@waukeshamakerspace/db-kit 0.2.1 → 0.3.0

package/README.md

@@ -27,11 +27,12 @@ need no environment at all.
 
 ### Scripts
 
-The two admin scripts ship as binaries, so a service's `package.json` is:
+The admin scripts ship as binaries, so a service's `package.json` is:
 
 ```json
 {
   "scripts": {
+    "db:provision": "wmi-db-provision",
     "db:ensure": "wmi-db-ensure",
     "db:migrate": "wmi-db-migrate"
   }
@@ -41,9 +42,71 @@ The two admin scripts ship as binaries, so a service's `package.json` is:
 `wmi-db-migrate` takes the migrations folder as an optional argument
 (`MIGRATIONS_DIR` also works), defaulting to `./migrations`.
 
-Both walk up from the cwd to the nearest `.env` and say which file they loaded.
-That replaces the hard-coded `resolve(cwd, '../../.env')` in the copied
-versions, which assumed every repo was exactly two levels deep.
+`wmi-db-ensure` and `wmi-db-migrate` walk up from the cwd to the nearest `.env`
+and say which file they loaded. That replaces the hard-coded
+`resolve(cwd, '../../.env')` in the copied versions, which assumed every repo
+was exactly two levels deep. **`wmi-db-provision` deliberately does not**, for
+the reason below.
+
+### Provisioning
+
+`wmi-db-provision` creates a database and its two scoped users. It replaces the
+block of manual SQL that each repo has been carrying in `docs/deploy.md`, so
+dev and production get set up the same way.
+
+```bash
+wmi-db-provision journeyman --admin-url mysql://admin:pw@rds.internal:3306
+```
+
+It creates, idempotently:
+
+| | |
+|---|---|
+| `` `journeyman` `` | `CREATE DATABASE IF NOT EXISTS` |
+| `journeyman_migrator` | `ALTER, CREATE, DROP, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE` |
+| `journeyman_app` | `SELECT, INSERT, UPDATE, DELETE` |
+
+**The migrator holds DML as well as DDL on purpose.** Drizzle maintains its
+`__drizzle_migrations` bookkeeping table over the same connection, so a migrator
+granted DDL alone looks correct and then fails partway through the first
+migration it tries to record.
+
+**The app user never holds DDL**, so a bug cannot alter its own schema. Narrow
+it further with `--app-privileges`, which accepts only those four DML
+privileges and refuses anything else:
+
+```bash
+# Journeyman's Lambda user: its append-only events table cannot be rewritten
+wmi-db-provision journeyman --admin-url ... --app-privileges SELECT,INSERT
+```
+
+Both passwords are generated here, printed once, and never written to disk. The
+output is ready to paste: `DATABASE_URL` + `DATABASE_NAME` for the service's
+`.env` and `samconfig.toml`, and the migrator's URI for the
+`MIGRATOR_DATABASE_URL` GitHub secret.
+
+`--dry-run` prints the exact statements and exits without connecting, which is
+also how you hand the SQL to someone else to run.
+
+Two things worth knowing before re-running it:
+
+- **It rotates both passwords.** `CREATE USER IF NOT EXISTS` is a no-op for an
+  existing account, so the password is set with a following `ALTER USER`.
+  Without that a re-run would print credentials that do not work. Existing
+  deployments need the new values.
+- **It revokes before granting**, so a re-run tightens an account that was
+  over-granted by hand rather than only widening it. Narrowing an existing
+  `journeyman_app` to `SELECT,INSERT` really does take `UPDATE` and `DELETE`
+  away.
+
+The admin credential is passed every time, via `--admin-url` or
+`WMI_DB_ADMIN_URL` (which keeps it out of shell history). This bin never reads
+the service's `.env`, because a stray `DATABASE_URL` must not be able to decide
+which server gets provisioned.
+
+The generated SQL is verified against MySQL 8.4 in a container, not just
+asserted as strings: the grants, the privilege boundary (the app user is
+refused `CREATE`, `ALTER`, and `DROP`), password rotation, and narrowing.
 
 ### The convention
 
@@ -56,8 +119,9 @@ app connect to the same place as different users:
 - `<service>_app` holds only the DML the service needs
 
 Journeyman takes that further: its Lambda user has `SELECT` and `INSERT` only,
-so its append-only events table cannot be rewritten even by a bug. That
-convention lives in each repo's deploy workflow; db-kit is the client half.
+so its append-only events table cannot be rewritten even by a bug. That is what
+`wmi-db-provision --app-privileges SELECT,INSERT` produces. The convention used
+to live as hand-written SQL in each repo's deploy doc; it is now executable.
 
 ## Notable fixes over the copied scripts
 

package/dist/admin.d.ts

@@ -12,6 +12,66 @@ export type Logger = {
  * it is interpolated into DDL where binding cannot help.
  */
 export declare function ensureDatabase(config: DatabaseConfig, logger?: Logger): Promise<void>;
+/**
+ * The migrator's grants. DDL *and* DML, deliberately: Drizzle keeps its
+ * `__drizzle_migrations` bookkeeping table over the same connection, so a
+ * migrator holding DDL alone looks right and then fails partway through the
+ * first migration it records.
+ */
+export declare const MIGRATOR_PRIVILEGES: readonly ["ALTER", "CREATE", "DROP", "INDEX", "REFERENCES", "SELECT", "INSERT", "UPDATE", "DELETE"];
+/** The app's grants: row movement only, never schema. */
+export declare const APP_PRIVILEGES: readonly ["SELECT", "INSERT", "UPDATE", "DELETE"];
+export type ProvisionStatement = {
+    sql: string;
+    /**
+     * MySQL error numbers that mean "already in the desired state". Tolerated so
+     * a re-run converges instead of failing halfway.
+     */
+    tolerate?: number[];
+};
+export type ProvisionedUser = {
+    user: string;
+    password: string;
+    /** Server URI carrying this user's credentials. No database path. */
+    url: string;
+};
+export type ProvisionPlan = {
+    name: string;
+    statements: ProvisionStatement[];
+    migrator: ProvisionedUser;
+    app: ProvisionedUser;
+};
+export type ProvisionOptions = {
+    /**
+     * Admin credential, server only. Passed in deliberately and never read from
+     * the service's own .env, so this cannot quietly provision whichever
+     * instance a stray DATABASE_URL happens to point at.
+     */
+    adminUrl: string;
+    /** Database name. Validated before it reaches DDL. */
+    name: string;
+    /** Host part of both accounts. Defaults to `%`. */
+    grantHost?: string;
+    /** Narrow the app user, e.g. `['SELECT', 'INSERT']`. Defaults to all four DML. */
+    appPrivileges?: readonly string[];
+    /** Injectable for tests. Defaults to 24 random bytes, base64url. */
+    generatePassword?: () => string;
+};
+/** 192 bits, in an alphabet that needs no escaping in a URI or a SQL literal. */
+export declare const generatePassword: () => string;
+/**
+ * Build the provisioning plan without touching a server. Separated from
+ * execution so `--dry-run` prints exactly what would run, and so the statement
+ * order and grants are testable without a MySQL instance.
+ */
+export declare function planProvision(options: ProvisionOptions): ProvisionPlan;
+/**
+ * Create the database and its two scoped users, idempotently.
+ *
+ * Re-running rotates both passwords and re-applies the grants, so the plan it
+ * prints is always the truth about how to connect afterwards.
+ */
+export declare function provisionDatabase(plan: ProvisionPlan, adminUrl: string, logger?: Logger): Promise<void>;
 /**
  * Apply pending Drizzle migrations.
  *

package/dist/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAeA,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAE1E,MAAM,MAAM,MAAM,GAAG;IAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,CAAC;AAIzD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,MAAM,GAAE,MAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,MAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAYf"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAqC,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,MAAM,MAAM,GAAG;IAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,CAAC;AAIzD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,MAAM,GAAE,MAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAUD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,qGAUtB,CAAC;AAEX,yDAAyD;AACzD,eAAO,MAAM,cAAc,mDAAoD,CAAC;AAgBhF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,QAAQ,EAAE,eAAe,CAAC;IAC1B,GAAG,EAAE,eAAe,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;CACjC,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,QAAO,MAA+C,CAAC;AA6BpF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAkFtE;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,MAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/admin.js

@@ -9,10 +9,11 @@
 // goes further: its Lambda user has SELECT+INSERT only, so the append-only
 // events table cannot be rewritten even by a bug.
 // ============================================================================
+import { randomBytes } from 'node:crypto';
 import { drizzle } from 'drizzle-orm/mysql2';
 import { migrate } from 'drizzle-orm/mysql2/migrator';
 import mysql from 'mysql2/promise';
-import { databaseUri, serverUri } from './config.js';
+import { SAFE_NAME, databaseUri, serverUri } from './config.js';
 const consoleLogger = { info: (message) => console.log(message) };
 /**
  * Create the database if it does not exist.
@@ -33,6 +34,177 @@ export async function ensureDatabase(config, logger = consoleLogger) {
         await connection.end();
     }
 }
+// ============================================================================
+// Provisioning: the database plus its two scoped users.
+//
+// This is the convention `shared/database.md` describes and that every repo
+// has so far encoded by hand in a deploy doc. A `<db>_migrator` owns the
+// schema, a `<db>_app` can only move rows through it.
+// ============================================================================
+/**
+ * The migrator's grants. DDL *and* DML, deliberately: Drizzle keeps its
+ * `__drizzle_migrations` bookkeeping table over the same connection, so a
+ * migrator holding DDL alone looks right and then fails partway through the
+ * first migration it records.
+ */
+export const MIGRATOR_PRIVILEGES = [
+    'ALTER',
+    'CREATE',
+    'DROP',
+    'INDEX',
+    'REFERENCES',
+    'SELECT',
+    'INSERT',
+    'UPDATE',
+    'DELETE',
+];
+/** The app's grants: row movement only, never schema. */
+export const APP_PRIVILEGES = ['SELECT', 'INSERT', 'UPDATE', 'DELETE'];
+/**
+ * What an app user may be narrowed to. An allowlist rather than a DDL denylist,
+ * so a privilege nobody thought about cannot slip through: Journeyman's Lambda
+ * user is SELECT+INSERT so its append-only events table cannot be rewritten
+ * even by a bug, and that is the shape of tightening this supports.
+ */
+const NARROWABLE_APP_PRIVILEGES = new Set(APP_PRIVILEGES);
+/** base64url: safe unquoted in a URI and unescaped in a SQL string literal. */
+const SAFE_SECRET = /^[A-Za-z0-9_-]+$/;
+/** MySQL account name host part. `%` is any host, the RDS default. */
+const SAFE_HOST = /^[A-Za-z0-9_%.:-]+$/;
+/** 192 bits, in an alphabet that needs no escaping in a URI or a SQL literal. */
+export const generatePassword = () => randomBytes(24).toString('base64url');
+function assertServerOnly(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`db-kit: admin URL is not a valid URI: ${JSON.stringify(url)}`);
+    }
+    if (parsed.pathname && parsed.pathname !== '/' && parsed.pathname !== '') {
+        throw new Error(`db-kit: admin URL must be the server only, with no database path (got "${parsed.pathname}").`);
+    }
+    return parsed;
+}
+function credentialUrl(admin, user, password) {
+    const url = new URL(admin.href);
+    url.username = user;
+    url.password = password;
+    url.pathname = '';
+    return url.href;
+}
+function grant(privileges, name, user, host) {
+    return `GRANT ${privileges.join(', ')} ON \`${name}\`.* TO '${user}'@'${host}'`;
+}
+/**
+ * Build the provisioning plan without touching a server. Separated from
+ * execution so `--dry-run` prints exactly what would run, and so the statement
+ * order and grants are testable without a MySQL instance.
+ */
+export function planProvision(options) {
+    const name = options.name.trim();
+    if (!name)
+        throw new Error('db-kit: a database name is required');
+    // The name is interpolated into DDL, where binding cannot help.
+    if (!SAFE_NAME.test(name)) {
+        throw new Error(`db-kit: refusing an unsafe database name: ${JSON.stringify(name)}`);
+    }
+    const host = options.grantHost ?? '%';
+    if (!SAFE_HOST.test(host)) {
+        throw new Error(`db-kit: refusing an unsafe grant host: ${JSON.stringify(host)}`);
+    }
+    const appPrivileges = options.appPrivileges ?? APP_PRIVILEGES;
+    if (appPrivileges.length === 0) {
+        throw new Error('db-kit: the app user needs at least one privilege');
+    }
+    for (const privilege of appPrivileges) {
+        if (!NARROWABLE_APP_PRIVILEGES.has(privilege)) {
+            throw new Error(`db-kit: refusing to grant ${JSON.stringify(privilege)} to the app user. ` +
+                `It may hold only ${[...NARROWABLE_APP_PRIVILEGES].join(', ')}; schema changes belong to the migrator.`);
+        }
+    }
+    const admin = assertServerOnly(options.adminUrl);
+    const generate = options.generatePassword ?? generatePassword;
+    const migratorUser = `${name}_migrator`;
+    const appUser = `${name}_app`;
+    const migratorPassword = generate();
+    const appPassword = generate();
+    for (const secret of [migratorPassword, appPassword]) {
+        if (!SAFE_SECRET.test(secret)) {
+            throw new Error('db-kit: generated password contains characters that are unsafe unescaped');
+        }
+    }
+    const account = (user, password) => [
+        { sql: `CREATE USER IF NOT EXISTS '${user}'@'${host}' IDENTIFIED BY '${password}'` },
+        // The CREATE above is a no-op for an existing account, so set the password
+        // explicitly. Otherwise a re-run prints credentials that do not work.
+        { sql: `ALTER USER '${user}'@'${host}' IDENTIFIED BY '${password}'` },
+        // Grants are additive, so revoke first: re-running must be able to TIGHTEN
+        // an account that was over-granted by hand, not just widen it. 1141 is
+        // "no such grant defined", which is the expected state on a fresh account.
+        //
+        // Two statements, not one. `REVOKE ALL PRIVILEGES, GRANT OPTION` is a
+        // separate grammar that takes no ON clause and drops everything globally;
+        // combining it with `ON db.*` is a syntax error, which is what MySQL 8.4
+        // said when this was first written as one line.
+        {
+            sql: `REVOKE ALL PRIVILEGES ON \`${name}\`.* FROM '${user}'@'${host}'`,
+            tolerate: [1141],
+        },
+        {
+            sql: `REVOKE GRANT OPTION ON \`${name}\`.* FROM '${user}'@'${host}'`,
+            tolerate: [1141],
+        },
+    ];
+    return {
+        name,
+        statements: [
+            { sql: `CREATE DATABASE IF NOT EXISTS \`${name}\`` },
+            ...account(migratorUser, migratorPassword),
+            { sql: grant(MIGRATOR_PRIVILEGES, name, migratorUser, host) },
+            ...account(appUser, appPassword),
+            { sql: grant(appPrivileges, name, appUser, host) },
+            { sql: 'FLUSH PRIVILEGES' },
+        ],
+        migrator: {
+            user: migratorUser,
+            password: migratorPassword,
+            url: credentialUrl(admin, migratorUser, migratorPassword),
+        },
+        app: {
+            user: appUser,
+            password: appPassword,
+            url: credentialUrl(admin, appUser, appPassword),
+        },
+    };
+}
+/**
+ * Create the database and its two scoped users, idempotently.
+ *
+ * Re-running rotates both passwords and re-applies the grants, so the plan it
+ * prints is always the truth about how to connect afterwards.
+ */
+export async function provisionDatabase(plan, adminUrl, logger = consoleLogger) {
+    const connection = await mysql.createConnection({ uri: adminUrl });
+    try {
+        for (const statement of plan.statements) {
+            try {
+                await connection.query(statement.sql);
+            }
+            catch (error) {
+                const errno = error.errno;
+                if (statement.tolerate && errno !== undefined && statement.tolerate.includes(errno)) {
+                    continue;
+                }
+                throw error;
+            }
+        }
+        logger.info(`Provisioned ${plan.name} with ${plan.migrator.user} and ${plan.app.user}.`);
+    }
+    finally {
+        await connection.end();
+    }
+}
 /**
  * Apply pending Drizzle migrations.
  *

package/dist/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,gFAAgF;AAChF,2EAA2E;AAC3E,kDAAkD;AAClD,+EAA+E;AAE/E,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,KAAK,MAAM,gBAAgB,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAuB,MAAM,aAAa,CAAC;AAI1E,MAAM,aAAa,GAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,SAAiB,aAAa;IAE9B,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAsB,EACtB,gBAAwB,EACxB,SAAiB,aAAa;IAE9B,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC9C,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC;QACxB,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,4BAA4B,gBAAgB,OAAO,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;QAClF,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;AACH,CAAC"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,gFAAgF;AAChF,2EAA2E;AAC3E,kDAAkD;AAClD,+EAA+E;AAE/E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,KAAK,MAAM,gBAAgB,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAuB,MAAM,aAAa,CAAC;AAIrF,MAAM,aAAa,GAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,SAAiB,aAAa;IAE9B,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,sDAAsD;AACtD,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;CACA,CAAC;AAEX,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;AAElE,+EAA+E;AAC/E,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAEvC,sEAAsE;AACtE,MAAM,SAAS,GAAG,qBAAqB,CAAC;AA0CxC,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEpF,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,0EAA0E,MAAM,CAAC,QAAQ,KAAK,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAU,EAAE,IAAY,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACxB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,KAAK,CAAC,UAA6B,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY;IACpF,OAAO,SAAS,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,YAAY,IAAI,MAAM,IAAI,GAAG,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAyB;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClE,gEAAgE;IAChE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC;IAC9D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,oBAAoB;gBACxE,oBAAoB,CAAC,GAAG,yBAAyB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,gBAAgB,CAAC;IAC9D,MAAM,YAAY,GAAG,GAAG,IAAI,WAAW,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC;IAC9B,MAAM,gBAAgB,GAAG,QAAQ,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,QAAQ,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAwB,EAAE,CAAC;QACxE,EAAE,GAAG,EAAE,8BAA8B,IAAI,MAAM,IAAI,oBAAoB,QAAQ,GAAG,EAAE;QACpF,2EAA2E;QAC3E,sEAAsE;QACtE,EAAE,GAAG,EAAE,eAAe,IAAI,MAAM,IAAI,oBAAoB,QAAQ,GAAG,EAAE;QACrE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,EAAE;QACF,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,gDAAgD;QAChD;YACE,GAAG,EAAE,8BAA8B,IAAI,cAAc,IAAI,MAAM,IAAI,GAAG;YACtE,QAAQ,EAAE,CAAC,IAAI,CAAC;SACjB;QACD;YACE,GAAG,EAAE,4BAA4B,IAAI,cAAc,IAAI,MAAM,IAAI,GAAG;YACpE,QAAQ,EAAE,CAAC,IAAI,CAAC;SACjB;KACF,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,UAAU,EAAE;YACV,EAAE,GAAG,EAAE,mCAAmC,IAAI,IAAI,EAAE;YACpD,GAAG,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC;YAC1C,EAAE,GAAG,EAAE,KAAK,CAAC,mBAAmB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE;YAC7D,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC;YAChC,EAAE,GAAG,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;YAClD,EAAE,GAAG,EAAE,kBAAkB,EAAE;SAC5B;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,gBAAgB;YAC1B,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,gBAAgB,CAAC;SAC1D;QACD,GAAG,EAAE;YACH,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,WAAW;YACrB,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;SAChD;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAmB,EACnB,QAAgB,EAChB,SAAiB,aAAa;IAE9B,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,GAAI,KAA4B,CAAC,KAAK,CAAC;gBAClD,IAAI,SAAS,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpF,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAC3F,CAAC;YAAS,CAAC;QACT,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAsB,EACtB,gBAAwB,EACxB,SAAiB,aAAa;IAE9B,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC9C,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC;QACxB,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,4BAA4B,gBAAgB,OAAO,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;QAClF,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/bin/provision.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=provision.d.ts.map

package/dist/bin/provision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../../src/bin/provision.ts"],"names":[],"mappings":""}

package/dist/bin/provision.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+// `wmi-db-provision <name> --admin-url <uri>` — create a service's database and
+// its two scoped users.
+//
+// Replaces the block of manual SQL each repo carries in docs/deploy.md.
+//   "db:provision": "wmi-db-provision"
+//
+// Note what this does NOT do: it never calls loadNearestEnv(). The other two
+// bins read the service's .env on purpose; this one must not, or it would
+// happily provision whichever instance a stray DATABASE_URL points at. The
+// admin credential is supplied deliberately every time.
+import { parseArgs } from 'node:util';
+import { APP_PRIVILEGES, planProvision, provisionDatabase } from '../admin.js';
+const USAGE = `Usage: wmi-db-provision <database> --admin-url <uri> [options]
+
+Creates, idempotently:
+  \`<database>\`
+  <database>_migrator   schema owner (DDL + DML, for Drizzle's bookkeeping)
+  <database>_app        row access only (${APP_PRIVILEGES.join(', ')})
+
+Options:
+  --admin-url <uri>     Admin credential, server only, no database path.
+                        Reads WMI_DB_ADMIN_URL if the flag is omitted, which
+                        keeps the password out of your shell history.
+  --app-privileges <l>  Narrow the app user, e.g. SELECT,INSERT for an
+                        append-only service. Default: ${APP_PRIVILEGES.join(',')}
+  --grant-host <host>   Host part of both accounts. Default: %
+  --dry-run             Print the exact statements and exit without connecting.
+  --help
+
+Passwords are generated here, printed once, and never written to disk.
+Re-running rotates them and re-applies the grants.`;
+function fail(message) {
+    console.error(message);
+    process.exit(1);
+}
+let parsed;
+try {
+    parsed = parseArgs({
+        allowPositionals: true,
+        options: {
+            'admin-url': { type: 'string' },
+            'app-privileges': { type: 'string' },
+            'grant-host': { type: 'string' },
+            'dry-run': { type: 'boolean', default: false },
+            help: { type: 'boolean', default: false },
+        },
+    });
+}
+catch (error) {
+    fail(`${error instanceof Error ? error.message : error}\n\n${USAGE}`);
+}
+const { values, positionals } = parsed;
+if (values.help) {
+    console.log(USAGE);
+    process.exit(0);
+}
+const name = positionals[0];
+if (!name)
+    fail(`A database name is required.\n\n${USAGE}`);
+if (positionals.length > 1) {
+    fail(`Unexpected argument ${JSON.stringify(positionals[1])}. One database at a time.\n\n${USAGE}`);
+}
+const adminUrl = values['admin-url'] ?? process.env.WMI_DB_ADMIN_URL;
+if (!adminUrl) {
+    fail('An admin credential is required: pass --admin-url or set WMI_DB_ADMIN_URL.\n' +
+        'It is never read from the service .env, so that provisioning cannot target ' +
+        'the wrong instance by accident.');
+}
+const appPrivileges = values['app-privileges']
+    ?.split(',')
+    .map((p) => p.trim().toUpperCase())
+    .filter(Boolean);
+try {
+    const plan = planProvision({
+        adminUrl,
+        name,
+        ...(values['grant-host'] ? { grantHost: values['grant-host'] } : {}),
+        ...(appPrivileges?.length ? { appPrivileges } : {}),
+    });
+    if (values['dry-run']) {
+        console.log(`-- Dry run for \`${plan.name}\`. Nothing was executed.`);
+        console.log(plan.statements.map((s) => `${s.sql};`).join('\n'));
+        process.exit(0);
+    }
+    await provisionDatabase(plan, adminUrl);
+    // Once, to stdout, and nowhere else.
+    console.log('');
+    console.log('Copy these now. They are shown once and never written to disk.');
+    console.log('');
+    console.log(`  The service (.env, samconfig.toml):`);
+    console.log(`    DATABASE_URL=${plan.app.url}`);
+    console.log(`    DATABASE_NAME=${plan.name}`);
+    console.log('');
+    console.log(`  The deploy workflow (GitHub secret MIGRATOR_DATABASE_URL):`);
+    console.log(`    ${plan.migrator.url}`);
+    console.log('');
+}
+catch (error) {
+    fail(error instanceof Error ? error.message : String(error));
+}
+//# sourceMappingURL=provision.js.map

package/dist/bin/provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../src/bin/provision.ts"],"names":[],"mappings":";AACA,gFAAgF;AAChF,wBAAwB;AACxB,EAAE;AACF,wEAAwE;AACxE,uCAAuC;AACvC,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AAExD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE/E,MAAM,KAAK,GAAG;;;;;2CAK6B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;wDAOZ,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;;mDAM7B,CAAC;AAEpD,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,MAAM,CAAC;AACX,IAAI,CAAC;IACH,MAAM,GAAG,SAAS,CAAC;QACjB,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC/B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAC9C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SAC1C;KACF,CAAC,CAAC;AACL,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,IAAI,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;AAEvC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAC5B,IAAI,CAAC,IAAI;IAAE,IAAI,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;AAC5D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC3B,IAAI,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACd,IAAI,CACF,8EAA8E;QAC5E,6EAA6E;QAC7E,iCAAiC,CACpC,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC5C,EAAE,KAAK,CAAC,GAAG,CAAC;KACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;KAClC,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,IAAI,CAAC;IACH,MAAM,IAAI,GAAG,aAAa,CAAC;QACzB,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAExC,qCAAqC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { DEFAULT_CONNECTION_LIMIT, SAFE_NAME, databaseConfig, databaseConfigFromEnv, databaseUri, serverUri, type DatabaseConfig, } from './config.js';
 export { createDbHandle, type Db, type DbHandle } from './client.js';
-export { ensureDatabase, runMigrations, type Logger } from './admin.js';
+export { APP_PRIVILEGES, MIGRATOR_PRIVILEGES, ensureDatabase, generatePassword, planProvision, provisionDatabase, runMigrations, type Logger, type ProvisionOptions, type ProvisionPlan, type ProvisionStatement, type ProvisionedUser, } from './admin.js';
 export { findNearestEnvFile, loadNearestEnv } from './env.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,SAAS,EACT,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAExE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,SAAS,EACT,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,KAAK,MAAM,EACX,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 export { DEFAULT_CONNECTION_LIMIT, SAFE_NAME, databaseConfig, databaseConfigFromEnv, databaseUri, serverUri, } from './config.js';
 export { createDbHandle } from './client.js';
-export { ensureDatabase, runMigrations } from './admin.js';
+export { APP_PRIVILEGES, MIGRATOR_PRIVILEGES, ensureDatabase, generatePassword, planProvision, provisionDatabase, runMigrations, } from './admin.js';
 export { findNearestEnvFile, loadNearestEnv } from './env.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,SAAS,GAEV,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,cAAc,EAA0B,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAe,MAAM,YAAY,CAAC;AAExE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,SAAS,GAEV,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,cAAc,EAA0B,MAAM,aAAa,CAAC;AAErE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,aAAa,GAMd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@waukeshamakerspace/db-kit",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "MySQL + Drizzle plumbing for Waukesha Makerspace services: the house DATABASE_URL/DATABASE_NAME convention, a lazy pool, and the ensure/migrate commands every WMI repo was copying by hand",
   "license": "MIT",
   "repository": {
@@ -20,7 +20,8 @@
   },
   "bin": {
     "wmi-db-ensure": "dist/bin/ensure.js",
-    "wmi-db-migrate": "dist/bin/migrate.js"
+    "wmi-db-migrate": "dist/bin/migrate.js",
+    "wmi-db-provision": "dist/bin/provision.js"
   },
   "files": [
     "dist/"