@rdlabo/workers-hono-kit 0.11.2 → 0.12.0-beta.pr48.sha371f5792ce8a

package/docs/data-layer.md

@@ -1,17 +1,62 @@
-Import database helpers from `@rdlabo/workers-hono-kit/db`. This entry point requires `drizzle-orm` and `mysql2`.
+# Data Layer
+
+Standalone MySQL / Hyperdrive access for Workers, plus the thin Hono container adapter. Fixed
+`+09:00` storage helpers are independent of IANA display timezones.
+
+- [HTTP and Authentication](./http-auth.md)
+- [Realtime and Offline](./realtime-offline.md)
+- [Testing and Operations](./testing-operations.md)
+- [API reference](./api.md)
+
+Import database helpers from `@rdlabo/workers-mysql`. The package installs `mysql2` directly. Add
+`drizzle-orm` only when using the `/drizzle` or `/testing` entry point. The old
+`@rdlabo/workers-hono-kit/db` path is a deprecated compatibility re-export.
+
+Workers using `mysql2` must enable its required Node.js networking APIs:
+
+```toml
+# wrangler.toml
+compatibility_flags = ["nodejs_compat"]
+```
+
+```sh
+npm install @rdlabo/workers-mysql drizzle-orm
+npm install -D @types/node@20
+```
+
+For candidate tarball installation, see [Development](./development.md).
+
+## Migrating from workers-hono-kit
+
+The package boundary is a breaking change in `0.12.0`. Update these imports before
+upgrading:
+
+| Current import                                          | Replacement                                           |
+| ------------------------------------------------------- | ----------------------------------------------------- |
+| `createContainerRuntime` from the kit root              | `@rdlabo/workers-hono-kit/mysql`                      |
+| `retryWhenDeadlock` from the kit root                   | `@rdlabo/workers-mysql`                               |
+| DB helpers from `@rdlabo/workers-hono-kit/db`           | `@rdlabo/workers-mysql`, `/drizzle`, or `/migrations` |
+| DB test helpers from `@rdlabo/workers-hono-kit/testing` | `@rdlabo/workers-mysql/testing`                       |
+
+The old `/db` and DB-related `/testing` exports remain available for backward compatibility.
+Their individual functions and types carry `@deprecated` notices pointing to the standalone
+package. No removal release is scheduled. The kit-owned `/mysql` adapter is not deprecated.
+Because `/testing` statically re-exports DB helpers, all kit `/testing` consumers must install the
+MySQL package and `drizzle-orm`, including consumers of non-DB helpers such as Firebase or KV fakes.
 
 ## Hyperdrive database
 
 `createHyperdriveDatabase()` lazily opens primary and replica connections from Hyperdrive bindings. `read()` uses the replica query runner; `query()` provides an explicit raw primary SELECT for read-after-write consistency; writes and transactions use the primary Drizzle instance. `readTransaction()` runs Drizzle and raw reads against one primary repeatable-read snapshot. Read transactions are serialized on one separately cached connection so their boundaries cannot mix with each other or with ordinary primary operations. After a fatal mysql2 connection error, a single read or the complete read-only transaction opens a fresh connection and repeats at most once. Writes and write transactions are not repeated because their commit state may be ambiguous. Workers owns connection cleanup at invocation end.
 
 ```ts
-import { createHyperdriveDatabase } from '@rdlabo/workers-hono-kit/db';
+import { createHyperdriveDatabase } from '@rdlabo/workers-mysql';
+import { DRIZZLE_ORM_OPTIONS } from '@rdlabo/workers-mysql/drizzle';
 import { drizzle } from 'drizzle-orm/mysql2';
 
 const db = createHyperdriveDatabase({
   primaryHyperdrive: env.DB_PRIMARY,
   replicaHyperdrive: env.DB_REPLICA,
-  createOrm: (primary) => drizzle(primary, { schema }),
+  createOrm: (primary) => drizzle(primary, { schema, ...DRIZZLE_ORM_OPTIONS }),
 });
 
 const rows = await db.read<Item>('SELECT * FROM items WHERE id = ?', [id]);
@@ -31,6 +76,12 @@ Do not call `readTransaction()` recursively from inside its callback. Calls shar
 
 Use `hyperdriveConnectionOptions()` when constructing lower-level mysql2 connections. The default JavaScript date conversion timezone is `+09:00`; it does not change the MySQL session timezone.
 
+Hono applications that want the standard request container use the thin adapter separately:
+
+```ts
+import { createContainerRuntime } from '@rdlabo/workers-hono-kit/mysql';
+```
+
 ## Writes and retries
 
 - `retryWhenDeadlock()` retries `ER_LOCK_DEADLOCK` with exponential backoff.
@@ -41,10 +92,16 @@ Use `hyperdriveConnectionOptions()` when constructing lower-level mysql2 connect
 
 Use `jstTimestamp`, `jstDatetime`, and `jstDate` for shared date behavior. Pair update timestamps with `jstOnUpdateNow()` because custom timestamp types do not expose Drizzle's `.onUpdateNow()`. For decimal columns, use Drizzle's `decimal(name, { precision, scale, mode: 'number' })` directly.
 
-The `/business-time` entry point converts instants and business dates in the JST business timezone:
+Generic business-time conversion is separate from the DB's fixed `+09:00` wire contract.
+Install `@rdlabo/workers-timezone` directly and migrate from the kit's deprecated `/business-time`
+compatibility path to its canonical entry point.
+
+```sh
+npm install @rdlabo/workers-timezone
+```
 
 ```ts
-import { addBusinessDays, toBusinessDateTime } from '@rdlabo/workers-hono-kit/business-time';
+import { addBusinessDays, toBusinessDateTime } from '@rdlabo/workers-timezone';
 
 toBusinessDateTime(new Date('2026-07-05T21:00:00Z'));
 // '2026-07-06 06:00:00'
@@ -52,3 +109,9 @@ toBusinessDateTime(new Date('2026-07-05T21:00:00Z'));
 addBusinessDays('2026-07-06', 3);
 // '2026-07-09'
 ```
+
+## Next step
+
+Continue to [Realtime and Offline](./realtime-offline.md), or see
+[`@rdlabo/workers-mysql`](https://docs.rdlabo.dev/projects/workers-mysql/docs/readme) for the
+standalone package guides.

package/docs/development.md

@@ -1,6 +1,7 @@
 # Development
 
-These commands are used when working on the package itself:
+Maintainer commands and release procedures for this monorepo. Application install guides live in
+each package README.
 
 ```bash
 npm install
@@ -10,9 +11,128 @@ npm test            # vitest
 npm run build       # tsc -p tsconfig.build.json → dist/
 ```
 
+## Candidate artifacts and publication
+
+Pull requests and merges build immutable candidate tarballs for all three packages:
+
+- `rdlabo-workers-hono-kit-*.tgz`
+- `rdlabo-workers-timezone-*.tgz`
+- `rdlabo-workers-mysql-*.tgz`
+
+Install all three when testing the complete package boundary:
+
+```sh
+npm install drizzle-orm ai-gateway-provider ./rdlabo-workers-mysql-*.tgz ./rdlabo-workers-timezone-*.tgz ./rdlabo-workers-hono-kit-*.tgz
+```
+
+No publication opt-in variable is required. Release tags trigger publication; candidate publication
+requires the authorization and successful source-run checks described below.
+The publisher validates all three archives before any write, then publishes timezone, MySQL, and
+the kit in that order. A retry skips a version only when the registry's SHA-512 integrity matches
+the local tarball; different content under an existing version fails and requires a version bump.
+
+## Release bundle verification
+
+Use Node.js 24 with a current npm CLI. From a clean checkout at the reviewed commit, verify the
+release bundle without publishing:
+
+```sh
+npm ci
+npm run typecheck
+npm run lint
+npm test
+npm run test:release
+npm run test:package
+RELEASE_DIR=$(mktemp -d)
+npm pack --ignore-scripts --workspaces --pack-destination "$RELEASE_DIR"
+node tooling/release/publish-packages.mjs --directory "$RELEASE_DIR" --manifests . --tag latest
+```
+
+The last command only validates and prints the plan: it does not publish or contact npm.
+Confirm registry visibility for the packages you intend to publish or skip:
+
+```sh
+npm view @rdlabo/workers-timezone version --registry https://registry.npmjs.org/
+npm view @rdlabo/workers-mysql version --registry https://registry.npmjs.org/
+npm view @rdlabo/workers-hono-kit version --registry https://registry.npmjs.org/
+```
+
+If a lookup fails for a version that should already exist, resolve registry visibility before
+releasing. The tag workflow compares archive integrity and skips identical versions when retrying a
+release. Changes to packaged contents require a new synchronized release version.
+
+## Trusted Publishing and repository protection
+
+Verify each public package's Trusted Publisher connection against these values before releasing:
+
+| Field                    | Value                                                        |
+| ------------------------ | ------------------------------------------------------------ |
+| Organization / user      | `rdlabo-dev`                                                 |
+| Repository               | `workers-hono-kit`                                           |
+| Workflow filename        | `release.yml`                                                |
+| Environment              | Leave empty (the workflow does not use a GitHub environment) |
+| Allowed action, if shown | Direct `npm publish`                                         |
+
+Do not create duplicate Trusted Publisher connections. Connections are npm account settings, not
+repository files. See [npm's Trusted Publishing guide](https://docs.npmjs.com/trusted-publishers/).
+
+Before releasing, install the packed candidates in a fresh consumer directory (using `RELEASE_DIR`
+from above):
+
+```sh
+npm install "$RELEASE_DIR"/rdlabo-workers-timezone-*.tgz "$RELEASE_DIR"/rdlabo-workers-mysql-*.tgz "$RELEASE_DIR"/rdlabo-workers-hono-kit-*.tgz drizzle-orm
+npm install -D @types/node@20
+```
+
+Before releasing, create an **active tag ruleset** for `v*` in GitHub repository Settings → Rules:
+restrict tag creation, updates, and deletion; grant bypass only to the designated release maintainer.
+That maintainer must tag only reviewed commits on `main`. The tag workflow runs code from the tag,
+so unrestricted tag creation would bypass the PR review boundary. Keep the default branch protected
+and require review for workflow/publisher changes as well. Configure these repository settings in
+GitHub; they are not applied by merging documentation.
+
+CI uses OIDC and generates provenance; no npm token secret or publication opt-in variable is needed.
+After merging the reviewed changes, `npm run release` creates the next release tag.
+Eligible merge/PR candidate events can also publish betas after their authorization checks pass.
+
+## Subsequent releases
+
+From a clean, up-to-date `main` checkout with dependencies installed, run:
+
+```sh
+npm run release
+```
+
+Choose the next version in `np`. Its npm `version` hook synchronizes the kit, timezone, and MySQL
+versions, internal dependency ranges, and lockfile **before** npm creates the release commit/tag.
+For example, choosing `0.12.1` advances all three packages to `0.12.1`. No separate workspace bump
+is required. The same applies to RCs. The tag workflow verifies synchronization, tests the packages,
+and publishes all three in dependency order. Unlike the Stripe repository's CI-side version update,
+no additional version commit is needed after tagging: the release tag already contains the complete
+version set.
+
+CI publishing requires the Trusted Publishing configuration above. Do not use `--ignore-scripts`
+when creating release versions: it bypasses synchronization and the tag workflow will reject the set.
+
+- A root `v<version>` tag must match the synchronized versions on the private workspace root and all
+  three public packages under `packages/`. Stable versions publish all three packages with `latest`;
+  prerelease versions publish all three with `next`.
+- All three versions must match for tag releases. Retries skip already-published archives only on
+  an exact integrity match; do not change an archive under an existing version.
+- `/beta` on a ready PR requires an owner/maintainer and successful Validation + Package Candidate
+  runs. A PR changing release workflows or publisher/versioning scripts cannot publish a beta until
+  those changes are reviewed and merged. Automatic merge beta has the same restriction.
+- PR betas use the trusted `main` package versions: all three version fields must match `main`.
+  Test version-bump PRs with the downloaded artifacts; their new versions can publish as merge
+  betas after reaching `main`. A mismatched PR version is rejected before any registry write.
+- Candidates publish all three immutable versions with one commit suffix and exact kit peer ranges.
+  The success message includes all three versions in the install command.
+- Candidate publication executes the publisher from the trusted default-branch commit. It reads
+  archive metadata without extracting or running candidate code, and uses `--ignore-scripts`.
+
 ## Local development / linking
 
-If you consume this package via a local path (e.g. `"@rdlabo/workers-hono-kit": "../../hono-kit"`) rather than from npm, TypeScript and esbuild resolve the package's bare imports from *its own* `node_modules`, which can create a second `zod` instance. That breaks types where your zod-inferred values flow into other libraries (e.g. Drizzle inserts). Dedupe with tsconfig `paths`:
+If you consume this package via a local path (e.g. `"@rdlabo/workers-hono-kit": "../../workers-hono-kit/packages/hono-kit"`) rather than from npm, TypeScript and esbuild resolve the package's bare imports from _its own_ `node_modules`, which can create a second `zod` instance. That breaks types where your zod-inferred values flow into other libraries (e.g. Drizzle inserts). Dedupe with tsconfig `paths`:
 
 ```jsonc
 {
@@ -21,9 +141,9 @@ If you consume this package via a local path (e.g. `"@rdlabo/workers-hono-kit":
     "paths": {
       "zod": ["node_modules/zod"],
       "zod/*": ["node_modules/zod/*"],
-      "@hono/zod-validator": ["node_modules/@hono/zod-validator"]
-    }
-  }
+      "@hono/zod-validator": ["node_modules/@hono/zod-validator"],
+    },
+  },
 }
 ```
 

package/docs/http-auth.md

@@ -1,3 +1,13 @@
+# HTTP and Authentication
+
+Validation, Firebase authentication, shared NestJS-shaped error bodies, and response finalization
+for Hono Workers APIs.
+
+- [Data Layer](./data-layer.md)
+- [Realtime and Offline](./realtime-offline.md)
+- [Testing and Operations](./testing-operations.md)
+- [API reference](./api.md)
+
 ## Validation
 
 `validate(target, schema, options?)` adapts a Zod schema to Hono and returns a NestJS `ValidationPipe`-shaped `400` response. Use `createValidate({ sentry })` to bind optional reporting once.
@@ -34,3 +44,8 @@ Mount `createMaintenanceMiddleware()` after CORS and before container or databas
 ## Deferred work and observability
 
 `createWaitUntilDefer(ctx)` registers background work through `waitUntil` and logs rejected work. `perfLog()` emits per-request application latency, colo, cold/warm state, route, and status to Workers Logs and optionally Analytics Engine.
+
+## Next step
+
+Continue to [Data Layer](./data-layer.md) for MySQL and Hyperdrive, or [API](./api.md) for the full
+export list.

package/docs/realtime-offline.md

@@ -1,3 +1,13 @@
+# Realtime and Offline
+
+Durable Object WebSocket helpers and table-agnostic offline replica contracts. Product schemas,
+Zod shapes, and domain policy stay in the application.
+
+- [HTTP and Authentication](./http-auth.md)
+- [Data Layer](./data-layer.md)
+- [Testing and Operations](./testing-operations.md)
+- [API reference](./api.md)
+
 ## Durable Object realtime
 
 The root and `/realtime` entry points expose the same focused realtime primitives:
@@ -25,3 +35,8 @@ Wire helpers canonicalize values:
 - `replicaNowIso(clock?)` → injectable current time
 
 Journal helpers enforce cursor coverage, retention, mutation transactions, and rebaseline behavior. Wire compatibility helpers let an application accept explicit previous fingerprints while maintaining a canonical current fingerprint.
+
+## Next step
+
+Continue to [Testing and Operations](./testing-operations.md), or [Offline API](./api-offline.md) for
+converter and wire export details.

package/docs/role-policies.md

@@ -39,10 +39,10 @@ const policy = createRolePolicy<Role, Permission>({
 The resulting `RolePolicy` has four pure checks:
 
 ```ts
-policy.hasPermission('member', 'resource.write');        // true
-policy.canAssignRole('admin', 'member');                 // true
-policy.canManageRole('owner', 'admin');                  // true
-policy.canChangeRole('owner', 'admin', 'member');        // true
+policy.hasPermission('member', 'resource.write'); // true
+policy.canAssignRole('admin', 'member'); // true
+policy.canManageRole('owner', 'admin'); // true
+policy.canChangeRole('owner', 'admin', 'member'); // true
 ```
 
 `canChangeRole(actor, current, next)` is a combination: the actor must be able to manage the subject's current role and also be allowed to assign the next role. Keeping role lookup and policy checks separate means the same policy can be reused no matter where roles are stored.

package/docs/testing-operations.md

@@ -1,6 +1,17 @@
+# Testing and Operations
+
+Test helpers, queue batching, operational CLIs, and trust boundaries for Hono Workers applications.
+
+- [HTTP and Authentication](./http-auth.md)
+- [Data Layer](./data-layer.md)
+- [Realtime and Offline](./realtime-offline.md)
+- [API reference](./api.md)
+
 ## Testing entry point
 
-`@rdlabo/workers-hono-kit/testing` requires the database peers and is never loaded by production code.
+`@rdlabo/workers-hono-kit/testing` is never loaded by production code. Its DB helpers are deprecated
+compatibility exports from `@rdlabo/workers-mysql/testing`, while Firebase, HTTP, Stripe, KV, and
+Queue fakes remain in the Hono kit.
 
 | Helper                                                          | Use                                                                   |
 | --------------------------------------------------------------- | --------------------------------------------------------------------- |
@@ -12,14 +23,26 @@
 | `fakeKv()` / `fakeQueue()`                                      | Use in-memory Workers binding fakes.                                  |
 | Stripe fixture factories                                        | Create typed events, sessions, subscriptions, prices, and intents.    |
 
+Because `/testing` statically re-exports DB helpers, every kit `/testing` consumer must install
+`@rdlabo/workers-mysql` and `drizzle-orm`, including consumers of non-DB helpers.
+
 ## Queues
 
 `sendInChunks()` bounds queue sends under Workers subrequest limits. `processBatch()` handles a message batch sequentially, bounding concurrent subrequests to one; errors explicitly marked with `queueDisposition: 'discard'` are acknowledged, while other failures retry. `createQueueErrorHandler()` adds logging and optional final-attempt reporting.
 
 ## Operational CLI
 
-The package publishes commands for synchronizing development AWS credentials, checking subrequest fanout, creating database baselines, checking realtime bundles, and querying Durable Object metrics. Run the exact CLI shipped with the installed package version and review its `--help` before changing infrastructure.
+The Hono kit publishes commands for synchronizing development AWS credentials, checking subrequest
+fanout, checking realtime bundles, and querying Durable Object metrics. Database baselining is owned
+by `workers-mysql-db-baseline`; the old `workers-hono-kit-db-baseline` command delegates to it during
+the compatibility period. Run the exact CLI shipped with the installed version before changing
+infrastructure.
 
 ## Trust boundaries
 
 AWS, Firebase, AI Gateway, Stripe, and database clients are configured by the consuming application. Do not place domain-specific credentials, schemas, or authorization policy inside the shared kit. Use `createRolePolicy()` only for storage-agnostic role and relation mapping; the application still owns its roles and permissions.
+
+## Next step
+
+See [Testing APIs](./api-testing.md) for export tables, [CLI](./cli.md) for command details, or
+[API](./api.md) for the full package map.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rdlabo/workers-hono-kit",
-  "version": "0.11.2",
+  "version": "0.12.0-beta.pr48.sha371f5792ce8a",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -11,7 +11,8 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/rdlabo-dev/workers-hono-kit.git"
+    "url": "git+https://github.com/rdlabo-dev/workers-hono-kit.git",
+    "directory": "packages/hono-kit"
   },
   "bugs": {
     "url": "https://github.com/rdlabo-dev/workers-hono-kit/issues"
@@ -47,11 +48,11 @@
     "!src/**/*.spec.ts"
   ],
   "bin": {
-    "workers-hono-kit-sync-dev-aws": "./scripts/sync-dev-aws.mjs",
-    "workers-hono-kit-check-subrequest-fanout": "./scripts/check-subrequest-fanout.mjs",
-    "workers-hono-kit-db-baseline": "./scripts/db-baseline.mjs",
-    "workers-hono-kit-check-realtime-bundle": "./scripts/check-realtime-bundle.mjs",
-    "workers-hono-kit-query-realtime-do-metrics": "./scripts/query-realtime-do-metrics.mjs"
+    "workers-hono-kit-sync-dev-aws": "scripts/sync-dev-aws.mjs",
+    "workers-hono-kit-check-subrequest-fanout": "scripts/check-subrequest-fanout.mjs",
+    "workers-hono-kit-db-baseline": "scripts/db-baseline.mjs",
+    "workers-hono-kit-check-realtime-bundle": "scripts/check-realtime-bundle.mjs",
+    "workers-hono-kit-query-realtime-do-metrics": "scripts/query-realtime-do-metrics.mjs"
   },
   "exports": {
     ".": {
@@ -64,6 +65,11 @@
       "import": "./dist/db/index.js",
       "default": "./dist/db/index.js"
     },
+    "./mysql": {
+      "types": "./dist/mysql/index.d.ts",
+      "import": "./dist/mysql/index.js",
+      "default": "./dist/mysql/index.js"
+    },
     "./business-time": {
       "types": "./dist/business-time/index.d.ts",
       "import": "./dist/business-time/index.js",
@@ -87,41 +93,42 @@
   },
   "scripts": {
     "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.build.json",
-    "prepare": "npm run build",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",
-    "format": "prettier --write \"src/**/*.ts\"",
-    "format:check": "prettier --check \"src/**/*.ts\"",
-    "release": "np --no-tests --no-publish"
+    "test:package": "node scripts/workspace-package-smoke.mjs",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "prepack": "npm run build"
   },
   "dependencies": {
     "stripe": "^20.4.1"
   },
   "peerDependencies": {
     "@hono/zod-validator": "^0.8.0",
+    "@rdlabo/workers-mysql": "0.1.0-beta.pr48.sha371f5792ce8a",
+    "@rdlabo/workers-timezone": "0.1.0-beta.pr48.sha371f5792ce8a",
     "ai": "^6.0.0",
     "ai-gateway-provider": "^3.1.0",
     "aws4fetch": "^1.0.20",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.6.0",
     "jose": "^6.2.0",
-    "mysql2": "^3.14.0",
     "zod": "^4.4.0"
   },
   "peerDependenciesMeta": {
-    "ai": {
+    "@rdlabo/workers-mysql": {
       "optional": true
     },
-    "ai-gateway-provider": {
+    "@rdlabo/workers-timezone": {
       "optional": true
     },
-    "drizzle-orm": {
+    "ai": {
       "optional": true
     },
-    "mysql2": {
+    "drizzle-orm": {
       "optional": true
     }
   },
@@ -143,8 +150,7 @@
     "eslint": "^9.39.4",
     "hono": "^4.6.0",
     "jose": "^6.2.3",
-    "mysql2": "3.22.5",
-    "np": "^8.0.4",
+    "mysql2": "3.24.3",
     "prettier": "^3.8.4",
     "typescript": "~5.6.2",
     "typescript-eslint": "^8.61.1",

package/scripts/db-baseline.mjs

@@ -1,70 +1,5 @@
 #!/usr/bin/env node
-// Record the Drizzle baseline (0000) as *already applied* on an existing (brownfield) MySQL DB,
-// without executing its CREATE TABLE statements. One-time per environment.
-//
-// Why: an in-production DB already has its schema, so running the introspect-derived baseline 0000 via
-// `db:migrate` collides. Instead we insert a single marker row into `__drizzle_migrations` so that
-// subsequent `db:migrate` runs apply only the later 0001+ (larger `when`). A fresh / test DB has no
-// marker, so the full chain runs (behavior unchanged).
-//
-// Where it runs: direct TCP from inside a VPC (e.g. AWS CodeBuild) to RDS. Hyperdrive is Workers-only
-// and cannot be used here. Credentials come from env (on CodeBuild, Secrets Manager → injected into env):
-//   DB_HOST / DB_PORT / DB_USER / DB_PASSWORD / DB_NAME
-// Migrations folder: defaults to ./drizzle (override with --migrations <dir> or MIGRATIONS_DIR).
-//
-// usage:
-//   npx workers-hono-kit-db-baseline [--migrations ./drizzle]
-import { createConnection } from 'mysql2/promise';
-import { baselineMigrations } from '../dist/db/migrate.js';
-import { resolveDbSecret } from '../dist/db/index.js';
+// Deprecated compatibility command. The implementation is owned by @rdlabo/workers-mysql.
+import { runBaselineCli } from '@rdlabo/workers-mysql/baseline-cli';
 
-function arg(name) {
-  const i = process.argv.indexOf(`--${name}`);
-  return i >= 0 ? process.argv[i + 1] : undefined;
-}
-
-const migrationsFolder = arg('migrations') ?? process.env.MIGRATIONS_DIR ?? './drizzle';
-// Shares the same DB_SECRET handling as db:migrate (honoDrizzleConfig). CI/production passes an AWS
-// Secrets Manager RDS managed secret via DB_SECRET (invalid/missing → resolveDbSecret throws). When
-// unset, it falls back to the individual DB_* env vars.
-const secret = resolveDbSecret();
-const conn = secret
-  ? {
-      host: secret.host,
-      port: secret.port,
-      user: secret.username,
-      password: secret.password,
-      database: secret.dbname,
-    }
-  : {
-      host: process.env.DB_HOST ?? '127.0.0.1',
-      port: Number(process.env.DB_PORT ?? '3306'),
-      user: process.env.DB_USER ?? 'root',
-      password: process.env.DB_PASSWORD ?? 'root',
-      database: process.env.DB_NAME,
-    };
-
-if (!conn.database) {
-  console.error('[db:baseline] DB_NAME (or DB_SECRET) is required.');
-  process.exit(1);
-}
-
-console.log(`[db:baseline] target = ${conn.user}@${conn.host}:${conn.port}/${conn.database} (migrations: ${migrationsFolder})`);
-
-const db = await createConnection(conn);
-try {
-  const res = await baselineMigrations({ db, migrationsFolder });
-  if (res.status === 'already-baselined') {
-    console.log(`[db:baseline] already baselined (${res.tag}, created_at=${res.when}). no-op.`);
-  } else {
-    console.log(
-      `[db:baseline] inserted baseline marker for ${res.tag} (created_at=${res.when}). ` +
-        `0000 is now recorded as applied; future migrations will run.`,
-    );
-  }
-} catch (err) {
-  console.error('[db:baseline] failed:', err instanceof Error ? err.message : err);
-  process.exitCode = 1;
-} finally {
-  await db.end();
-}
+await runBaselineCli();