@geekmidas/cli 10.0.0-alpha.4 → 10.0.0-alpha.40

package/dist/migrate-CFOUApUt.cjs

@@ -0,0 +1,743 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_discover = require("./discover-B0f_kuNN.cjs");
+const require_config = require("./config-CJ-PAb7M.cjs");
+const require_workspace = require("./workspace-RYSYtHP7.cjs");
+const require_store = require("./store-DQgxT_WR.cjs");
+const require_workspace$1 = require("./workspace-BIqeeqcR.cjs");
+const require_index = require("./index.cjs");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let node_module = require("node:module");
+let node_url = require("node:url");
+let pg = require("pg");
+pg = require_rolldown_runtime.__toESM(pg, 1);
+let _geekmidas_envkit = require("@geekmidas/envkit");
+let _geekmidas_services = require("@geekmidas/services");
+//#region src/migrate/provider.ts
+/**
+* One construct's migrations and seeds, read from its folders.
+*
+* Two kinds of file, told apart by extension rather than by configuration: a
+* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
+* `seeds/` — and a
+* `.sql` file is run whole. The second is what makes a folder independent of
+* the client the app uses — Better Auth's schema is SQL whatever the
+* application queries with.
+*/
+const SCRIPTS = /* @__PURE__ */ new Set([
+	".ts",
+	".mts",
+	".js",
+	".mjs"
+]);
+/** Two files in one folder that would be one migration. */
+var DuplicateMigration = class extends Error {
+	folder;
+	migration;
+	constructor(folder, migration) {
+		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
+		this.folder = folder;
+		this.migration = migration;
+		this.name = "DuplicateMigration";
+	}
+};
+/** A script in a migrations folder that exports no `up`. */
+var MigrationHasNoUp = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
+		this.file = file;
+		this.name = "MigrationHasNoUp";
+	}
+};
+/** A script in a seeds folder that exports no `seed`. */
+var SeedHasNoSeed = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
+		this.file = file;
+		this.name = "SeedHasNoSeed";
+	}
+};
+/**
+* The migration files in a folder, by name, without reading them.
+*
+* Also what `gkm dev` compares against a construct's history to report what
+* is pending, which is why it is separate from loading them.
+*/
+async function migrationFiles(folder) {
+	const entries = await (0, node_fs_promises.readdir)(folder, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	});
+	const files = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (!entry.isFile() || !isMigration(entry.name)) continue;
+		const name = entry.name.slice(0, -(0, node_path.extname)(entry.name).length);
+		if (files.has(name)) throw new DuplicateMigration(folder, name);
+		files.set(name, (0, node_path.join)(folder, entry.name));
+	}
+	return files;
+}
+/** A Kysely provider over one construct's folder. */
+function folderProvider(folder, raw) {
+	return { async getMigrations() {
+		const migrations = {};
+		for (const [name, file] of await migrationFiles(folder)) migrations[name] = (0, node_path.extname)(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
+		return migrations;
+	} };
+}
+/**
+* The seeds in a folder, loaded, in name order.
+*
+* Every one runs on every pass — there is no history to consult — so the order
+* is the only thing between two seeds where one reads what another writes.
+* Name them to sort that way.
+*/
+async function loadSeeds(folder, raw) {
+	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const seeds = [];
+	for (const [name, file] of files) seeds.push({
+		name,
+		run: (0, node_path.extname)(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
+	});
+	return seeds;
+}
+/**
+* A seed script, imported as it is on disk now.
+*
+* Keyed by its modification time: a seed is run again after it is edited, and
+* a process that has imported it once would otherwise run the old one.
+*/
+async function scriptSeed(file) {
+	const url = (0, node_url.pathToFileURL)(file);
+	url.searchParams.set("mtime", String((await (0, node_fs_promises.stat)(file)).mtimeMs));
+	const module = await import(url.href);
+	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
+	return module.seed;
+}
+function isMigration(file) {
+	if (file.endsWith(".d.ts")) return false;
+	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
+	const extension = (0, node_path.extname)(file);
+	return extension === ".sql" || SCRIPTS.has(extension);
+}
+async function scriptMigration(file) {
+	const module = await import((0, node_url.pathToFileURL)(file).href);
+	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
+	return {
+		up: module.up,
+		...typeof module.down === "function" ? { down: module.down } : {}
+	};
+}
+/**
+* A `.sql` file, run whole.
+*
+* One query rather than split on `;`: with no parameters, Postgres takes
+* several statements in one message, and splitting by hand breaks on the first
+* `;` inside a string or a function body. There is no `down` — a generated
+* schema is rolled back by a migration that says how, not by guessing.
+*/
+async function sqlMigration(file, raw) {
+	const statements = await (0, node_fs_promises.readFile)(file, "utf-8");
+	return { up: async (db) => {
+		await raw.raw(statements).execute(db);
+	} };
+}
+//#endregion
+//#region src/migrate/databases.ts
+/**
+* Bring each construct's schema up to its migrations folder.
+*
+* Which constructs, in what order, from which folder, is `migrationTargets`'
+* answer and nobody else's. What is decided here is only how one target is
+* run: as its owner, in its own schema, with a history of its own.
+*/
+/** A folder under `db/` that names no construct. */
+var UnknownMigrationFolder = class extends Error {
+	folder;
+	known;
+	constructor(folder, known) {
+		super(`${folder} names no database construct, so its migrations would never run. ${known.length > 0 ? `The folders that do: ${known.join(", ")}.` : "This project declares no database."} Rename the folder after the construct it belongs to.`);
+		this.folder = folder;
+		this.known = known;
+		this.name = "UnknownMigrationFolder";
+	}
+};
+/** A construct was asked for by a name that takes no migrations. */
+var NoSuchMigrationTarget = class extends Error {
+	construct;
+	known;
+	constructor(construct, known) {
+		super(`'${construct}' is not a database construct. ` + (known.length > 0 ? `The ones with migrations: ${known.join(", ")}.` : "This project declares no database."));
+		this.construct = construct;
+		this.known = known;
+		this.name = "NoSuchMigrationTarget";
+	}
+};
+/**
+* A migration left directly in a construct's folder, where nothing reads it.
+*
+* Migrations moved into `migrations/` so seeds could sit beside them. A file
+* still at the old level would otherwise never run, and nothing would say so.
+*/
+var MigrationsOutsideFolder = class extends Error {
+	folder;
+	files;
+	constructor(folder, files) {
+		super(`${folder} has ${files.join(", ")} directly inside it, where nothing runs them. Migrations live in ${folder}/migrations/ and seeds in ${folder}/seeds/ — move ${files.length === 1 ? "it" : "them"} there.`);
+		this.folder = folder;
+		this.files = files;
+		this.name = "MigrationsOutsideFolder";
+	}
+};
+/** A folder inside a construct's folder that is neither `migrations` nor `seeds`. */
+var UnknownDatabaseFolder = class extends Error {
+	folder;
+	constructor(folder) {
+		super(`${folder} is neither migrations/ nor seeds/, so nothing in it would ever run. A construct's folder holds those two; rename or remove it.`);
+		this.folder = folder;
+		this.name = "UnknownDatabaseFolder";
+	}
+};
+/** A seed failed; its own writes are rolled back, the ones before it stay. */
+var SeedFailed = class extends Error {
+	construct;
+	seed;
+	cause;
+	constructor(construct, seed, cause) {
+		super(`${construct}: seed '${seed}' failed — ${cause instanceof Error ? cause.message : String(cause)}. Its writes were rolled back; fix it and run it again.`);
+		this.construct = construct;
+		this.seed = seed;
+		this.cause = cause;
+		this.name = "SeedFailed";
+	}
+};
+/** A construct with roles has no owner URL to migrate with. */
+var NoOwnerCredential = class extends Error {
+	construct;
+	key;
+	constructor(construct, key) {
+		super(`${construct} has no ${key} to migrate with. Migrations run as the owner role — the runtime one cannot create a table — and nothing resolved its URL. Is the stage reconciled?`);
+		this.construct = construct;
+		this.key = key;
+		this.name = "NoOwnerCredential";
+	}
+};
+/** A migration failed; the ones before it in the run stay applied. */
+var MigrationFailed = class extends Error {
+	construct;
+	migration;
+	cause;
+	constructor(construct, migration, cause) {
+		super(`${construct}: migration ${migration ? `'${migration}' ` : ""}failed — ${cause instanceof Error ? cause.message : String(cause)}`);
+		this.construct = construct;
+		this.migration = migration;
+		this.cause = cause;
+		this.name = "MigrationFailed";
+	}
+};
+/** The project's Kysely could not be found from where a database is declared. */
+var KyselyNotFound = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not resolve 'kysely' from ${from}. Migrations run with the project's own Kysely — install it where the database is declared.`);
+		this.from = from;
+		this.name = "KyselyNotFound";
+	}
+};
+/** Apply every pending migration, construct by construct, parents first. */
+async function migrateDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) {
+			runs.push({
+				target,
+				applied: []
+			});
+			continue;
+		}
+		const applied = await withMigrator(options, target, async (migrator) => {
+			const { error, results = [] } = await migrator.migrateToLatest();
+			if (error) {
+				const failed = results.find((result) => result.status === "Error");
+				throw new MigrationFailed(target.id, failed?.migrationName, error);
+			}
+			return results.filter((result) => result.status === "Success").map((result) => result.migrationName);
+		});
+		runs.push({
+			target,
+			applied
+		});
+	}
+	return runs;
+}
+/**
+* Run every construct's seeds, parents first — each one, every time, on every
+* stage, production included. Each is handed the stage, so a seed decides
+* what belongs where.
+*
+* Seeds are reference data kept up to date by being run again, so there is no
+* history: a seed is an upsert, and a changed one is applied by the next run.
+* Each runs in its own transaction, as the construct's owner, so a failure
+* leaves nothing half-written. Assumes the schema is migrated —
+* {@link migrateAndSeed} is what makes that true.
+*/
+async function seedDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		const folder = (0, node_path.join)(options.root, target.seeds);
+		if ((await migrationFiles(folder)).size === 0) {
+			runs.push({
+				target,
+				seeded: []
+			});
+			continue;
+		}
+		const seeded = await withOwner(options, target, async (db, kysely) => {
+			const names = [];
+			for (const seed of await loadSeeds(folder, kysely.sql)) {
+				try {
+					await db.transaction().execute((trx) => seed.run(trx, { stage: options.stage }));
+				} catch (error) {
+					throw new SeedFailed(target.id, seed.name, error);
+				}
+				names.push(seed.name);
+			}
+			return names;
+		});
+		runs.push({
+			target,
+			seeded
+		});
+	}
+	return runs;
+}
+/**
+* Migrate, then seed: a seed only ever runs against the schema it was written
+* for.
+*
+* With `only`, the constructs it lives in are migrated too — a tenant's seed
+* cannot run before the database that owns its schema exists — and only it is
+* seeded.
+*/
+async function migrateAndSeed(options) {
+	const migrations = [];
+	for (const target of await withParents(options)) migrations.push(...await migrateDatabases({
+		...options,
+		only: target.id
+	}));
+	return {
+		migrations,
+		seeds: await seedDatabases(options)
+	};
+}
+/** The targets `only` names, after the ones it lives in; all without it. */
+async function withParents(options) {
+	const chosen = await targetsFor(options);
+	if (!options.only) return chosen;
+	const all = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
+	const ids = /* @__PURE__ */ new Set();
+	for (const target of chosen) {
+		let current = target;
+		while (current) {
+			ids.add(current.id);
+			const parent = current.of;
+			current = parent ? all.find((t) => t.id === parent) : void 0;
+		}
+	}
+	return all.filter((target) => ids.has(target.id));
+}
+/**
+* What each construct's folder has that its history does not — without
+* applying any of it. What `gkm dev` reports.
+*/
+async function pendingMigrations(options) {
+	const found = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) continue;
+		const pending = await withMigrator(options, target, async (migrator) => (await migrator.getMigrations()).filter((migration) => migration.executedAt === void 0).map((migration) => migration.name));
+		if (pending.length > 0) found.push({
+			target,
+			pending
+		});
+	}
+	return found;
+}
+/**
+* The targets this run covers, with every folder under `db/` accounted for.
+*
+* A folder that names no construct is an error rather than something to skip:
+* a typo in its name is otherwise a migration that silently never runs.
+*/
+async function targetsFor(options) {
+	const targets = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
+	const folders = targets.map((target) => target.folder);
+	for (const folder of await foldersIn((0, node_path.join)(options.root, _geekmidas_manifest.MIGRATIONS_ROOT))) {
+		const relative = `${_geekmidas_manifest.MIGRATIONS_ROOT}/${folder}`;
+		if (!folders.includes(relative)) throw new UnknownMigrationFolder(relative, folders);
+		await checkLayout(options.root, relative);
+	}
+	if (!options.only) return targets;
+	const id = (0, _geekmidas_manifest.canonicalId)(options.only);
+	const chosen = targets.filter((target) => target.id === id);
+	if (chosen.length === 0) throw new NoSuchMigrationTarget(options.only, targets.map((target) => target.id));
+	return chosen;
+}
+/**
+* A construct's folder holds `migrations/` and `seeds/`, and nothing else —
+* anything beside them is a file or folder nothing would ever run.
+*/
+async function checkLayout(root, folder) {
+	const entries = await (0, node_fs_promises.readdir)((0, node_path.join)(root, folder), { withFileTypes: true });
+	const loose = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
+	if (loose.length > 0) throw new MigrationsOutsideFolder(folder, loose);
+	for (const entry of entries) if (entry.isDirectory() && !_geekmidas_manifest.DATABASE_FOLDERS.includes(entry.name)) throw new UnknownDatabaseFolder(`${folder}/${entry.name}`);
+}
+async function foldersIn(dir) {
+	return (await (0, node_fs_promises.readdir)(dir, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+}
+/**
+* A migrator for one target, connected as its owner.
+*
+* No `migrationTableSchema`: the owner role's `search_path` is pinned to the
+* construct's schema, so the history lands there — `app.kysely_migration` for
+* the database, `auth_database.kysely_migration` for its tenant — and two
+* constructs in one Postgres never share one.
+*
+* Unordered migrations are allowed. Files are timestamped, so a branch merged
+* after another's migration ran carries an older one; refusing it would make
+* every such merge a manual repair.
+*/
+async function withMigrator(options, target, run) {
+	return withOwner(options, target, (db, { Migrator, sql }) => run(new Migrator({
+		db,
+		provider: folderProvider((0, node_path.join)(options.root, target.migrations), sql),
+		allowUnorderedMigrations: true
+	})));
+}
+/**
+* One target's database, connected as its owner and closed afterwards — what
+* migrations and seeds both run as.
+*/
+async function withOwner(options, target, run) {
+	const kysely = await kyselyFrom(options.sources?.[target.id]?.file ?? (target.of ? options.sources?.[target.of]?.file : void 0) ?? (0, node_path.join)(options.root, "package.json"));
+	const db = new kysely.Kysely({ dialect: new kysely.PostgresDialect({ pool: new pg.default.Pool(poolConfig(ownerUrl(options, target))) }) });
+	try {
+		return await run(db, kysely);
+	} finally {
+		await db.destroy();
+	}
+}
+/**
+* The owner's URL, with no fallback to the runtime one.
+*
+* The runtime role can create nothing, so falling back would only move the
+* failure to the first `CREATE TABLE` and make it read like a permissions
+* bug. The one exception is a database declared `roles: false`, where there is
+* no owner — both URLs are the master credential by design.
+*/
+function ownerUrl(options, target) {
+	const key = (0, _geekmidas_manifest.provideKey)(target.id, "ownerUrl");
+	const owner = options.env[key];
+	if (owner) return owner;
+	const database = options.manifest[target.of ?? target.id];
+	if (database?.kind === "database" && database.roles === false) {
+		const url = options.env[(0, _geekmidas_manifest.provideKey)(target.id, "url")];
+		if (url) return url;
+	}
+	throw new NoOwnerCredential(target.id, key);
+}
+/**
+* Pool settings for a URL, with `?search_path=` as the startup option Postgres
+* reads. Only a `roles: false` URL carries it — a role pins its own.
+*/
+function poolConfig(url) {
+	const parsed = new URL(url);
+	const searchPath = parsed.searchParams.get("search_path");
+	if (!searchPath) return { connectionString: url };
+	parsed.searchParams.delete("search_path");
+	return {
+		connectionString: parsed.toString(),
+		options: `-c search_path=${searchPath}`
+	};
+}
+/** Kysely as the project resolves it from `from`. */
+async function kyselyFrom(from) {
+	const require$1 = (0, node_module.createRequire)(from);
+	try {
+		const [main, migration] = await Promise.all([import((0, node_url.pathToFileURL)(require$1.resolve("kysely")).href), import((0, node_url.pathToFileURL)(require$1.resolve("kysely/migration")).href)]);
+		return {
+			Kysely: main.Kysely,
+			PostgresDialect: main.PostgresDialect,
+			sql: main.sql,
+			Migrator: migration.Migrator
+		};
+	} catch {
+		throw new KyselyNotFound(from);
+	}
+}
+//#endregion
+//#region src/migrate/index.ts
+/**
+* `gkm migrate`, `gkm seed` and `gkm migration` — applying a construct's
+* migrations, running its seeds, and writing its next migration.
+*
+* Both work on a stage this machine reconciles: its containers up, its roles
+* provisioned, its owner URLs resolved. A deployed stage is migrated by the
+* deploy that ships it, which is the one thing that can reach its database.
+*/
+const logger = console;
+/** `gkm migrate --stage` named a stage only a deploy can reach. */
+var MigrateDeployedStage = class extends Error {
+	stage;
+	local;
+	constructor(stage, local) {
+		super(`'${stage}' is a deployed stage, and its database is migrated by \`gkm deploy --stage ${stage}\`, which is what can reach it. \`gkm migrate\` runs against '${local}' or '${require_workspace.TEST_STAGE}'.`);
+		this.stage = stage;
+		this.local = local;
+		this.name = "MigrateDeployedStage";
+	}
+};
+/** `gkm migration` for a Kysely database, with no name for the file. */
+var MigrationNeedsName = class extends Error {
+	construct;
+	constructor(construct) {
+		super(`Name the migration: \`gkm migration ${construct} add_workouts\`. The name is what the file — and the history — calls it.`);
+		this.construct = construct;
+		this.name = "MigrationNeedsName";
+	}
+};
+/**
+* Reconcile a stage so it can be migrated: containers up, databases, schemas,
+* roles and grants in place, owner URLs resolved.
+*
+* Migrating assumes the roles exist, and this is what makes that true rather
+* than something a developer has to have run first.
+*/
+async function readyStage(cwd, stage) {
+	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
+	const local = workspace.stages.local;
+	const target = stage ?? local;
+	if (target !== local && target !== "test") throw new MigrateDeployedStage(target, local);
+	const sources = {};
+	const manifest = await require_discover.discover({
+		patterns: require_workspace$1.constructGlobs(workspace),
+		cwd: workspace.root,
+		sources
+	});
+	return {
+		workspace,
+		manifest,
+		sources,
+		env: { ...(await require_workspace$1.reconcileWorkspace(workspace, {
+			stage: target,
+			manifest,
+			start: true
+		})).env },
+		stage: target
+	};
+}
+/** `gkm migrate [construct]`. */
+async function migrateCommand(options = {}) {
+	const ready = await readyStage(process.cwd(), options.stage);
+	const runs = await migrateDatabases({
+		root: ready.workspace.root,
+		manifest: ready.manifest,
+		sources: ready.sources,
+		env: ready.env,
+		...options.construct ? { only: options.construct } : {}
+	});
+	if (runs.length === 0) {
+		logger.log("🗄️  No database constructs to migrate.");
+		return;
+	}
+	logMigrations(runs);
+}
+/**
+* `gkm seed [construct]` — migrate, then run the seeds.
+*
+* Always migrates first: a seed is written against the schema its migrations
+* build, and against an older one it fails on a table that is not there yet.
+*/
+async function seedCommand(options = {}) {
+	const ready = await readyStage(process.cwd(), options.stage);
+	const { migrations, seeds } = await migrateAndSeed({
+		root: ready.workspace.root,
+		manifest: ready.manifest,
+		sources: ready.sources,
+		env: ready.env,
+		stage: ready.stage,
+		...options.construct ? { only: options.construct } : {}
+	});
+	if (migrations.length === 0) {
+		logger.log("🗄️  No database constructs to seed.");
+		return;
+	}
+	logMigrations(migrations);
+	logSeeds(seeds);
+}
+/** One line per construct: up to date, or what was applied. */
+function logMigrations(runs, log = logger.log) {
+	for (const { target, applied } of runs) {
+		if (applied.length === 0) {
+			log(`🗄️  ${target.migrations}: up to date`);
+			continue;
+		}
+		log(`🗄️  ${target.migrations}: applied ${applied.length}`);
+		for (const name of applied) log(`   ✓ ${name}`);
+	}
+}
+/** One line per construct that has seeds, and each seed it ran. */
+function logSeeds(runs, log = logger.log) {
+	for (const { target, seeded } of runs) {
+		if (seeded.length === 0) continue;
+		log(`🌱 ${target.seeds}: ran ${seeded.length}`);
+		for (const name of seeded) log(`   ✓ ${name}`);
+	}
+}
+/**
+* What `gkm dev` prints: one line per construct whose folder is ahead of its
+* history, and nothing when every folder is applied.
+*
+* Reported, never applied. A migration being written would otherwise run the
+* moment its file is saved, half-finished, against the database the developer
+* is working in.
+*/
+async function reportPendingMigrations(workspace, env) {
+	const sources = {};
+	const manifest = await require_discover.discover({
+		patterns: require_workspace$1.constructGlobs(workspace),
+		cwd: workspace.root,
+		sources
+	});
+	const pending = await pendingMigrations({
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	});
+	for (const { target, pending: names } of pending) logger.log(`⚠️  ${target.migrations}: ${names.length} pending (${names.join(", ")}) — run gkm migrate`);
+}
+/**
+* What `gkm dev --migrate` and `gkm dev --seed` do before the apps start:
+* migrate, and with `seed`, run the seeds after — once, at startup, never on a
+* save, for the reason {@link reportPendingMigrations} gives.
+*
+* A failure here is thrown, unlike the report's: the developer asked for the
+* database to be brought up to date, and apps started against one in an
+* unknown state would fail somewhere less obvious.
+*/
+async function prepareDevDatabases(workspace, env, { seed = false } = {}) {
+	const sources = {};
+	const manifest = await require_discover.discover({
+		patterns: require_workspace$1.constructGlobs(workspace),
+		cwd: workspace.root,
+		sources
+	});
+	const options = {
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	};
+	if (!seed) {
+		logMigrations(await migrateDatabases(options));
+		return;
+	}
+	const { migrations, seeds } = await migrateAndSeed({
+		...options,
+		stage: workspace.stages.local
+	});
+	logMigrations(migrations);
+	logSeeds(seeds);
+}
+/**
+* `gkm migration <construct> [name]` — write the construct's next migration.
+*
+* For a database, an empty `up`/`down` to fill in. For an auth server, what
+* its schema is missing, computed against its tenant once every committed
+* migration has been applied — so the file is only the change, and is
+* reviewed and committed like any other.
+*/
+async function migrationCommand(options) {
+	const ready = await readyStage(process.cwd());
+	const targets = (0, _geekmidas_manifest.migrationTargets)(ready.manifest);
+	const id = (0, _geekmidas_manifest.canonicalId)(options.construct);
+	const auth = authConstruct(ready.sources, id);
+	if (auth) {
+		const target = targets.find((t) => t.id === auth.databaseId);
+		if (!target) throw new NoSuchMigrationTarget(auth.databaseId, ids(targets));
+		return writeAuthMigration(ready, auth, target, options);
+	}
+	const target = targets.find((t) => t.id === id);
+	if (!target) throw new NoSuchMigrationTarget(options.construct, [...ids(targets), ...authIds(ready.sources)]);
+	if (!options.name) throw new MigrationNeedsName(options.construct);
+	const file = await write(ready.workspace.root, target, `${require_index.stamp(options.now)}_${require_index.slug(options.name)}.ts`, STUB);
+	logger.log(`📝 ${file}`);
+	return file;
+}
+function authConstruct(sources, id) {
+	const construct = sources[id]?.construct;
+	return construct && typeof construct.pendingMigration === "function" && typeof construct.databaseId === "string" ? construct : void 0;
+}
+function authIds(sources) {
+	return Object.keys(sources).filter((id) => authConstruct(sources, id));
+}
+async function writeAuthMigration(ready, auth, target, options) {
+	await migrateDatabases({
+		root: ready.workspace.root,
+		manifest: ready.manifest,
+		sources: ready.sources,
+		env: ready.env,
+		only: target.id
+	});
+	const stage = ready.workspace.stages.local;
+	const secrets = await require_workspace$1.loadSecretsForApp(await require_store.secretsStoreFor(ready.workspace, stage), stage);
+	const pending = await auth.pendingMigration({
+		envParser: new _geekmidas_envkit.EnvironmentParser({
+			...secrets,
+			...ready.env
+		}),
+		context: _geekmidas_services.serviceContext
+	});
+	if (!pending) {
+		logger.log(`✓ ${target.migrations}: ${auth.id} is up to date`);
+		return;
+	}
+	const file = await write(ready.workspace.root, target, `${require_index.stamp(options.now)}_${require_index.slug(options.name ?? "better_auth")}.sql`, `${pending.trim()}\n`);
+	logger.log(`📝 ${file}`);
+	return file;
+}
+const STUB = `import type { Kysely } from 'kysely';
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  // await db.schema.createTable('…').addColumn(…).execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  // await db.schema.dropTable('…').execute();
+}
+`;
+async function write(root, target, file, content) {
+	const folder = (0, node_path.join)(root, target.migrations);
+	await (0, node_fs_promises.mkdir)(folder, { recursive: true });
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(folder, file), content, { flag: "wx" });
+	return `${target.migrations}/${file}`;
+}
+function ids(targets) {
+	return targets.map((target) => target.id);
+}
+//#endregion
+exports.migrateAndSeed = migrateAndSeed;
+exports.migrateCommand = migrateCommand;
+exports.migrationCommand = migrationCommand;
+exports.prepareDevDatabases = prepareDevDatabases;
+exports.reportPendingMigrations = reportPendingMigrations;
+exports.seedCommand = seedCommand;
+
+//# sourceMappingURL=migrate-CFOUApUt.cjs.map