ruby_everywhere 0.0.1 → 0.1.0

data/lib/everywhere/commands/platform/runner.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+require "dry/cli"
+require "tmpdir"
+require "fileutils"
+require "shellwords"
+require "base64"
+require "json"
+require "open3"
+require_relative "../../ui"
+require_relative "../../platform/client"
+
+module Everywhere
+  module Commands
+    # `every platform runner` — runs ON a build runner (a GitHub Actions macOS
+    # machine, or any Mac). It's the glue between the Runner API and the
+    # `every release` signing engine:
+    #
+    #   job spec → mark running → download+extract snapshot → pull JIT creds into
+    #   a throwaway keychain (+ .p8) → every release (streaming logs) → upload the
+    #   artifact + release.json → complete.
+    #
+    # Authenticated with the per-artifact runner token, so it can only touch the
+    # one artifact it was dispatched for.
+    class PlatformRunner < Dry::CLI::Command
+      desc "Run a Platform build on this machine (used by the hosted runner)"
+
+      option :artifact,  required: true, desc: "Artifact public id (art_…)"
+      option :token,     required: true, desc: "Per-artifact runner token"
+      option :url,       default: nil,   desc: "Platform base URL"
+      option :shell_dir, default: nil,   desc: "Path to the generic Tauri shell (src-tauri)"
+
+      def call(artifact:, token:, url: nil, shell_dir: nil, **)
+        base = Everywhere::Platform::Client.base_url(url)
+        @client = Everywhere::Platform::Client.new(base, token: token)
+        @artifact = artifact
+
+        job = get!("/runner/artifacts/#{artifact}")
+        patch!("/runner/artifacts/#{artifact}", status: "running")
+        remote_log("runner: picked up #{job.dig("target", "os")}-#{job.dig("target", "arch")} for #{job.dig("app", "name")}")
+
+        Dir.mktmpdir("every-runner") do |work|
+          src = fetch_snapshot(work, job)
+          signing_env = pull_credentials(work)
+
+          status, release_json, zip = run_release(src, job, signing_env, shell_dir)
+
+          if status == "succeeded" && zip
+            complete_success(zip, release_json)
+          else
+            complete_failure("build failed — see log")
+          end
+        ensure
+          restore_keychains
+        end
+      rescue Everywhere::Error => e
+        complete_failure(e.message)
+        UI.die!(e.message)
+      end
+
+      private
+
+      # ---- pipeline steps ------------------------------------------------------
+
+      def fetch_snapshot(work, job)
+        remote_log("runner: downloading source snapshot")
+        tarball = File.join(work, "snapshot.tar.gz")
+        @client.download(job["snapshot_url"], tarball)
+        src = File.join(work, "src")
+        FileUtils.mkdir_p(src)
+        UI.die!("failed to extract snapshot") unless system("tar", "-xzf", tarball, "-C", src)
+        src
+      end
+
+      def pull_credentials(work)
+        remote_log("runner: pulling signing credentials")
+        creds = get!("/runner/artifacts/#{@artifact}/credentials")["credentials"] || []
+        env = {}
+        creds.each do |cred|
+          path = File.join(work, cred["filename"])
+          File.binwrite(path, Base64.strict_decode64(cred["data_base64"]))
+          File.chmod(0o600, path)
+          case cred["kind"]
+          when "apple_developer_id", "apple_distribution"
+            env["APPLE_SIGNING_IDENTITY"] = install_certificate(path, cred["metadata"] || {}, work)
+          when "apple_asc_api_key"
+            env["NOTARY_KEY"]    = path
+            env["NOTARY_KEY_ID"] = cred.dig("metadata", "key_id")
+            env["NOTARY_ISSUER"] = cred.dig("metadata", "issuer_id")
+          end
+        end
+        env
+      end
+
+      # Import the .p12 into a throwaway keychain and add it to the search list so
+      # codesign finds the identity. Returns the identity name for notarize.sh.
+      def install_certificate(p12, metadata, work)
+        @keychain = File.join(work, "runner.keychain-db")
+        password = SecureRandom.hex(12)
+        @saved_keychains = `security list-keychains -d user`.scan(/"([^"]+)"/).flatten
+
+        run_security("create-keychain", "-p", password, @keychain)
+        run_security("set-keychain-settings", "-lut", "7200", @keychain)
+        run_security("unlock-keychain", "-p", password, @keychain)
+        run_security("import", p12, "-k", @keychain, "-P", metadata["password"].to_s, "-T", "/usr/bin/codesign")
+        run_security("list-keychains", "-d", "user", "-s", @keychain, *@saved_keychains)
+        run_security("set-key-partition-list", "-S", "apple-tool:,apple:,codesign:", "-s", "-k", password, @keychain)
+
+        # Sign by SHA-1, not name: the name can collide with other identities on
+        # the machine, and `-v` (valid-only) would hide ours when the Apple
+        # intermediate isn't in THIS keychain — codesign completes the chain from
+        # the full search list.
+        listing = `security find-identity -p codesigning #{@keychain.shellescape} 2>/dev/null`
+        sha = listing[/\b([0-9A-F]{40})\b/, 1]
+        UI.die!("no codesigning identity in the delivered .p12") unless sha
+        remote_log("runner: signing identity #{listing[/"(.+)"/, 1]} (#{sha[0, 10]}…)")
+        sha
+      end
+
+      def run_release(src, job, signing_env, shell_dir)
+        remote_log("runner: every release (press → sign → notarize → staple)")
+        cmd = [RbConfig.ruby, "-I", lib_dir, every_exe, "release",
+               "--root", src,
+               "--target", "#{job.dig("target", "os")}-#{job.dig("target", "arch")}",
+               "--channel", job.dig("target", "distribution_channel").to_s]
+        cmd += ["--shell-dir", shell_dir] if shell_dir
+
+        success = stream(signing_env, cmd)
+
+        dist = File.join(src, "dist")
+        release_json = JSON.parse(File.read(File.join(dist, "release.json"))) rescue nil
+        zip = Dir[File.join(dist, "*.zip")].max_by { |f| File.mtime(f) }
+        [success ? "succeeded" : "failed", release_json, zip]
+      end
+
+      def complete_success(zip, release_json)
+        remote_log("runner: uploading artifact (#{(File.size(zip) / 1024.0 / 1024.0).round(1)}MB)")
+        signed_id = upload_artifact(zip)
+        post!("/runner/artifacts/#{@artifact}/complete",
+              status: "succeeded", file_signed_id: signed_id, release_json: release_json)
+        UI.success("build succeeded — #{File.basename(zip)}")
+      end
+
+      def complete_failure(message)
+        return if @completed
+
+        @client.post("/runner/artifacts/#{@artifact}/complete", status: "failed", error: message)
+        @completed = true
+      end
+
+      def upload_artifact(zip)
+        require_relative "../../platform/snapshot"
+        reservation = post!("/runner/artifacts/#{@artifact}/upload",
+          filename: File.basename(zip), byte_size: File.size(zip),
+          checksum: Everywhere::Platform::Snapshot.md5_base64(zip), content_type: "application/zip")
+        du = reservation["direct_upload"] || {}
+        res = @client.put_file(du["url"], zip, headers: du["headers"] || {})
+        UI.die!("artifact upload failed (HTTP #{res.code})") unless res.code.to_i.between?(200, 299)
+        reservation["signed_id"]
+      end
+
+      # ---- log streaming -------------------------------------------------------
+
+      # Run cmd, echoing output to this process's stdout AND forwarding it to the
+      # Platform log in ~400-byte batches so the web UI tails it live.
+      def stream(env, cmd)
+        buffer = +""
+        status = nil
+        Open3.popen2e(env, *cmd) do |stdin, out, wait|
+          stdin.close
+          out.each_line do |line|
+            $stdout.print(line)
+            buffer << line
+            (flush_log(buffer); buffer = +"") if buffer.bytesize >= 400
+          end
+          flush_log(buffer) unless buffer.empty?
+          status = wait.value
+        end
+        status&.success?
+      end
+
+      def flush_log(text)
+        @client.post("/runner/artifacts/#{@artifact}/logs", text: text)
+      rescue Everywhere::Error
+        nil # never let a log hiccup kill the build
+      end
+
+      def remote_log(message)
+        UI.step(message)
+        flush_log("#{message}\n")
+      end
+
+      # ---- helpers -------------------------------------------------------------
+
+      def get!(path)
+        res = @client.get(path)
+        UI.die!("runner API #{path} failed (HTTP #{res.status})") unless res.ok?
+        res.body
+      end
+
+      def post!(path, body)
+        res = @client.post(path, body)
+        UI.die!("runner API #{path} failed (HTTP #{res.status})") unless res.ok?
+        res.body
+      end
+
+      def patch!(path, body)
+        @client.patch(path, body)
+      end
+
+      def run_security(*args)
+        system("security", *args, out: File::NULL, err: File::NULL)
+      end
+
+      def restore_keychains
+        run_security("list-keychains", "-d", "user", "-s", *@saved_keychains) if @saved_keychains
+        run_security("delete-keychain", @keychain) if @keychain && File.exist?(@keychain)
+      end
+
+      def lib_dir  = File.expand_path("../../..", __dir__)
+      def every_exe = File.expand_path("../../../../exe/every", __dir__)
+    end
+  end
+end

data/lib/everywhere/commands/release.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require "dry/cli"
+require_relative "../shellout"
+require_relative "../receipt"
+require_relative "build"
+
+module Everywhere
+  module Commands
+    # Produce a signed, notarized, stapled, distributable artifact + release.json.
+    #
+    # `every release` wraps the existing signing engine
+    # (cli/support/macos/notarize.sh) rather than reimplementing
+    # codesign/notarytool, and emits the machine-readable receipt every build
+    # surface (local, CI, Platform) must produce. See
+    # platform/docs/build-engine.md §4, §7, §9.
+    #
+    # Today only the macos builder is live; the target is parameterized so
+    # ios/android/windows/linux slot in as builders later.
+    class Release < Dry::CLI::Command
+      NOTARIZE = File.expand_path("../../../support/macos/notarize.sh", __dir__)
+
+      desc "Sign, notarize, staple, and emit release.json for a distributable build"
+
+      option :root,       default: ".",              desc: "App root directory"
+      option :target,     default: "macos-arm64",    desc: "Build target (os-arch)"
+      option :channel,    default: "direct",         desc: "Distribution channel (direct | mac_app_store | ...)"
+      option :ruby,       default: nil,              desc: "Ruby version to package (default: build.ruby or 4.0.6)"
+      option :entry,      default: "native_boot.rb", desc: "Entry point script relative to root"
+      option :app_name,   default: nil,              desc: "Bundle name (default from config)"
+      option :shell_dir,  default: nil,              desc: "Path to the shell's src-tauri directory"
+      option :env_file,   default: nil,              desc: "dotenv file with APPLE_* signing secrets (default: .env.release)"
+      option :skip_build, type: :boolean, default: false, desc: "Notarize the existing .app instead of rebuilding"
+
+      def call(root: ".", target: "macos-arm64", channel: "direct", ruby: nil, entry: "native_boot.rb",
+               app_name: nil, shell_dir: nil, env_file: nil, skip_build: false, **)
+        root_path = File.expand_path(root)
+        config = Everywhere::Config.load(root_path)
+        app_name ||= config.name
+        ruby ||= config.build_ruby || "4.0.6"
+
+        preflight!(target)
+
+        framework = config.remote? ? nil : Framework.detect(root_path)
+        dist_dir = File.expand_path("dist", root_path)
+
+        # 1. Produce (or reuse) the signed-for-dev .app via the build path. The
+        #    notarize step below re-signs it inside-out with the Developer ID.
+        unless skip_build
+          UI.step("building #{UI.bold(app_name)} for #{UI.cyan(target)}")
+          Build.new.call(root: root, ruby: ruby, entry: entry, app_name: app_name, shell_dir: shell_dir, **)
+        end
+
+        app_dir = Dir[File.join(dist_dir, "*.app")].max_by { |d| File.mtime(d) }
+        UI.die!("no .app found in #{dist_dir} — run without --skip-build first") unless app_dir
+
+        # 2. Sign (Developer ID + hardened runtime) → notarize → staple → verify.
+        env_file ||= discover_env_file(root_path)
+        env = env_file ? { "ENV_FILE" => env_file } : {}
+        UI.step("signing + notarizing #{File.basename(app_dir)}#{env_file ? " #{UI.dim("(#{rel(env_file, root_path)})")}" : ""}")
+        UI.warn("no signing env found — set APPLE_* or pass --env-file (notarize.sh will fail without it)") unless env_file || ENV["APPLE_SIGNING_IDENTITY"]
+        log = "#{app_dir}.notarize.log"
+        Shellout.run_logged!(env, ["/bin/bash", NOTARIZE, app_dir], log: log)
+
+        # 3. Gather signing facts from the bundle itself, then emit the receipt.
+        artifact = "#{app_dir.sub(/\.app\z/, "")}.zip" # notarize.sh re-zips the stapled app
+        UI.die!("expected notarized zip #{artifact} not found") unless File.exist?(artifact)
+
+        signing = gather_signing(app_dir, log)
+        receipt = Receipt.new(root: root_path, config: config, framework: framework, ruby: ruby,
+                              target: target, channel: channel, shell_dir: resolve_shell_dir(shell_dir))
+        out = File.join(dist_dir, "release.json")
+        receipt.write(out, artifact: artifact, signing: signing)
+
+        summarize(out, artifact, signing, root_path)
+      end
+
+      private
+
+      def preflight!(target)
+        os = target.split("-", 2).first
+        UI.die!("only the macos target is implemented (got #{target}); other builders are stubs") unless os == "macos"
+        UI.die!("`every release` runs on macOS only") unless RUBY_PLATFORM.include?("darwin")
+        UI.die!("signing engine missing at #{NOTARIZE}") unless File.exist?(NOTARIZE)
+      end
+
+      # A .env.release next to the app, then at the repo root above it.
+      def discover_env_file(root_path)
+        [ENV["ENV_FILE"], File.join(root_path, ".env.release"), File.join(root_path, "..", ".env.release")]
+          .compact.find { |p| File.exist?(p) }
+      end
+
+      def resolve_shell_dir(given)
+        return File.expand_path(given) if given
+
+        ["shell/src-tauri", "../shell/src-tauri", "src-tauri"]
+          .map { |c| File.expand_path(c) }
+          .find { |c| File.exist?(File.join(c, "tauri.conf.json")) }
+      end
+
+      # Read the truth back off the bundle rather than trusting the script's log:
+      # a valid staple proves notarization; codesign/spctl prove signed/accepted.
+      def gather_signing(app_dir, log)
+        stapled = probe("xcrun", "stapler", "validate", app_dir)
+        {
+          "signed" => probe("codesign", "--verify", "--deep", "--strict", app_dir),
+          "signed_by" => team_id(app_dir),
+          "verified" => probe("spctl", "--assess", "--type", "execute", app_dir),
+          "platform" => {
+            "notarized" => stapled,
+            "stapled" => stapled,
+            "notarization_id" => notarization_id(log)
+          }.compact
+        }
+      end
+
+      def probe(*cmd) = Shellout.capture(*cmd).last&.success? || false
+
+      def team_id(app_dir)
+        out, status = Shellout.capture("codesign", "-dvv", app_dir)
+        (status&.success? && out[/TeamIdentifier=(\w+)/, 1]) || ENV["APPLE_TEAM_ID"]
+      end
+
+      def notarization_id(log)
+        File.exist?(log) ? File.read(log)[/\bid:\s*([0-9a-fA-F-]{36})/, 1] : nil
+      end
+
+      def summarize(out, artifact, signing, root_path)
+        UI.success("release ready")
+        UI.step("artifact: #{rel(artifact, root_path)} (#{(File.size(artifact) / 1024.0 / 1024.0).round}MB)")
+        UI.step("signed by #{signing["signed_by"] || "?"} · " \
+                "notarized #{yn(signing.dig("platform", "notarized"))} · " \
+                "stapled #{yn(signing.dig("platform", "stapled"))} · " \
+                "gatekeeper #{yn(signing["verified"])}")
+        UI.step("receipt: #{rel(out, root_path)}")
+      end
+
+      def yn(bool) = bool ? UI.green("yes") : UI.red("no")
+
+      def rel(path, root_path) = path.sub("#{root_path}/", "").sub("#{Dir.pwd}/", "")
+    end
+  end
+end

data/lib/everywhere/config.rb

@@ -0,0 +1,188 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module Everywhere
+  # Loads config/everywhere.yml:
+  #
+  #   app:
+  #     name: My Really Awesome App
+  #     entry_path: /dashboard        # initial url on app launch
+  #   appearance:
+  #     tint_color: "#CC342D"         # a hex string...
+  #     background_color:             # ...or split by system theme
+  #       light: "#FAF9F7"
+  #       dark: "#1C1B1A"
+  #
+  # Colors always normalize to { "light" => ..., "dark" => ... }.
+  class Config
+    FILE = File.join("config", "everywhere.yml")
+
+    def self.load(root = Dir.pwd)
+      path = File.join(root, FILE)
+      data = File.exist?(path) ? YAML.safe_load_file(path, aliases: true) || {} : {}
+      new(data, root)
+    end
+
+    attr_reader :root
+
+    def initialize(data, root)
+      @data = data
+      @root = root
+    end
+
+    def name
+      app["name"] || File.basename(File.expand_path(root)).split(/[-_]/).map(&:capitalize).join(" ")
+    end
+
+    # Reverse-DNS identifier: macOS bundle id, and the name of the per-user
+    # app-data directory on every platform. Set it explicitly and never change
+    # it — renaming moves users' data.
+    def bundle_id
+      app["bundle_id"] || "com.rubyeverywhere.#{name.downcase.gsub(/[^a-z0-9]+/, "-").gsub(/\A-|-\z/, "")}"
+    end
+
+    # App icon source: a PNG (ideally square, 1024px+). Explicit `app.icon`
+    # path relative to the app root, or icon.png at the root by convention.
+    def icon
+      if (explicit = app["icon"])
+        File.expand_path(explicit, root)
+      else
+        default = File.join(root, "icon.png")
+        File.exist?(default) ? default : nil
+      end
+    end
+
+    # Optional custom splash page (HTML file, path relative to the app root).
+    # Shown while the packaged server boots; the shell injects
+    # window.__EVERYWHERE_CONFIG__ so it can use the app's name and colors.
+    def splash
+      path = app["splash"]
+      File.expand_path(path, root) if path
+    end
+
+    def entry_path
+      path = app["entry_path"] || "/"
+      path.start_with?("/") ? path : "/#{path}"
+    end
+
+    # Marketing/display version of the app (CFBundleShortVersionString, and the
+    # `version` recorded in the build receipt). Defaults conservatively.
+    def version
+      app["version"] || "0.1.0"
+    end
+
+    # The `build:` section — durable build knobs that were once `every build`
+    # flags (ruby, targets, permissions). CLI flags still override per-run.
+    # See platform/docs/build-engine.md §2.
+    def build = @data.fetch("build", nil) || {}
+
+    # Ruby version to package. nil here means "let the CLI decide its default".
+    def build_ruby = build["ruby"]
+
+    # OS-integration permissions the app declares. Recorded in the receipt and
+    # (later) used to generate the shell's capabilities.
+    def permissions = Array(build["permissions"])
+
+    # Build targets (os-arch strings) — the CI matrix, expressed once.
+    def targets = Array(build["targets"])
+
+    # "local"  — the app is tebako-pressed and runs on-device (default)
+    # "remote" — thin shell around an already-deployed app: no press, no sidecar
+    def mode
+      app["mode"] || (remote_url ? "remote" : "local")
+    end
+
+    def remote? = mode == "remote"
+
+    def remote_url
+      @data.dig("remote", "url")&.chomp("/")
+    end
+
+    def tint_color
+      normalize_color(appearance["tint_color"])
+    end
+
+    def background_color
+      normalize_color(appearance["background_color"])
+    end
+
+    # Custom native menu items (macOS app menu). Each entry: label + path
+    # (+ optional accelerator), or "separator". Clicks arrive in the page as
+    # "everywhere:menu" events and navigate via Turbo.
+    def menu
+      entries = @data["menu"]
+      return [] unless entries.is_a?(Array)
+
+      entries.filter_map do |item|
+        if item == "separator" || (item.is_a?(Hash) && item["separator"])
+          { "separator" => true }
+        elsif item.is_a?(Hash) && item["label"] && item["path"]
+          { "label" => item["label"], "path" => item["path"],
+            "accelerator" => item["accelerator"] }.compact
+        end
+      end
+    end
+
+    # System tray: same entry shape as `menu:` plus `action: quit | show`.
+    #
+    #   tray:
+    #     - label: "Open My App"
+    #       action: show
+    #     - label: "New Note"
+    #       path: /notes/new
+    #     - separator
+    #     - label: Quit
+    #       action: quit
+    def tray
+      entries = @data["tray"]
+      return [] unless entries.is_a?(Array)
+
+      entries.filter_map do |item|
+        if item == "separator" || (item.is_a?(Hash) && item["separator"])
+          { "separator" => true }
+        elsif item.is_a?(Hash) && item["label"] && (item["path"] || item["action"])
+          { "label" => item["label"], "path" => item["path"],
+            "action" => item["action"] }.compact
+        end
+      end
+    end
+
+    # The subset the shell needs, shipped as JSON (env var in dev,
+    # Resources/everywhere.json inside a bundled .app).
+    def to_shell_hash
+      {
+        "name" => name,
+        "bundle_id" => bundle_id,
+        "mode" => mode,
+        "remote_url" => remote_url,
+        "entry_path" => entry_path,
+        "tint_color" => tint_color,
+        "background_color" => background_color,
+        "menu" => (menu unless menu.empty?),
+        "tray" => (tray unless tray.empty?)
+      }.compact
+    end
+
+    def to_shell_json
+      require "json"
+      JSON.generate(to_shell_hash)
+    end
+
+    private
+
+    def app = @data.fetch("app", nil) || {}
+    def appearance = @data.fetch("appearance", nil) || {}
+
+    def normalize_color(value)
+      case value
+      when String
+        { "light" => value, "dark" => value }
+      when Hash
+        light = value["light"] || value["dark"]
+        dark  = value["dark"] || value["light"]
+        { "light" => light, "dark" => dark } if light
+      end
+    end
+  end
+end

data/lib/everywhere/database.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # Framework-neutral database preparation for the packaged runtime: create the
+  # database if missing and bring it up to the latest migration, so a freshly
+  # installed desktop app has a working schema on first launch.
+  #
+  # Rather than hardcode one stack, prepare! adapts to whatever ORM the app has
+  # already loaded (it runs *after* the app boots):
+  #
+  #   * ActiveRecord — Rails uses the multi-db-aware prepare_all; a plain
+  #     ActiveRecord app (e.g. Sinatra + sinatra-activerecord) runs its
+  #     migrations in-process.
+  #   * Sequel — runs Sequel migrations against the app's database handle.
+  #
+  # Apps that need something else register a hook and own the whole step:
+  #
+  #   Everywhere.configure { |c| c.database { MyMigrator.run! } }
+  module Database
+    MIGRATION_DIRS = %w[db/migrate db/migrations config/db/migrate].freeze
+
+    module_function
+
+    def prepare!(root)
+      if (hook = Everywhere.config.database_hook)
+        return hook.call
+      end
+
+      if defined?(::ActiveRecord::Base)
+        prepare_active_record(root)
+      elsif defined?(::Sequel)
+        prepare_sequel(root)
+      else
+        log "no ActiveRecord/Sequel detected — skipping database prepare"
+      end
+    rescue StandardError => e
+      warn "[everywhere] database prepare failed: #{e.class}: #{e.message}"
+      raise
+    end
+
+    # Rails: prepare_all handles the primary/cache/queue/cable databases.
+    # Plain ActiveRecord: connect (sqlite creates the file on demand) and run
+    # any pending migrations found on disk.
+    def prepare_active_record(root)
+      if rails_app?
+        ::ActiveRecord::Tasks::DatabaseTasks.prepare_all
+        return
+      end
+
+      paths = migration_paths(root)
+      return log("no migrations found — skipping") if paths.empty?
+
+      # Opening the connection creates the sqlite file if it doesn't exist yet.
+      ::ActiveRecord::Base.connection
+      context = ::ActiveRecord::MigrationContext.new(paths)
+      unless context.needs_migration?
+        return log("database up to date")
+      end
+
+      log "migrating database"
+      context.migrate
+    end
+
+    def prepare_sequel(root)
+      db = Everywhere.config.sequel_db
+      db ||= ::Object.const_get(:DB) if ::Object.const_defined?(:DB)
+      return log("no Sequel database handle (set Everywhere.config.sequel_db)") unless db
+
+      paths = migration_paths(root)
+      return log("no migrations found — skipping") if paths.empty?
+
+      ::Sequel.extension :migration
+      paths.each { |dir| ::Sequel::Migrator.run(db, dir) }
+    end
+
+    def migration_paths(root)
+      MIGRATION_DIRS.map { |d| File.join(root, d) }.select { |p| Dir.exist?(p) }
+    end
+
+    def rails_app?
+      defined?(::Rails) && ::Rails.respond_to?(:application) && ::Rails.application &&
+        defined?(::ActiveRecord::Tasks::DatabaseTasks)
+    end
+
+    def log(message)
+      puts "[everywhere] #{message}"
+    end
+  end
+end