@beignet/cli 0.0.51 → 0.0.53

package/src/templates/agents.ts

@@ -41,8 +41,8 @@ https://beignetjs.com (agent-friendly index at https://beignetjs.com/llms.txt).
 README.md covers setup and the app map; this file covers what is not
 discoverable from the code.
 
-This app requires Node.js 22.12 or newer. Bun 1.3.14 or newer is supported for
-Beignet commands.
+This app requires Node.js 22.12 or newer. Bun is optional; npm, pnpm, Yarn, and
+Bun can run Beignet commands.
 
 ## Registration is explicit
 
@@ -71,6 +71,12 @@ is a silent failure — the file exists but never runs:
 - Apps using runtime integrity must list workflow registries in
   \`defineRuntimeManifest({...})\`.
 
+Event schemas must output canonical JSON transport data. Use null, strings,
+finite numbers, booleans, arrays, and plain objects. Keep validation
+deterministic and side-effect-free, keep transforms idempotent, and represent
+timestamps as strings or numbers rather than \`Date\` objects.
+Beignet rejects payloads that would change when decoded and validated again.
+
 The starter ships no workflow registries — generators create them on first
 use, so their absence is fine. \`${cli} make event\`, \`${cli} make job\`,
 \`${cli} make listener\`, \`${cli} make schedule\`, \`${cli} make task\`,
@@ -146,20 +152,37 @@ formatting. The individual commands (\`${lint}\`, \`${cli} lint\`,
 \`${cli} doctor --strict\`, \`${test}\`, \`${typecheck}\`) still work when you
 need one check alone.
 
-Beignet's architecture lint parses TypeScript imports and re-exports,
-\`require()\`, import assignments, and literal dynamic imports, then follows
-local value imports through feature-root helpers. When lint cannot verify a
-computed module reference inside a constrained layer, use a string-literal
-specifier or move runtime loading behind an allowed boundary. Move near-miss
-feature layers to the canonical path named in the diagnostic.
+Inside a Git worktree, \`${cli} check\` fingerprints HEAD, the index, the
+worktree, and non-ignored untracked files before and after validation. If the
+ending fingerprint differs from the baseline, the result is stale and
+unsuccessful even when every step passed; rerun the check against the resulting
+source. Outside Git, the same validation runs with source provenance marked
+unavailable; report that limitation instead of describing the result as
+source-current.
+
+Beignet's architecture lint parses JavaScript and TypeScript imports and
+re-exports, \`require()\`, import assignments, and literal dynamic imports, then
+follows local value imports through feature-root helpers. This includes JSX
+and the \`.mts\`, \`.cts\`, \`.mjs\`, and \`.cjs\` module variants. When lint
+cannot verify a computed module reference inside a constrained layer, use a
+string-literal specifier or move runtime loading behind an allowed boundary.
+Move near-miss feature layers to the canonical path named in the diagnostic.
 
 Before exploring unfamiliar code, run \`${cli} map\` for the human inventory
 or \`${cli} map --json --feature <name>\` for an evidence-backed graph scoped
-to one feature. The graph honors the app's complete TypeScript \`baseUrl\` and
-\`paths\` configuration. Fix \`local_import_unresolved\` and
-\`contract_declaration_unresolved\` entries rather than treating their missing
-edges as proof that no relationship exists. Registration diagnostics expose
-the declaration as \`subject.file\` and \`subject.exportName\`.
+to one feature. The graph analyzes JavaScript and TypeScript source and honors
+the app's complete \`baseUrl\` and \`paths\` configuration from
+\`tsconfig.json\`, or \`jsconfig.json\` when no TypeScript config exists. Fix
+\`local_import_unresolved\` and \`contract_declaration_unresolved\` entries
+rather than treating their missing edges as proof that no relationship exists.
+Registration diagnostics expose the declaration as \`subject.file\` and
+\`subject.exportName\`.
+
+The graph includes JavaScript and TypeScript test/spec files under canonical
+and configured app test roots. Feature tests retain feature ownership;
+adjacent app, infra, server, and top-level tests remain app-level nodes and can
+appear as reverse-import consumers in changed mode. Treat that as impact
+evidence, not proof of behavioral coverage.
 
 After editing in a Git worktree, run \`${cli} map --changed\` before the full
 check. It reports direct changes, reverse imports, one-hop semantic consumers,

package/src/templates/base.ts

@@ -247,8 +247,8 @@ route groups such as \`app/(app)\` are not part of the URL.
 
 Beignet app scaffolded with \`@beignet/cli\`.
 
-Node.js 22.12 or newer is required. Bun 1.3.14 or newer is supported for
-Beignet commands.
+Node.js 22.12 or newer is required. Bun is optional; npm, pnpm, Yarn, and Bun
+can run Beignet commands.
 
 ## Getting started
 
@@ -288,9 +288,9 @@ use cases, workflows, ports, providers, and tests connect. \`check\` runs the
 whole validation loop in one pass: \`${cli} lint\` (dependency direction),
 \`${cli} doctor --strict\` (route, OpenAPI, and resource drift), and the
 \`lint\`, \`typecheck\`, and \`test\` package scripts. Use \`${format}\` to
-apply Biome formatting. Beignet lint uses the TypeScript import graph, follows
-feature-root helpers, and reports unverifiable computed module references in
-constrained layers.
+apply Biome formatting. Beignet lint analyzes JavaScript and TypeScript import
+graphs, follows feature-root helpers, and reports unverifiable computed module
+references in constrained layers.
 ${testingNotes}
 ## Coding agents
 

package/src/templates/db/mysql.ts

@@ -15,7 +15,7 @@
 // lives outside the app schema, so `db generate` never diffs against it.
 //
 // The Better Auth tables were generated with
-// `bunx @better-auth/cli generate` against a scratch app configured with
+// `bunx auth generate` against a scratch app configured with
 // drizzleAdapter(db, { provider: "mysql" }), then normalized to the starter's
 // conventions (tabs, no relations, no extra indexes, no column defaults).
 // MySQL cannot put UNIQUE constraints on bare text columns, so identity
@@ -60,6 +60,7 @@ export function closeDatabaseClient(): Promise<void> {
 	mysqlTable,
 	text,
 	timestamp,
+	uniqueIndex,
 	varchar,
 } from "drizzle-orm/mysql-core";
 
@@ -86,23 +87,33 @@ export const session = mysqlTable("session", {
 		.references(() => user.id, { onDelete: "cascade" }),
 });
 
-export const account = mysqlTable("account", {
-	id: varchar("id", { length: 36 }).primaryKey(),
-	accountId: text("account_id").notNull(),
-	providerId: text("provider_id").notNull(),
-	userId: varchar("user_id", { length: 36 })
-		.notNull()
-		.references(() => user.id, { onDelete: "cascade" }),
-	accessToken: text("access_token"),
-	refreshToken: text("refresh_token"),
-	idToken: text("id_token"),
-	accessTokenExpiresAt: timestamp("access_token_expires_at", { fsp: 3 }),
-	refreshTokenExpiresAt: timestamp("refresh_token_expires_at", { fsp: 3 }),
-	scope: text("scope"),
-	password: text("password"),
-	createdAt: timestamp("created_at", { fsp: 3 }).notNull(),
-	updatedAt: timestamp("updated_at", { fsp: 3 }).notNull(),
-});
+export const account = mysqlTable(
+	"account",
+	{
+		id: varchar("id", { length: 36 }).primaryKey(),
+		issuer: varchar("issuer", { length: 255 }).notNull(),
+		accountId: varchar("account_id", { length: 255 }).notNull(),
+		providerId: text("provider_id").notNull(),
+		userId: varchar("user_id", { length: 36 })
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		accessToken: text("access_token"),
+		refreshToken: text("refresh_token"),
+		idToken: text("id_token"),
+		accessTokenExpiresAt: timestamp("access_token_expires_at", { fsp: 3 }),
+		refreshTokenExpiresAt: timestamp("refresh_token_expires_at", { fsp: 3 }),
+		scope: text("scope"),
+		password: text("password"),
+		createdAt: timestamp("created_at", { fsp: 3 }).notNull(),
+		updatedAt: timestamp("updated_at", { fsp: 3 }).notNull(),
+	},
+	(table) => [
+		uniqueIndex("account_issuer_accountId_uidx").on(
+			table.issuer,
+			table.accountId,
+		),
+	],
+);
 
 export const verification = mysqlTable("verification", {
 	id: varchar("id", { length: 36 }).primaryKey(),
@@ -476,7 +487,8 @@ const mysqlStarterMigration = {
   // above, with the provider idempotency setup statements appended.
   starterMigrationSql: `CREATE TABLE \`account\` (
 	\`id\` varchar(36) NOT NULL,
-	\`account_id\` text NOT NULL,
+	\`issuer\` varchar(255) NOT NULL,
+	\`account_id\` varchar(255) NOT NULL,
 	\`provider_id\` text NOT NULL,
 	\`user_id\` varchar(36) NOT NULL,
 	\`access_token\` text,
@@ -488,7 +500,8 @@ const mysqlStarterMigration = {
 	\`password\` text,
 	\`created_at\` timestamp(3) NOT NULL,
 	\`updated_at\` timestamp(3) NOT NULL,
-	CONSTRAINT \`account_id\` PRIMARY KEY(\`id\`)
+	CONSTRAINT \`account_id\` PRIMARY KEY(\`id\`),
+	CONSTRAINT \`account_issuer_accountId_uidx\` UNIQUE(\`issuer\`,\`account_id\`)
 );
 --> statement-breakpoint
 CREATE TABLE \`session\` (
@@ -585,9 +598,16 @@ CREATE TABLE IF NOT EXISTS \`idempotency_records\` (
           "notNull": true,
           "autoincrement": false
         },
+        "issuer": {
+          "name": "issuer",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
         "account_id": {
           "name": "account_id",
-          "type": "text",
+          "type": "varchar(255)",
           "primaryKey": false,
           "notNull": true,
           "autoincrement": false
@@ -670,7 +690,16 @@ CREATE TABLE IF NOT EXISTS \`idempotency_records\` (
           "autoincrement": false
         }
       },
-      "indexes": {},
+      "indexes": {
+        "account_issuer_accountId_uidx": {
+          "name": "account_issuer_accountId_uidx",
+          "columns": [
+            "issuer",
+            "account_id"
+          ],
+          "isUnique": true
+        }
+      },
       "foreignKeys": {
         "account_user_id_user_id_fk": {
           "name": "account_user_id_user_id_fk",

package/src/templates/db/postgres.ts

@@ -15,7 +15,7 @@
 // lives outside the app schema, so `db generate` never diffs against it.
 //
 // The Better Auth tables were generated with
-// `bunx @better-auth/cli generate` against a scratch app configured with
+// `bunx auth generate` against a scratch app configured with
 // drizzleAdapter(db, { provider: "pg" }), then normalized to the starter's
 // conventions (tabs, no relations, no extra indexes, no column defaults).
 
@@ -51,7 +51,7 @@ export function closeDatabaseClient(): Promise<void> {
 	return closePromise;
 }
 `,
-    dbSchema: `import { boolean, index, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+    dbSchema: `import { boolean, index, pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
 
 export const user = pgTable("user", {
 	id: text("id").primaryKey(),
@@ -76,23 +76,33 @@ export const session = pgTable("session", {
 		.references(() => user.id, { onDelete: "cascade" }),
 });
 
-export const account = pgTable("account", {
-	id: text("id").primaryKey(),
-	accountId: text("account_id").notNull(),
-	providerId: text("provider_id").notNull(),
-	userId: text("user_id")
-		.notNull()
-		.references(() => user.id, { onDelete: "cascade" }),
-	accessToken: text("access_token"),
-	refreshToken: text("refresh_token"),
-	idToken: text("id_token"),
-	accessTokenExpiresAt: timestamp("access_token_expires_at"),
-	refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
-	scope: text("scope"),
-	password: text("password"),
-	createdAt: timestamp("created_at").notNull(),
-	updatedAt: timestamp("updated_at").notNull(),
-});
+export const account = pgTable(
+	"account",
+	{
+		id: text("id").primaryKey(),
+		issuer: text("issuer").notNull(),
+		accountId: text("account_id").notNull(),
+		providerId: text("provider_id").notNull(),
+		userId: text("user_id")
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		accessToken: text("access_token"),
+		refreshToken: text("refresh_token"),
+		idToken: text("id_token"),
+		accessTokenExpiresAt: timestamp("access_token_expires_at"),
+		refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+		scope: text("scope"),
+		password: text("password"),
+		createdAt: timestamp("created_at").notNull(),
+		updatedAt: timestamp("updated_at").notNull(),
+	},
+	(table) => [
+		uniqueIndex("account_issuer_accountId_uidx").on(
+			table.issuer,
+			table.accountId,
+		),
+	],
+);
 
 export const verification = pgTable("verification", {
 	id: text("id").primaryKey(),
@@ -413,6 +423,7 @@ const postgresStarterMigration = {
   // above, with the provider idempotency setup statements appended.
   starterMigrationSql: `CREATE TABLE "account" (
 	"id" text PRIMARY KEY NOT NULL,
+	"issuer" text NOT NULL,
 	"account_id" text NOT NULL,
 	"provider_id" text NOT NULL,
 	"user_id" text NOT NULL,
@@ -470,6 +481,7 @@ CREATE TABLE "verification" (
 ALTER TABLE "account" ADD CONSTRAINT "account_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "session" ADD CONSTRAINT "session_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "todos" ADD CONSTRAINT "todos_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "account_issuer_accountId_uidx" ON "account" USING btree ("issuer","account_id");--> statement-breakpoint
 CREATE INDEX "todos_user_idx" ON "todos" USING btree ("user_id","created_at");
 --> statement-breakpoint
 CREATE TABLE IF NOT EXISTS "idempotency_records" (
@@ -517,6 +529,12 @@ CREATE INDEX IF NOT EXISTS "idempotency_records_expires_idx" ON "idempotency_rec
           "primaryKey": true,
           "notNull": true
         },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
         "account_id": {
           "name": "account_id",
           "type": "text",
@@ -590,7 +608,29 @@ CREATE INDEX IF NOT EXISTS "idempotency_records_expires_idx" ON "idempotency_rec
           "notNull": true
         }
       },
-      "indexes": {},
+      "indexes": {
+        "account_issuer_accountId_uidx": {
+          "name": "account_issuer_accountId_uidx",
+          "columns": [
+            {
+              "expression": "issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
       "foreignKeys": {
         "account_user_id_user_id_fk": {
           "name": "account_user_id_user_id_fk",

package/src/templates/db/sqlite.ts

@@ -42,7 +42,7 @@ export function closeDatabaseClient(): Promise<void> {
 	return closePromise;
 }
 `,
-  dbSchema: `import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+  dbSchema: `import { index, integer, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
 
 export const user = sqliteTable("user", {
 	id: text("id").primaryKey(),
@@ -69,27 +69,37 @@ export const session = sqliteTable("session", {
 		.references(() => user.id, { onDelete: "cascade" }),
 });
 
-export const account = sqliteTable("account", {
-	id: text("id").primaryKey(),
-	accountId: text("account_id").notNull(),
-	providerId: text("provider_id").notNull(),
-	userId: text("user_id")
-		.notNull()
-		.references(() => user.id, { onDelete: "cascade" }),
-	accessToken: text("access_token"),
-	refreshToken: text("refresh_token"),
-	idToken: text("id_token"),
-	accessTokenExpiresAt: integer("access_token_expires_at", {
-		mode: "timestamp",
-	}),
-	refreshTokenExpiresAt: integer("refresh_token_expires_at", {
-		mode: "timestamp",
-	}),
-	scope: text("scope"),
-	password: text("password"),
-	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
-	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
-});
+export const account = sqliteTable(
+	"account",
+	{
+		id: text("id").primaryKey(),
+		issuer: text("issuer").notNull(),
+		accountId: text("account_id").notNull(),
+		providerId: text("provider_id").notNull(),
+		userId: text("user_id")
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		accessToken: text("access_token"),
+		refreshToken: text("refresh_token"),
+		idToken: text("id_token"),
+		accessTokenExpiresAt: integer("access_token_expires_at", {
+			mode: "timestamp",
+		}),
+		refreshTokenExpiresAt: integer("refresh_token_expires_at", {
+			mode: "timestamp",
+		}),
+		scope: text("scope"),
+		password: text("password"),
+		createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+		updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+	},
+	(table) => [
+		uniqueIndex("account_issuer_accountId_uidx").on(
+			table.issuer,
+			table.accountId,
+		),
+	],
+);
 
 export const verification = sqliteTable("verification", {
 	id: text("id").primaryKey(),
@@ -452,6 +462,7 @@ export async function createTestDatabase(): Promise<TestDatabase> {
   // above, with the provider idempotency setup statements appended.
   starterMigrationSql: `CREATE TABLE \`account\` (
 	\`id\` text PRIMARY KEY NOT NULL,
+	\`issuer\` text NOT NULL,
 	\`account_id\` text NOT NULL,
 	\`provider_id\` text NOT NULL,
 	\`user_id\` text NOT NULL,
@@ -467,6 +478,7 @@ export async function createTestDatabase(): Promise<TestDatabase> {
 	FOREIGN KEY (\`user_id\`) REFERENCES \`user\`(\`id\`) ON UPDATE no action ON DELETE cascade
 );
 --> statement-breakpoint
+CREATE UNIQUE INDEX \`account_issuer_accountId_uidx\` ON \`account\` (\`issuer\`,\`account_id\`);--> statement-breakpoint
 CREATE TABLE \`session\` (
 	\`id\` text PRIMARY KEY NOT NULL,
 	\`expires_at\` integer NOT NULL,
@@ -555,6 +567,13 @@ CREATE INDEX IF NOT EXISTS "idempotency_records_expires_idx" ON "idempotency_rec
           "notNull": true,
           "autoincrement": false
         },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
         "account_id": {
           "name": "account_id",
           "type": "text",
@@ -640,7 +659,16 @@ CREATE INDEX IF NOT EXISTS "idempotency_records_expires_idx" ON "idempotency_rec
           "autoincrement": false
         }
       },
-      "indexes": {},
+      "indexes": {
+        "account_issuer_accountId_uidx": {
+          "name": "account_issuer_accountId_uidx",
+          "columns": [
+            "issuer",
+            "account_id"
+          ],
+          "isUnique": true
+        }
+      },
       "foreignKeys": {
         "account_user_id_user_id_fk": {
           "name": "account_user_id_user_id_fk",

package/src/templates/shadcn.ts

@@ -561,7 +561,7 @@ export const shadcnDependencies: Record<string, string> = {
   clsx: "^2.1.1",
   "lucide-react": "^1.16.0",
   "radix-ui": "^1.4.3",
-  shadcn: "^4.7.0",
+  shadcn: "^4.19.0",
   "tailwind-merge": "^3.6.0",
   "tw-animate-css": "^1.4.0",
 };

package/src/templates/shared.ts

@@ -32,7 +32,7 @@ export type TemplateContext = {
 
 export const externalVersions = {
   biome: "^2.4.14",
-  next: "^16.2.10",
+  next: "^16.3.3",
   react: "^19.2.5",
   reactDom: "^19.2.5",
   tsx: "^4.22.4",
@@ -41,16 +41,16 @@ export const externalVersions = {
   typesReact: "^19.0.0",
   typesReactDom: "^19.0.0",
   zod: "^4.0.0",
-  tanstackReactQuery: "^5.100.7",
+  tanstackReactQuery: "^5.102.0",
   hookformResolvers: "^5.0.0",
   reactHookForm: "^7.74.0",
-  betterAuth: "1.6.25",
+  betterAuth: "1.7.1",
   bullmq: "^5.0.0",
   drizzleKit: "^0.31.10",
   drizzleOrm: "^0.45.2",
-  inngest: "^4.12.1",
+  inngest: "^4.18.1",
   libsqlClient: "^0.14.0",
-  vercelBlob: "^2.5.0",
+  vercelBlob: "^2.8.0",
   mysql2: "^3.12.0",
   pg: "^8.13.0",
   pglite: "^0.5.2",
@@ -58,7 +58,7 @@ export const externalVersions = {
   resend: "^6.14.0",
   sentryNode: "^10.58.0",
   stripe: "^22.2.1",
-  nodemailer: "^9.0.1",
+  nodemailer: "^9.1.1",
   openFeatureServerSdk: "^1.22.0",
   typesPg: "^8.11.0",
   ioredis: "^5.0.0",

package/src/templates/testing.ts

@@ -1,3 +1,9 @@
+import {
+  appTestFilePattern,
+  configuredTestDirectoryPathKeys,
+  configuredTestFilePathKeys,
+  defaultAppTestRoots,
+} from "../test-discovery.js";
 import type { TemplateFile } from "./shared.js";
 
 export const testHelperTemplateFile: TemplateFile = {
@@ -408,16 +414,9 @@ import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-const defaultTestRoots = [
-  "app",
-  "features",
-  "infra",
-  "lib",
-  "ports",
-  "server",
-  "tests",
-  "src/tests",
-];
+const defaultTestRoots = ${JSON.stringify(defaultAppTestRoots, null, 2)};
+const configuredTestDirectoryPathKeys = ${JSON.stringify(configuredTestDirectoryPathKeys)};
+const configuredTestFilePathKeys = ${JSON.stringify(configuredTestFilePathKeys)};
 const ignoredDirectories = new Set([
   ".beignet-local",
   ".git",
@@ -427,7 +426,7 @@ const ignoredDirectories = new Set([
   "dist",
   "node_modules",
 ]);
-const testFilePattern = /\\.(test|spec)\\.[cm]?[tj]sx?$/;
+const testFilePattern = /${appTestFilePattern.source}/;
 
 const configFileNames = [
   "beignet.config.ts",
@@ -532,14 +531,8 @@ async function configuredRoots(cwd: string): Promise<string[]> {
   }
   const paths = isObjectRecord(config.paths) ? config.paths : {};
   return [
-    paths.tests,
-    paths.features,
-    parentPath(paths.routes),
-    parentPath(paths.server),
-    parentPath(paths.portWiring),
-    parentPath(paths.ports),
-    parentPath(paths.useCaseBuilder),
-    parentPath(paths.routesBuilder),
+    ...configuredTestDirectoryPathKeys.map((key) => paths[key]),
+    ...configuredTestFilePathKeys.map((key) => parentPath(paths[key])),
   ].filter((root): root is string => Boolean(root) && root !== ".");
 }
 

package/src/test-discovery.ts

@@ -0,0 +1,53 @@
+import path from "node:path";
+import { type BeignetPaths, directoryPath } from "./config.js";
+
+export const defaultAppTestRoots = [
+  "app",
+  "features",
+  "infra",
+  "lib",
+  "ports",
+  "server",
+  "tests",
+  "src/tests",
+] as const;
+
+export const configuredTestDirectoryPathKeys = [
+  "tests",
+  "features",
+] as const satisfies readonly (keyof BeignetPaths)[];
+
+export const configuredTestFilePathKeys = [
+  "routes",
+  "server",
+  "portWiring",
+  "ports",
+  "useCaseBuilder",
+  "routesBuilder",
+] as const satisfies readonly (keyof BeignetPaths)[];
+
+export const appTestFilePattern = /\.(test|spec)\.[cm]?[jt]sx?$/;
+
+export function appTestRoots(paths: BeignetPaths): string[] {
+  const roots = [
+    ...defaultAppTestRoots,
+    ...configuredTestDirectoryPathKeys.map((key) => paths[key]),
+    ...configuredTestFilePathKeys.map((key) =>
+      directoryPath(path.posix.dirname(paths[key])),
+    ),
+  ];
+  return Array.from(
+    new Set(roots.map(directoryPath).filter((root) => root && root !== ".")),
+  );
+}
+
+export function isAppTestFile(file: string): boolean {
+  return appTestFilePattern.test(file);
+}
+
+export function isWithinAppTestRoots(
+  file: string,
+  roots: readonly string[],
+): boolean {
+  return roots.some((root) => file.startsWith(`${root}/`));
+}