@beignet/cli 0.0.32 → 0.0.33

package/dist/make.js

@@ -2,8 +2,9 @@ import { randomBytes } from "node:crypto";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { clientIndexPath, loadBeignetConfig, resolveConfig, } from "./config.js";
-import { adapterFilePath, addNamedImport, addNamedTypeImport, aliasModule, appendDeferredPortKey, appendPickStringLiteralMember, applyPortProviderWiring, assertAdapterApp, assertFeatureArtifactApp, assertFeatureUiApp, assertGeneratedIdentifiers, assertPersistenceArtifactApp, assertPolicyApp, assertPortApp, assertServerRuntimeApp, assertStandardApp, assertTestApp, assertUseCaseApp, beignetDependencyVersion, constantCase, defineUploadsInitializerInfo, detectResourceDatabase, detectResourcePersistence, drizzleDialects, drizzleRepositoriesPath, drizzleResourceRepositoryFilePath, drizzleSchemaIndexPath, eventBusPortWiring, eventFilePath, factoryFilePath, featureArtifactDir, featureArtifactIndexFile, featureArtifactNames, featureResourceNames, featureUiClientQueriesFilePath, featureUiComponentFilePath, featureUiIndexFilePath, featureUiNames, fileExists, hasTopLevelObjectProperty, identifierNames, infrastructureDir, insertTypeProperty, jobFilePath, listenerFilePath, mergeMakeResultInto, mergeMakeResults, missingCapabilityBuilderFiles, notificationFilePath, notificationPortWirings, planGeneratedFile, planGeneratedFiles, portFilePath, portNames, providersFilePath, readOptionalFile, relativeModule, resourceContractFilePath, resourceFeatureDir, resourceNames, resourcePortFilePath, resourceSharedErrorsPath, scheduleFilePath, seedEntrypointPath, seedFilePath, seedNames, singularize, storagePortWiring, tanstackReactQueryDependencyVersion, taskFilePath, typeBodySource, uniqueStrings, updateDrizzleRepositories, updateDrizzleSchemaIndex, updateFeatureArtifactIndex, updateInfrastructureAdapterWiring, updateInfrastructureDeferredPorts, updateInfrastructureGatePolicies, updateInfrastructurePortStub, updateInfrastructurePorts, updateOpenApiRoute, updatePackageDependencies, updatePackageJson, updatePackageScripts, updatePortIndex, updatePortsIndex, updateSeedEntrypoint, updateServerRoutes, updateServerTransactionPorts, updateSharedErrors, uploadFilePath, useCaseFeatureDir, useCaseFilePath, usesFeatureOwnedPolicies, usesFeatureOwnedTests, wireListenersProviderSource, wirePortProviders, writeGeneratedFile, writePlannedGeneratedFile, } from "./make/shared.js";
+import { adapterFilePath, addNamedImport, addNamedTypeImport, aliasModule, appendDeferredPortKey, appendPickStringLiteralMember, applyPortProviderWiring, assertAdapterApp, assertFeatureArtifactApp, assertFeatureUiApp, assertGeneratedIdentifiers, assertPersistenceArtifactApp, assertPolicyApp, assertPortApp, assertServerRuntimeApp, assertStandardApp, assertTestApp, assertUseCaseApp, beignetDependencyVersion, constantCase, createListenersRegistrySource, defineUploadsInitializerInfo, detectResourceDatabase, detectResourcePersistence, drizzleDialects, drizzleRepositoriesPath, drizzleResourceRepositoryFilePath, drizzleSchemaIndexPath, eventBusPortWiring, eventFilePath, factoryFilePath, featureArtifactDir, featureArtifactIndexFile, featureArtifactNames, featureResourceNames, featureUiClientQueriesFilePath, featureUiComponentFilePath, featureUiIndexFilePath, featureUiNames, fileExists, hasTopLevelObjectProperty, identifierNames, infrastructureDir, insertTypeProperty, jobFilePath, listenerFilePath, listenersFilePath, mergeMakeResultInto, mergeMakeResults, missingCapabilityBuilderFiles, notificationFilePath, notificationPortWirings, planGeneratedFile, planGeneratedFiles, portFilePath, portNames, providersFilePath, readOptionalFile, relativeModule, resourceContractFilePath, resourceFeatureDir, resourceNames, resourcePortFilePath, resourceSharedErrorsPath, scheduleFilePath, seedEntrypointPath, seedFilePath, seedNames, singularize, storagePortWiring, tanstackReactQueryDependencyVersion, taskFilePath, typeBodySource, uniqueStrings, updateDrizzleRepositories, updateDrizzleSchemaIndex, updateFeatureArtifactIndex, updateInfrastructureAdapterWiring, updateInfrastructureDeferredPorts, updateInfrastructureGatePolicies, updateInfrastructurePortStub, updateInfrastructurePorts, updateListenersRegistrySource, updateOpenApiRoute, updatePackageDependencies, updatePackageJson, updatePackageScripts, updatePortIndex, updatePortsIndex, updateSeedEntrypoint, updateServerRoutes, updateServerTransactionPorts, updateSharedErrors, uploadFilePath, useCaseFeatureDir, useCaseFilePath, usesFeatureOwnedPolicies, usesFeatureOwnedTests, wireListenersProviderSource, wirePortProviders, writeGeneratedFile, writePlannedGeneratedFile, } from "./make/shared.js";
 import { appendToArrayExpression, appendToOutboxRegistryArray, arrayInitializerInfo, identifiersFromArrayExpression, insertAfterImports, } from "./registry-edits.js";
+import { testSupportTemplateFiles } from "./templates/testing.js";
 export { makeFeatureAddonChoices, makeFeatureRecipeChoices, } from "./choices.js";
 export * from "./make/inbox.js";
 export * from "./make/payments.js";
@@ -689,7 +690,7 @@ export async function makeSeed(options) {
     if (!result.files.includes(seedEntrypointPath(config))) {
         result.files.push(seedEntrypointPath(config));
     }
-    if (await updatePackageScripts(targetDir, { "db:seed": `bun ${seedEntrypointPath(config)}` }, { dryRun: Boolean(options.dryRun) })) {
+    if (await updatePackageScripts(targetDir, { "db:seed": `tsx ${seedEntrypointPath(config)}` }, { dryRun: Boolean(options.dryRun) })) {
         result.updatedFiles.push("package.json");
         if (!result.files.includes("package.json"))
             result.files.push("package.json");
@@ -742,6 +743,9 @@ export async function makeListener(options) {
     if (!options.skipEventAssert) {
         await assertListenerEventExists(targetDir, names.event, config);
     }
+    await updateListenerRegistry(targetDir, names, config, {
+        dryRun: true,
+    });
     await updateListenerProviderWiring(targetDir, names, config, {
         dryRun: true,
     });
@@ -760,6 +764,18 @@ export async function makeListener(options) {
             "@beignet/core": beignetDependencyVersion,
         },
     });
+    const registryResult = await updateListenerRegistry(targetDir, names, config, {
+        dryRun: Boolean(options.dryRun),
+    });
+    if (registryResult === "created")
+        result.createdFiles.push(listenersFilePath(config));
+    if (registryResult === "updated")
+        result.updatedFiles.push(listenersFilePath(config));
+    if (registryResult === "skipped")
+        result.skippedFiles.push(listenersFilePath(config));
+    if (!result.files.includes(listenersFilePath(config))) {
+        result.files.push(listenersFilePath(config));
+    }
     const providerResult = await updateListenerProviderWiring(targetDir, names, config, {
         dryRun: Boolean(options.dryRun),
     });
@@ -774,6 +790,36 @@ export async function makeListener(options) {
     }
     return result;
 }
+async function updateListenerRegistry(targetDir, names, config, options) {
+    const file = listenersFilePath(config);
+    const filePath = path.join(targetDir, file);
+    const listenerIndex = featureArtifactIndexFile("listener", names, config);
+    const original = await readOptionalFile(filePath);
+    if (original === undefined) {
+        if (!options.dryRun) {
+            await writeGeneratedFile(targetDir, {
+                path: file,
+                content: createListenersRegistrySource({
+                    registryName: listenerIndex.registryName,
+                    listenerModule: aliasModule(listenerIndex.path),
+                }),
+            }, { force: false, dryRun: false });
+        }
+        return "created";
+    }
+    const result = updateListenersRegistrySource(original, {
+        registryName: listenerIndex.registryName,
+        listenerModule: aliasModule(listenerIndex.path),
+    });
+    if (result.kind === "missing") {
+        throw new Error(`Could not find the exported listeners array in ${file}. Register ${listenerIndex.registryName} manually, or restore the generated listeners file before running make listener.`);
+    }
+    if (result.kind === "unchanged")
+        return "skipped";
+    if (!options.dryRun)
+        await writeFile(filePath, result.source);
+    return "updated";
+}
 async function assertListenerEventExists(targetDir, names, config) {
     const file = eventFilePath(names, config);
     try {
@@ -1012,9 +1058,13 @@ async function updateOutboxPorts(targetDir, config, options) {
     const filePath = path.join(targetDir, config.paths.ports);
     const original = await readFile(filePath, "utf8");
     let next = addNamedTypeImport(original, "OutboxPort", "@beignet/core/outbox");
+    next = addNamedTypeImport(next, "OutboxAdminPort", "@beignet/core/outbox");
     if (!typeHasTopLevelProperty(next, "AppPorts", "outbox")) {
         next = insertTypeProperty(next, "AppPorts", "outbox: OutboxPort;", `Could not find AppPorts in ${config.paths.ports}. Add outbox: OutboxPort; manually, or restore the generated ports file before running make outbox.`);
     }
+    if (!typeHasTopLevelProperty(next, "AppPorts", "outboxAdmin")) {
+        next = insertTypeProperty(next, "AppPorts", "outboxAdmin: OutboxAdminPort;", `Could not find AppPorts in ${config.paths.ports}. Add outboxAdmin: OutboxAdminPort; manually, or restore the generated ports file before running make outbox.`);
+    }
     if (!typeHasTopLevelProperty(next, "AppTransactionPorts", "outbox")) {
         next = insertTypeProperty(next, "AppTransactionPorts", "outbox: OutboxPort;", `Could not find AppTransactionPorts in ${config.paths.ports}. Add outbox: OutboxPort; manually, or restore the generated ports file before running make outbox.`);
     }
@@ -1027,7 +1077,8 @@ async function updateOutboxPorts(targetDir, config, options) {
 async function updateOutboxInfrastructurePorts(targetDir, config, options) {
     const filePath = path.join(targetDir, config.paths.infrastructurePorts);
     const original = await readFile(filePath, "utf8");
-    const next = appendDeferredPortKey(original, "outbox");
+    let next = appendDeferredPortKey(original, "outbox");
+    next = appendDeferredPortKey(next, "outboxAdmin");
     if (next === original)
         return false;
     if (!options.dryRun)
@@ -1041,9 +1092,12 @@ async function updateOutboxDatabaseProvider(targetDir, config, options) {
         return false;
     const database = await detectResourceDatabase(targetDir, config);
     const factoryName = drizzleOutboxPortFactoryName(database);
+    const adminFactoryName = drizzleOutboxAdminPortFactoryName(database);
     const original = await readFile(filePath, "utf8");
     let next = addNamedImport(original, factoryName, `@beignet/provider-db-drizzle/${database}`);
+    next = addNamedImport(next, adminFactoryName, `@beignet/provider-db-drizzle/${database}`);
     next = appendPickStringLiteralMember(next, "AppPorts", "outbox");
+    next = appendPickStringLiteralMember(next, "AppPorts", "outboxAdmin");
     if (!/\bconst\s+outbox\s*=/.test(next)) {
         const beforeOutboxConst = next;
         next = beforeOutboxConst.replace(/(\n\s*const idempotency = createDrizzle[A-Za-z]+IdempotencyPort\((dbPort\.(?:drizzle|db))\);)/, `$1\n\t\tconst outbox = ${factoryName}($2);`);
@@ -1051,6 +1105,13 @@ async function updateOutboxDatabaseProvider(targetDir, config, options) {
             throw new Error(`Could not find the idempotency port in ${file}. Add const outbox = ${factoryName}(dbPort.drizzle) manually, or restore the generated database provider before running make outbox.`);
         }
     }
+    if (!/\bconst\s+outboxAdmin\s*=/.test(next)) {
+        const beforeOutboxAdminConst = next;
+        next = beforeOutboxAdminConst.replace(new RegExp(`(\\n\\s*const outbox = ${factoryName}\\((dbPort\\.(?:drizzle|db))\\);)`), `$1\n\t\tconst outboxAdmin = ${adminFactoryName}($2);`);
+        if (next === beforeOutboxAdminConst) {
+            throw new Error(`Could not find the outbox port in ${file}. Add const outboxAdmin = ${adminFactoryName}(dbPort.drizzle) manually, or restore the generated database provider before running make outbox.`);
+        }
+    }
     if (!/\boutbox\s*,/.test(next)) {
         const withOutboxPort = next.replace(/(\n\s*idempotency,\n)/, `$1\t\t\toutbox,\n`);
         if (withOutboxPort === next) {
@@ -1058,6 +1119,13 @@ async function updateOutboxDatabaseProvider(targetDir, config, options) {
         }
         next = withOutboxPort;
     }
+    if (!/\boutboxAdmin\s*,/.test(next)) {
+        const withOutboxAdminPort = next.replace(/(\n\s*outbox,\n)/, `$1\t\t\toutboxAdmin,\n`);
+        if (withOutboxAdminPort === next) {
+            throw new Error(`Could not find outbox in providedPorts in ${file}. Add outboxAdmin to providedPorts manually, or restore the generated database provider before running make outbox.`);
+        }
+        next = withOutboxAdminPort;
+    }
     if (!new RegExp(`outbox:\\s*${factoryName}\\(tx\\)`).test(next)) {
         const withTransactionOutbox = next.replace(/(\n\s*idempotency: createDrizzle[A-Za-z]+IdempotencyPort\(tx\),\n)/, `$1\t\t\t\t\toutbox: ${factoryName}(tx),\n`);
         if (withTransactionOutbox === next) {
@@ -1127,6 +1195,13 @@ function drizzleOutboxPortFactoryName(database) {
         return "createDrizzleMysqlOutboxPort";
     return "createDrizzleSqliteOutboxPort";
 }
+function drizzleOutboxAdminPortFactoryName(database) {
+    if (database === "postgres")
+        return "createDrizzlePostgresOutboxAdminPort";
+    if (database === "mysql")
+        return "createDrizzleMysqlOutboxAdminPort";
+    return "createDrizzleSqliteOutboxAdminPort";
+}
 async function applyOutboxDrainWiring(result, targetDir, plan, options) {
     if (!plan)
         return;
@@ -1584,6 +1659,7 @@ function resourceFiles(names, config, persistence = "memory", mode = "feature",
     const infraDir = infrastructureDir(config);
     const featureDir = resourceFeatureDir(names, config);
     const files = [
+        ...testSupportTemplateFiles,
         {
             path: resourceContractFilePath(names, config),
             content: contractFile(names, config, mode, options),
@@ -1709,6 +1785,7 @@ function useCaseFiles(names, config) {
 }
 function testFiles(names, config) {
     return [
+        ...testSupportTemplateFiles,
         {
             path: useCaseTestFilePath(names, config),
             content: useCaseTestFile(names, config),
@@ -2261,7 +2338,7 @@ function listUseCaseFile(names, config, options) {
     const filePath = path.join(resourceUseCaseDir(names, config), `list-${names.pluralKebab}.ts`);
     return `import "@beignet/core/server-only";
 import { normalizeCursorPage } from "@beignet/core/pagination";
-import { useCase } from "${relativeModule(filePath, config.paths.useCaseBuilder)}";
+${options.tenant ? `import { requireTenantScope } from "@beignet/core/tenancy";\n` : ""}import { useCase } from "${relativeModule(filePath, config.paths.useCaseBuilder)}";
 import {
 	decode${names.singularPascal}Cursor,
 	List${names.pluralPascal}InputSchema,
@@ -2273,7 +2350,7 @@ export const list${names.pluralPascal}UseCase = useCase
 	.input(List${names.pluralPascal}InputSchema)
 	.output(List${names.pluralPascal}OutputSchema)
 	.run(async ({ ctx, input }) => {
-${options.tenant ? `\t\tconst tenantId = ctx.tenant?.id;\n\t\tif (!tenantId) {\n\t\t\tthrow new Error("Tenant is required to list ${names.pluralKebab}.");\n\t\t}\n\n` : ""}		const page = normalizeCursorPage(input, {
+${options.tenant ? `\t\tconst scope = requireTenantScope(ctx);\n\n` : ""}		const page = normalizeCursorPage(input, {
 			defaultLimit: 20,
 			maxLimit: 100,
 		});
@@ -2284,14 +2361,14 @@ ${options.tenant ? `\t\tconst tenantId = ctx.tenant?.id;\n\t\tif (!tenantId) {\n
 			name: input.name,
 			sortBy: input.sortBy,
 			sortDirection: input.sortDirection,
-${options.tenant ? `\t\t\ttenantId,\n` : ""}		});
+		}${options.tenant ? ", scope" : ""});
 	});
 `;
 }
 function createUseCaseFile(names, config, options) {
     const filePath = path.join(resourceUseCaseDir(names, config), `create-${names.singularKebab}.ts`);
     return `import "@beignet/core/server-only";
-import { useCase } from "${relativeModule(filePath, config.paths.useCaseBuilder)}";
+${options.tenant ? `import { requireTenantScope } from "@beignet/core/tenancy";\n` : ""}import { useCase } from "${relativeModule(filePath, config.paths.useCaseBuilder)}";
 import {
 	Create${names.singularPascal}InputSchema,
 	${names.singularPascal}Schema,
@@ -2303,9 +2380,7 @@ export const create${names.singularPascal}UseCase = useCase
 	.input(Create${names.singularPascal}InputSchema)
 	.output(${names.singularPascal}Schema)
 	.run(async ({ ctx, input }) => {
-${options.tenant ? `\t\tconst tenantId = ctx.tenant?.id;\n\t\tif (!tenantId) {\n\t\t\tthrow new Error("Tenant is required to create ${names.singularKebab}.");\n\t\t}\n\n` : ""}${options.auth ? `\t\tawait ctx.gate.authorize("${names.pluralCamel}.create");\n\n` : ""}		const ${names.singularCamel} = await ctx.ports.${names.pluralCamel}.create({
-			...input,
-${options.tenant ? `\t\t\ttenantId,\n` : ""}		});
+${options.tenant ? `\t\tconst scope = requireTenantScope(ctx);\n\n` : ""}${options.auth ? `\t\tawait ctx.gate.authorize("${names.pluralCamel}.create");\n\n` : ""}		const ${names.singularCamel} = await ctx.ports.${names.pluralCamel}.create(input${options.tenant ? ", scope" : ""});
 ${options.events ? `\n\t\tawait ctx.ports.eventBus.publish(${names.singularPascal}Created, {\n\t\t\tid: ${names.singularCamel}.id,\n\t\t});\n` : ""}
 		return ${names.singularCamel};
 	});
@@ -2314,7 +2389,7 @@ ${options.events ? `\n\t\tawait ctx.ports.eventBus.publish(${names.singularPasca
 function getUseCaseFile(names, config, options) {
     const filePath = path.join(resourceUseCaseDir(names, config), `get-${names.singularKebab}.ts`);
     return `import "@beignet/core/server-only";
-import { appError } from "${relativeModule(filePath, resourceSharedErrorsPath(config))}";
+${options.tenant ? `import { requireTenantScope } from "@beignet/core/tenancy";\n` : ""}import { appError } from "${relativeModule(filePath, resourceSharedErrorsPath(config))}";
 import { useCase } from "${relativeModule(filePath, config.paths.useCaseBuilder)}";
 import {
 	${names.singularPascal}IdInputSchema,
@@ -2326,7 +2401,7 @@ export const get${names.singularPascal}UseCase = useCase
 	.input(${names.singularPascal}IdInputSchema)
 	.output(${names.singularPascal}Schema)
 	.run(async ({ ctx, input }) => {
-${options.tenant ? `\t\tconst tenantId = ctx.tenant?.id;\n\t\tif (!tenantId) {\n\t\t\tthrow new Error("Tenant is required to get ${names.singularKebab}.");\n\t\t}\n\n` : ""}		const ${names.singularCamel} = await ctx.ports.${names.pluralCamel}.findById(input.id${options.tenant ? ", { tenantId }" : ""});
+${options.tenant ? `\t\tconst scope = requireTenantScope(ctx);\n\n` : ""}		const ${names.singularCamel} = await ctx.ports.${names.pluralCamel}.findById(input.id${options.tenant ? ", scope" : ""});
 		if (!${names.singularCamel}) {
 			throw appError("${names.singularPascal}NotFound", {
 				details: { id: input.id },
@@ -2340,7 +2415,7 @@ ${options.tenant ? `\t\tconst tenantId = ctx.tenant?.id;\n\t\tif (!tenantId) {\n
 function updateUseCaseFile(names, config, options) {
     const filePath = path.join(resourceUseCaseDir(names, config), `update-${names.singularKebab}.ts`);
     return `import "@beignet/core/server-only";
-import { appError } from "${relativeModule(filePath, resourceSharedErrorsPath(config))}";
+${options.tenant ? `import { requireTenantScope } from "@beignet/core/tenancy";\n` : ""}import { appError } from "${relativeModule(filePath, resourceSharedErrorsPath(config))}";
 import { useCase } from "${relativeModule(filePath, config.paths.useCaseBuilder)}";
 ${options.events ? `import { ${names.singularPascal}Updated } from "../domain/events";\n` : ""}import {
 	Update${names.singularPascal}InputSchema,
@@ -2352,7 +2427,7 @@ export const update${names.singularPascal}UseCase = useCase
 	.input(Update${names.singularPascal}InputSchema)
 	.output(${names.singularPascal}Schema)
 	.run(async ({ ctx, input }) => {
-${options.tenant ? `\t\tconst tenantId = ctx.tenant?.id;\n\t\tif (!tenantId) {\n\t\t\tthrow new Error("Tenant is required to update ${names.singularKebab}.");\n\t\t}\n\n` : ""}		const existing = await ctx.ports.${names.pluralCamel}.findById(input.id${options.tenant ? ", { tenantId }" : ""});
+${options.tenant ? `\t\tconst scope = requireTenantScope(ctx);\n\n` : ""}		const existing = await ctx.ports.${names.pluralCamel}.findById(input.id${options.tenant ? ", scope" : ""});
 		if (!existing) {
 			throw appError("${names.singularPascal}NotFound", {
 				details: { id: input.id },
@@ -2366,7 +2441,7 @@ ${options.auth ? `\t\tawait ctx.gate.authorize("${names.pluralCamel}.update", ex
 
 		const ${names.singularCamel} = await ctx.ports.${names.pluralCamel}.update({
 			...input,
-${options.tenant ? `\t\t\ttenantId,\n` : ""}		});
+		}${options.tenant ? ", scope" : ""});
 		if (!${names.singularCamel}) {
 			throw appError("${names.singularPascal}Conflict", {
 				details: { id: input.id, expectedVersion: existing.version },
@@ -2381,7 +2456,7 @@ function deleteUseCaseFile(names, config, options) {
     const filePath = path.join(resourceUseCaseDir(names, config), `delete-${names.singularKebab}.ts`);
     return `import "@beignet/core/server-only";
 import { z } from "zod";
-import { appError } from "${relativeModule(filePath, resourceSharedErrorsPath(config))}";
+${options.tenant ? `import { requireTenantScope } from "@beignet/core/tenancy";\n` : ""}import { appError } from "${relativeModule(filePath, resourceSharedErrorsPath(config))}";
 import { useCase } from "${relativeModule(filePath, config.paths.useCaseBuilder)}";
 ${options.events ? `import { ${names.singularPascal}Deleted } from "../domain/events";\n` : ""}import { ${names.singularPascal}IdInputSchema } from "../schemas";
 
@@ -2390,7 +2465,7 @@ export const delete${names.singularPascal}UseCase = useCase
 	.input(${names.singularPascal}IdInputSchema)
 	.output(z.void())
 	.run(async ({ ctx, input }) => {
-${options.tenant ? `\t\tconst tenantId = ctx.tenant?.id;\n\t\tif (!tenantId) {\n\t\t\tthrow new Error("Tenant is required to delete ${names.singularKebab}.");\n\t\t}\n\n` : ""}${options.auth ? `\t\tconst existing = await ctx.ports.${names.pluralCamel}.findById(input.id${options.tenant ? ", { tenantId }" : ""});\n\t\tif (!existing) {\n\t\t\tthrow appError("${names.singularPascal}NotFound", {\n\t\t\t\tdetails: { id: input.id },\n\t\t\t});\n\t\t}\n\t\tawait ctx.gate.authorize("${names.pluralCamel}.delete", existing);\n\n` : ""}		const deleted = await ctx.ports.${names.pluralCamel}.delete(input.id${options.tenant ? ", { tenantId }" : ""});
+${options.tenant ? `\t\tconst scope = requireTenantScope(ctx);\n\n` : ""}${options.auth ? `\t\tconst existing = await ctx.ports.${names.pluralCamel}.findById(input.id${options.tenant ? ", scope" : ""});\n\t\tif (!existing) {\n\t\t\tthrow appError("${names.singularPascal}NotFound", {\n\t\t\t\tdetails: { id: input.id },\n\t\t\t});\n\t\t}\n\t\tawait ctx.gate.authorize("${names.pluralCamel}.delete", existing);\n\n` : ""}		const deleted = await ctx.ports.${names.pluralCamel}.delete(input.id${options.tenant ? ", scope" : ""});
 		if (!deleted) {
 			throw appError("${names.singularPascal}NotFound", {
 				details: { id: input.id },
@@ -2420,7 +2495,7 @@ function repositoryPortFile(names, config, mode, options) {
 	PageResult,
 	SortDirection,
 } from "@beignet/core/pagination";
-import type {
+${options.tenant ? `import type { TenantScope } from "@beignet/core/tenancy";\n` : ""}import type {
 	Create${names.singularPascal}Input,
 	${names.singularPascal}Cursor,
 	${names.singularPascal}SortBy,
@@ -2434,13 +2509,12 @@ export type List${names.pluralPascal}Query = {
 	name?: string;
 	sortBy: ${names.singularPascal}SortBy;
 	sortDirection: SortDirection;
-${options.tenant ? `\ttenantId: string;\n` : ""}};
-${options.tenant ? `export type ${names.singularPascal}TenantFilter = { tenantId: string };\nexport type Create${names.singularPascal}RepositoryInput = Create${names.singularPascal}Input & ${names.singularPascal}TenantFilter;\n${mode === "resource" ? `export type Update${names.singularPascal}RepositoryInput = Update${names.singularPascal}Input & ${names.singularPascal}TenantFilter;\n` : ""}` : ""}
+};
 
 export interface ${names.singularPascal}Repository {
-	list(query: List${names.pluralPascal}Query): Promise<List${names.pluralPascal}Result>;
-	create(input: ${options.tenant ? `Create${names.singularPascal}RepositoryInput` : `Create${names.singularPascal}Input`}): Promise<${names.singularPascal}>;
-${mode === "resource" ? `	findById(id: string${options.tenant ? `, filter: ${names.singularPascal}TenantFilter` : ""}): Promise<${names.singularPascal} | null>;\n	update(input: ${options.tenant ? `Update${names.singularPascal}RepositoryInput` : `Update${names.singularPascal}Input`}): Promise<${names.singularPascal} | null>;\n	delete(id: string${options.tenant ? `, filter: ${names.singularPascal}TenantFilter` : ""}): Promise<boolean>;\n` : ""}}
+	list(query: List${names.pluralPascal}Query${options.tenant ? ", scope: TenantScope" : ""}): Promise<List${names.pluralPascal}Result>;
+	create(input: Create${names.singularPascal}Input${options.tenant ? ", scope: TenantScope" : ""}): Promise<${names.singularPascal}>;
+${mode === "resource" ? `	findById(id: string${options.tenant ? ", scope: TenantScope" : ""}): Promise<${names.singularPascal} | null>;\n	update(input: Update${names.singularPascal}Input${options.tenant ? ", scope: TenantScope" : ""}): Promise<${names.singularPascal} | null>;\n	delete(id: string${options.tenant ? ", scope: TenantScope" : ""}): Promise<boolean>;\n` : ""}}
 `;
 }
 function inMemoryRepositoryFile(names, config, mode, options) {
@@ -2468,13 +2542,13 @@ function inMemoryRepositoryFile(names, config, mode, options) {
         ? " || existing.deletedAt !== null"
         : "";
     const deleteImplementation = options.softDelete
-        ? `${options.tenant ? `\t\t\tconst existing = ${names.pluralCamel}.get(id);\n\t\t\tif (!existing || existing.tenantId !== filter.tenantId || existing.deletedAt !== null) return false;\n` : `\t\t\tconst existing = ${names.pluralCamel}.get(id);\n\t\t\tif (!existing || existing.deletedAt !== null) return false;\n`}			const now = new Date().toISOString();
+        ? `${options.tenant ? `\t\t\tconst existing = ${names.pluralCamel}.get(id);\n\t\t\tif (!existing || existing.tenantId !== tenantId || existing.deletedAt !== null) return false;\n` : `\t\t\tconst existing = ${names.pluralCamel}.get(id);\n\t\t\tif (!existing || existing.deletedAt !== null) return false;\n`}			const now = new Date().toISOString();
 			${names.pluralCamel}.set(id, { ...existing, deletedAt: now, updatedAt: now });
 			return true;`
-        : `${options.tenant ? `\t\t\tconst existing = ${names.pluralCamel}.get(id);\n\t\t\tif (existing?.tenantId !== filter.tenantId) return false;\n` : ""}			return ${names.pluralCamel}.delete(id);`;
+        : `${options.tenant ? `\t\t\tconst existing = ${names.pluralCamel}.get(id);\n\t\t\tif (existing?.tenantId !== tenantId) return false;\n` : ""}			return ${names.pluralCamel}.delete(id);`;
     return `import "@beignet/core/server-only";
 import { cursorPageResult } from "@beignet/core/pagination";
-import type { ${names.singularPascal}Repository } from "${aliasModule(repositoryPortPath)}";
+${options.tenant ? `import { tenantScopeId } from "@beignet/core/tenancy";\n` : ""}import type { ${names.singularPascal}Repository } from "${aliasModule(repositoryPortPath)}";
 import { encode${names.singularPascal}Cursor } from "${aliasModule(resourceSchemaFilePath(names, config))}";
 import type {
 	Create${names.singularPascal}Input,
@@ -2542,10 +2616,10 @@ export function createInMemory${names.singularPascal}Repository(
 	);
 
 	return {
-		async list(query) {
+		async list(query${options.tenant ? ", scope" : ""}) {
 			const name = query.name?.toLocaleLowerCase();
-			const all${names.pluralPascal} = Array.from(${names.pluralCamel}.values())
-${activeFilter}${options.tenant ? `\t\t\t\t.filter((${names.singularCamel}) => ${names.singularCamel}.tenantId === query.tenantId)\n` : ""}				.filter((${names.singularCamel}) => !name || ${names.singularCamel}.name.toLocaleLowerCase().includes(name))
+${options.tenant ? `\t\t\tconst tenantId = tenantScopeId(scope);\n` : ""}			const all${names.pluralPascal} = Array.from(${names.pluralCamel}.values())
+${activeFilter}${options.tenant ? `\t\t\t\t.filter((${names.singularCamel}) => ${names.singularCamel}.tenantId === tenantId)\n` : ""}				.filter((${names.singularCamel}) => !name || ${names.singularCamel}.name.toLocaleLowerCase().includes(name))
 				.sort((left, right) => compare${names.pluralPascal}(left, right, query))
 				.filter((${names.singularCamel}) => isAfter${names.singularPascal}Cursor(${names.singularCamel}, query));
 			const pageItems = all${names.pluralPascal}.slice(0, query.page.limit);
@@ -2560,11 +2634,11 @@ ${activeFilter}${options.tenant ? `\t\t\t\t.filter((${names.singularCamel}) => $
 				nextCursor,
 			);
 		},
-		async create(input) {
+		async create(input${options.tenant ? ", scope" : ""}) {
 			const now = new Date().toISOString();
-			const ${names.singularCamel}: ${names.singularPascal} = {
+${options.tenant ? `\t\t\tconst tenantId = tenantScopeId(scope);\n` : ""}			const ${names.singularCamel}: ${names.singularPascal} = {
 				id: crypto.randomUUID(),
-${options.tenant ? `\t\t\t\ttenantId: input.tenantId,\n` : ""}				name: input.name,
+${options.tenant ? `\t\t\t\ttenantId,\n` : ""}				name: input.name,
 				version: 1,
 				createdAt: now,
 				updatedAt: now,
@@ -2574,7 +2648,7 @@ ${options.tenant ? `\t\t\t\ttenantId: input.tenantId,\n` : ""}				name: input.na
 ${newDeletedAtField}			});
 			return ${names.singularCamel};
 		},
-${mode === "resource" ? `		async findById(id: string${options.tenant ? ", filter" : ""}) {\n			const ${names.singularCamel} = ${names.pluralCamel}.get(id) ?? null;\n${options.tenant ? `\t\t\tif (${names.singularCamel}?.tenantId !== filter.tenantId) return null;\n` : ""}${findDeletedGuard}			return ${names.singularCamel} ? to${names.singularPascal}(${names.singularCamel}) : null;\n		},\n		async update(input) {\n			const existing = ${names.pluralCamel}.get(input.id);\n			if (!existing${options.tenant ? " || existing.tenantId !== input.tenantId" : ""}${updateDeletedGuard} || existing.version !== input.version) return null;\n\n			const next: ${mapValueType} = {\n				...existing,\n				name: input.name,\n				version: existing.version + 1,\n				updatedAt: new Date().toISOString(),\n			};\n			${names.pluralCamel}.set(input.id, next);\n			return to${names.singularPascal}(next);\n		},\n		async delete(id: string${options.tenant ? ", filter" : ""}) {\n${deleteImplementation}\n		},\n` : ""}
+${mode === "resource" ? `		async findById(id: string${options.tenant ? ", scope" : ""}) {\n${options.tenant ? `\t\t\tconst tenantId = tenantScopeId(scope);\n` : ""}			const ${names.singularCamel} = ${names.pluralCamel}.get(id) ?? null;\n${options.tenant ? `\t\t\tif (${names.singularCamel}?.tenantId !== tenantId) return null;\n` : ""}${findDeletedGuard}			return ${names.singularCamel} ? to${names.singularPascal}(${names.singularCamel}) : null;\n		},\n		async update(input${options.tenant ? ", scope" : ""}) {\n${options.tenant ? `\t\t\tconst tenantId = tenantScopeId(scope);\n` : ""}			const existing = ${names.pluralCamel}.get(input.id);\n			if (!existing${options.tenant ? " || existing.tenantId !== tenantId" : ""}${updateDeletedGuard} || existing.version !== input.version) return null;\n\n			const next: ${mapValueType} = {\n				...existing,\n				name: input.name,\n				version: existing.version + 1,\n				updatedAt: new Date().toISOString(),\n			};\n			${names.pluralCamel}.set(input.id, next);\n			return to${names.singularPascal}(next);\n		},\n		async delete(id: string${options.tenant ? ", scope" : ""}) {\n${options.tenant ? `\t\t\tconst tenantId = tenantScopeId(scope);\n` : ""}${deleteImplementation}\n		},\n` : ""}
 	};
 }
 `;
@@ -2680,20 +2754,20 @@ function drizzleRepositoryFile(names, config, mode, options, dialect) {
     const findWhere = drizzleResourceWhere(names, options, [
         `eq(schema.${names.pluralCamel}.id, id)`,
         ...(options.tenant
-            ? [`eq(schema.${names.pluralCamel}.tenantId, filter.tenantId)`]
+            ? [`eq(schema.${names.pluralCamel}.tenantId, tenantScopeId(scope))`]
             : []),
     ]);
     const updateWhere = drizzleResourceWhere(names, options, [
         `eq(schema.${names.pluralCamel}.id, input.id)`,
         `eq(schema.${names.pluralCamel}.version, input.version)`,
         ...(options.tenant
-            ? [`eq(schema.${names.pluralCamel}.tenantId, input.tenantId)`]
+            ? [`eq(schema.${names.pluralCamel}.tenantId, tenantScopeId(scope))`]
             : []),
     ]);
     const deleteWhere = drizzleResourceWhere(names, options, [
         `eq(schema.${names.pluralCamel}.id, id)`,
         ...(options.tenant
-            ? [`eq(schema.${names.pluralCamel}.tenantId, filter.tenantId)`]
+            ? [`eq(schema.${names.pluralCamel}.tenantId, tenantScopeId(scope))`]
             : []),
     ]);
     const drizzleImports = [
@@ -2711,7 +2785,7 @@ function drizzleRepositoryFile(names, config, mode, options, dialect) {
     // After a version-guarded update succeeds, re-select by identity only —
     // matching what `.returning()` yields on the dialects that support it.
     const updateReselectWhere = options.tenant
-        ? `and(eq(schema.${names.pluralCamel}.id, input.id), eq(schema.${names.pluralCamel}.tenantId, input.tenantId))`
+        ? `and(eq(schema.${names.pluralCamel}.id, input.id), eq(schema.${names.pluralCamel}.tenantId, tenantScopeId(scope)))`
         : `eq(schema.${names.pluralCamel}.id, input.id)`;
     // drizzle-orm/mysql2 has no `.returning(...)`; mutations resolve to a
     // `[ResultSetHeader, FieldPacket[]]` tuple typed as `unknown` through the
@@ -2732,13 +2806,13 @@ function affectedRows(result: unknown): number {
 `
         : "";
     const createMethod = dialect.supportsReturning
-        ? `		async create(input) {
+        ? `		async create(input${options.tenant ? ", scope" : ""}) {
 			const now = new Date().toISOString();
 			const [row] = await db
 				.insert(schema.${names.pluralCamel})
 				.values({
 					id: crypto.randomUUID(),
-${options.tenant ? `\t\t\t\t\ttenantId: input.tenantId,\n` : ""}					name: input.name,
+${options.tenant ? `\t\t\t\t\ttenantId: tenantScopeId(scope),\n` : ""}					name: input.name,
 					version: 1,
 					createdAt: now,
 					updatedAt: now,
@@ -2752,11 +2826,11 @@ ${options.tenant ? `\t\t\t\t\ttenantId: input.tenantId,\n` : ""}					name: input
 			return to${names.singularPascal}(row);
 		},
 `
-        : `		async create(input) {
+        : `		async create(input${options.tenant ? ", scope" : ""}) {
 			const now = new Date().toISOString();
 			const ${names.singularCamel}: ${names.singularPascal} = {
 				id: crypto.randomUUID(),
-${options.tenant ? `\t\t\t\ttenantId: input.tenantId,\n` : ""}				name: input.name,
+${options.tenant ? `\t\t\t\ttenantId: tenantScopeId(scope),\n` : ""}				name: input.name,
 				version: 1,
 				createdAt: now,
 				updatedAt: now,
@@ -2769,7 +2843,7 @@ ${options.tenant ? `\t\t\t\ttenantId: input.tenantId,\n` : ""}				name: input.na
     const resourceMethods = mode !== "resource"
         ? ""
         : dialect.supportsReturning
-            ? `		async findById(id: string${options.tenant ? ", filter" : ""}) {
+            ? `		async findById(id: string${options.tenant ? ", scope" : ""}) {
 			const [row] = await db
 				.select()
 				.from(schema.${names.pluralCamel})
@@ -2778,7 +2852,7 @@ ${options.tenant ? `\t\t\t\ttenantId: input.tenantId,\n` : ""}				name: input.na
 
 			return row ? to${names.singularPascal}(row) : null;
 		},
-		async update(input) {
+		async update(input${options.tenant ? ", scope" : ""}) {
 			const [row] = await db
 				.update(schema.${names.pluralCamel})
 				.set({
@@ -2791,12 +2865,12 @@ ${options.tenant ? `\t\t\t\ttenantId: input.tenantId,\n` : ""}				name: input.na
 
 			return row ? to${names.singularPascal}(row) : null;
 		},
-		async delete(id: string${options.tenant ? ", filter" : ""}) {
+		async delete(id: string${options.tenant ? ", scope" : ""}) {
 ${options.softDelete ? `\t\t\tconst now = new Date().toISOString();\n\t\t\tconst rows = await db\n\t\t\t\t.update(schema.${names.pluralCamel})\n\t\t\t\t.set({ deletedAt: now, updatedAt: now })\n\t\t\t\t.where(${deleteWhere})\n\t\t\t\t.returning({ id: schema.${names.pluralCamel}.id });\n` : `\t\t\tconst rows = await db\n\t\t\t\t.delete(schema.${names.pluralCamel})\n\t\t\t\t.where(${deleteWhere})\n\t\t\t\t.returning({ id: schema.${names.pluralCamel}.id });\n`}
 			return rows.length > 0;
 		},
 `
-            : `		async findById(id: string${options.tenant ? ", filter" : ""}) {
+            : `		async findById(id: string${options.tenant ? ", scope" : ""}) {
 			const [row] = await db
 				.select()
 				.from(schema.${names.pluralCamel})
@@ -2805,7 +2879,7 @@ ${options.softDelete ? `\t\t\tconst now = new Date().toISOString();\n\t\t\tconst
 
 			return row ? to${names.singularPascal}(row) : null;
 		},
-		async update(input) {
+		async update(input${options.tenant ? ", scope" : ""}) {
 			const result = await db
 				.update(schema.${names.pluralCamel})
 				.set({
@@ -2825,14 +2899,14 @@ ${options.softDelete ? `\t\t\tconst now = new Date().toISOString();\n\t\t\tconst
 
 			return row ? to${names.singularPascal}(row) : null;
 		},
-		async delete(id: string${options.tenant ? ", filter" : ""}) {
+		async delete(id: string${options.tenant ? ", scope" : ""}) {
 ${options.softDelete ? `\t\t\tconst now = new Date().toISOString();\n\t\t\tconst result = await db\n\t\t\t\t.update(schema.${names.pluralCamel})\n\t\t\t\t.set({ deletedAt: now, updatedAt: now })\n\t\t\t\t.where(${deleteWhere});\n` : `\t\t\tconst result = await db\n\t\t\t\t.delete(schema.${names.pluralCamel})\n\t\t\t\t.where(${deleteWhere});\n`}
 			return affectedRows(result) > 0;
 		},
 `;
     return `import "@beignet/core/server-only";
 import { cursorPageResult } from "@beignet/core/pagination";
-import type { ${dialect.dbTypeName} } from "@beignet/provider-db-drizzle/${dialect.subpath}";
+${options.tenant ? `import { tenantScopeId } from "@beignet/core/tenancy";\n` : ""}import type { ${dialect.dbTypeName} } from "@beignet/provider-db-drizzle/${dialect.subpath}";
 import { ${drizzleImports.join(", ")} } from "drizzle-orm";
 import type { ${names.singularPascal}Repository } from "${aliasModule(repositoryPortPath)}";
 import { encode${names.singularPascal}Cursor } from "${aliasModule(resourceSchemaFilePath(names, config))}";
@@ -2879,9 +2953,9 @@ function ${names.singularCamel}CursorFilter(
 
 function ${names.singularCamel}ListWhere(
 	query: List${names.pluralPascal}Query,
-): SQL<unknown> | undefined {
+${options.tenant ? `\tscope: Parameters<${names.singularPascal}Repository["list"]>[1],\n` : ""}): SQL<unknown> | undefined {
 	const filters: SQL<unknown>[] = [
-${options.tenant ? `\t\teq(schema.${names.pluralCamel}.tenantId, query.tenantId),\n` : ""}${options.softDelete ? `\t\tisNull(schema.${names.pluralCamel}.deletedAt),\n` : ""}	];
+${options.tenant ? `\t\teq(schema.${names.pluralCamel}.tenantId, tenantScopeId(scope)),\n` : ""}${options.softDelete ? `\t\tisNull(schema.${names.pluralCamel}.deletedAt),\n` : ""}	];
 	const cursor = ${names.singularCamel}CursorFilter(query);
 
 	if (query.name) {
@@ -2915,8 +2989,8 @@ export function createDrizzle${names.singularPascal}Repository(
 	db: ${dialect.dbTypeName}<typeof schema>,
 ): ${names.singularPascal}Repository {
 	return {
-		async list(query) {
-			const where = ${names.singularCamel}ListWhere(query);
+		async list(query${options.tenant ? ", scope" : ""}) {
+			const where = ${names.singularCamel}ListWhere(query${options.tenant ? ", scope" : ""});
 			const rows = await db
 				.select()
 				.from(schema.${names.pluralCamel})
@@ -3077,7 +3151,7 @@ export const ${names.exportName} = useCase
 }
 function useCaseTestFile(names, config) {
     const filePath = useCaseTestFilePath(names, config);
-    return `import { describe, expect, it } from "bun:test";
+    return `import { describe, expect, it } from "@/lib/beignet-test";
 import { createUseCaseTester } from "@beignet/core/application";
 import { createInMemoryDevtools } from "@beignet/devtools";
 import { createTestContextFactory, createTestPorts } from "@beignet/core/testing";
@@ -3235,7 +3309,7 @@ export const ${names.singularCamel}Events = [
 `;
 }
 function resourcePolicyTestFile(names, options) {
-    return `import { describe, expect, it } from "bun:test";
+    return `import { describe, expect, it } from "@/lib/beignet-test";
 import { createPolicyTester } from "@beignet/core/ports/testing";
 import { ${names.singularCamel}Policy } from "../policy";
 import type { ${names.singularPascal} } from "../schemas";
@@ -3762,7 +3836,7 @@ function testFile(names, config, mode, options) {
     const repositoryPath = path.join(path.dirname(config.paths.infrastructurePorts), names.pluralKebab, `in-memory-${names.singularKebab}-repository.ts`);
     const serverContextPath = path.join(path.dirname(config.paths.server), "context.ts");
     const requestTarget = "app";
-    return `import { describe, expect, it } from "bun:test";
+    return `import { describe, expect, it } from "@/lib/beignet-test";
 import { createUseCaseTester } from "@beignet/core/application";
 ${mode === "resource" ? `import { isAppError } from "@beignet/core/errors";\n` : ""}import { defineRoutes } from "@beignet/web";
 import { createTestApp } from "@beignet/web/testing";