@zerotal/orm 1.3.0 → 1.5.0

package/CHANGELOG.md

@@ -8,6 +8,160 @@ follows the Zerotal monorepo's unified versioning.
 
 ## [Unreleased]
 
+## [1.5.0] — 2026-08-15
+
+### Fixed
+
+- **N+1 detection was running in production.** The gate read `Bun.env.APP_ENV`, which
+  by the time a provider boots holds the runtime mode (`web`) rather than the
+  deployment name — `setAppEnv()` overwrote it. So the check that exists to help in
+  development was wrapping every query on live apps, to warn about something nobody
+  was there to read. It now asks `deployEnv()`, which is what the deployment name
+  survives in.
+
+### Added
+
+- **A missing table now offers to run the migration that would create it.**
+  When a query fails because a table or column does not exist, the development
+  error page reports which migrations have not run and offers to run them.
+  Detection is by driver error code where there is one — `42P01` / `42703` on
+  PostgreSQL, `1146` / `1054` on MySQL — and by message on SQLite, which has
+  none worth branching on.
+
+  **The half that matters is when it does _not_ offer the button.** With nothing
+  pending, running every migration changes nothing and leaves the developer back
+  where they started, so instead it says whether any migration on disk even
+  mentions the missing name — if none does, the migration was probably never
+  written, which is a different problem with a different fix.
+
+  The endpoint behind the button carries three guards, each checked on its own
+  rather than inferred from the overlay being dev-only: `devSurfacesEnabled()`
+  at request time (which **fails closed** — unlike `!isProdLike()`, an unset
+  `APP_ENV` does not qualify), a single-use token minted into the page, and the
+  same origin check the raw Flow endpoints use, since a raw route sits outside
+  CSRF middleware. Outside development the route is never registered at all.
+
+- **`migrate:refresh`** — the same command as `migrate:fresh`, under the name it has
+  elsewhere. Nothing otherwise pushes anyone to run their `down()` methods, and a
+  rollback nobody has exercised is a rollback that does not work.
+
+- **`--seed` on `migrate` and `migrate:fresh`.** Wiping a database and repopulating it is
+  one thought, and it took two commands — `bun zt migrate:fresh && bun zt db:seed` — with
+  the second easy to forget and nothing to remind you. The flag closes that:
+
+  ```bash
+  bun zt migrate:fresh --seed        # rebuild the schema, then seed it
+  bun zt migrate --fresh --seed      # the same thing
+  bun zt migrate --seed              # apply pending migrations, then seed
+  ```
+
+  `migrate --seed` seeds even when nothing was pending, because topping up an
+  already-current dev database is a normal reason to run it.
+
+  A seeding failure is reported but does not fail the command. The migrations above have
+  already committed by then, and exiting non-zero would suggest the whole operation needs
+  repeating when only the seeders do — so the output says the schema was rebuilt and
+  points at `bun zt db:seed` for the retry.
+
+  The seeder-loading logic is now shared with `db:seed` rather than duplicated, so all
+  three commands accept the same shapes: a class-based `DatabaseSeeder` (named or default
+  export) and the legacy `database/seeders/index.ts` default function.
+
+### Changed
+
+- **The N+1 detector reads the bindings, not just the SQL text.** Grouping by SQL alone
+  made a legitimate loop over six months — identical SQL, a different `period` each
+  time — indistinguishable from a per-row lookup, so it told you to eager-load a
+  relation that does not exist. The warning now says which of the two it found: _same
+  SQL, different arguments_ points at eager loading or `whereIn`; _same SQL, same
+  arguments_ points at `RequestContext.remember()`, because there is nothing to
+  eager-load when the answer never changes. `NPlusOneError.distinctArgs` carries the
+  count.
+
+### Fixed
+
+- **A `Date` in a query-builder write is no longer silently discarded.**
+  `update({ read_at: new Date() })` bound the `Date` object straight through; SQLite
+  dropped it and **reported no error**, so a "mark all as read" feature shipped as a
+  latent no-op whose source read correctly. The asymmetry made it easy to write, too —
+  `model.save()` applies casts, so the identical value through a model worked. Dates
+  and `Carbon` instances are now serialised at the single point every bind passes
+  through, dialect-aware (MySQL DATETIME rejects ISO 8601's `T`/`Z`), which covers
+  `update`, `insert`, `where` and every builder at once. The comparison path had
+  already learned this lesson separately; now there is one place it lives.
+
+- **`foreignId(...).nullable().constrained()` type-checks.** `nullable()` returned
+  `ColumnBuilder`, so the chain left `ForeignIdColumnBuilder` and `.constrained()` was
+  gone — the form the class's own docblock documents, and the first one anyone reaches
+  for, since a nullable foreign key is the commonest kind. The two modifiers now
+  preserve the subclass while keeping the `nullability` lock, so
+  `.nullable().notNullable()` is still a compile error.
+
+- **SQLite refuses an impossible `dropColumn` before applying anything.** SQLite cannot
+  drop a column a foreign key still names, and it says so _after_ every earlier
+  statement in the same `Schema.table()` block has run — the difference between a
+  migration that did nothing and one that has to be unpicked by hand. A `PRAGMA
+foreign_key_list` check now runs first and throws a message naming the column, the
+  table it references, and the table-rebuild way out. The rebuild itself is still not
+  implemented; this makes its absence safe rather than expensive.
+
+- **Altering a Postgres column no longer silently drops its NOT NULL and DEFAULT.**
+  The regexes that split a column definition into `ALTER COLUMN` sub-commands
+  carried literal backspace characters (0x08) where `\b` word boundaries were
+  meant — invisible in any editor, and impossible for either pattern to match. So
+  `table.string("email").notNullable().alter()` emitted `DROP NOT NULL`, and a
+  declared default emitted `DROP DEFAULT`, on every alter, regardless of the
+  definition. Found by the lint ratchet (`no-control-regex`); the statements are
+  now pinned by tests, not just the column name.
+
+## [1.4.0] — 2026-08-10
+
+### Added
+
+- **Encrypted columns.** A column can now hold ciphertext at rest and plaintext on
+  the model, keyed by `APP_KEY` with AES-256-GCM. Declare it per-column or as a
+  list; the two mean the same thing and resolve to the same cast:
+
+  ```ts
+  @column("encrypted", { nullable: true }) idNumber?: string;
+  @column("encrypted:json") medical?: MedicalInfo;
+
+  // …the same, spelled out — `encrypted` is a cast, not a storage type:
+  @column({ type: "text", nullable: true, cast: "encrypted" }) passportNumber?: string;
+
+  static encryptable = ["idNumber", "passportNumber"];
+  ```
+
+  `encrypted` and `encrypted:json` join the `@column("…")` shorthands, resolving
+  to `{ type: "text", cast: "encrypted" }` — so the storage type is right without
+  having to know that ciphertext outgrows its plaintext.
+
+  Encryption happens on the way to the database rather than to the instance, so —
+  unlike `hashable` — it is non-destructive: after `save()` the property still
+  holds what you assigned. `$dirty` compares plaintext, so an unchanged column is
+  not rewritten with a fresh IV on every unrelated save.
+
+  A column listed in `encryptable` whose `@column({ type })` is `json` encrypts as
+  `encrypted:json`, so it round-trips as the structure it was instead of reaching
+  the cipher as `"[object Object]"`.
+
+  **`where()` on an encrypted column throws** rather than returning nothing. The
+  bind path runs a column's cast over the search value, which would encrypt it
+  under a fresh IV and compare it against ciphertext written with a different one:
+  zero rows, no error, and a screen reading "no such client" for a client who is
+  right there. `EncryptedColumnError` says so and points at a blind index.
+
+  **A value the key cannot open fails the read**, naming the model, the column and
+  the two causes (a rotated `APP_KEY`, or plaintext that predates the cast).
+  Returning the ciphertext instead would put an unreadable value where the
+  application expects a real one — displayed, reported on, or re-encrypted by the
+  next save, which destroys the original.
+
+  `migrate:generate` and `synchronize()` widen an encrypted column to TEXT
+  whatever it was declared as. A payload is ~1.4× the plaintext plus 28 bytes, and
+  MySQL outside strict mode truncates rather than failing — a truncated payload
+  never decrypts, so the row would be destroyed silently at write time.
+
 ## [1.3.0] — 2026-08-09
 
 ### Changed — BREAKING

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerotal/orm",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "license": "MIT",
   "maturity": "stable",
   "private": false,
@@ -30,8 +30,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zerotal/core": "1.3.0",
-    "@zerotal/validator": "1.3.0"
+    "@zerotal/core": "1.5.0",
+    "@zerotal/validator": "1.5.0"
   },
   "devDependencies": {
     "typescript": "^5.8.0"

package/src/casts/encrypted.ts

@@ -0,0 +1,168 @@
+/**
+ * Encrypted columns — ciphertext at rest, plaintext on the model.
+ *
+ * The column stores an opaque AES-256-GCM payload keyed by `APP_KEY`; the model
+ * property holds the value you assigned. Encryption happens on the way to the
+ * database and decryption on the way back, so nothing in between — your code,
+ * validation, `$dirty` — has to know the column is encrypted.
+ *
+ * Two ways to declare one, and they compile to the same thing:
+ *
+ * ```ts
+ * class Client extends BaseModel {
+ *   @column({ type: "text", nullable: true, cast: "encrypted" })
+ *   idNumber?: string;
+ *
+ *   // …or, for several columns at once:
+ *   static encryptable = ["idNumber", "passportNumber"];
+ * }
+ * ```
+ *
+ * **The column must be `text`, not `string`.** A payload is roughly a third
+ * larger than its plaintext plus 28 bytes of IV and auth tag, so a 13-character
+ * ID number lands around 60 characters and a paragraph overflows a `VARCHAR(255)`
+ * that comfortably held it before.
+ *
+ * **You cannot query an encrypted column.** Every write draws a fresh IV, so the
+ * same value encrypts to different ciphertext each time and an equality match can
+ * never hit. `where()` on one throws rather than returning zero rows — see
+ * {@link EncryptedColumnError}. If you need lookup, keep a separate hashed column
+ * (a blind index) beside it and query that.
+ *
+ * **Decryption failure is fatal to the read**, deliberately. Returning the
+ * ciphertext instead would put an unreadable value where the application expects
+ * a real one — displayed to a user, written into a report, or re-encrypted on the
+ * next save, which destroys the original for good.
+ *
+ * @packageDocumentation
+ */
+
+import { ZerotalError } from "@zerotal/core";
+import { Crypt } from "@zerotal/core/security";
+
+/** The cast names that mean "encrypt this column". */
+export type EncryptedCastName = "encrypted" | "encrypted:json";
+
+/** Raised for anything an encrypted column cannot do. */
+export class EncryptedColumnError extends ZerotalError {
+  constructor(message: string, code: string, context?: Record<string, unknown>) {
+    super(message, code, 500, context);
+  }
+}
+
+/** Whether a resolved cast option is one of the encrypted ones. */
+export function isEncryptedCast(cast: unknown): cast is EncryptedCastName {
+  return cast === "encrypted" || cast === "encrypted:json";
+}
+
+/**
+ * Model value → the ciphertext written to the column.
+ *
+ * @param label - `Model.column`, or just the column name, for error messages.
+ */
+export function encryptColumn(value: unknown, cast: EncryptedCastName, label: string): unknown {
+  if (value === null || value === undefined) return value;
+
+  if (cast === "encrypted:json") return Crypt.encryptString(JSON.stringify(value));
+
+  if (typeof value !== "string") {
+    // Not coerced with String(). `42` would store as "42" and read back as the
+    // string "42" — the value's type silently changing between write and read,
+    // which is worse than refusing it, because nothing fails until something
+    // downstream compares it.
+    throw new EncryptedColumnError(
+      `[Zerotal] ${label} is cast "encrypted", which stores strings, but a ` +
+        `${Array.isArray(value) ? "array" : typeof value} was assigned. Use ` +
+        `cast: "encrypted:json" to encrypt a structured value — it round-trips the type.`,
+      "E_ENCRYPTED_COLUMN_NOT_A_STRING",
+      { column: label, received: typeof value },
+    );
+  }
+
+  return Crypt.encryptString(value);
+}
+
+/**
+ * Stored ciphertext → the value the model exposes.
+ *
+ * @param label - `Model.column`, for error messages.
+ * @throws {@link EncryptedColumnError} When the stored value is not ciphertext
+ *   this `APP_KEY` can open.
+ */
+export function decryptColumn(value: unknown, cast: EncryptedCastName, label: string): unknown {
+  if (value === null || value === undefined) return value;
+
+  let plain: string;
+  try {
+    plain = Crypt.decryptString(String(value));
+  } catch (cause) {
+    throw new EncryptedColumnError(
+      `[Zerotal] Could not decrypt ${label}. The column is cast "${cast}", so what is ` +
+        `stored has to be ciphertext this APP_KEY can open. Two things cause this: ` +
+        `APP_KEY changed since the row was written (decrypt with the old key and ` +
+        `re-save), or the column already held plaintext when the cast was added ` +
+        `(back-fill the existing rows before switching it on). The row cannot be read ` +
+        `until one of those is resolved.`,
+      "E_ENCRYPTED_COLUMN_UNREADABLE",
+      { column: label, cause: cause instanceof Error ? cause.message : String(cause) },
+    );
+  }
+
+  if (cast !== "encrypted:json") return plain;
+  try {
+    return JSON.parse(plain);
+  } catch {
+    // Decrypted cleanly, so the key is right and the bytes are intact — the
+    // column simply was not written as JSON. Says so, rather than reporting a
+    // key problem it does not have.
+    throw new EncryptedColumnError(
+      `[Zerotal] ${label} decrypted, but its contents are not JSON. The column is cast ` +
+        `"encrypted:json"; a column written under plain "encrypted" reads back with that.`,
+      "E_ENCRYPTED_COLUMN_NOT_JSON",
+      { column: label },
+    );
+  }
+}
+
+/** The error thrown when someone tries to filter on an encrypted column. */
+export function encryptedQueryError(label: string): EncryptedColumnError {
+  return new EncryptedColumnError(
+    `[Zerotal] Cannot filter on ${label} — it is an encrypted column. Every write draws ` +
+      `a fresh IV, so the same value encrypts to different ciphertext each time and an ` +
+      `equality match can never hit. Keep a separate hashed lookup column (a blind index) ` +
+      `beside it and query that instead.`,
+    "E_ENCRYPTED_COLUMN_NOT_QUERYABLE",
+    { column: label },
+  );
+}
+
+/**
+ * Resolve `static encryptable = [...]` down a prototype chain into cast entries.
+ *
+ * Declaring it is exactly equivalent to putting `cast: "encrypted"` on each of
+ * those columns, which is why it resolves to casts here rather than being handled
+ * separately: read, write, `$dirty` and the query guard then all see one thing.
+ *
+ * A `json` column resolves to `encrypted:json` on its own — the alternative is
+ * `String(someObject)` reaching the cipher as `"[object Object]"`.
+ *
+ * Entries union down the chain, so a base model marking a column encrypted keeps
+ * it encrypted in a subclass that lists its own.
+ *
+ * @param chain - The constructor chain, base-most first.
+ * @param columnType - Declared `@column({ type })` for a property, if any.
+ */
+export function collectEncryptable(
+  chain: readonly object[],
+  columnType: (key: string) => string | undefined,
+): Record<string, EncryptedCastName> {
+  const out: Record<string, EncryptedCastName> = {};
+  for (const entry of chain) {
+    const keys = (entry as { encryptable?: string[] }).encryptable;
+    if (!keys) continue;
+    for (const key of keys) {
+      out[key] = columnType(key) === "json" ? "encrypted:json" : "encrypted";
+    }
+  }
+  return out;
+}

package/src/commands/DbSeedCommand.ts

@@ -1,5 +1,5 @@
 import { Command } from "@zerotal/core";
-import type { Seeder } from "../seeding/Seeder.ts";
+import { runSeeders } from "./_runSeeders.ts";
 
 /**
  * Runs the application's database seeders (`bun zt db:seed`).
@@ -21,51 +21,23 @@ export class DbSeedCommand extends Command {
   static needsApp = true;
 
   async run(): Promise<void> {
-    const cwd = process.cwd();
-    const seederPath = `${cwd}/database/seeders/DatabaseSeeder.ts`;
+    this.section("Database Seeding");
+    const outcome = await runSeeders();
 
-    const file = Bun.file(seederPath);
-    if (!(await file.exists())) {
-      // Fall back to legacy index.ts seeder format
-      const legacyPath = `${cwd}/database/seeders/index.ts`;
-      if (await Bun.file(legacyPath).exists()) {
-        try {
-          const mod = await import(legacyPath);
-          const seed = mod.default as (() => Promise<void>) | undefined;
-          if (!seed) {
-            this.error("Seeder index must export a default async function.");
-            return;
-          }
-          await seed();
-          this.info("Database seeded.");
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          this.error(`Failed to run seeders: ${msg}`);
-        }
+    switch (outcome.status) {
+      case "seeded":
+        this.info("Database seeded successfully.");
         return;
-      }
-
-      this.error(`Seeder not found: ${seederPath}`);
-      this.dim("Create it with: bun zerotal.ts make:seeder DatabaseSeeder");
-      return;
-    }
-
-    try {
-      const mod = await import(seederPath);
-      const SeederClass = (mod.DatabaseSeeder ?? mod.default) as (new () => Seeder) | undefined;
-
-      if (!SeederClass) {
-        this.error("DatabaseSeeder not found as a named or default export.");
+      case "missing":
+        this.error(`Seeder not found: ${outcome.path}`);
+        this.dim("Create it with: bun zerotal.ts make:seeder DatabaseSeeder");
+        return;
+      case "invalid":
+        this.error(outcome.message);
+        return;
+      case "failed":
+        this.error(`Failed to run seeders: ${outcome.message}`);
         return;
-      }
-
-      this.section("Database Seeding");
-      const seeder = new SeederClass();
-      await seeder.run();
-      this.info("Database seeded successfully.");
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      this.error(`Failed to run seeders: ${msg}`);
     }
   }
 }

package/src/commands/MigrateCommand.ts

@@ -1,20 +1,22 @@
-import { Command } from "@zerotal/core";
+import { Command, type FlagDef } from "@zerotal/core";
 import type { MigrationEntry } from "../schema/MigrationRunner.ts";
 import { MigrationRunner } from "../schema/MigrationRunner.ts";
 import { _getConnection } from "../db/DB.ts";
 import { loadMigrations } from "./_loadMigrations.ts";
+import { runSeeders } from "./_runSeeders.ts";
 
 /**
  * Runs all pending database migrations (`bun zt migrate`).
  *
  * Loads every migration under `database/migrations/`, then applies those not
  * yet run. Passing `--fresh` first drops all tables and re-runs every
- * migration from scratch.
+ * migration from scratch; `--seed` runs the seeders afterwards.
  *
  * @example
  * ```bash
  * bun zt migrate
  * bun zt migrate --fresh
+ * bun zt migrate --fresh --seed
  * ```
  *
  * @category Migrations
@@ -24,13 +26,19 @@ export class MigrateCommand extends Command {
   static aliases = ["db:migrate"];
   static description = "Run all pending database migrations";
   static needsApp = true;
-  static flags = [
+  static flags: FlagDef[] = [
     {
       name: "fresh",
-      type: "boolean" as const,
+      type: "boolean",
       description: "Drop all tables and re-run all migrations",
       default: false,
     },
+    {
+      name: "seed",
+      type: "boolean",
+      description: "Run database seeders once migrations have run",
+      default: false,
+    },
   ];
 
   async run(): Promise<void> {
@@ -51,10 +59,41 @@ export class MigrateCommand extends Command {
 
     if (ran.length === 0) {
       this.info("Nothing to migrate.");
-      return;
+    } else {
+      this.info(`Migrated ${ran.length} migration(s).`);
+      this.table(ran.map((name) => [name, "ran"]));
     }
 
-    this.info(`Migrated ${ran.length} migration(s).`);
-    this.table(ran.map((name) => [name, "ran"]));
+    // Seeding runs even when nothing migrated: `migrate --seed` against an
+    // already-current schema is a normal way to top up a dev database.
+    if (this.flags["seed"] as boolean) await this.#seed();
+  }
+
+  /**
+   * Seed after migrating.
+   *
+   * Reported, not thrown: the migrations above already committed, and failing
+   * the command here would suggest they need repeating when only the seeders do.
+   */
+  async #seed(): Promise<void> {
+    this.section("Database Seeding");
+    const outcome = await runSeeders();
+
+    switch (outcome.status) {
+      case "seeded":
+        this.info("Database seeded successfully.");
+        return;
+      case "missing":
+        this.error(`Seeder not found: ${outcome.path}`);
+        this.dim("Create it with: bun zerotal.ts make:seeder DatabaseSeeder");
+        return;
+      case "invalid":
+        this.error(outcome.message);
+        return;
+      case "failed":
+        this.error(`Failed to run seeders: ${outcome.message}`);
+        this.dim("Migrations already ran — re-run `bun zt db:seed` once the seeder is fixed.");
+        return;
+    }
   }
 }

package/src/commands/MigrateFreshCommand.ts

@@ -1,18 +1,21 @@
-import { Command } from "@zerotal/core";
+import { Command, type FlagDef } from "@zerotal/core";
 import type { MigrationEntry } from "../schema/MigrationRunner.ts";
 import { MigrationRunner } from "../schema/MigrationRunner.ts";
 import { _getConnection } from "../db/DB.ts";
 import { loadMigrations } from "./_loadMigrations.ts";
+import { runSeeders } from "./_runSeeders.ts";
 
 /**
  * Rolls back every migration, then re-runs them from scratch (`bun zt migrate:fresh`).
  *
  * Resets the database by reversing all applied migrations and then re-applying
- * the full set, giving a clean, fully-migrated schema in one step.
+ * the full set, giving a clean, fully-migrated schema in one step. Pass
+ * `--seed` to repopulate it afterwards, which is the usual reason for wiping it.
  *
  * @example
  * ```bash
  * bun zt migrate:fresh
+ * bun zt migrate:fresh --seed
  * ```
  *
  * @category Migrations
@@ -22,6 +25,15 @@ export class MigrateFreshCommand extends Command {
   static description = "Roll back every migration, then re-run them from scratch";
   static needsApp = true;
 
+  static flags: FlagDef[] = [
+    {
+      name: "seed",
+      type: "boolean",
+      description: "Run database seeders once the schema has been rebuilt",
+      default: false,
+    },
+  ];
+
   async run(): Promise<void> {
     const records = await loadMigrations();
     const entries: MigrationEntry[] = records.map((r) => ({
@@ -37,5 +49,36 @@ export class MigrateFreshCommand extends Command {
     if (ran.length > 0) {
       this.table(ran.map((name) => [name, "migrated"]));
     }
+
+    if (this.flags["seed"] as boolean) await this.#seed();
+  }
+
+  /**
+   * Seed the freshly-migrated schema.
+   *
+   * A seeding failure is reported but does not fail the command: the migrations
+   * above already ran and committed, and exiting non-zero here would suggest the
+   * whole operation needs repeating when only the seeders do.
+   */
+  async #seed(): Promise<void> {
+    this.section("Database Seeding");
+    const outcome = await runSeeders();
+
+    switch (outcome.status) {
+      case "seeded":
+        this.info("Database seeded successfully.");
+        return;
+      case "missing":
+        this.error(`Seeder not found: ${outcome.path}`);
+        this.dim("Create it with: bun zerotal.ts make:seeder DatabaseSeeder");
+        return;
+      case "invalid":
+        this.error(outcome.message);
+        return;
+      case "failed":
+        this.error(`Failed to run seeders: ${outcome.message}`);
+        this.dim("The schema was rebuilt — re-run `bun zt db:seed` once the seeder is fixed.");
+        return;
+    }
   }
 }

package/src/commands/MigrateRefreshCommand.ts

@@ -0,0 +1,28 @@
+import { MigrateFreshCommand } from "./MigrateFreshCommand.ts";
+
+/**
+ * `bun zt migrate:refresh` — a second name for `migrate:fresh`, pointing at the
+ * same command.
+ *
+ * `migrate:fresh` already runs every migration's `down()` and then every `up()`
+ * again, which is what "refresh" means to most people arriving here; elsewhere
+ * the two names are split, and "fresh" is the one that drops the tables outright
+ * without touching `down()`. So the behaviour was always there — only the name
+ * people reach for was missing, and reaching for a command that does not exist
+ * is how a broken `down()` stays unexercised until the day it matters.
+ *
+ * A subclass rather than a second implementation: one code path, two names.
+ *
+ * @example
+ * ```bash
+ * bun zt migrate:refresh
+ * bun zt migrate:refresh --seed
+ * ```
+ *
+ * @category Migrations
+ */
+export class MigrateRefreshCommand extends MigrateFreshCommand {
+  static override commandName = "migrate:refresh";
+  static override description =
+    "Roll every migration back through down(), then re-run them (alias of migrate:fresh)";
+}