@beignet/cli 0.0.32 → 0.0.34

package/src/provider-add.ts

@@ -76,9 +76,9 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
   "flags-openfeature": {
     name: "flags-openfeature",
     displayName: "OpenFeature flags",
-    importName: "openFeatureFlagsProvider",
+    importName: "createOpenFeatureFlagsProvider",
     importFrom: "@beignet/provider-flags-openfeature",
-    providerEntry: "openFeatureFlagsProvider",
+    providerEntry: "createOpenFeatureFlagsProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-flags-openfeature":
         beignetDependencyVersion(packageJson),
@@ -97,7 +97,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-flags-openfeature`",
       "- Peer dependency: `@openfeature/server-sdk`",
-      "- The preset wires `openFeatureFlagsProvider` in `server/providers.ts` and defers `flags` in `infra/app-ports.ts`.",
+      "- The preset wires `createOpenFeatureFlagsProvider()` in `server/providers.ts` and defers `flags` in `infra/app-ports.ts`.",
       "- Configure the OpenFeature provider globally or replace this preset with `createOpenFeatureFlagsProvider(...)` when the app needs provider-specific setup.",
       "- Use `ctx.ports.flags` in app code; `ctx.ports.openFeature` is available as an escape hatch.",
       "",
@@ -111,9 +111,9 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
   "jobs-bullmq": {
     name: "jobs-bullmq",
     displayName: "BullMQ jobs",
-    importName: "bullMQJobsProvider",
+    importName: "createBullMQJobsProvider",
     importFrom: "@beignet/provider-jobs-bullmq",
-    providerEntry: "bullMQJobsProvider",
+    providerEntry: "createBullMQJobsProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-jobs-bullmq": beignetDependencyVersion(packageJson),
       bullmq: externalVersions.bullmq,
@@ -138,7 +138,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-jobs-bullmq`",
       "- Peer dependency: `bullmq`",
-      "- The preset wires `bullMQJobsProvider` in `server/providers.ts` and defers `jobs` in `infra/app-ports.ts`.",
+      "- The preset wires `createBullMQJobsProvider()` in `server/providers.ts` and defers `jobs` in `infra/app-ports.ts`.",
       "- Set `BULLMQ_REDIS_URL` before booting the app; the default points at local Redis.",
       "- Dispatching enqueues jobs, but nothing executes them until a worker entrypoint runs `createBullMQJobWorker(...)` in a worker process. See the jobs docs page.",
       "- Use `ctx.ports.jobs.dispatch(...)` in app code; `ctx.ports.bullMQJobs` is available as an escape hatch.",
@@ -150,18 +150,14 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Add a worker entrypoint that runs createBullMQJobWorker(...) in a worker process; dispatched jobs do not execute without one. See the jobs docs page.",
       "Run beignet providers audit and beignet doctor --strict.",
     ],
-    conflictingProviderEntries: [
-      "inngestJobsProvider",
-      "createInngestJobsProvider",
-      "createBullMQJobsProvider",
-    ],
+    conflictingProviderEntries: ["createInngestJobsProvider"],
   },
   "jobs-inngest": {
     name: "jobs-inngest",
     displayName: "Inngest jobs",
-    importName: "inngestJobsProvider",
+    importName: "createInngestJobsProvider",
     importFrom: "@beignet/provider-jobs-inngest",
-    providerEntry: "inngestJobsProvider",
+    providerEntry: "createInngestJobsProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-jobs-inngest": beignetDependencyVersion(packageJson),
       inngest: externalVersions.inngest,
@@ -184,7 +180,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-jobs-inngest`",
       "- Peer dependency: `inngest`",
-      "- The preset wires `inngestJobsProvider` in `server/providers.ts` and defers `jobs` in `infra/app-ports.ts`.",
+      "- The preset wires `createInngestJobsProvider()` in `server/providers.ts` and defers `jobs` in `infra/app-ports.ts`.",
       "- Define jobs with `defineJob(...)` and dispatch them through `ctx.ports.jobs.dispatch(...)`.",
       "- Execution needs an Inngest serve route built from `createInngestJobFunction(...)` and `serve(...)`. See the jobs docs page.",
       "- Use `ctx.ports.inngest` only as an escape hatch for Inngest-specific workflow APIs; prefer `ctx.ports.jobs.dispatch(...)` for Beignet jobs.",
@@ -196,17 +192,14 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Expose an Inngest serve route with createInngestJobFunction(...) so dispatched jobs execute. See the jobs docs page.",
       "Run beignet providers audit and beignet doctor --strict.",
     ],
-    conflictingProviderEntries: [
-      "bullMQJobsProvider",
-      "createBullMQJobsProvider",
-    ],
+    conflictingProviderEntries: ["createBullMQJobsProvider"],
   },
   "mail-resend": {
     name: "mail-resend",
     displayName: "Resend mail",
-    importName: "resendMailProvider",
+    importName: "createResendMailProvider",
     importFrom: "@beignet/provider-mail-resend",
-    providerEntry: "resendMailProvider",
+    providerEntry: "createResendMailProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-mail-resend": beignetDependencyVersion(packageJson),
       resend: externalVersions.resend,
@@ -229,7 +222,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-mail-resend`",
       "- Peer dependency: `resend`",
-      "- The preset wires `resendMailProvider` in `server/providers.ts` and defers `mailer` in `infra/app-ports.ts`.",
+      "- The preset wires `createResendMailProvider()` in `server/providers.ts` and defers `mailer` in `infra/app-ports.ts`.",
       "- `.env.example` ships dev placeholders so the app boots; set real `RESEND_API_KEY` and `RESEND_FROM` values before sending mail.",
       "- Use `ctx.ports.mailer` in app code; `ctx.ports.resend` is available as an escape hatch.",
       "",
@@ -240,16 +233,16 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet providers audit and beignet doctor --strict.",
     ],
     conflictingProviderEntries: [
-      "smtpMailProvider",
+      "createSmtpMailProvider",
       "createMemoryMailerProvider",
     ],
   },
   "mail-smtp": {
     name: "mail-smtp",
     displayName: "SMTP mail",
-    importName: "smtpMailProvider",
+    importName: "createSmtpMailProvider",
     importFrom: "@beignet/provider-mail-smtp",
-    providerEntry: "smtpMailProvider",
+    providerEntry: "createSmtpMailProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-mail-smtp": beignetDependencyVersion(packageJson),
       nodemailer: externalVersions.nodemailer,
@@ -275,7 +268,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-mail-smtp`",
       "- Peer dependency: `nodemailer`",
-      "- The preset wires `smtpMailProvider` in `server/providers.ts` and defers `mailer` in `infra/app-ports.ts`.",
+      "- The preset wires `createSmtpMailProvider()` in `server/providers.ts` and defers `mailer` in `infra/app-ports.ts`.",
       "- `.env.example` ships dev placeholders so the app boots; set real `MAIL_*` values before sending mail.",
       "- Use `ctx.ports.mailer` in app code; `ctx.ports.smtp` is available as an escape hatch.",
       "",
@@ -286,16 +279,16 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet providers audit and beignet doctor --strict.",
     ],
     conflictingProviderEntries: [
-      "resendMailProvider",
+      "createResendMailProvider",
       "createMemoryMailerProvider",
     ],
   },
   "payments-stripe": {
     name: "payments-stripe",
     displayName: "Stripe payments",
-    importName: "stripePaymentsProvider",
+    importName: "createStripePaymentsProvider",
     importFrom: "@beignet/provider-payments-stripe",
-    providerEntry: "stripePaymentsProvider",
+    providerEntry: "createStripePaymentsProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-payments-stripe":
         beignetDependencyVersion(packageJson),
@@ -324,7 +317,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-payments-stripe`",
       "- Peer dependency: `stripe`",
-      "- The preset wires `stripePaymentsProvider` in `server/providers.ts` and defers `payments` in `infra/app-ports.ts`.",
+      "- The preset wires `createStripePaymentsProvider()` in `server/providers.ts` and defers `payments` in `infra/app-ports.ts`.",
       "- `.env.example` ships dev placeholders so the app boots; set real `STRIPE_SECRET_KEY` and `STRIPE_WEBHOOK_SECRET` values before taking payments.",
       "- Stripe requires a webhook route: run `beignet make payments` for the full billing slice, including a `createPaymentWebhookRoute(...)` route.",
       "- Use `ctx.ports.payments` in app code; `ctx.ports.stripe` is available as an escape hatch.",
@@ -336,17 +329,14 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet make payments for the full billing slice; Stripe needs its webhook route before subscription state can sync.",
       "Run beignet providers audit and beignet doctor --strict.",
     ],
-    conflictingProviderEntries: [
-      "createMemoryPaymentsProvider",
-      "createStripePaymentsProvider",
-    ],
+    conflictingProviderEntries: ["createMemoryPaymentsProvider"],
   },
   "search-meilisearch": {
     name: "search-meilisearch",
     displayName: "Meilisearch search",
-    importName: "meilisearchSearchProvider",
+    importName: "createMeilisearchSearchProvider",
     importFrom: "@beignet/provider-search-meilisearch",
-    providerEntry: "meilisearchSearchProvider",
+    providerEntry: "createMeilisearchSearchProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-search-meilisearch":
         beignetDependencyVersion(packageJson),
@@ -370,7 +360,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "## Meilisearch search",
       "",
       "- Package: `@beignet/provider-search-meilisearch`",
-      "- The preset wires `meilisearchSearchProvider` in `server/providers.ts` and defers `search` in `infra/app-ports.ts`.",
+      "- The preset wires `createMeilisearchSearchProvider()` in `server/providers.ts` and defers `search` in `infra/app-ports.ts`.",
       "- Set `MEILISEARCH_HOST` before booting the app; set `MEILISEARCH_API_KEY` when your Meilisearch server requires one.",
       "- Use `ctx.ports.search` in app code; `ctx.ports.meilisearch` is available as an escape hatch.",
       "",
@@ -384,9 +374,9 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
   sentry: {
     name: "sentry",
     displayName: "Sentry error reporting",
-    importName: "sentryErrorReportingProvider",
+    importName: "createSentryErrorReportingProvider",
     importFrom: "@beignet/provider-error-reporting-sentry",
-    providerEntry: "sentryErrorReportingProvider",
+    providerEntry: "createSentryErrorReportingProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-error-reporting-sentry":
         beignetDependencyVersion(packageJson),
@@ -405,7 +395,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-error-reporting-sentry`",
       "- Peer dependency: `@sentry/node`",
-      "- The preset wires `sentryErrorReportingProvider` in `server/providers.ts`.",
+      "- The preset wires `createSentryErrorReportingProvider()` in `server/providers.ts`.",
       "- Set `SENTRY_DSN` before deploying when captures should be sent to Sentry.",
       "- Use `ctx.ports.errorReporter` in app code; `ctx.ports.sentry` is available as an escape hatch.",
       "",
@@ -419,9 +409,9 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
   "redis-cache": {
     name: "redis-cache",
     displayName: "Redis cache",
-    importName: "redisCacheProvider",
+    importName: "createRedisCacheProvider",
     importFrom: "@beignet/provider-cache-redis",
-    providerEntry: "redisCacheProvider",
+    providerEntry: "createRedisCacheProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-cache-redis": beignetDependencyVersion(packageJson),
       ioredis: externalVersions.ioredis,
@@ -444,7 +434,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-cache-redis`",
       "- Peer dependency: `ioredis`",
-      "- The preset wires `redisCacheProvider` in `server/providers.ts` and defers `cache` in `infra/app-ports.ts`.",
+      "- The preset wires `createRedisCacheProvider()` in `server/providers.ts` and defers `cache` in `infra/app-ports.ts`.",
       "- Set `REDIS_URL` before booting the app.",
       "- Use `ctx.ports.cache` in app code; `ctx.ports.redis` is available as an escape hatch.",
       "",
@@ -455,12 +445,56 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet providers audit and beignet doctor --strict.",
     ],
   },
+  "event-bus-redis": {
+    name: "event-bus-redis",
+    displayName: "Redis event bus",
+    importName: "createRedisEventBusProvider",
+    importFrom: "@beignet/provider-event-bus-redis",
+    providerEntry: "createRedisEventBusProvider()",
+    dependencies: (packageJson) => ({
+      "@beignet/provider-event-bus-redis":
+        beignetDependencyVersion(packageJson),
+      ioredis: externalVersions.ioredis,
+    }),
+    appPort: {
+      key: "eventBus",
+      typeName: "EventBusPort",
+      importName: "EventBusPort",
+      importFrom: "@beignet/core/ports",
+    },
+    envVars: ["REDIS_EVENT_BUS_URL"],
+    envExample: [
+      "# Redis event bus provider",
+      "REDIS_EVENT_BUS_URL=redis://localhost:6379",
+      "# REDIS_EVENT_BUS_DB=0",
+      "# REDIS_EVENT_BUS_CHANNEL_PREFIX=beignet:event-bus:",
+      "",
+    ].join("\n"),
+    docs: [
+      "## Redis event bus",
+      "",
+      "- Package: `@beignet/provider-event-bus-redis`",
+      "- Peer dependency: `ioredis`",
+      "- The preset wires `createRedisEventBusProvider()` in `server/providers.ts` and defers `eventBus` in `infra/app-ports.ts`.",
+      "- Set `REDIS_EVENT_BUS_URL` before booting the app.",
+      "- Redis Pub/Sub delivery is best-effort and cross-process, but not durable: use outbox/jobs for side effects that need retry, replay, or dead-letter handling.",
+      "- Use `ctx.ports.eventBus` in app code; `ctx.ports.redisEventBus` is available as an escape hatch.",
+      "",
+    ].join("\n"),
+    nextSteps: [
+      "Run your package manager install command.",
+      "Set REDIS_EVENT_BUS_URL in .env.local or your deployment environment.",
+      "Keep durable side effects on the outbox/jobs path; Redis Pub/Sub does not replay missed events.",
+      "Run beignet providers audit and beignet doctor --strict.",
+    ],
+    conflictingProviderEntries: ["createMemoryEventBusProvider"],
+  },
   "redis-locks": {
     name: "redis-locks",
     displayName: "Redis locks",
-    importName: "redisLocksProvider",
+    importName: "createRedisLocksProvider",
     importFrom: "@beignet/provider-locks-redis",
-    providerEntry: "redisLocksProvider",
+    providerEntry: "createRedisLocksProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-locks-redis": beignetDependencyVersion(packageJson),
       ioredis: externalVersions.ioredis,
@@ -484,7 +518,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-locks-redis`",
       "- Peer dependency: `ioredis`",
-      "- The preset wires `redisLocksProvider` in `server/providers.ts` and defers `locks` in `infra/app-ports.ts`.",
+      "- The preset wires `createRedisLocksProvider()` in `server/providers.ts` and defers `locks` in `infra/app-ports.ts`.",
       "- Set `REDIS_LOCKS_URL` before booting the app.",
       "- Use `ctx.ports.locks` in app code; `ctx.ports.redisLocks` is available as an escape hatch.",
       "",
@@ -498,9 +532,9 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
   "s3-storage": {
     name: "s3-storage",
     displayName: "S3-compatible storage",
-    importName: "s3StorageProvider",
+    importName: "createS3StorageProvider",
     importFrom: "@beignet/provider-storage-s3",
-    providerEntry: "s3StorageProvider",
+    providerEntry: "createS3StorageProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-storage-s3": beignetDependencyVersion(packageJson),
       "@aws-sdk/client-s3": externalVersions.awsSdkS3,
@@ -545,7 +579,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-storage-s3`",
       "- Peer dependencies: `@aws-sdk/client-s3` and `@aws-sdk/s3-request-presigner`",
-      "- The preset wires `s3StorageProvider` in `server/providers.ts` and defers `storage` in `infra/app-ports.ts`.",
+      "- The preset wires `createS3StorageProvider()` in `server/providers.ts` and defers `storage` in `infra/app-ports.ts`.",
       "- Set `STORAGE_S3_BUCKET` before booting the app; set endpoint and credentials when using an S3-compatible host outside AWS defaults.",
       "- Use `ctx.ports.storage` in app code; `ctx.ports.s3Storage` is available as an escape hatch.",
       "",
@@ -556,18 +590,16 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet providers audit and beignet doctor --strict.",
     ],
     conflictingProviderEntries: [
-      "localStorageProvider",
       "createLocalStorageProvider",
-      "vercelBlobStorageProvider",
       "createVercelBlobStorageProvider",
     ],
   },
   "vercel-blob-storage": {
     name: "vercel-blob-storage",
     displayName: "Vercel Blob storage",
-    importName: "vercelBlobStorageProvider",
+    importName: "createVercelBlobStorageProvider",
     importFrom: "@beignet/provider-storage-vercel-blob",
-    providerEntry: "vercelBlobStorageProvider",
+    providerEntry: "createVercelBlobStorageProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-storage-vercel-blob":
         beignetDependencyVersion(packageJson),
@@ -593,7 +625,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-storage-vercel-blob`",
       "- Peer dependency: `@vercel/blob`",
-      "- The preset wires `vercelBlobStorageProvider` in `server/providers.ts` and defers `storage` in `infra/app-ports.ts`.",
+      "- The preset wires `createVercelBlobStorageProvider()` in `server/providers.ts` and defers `storage` in `infra/app-ports.ts`.",
       "- On Vercel, connect a Blob store to the project and `BLOB_READ_WRITE_TOKEN` is set automatically; set it manually elsewhere.",
       "- The store is uniform-visibility (`BLOB_ACCESS`, default `private`): Vercel Blob does not report per-object access back, so mixed visibility needs a second store.",
       "- Use `ctx.ports.storage` in app code; `ctx.ports.vercelBlob` is available as an escape hatch.",
@@ -605,18 +637,16 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "Run beignet providers audit and beignet doctor --strict.",
     ],
     conflictingProviderEntries: [
-      "localStorageProvider",
       "createLocalStorageProvider",
-      "s3StorageProvider",
       "createS3StorageProvider",
     ],
   },
   "upstash-rate-limit": {
     name: "upstash-rate-limit",
     displayName: "Upstash rate limit",
-    importName: "upstashRateLimitProvider",
+    importName: "createUpstashRateLimitProvider",
     importFrom: "@beignet/provider-rate-limit-upstash",
-    providerEntry: "upstashRateLimitProvider",
+    providerEntry: "createUpstashRateLimitProvider()",
     dependencies: (packageJson) => ({
       "@beignet/provider-rate-limit-upstash":
         beignetDependencyVersion(packageJson),
@@ -643,7 +673,7 @@ const presets: Record<ProviderPresetName, ProviderPreset> = {
       "",
       "- Package: `@beignet/provider-rate-limit-upstash`",
       "- Peer dependencies: `@upstash/ratelimit` and `@upstash/redis`",
-      "- The preset wires `upstashRateLimitProvider` in `server/providers.ts` and defers `rateLimit` in `infra/app-ports.ts`.",
+      "- The preset wires `createUpstashRateLimitProvider()` in `server/providers.ts` and defers `rateLimit` in `infra/app-ports.ts`.",
       "- `.env.example` ships dev placeholders so the app boots; set real `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN` values before rate limiting requests.",
       "- Use `ctx.ports.rateLimit` in app code; `ctx.ports.upstash` is available as an escape hatch.",
       "",
@@ -663,9 +693,9 @@ const providerPresetSet = new Set<string>(providerPresetChoices);
  * integration, used to pre-validate preset selections at create time.
  */
 const integrationProviderEntries: Record<IntegrationName, string> = {
-  inngest: "inngestJobsProvider",
-  resend: "resendMailProvider",
-  "upstash-rate-limit": "upstashRateLimitProvider",
+  inngest: "createInngestJobsProvider",
+  resend: "createResendMailProvider",
+  "upstash-rate-limit": "createUpstashRateLimitProvider",
 };
 
 /**
@@ -688,7 +718,7 @@ export function assertCompatibleCreatePresets(
     selectedEntries.set(integrationProviderEntries[integration], integration);
   }
   for (const name of presetNames) {
-    selectedEntries.set(presets[name].providerEntry, name);
+    selectedEntries.set(presets[name].importName, name);
   }
 
   for (const name of presetNames) {

package/src/registry-edits.ts

@@ -300,7 +300,8 @@ export function appendToOutboxRegistryArray(
 }
 
 function entryIdentifier(entry: string): string {
-  return entry.replace(/^\.{3}/, "").trim();
+  const normalized = entry.replace(/^\.{3}/, "").trim();
+  return /^[A-Za-z_$][\w$]*/.exec(normalized)?.[0] ?? normalized;
 }
 
 function appendEntry(

package/src/task.ts

@@ -50,7 +50,7 @@ export async function runAppTask(
   const task = findTask(taskModule.tasks, options.name, modulePath);
   // Loaded lazily so CLI commands that never touch the app runtime, such as
   // `beignet lint`, work without a built @beignet/core.
-  const { parseTaskInput } = await import("@beignet/core/tasks");
+  const { parseTaskInput, runTask } = await import("@beignet/core/tasks");
   const parsedInput = await parseTaskInput(task, rawInput);
   const contextArgs: TaskRunContextArgs = {
     task,
@@ -63,8 +63,7 @@ export async function runAppTask(
     : {};
 
   try {
-    const output = await task.handle({
-      task,
+    const output = await runTask(task, {
       input: parsedInput,
       ctx,
     });

package/src/templates/agents.ts

@@ -27,7 +27,9 @@ export function agentsMd(ctx: TemplateContext): string {
   const intent = intentRunner(ctx);
   const capabilityClientRow = ctx.api
     ? ""
-    : "\n| Query cache keys and invalidation | `rq(contract).invalidate(queryClient, params?)`, `.key(...)`, `.filter(...)` from `client/` (`@beignet/react-query`). Thin named wrappers in `features/<feature>/client/` are the convention — hand-built key arrays are not. |";
+    : "\n| Query cache keys and invalidation | `rq(contract).invalidate(queryClient, params?)`, `.key(...)`, `.filter(...)` from `client/` (`@beignet/react-query`). Thin named wrappers in `features/<feature>/client/` are the convention — hand-built key arrays are not. |" +
+      "\n| Server Component request context | Use an app-owned server-only helper such as `lib/server-context.ts` that wraps `server.createContextFromNext()` in React `cache(...)`. Layouts may read `ctx.auth`, `ctx.tenant`, and request metadata for redirects and shell state; feature data still belongs behind use cases. |" +
+      "\n| Server Component React Query prefetch | Use an app-owned helper such as `lib/server-react-query.ts` on top of the request context: keep the `rq(contract).queryOptions(...)` key, replace only the server `queryFn` with the direct use case call, and do not create a parallel `rqServer` abstraction. |";
   const specificSkills = ctx.api
     ? "`@beignet/next#routes-server`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`"
     : "`@beignet/next#routes-server`, `@beignet/react-query#client`, `@beignet/react-hook-form#forms`, `@beignet/provider-db-drizzle#database-provider`, `@beignet/provider-auth-better-auth#auth-provider`, or `@beignet/cli#app-structure`";
@@ -50,8 +52,8 @@ is a silent failure — the file exists but never runs:
 - Tasks must be added to \`defineTasks([...])\` in \`server/tasks.ts\`.
 - Outbox events and jobs must be registered in \`defineOutboxRegistry({...})\`
   in \`server/outbox.ts\`.
-- Listeners must be wired through a \`registerListeners(...)\` call in infra
-  wiring.
+- Listeners must be added to the \`listeners\` array in \`server/listeners.ts\`
+  and wired through a \`registerListeners(...)\` call in server provider wiring.
 
 The starter ships no workflow registries — generators create them on first
 use, so their absence is fine. \`${cli} make event\`, \`${cli} make job\`,
@@ -81,6 +83,7 @@ apps have reimplemented by accident:
 | Ports outside a request — auth callbacks, module-level helpers | \`const { ports } = await getServer()\` (dynamic \`import("@/server")\` breaks module cycles). Do not construct parallel provider clients or fall back to \`console.*\` when \`ports.logger\` exists. |
 | Routes that cannot be contracts — webhooks, third-party callbacks, streaming | \`createWebhookRoute\`, \`createPaymentWebhookRoute\`, \`createScheduleRoute\`, \`createOutboxDrainRoute\` from \`@beignet/next\`; \`server.rawRoute(...)\` for anything else. All run the hooks pipeline — never hand-enforce rate limits in a route body. |
 | Rate limiting or idempotency on a route | Declare \`metadata.rateLimit\` / \`metadata.idempotency\` on the contract (or the \`pipeline\` option on raw routes); hooks enforce it. |
+| Tenant-owned repository access | Pass \`TenantScope\` through app-facing repository methods and unwrap it with \`tenantScopeId(scope)\` in adapters. Raw provider-correlation lookups such as webhook customer IDs are not tenant authorization. |
 | Route-level tests that exercise real hooks | \`createTestApp\` / \`createTestRequester\` from \`@beignet/web/testing\`. Bind the rate-limit and idempotency ports in the test app when asserting 429s or replay. |
 | Environment configuration | \`lib/env.ts\` (\`createEnv\`), never ad-hoc \`process.env\` reads in app code. |
 | The same lookup runs several times in one request — context, policy, use case | Wrap the repository read in \`createMemo(...)\` from \`@beignet/core/memo\` where the adapter is wired in infra. The cache lives for exactly one request; pair mutations with \`.invalidate(...)\`. Never hand-roll per-request caches. |

package/src/templates/base.ts

@@ -67,11 +67,11 @@ export function packageJson(ctx: TemplateContext): string {
     "@beignet/cli": ctx.beignetVersion,
     "@beignet/web": ctx.beignetVersion,
     "@biomejs/biome": externalVersions.biome,
-    "@types/bun": externalVersions.typesBun,
     "@types/node": externalVersions.typesNode,
     "@types/react": externalVersions.typesReact,
     "@types/react-dom": externalVersions.typesReactDom,
     "drizzle-kit": externalVersions.drizzleKit,
+    tsx: externalVersions.tsx,
     typescript: externalVersions.typescript,
   };
 
@@ -97,11 +97,11 @@ export function packageJson(ctx: TemplateContext): string {
     start: "next start",
     lint: "biome lint .",
     format: "biome format --write .",
-    test: "bun test",
+    test: "tsx lib/beignet-test-runner.ts",
     typecheck: "tsc --noEmit",
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
-    "db:reset": "bun infra/db/reset.ts",
+    "db:reset": "tsx infra/db/reset.ts",
   };
 
   return json({
@@ -390,7 +390,7 @@ export function integrationsDoc(ctx: TemplateContext): string {
         "- Package: `@beignet/core` (`@beignet/core/events`, `@beignet/core/jobs`)",
         "- Package: `@beignet/provider-jobs-inngest`",
         "- Peer dependency: `inngest`",
-        "- The starter wires `inngestJobsProvider` in `server/providers.ts`.",
+        "- The starter wires `createInngestJobsProvider()` in `server/providers.ts`.",
         "- Define jobs with `defineJob(...)` and dispatch them through `ctx.ports.jobs.dispatch(...)`.",
         "- Use `ctx.ports.inngest` only as an escape hatch for Inngest-specific workflow APIs; prefer `ctx.ports.jobs.dispatch(...)` for Beignet jobs.",
         "",
@@ -403,7 +403,7 @@ export function integrationsDoc(ctx: TemplateContext): string {
         "",
         "- Package: `@beignet/provider-mail-resend`",
         "- Peer dependency: `resend`",
-        "- The starter wires `resendMailProvider` in `server/providers.ts`.",
+        "- The starter wires `createResendMailProvider()` in `server/providers.ts`.",
         "- `.env.example` ships dev placeholders so the app boots; set real `RESEND_API_KEY` and `RESEND_FROM` values before sending mail.",
         "",
       );
@@ -415,7 +415,7 @@ export function integrationsDoc(ctx: TemplateContext): string {
         "",
         "- Package: `@beignet/provider-rate-limit-upstash`",
         "- Peer dependencies: `@upstash/ratelimit` and `@upstash/redis`",
-        "- The starter wires `upstashRateLimitProvider` in `server/providers.ts` and adds `rateLimit: RateLimitPort` to `AppPorts`.",
+        "- The starter wires `createUpstashRateLimitProvider()` in `server/providers.ts` and adds `rateLimit: RateLimitPort` to `AppPorts`.",
         "- `.env.example` ships dev placeholders so the app boots; set real `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN` values before rate limiting requests.",
         "",
       );

package/src/templates/index.ts

@@ -28,6 +28,7 @@ import {
 import { shadcnTemplateFiles } from "./shadcn.js";
 import type { TemplateContext, TemplateFile } from "./shared.js";
 import { shellTemplateFiles } from "./shell.js";
+import { testSupportTemplateFiles } from "./testing.js";
 import { todosFiles } from "./todos.js";
 
 /**
@@ -133,6 +134,7 @@ export function getTemplateFiles(ctx: TemplateContext): TemplateFile[] {
     { path: "lib/auth.ts", content: serverFiles.authHelpers },
     { path: "lib/better-auth.ts", content: betterAuth(ctx) },
     { path: "lib/tenant.ts", content: serverFiles.tenantHelper },
+    ...testSupportTemplateFiles,
     { path: "lib/use-case.ts", content: serverFiles.useCaseBuilder },
     { path: "server/index.ts", content: server(ctx) },
     { path: "server/context.ts", content: serverFiles.serverContext },

package/src/templates/server.ts

@@ -13,14 +13,14 @@ export function serverProviders(ctx: TemplateContext): string {
     'import { createAuthBetterAuthProvider } from "@beignet/provider-auth-better-auth";',
     `import { ${db.providerFactory} } from "@beignet/provider-db-drizzle/${db.subpath}";`,
     hasIntegration(ctx, "inngest")
-      ? 'import { inngestJobsProvider } from "@beignet/provider-jobs-inngest";'
+      ? 'import { createInngestJobsProvider } from "@beignet/provider-jobs-inngest";'
       : undefined,
-    'import { pinoLoggerProvider } from "@beignet/provider-logger-pino";',
+    'import { createPinoLoggerProvider } from "@beignet/provider-logger-pino";',
     hasIntegration(ctx, "resend")
-      ? 'import { resendMailProvider } from "@beignet/provider-mail-resend";'
+      ? 'import { createResendMailProvider } from "@beignet/provider-mail-resend";'
       : undefined,
     hasIntegration(ctx, "upstash-rate-limit")
-      ? 'import { upstashRateLimitProvider } from "@beignet/provider-rate-limit-upstash";'
+      ? 'import { createUpstashRateLimitProvider } from "@beignet/provider-rate-limit-upstash";'
       : undefined,
     'import * as schema from "@/infra/db/schema";',
     'import { starterDatabaseProvider } from "@/infra/db/provider";',
@@ -31,13 +31,15 @@ export function serverProviders(ctx: TemplateContext): string {
   const entries = [
     "\tcreateDevtoolsProvider(),",
     "\tcreateAuthBetterAuthProvider<AuthUser, AuthSessionMetadata>(auth),",
-    "\tpinoLoggerProvider,",
+    "\tcreatePinoLoggerProvider(),",
     `\t${db.providerInstance},`,
     "\tstarterDatabaseProvider,",
-    hasIntegration(ctx, "inngest") ? "\tinngestJobsProvider," : undefined,
-    hasIntegration(ctx, "resend") ? "\tresendMailProvider," : undefined,
+    hasIntegration(ctx, "inngest")
+      ? "\tcreateInngestJobsProvider(),"
+      : undefined,
+    hasIntegration(ctx, "resend") ? "\tcreateResendMailProvider()," : undefined,
     hasIntegration(ctx, "upstash-rate-limit")
-      ? "\tupstashRateLimitProvider,"
+      ? "\tcreateUpstashRateLimitProvider(),"
       : undefined,
   ].filter((entry): entry is string => Boolean(entry));
 
@@ -297,7 +299,11 @@ export function server(ctx: TemplateContext): string {
 
   return `import "@beignet/core/server-only";
 import { createNextServer, createNextServerLoader } from "@beignet/next";
-import { createErrorReportingHooks, createIdempotencyHooks } from "@beignet/core/server";
+import {
+	createErrorReportingHooks,
+	createIdempotencyHooks,
+	createSecurityHeadersHooks,
+} from "@beignet/core/server";
 import type { AppContext } from "@/app-context";
 import { appPorts } from "@/infra/app-ports";
 import { env } from "@/lib/env";
@@ -314,6 +320,7 @@ export const getServer = createNextServerLoader(async () => {
 ${providerConfigEntries}
 	},
 	hooks: [
+		createSecurityHeadersHooks<AppContext>(),
 		createErrorReportingHooks<AppContext>(),
 		createIdempotencyHooks<AppContext>(),
 	],
@@ -440,7 +447,7 @@ export type AuthPort = BeignetAuthPort<
 >;
 `,
   serverRoutes: `import "@beignet/core/server-only";
-import { contractsFromRoutes, defineRoutes } from "@beignet/next";
+import { contractsFromRoutes, defineRoutes } from "@beignet/core/server";
 import type { AppContext } from "@/app-context";
 import { todoRoutes } from "@/features/todos/routes";
 

package/src/templates/shared.ts

@@ -35,8 +35,8 @@ export const externalVersions = {
   next: "^16.2.4",
   react: "^19.2.5",
   reactDom: "^19.2.5",
+  tsx: "^4.22.4",
   typescript: "^5.3.0",
-  typesBun: "^1.3.13",
   typesNode: "^20.10.0",
   typesReact: "^19.0.0",
   typesReactDom: "^19.0.0",
@@ -67,6 +67,18 @@ export const externalVersions = {
   upstashRedis: "^1.0.0",
 };
 
+export const legacyGeneratedPackageScripts: Record<string, string> = {
+  "db:reset": "bun infra/db/reset.ts",
+  "db:seed": "bun server/seed.ts",
+  test: "bun test",
+};
+
+export const currentGeneratedPackageScripts: Record<string, string> = {
+  "db:reset": "tsx infra/db/reset.ts",
+  "db:seed": "tsx server/seed.ts",
+  test: "tsx lib/beignet-test-runner.ts",
+};
+
 /**
  * Dialect-specific names used when rendering database-aware templates.
  */