@geekmidas/cli 10.0.0-alpha.29 → 10.0.0-alpha.30

package/dist/index.cjs

@@ -1,12 +1,14 @@
 #!/usr/bin/env -S npx tsx
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_discover = require("./discover-BTh87DOO.cjs");
-const require_config = require("./config-BTFLHfRb.cjs");
+const require_discover = require("./discover-CroTIm0K.cjs");
+const require_config = require("./config-URVD4bTj.cjs");
 const require_workspace = require("./workspace-Bav3TVrP.cjs");
 const require_storage = require("./storage-C2JC31V9.cjs");
-const require_workspace$1 = require("./workspace-B3ApLW6p.cjs");
-const require_openapi = require("./openapi-K4H5tHzA.cjs");
+const require_workspace$1 = require("./workspace-BhiMkRuA.cjs");
+const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-D1nhN98m.cjs");
+const require_openapi = require("./openapi.cjs");
+const require_ready = require("./ready-DXtNfk7v.cjs");
 const require_emit = require("./emit-BdoPFjZf.cjs");
 const require_reconcile = require("./reconcile-BxZTV2vl.cjs");
 let commander = require("commander");
@@ -39,10 +41,8 @@ let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_subscribers = require("@geekmidas/constructs/subscribers");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
-let _geekmidas_envkit = require("@geekmidas/envkit");
-let _geekmidas_services = require("@geekmidas/services");
 //#region package.json
-var version = "10.0.0-alpha.29";
+var version = "10.0.0-alpha.30";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1091,6 +1091,9 @@ async function workspaceDevCommand(workspace, options) {
 		...rawSecrets,
 		...reconciled.env
 	};
+	await Promise.resolve().then(() => require("./migrate-BuCx7tIv.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
+	});
 	const appUrls = {};
 	for (const resource of reconciled.plan.resources) {
 		if (resource.kind !== "rest-api" && resource.kind !== "site") continue;
@@ -1784,7 +1787,7 @@ export async function stopCrons(): Promise<void> {
 		const handlerFileName = `${exportName}.ts`;
 		const handlerPath = (0, node_path.join)(outputDir, handlerFileName);
 		const importPath = (0, node_path.relative)((0, node_path.dirname)(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = require_openapi.runtimeFor(context, (0, node_path.dirname)(handlerPath), owner);
+		const runtime = require_OpenApiTsGenerator.runtimeFor(context, (0, node_path.dirname)(handlerPath), owner);
 		const content = `import { AWSScheduledFunction } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
 ${runtime.imports}
@@ -1799,111 +1802,6 @@ export const handler = adapter.handler;
 	}
 };
 //#endregion
-//#region src/generators/drivers.ts
-/**
-* Driver registration for generated entry points.
-*
-* A construct declares that it needs object storage and is handed one URL; the
-* scheme in that URL picks the driver that builds the client. Which drivers
-* exist is therefore the *entry point's* decision, not the construct's and not
-* the application's — an app that never talks to S3 should never resolve the AWS
-* SDK, and application code that registers a driver has named a provider in the
-* one layer this design keeps provider-free.
-*
-* So the generated entries register: `gkm dev`'s server for local development,
-* and each Lambda handler for its own target. Registration is an explicit call
-* rather than an import side effect, because a side-effecting module is exactly
-* what a bundler is entitled to drop.
-*/
-/** The `s3://` driver, which serves MinIO locally and S3 deployed. */
-const S3 = {
-	imports: `import { registerStorageDriver } from '@geekmidas/storage';\nimport { s3Driver } from '@geekmidas/storage/aws';`,
-	setup: "registerStorageDriver(s3Driver);"
-};
-const NONE = {
-	imports: "",
-	setup: ""
-};
-/**
-* The cache driver for a backend — exactly one, never all three.
-*
-* Keyed off the *backend* rather than off a dependency, because unlike storage
-* the backend already says which driver is right: a project caching in Postgres
-* resolves `pg` and never `ioredis`, and one caching in Upstash resolves
-* neither. That is the whole reason the drivers live behind separate subpaths.
-*
-* Both HTTP schemes are registered for Upstash, because the local proxy speaks
-* `http://` and Upstash speaks `https://`, and an entry that registered one
-* would work in exactly one of the two places.
-*/
-const CACHE_DRIVERS = {
-	upstash: {
-		imports: `import { registerCacheDriver } from '@geekmidas/cache';\nimport { upstashCacheDriver, upstashInsecureCacheDriver } from '@geekmidas/cache/upstash';`,
-		setup: "registerCacheDriver(upstashCacheDriver);\nregisterCacheDriver(upstashInsecureCacheDriver);"
-	},
-	elasticache: {
-		imports: `import { registerCacheDriver } from '@geekmidas/cache';\nimport { redisCacheDriver, redissCacheDriver } from '@geekmidas/cache/redis';`,
-		setup: "registerCacheDriver(redisCacheDriver);\nregisterCacheDriver(redissCacheDriver);"
-	},
-	db: {
-		imports: `import { registerCacheDriver } from '@geekmidas/cache';\nimport { postgresCacheDriver } from '@geekmidas/cache/postgres';`,
-		setup: "registerCacheDriver(postgresCacheDriver);"
-	}
-};
-/**
-* Everything a generated entry should register: object storage, and the cache.
-*
-* Merged here rather than threaded separately, because a generated file has one
-* import block and one setup block whatever fills them.
-*/
-function driversFor(options) {
-	const backends = options.cache === false || options.cache === void 0 ? [] : typeof options.cache === "string" ? [options.cache] : options.cache;
-	const parts = [storageDriversFor(options.appRoot), ...[...new Set(backends)].map((backend) => CACHE_DRIVERS[backend] ?? CACHE_DRIVERS[require_discover.DEFAULT_CACHE.aws])].filter((part) => part.imports || part.setup);
-	if (parts.length === 0) return NONE;
-	return {
-		imports: parts.map((part) => part.imports).join("\n"),
-		setup: parts.map((part) => part.setup).join("\n")
-	};
-}
-/**
-* Which cache backends an app's entry actually has to speak.
-*
-* The config answers this for a cache that named nowhere, and the *declaration*
-* answers it for one that named a database — `orders.cache('Sessions')` is a
-* statement about the application, so a deployment cannot move that cache and
-* the entry cannot register a driver for somewhere else.
-*
-* Reading only the config is how an entry ends up registering the Upstash
-* driver for a URL the target composed as `postgres://`, which fails at the
-* first request with `UnregisteredCacheScheme` and a stack that points at the
-* cache rather than at the config that disagreed.
-*/
-function cacheBackendsIn(manifest, configured) {
-	const caches = Object.values(manifest).filter((d) => d.kind === "cache");
-	return [...new Set(caches.map((c) => c.of ? "db" : configured))];
-}
-/**
-* The drivers an app's entry points should register.
-*
-* Keyed off the dependency rather than off a declared bucket, because the entry
-* is generated before discovery has run on the watcher's rebuild path — and an
-* app that installed `@geekmidas/storage` has already paid for the SDK it would
-* otherwise resolve lazily.
-*/
-function storageDriversFor(appRoot) {
-	return dependsOnStorage(appRoot) ? S3 : NONE;
-}
-function dependsOnStorage(appRoot) {
-	const manifest = (0, node_path.join)(appRoot, "package.json");
-	if (!(0, node_fs.existsSync)(manifest)) return false;
-	try {
-		const pkg = JSON.parse((0, node_fs.readFileSync)(manifest, "utf8"));
-		return Boolean(pkg.dependencies?.["@geekmidas/storage"] ?? pkg.devDependencies?.["@geekmidas/storage"]);
-	} catch {
-		return false;
-	}
-}
-//#endregion
 //#region src/generators/FunctionGenerator.ts
 var FunctionGenerator = class extends require_discover.ConstructGenerator {
 	isConstruct(value) {
@@ -1934,7 +1832,7 @@ var FunctionGenerator = class extends require_discover.ConstructGenerator {
 		const handlerFileName = `${exportName}.ts`;
 		const handlerPath = (0, node_path.join)(outputDir, handlerFileName);
 		const importPath = (0, node_path.relative)((0, node_path.dirname)(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = require_openapi.runtimeFor(context, (0, node_path.dirname)(handlerPath), owner);
+		const runtime = require_OpenApiTsGenerator.runtimeFor(context, (0, node_path.dirname)(handlerPath), owner);
 		const content = `import { AWSLambdaFunction } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
 ${runtime.imports}
@@ -1993,7 +1891,7 @@ var QueueGenerator = class extends require_discover.ConstructGenerator {
 	async generateQueueHandler(outputDir, sourceFile, exportName, context, owner) {
 		const handlerPath = (0, node_path.join)(outputDir, `${exportName}.ts`);
 		const importPath = (0, node_path.relative)((0, node_path.dirname)(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = require_openapi.runtimeFor(context, (0, node_path.dirname)(handlerPath), owner);
+		const runtime = require_OpenApiTsGenerator.runtimeFor(context, (0, node_path.dirname)(handlerPath), owner);
 		const content = `import { AWSLambdaQueue } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
 ${runtime.imports}
@@ -2173,7 +2071,7 @@ var SubscriberGenerator = class extends require_discover.ConstructGenerator {
 		const handlerFileName = `${exportName}.ts`;
 		const handlerPath = (0, node_path.join)(outputDir, handlerFileName);
 		const importPath = (0, node_path.relative)((0, node_path.dirname)(handlerPath), sourceFile).replace(/\.ts$/, ".js");
-		const runtime = require_openapi.runtimeFor(context, (0, node_path.dirname)(handlerPath), owner);
+		const runtime = require_OpenApiTsGenerator.runtimeFor(context, (0, node_path.dirname)(handlerPath), owner);
 		const content = `import { AWSLambdaSubscriber } from '@geekmidas/constructs/aws';
 import { ${exportName} } from '${importPath}';
 ${runtime.imports}
@@ -2827,13 +2725,13 @@ async function buildApp(input) {
 		constructGlobs,
 		cacheBackend,
 		emailBackend: "ses",
-		storageDrivers: driversFor({
+		storageDrivers: require_ready.driversFor({
 			appRoot,
-			cache: cacheBackendsIn(declared, cacheBackend)
+			cache: require_ready.cacheBackendsIn(declared, cacheBackend)
 		}),
 		markOptional: input.markOptional ?? false
 	};
-	const endpointGenerator = new require_openapi.EndpointGenerator();
+	const endpointGenerator = new require_OpenApiTsGenerator.EndpointGenerator();
 	const functionGenerator = new FunctionGenerator();
 	const cronGenerator = new CronGenerator();
 	const subscriberGenerator = new SubscriberGenerator();
@@ -8060,6 +7958,22 @@ function printStateDetails(state) {
 	}
 }
 //#endregion
+//#region src/migrate/names.ts
+/**
+* What a migration file is called: a UTC timestamp, then a name.
+*
+* Kept apart from the commands so the scaffold can name the migration it
+* writes the same way `gkm migration` does, without loading a migrator.
+*/
+/** UTC `YYYYMMDDHHmmss` — sorts as text, and reads as a date. */
+function stamp(now = /* @__PURE__ */ new Date()) {
+	return now.toISOString().replace(/\.\d+Z$/, "").replace(/\D/g, "");
+}
+/** `Add workouts` → `add_workouts`: the part of a file name after its stamp. */
+function slug(name) {
+	return name.trim().replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
+}
+//#endregion
 //#region src/init/constructs.ts
 /**
 * What a scaffolded project declares, and the keys that derive from it.
@@ -8176,7 +8090,7 @@ export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}', {
 */
 function usersMigration() {
 	return {
-		path: "src/db/migrations/001_create_users.ts",
+		path: `${(0, _geekmidas_manifest.migrationFolder)(databaseFor().id)}/${stamp()}_create_users.ts`,
 		content: `import type { Kysely } from 'kysely';
 
 export async function up(db: Kysely<unknown>): Promise<void> {
@@ -8339,7 +8253,7 @@ environment and fail in a way that looks like a config bug. Go through
 \`gkm exec --\`, which is what injects them.`);
 	if (!isWorker) sections.push(endpointSection(options));
 	if (isWorker || isServerless) sections.push(backgroundSection(template));
-	if (database) sections.push(databaseSection(), queriesSection());
+	if (database) sections.push(databaseSection(), migrationsSection(), queriesSection());
 	sections.push(`## Environment
 
 Environment is parsed once, through \`envkit\`, and never read from
@@ -8390,7 +8304,7 @@ function layoutBlock(options, template) {
 	const { database } = options.constructs;
 	const isWorker = template.name === "worker";
 	if (monorepo) return `constructs/          # every construct: the surface, the database, topics
-${apiPath}/            # the API app
+${database ? "db/<construct>/      # migrations, one folder per database construct\n" : ""}${apiPath}/            # the API app
 gkm.config.ts        # name, constructs glob, secrets`;
 	const lines = ["src/constructs/      # the surface, and anything it declares", "src/config/          # env parser, logger"];
 	if (!isWorker) lines.push("src/endpoints/       # HTTP handlers");
@@ -8398,7 +8312,7 @@ gkm.config.ts        # name, constructs glob, secrets`;
 		lines.push("src/crons/           # scheduled work");
 		lines.push("src/subscribers/     # topic consumers");
 	}
-	if (database) lines.push("src/db/              # migrations, schema");
+	if (database) lines.push("db/<construct>/      # migrations, one folder per database construct");
 	lines.push("gkm.config.ts        # name, constructs glob, secrets");
 	return lines.join("\n");
 }
@@ -8526,6 +8440,38 @@ export const monthly = router
 Queries go through Kysely. Never open your own connection pool — the one the
 construct provides is the one that gets credentials, pooling and shutdown.`;
 }
+function migrationsSection() {
+	return `## Migrations
+
+Each database construct has its own folder, named after the construct:
+\`Database\` is \`db/database/\`, a tenant \`AuthDatabase\` is
+\`db/auth-database/\`. Each keeps its own history, in its own schema, and is
+migrated as its own **owner** role — the role a handler runs as cannot create a
+table.
+
+\`\`\`bash
+gkm migration database add_workouts   # db/database/20260930143012_add_workouts.ts
+gkm migration auth                    # Better Auth's schema change, as SQL
+gkm migrate                           # apply every folder, parents first
+gkm migrate database                  # apply one construct's
+\`\`\`
+
+- Files are \`<UTC timestamp>_<name>.ts\` exporting \`up\` (and \`down\`), or
+  \`.sql\`, which runs whole. Never rename or edit one that has been applied —
+  it is recorded by name. Change the schema with a new migration.
+- Write migrations with \`Kysely<unknown>\` and snake_case names: they are the
+  SQL, and the camelCase plugin is the app's, not theirs.
+- \`gkm migration auth\` compares Better Auth's schema to its tenant and writes
+  only the difference. Run it after adding a Better Auth plugin, and commit the
+  file.
+- Tests migrate themselves: the root vitest config's
+  \`globalSetup: ['@geekmidas/cli/vitest']\` applies every folder to the test
+  stage before any test runs. \`gkm dev\` only reports what is pending.
+- A deploy migrates before the new version goes live, so the old version runs
+  against the new schema until it is replaced. Keep each migration compatible
+  with the code before it: add a column in one release, stop using the old one,
+  drop it in a later release.`;
+}
 function queriesSection() {
 	return `## Writing queries and relations
 
@@ -8675,7 +8621,6 @@ const DEPENDENCY_VERSIONS = {
 	hono: "~4.13.9",
 	"@hono/node-server": "~1.19.17",
 	kysely: "~0.29.6",
-	"kysely-ctl": "~0.21.0",
 	pg: "~8.23.0",
 	pino: "~10.3.1",
 	zod: "~4.6.5",
@@ -8782,26 +8727,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.29",
-	"@geekmidas/auth": "~10.0.0-alpha.29",
-	"@geekmidas/cache": "~10.0.0-alpha.29",
-	"@geekmidas/client": "~10.0.0-alpha.29",
-	"@geekmidas/cloud": "~10.0.0-alpha.29",
-	"@geekmidas/constructs": "~10.0.0-alpha.29",
-	"@geekmidas/db": "~10.0.0-alpha.29",
-	"@geekmidas/emailkit": "~10.0.0-alpha.29",
-	"@geekmidas/envkit": "~10.0.0-alpha.29",
-	"@geekmidas/errors": "~10.0.0-alpha.29",
-	"@geekmidas/events": "~10.0.0-alpha.29",
-	"@geekmidas/logger": "~10.0.0-alpha.29",
-	"@geekmidas/manifest": "~10.0.0-alpha.29",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.29",
-	"@geekmidas/schema": "~10.0.0-alpha.29",
-	"@geekmidas/services": "~10.0.0-alpha.29",
-	"@geekmidas/storage": "~10.0.0-alpha.29",
-	"@geekmidas/studio": "~10.0.0-alpha.29",
-	"@geekmidas/telescope": "~10.0.0-alpha.29",
-	"@geekmidas/testkit": "~10.0.0-alpha.29",
+	"@geekmidas/audit": "~10.0.0-alpha.30",
+	"@geekmidas/auth": "~10.0.0-alpha.30",
+	"@geekmidas/cache": "~10.0.0-alpha.30",
+	"@geekmidas/client": "~10.0.0-alpha.30",
+	"@geekmidas/cloud": "~10.0.0-alpha.30",
+	"@geekmidas/constructs": "~10.0.0-alpha.30",
+	"@geekmidas/db": "~10.0.0-alpha.30",
+	"@geekmidas/emailkit": "~10.0.0-alpha.30",
+	"@geekmidas/envkit": "~10.0.0-alpha.30",
+	"@geekmidas/errors": "~10.0.0-alpha.30",
+	"@geekmidas/events": "~10.0.0-alpha.30",
+	"@geekmidas/logger": "~10.0.0-alpha.30",
+	"@geekmidas/manifest": "~10.0.0-alpha.30",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.30",
+	"@geekmidas/schema": "~10.0.0-alpha.30",
+	"@geekmidas/services": "~10.0.0-alpha.30",
+	"@geekmidas/storage": "~10.0.0-alpha.30",
+	"@geekmidas/studio": "~10.0.0-alpha.30",
+	"@geekmidas/telescope": "~10.0.0-alpha.30",
+	"@geekmidas/testkit": "~10.0.0-alpha.30",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -8819,9 +8764,7 @@ function generateAuthAppFiles(options) {
 		type: "module",
 		scripts: {
 			dev: "gkm dev",
-			build: "gkm build",
-			"db:migrate": "gkm exec -- npx @better-auth/cli migrate",
-			"db:generate": "gkm exec -- npx @better-auth/cli generate"
+			build: "gkm build"
 		},
 		dependencies: {
 			[`@${options.name}/models`]: "workspace:*",
@@ -8901,16 +8844,24 @@ function stageEnv(stages) {
 //#endregion
 //#region src/init/generators/config.ts
 /**
-* Vitest config content with globalSetup for database-enabled apps
+* Vitest config for a database-enabled app.
+*
+* On its own, it is the root config and carries gkm's setup: the test stage
+* reconciled and every construct migrated, however the suite starts. In a
+* workspace the root config carries it instead — once, so no project filter
+* can skip it and nothing runs it twice.
 */
-const vitestConfigContent = `import { defineConfig } from 'vitest/config';
+const vitestConfigFor = (monorepo) => `import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
   // Vite resolves tsconfig \`paths\` itself; no plugin needed.
   resolve: { tsconfigPaths: true },
   test: {
-    environment: 'node',
-    globalSetup: './test/globalSetup.ts',
+    environment: 'node',${monorepo ? "" : `
+    // The test stage, reconciled and every database construct's migrations
+    // applied, before any test runs — whether \`gkm test\` or plain
+    // \`vitest\` started it.
+    globalSetup: ['@geekmidas/cli/vitest'],`}
   },
 });
 `;
@@ -8988,7 +8939,7 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 		}];
 		if (options.constructs.database) files.push({
 			path: "vitest.config.ts",
-			content: vitestConfigContent
+			content: vitestConfigFor(Boolean(options.monorepo))
 		});
 		return files;
 	}
@@ -9078,7 +9029,7 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 	];
 	if (options.constructs.database) files.push({
 		path: "vitest.config.ts",
-		content: vitestConfigContent
+		content: vitestConfigFor(Boolean(options.monorepo))
 	});
 	return files;
 }
@@ -9114,7 +9065,7 @@ function generateSingleAppConfigFiles(options, _template, _helpers) {
 	}];
 	if (options.constructs.database) files.push({
 		path: "vitest.config.ts",
-		content: vitestConfigContent
+		content: vitestConfigFor(Boolean(options.monorepo))
 	});
 	return files;
 }
@@ -10561,8 +10512,12 @@ ${isSst ? "\n# SST\n.sst/\n" : ""}`;
 
 export default defineConfig({
   test: {
-    // Each app and package is its own project, so its own config — an app's
-    // \`globalSetup\`, its path aliases — applies to its own tests.
+    // The test stage, reconciled and every database construct's migrations
+    // applied, before any project's tests start — declared here, once, so no
+    // project filter can skip it and nothing runs it twice.
+    globalSetup: ['@geekmidas/cli/vitest'],
+    // Each app and package is its own project, so its own config — its path
+    // aliases — applies to its own tests.
     projects: ['apps/*', 'packages/*'],
     // The shared packages ship without tests of their own.
     passWithNoTests: true,
@@ -10780,6 +10735,7 @@ export const database = new KyselyDatabase<Database, '${db.id}'>('${db.id}', {
 export const authDb = database.schema<Record<string, never>, 'AuthDb'>('AuthDb');
 `
 	});
+	files.push(usersMigration());
 	files.push({
 		path: "constructs/auth.ts",
 		content: `import { BetterAuth } from '@geekmidas/constructs/auth';
@@ -11168,7 +11124,6 @@ export const router = api${options.constructs.database ? ".database(database)" :
 `
 		});
 		if (options.constructs.database && declares) files.push(...databaseFiles());
-		else if (options.constructs.database) files.push(usersMigration());
 		if (uploads && declares) files.push({
 			path: "src/constructs/storage.ts",
 			content: `import { ObjectStorage } from '@geekmidas/constructs/object-storage';
@@ -11936,7 +11891,6 @@ function generatePackageJson(options, template) {
 		devDependencies["@types/pg"] = DEPENDENCY_VERSIONS["@types/pg"];
 		devDependencies["@geekmidas/testkit"] = GEEKMIDAS_VERSIONS["@geekmidas/testkit"];
 		devDependencies["@faker-js/faker"] = DEPENDENCY_VERSIONS["@faker-js/faker"];
-		devDependencies["kysely-ctl"] = DEPENDENCY_VERSIONS["kysely-ctl"];
 	}
 	if (monorepo) {
 		delete devDependencies["@biomejs/biome"];
@@ -11987,38 +11941,16 @@ function generateSourceFiles(options, template) {
 //#region src/init/generators/test.ts
 /**
 * Generate test infrastructure files when database is enabled.
-* Includes transaction-isolated test config, global setup with migrations,
+* Includes transaction-isolated test config,
 * factory system with builders/seeds, and an example spec.
 */
 function generateTestFiles(options, _template) {
 	if (!options.constructs.database) return [];
 	const db = databaseFor();
 	const schema = !options.monorepo ? "../src/constructs/database.ts" : `@${options.name}/constructs/database.ts`;
-	const runtimeUrl = db.urlKey;
-	const ownerUrl = db.ownerUrlKey;
+	db.urlKey;
+	db.ownerUrlKey;
 	return [
-		{
-			path: "kysely.config.ts",
-			content: `import { Credentials } from '@geekmidas/envkit/credentials';
-import { PostgresDialect } from 'kysely';
-import { defineConfig } from 'kysely-ctl';
-import pg from 'pg';
-
-// The owner role's URL — the one that may create, alter, and drop. Both keys
-// are published by the declared database construct; run this under
-// \`gkm exec -- pnpm kysely migrate:latest\` so they are injected.
-const url = Credentials.${ownerUrl} ?? Credentials.${runtimeUrl};
-
-export default defineConfig({
-  dialect: new PostgresDialect({
-    pool: new pg.Pool({ connectionString: url }),
-  }),
-  migrations: {
-    migrationFolder: './src/db/migrations',
-  },
-});
-`
-		},
 		{
 			path: "test/config.ts",
 			content: `import { it as itVitest } from 'vitest';
@@ -12030,44 +11962,6 @@ export const it = wrapVitestKyselyTransaction<Database>(itVitest, {
   // the plugins it was given, \`CamelCasePlugin\` included.
   connection: database,
 });
-`
-		},
-		{
-			path: "test/globalSetup.ts",
-			content: `import fs from 'node:fs/promises';
-import path from 'node:path';
-import { Credentials } from '@geekmidas/envkit/credentials';
-import { PostgresKyselyMigrator } from '@geekmidas/testkit/kysely';
-import { Kysely, PostgresDialect } from 'kysely';
-import { FileMigrationProvider } from 'kysely/migration';
-import pg from 'pg';
-
-export default async function globalSetup() {
-  // \`gkm test\` reconciles the test stage before this runs: the container is
-  // up, the database exists, and its roles are created. What is left is the
-  // schema, which is what migrations are for.
-  const databaseUrl = Credentials.${ownerUrl} ?? Credentials.${runtimeUrl}!;
-  const migrationFolder = path.resolve(import.meta.dirname, '../src/db/migrations');
-
-  const db = new Kysely({
-    dialect: new PostgresDialect({
-      pool: new pg.Pool({ connectionString: databaseUrl }),
-    }),
-  });
-
-  const migrator = new PostgresKyselyMigrator({
-    uri: databaseUrl,
-    db,
-    provider: new FileMigrationProvider({
-      fs,
-      path,
-      migrationFolder,
-    }),
-  });
-
-  const teardown = await migrator.start();
-  return teardown;
-}
 `
 		},
 		{
@@ -14695,10 +14589,14 @@ function printNextSteps(projectName, options, pkgManager) {
 	console.log("Next steps:\n");
 	console.log(`  ${cdCommand}`);
 	console.log(`  ${devCommand}`);
-	if (!options.monorepo && options.constructs.database) {
+	if (options.constructs.database) {
 		console.log("");
-		console.log("  # Then, once the container is up:");
-		console.log(`  gkm exec -- pnpm kysely migrate:latest`);
+		console.log("  # Apply each database construct's db/<construct>/ migrations:");
+		console.log("  gkm migrate");
+		if (options.monorepo) {
+			console.log("  # Better Auth's tables, as its tenant's first migration:");
+			console.log("  gkm migration auth && gkm migrate");
+		}
 	}
 	console.log("");
 	if (options.monorepo) {
@@ -15050,7 +14948,7 @@ var NoStoredSecrets = class extends Error {
 	}
 };
 async function reconcile(secrets, workspace, stage) {
-	const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-B3ApLW6p.cjs")).then((n) => n.workspace_exports);
+	const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-BhiMkRuA.cjs")).then((n) => n.workspace_exports);
 	const result = require_reconcile.reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 	return result ? {
 		secrets: result.secrets,
@@ -15349,231 +15247,6 @@ function printSummary(workspace, stage) {
 	logger$1.log("");
 }
 //#endregion
-//#region src/test/harness.ts
-/**
-* What `gkm test` writes for a feature test to be built from.
-*
-* `gkm test` already discovers an app's constructs and resolves the test
-* stage's environment; this keeps both, under `.gkm/test/`:
-*
-* - `manifest.json` — which construct and endpoint is exported where, and the
-*   environment the test stage resolved, keyed as the constructs derive keys.
-* - `clients/<surface>.ts` — each surface's typed client, from the same
-*   generator `gkm build` uses for the app's own.
-* - `index.ts` — the configured `it`, and a `Browser` holding one client per
-*   surface and one per auth server, each on the browser's `fetch`.
-*
-* A test imports `it` from there and declares nothing — not a construct, not an
-* environment key, not a client.
-*/
-/**
-* The variable the manifest's path travels in — what
-* `@geekmidas/constructs/testing` reads. Its own constant rather than an import:
-* that entry carries the whole harness (MSW, Hono, Vitest), and importing it
-* here put all of it on the start-up path of every `gkm` command.
-*/
-const TEST_MANIFEST_ENV = "GKM_TEST_MANIFEST";
-/** Where the harness lives, relative to the workspace root. */
-const TEST_HARNESS_DIR = ".gkm/test";
-/**
-* Better-auth's client plugin for each server plugin id.
-*
-* Written down rather than derived: the ids and the client names do not follow
-* one rule (`admin` pairs with `adminClient`, `email-otp` with
-* `emailOTPClient`), and a guess that missed would hand a test a client
-* silently lacking every method of that plugin. A server plugin not listed has
-* no client counterpart — `bearer`, `open-api` — or needs one from another
-* package, and is left out.
-*/
-const CLIENT_PLUGINS = {
-	admin: "adminClient",
-	anonymous: "anonymousClient",
-	"device-authorization": "deviceAuthorizationClient",
-	"email-otp": "emailOTPClient",
-	jwt: "jwtClient",
-	"last-login-method": "lastLoginMethodClient",
-	"magic-link": "magicLinkClient",
-	"multi-session": "multiSessionClient",
-	"oauth-popup": "oauthPopupClient",
-	"one-tap": "oneTapClient",
-	"one-time-token": "oneTimeTokenClient",
-	organization: "organizationClient",
-	"phone-number": "phoneNumberClient",
-	siwe: "siweClient",
-	"two-factor": "twoFactorClient",
-	username: "usernameClient"
-};
-/** Write the manifest, the clients and the harness; return the manifest path. */
-async function writeTestHarness(options) {
-	const sources = {};
-	const declared = await require_discover.discover({
-		patterns: options.patterns,
-		cwd: options.root,
-		sources
-	});
-	const endpoints = (await new require_openapi.EndpointGenerator().load(options.patterns, options.root)).map(({ key, construct, path }) => ({
-		surface: construct.owner ?? construct.surface?.id,
-		construct,
-		source: {
-			file: path.absolute,
-			export: key
-		}
-	})).filter((endpoint) => endpoint.surface !== void 0);
-	const manifest = {
-		stage: options.stage,
-		constructs: Object.fromEntries(Object.entries(declared).flatMap(([id, declaration]) => {
-			const source = sources[id];
-			return source ? [[id, {
-				kind: declaration.kind,
-				source: {
-					file: source.file,
-					export: source.exportName
-				}
-			}]] : [];
-		})),
-		endpoints: endpoints.map(({ surface, source }) => ({
-			surface,
-			source
-		})),
-		env: options.env
-	};
-	const surfaces = [...new Set(endpoints.map(({ surface }) => surface))];
-	const generator = new require_openapi.OpenApiTsGenerator();
-	const clients = await Promise.all(surfaces.map(async (surface) => ({
-		file: `${(0, _geekmidas_manifest.kebabCase)(surface)}.ts`,
-		content: await generator.generate(endpoints.filter((endpoint) => endpoint.surface === surface).map(({ construct }) => construct), {
-			title: surface,
-			version: "1.0.0"
-		})
-	})));
-	const auths = await authClients(declared, sources, options.env);
-	const drivers = driversFor({
-		appRoot: options.root,
-		cache: cacheBackendsIn(declared, options.cacheBackend)
-	});
-	const database = await databaseSource(declared, sources, endpoints.map(({ construct }) => construct));
-	const files = [.../* @__PURE__ */ new Set([...Object.values(manifest.constructs).map(({ source }) => source.file), ...manifest.endpoints.map(({ source }) => source.file)])];
-	const harnessFor = (dir) => harnessModule({
-		dir,
-		files,
-		database,
-		surfaces: surfaces.map((id, index) => ({
-			id,
-			secured: clients[index].content.includes("authStrategies:")
-		})),
-		auths,
-		drivers
-	});
-	const json = `${JSON.stringify(manifest, null, 2)}\n`;
-	return (await Promise.all([...new Set(options.targets)].map(async (target) => {
-		const dir = (0, node_path.join)(target, TEST_HARNESS_DIR);
-		await (0, node_fs_promises.rm)(dir, {
-			recursive: true,
-			force: true
-		});
-		await (0, node_fs_promises.mkdir)((0, node_path.join)(dir, "clients"), { recursive: true });
-		await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "manifest.json"), json);
-		await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "index.ts"), harnessFor(dir));
-		for (const client of clients) await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "clients", client.file), client.content);
-		return (0, node_path.join)(dir, "manifest.json");
-	})))[0];
-}
-/** Each auth server, with the client plugins its server plugins pair with. */
-async function authClients(declared, sources, env) {
-	const clients = [];
-	const envParser = new _geekmidas_envkit.EnvironmentParser({ ...env });
-	for (const [id, declaration] of Object.entries(declared)) {
-		const source = sources[id];
-		if (declaration.kind !== "rest-api" || !source) continue;
-		const exported = (await import(source.file))[source.exportName];
-		if (!isBetterAuth(exported) || exported.id !== id) continue;
-		const ids = await exported.pluginIds({
-			envParser,
-			context: _geekmidas_services.serviceContext
-		});
-		clients.push({
-			id,
-			basePath: exported.basePath,
-			plugins: ids.flatMap((plugin) => CLIENT_PLUGINS[plugin] ?? [])
-		});
-	}
-	return clients;
-}
-function isBetterAuth(value) {
-	return typeof value === "object" && value !== null && "pluginIds" in value && "basePath" in value;
-}
-/** `Api` → `api`, `AdminApi` → `adminApi`: a construct id as a property name. */
-function propertyOf(id) {
-	return id.charAt(0).toLowerCase() + id.slice(1);
-}
-/**
-* The database a test's `db` is — the one the endpoints were given with
-* `.database()`, found by the service they hold, which is the construct's own.
-* The same rule `featureTest` applies at runtime, applied here so `db` can be
-* typed by the construct's schema.
-*/
-async function databaseSource(declared, sources, endpoints) {
-	const services = new Set(endpoints.map((endpoint) => endpoint.databaseService).filter(Boolean));
-	if (services.size === 0) return void 0;
-	for (const [id, declaration] of Object.entries(declared)) {
-		const source = sources[id];
-		if (!source || !declaration.kind.startsWith("database")) continue;
-		const exported = (await import(source.file))[source.exportName];
-		if (services.has(exported?.service)) return source;
-	}
-}
-/** An import specifier for `file`, from the harness written into `dir`. */
-function specifierFrom(dir, file) {
-	const path = (0, node_path.relative)(dir, file).replace(/\.tsx?$/, ".js");
-	return path.startsWith(".") ? path : `./${path}`;
-}
-function harnessModule(options) {
-	const { surfaces, auths, drivers, database, dir, files } = options;
-	const plugins = [...new Set(auths.flatMap(({ plugins }) => plugins))].sort();
-	const imports = [
-		`import {${database ? " type DatabaseOf," : ""} featureTest, loadTestManifest } from '@geekmidas/constructs/testing';`,
-		...database ? [`import type { ${database.exportName} as __database } from '${specifierFrom(dir, database.file)}';`] : [],
-		`import { Browser as TestBrowser } from '@geekmidas/testkit/browser';`,
-		...surfaces.map(({ id }) => `import { createApi as create${id} } from './clients/${(0, _geekmidas_manifest.kebabCase)(id)}.js';`),
-		...auths.length ? [`import { createAuthClient } from 'better-auth/client';`] : [],
-		...plugins.length ? [`import { ${plugins.join(", ")} } from 'better-auth/client/plugins';`] : [],
-		...drivers.imports ? [drivers.imports] : [],
-		...files.map((file, index) => `import * as __module${index} from '${specifierFrom(dir, file)}';`)
-	];
-	const url = (id) => `manifest.env[${JSON.stringify((0, _geekmidas_manifest.provideKey)(id, "url"))}]!`;
-	const members = [...surfaces.map(({ id, secured }) => `	/** \`${id}\`, at ${(0, _geekmidas_manifest.provideKey)(id, "url")}. */
-	readonly ${propertyOf(id)} = create${id}({
-		baseURL: ${url(id)},
-		fetch: this.fetch,${secured ? `
-		// Served in-process: no authorizer runs, so nothing is signed. A scheme
-		// with no strategy sends its request without credentials.
-		authStrategies: {} as never,` : ""}
-	});`), ...auths.map((auth) => `	/** \`${auth.id}\`, at ${(0, _geekmidas_manifest.provideKey)(auth.id, "url")}. */
-	readonly ${propertyOf(auth.id)} = createAuthClient({
-		baseURL: \`\${${url(auth.id)}}${auth.basePath}\`,
-		plugins: [${auth.plugins.map((plugin) => `${plugin}()`).join(", ")}],
-		fetchOptions: { customFetchImpl: this.fetch },
-	});`)];
-	return `// Generated by \`gkm test\` from the app's constructs — do not edit.
-${imports.join("\n")}
-
-${drivers.setup ? `// The drivers the app's server entry registers, registered the same way.\n${drivers.setup}\n\n` : ""}const manifest = loadTestManifest(new URL('./manifest.json', import.meta.url));
-
-/** A browser with a client for every surface the app declares. */
-export class Browser extends TestBrowser {
-${members.join("\n\n")}
-}
-
-/** The app's modules, by the path the manifest records for each. */
-const modules = {
-${files.map((file, index) => `\t${JSON.stringify(file)}: __module${index},`).join("\n")}
-};
-
-/** \`it\`, for a test that drives the app the way it runs deployed. */
-export const it = featureTest${database ? "<Browser, DatabaseOf<typeof __database>>" : ""}({ manifest, modules, browser: Browser });
-`;
-}
-//#endregion
 //#region src/test/index.ts
 /**
 * Run tests with secrets, dependency URLs, and .env files loaded.
@@ -15613,7 +15286,7 @@ async function testCommand(options = {}) {
 	const preloadPath = (0, node_path.join)(gkmDir, "test-credentials-preload.ts");
 	await require_workspace$1.createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const workspace = await require_config.loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
-	const manifestPath = workspace ? await writeTestHarness({
+	const manifestPath = workspace ? await require_ready.writeTestHarness({
 		root: workspace.root,
 		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => (0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspace.root, app.path))],
 		patterns: require_workspace$1.constructGlobs(workspace),
@@ -15625,6 +15298,16 @@ async function testCommand(options = {}) {
 		console.log(manifestPath ? `  🧪 Test harness written beside ${manifestPath}` : "  🧪 Nothing to prepare: this project declares no constructs");
 		return;
 	}
+	if (workspace) await migrateTestStage(workspace, result.credentials);
+	const readyPath = (0, node_path.join)(cwd, require_ready.TEST_READY_FILE);
+	await (0, node_fs_promises.writeFile)(readyPath, JSON.stringify({
+		env: result.secretsJsonPath,
+		...manifestPath ? { manifest: manifestPath } : {}
+	}, null, 2));
+	if (options.setup) {
+		console.log(`  🧪 Test stage ready: ${require_ready.TEST_READY_FILE}`);
+		return;
+	}
 	const nodeOptions = [
 		process.env.NODE_OPTIONS ?? "",
 		"--import=tsx",
@@ -15642,7 +15325,8 @@ async function testCommand(options = {}) {
 		env: {
 			...process.env,
 			...finalCredentials,
-			...manifestPath ? { [TEST_MANIFEST_ENV]: manifestPath } : {},
+			...manifestPath ? { [require_ready.TEST_MANIFEST_ENV]: manifestPath } : {},
+			[require_ready.TEST_READY_ENV]: readyPath,
 			NODE_ENV: "test",
 			NODE_OPTIONS: nodeOptions
 		}
@@ -15657,6 +15341,24 @@ async function testCommand(options = {}) {
 		});
 	});
 }
+/** Apply every construct's migrations to the test stage just reconciled. */
+async function migrateTestStage(workspace, env) {
+	const { migrateDatabases } = await Promise.resolve().then(() => require("./migrate-BuCx7tIv.cjs"));
+	const { discover } = await Promise.resolve().then(() => require("./discover-CroTIm0K.cjs")).then((n) => n.discover_exports);
+	const sources = {};
+	const manifest = await discover({
+		patterns: require_workspace$1.constructGlobs(workspace),
+		cwd: workspace.root,
+		sources
+	});
+	const runs = await migrateDatabases({
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	});
+	for (const { target, applied } of runs) if (applied.length > 0) console.log(`  🗄️  ${target.folder}: applied ${applied.join(", ")}`);
+}
 /** `gkm test` outside a project that declares stages, with none named. */
 var NoStageToTest = class extends Error {
 	constructor() {
@@ -16065,7 +15767,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		process.exit(1);
 	}
 });
-program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
+program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile and migrate the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -16078,6 +15780,34 @@ program.command("test").description("Run tests with secrets loaded from environm
 		process.exit(1);
 	}
 });
+program.command("migrate").description("Apply each database construct's migrations from db/<construct>/, as its owner").argument("[construct]", "Only this construct, by name").option("--stage <stage>", "The local stage (default) or test — a deploy migrates its own stage").action(async (construct, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BuCx7tIv.cjs"));
+		await migrateCommand({
+			...options,
+			...construct ? { construct } : {}
+		});
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
+program.command("migration").description("Write a construct's next migration: an empty one for a database, the schema change for an auth server").argument("<construct>", "The construct, by name").argument("[name]", "What the migration is called").action(async (construct, name) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BuCx7tIv.cjs"));
+		await migrationCommand({
+			construct,
+			...name ? { name } : {}
+		});
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("cron").description("Manage cron jobs").action(() => {
 	const globalOptions = program.opts();
 	if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -16236,7 +15966,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-B3ApLW6p.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-BhiMkRuA.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16295,7 +16025,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-ZL3RcUVD.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-B2fis34P.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16429,5 +16159,7 @@ Object.defineProperty(exports, "encryption_exports", {
 exports.getHostingerToken = getHostingerToken;
 exports.isRemoteStore = isRemoteStore;
 exports.pushStageSecrets = pushStageSecrets;
+exports.slug = slug;
+exports.stamp = stamp;
 
 //# sourceMappingURL=index.cjs.map