@@ -147,7 +149,11 @@ export function formatDoctor(result, options = {}) {
     lines.push("", formatDoctorFooter(result));
     return lines.join("\n");
 }
-const productionHardeningDiagnosticCodes = new Set([
+/**
+ * Doctor diagnostic codes that describe production hardening concerns.
+ * `beignet preflight` promotes these to gate failures.
+ */
+export const productionHardeningDiagnosticCodes = new Set([
     "BEIGNET_AUTH_ROUTE_MISSING",
     "BEIGNET_AUTH_TRUSTED_ORIGINS_MISSING",
     "BEIGNET_BETTER_AUTH_SECRET_PLACEHOLDER",
@@ -163,6 +169,7 @@ const productionHardeningDiagnosticCodes = new Set([
     "BEIGNET_PROVIDER_ENV_MISSING",
     "BEIGNET_PROVIDER_TABLE_MISSING",
     "BEIGNET_READINESS_ROUTE_MISSING",
+    "BEIGNET_SECURITY_HEADERS_MISSING",
     "BEIGNET_TENANT_HEADER_AUTHORITY",
     "BEIGNET_UPLOAD_AUTHORIZATION_MISSING",
     "BEIGNET_UPLOAD_SIZE_LIMIT_MISSING",
@@ -175,7 +182,7 @@ function productionHardeningChecklist(diagnostics) {
         "Secrets and provider credentials are unique per environment, validated at startup, never committed, and never logged.",
         "Auth routes, tenant resolution, authorization policies, and trusted origins derive authority from verified sessions, API keys, or trusted gateway metadata.",
         "Devtools, OpenAPI, cron, webhooks, and operational routes have intentional exposure and app-owned authorization.",
-        "CORS origins, proxy IP trust, rate-limit keys, and request body limits match the production host topology.",
+        "Security headers, CORS origins, proxy IP trust, rate-limit keys, and request body limits match the production host topology.",
         "Uploads and storage define max sizes, authorization or explicit public access, object visibility, safe content headers, and short direct-upload expirations.",
         "Provider-backed dependencies have bounded readiness checks, worker shutdown behavior, webhook secrets, and least-privilege credentials.",
     ];
@@ -842,7 +849,7 @@ async function inspectDiagnostics(targetDir, files, config, convention, contract
     for (const routeHandler of matchedRoutes.unmatchedRouteHandlers) {
         diagnostics.push(unmatchedRouteDiagnostic(routeHandler));
     }
-    diagnostics.push(...(await inspectPackageScripts(targetDir, files, convention)), ...(await inspectOpenApiDrift(targetDir, files, config, convention, contracts, matchedRoutes)), ...(await inspectFeatureRouteRegistration(targetDir, files, config, convention, contracts)), ...(await inspectRouteErrorCatalogDrift(targetDir, files, config, convention, contracts, strict)), ...(await inspectCanonicalConformance(targetDir, files, config, convention, strict)), ...(await inspectVersionSkew(targetDir, files)), ...(await inspectProviderMetadataDrift(targetDir, files, convention)), ...(await inspectPortProviderDrift(targetDir, files, config, convention)), ...(await inspectProviderRegistrationDrift(targetDir, files, config, convention)), ...(await inspectDatabaseLifecycleDrift(targetDir, files, config, convention, strict)), ...(await inspectAuthzAuditDrift(targetDir, files, config, convention, contracts)), ...(await inspectServerlessFootguns(targetDir, files, config, convention)), ...(await inspectProductionReadiness(targetDir, files, config, convention)), ...(await inspectFeatureArtifactDrift(targetDir, files, config, convention)), ...(await inspectWorkflowRegistrationDrift(targetDir, files, config, convention)), ...(await inspectResourceSlices(targetDir, files, config, convention, strict)));
+    diagnostics.push(...(await inspectPackageScripts(targetDir, files, convention)), ...(await inspectOpenApiDrift(targetDir, files, config, convention, contracts, matchedRoutes)), ...(await inspectFeatureRouteRegistration(targetDir, files, config, convention, contracts)), ...(await inspectRouteErrorCatalogDrift(targetDir, files, config, convention, contracts, strict)), ...(await inspectCanonicalConformance(targetDir, files, config, convention, strict)), ...(await inspectVersionSkew(targetDir, files)), ...(await inspectProviderMetadataDrift(targetDir, files, convention)), ...(await inspectPortProviderDrift(targetDir, files, config, convention)), ...(await inspectProviderRegistrationDrift(targetDir, files, config, convention)), ...(await inspectDatabaseLifecycleDrift(targetDir, files, config, convention, strict)), ...(await inspectAuthzAuditDrift(targetDir, files, config, convention, contracts)), ...(await inspectServerlessFootguns(targetDir, files, config, convention)), ...(await inspectProductionReadiness(targetDir, files, config, convention)), ...(await inspectFeatureArtifactDrift(targetDir, files, config, convention)), ...(await inspectWorkflowRegistrationDrift(targetDir, files, config, convention)), ...(await inspectRuntimeManifestDrift(targetDir, files, config, convention)), ...(await inspectResourceSlices(targetDir, files, config, convention, strict)));
     return dedupeDiagnostics(diagnostics);
 }
 async function inspectCanonicalConformance(targetDir, files, config, convention, strict) {
@@ -1224,6 +1231,7 @@ const readinessRelevantProviderPackages = new Set([
     "@beignet/provider-auth-better-auth",
     "@beignet/provider-db-drizzle",
     "@beignet/provider-error-reporting-sentry",
+    "@beignet/provider-event-bus-redis",
     "@beignet/provider-flags-openfeature",
     "@beignet/provider-jobs-bullmq",
     "@beignet/provider-jobs-inngest",
@@ -1232,7 +1240,7 @@ const readinessRelevantProviderPackages = new Set([
     "@beignet/provider-mail-smtp",
     "@beignet/provider-payments-stripe",
     "@beignet/provider-rate-limit-upstash",
-    "@beignet/provider-redis",
+    "@beignet/provider-cache-redis",
     "@beignet/provider-search-meilisearch",
     "@beignet/provider-storage-s3",
 ]);
@@ -1247,10 +1255,16 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
     const configFiles = operationalConfigFiles(files, config);
     const infrastructurePath = directoryPath(path.dirname(config.paths.infrastructurePorts));
     const schemaDir = `${infrastructurePath}/db/schema`;
+    let hasSecurityHeadersHook = false;
     for (const file of files) {
         if (!file.endsWith(".ts") || file.endsWith(".test.ts"))
             continue;
         const source = await readCachedSource(targetDir, file, sourceCache);
+        const routeServerOrInfra = isRouteServerOrInfraFile(file, config);
+        if (routeServerOrInfra &&
+            containsCallExpression(source, "createSecurityHeadersHooks")) {
+            hasSecurityHeadersHook = true;
+        }
         if (containsCallExpression(source, "createDevtoolsRoute") &&
             /\benabled\s*:\s*true\b/.test(source) &&
             !/\bauthorize\s*:/.test(source)) {
@@ -1293,8 +1307,7 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
                 message: `${file} defines a protected upload without authorize(...). Add an authorize hook, or set access: "public" only for intentionally public uploads.`,
             });
         }
-        if (isRouteServerOrInfraFile(file, config) &&
-            containsRequestTenantHeaderAuthority(source)) {
+        if (routeServerOrInfra && containsRequestTenantHeaderAuthority(source)) {
             diagnostics.push({
                 severity: "warning",
                 code: "BEIGNET_TENANT_HEADER_AUTHORITY",
@@ -1302,7 +1315,7 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
                 message: `${file} reads x-tenant-id and turns it into tenant authority. Resolve request tenants from verified auth/session claims or trusted gateway metadata instead of a caller-controlled header.`,
             });
         }
-        if (isRouteServerOrInfraFile(file, config) &&
+        if (routeServerOrInfra &&
             containsCallExpression(source, "createCorsHooks") &&
             /\bcredentials\s*:\s*true\b/.test(source) &&
             /(?:\borigin\b|\borigins\b)\s*:\s*(?:["']\*["']|\[\s*["']\*["'])/.test(source)) {
@@ -1314,6 +1327,14 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
             });
         }
     }
+    if (files.includes(config.paths.server) && !hasSecurityHeadersHook) {
+        diagnostics.push({
+            severity: "warning",
+            code: "BEIGNET_SECURITY_HEADERS_MISSING",
+            file: config.paths.server,
+            message: `${config.paths.server} does not install createSecurityHeadersHooks(...). Add the hook or equivalent platform-managed headers before exposing browser traffic.`,
+        });
+    }
     for (const file of configFiles) {
         const source = await readCachedSource(targetDir, file, sourceCache);
         if (containsBetterAuthLocalSecret(source)) {
@@ -1354,7 +1375,7 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
                         severity: "warning",
                         code: "BEIGNET_PROVIDER_TABLE_MISSING",
                         file: schemaDir,
-                        message: `${provider.packageName} is installed and ${variant.displayName} is registered, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema generate, include it in your Drizzle schema/migrations, or remove the provider registration.`,
+                        message: `${provider.packageName} is installed and ${variant.displayName} is registered, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema sync, include it in your Drizzle schema/migrations, or remove the provider registration.`,
                     });
                 }
             }
@@ -1379,7 +1400,7 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
                 severity: "warning",
                 code: "BEIGNET_PROVIDER_TABLE_MISSING",
                 file: schemaDir,
-                message: `${provider.packageName} is installed, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema generate, include it in your Drizzle schema/migrations, or remove the unused provider package.`,
+                message: `${provider.packageName} is installed, but required table ${tableName} was not found in ${schemaDir}/, drizzle/, or app database setup files. Add it with beignet db schema sync, include it in your Drizzle schema/migrations, or remove the unused provider package.`,
             });
         }
     }
@@ -2126,6 +2147,61 @@ async function inspectWorkflowRegistrationDrift(targetDir, files, config, conven
     }
     return diagnostics;
 }
+async function inspectRuntimeManifestDrift(targetDir, files, config, convention) {
+    if (!convention.resourceGenerator)
+        return [];
+    const manifest = await readRuntimeManifestIdentifiers(targetDir, files);
+    if (!manifest)
+        return [];
+    const registries = await readFeatureWorkflowRegistries(targetDir, files, config);
+    const diagnostics = [];
+    const checks = [
+        {
+            kind: "listeners",
+            registered: manifest.listeners,
+            code: "BEIGNET_RUNTIME_MANIFEST_LISTENER_MISSING",
+            label: "listeners",
+        },
+        {
+            kind: "schedules",
+            registered: manifest.schedules,
+            code: "BEIGNET_RUNTIME_MANIFEST_SCHEDULE_MISSING",
+            label: "schedules",
+        },
+        {
+            kind: "tasks",
+            registered: manifest.tasks,
+            code: "BEIGNET_RUNTIME_MANIFEST_TASK_MISSING",
+            label: "tasks",
+        },
+        {
+            kind: "events",
+            registered: manifest.events,
+            code: "BEIGNET_RUNTIME_MANIFEST_OUTBOX_EVENT_MISSING",
+            label: "outbox events",
+        },
+        {
+            kind: "jobs",
+            registered: manifest.jobs,
+            code: "BEIGNET_RUNTIME_MANIFEST_OUTBOX_JOB_MISSING",
+            label: "outbox jobs",
+        },
+    ];
+    for (const check of checks) {
+        const missing = unregisteredWorkflowRegistries(registries.filter((registry) => registry.kind === check.kind), check.registered);
+        for (const { registry, missingMembers } of missing) {
+            for (const member of missingMembers) {
+                diagnostics.push({
+                    severity: "warning",
+                    code: check.code,
+                    file: manifest.file,
+                    message: `${workflowArtifactOrigin(registry, member)}, but it is not listed in defineRuntimeManifest(...) ${check.label} in ${manifest.file}, so runtime integrity cannot fail fast if it is omitted from a runtime registry.`,
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
 function workflowArtifactOrigin(registry, member) {
     const memberFile = registry.memberFiles.get(member) ?? registry.indexFile;
     if (memberFile === registry.indexFile) {
@@ -2192,7 +2268,7 @@ async function workflowRegistrationDrift(targetDir, files, config) {
     }
     const listenerRegistries = byKind("listeners");
     if (listenerRegistries.length > 0) {
-        const wiring = await listenerWiringReferences(targetDir, files);
+        const wiring = await listenerWiringReferences(targetDir, files, config);
         drift.listeners = {
             unregistered: unregisteredWorkflowRegistries(listenerRegistries, wiring.identifiers),
             wiringFile: wiring.wiringFile,
@@ -2271,6 +2347,71 @@ function exportedMemberFiles(source, indexFile, files) {
     }
     return memberFiles;
 }
+async function readRuntimeManifestIdentifiers(targetDir, files) {
+    for (const file of files) {
+        if (!file.endsWith(".ts") && !file.endsWith(".tsx"))
+            continue;
+        if (file.endsWith(".d.ts") || isWorkflowTestFile(file))
+            continue;
+        const source = await readFile(path.join(targetDir, file), "utf8");
+        if (!source.includes("defineRuntimeManifest"))
+            continue;
+        const identifiers = runtimeManifestIdentifiers(source);
+        if (identifiers) {
+            return {
+                file,
+                ...identifiers,
+            };
+        }
+    }
+    return undefined;
+}
+function runtimeManifestIdentifiers(source) {
+    const call = /\bdefineRuntimeManifest\s*(?:<[^>]*>\s*)?\(/.exec(source);
+    if (!call)
+        return undefined;
+    const arg = firstCallArgInfo(source, call.index + call[0].length);
+    if (!arg)
+        return undefined;
+    const outbox = objectPropertyValueInfo(arg.text, "outbox");
+    return {
+        listeners: identifiersFromPropertyArray(arg.text, "listeners"),
+        schedules: identifiersFromPropertyArray(arg.text, "schedules"),
+        tasks: identifiersFromPropertyArray(arg.text, "tasks"),
+        events: outbox
+            ? identifiersFromPropertyArray(outbox.text, "events")
+            : new Set(),
+        jobs: outbox
+            ? identifiersFromPropertyArray(outbox.text, "jobs")
+            : new Set(),
+    };
+}
+function identifiersFromPropertyArray(source, property) {
+    const value = objectPropertyValueInfo(source, property);
+    if (!value?.text.startsWith("["))
+        return new Set();
+    return identifiersFromArrayExpression(value.text);
+}
+function objectPropertyValueInfo(source, property) {
+    const propertyMatch = new RegExp(`\\b${property}\\s*:`).exec(source);
+    if (!propertyMatch)
+        return undefined;
+    let start = propertyMatch.index + propertyMatch[0].length;
+    while (start < source.length && /\s/.test(source[start]))
+        start++;
+    const open = source[start];
+    const close = open === "[" ? "]" : open === "{" ? "}" : undefined;
+    if (!close)
+        return undefined;
+    const end = matchingDelimiterIndex(source, start, open, close);
+    if (end === -1)
+        return undefined;
+    return {
+        text: source.slice(start, end + 1),
+        start,
+        end: end + 1,
+    };
+}
 function registeredWorkflowIdentifiers(source, kind) {
     if (kind === "tasks") {
         const call = /\bdefineTasks\s*(?:<[^>]*>\s*)?\(/.exec(source);
@@ -2297,16 +2438,19 @@ async function listenedEventNames(targetDir, files, config) {
     }
     return listened;
 }
-async function listenerWiringReferences(targetDir, files) {
+async function listenerWiringReferences(targetDir, files, config) {
     const identifiers = new Set();
     let wiringFile;
     let eventBusFile;
+    let centralListenerRegistryReferenced = false;
+    const listenerRegistryFile = listenersFilePath(config);
     for (const file of files) {
         if (!file.endsWith(".ts") && !file.endsWith(".tsx"))
             continue;
         if (file.endsWith(".d.ts") || isWorkflowTestFile(file))
             continue;
         const source = await readFile(path.join(targetDir, file), "utf8");
+        const namedImports = parseNamedImportSources(source);
         let foundCall = false;
         for (const match of source.matchAll(/\bregisterListeners\s*\(/g)) {
             const openParen = (match.index ?? 0) + match[0].length - 1;
@@ -2315,9 +2459,19 @@ async function listenerWiringReferences(targetDir, files) {
                 ? source.slice(openParen)
                 : source.slice(openParen + 1, closeParen);
             foundCall = true;
-            for (const identifier of identifiersFromArrayExpression(argsText)) {
+            const callIdentifiers = identifiersFromArrayExpression(argsText);
+            for (const identifier of callIdentifiers) {
                 identifiers.add(identifier);
             }
+            if (callReferencesCentralListenerRegistry({
+                callIdentifiers,
+                namedImports,
+                importerFile: file,
+                listenerRegistryFile,
+                files,
+            })) {
+                centralListenerRegistryReferenced = true;
+            }
         }
         if (foundCall) {
             wiringFile ??= file;
@@ -2326,8 +2480,33 @@ async function listenerWiringReferences(targetDir, files) {
             eventBusFile = file;
         }
     }
+    if (centralListenerRegistryReferenced &&
+        files.includes(listenerRegistryFile)) {
+        const source = await readFile(path.join(targetDir, listenerRegistryFile), "utf8");
+        const central = arrayInitializerInfo(source, "listeners");
+        if (central) {
+            for (const identifier of identifiersFromArrayExpression(central.text)) {
+                identifiers.add(identifier);
+            }
+        }
+    }
     return { identifiers, wiringFile, eventBusFile };
 }
+function callReferencesCentralListenerRegistry(args) {
+    if (args.importerFile === args.listenerRegistryFile &&
+        args.callIdentifiers.has("listeners")) {
+        return true;
+    }
+    for (const identifier of args.callIdentifiers) {
+        const imported = args.namedImports.get(identifier);
+        if (!imported || imported.importedName !== "listeners")
+            continue;
+        const importedFile = sourceFileFromImport(imported.sourcePath, args.importerFile, args.files);
+        if (importedFile === args.listenerRegistryFile)
+            return true;
+    }
+    return false;
+}
 function isWorkflowTestFile(file) {
     return (file.endsWith(".test.ts") ||
         file.endsWith(".test.tsx") ||
@@ -2546,7 +2725,7 @@ async function inspectDatabaseLifecycleDrift(targetDir, files, config, conventio
                 message: `This app has Drizzle database artifacts, but package.json does not define "${script}". Add an app-owned ${script} script so beignet db ${script.replace("db:", "")} can run the database lifecycle command.`,
             });
         }
-        diagnostics.push(...(await inspectDurableDrizzleTableDrift(targetDir, files, config, infrastructurePath, schemaDir, sourceCache)));
+        diagnostics.push(...(await inspectDurableDrizzleTableDrift(targetDir, files, config, infrastructurePath, schemaDir, sourceCache)), ...(await inspectTenantScopeRepositoryDrift(targetDir, files, resources, config, infrastructurePath, schemaDir, sourceCache)));
     }
     const schemaFilePath = `${infrastructurePath}/db/schema.ts`;
     if (files.includes(schemaFilePath)) {
@@ -2671,6 +2850,387 @@ async function inspectDatabaseLifecycleDrift(targetDir, files, config, conventio
     }
     return diagnostics;
 }
+async function inspectTenantScopeRepositoryDrift(targetDir, files, resources, config, infrastructurePath, schemaDir, sourceCache) {
+    const diagnostics = [];
+    const schemaIndexFile = `${schemaDir}/index.ts`;
+    const schemaFiles = files.filter((file) => file.startsWith(`${schemaDir}/`) &&
+        file.endsWith(".ts") &&
+        file !== schemaIndexFile);
+    const tenantScopedTables = await collectTenantScopedDrizzleTables(targetDir, schemaFiles, sourceCache);
+    const inspectedRepositories = new Set();
+    for (const resource of resources) {
+        const singular = singularize(resource);
+        const singularPascal = pascalCase(singular);
+        const pluralCamel = camelCase(resource);
+        const schemaFile = `${schemaDir}/${resource}.ts`;
+        const portFile = resourcePortFile(resource, singular, config);
+        const drizzleRepositoryFile = drizzleRepositoryAdapterFile(files, `${infrastructurePath}/${resource}/`, singular);
+        if (!drizzleRepositoryFile || !files.includes(schemaFile))
+            continue;
+        const schemaSource = await readCachedSource(targetDir, schemaFile, sourceCache);
+        const schemaTenantColumns = tenantScopeColumnsFromSource(schemaSource);
+        if (schemaTenantColumns.length === 0)
+            continue;
+        inspectedRepositories.add(drizzleRepositoryFile);
+        if (files.includes(portFile)) {
+            const portSource = await readCachedSource(targetDir, portFile, sourceCache);
+            if (!/\b[A-Za-z_$][\w$]*\s*:\s*TenantScope\b/.test(portSource)) {
+                diagnostics.push({
+                    severity: "warning",
+                    code: "BEIGNET_TENANT_SCOPE_PORT_MISSING",
+                    file: portFile,
+                    message: `${resource} has a tenant-scoped Drizzle schema (${schemaFile}), but ${portFile} does not accept TenantScope in its ${singularPascal}Repository methods. Tenant-owned repository methods should require a branded scope argument instead of raw tenant or workspace IDs.`,
+                });
+            }
+        }
+        const repositorySource = await readCachedSource(targetDir, drizzleRepositoryFile, sourceCache);
+        const tenantPredicate = `eq(schema.${pluralCamel}.tenantId, tenantScopeId(scope))`;
+        const tenantPredicateCount = countSourceOccurrences(repositorySource, tenantPredicate);
+        const setsTenantFromScope = repositorySource.includes("tenantId: tenantScopeId(scope)");
+        if (!repositorySource.includes(`schema.${pluralCamel}`) ||
+            (tenantPredicateCount >= 4 && setsTenantFromScope) ||
+            repositoryHasScopedTenantCoverage(repositorySource, [
+                {
+                    name: pluralCamel,
+                    file: schemaFile,
+                    columns: schemaTenantColumns,
+                },
+            ])) {
+            continue;
+        }
+        diagnostics.push({
+            severity: "warning",
+            code: "BEIGNET_TENANT_SCOPE_PREDICATE_MISSING",
+            file: drizzleRepositoryFile,
+            message: `${resource} has a tenant-scoped Drizzle schema (${schemaFile}), but ${drizzleRepositoryFile} does not use TenantScope consistently. Tenant-owned repository adapters should derive tenant or workspace IDs from tenantScopeId(scope) and include them in create values and read, update, and delete predicates.`,
+        });
+    }
+    const repositoryFiles = files.filter((file) => file.startsWith(`${infrastructurePath}/`) &&
+        file.includes("/drizzle-") &&
+        file.endsWith("-repository.ts") &&
+        !file.endsWith(".test.ts"));
+    const featuresPath = directoryPath(config.paths.features);
+    for (const repositoryFile of repositoryFiles) {
+        if (inspectedRepositories.has(repositoryFile))
+            continue;
+        const repositorySource = await readCachedSource(targetDir, repositoryFile, sourceCache);
+        const referencedTables = tenantScopedTables.filter((table) => repositorySource.includes(`schema.${table.name}`));
+        if (referencedTables.length === 0)
+            continue;
+        const repositoryFeature = repositoryFeatureFromPath(repositoryFile, infrastructurePath);
+        if (!repositoryFeature || isTenantAuthorityFeature(repositoryFeature)) {
+            continue;
+        }
+        const portFile = `${featuresPath}/${repositoryFeature}/ports.ts`;
+        if (!files.includes(portFile))
+            continue;
+        const portSource = await readCachedSource(targetDir, portFile, sourceCache);
+        const repositoryBlocks = repositoryInterfaceBlocks(portSource);
+        if (repositoryBlocks.length === 0)
+            continue;
+        const hasTenantScopeBoundary = repositoryBlocks.some((block) => repositoryInterfaceAcceptsTenantScope(block));
+        const rawBoundaries = repositoryBlocks.flatMap((block) => rawTenantRepositoryMethodBoundaries(block, referencedTables));
+        if (rawBoundaries.length > 0) {
+            diagnostics.push({
+                severity: "warning",
+                code: "BEIGNET_TENANT_SCOPE_RAW_ID_BOUNDARY",
+                file: portFile,
+                message: `${portFile} declares tenant-owned repository methods (${rawBoundaries.join(", ")}) with raw tenant IDs. Use TenantScope at app-facing repository boundaries and unwrap it with tenantScopeId(scope) inside ${repositoryFile}; keep provider-correlation lookups separate from authorization.`,
+            });
+            continue;
+        }
+        if (hasTenantScopeBoundary &&
+            !repositoryHasScopedTenantCoverage(repositorySource, referencedTables)) {
+            diagnostics.push({
+                severity: "warning",
+                code: "BEIGNET_TENANT_SCOPE_PREDICATE_MISSING",
+                file: repositoryFile,
+                message: `${repositoryFile} adapts tenant-owned tables (${referencedTables
+                    .map((table) => table.name)
+                    .join(", ")}), but its scoped methods do not consistently derive tenant or workspace IDs from tenantScopeId(scope). Include that derived ID in create values and read, update, and delete predicates.`,
+            });
+        }
+    }
+    return diagnostics;
+}
+const tenantScopeColumnDefinitions = [
+    {
+        property: "tenantId",
+        sqlName: "tenant_id",
+        label: "tenant",
+    },
+    {
+        property: "workspaceId",
+        sqlName: "workspace_id",
+        label: "workspace",
+    },
+];
+async function collectTenantScopedDrizzleTables(targetDir, schemaFiles, sourceCache) {
+    const tables = [];
+    for (const file of schemaFiles) {
+        const source = await readCachedSource(targetDir, file, sourceCache);
+        for (const table of drizzleTablesFromSource(source, file)) {
+            if (table.columns.length > 0)
+                tables.push(table);
+        }
+    }
+    return tables;
+}
+function drizzleTablesFromSource(source, file) {
+    const tables = [];
+    const tablePattern = /\bexport\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:sqliteTable|pgTable|mysqlTable)\s*\(/g;
+    for (const match of source.matchAll(tablePattern)) {
+        const tableName = match[1];
+        const openIndex = source.indexOf("(", match.index ?? 0);
+        if (!tableName || openIndex === -1)
+            continue;
+        const closeIndex = matchingDelimiterIndex(source, openIndex, "(", ")");
+        if (closeIndex === -1)
+            continue;
+        const tableSource = source.slice(openIndex, closeIndex + 1);
+        const columns = tenantScopeColumnsFromSource(tableSource);
+        tables.push({ name: tableName, file, columns });
+    }
+    return tables;
+}
+function tenantScopeColumnsFromSource(source) {
+    return tenantScopeColumnDefinitions.filter((column) => {
+        const propertyPattern = new RegExp(`\\b${column.property}\\s*:`);
+        return (propertyPattern.test(source) ||
+            source.includes(`"${column.sqlName}"`) ||
+            source.includes(`'${column.sqlName}'`));
+    });
+}
+function repositoryFeatureFromPath(repositoryFile, infrastructurePath) {
+    const match = new RegExp(`^${escapeRegExp(infrastructurePath)}/([^/]+)/`).exec(repositoryFile);
+    return match?.[1];
+}
+function isTenantAuthorityFeature(feature) {
+    return feature === "workspaces";
+}
+function repositoryInterfaceBlocks(source) {
+    const blocks = [];
+    const interfacePattern = /\bexport\s+interface\s+[A-Za-z_$][\w$]*Repository\s*\{/g;
+    for (const match of source.matchAll(interfacePattern)) {
+        const openIndex = source.indexOf("{", match.index ?? 0);
+        if (openIndex === -1)
+            continue;
+        const closeIndex = matchingDelimiterIndex(source, openIndex, "{", "}");
+        if (closeIndex === -1)
+            continue;
+        blocks.push(source.slice(openIndex + 1, closeIndex));
+    }
+    return blocks;
+}
+function repositoryInterfaceAcceptsTenantScope(block) {
+    return /\b[A-Za-z_$][\w$]*\s*:\s*TenantScope\b/.test(block);
+}
+function rawTenantRepositoryMethodBoundaries(block, tables) {
+    const rawMethods = [];
+    for (const method of repositoryMethodSignatures(block)) {
+        if (isProviderCorrelationMethod(method.name))
+            continue;
+        const rawColumns = tenantColumnsUsedInSource(method.params, tables).filter((column) => column.property === "tenantId");
+        if (rawColumns.length === 0)
+            continue;
+        rawMethods.push(method.name);
+    }
+    return uniqueStringValues(rawMethods);
+}
+function repositoryMethodSignatures(block) {
+    const signatures = [];
+    const methodPattern = /\b([A-Za-z_$][\w$]*)\s*\(/g;
+    for (const match of block.matchAll(methodPattern)) {
+        const name = match[1];
+        const openIndex = block.indexOf("(", match.index ?? 0);
+        if (!name || openIndex === -1)
+            continue;
+        const closeIndex = matchingDelimiterIndex(block, openIndex, "(", ")");
+        if (closeIndex === -1)
+            continue;
+        const afterParams = block.slice(closeIndex + 1).trimStart();
+        if (!afterParams.startsWith(":"))
+            continue;
+        signatures.push({
+            name,
+            params: block.slice(openIndex + 1, closeIndex),
+        });
+    }
+    return signatures;
+}
+function isProviderCorrelationMethod(name) {
+    return /(?:Customer|Provider|Subscription|Checkout|Event|Delivery|External|Token)[A-Za-z0-9]*(?:Id)?$/i.test(name);
+}
+function tenantColumnsUsedInSource(source, tables) {
+    const columns = new Map();
+    for (const table of tables) {
+        for (const column of table.columns) {
+            const propertyPattern = new RegExp(`\\b${column.property}\\s*:`);
+            if (propertyPattern.test(source)) {
+                columns.set(column.property, column);
+            }
+        }
+    }
+    return [...columns.values()];
+}
+function repositoryHasScopedTenantCoverage(source, tables) {
+    if (!source.includes("tenantScopeId(scope)"))
+        return false;
+    const allFunctions = functionLikeBlocks(source);
+    const scopedFunctions = allFunctions.filter((block) => /\bscope\b/.test(block.params));
+    if (scopedFunctions.length === 0)
+        return false;
+    const functionsByName = new Map(allFunctions.map((block) => [block.name, block]));
+    return scopedFunctions.every((block) => scopedFunctionUsesTenantScope(block, tables, functionsByName));
+}
+function functionLikeBlocks(source) {
+    const blocks = [];
+    const pattern = /(?:\basync\s+)?(?:function\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+    for (const match of source.matchAll(pattern)) {
+        const name = match[1];
+        const openParamsIndex = source.indexOf("(", match.index ?? 0);
+        if (!name || openParamsIndex === -1)
+            continue;
+        const closeParamsIndex = matchingDelimiterIndex(source, openParamsIndex, "(", ")");
+        if (closeParamsIndex === -1)
+            continue;
+        const afterParams = source.slice(closeParamsIndex + 1);
+        const bodyOpenOffset = afterParams.search(/\{/);
+        if (bodyOpenOffset === -1)
+            continue;
+        const betweenParamsAndBody = afterParams.slice(0, bodyOpenOffset);
+        if (!/^\s*(?::[^{;=]+)?\s*(?:=>\s*)?$/.test(betweenParamsAndBody) &&
+            !/^\s*$/.test(betweenParamsAndBody)) {
+            continue;
+        }
+        const openBodyIndex = closeParamsIndex + 1 + bodyOpenOffset;
+        const closeBodyIndex = matchingDelimiterIndex(source, openBodyIndex, "{", "}");
+        if (closeBodyIndex === -1)
+            continue;
+        blocks.push({
+            name,
+            params: source.slice(openParamsIndex + 1, closeParamsIndex),
+            body: source.slice(openBodyIndex + 1, closeBodyIndex),
+        });
+    }
+    return blocks;
+}
+function scopedFunctionUsesTenantScope(block, tables, functionsByName) {
+    if (bodyUsesTenantScopePredicate(block.body, tables))
+        return true;
+    for (const variable of tenantScopeVariables(block.body)) {
+        if (bodyUsesTenantScopePredicate(block.body, tables, variable))
+            return true;
+        for (const callee of functionsCalledWithVariable(block.body, variable)) {
+            const helper = functionsByName.get(callee.name);
+            if (helper &&
+                helperUsesTenantVariable(helper, tables, callee.argumentIndex)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function tenantScopeVariables(body) {
+    const variables = new Set(["tenantScopeId(scope)"]);
+    const assignmentPattern = /\b(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*tenantScopeId\(scope\)/g;
+    for (const match of body.matchAll(assignmentPattern)) {
+        if (match[1])
+            variables.add(match[1]);
+    }
+    return [...variables];
+}
+function bodyUsesTenantScopePredicate(body, tables, variable = "tenantScopeId(scope)") {
+    for (const table of tables) {
+        for (const column of table.columns) {
+            if (body.includes(`eq(schema.${table.name}.${column.property}, ${variable})`)) {
+                return true;
+            }
+            if (body.includes(`${column.property}: ${variable}`)) {
+                return true;
+            }
+            if (variable === column.property &&
+                new RegExp(`\\b${column.property}\\s*(?:,|})`).test(body)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function functionsCalledWithVariable(body, variable) {
+    if (variable.includes("("))
+        return [];
+    const calls = [];
+    const callPattern = /\b([A-Za-z_$][\w$]*)\s*\(/g;
+    for (const match of body.matchAll(callPattern)) {
+        const name = match[1];
+        const openIndex = body.indexOf("(", match.index ?? 0);
+        if (!name || openIndex === -1)
+            continue;
+        const closeIndex = matchingDelimiterIndex(body, openIndex, "(", ")");
+        if (closeIndex === -1)
+            continue;
+        const args = splitTopLevelArguments(body.slice(openIndex + 1, closeIndex));
+        const argumentIndex = args.findIndex((argument) => argument.trim() === variable);
+        if (argumentIndex !== -1) {
+            calls.push({ name, argumentIndex });
+        }
+    }
+    return calls;
+}
+function helperUsesTenantVariable(helper, tables, argumentIndex) {
+    const params = splitTopLevelArguments(helper.params);
+    const parameter = params[argumentIndex]?.trim();
+    if (!parameter)
+        return false;
+    const parameterName = /^([A-Za-z_$][\w$]*)/.exec(parameter)?.[1];
+    return parameterName
+        ? bodyUsesTenantScopePredicate(helper.body, tables, parameterName)
+        : false;
+}
+function splitTopLevelArguments(source) {
+    const args = [];
+    let start = 0;
+    let depth = 0;
+    let inString;
+    let escaped = false;
+    for (let index = 0; index < source.length; index++) {
+        const char = source[index];
+        if (inString) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (char === "\\") {
+                escaped = true;
+            }
+            else if (char === inString) {
+                inString = undefined;
+            }
+            continue;
+        }
+        if (char === '"' || char === "'" || char === "`") {
+            inString = char;
+            continue;
+        }
+        if (char === "(" || char === "{" || char === "[") {
+            depth += 1;
+            continue;
+        }
+        if (char === ")" || char === "}" || char === "]") {
+            depth -= 1;
+            continue;
+        }
+        if (char === "," && depth === 0) {
+            args.push(source.slice(start, index));
+            start = index + 1;
+        }
+    }
+    args.push(source.slice(start));
+    return args;
+}
+function uniqueStringValues(values) {
+    return [...new Set(values)];
+}
 const durableDrizzleTableRequirements = [
     {
         capability: "idempotency",
@@ -2695,15 +3255,18 @@ const durableDrizzleTableRequirements = [
         code: "BEIGNET_OUTBOX_TABLE_MISSING",
         factoryNames: [
             "createDrizzleSqliteOutboxPort",
+            "createDrizzleSqliteOutboxAdminPort",
             "createDrizzlePostgresOutboxPort",
+            "createDrizzlePostgresOutboxAdminPort",
             "createDrizzleMysqlOutboxPort",
+            "createDrizzleMysqlOutboxAdminPort",
         ],
         setupNames: [
             "createDrizzleSqliteOutboxSetupStatements",
             "createDrizzlePostgresOutboxSetupStatements",
             "createDrizzleMysqlOutboxSetupStatements",
         ],
-        explicitFactoryPattern: "createDrizzle[A-Za-z]*Outbox(?:Port)?",
+        explicitFactoryPattern: "createDrizzle[A-Za-z]*Outbox(?:Admin)?(?:Port)?",
         explicitSetupPattern: "createDrizzle[A-Za-z]*OutboxSetupStatements",
     },
     {
@@ -2925,18 +3488,52 @@ async function inspectPackageScripts(targetDir, files, convention) {
         return [];
     }
     const packageJson = JSON.parse(await readFile(path.join(targetDir, "package.json"), "utf8"));
-    if (packageJson.scripts?.test)
-        return [];
-    return [
-        {
+    const diagnostics = [];
+    const scripts = packageJson.scripts ?? {};
+    const hasDirectBunTestImports = await appUsesDirectBunTestImports(targetDir, files);
+    if (!scripts.test) {
+        diagnostics.push({
             severity: "warning",
             code: "BEIGNET_PACKAGE_TEST_SCRIPT_MISSING",
             file: "package.json",
-            message: 'package.json does not define a test script. Add "test": "bun test" or run beignet doctor --fix.',
-        },
-    ];
+            message: 'package.json does not define a test script. Add "test": "tsx lib/beignet-test-runner.ts" or run beignet doctor --fix.',
+        });
+    }
+    const legacyScripts = hasDirectBunTestImports
+        ? []
+        : legacyGeneratedScriptNames(scripts);
+    if (legacyScripts.length > 0) {
+        diagnostics.push({
+            severity: "warning",
+            code: "BEIGNET_PACKAGE_SCRIPT_LEGACY",
+            file: "package.json",
+            message: `package.json still uses legacy generated Bun scripts for ${legacyScripts.join(", ")}. Run beignet doctor --fix to migrate them to package-manager-neutral tsx scripts.`,
+        });
+    }
+    const needsTsx = hasCurrentGeneratedTsxScript(scripts) &&
+        !packageJson.dependencies?.tsx &&
+        !packageJson.devDependencies?.tsx;
+    if (needsTsx) {
+        diagnostics.push({
+            severity: "warning",
+            code: "BEIGNET_PACKAGE_TSX_DEPENDENCY_MISSING",
+            file: "package.json",
+            message: 'package.json uses generated tsx scripts but does not depend on tsx. Add "tsx" to devDependencies or run beignet doctor --fix.',
+        });
+    }
+    const missingSupportFiles = missingTestSupportFiles(files);
+    if (scripts.test === currentGeneratedPackageScripts.test &&
+        missingSupportFiles.length > 0) {
+        diagnostics.push({
+            severity: "warning",
+            code: "BEIGNET_PACKAGE_TEST_SUPPORT_MISSING",
+            file: "package.json",
+            message: `package.json uses the generated test runner, but ${missingSupportFiles.join(", ")} ${missingSupportFiles.length === 1 ? "is" : "are"} missing. Run beignet doctor --fix to restore test support files.`,
+        });
+    }
+    return diagnostics;
 }
-async function fixMissingTestScript(targetDir, files, convention) {
+async function fixPackageScripts(targetDir, files, convention) {
     if (!convention.resourceGenerator || !files.includes("package.json")) {
         return undefined;
     }
@@ -2944,18 +3541,118 @@ async function fixMissingTestScript(targetDir, files, convention) {
     const original = await readFile(filePath, "utf8");
     const packageJson = JSON.parse(original);
     packageJson.scripts = packageJson.scripts ?? {};
-    if (packageJson.scripts.test)
-        return undefined;
-    packageJson.scripts.test = "bun test";
+    const updatedScripts = [];
+    const addedTestScript = !packageJson.scripts.test;
+    const hasDirectBunTestImports = await appUsesDirectBunTestImports(targetDir, files);
+    if (addedTestScript) {
+        packageJson.scripts.test = currentGeneratedPackageScripts.test;
+        updatedScripts.push("test");
+    }
+    if (!hasDirectBunTestImports) {
+        for (const [name, legacyCommand] of Object.entries(legacyGeneratedPackageScripts)) {
+            if (packageJson.scripts[name] === legacyCommand) {
+                packageJson.scripts[name] = currentGeneratedPackageScripts[name];
+                if (!updatedScripts.includes(name))
+                    updatedScripts.push(name);
+            }
+        }
+    }
+    const needsTsx = hasCurrentGeneratedTsxScript(packageJson.scripts);
+    const addedTsx = needsTsx &&
+        !packageJson.dependencies?.tsx &&
+        !packageJson.devDependencies?.tsx;
+    if (addedTsx) {
+        packageJson.devDependencies = packageJson.devDependencies ?? {};
+        packageJson.devDependencies.tsx = externalVersions.tsx;
+    }
     const next = `${JSON.stringify(packageJson, null, "\t")}\n`;
-    if (next === original)
+    const createdSupportFiles = await createMissingTestSupportFiles(targetDir, files, packageJson.scripts.test === currentGeneratedPackageScripts.test);
+    if (next === original && createdSupportFiles.length === 0)
         return undefined;
-    await writeFile(filePath, next);
-    return {
-        code: "BEIGNET_PACKAGE_TEST_SCRIPT_MISSING",
-        file: "package.json",
-        message: 'Added "test": "bun test".',
-    };
+    if (next !== original)
+        await writeFile(filePath, next);
+    if (addedTestScript) {
+        return {
+            code: "BEIGNET_PACKAGE_TEST_SCRIPT_MISSING",
+            file: "package.json",
+            message: createdSupportFiles.length > 0
+                ? `Added "test": "tsx lib/beignet-test-runner.ts" and ${createdSupportFiles.join(", ")}.`
+                : 'Added "test": "tsx lib/beignet-test-runner.ts".',
+        };
+    }
+    if (updatedScripts.length > 0) {
+        return {
+            code: "BEIGNET_PACKAGE_SCRIPT_LEGACY",
+            file: "package.json",
+            message: packageScriptFixMessage(updatedScripts, createdSupportFiles, addedTsx),
+        };
+    }
+    if (createdSupportFiles.length > 0) {
+        return {
+            code: "BEIGNET_PACKAGE_TEST_SUPPORT_MISSING",
+            file: "package.json",
+            message: `Restored ${createdSupportFiles.join(", ")}.`,
+        };
+    }
+    if (addedTsx) {
+        return {
+            code: "BEIGNET_PACKAGE_TSX_DEPENDENCY_MISSING",
+            file: "package.json",
+            message: 'Added "tsx" to devDependencies.',
+        };
+    }
+    return undefined;
+}
+function legacyGeneratedScriptNames(scripts) {
+    return Object.entries(legacyGeneratedPackageScripts)
+        .filter(([name, command]) => scripts[name] === command)
+        .map(([name]) => name);
+}
+async function appUsesDirectBunTestImports(targetDir, files) {
+    for (const file of files) {
+        if (!isTestSourceFile(file))
+            continue;
+        const source = await readFile(path.join(targetDir, file), "utf8");
+        if (/\bfrom\s*["']bun:test["']/.test(source))
+            return true;
+        if (/\bimport\s*\(\s*["']bun:test["']\s*\)/.test(source))
+            return true;
+    }
+    return false;
+}
+function hasCurrentGeneratedTsxScript(scripts) {
+    return Object.values(currentGeneratedPackageScripts).some((command) => command.startsWith("tsx ") && Object.values(scripts).includes(command));
+}
+function missingTestSupportFiles(files) {
+    return testSupportTemplateFiles
+        .map((file) => file.path)
+        .filter((file) => !files.includes(file));
+}
+async function createMissingTestSupportFiles(targetDir, files, shouldCreate) {
+    if (!shouldCreate)
+        return [];
+    const createdSupportFiles = [];
+    for (const file of testSupportTemplateFiles) {
+        if (files.includes(file.path))
+            continue;
+        const destination = path.join(targetDir, file.path);
+        await mkdir(path.dirname(destination), { recursive: true });
+        await writeFile(destination, file.content);
+        createdSupportFiles.push(file.path);
+    }
+    return createdSupportFiles;
+}
+function packageScriptFixMessage(updatedScripts, createdSupportFiles, addedTsx) {
+    const parts = [
+        `Updated generated package scripts: ${updatedScripts.join(", ")}.`,
+    ];
+    if (createdSupportFiles.length > 0) {
+        parts.push(`Restored ${createdSupportFiles.join(", ")}.`);
+    }
+    if (addedTsx) {
+        parts.push('Added "tsx" to devDependencies.');
+    }
+    return parts.join(" ");
 }
 function unmatchedRouteDiagnostic(routeHandler) {
     if (routeHandler.source === "next-route") {
@@ -3394,14 +4091,15 @@ async function fixUnregisteredTasks(targetDir, files, drift, config) {
     });
 }
 /**
- * Wire fully unregistered feature listener registries into the providers
- * file with the same `<registry>Provider` block `beignet make listener`
- * generates, so both write paths stay byte-compatible.
+ * Wire fully unregistered feature listener registries into the central
+ * listener registry and ensure the providers file registers that central
+ * registry with the same block `beignet make listener` generates, so both
+ * write paths stay byte-compatible.
  *
- * Bails without writing when the providers file or its exported array is
- * missing or customized, when the app has no eventBus port to register
- * against, or when the registry name is already imported from another file.
- * The diagnostic stays in every bail case.
+ * Bails without writing when the providers file or central listener registry
+ * is customized beyond the known anchors, when the app has no eventBus port to
+ * register against, or when the registry name is already imported from another
+ * file. The diagnostic stays in every bail case.
  */
 async function fixUnregisteredListeners(targetDir, files, drift, config) {
     const candidates = drift.listeners.unregistered.filter((entry) => entry.fullyUnregistered);
@@ -3424,41 +4122,72 @@ async function fixUnregisteredListeners(targetDir, files, drift, config) {
     if (!/\beventBus\s*[:?]/.test(portsSource))
         return undefined;
     const providersPath = path.join(targetDir, providersFile);
-    const original = await readFile(providersPath, "utf8");
-    let next = original;
-    const registeredNames = [];
+    const originalProviders = await readFile(providersPath, "utf8");
+    const listenersFile = listenersFilePath(config);
+    const listenersPath = path.join(targetDir, listenersFile);
+    const originalListeners = files.includes(listenersFile)
+        ? await readFile(listenersPath, "utf8")
+        : undefined;
+    let nextListeners = originalListeners;
+    const candidateNames = [];
     for (const { registry } of candidates) {
-        const imported = parseNamedImportSources(next).get(registry.registryName);
+        candidateNames.push(registry.registryName);
+        const imported = nextListeners === undefined
+            ? undefined
+            : parseNamedImportSources(nextListeners).get(registry.registryName);
         if (imported) {
-            const importedFile = sourceFileFromImport(imported.sourcePath, providersFile, files);
+            const importedFile = sourceFileFromImport(imported.sourcePath, listenersFile, files);
             if (importedFile !== registry.indexFile)
                 return undefined;
         }
-        const result = wireListenersProviderSource(next, {
-            registryName: registry.registryName,
-            featureKebab: listenerFeatureKebab(registry.indexFile),
-            listenerModule: `@/${modulePath(registry.indexFile)}`,
-            config,
-        });
+        const listenerModule = `@/${modulePath(registry.indexFile)}`;
+        const result = nextListeners === undefined
+            ? {
+                kind: "updated",
+                source: createListenersRegistrySource({
+                    registryName: registry.registryName,
+                    listenerModule,
+                }),
+            }
+            : updateListenersRegistrySource(nextListeners, {
+                registryName: registry.registryName,
+                listenerModule,
+            });
         if (result.kind === "missing")
             return undefined;
         if (result.kind === "updated") {
-            next = result.source;
-            registeredNames.push(registry.registryName);
+            nextListeners = result.source;
         }
     }
-    if (next === original || registeredNames.length === 0)
+    if (nextListeners === undefined || candidateNames.length === 0) {
         return undefined;
-    await writeFile(providersPath, next);
+    }
+    const providerResult = wireListenersProviderSource(originalProviders, {
+        registryName: candidateNames[0] ?? "listeners",
+        featureKebab: "app",
+        listenerModule: `@/${modulePath(listenersFile)}`,
+        config,
+    });
+    if (providerResult.kind === "missing")
+        return undefined;
+    const nextProviders = providerResult.kind === "updated"
+        ? providerResult.source
+        : originalProviders;
+    if (nextListeners === originalListeners &&
+        nextProviders === originalProviders) {
+        return undefined;
+    }
+    await mkdir(path.dirname(listenersPath), { recursive: true });
+    await writeFile(listenersPath, nextListeners);
+    if (nextProviders !== originalProviders) {
+        await writeFile(providersPath, nextProviders);
+    }
     return {
         code: "BEIGNET_LISTENER_UNREGISTERED",
-        file: providersFile,
-        message: `Registered ${registeredNames.join(", ")} with registerListeners(...) in ${providersFile}.`,
+        file: listenersFile,
+        message: `Registered ${candidateNames.join(", ")} in ${listenersFile} and wired listeners with registerListeners(...) in ${providersFile}.`,
     };
 }
-function listenerFeatureKebab(indexFile) {
-    return path.posix.basename(path.posix.dirname(path.posix.dirname(normalizePath(indexFile))));
-}
 async function fixUnregisteredOutboxEntries(targetDir, files, drift, config) {
     if (!drift.outbox.exists)
         return [];
@@ -3869,7 +4598,9 @@ async function inspectResourceSlices(targetDir, files, config, convention, stric
             sourceIncludesAny(portSource, [
                 `update(input: Update${singularPascal}Input)`,
                 `update(input: Update${singularPascal}RepositoryInput)`,
+                `update(input: Update${singularPascal}Input, scope: TenantScope)`,
                 "delete(id: string): Promise<boolean>",
+                "delete(id: string, scope: TenantScope): Promise<boolean>",
             ]);
         if (!hasCrudSignals)
             continue;
@@ -3904,6 +4635,7 @@ async function inspectResourceSlices(targetDir, files, config, convention, stric
                 alternatives: [
                     `findById(id: string): Promise<${singularPascal} | null>`,
                     `findById(id: string, filter: ${singularPascal}TenantFilter): Promise<${singularPascal} | null>`,
+                    `findById(id: string, scope: TenantScope): Promise<${singularPascal} | null>`,
                 ],
             },
             {
@@ -3911,6 +4643,7 @@ async function inspectResourceSlices(targetDir, files, config, convention, stric
                 alternatives: [
                     `update(input: Update${singularPascal}Input)`,
                     `update(input: Update${singularPascal}RepositoryInput)`,
+                    `update(input: Update${singularPascal}Input, scope: TenantScope)`,
                 ],
             },
             {
@@ -3918,6 +4651,7 @@ async function inspectResourceSlices(targetDir, files, config, convention, stric
                 alternatives: [
                     "delete(id: string): Promise<boolean>",
                     `delete(id: string, filter: ${singularPascal}TenantFilter): Promise<boolean>`,
+                    "delete(id: string, scope: TenantScope): Promise<boolean>",
                 ],
             },
         ];
@@ -4032,6 +4766,15 @@ async function readSourceIfPresent(targetDir, files, file) {
 function sourceIncludesAny(source, snippets) {
     return source ? snippets.some((snippet) => source.includes(snippet)) : false;
 }
+function countSourceOccurrences(source, snippet) {
+    let count = 0;
+    let index = source.indexOf(snippet);
+    while (index !== -1) {
+        count += 1;
+        index = source.indexOf(snippet, index + snippet.length);
+    }
+    return count;
+}
 function sourceIncludesAll(source, snippets) {
     return snippets.every((snippet) => source.includes(snippet));
 }