@nakedev/go-scaffold 0.1.4 → 0.3.0

package/dist/commands/method.js

@@ -13,6 +13,7 @@ const module_location_1 = require("../utils/module-location");
 const method_patcher_1 = require("../utils/method-patcher");
 const gocheck_1 = require("../utils/gocheck");
 const template_renderer_1 = require("../utils/template-renderer");
+const migrations_1 = require("../utils/migrations");
 const openapi_patcher_1 = require("../utils/openapi-patcher");
 const generate_wizard_1 = require("../prompts/generate-wizard");
 // URL path registered in method-patcher.ts, excluding the project-wide API
@@ -63,7 +64,7 @@ function methodOpenapiDocument(naming, method, type, getMode, field) {
 }
 async function generateMethod(moduleNameArg, methodNameArg, opts, projectDir = process.cwd()) {
     const config = (0, config_1.readConfig)(projectDir);
-    const naming = (0, module_location_1.resolveProjectModuleNaming)(projectDir, moduleNameArg ?? (await (0, generate_wizard_1.promptModuleName)()));
+    const naming = (0, module_location_1.resolveProjectModuleNaming)(projectDir, moduleNameArg ?? (await (0, generate_wizard_1.promptExistingModule)((0, module_location_1.existingModulePackages)(projectDir), "add a method to")));
     const modulePath = naming.pkg;
     const moduleDir = path_1.default.join(projectDir, "internal", "app", modulePath);
     const paths = {
@@ -88,10 +89,20 @@ async function generateMethod(moduleNameArg, methodNameArg, opts, projectDir = p
     }
     const getMode = type === "get" ? opts.getMode ?? (await (0, generate_wizard_1.promptGetMode)()) : undefined;
     const field = type === "get" && getMode === "one" ? opts.field ?? (await (0, generate_wizard_1.promptLookupField)()) : undefined;
-    // field becomes a Go param name (`func (...)(ctx, <field> string)`)
+    // field becomes a Go param name (`func (...)(ctx, <field> string)`) and a
+    // column name in the generated `WHERE <field> = ?`
     if (field)
-        (0, naming_1.assertNotGoKeyword)((0, naming_1.toCamelCase)(field), "lookup field");
+        (0, naming_1.assertGoIdentifier)((0, naming_1.toCamelCase)(field), "lookup field");
     const method = (0, naming_1.resolveMethodNaming)(methodNameArg ?? (await (0, generate_wizard_1.promptMethodName)()));
+    // Every marker this command patches has to exist before the first write:
+    // patchMethod writes dto.go, then handler.go, then reads service.go, so a
+    // missing service marker used to leave two files patched and the method
+    // permanently un-retryable (assertNotDuplicate then sees it as existing).
+    if (!(0, method_patcher_1.markersPresent)(paths.handlerPath, paths.servicePath)) {
+        throw new Error(`internal/app/${naming.pkg} is missing the marker comments \`generate method\` patches at.\n` +
+            `handler.go and service.go must both still carry their \`// go-scaffold:*\` markers —\n` +
+            `restore them, or add this method by hand.`);
+    }
     const docsRelativePath = config.features.openapiDocs
         ? `${naming.plural}/methods/${method.pathSegment}.yaml`
         : undefined;
@@ -102,6 +113,24 @@ async function generateMethod(moduleNameArg, methodNameArg, opts, projectDir = p
     (0, method_patcher_1.patchMethod)(paths, naming, method, { type, getMode, field }, config.goModule);
     (0, template_renderer_1.gofmtTree)(projectDir);
     (0, gocheck_1.assertNoDrift)(projectDir, checkBefore, config);
+    // A --field lookup queries a column the table doesn't have yet. GORM builds
+    // that SQL at runtime, so nothing before the first real request notices:
+    // the build passes, vet passes, the generated tests pass. Ship the column
+    // and its index with the code that needs them.
+    let fieldMigration = "";
+    if (field) {
+        const migrationsDir = path_1.default.join(projectDir, "migrations");
+        fieldMigration = (0, migrations_1.newMigrationVersion)(migrationsDir);
+        const fieldColumn = (0, naming_1.toDbName)(field);
+        await (0, template_renderer_1.applyTemplateEntries)(projectDir, [
+            { template: "generate/module/field-column.up.sql.hbs", output: path_1.default.join("migrations", `${fieldMigration}_add_${naming.tableName}_${fieldColumn}.up.sql`) },
+            { template: "generate/module/field-column.down.sql.hbs", output: path_1.default.join("migrations", `${fieldMigration}_add_${naming.tableName}_${fieldColumn}.down.sql`) },
+        ], { ...naming, pkg: naming.pkg, methodName: method.name, fieldColumn });
+    }
+    if (fieldMigration) {
+        console.log(`migration: migrations/${fieldMigration}_add_${naming.tableName}_${(0, naming_1.toDbName)(field)}.{up,down}.sql ` +
+            `(adds the column the lookup queries, plus an index on it — check the type before applying)`);
+    }
     if (docsRelativePath) {
         const docsPath = path_1.default.join(projectDir, "docs", docsRelativePath);
         fs_extra_1.default.outputFileSync(docsPath, methodOpenapiDocument(naming, method, type, getMode, field));

package/dist/commands/observability.js

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addObservability = addObservability;
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const picocolors_1 = __importDefault(require("picocolors"));
+const config_1 = require("../utils/config");
+const template_renderer_1 = require("../utils/template-renderer");
+const observability_manifest_1 = require("../templates/observability-manifest");
+const observability_patcher_1 = require("../utils/observability-patcher");
+const gocheck_1 = require("../utils/gocheck");
+const gomod_patcher_1 = require("../utils/gomod-patcher");
+// addObservability scaffolds Prometheus metrics (GET /metrics) and
+// OpenTelemetry tracing for Gin + GORM, wiring both into the files `create`
+// already wrote. Opt-in and separate from `create`: most projects don't want
+// to think about a collector on day one, and unlike worker/auth/rbac this
+// touches files every project already has, so it has to patch rather than
+// just add new ones. `create --observability` calls this immediately after
+// scaffolding, so the two paths produce identical projects.
+async function addObservability(projectDir = process.cwd(), opts = {}) {
+    const config = (0, config_1.readConfig)(projectDir);
+    const telemetryGoPath = path_1.default.join(projectDir, "internal", "platform", "telemetry", "tracing.go");
+    if (fs_extra_1.default.existsSync(telemetryGoPath)) {
+        throw new Error(`${telemetryGoPath} already exists — observability looks like it's already been added`);
+    }
+    const parsedBefore = (0, gocheck_1.parseChecks)(projectDir);
+    await (0, template_renderer_1.applyTemplateEntries)(projectDir, observability_manifest_1.OBSERVABILITY_FILES, { openapiDocs: config.features.openapiDocs });
+    (0, observability_patcher_1.patchMainGoForObservability)(path_1.default.join(projectDir, "cmd", "api", "wiring.go"), config.goModule, config.projectName);
+    (0, observability_patcher_1.patchDatabaseGoForObservability)(path_1.default.join(projectDir, "internal", "platform", "database", "database.go"), config.goModule);
+    (0, observability_patcher_1.patchConfigForObservability)(path_1.default.join(projectDir, "internal", "shared", "config", "config.go"));
+    (0, gomod_patcher_1.patchGoModRequires)(path_1.default.join(projectDir, "go.mod"), [
+        "github.com/prometheus/client_golang v1.24.1",
+        "go.opentelemetry.io/otel v1.45.0",
+        "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0",
+        "go.opentelemetry.io/otel/sdk v1.45.0",
+        "go.opentelemetry.io/otel/trace v1.45.0",
+    ]);
+    (0, observability_patcher_1.patchEnvExampleForObservability)(path_1.default.join(projectDir, ".env.example"));
+    const openapiPath = path_1.default.join(projectDir, "docs", "openapi.yaml");
+    if (config.features.openapiDocs && fs_extra_1.default.existsSync(openapiPath)) {
+        (0, observability_patcher_1.patchOpenapiIndexForObservability)(openapiPath);
+    }
+    (0, template_renderer_1.gofmtTree)(projectDir);
+    // parse-only: the otel/prometheus imports this adds aren't in go.mod until
+    // the `go mod tidy` printed below, so `go vet` can't be the gate here.
+    (0, gocheck_1.assertStillParses)(projectDir, parsedBefore, "added observability");
+    // After the gate, next to writeConfig: these are .md files, so the parse
+    // check has no reason to guard them, and a throw from it used to strand the
+    // docs saying `enabled` while the config it never reached still said false —
+    // a disagreement no later command could converge, since the "already added"
+    // guard then blocks a re-run.
+    const staleDocs = refreshArchitectDocs(projectDir, config);
+    (0, config_1.writeConfig)(projectDir, { ...config, features: { ...config.features, observability: true } });
+    if (opts.silent)
+        return;
+    console.log(picocolors_1.default.green("\nadded internal/platform/telemetry/, internal/shared/middleware/{metrics,tracing}.go, and GET /metrics"));
+    console.log("wired into cmd/api/wiring.go and internal/platform/database — every request and GORM query now gets a trace span");
+    if (staleDocs.length) {
+        // Deliberately not "you edited these". The comparison is a whole-file
+        // match against today's template, and techstack.md embeds pinned
+        // dependency versions — so every release that bumps one makes every
+        // project scaffolded before it look edited. Which is exactly the
+        // population this function exists for.
+        console.log(picocolors_1.default.yellow(`\nnote: couldn't safely rewrite ${staleDocs.join(" and ")} — ` +
+            `${staleDocs.length > 1 ? "they don't" : "it doesn't"} match what this go-scaffold\n` +
+            `  would have generated, so ${staleDocs.length > 1 ? "they were" : "it was"} left alone rather than overwriting your edits.\n` +
+            `  ${staleDocs.length > 1 ? "They still describe" : "It still describes"} this project as having no metrics or tracing; update by hand.`));
+    }
+    console.log(picocolors_1.default.dim("\nnext: go mod tidy, then set OTEL_EXPORTER_OTLP_ENDPOINT to export traces (empty = tracing no-ops, /metrics works either way)"));
+}
+// The architecture docs gate their observability sections on a `create`-time
+// flag, so adding the feature afterwards used to leave techstack.md saying
+// `disabled` and architecture.md missing the section entirely — while the
+// README promises `create --observability` and this command produce the same
+// project.
+//
+// Re-rendering from the templates rather than string-patching keeps the prose
+// in one place (the .hbs), but would also silently discard a user's edits. So
+// it first renders what the file *should* look like today, with observability
+// still off: only a byte-for-byte match proves nobody has touched it. Returns
+// the docs it declined to overwrite, for the caller to warn about.
+function refreshArchitectDocs(projectDir, config) {
+    const docs = [
+        { template: "create/features/docs/architecture.md.hbs", output: path_1.default.join("docs", "architect", "architecture.md") },
+        { template: "create/features/docs/techstack.md.hbs", output: path_1.default.join("docs", "architect", "techstack.md") },
+    ];
+    // only what the two templates actually reference — projectName, apiPrefix
+    // and the feature flags
+    const base = { projectName: config.projectName, apiPrefix: config.apiPrefix, ...config.features };
+    const root = (0, template_renderer_1.getTemplatesRoot)();
+    const skipped = [];
+    for (const doc of docs) {
+        const outputPath = path_1.default.join(projectDir, doc.output);
+        if (!fs_extra_1.default.existsSync(outputPath))
+            continue;
+        const source = fs_extra_1.default.readFileSync(path_1.default.join(root, doc.template), "utf8");
+        // compare with line endings normalised — a Windows checkout with
+        // core.autocrlf=true would otherwise never match, and the feature would
+        // silently never fire there
+        const onDisk = lf(fs_extra_1.default.readFileSync(outputPath, "utf8"));
+        if (onDisk !== lf((0, template_renderer_1.renderString)(source, { ...base, observability: false }))) {
+            skipped.push(doc.output);
+            continue;
+        }
+        fs_extra_1.default.writeFileSync(outputPath, (0, template_renderer_1.renderString)(source, { ...base, observability: true }));
+    }
+    return skipped;
+}
+function lf(text) {
+    return text.replace(/\r\n/g, "\n");
+}

package/dist/commands/rbac.js

@@ -13,6 +13,8 @@ const rbac_manifest_1 = require("../templates/rbac-manifest");
 const migrations_1 = require("../utils/migrations");
 const rbac_patcher_1 = require("../utils/rbac-patcher");
 const openapi_patcher_1 = require("../utils/openapi-patcher");
+const golangci_patcher_1 = require("../utils/golangci-patcher");
+const gocheck_1 = require("../utils/gocheck");
 // URL (relative to the api prefix) -> docs file (relative to docs/) for every
 // route `add rbac` registers or adds onto the user handler.
 const RBAC_OPENAPI_PATHS = [
@@ -41,6 +43,12 @@ async function addRbac(projectDir = process.cwd()) {
     if (fs_extra_1.default.existsSync(roleDir)) {
         throw new Error(`${roleDir} already exists — RBAC looks like it's already been added`);
     }
+    const before = (0, gocheck_1.typeChecks)(projectDir);
+    // Every file below is patched in place, and main.go's userSvc line is the
+    // one rbac cannot construct on its own — check it first so a mismatch costs
+    // an error message rather than a half-patched project.
+    (0, rbac_patcher_1.assertRbacPatchable)(path_1.default.join(projectDir, "cmd", "api", "wiring.go"), config.goModule, config.features.authStore ?? "redis", config.features.worker ?? false);
+    const parsedBefore = (0, gocheck_1.parseChecks)(projectDir);
     await (0, template_renderer_1.applyTemplateEntries)(projectDir, rbac_manifest_1.RBAC_FILES, { goModule: config.goModule });
     const migrationsDir = path_1.default.join(projectDir, "migrations");
     fs_extra_1.default.ensureDirSync(migrationsDir);
@@ -58,7 +66,9 @@ async function addRbac(projectDir = process.cwd()) {
     (0, rbac_patcher_1.patchUserDTOForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "dto.go"));
     (0, rbac_patcher_1.patchUserHandlerForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "handler.go"), config.goModule);
     (0, rbac_patcher_1.patchUserErrorsForRbac)(path_1.default.join(projectDir, "internal", "app", "user", "errors.go"));
-    (0, rbac_patcher_1.patchMainGoForRbac)(path_1.default.join(projectDir, "cmd", "api", "main.go"), config.goModule);
+    (0, golangci_patcher_1.patchGolangciForModule)(path_1.default.join(projectDir, ".golangci.yml"), config.goModule, "role");
+    // projects scaffolded before --store existed are all Redis-backed
+    (0, rbac_patcher_1.patchMainGoForRbac)(path_1.default.join(projectDir, "cmd", "api", "wiring.go"), config.goModule, config.features.authStore ?? "redis", config.features.worker ?? false);
     (0, rbac_patcher_1.patchCmdSeedForRbac)(path_1.default.join(projectDir, "cmd", "seed", "main.go"), config.goModule);
     patchEnvExample(path_1.default.join(projectDir, ".env.example"));
     let docsMessage = "";
@@ -77,9 +87,16 @@ async function addRbac(projectDir = process.cwd()) {
         docsMessage = "\ndocs: docs/rbac/*.yaml, wired into docs/openapi.yaml";
     }
     (0, template_renderer_1.gofmtTree)(projectDir);
+    (0, gocheck_1.assertStillParses)(projectDir, parsedBefore, "added RBAC");
+    // rbac introduces no new third-party dependency, so unlike add auth/worker
+    // this can hold the stronger line: the project has to still type-check.
+    (0, gocheck_1.assertNoDrift)(projectDir, before, config, {
+        didWhat: "added RBAC",
+        recover: "internal/app/role/ and the rbac patches were left in place — reconcile cmd/api/wiring.go by hand.",
+    });
     (0, config_1.writeConfig)(projectDir, { ...config, features: { ...config.features, rbac: true } });
     console.log(picocolors_1.default.green("\nadded internal/app/role/ and internal/shared/middleware/authz.go"));
-    console.log("registered GET /users, GET /users/:id, PATCH /users/:id/set-role, /roles, and /permissions in cmd/api/main.go" + docsMessage);
+    console.log("registered GET /users, GET /users/:id, PATCH /users/:id/set-role, /roles, and /permissions in cmd/api/wiring.go" + docsMessage);
     console.log(picocolors_1.default.yellow("\n⚠ AUTO_MIGRATE=true does NOT seed the role/permission data — it only creates the\n" +
         "  tables from the Go structs. The \"staff\"/\"admin\" roles and their permissions live\n" +
         "  in the migration's SQL (INSERT statements), which AutoMigrate never runs. Without\n" +

package/dist/commands/undo.js

@@ -0,0 +1,331 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.undoModule = undoModule;
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const picocolors_1 = __importDefault(require("picocolors"));
+const prompts_1 = require("@inquirer/prompts");
+const config_1 = require("../utils/config");
+const naming_1 = require("../utils/naming");
+const module_location_1 = require("../utils/module-location");
+const main_patcher_1 = require("../utils/main-patcher");
+const openapi_patcher_1 = require("../utils/openapi-patcher");
+const golangci_patcher_1 = require("../utils/golangci-patcher");
+const template_renderer_1 = require("../utils/template-renderer");
+const gocheck_1 = require("../utils/gocheck");
+const generate_wizard_1 = require("../prompts/generate-wizard");
+// undoModule reverses a `generate module` that shouldn't have happened —
+// a typo'd name, a domain you decided against — by deleting everything it
+// created, migration files included.
+//
+// It deliberately does NOT try to retire a domain that is live somewhere.
+// The command this replaced claimed to ("a migration may already be recorded
+// in schema_migrations on production"), and that framing was wrong twice
+// over. Nobody decommissions a shipped domain by running a scaffolding CLI:
+// that needs a deprecation window, a data migration, and a drop migration
+// written by hand. Meanwhile the case people actually hit — undoing a module
+// generated thirty seconds ago — got the production treatment, so the typo's
+// migration survived forever. `migrations/embed.go` is a `//go:embed *`, so
+// that leftover then ran on every database anyone created from then on,
+// building a `oder_svc.oders` table nobody asked for.
+//
+// So: work out whether the migration could possibly have escaped this
+// machine. If it can't have, delete it. If it might have, refuse and say why.
+async function undoModule(rawName, opts, projectDir = process.cwd()) {
+    const config = (0, config_1.readConfig)(projectDir);
+    const naming = (0, module_location_1.resolveProjectModuleNaming)(projectDir, rawName ?? (await (0, generate_wizard_1.promptExistingModule)((0, module_location_1.existingModulePackages)(projectDir), "undo")));
+    const modulePath = naming.pkg;
+    const moduleDir = path_1.default.join(projectDir, "internal", "app", modulePath);
+    if (!fs_extra_1.default.existsSync(moduleDir)) {
+        throw new Error(`module "${naming.pkg}" not found at internal/app/${modulePath} — nothing to undo`);
+    }
+    // `user` and `role` live under internal/app/ like any generated module, but
+    // they were wired by add auth / add rbac using entirely different line
+    // shapes — this command would delete the package and then silently fail to
+    // un-wire most of it, leaving main.go and cmd/seed referencing a package
+    // that no longer exists. findDependents can't catch it either: the
+    // consumer-side-interface convention means `user` never imports `role`.
+    const featureOwner = { user: "auth", role: "rbac" };
+    const owner = featureOwner[modulePath];
+    if (owner && config.features[owner]) {
+        throw new Error(`"${modulePath}" belongs to \`go-scaffold add ${owner}\`, not to \`generate module\` — refusing to undo it.\n` +
+            `Its wiring in cmd/api/wiring.go (and cmd/seed, docs/openapi.yaml) doesn't match what this command knows how to reverse,\n` +
+            `so removing it would leave the project un-compilable. Undo \`add ${owner}\` by hand, or start from a fresh scaffold.`);
+    }
+    const migrationsDir = path_1.default.join(projectDir, "migrations");
+    const migrations = moduleMigrations(migrationsDir, (0, naming_1.migrationSlugAliases)(naming));
+    const { checkedDatabase } = assertMigrationsNeverEscaped(projectDir, migrations, naming.pkg);
+    if (!opts.yes) {
+        const ok = await (0, prompts_1.confirm)({
+            message: `Undo module "${naming.pkg}"? Deletes internal/app/${modulePath}/, its docs, ` +
+                `${migrations.length ? `${migrations.length} migration file(s), ` : ""}` +
+                `and un-wires wiring.go/openapi.yaml. The ${naming.tableName} table itself is not dropped.`,
+            default: false,
+        });
+        if (!ok)
+            throw new Error("undo cancelled");
+    }
+    // detect --auth/--permission from the generated handler.go itself (not
+    // stored anywhere else) — unpatchMainGo needs the exact same flags used at
+    // generate-time to reconstruct the identical line it's removing.
+    const handlerGoPath = path_1.default.join(moduleDir, "handler.go");
+    let auth;
+    let permission;
+    if (fs_extra_1.default.existsSync(handlerGoPath)) {
+        const handlerContent = fs_extra_1.default.readFileSync(handlerGoPath, "utf8");
+        auth = /jwtSecret\s+string/.test(handlerContent);
+        permission = handlerContent.match(/h\.authz\.Require\("([^"]+)"\)/)?.[1];
+    }
+    // Refuse if another domain still imports this one. Deleting it anyway
+    // leaves the project un-compilable, and the error Go reports then points at
+    // the surviving module rather than at the removal that caused it.
+    const dependents = findDependents(projectDir, config.goModule, modulePath);
+    if (dependents.length > 0) {
+        throw new Error(`module "${naming.pkg}" is still used by: ${dependents.join(", ")}\n` +
+            `remove those references (or the modules themselves) first — deleting internal/app/${modulePath} now would break the build`);
+    }
+    const before = (0, gocheck_1.typeChecks)(projectDir);
+    // Un-wire before deleting, not after. Every step below can throw — a
+    // hand-edited wiring.go with the routes marker gone is enough — and if the
+    // package is already gone by then, the user's own code inside it is
+    // unrecoverable outside of git. This order fails the other way round: a
+    // still-present package with its wiring removed, which `generate module`
+    // re-wires idempotently.
+    // 1. wiring.go
+    (0, main_patcher_1.unpatchMainGo)(path_1.default.join(projectDir, "cmd", "api", "wiring.go"), {
+        goModule: config.goModule,
+        modulePath,
+        pkg: naming.pkg,
+        pascalName: naming.pascalName,
+        schemaName: naming.schemaName,
+        auth,
+        permission,
+    });
+    (0, golangci_patcher_1.unpatchGolangciForModule)(path_1.default.join(projectDir, ".golangci.yml"), modulePath);
+    // 2. openapi index + per-module docs
+    const openapiPath = path_1.default.join(projectDir, "docs", "openapi.yaml");
+    if (fs_extra_1.default.existsSync(openapiPath)) {
+        (0, openapi_patcher_1.unpatchOpenapiIndex)(openapiPath, naming, config.apiPrefix);
+        fs_extra_1.default.removeSync(path_1.default.join(projectDir, "docs", naming.plural));
+    }
+    // 3. the migrations — safe to delete, assertMigrationsNeverEscaped proved
+    // above that they exist nowhere but this working tree
+    for (const file of migrations)
+        fs_extra_1.default.removeSync(path_1.default.join(migrationsDir, file));
+    // 4. the domain package — last, once nothing left can fail
+    fs_extra_1.default.removeSync(moduleDir);
+    (0, template_renderer_1.gofmtTree)(projectDir);
+    (0, gocheck_1.assertNoDrift)(projectDir, before, config, {
+        didWhat: `undid module "${naming.pkg}"`,
+        recover: `internal/app/${modulePath}/ is gone; re-run \`go-scaffold generate module ${naming.pkg}\` to put it\nback, then reconcile cmd/api/wiring.go by hand.`,
+    });
+    console.log(picocolors_1.default.green(`\nundid module "${naming.pkg}"`));
+    console.log(`  deleted internal/app/${modulePath}/`);
+    console.log(`  un-wired cmd/api/wiring.go`);
+    if (fs_extra_1.default.existsSync(openapiPath))
+        console.log(`  un-wired docs/openapi.yaml + deleted docs/${naming.plural}/`);
+    if (migrations.length)
+        console.log(`  deleted migrations/${migrations.join(", migrations/")}`);
+    if (migrations.length && !checkedDatabase) {
+        console.log(picocolors_1.default.yellow(`\ncouldn't check whether those migrations had already been applied — no reachable DB_DSN,\n` +
+            `or no migrate CLI. They weren't committed, so no other environment can have them, but if\n` +
+            `you had run them against a local database it now records a version with no file behind it.`));
+    }
+    console.log(picocolors_1.default.dim(`\nnothing was dropped from any database — if you had already run these migrations locally,\n` +
+        `the ${naming.tableName} table is still there. \`make db-drop && make db-create && make migrate-up\` is the\n` +
+        `quickest way back to a clean dev database.`));
+}
+// moduleMigrations lists the migration files `generate module` created for
+// this module: the create pair, plus the permission pair when it was
+// generated with --permission.
+function moduleMigrations(migrationsDir, slugs) {
+    if (!fs_extra_1.default.existsSync(migrationsDir))
+        return [];
+    return fs_extra_1.default
+        .readdirSync(migrationsDir)
+        .filter((f) => slugs.some((slug) => f.endsWith(`_create_${slug}.up.sql`) ||
+        f.endsWith(`_create_${slug}.down.sql`) ||
+        f.endsWith(`_add_${slug}_permission.up.sql`) ||
+        f.endsWith(`_add_${slug}_permission.down.sql`)))
+        .sort();
+}
+// assertMigrationsNeverEscaped is what lets undo delete migration files at
+// all. A migration that has only ever existed in this working tree cannot be
+// recorded in any other environment's schema_migrations, so removing it can't
+// make two databases disagree. Two ways it could have escaped:
+//
+//   1. it's committed — then it's in whatever anyone pulled or deployed
+//   2. it's applied to the database this project is pointed at
+//
+// A project with no git repository at all has never been pushed anywhere, so
+// "git doesn't know this file" covers it.
+//
+// The git half is the one that has to be right: it's what decides whether a
+// migration could be in someone else's database. The database half only ever
+// protects the developer's own dev database, and that damage is recoverable
+// (`migrate force`), so an unreachable database doesn't block the command —
+// it reports back that it couldn't check, and the caller says so.
+function assertMigrationsNeverEscaped(projectDir, migrations, pkg) {
+    if (migrations.length === 0)
+        return { checkedDatabase: true };
+    const known = migrations.filter((f) => gitKnowsAbout(projectDir, path_1.default.join("migrations", f)));
+    if (known.length) {
+        throw new Error(`git knows about these migrations, so they may already have been applied somewhere:\n` +
+            known.map((f) => `  migrations/${f}`).join("\n") +
+            `\n\n\`undo\` is for a module you generated and immediately regretted — it deletes migration\n` +
+            `files, which is only safe while they exist nowhere but this working tree. To retire a domain\n` +
+            `that has shipped, leave its history alone and write the reversal explicitly:\n` +
+            `  go-scaffold generate migration drop_${pkg}`);
+    }
+    // Check every database this project could mean, not just the first one
+    // found: an exported DB_DSN left over in the shell would otherwise shadow
+    // the project's own .env and answer for the wrong database entirely.
+    let checkedDatabase = true;
+    for (const dsn of candidateDsns(projectDir)) {
+        const applied = appliedVersion(projectDir, dsn);
+        if (applied === null) {
+            checkedDatabase = false;
+            continue;
+        }
+        const escaped = migrations.filter((f) => Number(f.split("_")[0]) <= applied);
+        if (escaped.length) {
+            throw new Error(`these migrations have already been applied to your database (schema_migrations is at ${applied}):\n` +
+                escaped.map((f) => `  migrations/${f}`).join("\n") +
+                `\n\nDeleting the files now would leave the database recorded at a version with no migration\n` +
+                `behind it, and golang-migrate would refuse to move from there. Roll them back first:\n` +
+                `  migrate -path migrations -database "$DB_DSN" down ${escaped.length / 2 || 1}\n` +
+                `then run this again.`);
+        }
+    }
+    return { checkedDatabase };
+}
+// gitKnowsAbout asks both questions, because either one means the file has
+// left this working tree. The index alone isn't enough: a file that was
+// committed and later `git rm --cached`'d is untracked now but is still in
+// history, and in anything anyone has pulled.
+function gitKnowsAbout(projectDir, relativePath) {
+    if (runsClean(projectDir, ["ls-files", "--error-unmatch", relativePath]))
+        return true;
+    const inHistory = (0, child_process_1.spawnSync)("git", ["log", "--all", "--max-count=1", "--format=%H", "--", relativePath], {
+        cwd: projectDir,
+        encoding: "utf8",
+    });
+    return !inHistory.error && inHistory.status === 0 && inHistory.stdout.trim() !== "";
+}
+function runsClean(projectDir, args) {
+    try {
+        (0, child_process_1.execFileSync)("git", args, { cwd: projectDir, stdio: "ignore" });
+        return true;
+    }
+    catch {
+        // not tracked, or not a git repository at all
+        return false;
+    }
+}
+// appliedVersion reads schema_migrations through the migrate CLI the project
+// already documents. Returns null when it can't tell — no migrate on PATH, no
+// DB_DSN, database unreachable, or nothing applied yet.
+function appliedVersion(projectDir, dsn) {
+    // spawnSync, not execFileSync: `migrate version` prints the version on
+    // stderr and still exits 0, and execFileSync only hands back stdout. That
+    // read as "" -> Number("") -> 0 -> "nothing applied yet", which waved every
+    // migration straight through the check this function exists to perform.
+    //
+    // The timeout matters as much: a DSN pointing at an unroutable host makes
+    // migrate sit on the OS TCP timeout, and the CLI froze for 77 seconds with
+    // no output before carrying on anyway.
+    const res = (0, child_process_1.spawnSync)("migrate", ["-path", "migrations", "-database", dsn, "version"], {
+        cwd: projectDir,
+        encoding: "utf8",
+        timeout: 5000,
+    });
+    if (res.error)
+        return null; // no migrate on PATH, or it timed out
+    const output = `${res.stderr ?? ""}\n${res.stdout ?? ""}`;
+    // a database that has never been migrated is a definitive "nothing
+    // applied", not an inconclusive answer
+    if (/no migration/i.test(output))
+        return 0;
+    return parseVersion(output);
+}
+// parseVersion pulls the bare version number out of migrate's output, and
+// insists on actually finding one: anything else (a connection error, a
+// "dirty" marker, an empty string) has to read as "can't tell", never as 0.
+function parseVersion(output) {
+    const match = output.trim().match(/^(\d+)/m);
+    return match ? Number(match[1]) : null;
+}
+// dsnFromEnvFile reads DB_DSN out of .env the same way the generated Makefile
+// does, and tolerates the two spellings people actually write: a quoted value,
+// and a leading `export`. Getting either wrong doesn't fail loudly — it hands
+// `migrate` a DSN it can't parse, appliedVersion then reports "can't tell",
+// and the applied-migrations guard is skipped entirely. Both forms silently
+// defeated it.
+// candidateDsns returns every database this project might mean, deduped. Both
+// are checked rather than just the first: an exported DB_DSN pointing at some
+// other environment would otherwise shadow the project's own .env and answer
+// the applied-migrations question about the wrong database.
+function candidateDsns(projectDir) {
+    const found = [process.env.DB_DSN, dsnFromEnvFile(projectDir)].filter((d) => Boolean(d));
+    return [...new Set(found)];
+}
+function dsnFromEnvFile(projectDir) {
+    const envPath = path_1.default.join(projectDir, ".env");
+    if (!fs_extra_1.default.existsSync(envPath))
+        return undefined;
+    const match = fs_extra_1.default.readFileSync(envPath, "utf8").match(/^[ \t]*(?:export[ \t]+)?DB_DSN[ \t]*=[ \t]*(.*)$/m);
+    if (!match)
+        return undefined;
+    let value = match[1].trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+        // a quoted value ends at its closing quote; anything after it is a comment
+        const end = value.indexOf(quote, 1);
+        value = end === -1 ? value.slice(1) : value.slice(1, end);
+    }
+    else {
+        // unquoted: strip a trailing ` # comment`, matching the Makefile's
+        // sed -E 's/[[:space:]]+#.*$//'. Not a bare `#` — that's legal in a URL.
+        value = value.replace(/[ \t]+#.*$/, "").trim();
+    }
+    return value || undefined;
+}
+// findDependents lists the .go files in *other* domains that import this one.
+// Import path match, not a bare package-name match: `orders` appears in plenty
+// of strings and comments, but only an import of
+// "<goModule>/internal/app/orders" is a real compile-time dependency.
+function findDependents(projectDir, goModule, modulePath) {
+    // The package itself, or one of its subpackages — and nothing else. Dropping
+    // the closing quote to catch `/model` was matching on a bare prefix too, so
+    // `undo module order` was refused by every module whose name merely starts
+    // with it: internal/app/orderitem imports nothing from internal/app/order,
+    // but the second path contains the first.
+    const base = `"${goModule}/internal/app/${modulePath}`;
+    const importsIt = (src) => src.includes(`${base}"`) || src.includes(`${base}/`);
+    const appDir = path_1.default.join(projectDir, "internal", "app");
+    const hits = [];
+    for (const pkg of (0, module_location_1.existingModulePackages)(projectDir)) {
+        if (pkg === modulePath)
+            continue;
+        for (const file of goFilesIn(path_1.default.join(appDir, pkg))) {
+            if (importsIt(fs_extra_1.default.readFileSync(file, "utf8"))) {
+                hits.push(path_1.default.relative(projectDir, file));
+            }
+        }
+    }
+    return hits;
+}
+function goFilesIn(dir) {
+    if (!fs_extra_1.default.existsSync(dir))
+        return [];
+    return fs_extra_1.default.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory())
+            return goFilesIn(full);
+        return entry.name.endsWith(".go") ? [full] : [];
+    });
+}