@zintrust/core 0.1.41 → 0.1.43

package/src/cli/commands/D1MigrateCommand.js

@@ -1,9 +1,13 @@
 import { BaseCommand } from '../BaseCommand.js';
+import { D1SqlMigrations } from '../d1/D1SqlMigrations.js';
+import { WranglerConfig } from '../d1/WranglerConfig.js';
 import { WranglerD1 } from '../d1/WranglerD1.js';
 import { resolveNpmPath } from '../../common/index.js';
 import { appConfig } from '../../config/app.js';
+import { databaseConfig } from '../../config/database.js';
 import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import * as path from '../../node-singletons/path.js';
 const RESOLVED_VOID = Promise.resolve();
 const runWrangler = async (cmd, args) => {
     // Back-compat entrypoint for tests; we only use this for D1 migrations apply.
@@ -13,30 +17,64 @@ const runWrangler = async (cmd, args) => {
     await RESOLVED_VOID;
     return WranglerD1.applyMigrations({ cmd, dbName, isLocal });
 };
-const executeD1Migrate = async (cmd, options) => {
+const getDbName = (options) => {
+    const value = options['database'];
+    return typeof value === 'string' && value.trim() !== '' ? value : 'zintrust_db';
+};
+const buildExecutionContext = (options) => {
+    const isWorkerCommand = process.argv.includes('d1:migrate:worker');
     const isLocal = options['local'] === true || options['remote'] !== true;
-    const dbName = typeof options['database'] === 'string' && options['database'].trim() !== ''
-        ? options['database']
-        : 'zintrust_db';
-    cmd.info(`Running D1 migrations for ${dbName} (${isLocal ? 'local' : 'remote'})...`);
+    const dbName = getDbName(options);
+    const projectRoot = process.cwd();
+    const migrationsRelDir = isWorkerCommand
+        ? path.join('database', 'migrations', 'd1')
+        : WranglerConfig.getD1MigrationsDir(projectRoot, dbName);
+    const sourceMigrationsDir = isWorkerCommand
+        ? path.join('packages', 'workers', 'migrations')
+        : databaseConfig.migrations.directory;
+    return {
+        isLocal,
+        dbName,
+        projectRoot,
+        migrationsRelDir,
+        sourceMigrationsDir,
+        outputDir: path.join(projectRoot, migrationsRelDir),
+    };
+};
+const handleMigrationError = (cmd, error) => {
+    Logger.error('D1 Migration failed', error);
+    ErrorFactory.createCliError('D1 Migration failed', error);
+    const err = error;
+    if (err.stdout !== undefined && err.stdout.length > 0)
+        cmd.info(err.stdout.toString());
+    if (err.stderr !== undefined && err.stderr.length > 0) {
+        const stderr = err.stderr.toString();
+        Logger.error('Wrangler stderr', stderr);
+        ErrorFactory.createCliError('Wrangler stderr', stderr);
+    }
+    throw error;
+};
+const executeD1Migrate = async (cmd, options) => {
+    const ctx = buildExecutionContext(options);
+    cmd.info(`Running D1 migrations for ${ctx.dbName} (${ctx.isLocal ? 'local' : 'remote'})...`);
+    cmd.info(`Generating D1 SQL migrations into ${ctx.migrationsRelDir}...`);
     await RESOLVED_VOID;
     try {
-        const output = WranglerD1.applyMigrations({ cmd, dbName, isLocal });
+        const generated = await D1SqlMigrations.compileAndWrite({
+            projectRoot: ctx.projectRoot,
+            globalDir: ctx.sourceMigrationsDir,
+            extension: databaseConfig.migrations.extension,
+            includeGlobal: true,
+            outputDir: ctx.outputDir,
+        });
+        cmd.info(`Generated ${generated.length} SQL migration file(s).`);
+        const output = WranglerD1.applyMigrations({ cmd, dbName: ctx.dbName, isLocal: ctx.isLocal });
         if (output !== '')
             cmd.info(output);
         cmd.info('✓ D1 migrations completed successfully');
     }
     catch (error) {
-        Logger.error('D1 Migration failed', error);
-        ErrorFactory.createCliError('D1 Migration failed', error);
-        const err = error;
-        if (err.stdout !== undefined && err.stdout.length > 0)
-            cmd.info(err.stdout.toString());
-        if (err.stderr !== undefined && err.stderr.length > 0)
-            Logger.error('Wrangler stderr', err.stderr.toString());
-        if (err.stderr !== undefined && err.stderr.length > 0)
-            ErrorFactory.createCliError('Wrangler stderr', err.stderr.toString());
-        throw error;
+        handleMigrationError(cmd, error);
     }
 };
 /**
@@ -60,6 +98,7 @@ export const D1MigrateCommand = Object.freeze({
         const cmd = BaseCommand.create({
             name: 'd1:migrate',
             description: 'Run Cloudflare D1 migrations',
+            aliases: ['d1:migrate:worker'],
             addOptions,
             execute: async (options) => executeD1Migrate(cmd, options),
         });

package/src/cli/commands/InitContainerCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InitContainerCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/InitContainerCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAoNlE,eAAO,MAAM,oBAAoB;cACrB,YAAY;EAkBtB,CAAC"}
+{"version":3,"file":"InitContainerCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/InitContainerCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAmOlE,eAAO,MAAM,oBAAoB;cACrB,YAAY;EAkBtB,CAAC"}

package/src/cli/commands/InitContainerCommand.js

@@ -76,13 +76,29 @@ services:
       - DB_DATABASE_MYSQL=\${DB_DATABASE_MYSQL:-zintrust}
       - DB_USERNAME_MYSQL=\${DB_USERNAME_MYSQL:-zintrust}
       - DB_PASSWORD_MYSQL=\${DB_PASSWORD_MYSQL:-secret}
+
+      # Cloudflare D1
+      - D1_DATABASE_ID=\${D1_DATABASE_ID}
+      - D1_ACCOUNT_ID=\${D1_ACCOUNT_ID}
+      - D1_API_TOKEN=\${D1_API_TOKEN}
+      - D1_REMOTE_URL=\${D1_REMOTE_URL}
+      - D1_REMOTE_KEY_ID=\${D1_REMOTE_KEY_ID}
+      - D1_REMOTE_SECRET=\${D1_REMOTE_SECRET}
+
+      # Cloudflare KV
+      - KV_NAMESPACE_ID=\${KV_NAMESPACE_ID}
+      - KV_ACCOUNT_ID=\${KV_ACCOUNT_ID}
+      - KV_API_TOKEN=\${KV_API_TOKEN}
+      - KV_REMOTE_URL=\${KV_REMOTE_URL}
+      - KV_REMOTE_KEY_ID=\${KV_REMOTE_KEY_ID}
+      - KV_REMOTE_SECRET=\${KV_REMOTE_SECRET}
     ports:
       - '7772:7772'
 
 `;
 const DOCKERFILE_TEMPLATE = String.raw `# syntax=docker/dockerfile:1.6
 # Build Stage - Compile TypeScript
-FROM node:20-alpine AS builder
+FROM node:20-bookworm-slim AS builder
 
 WORKDIR /app
 
@@ -90,18 +106,16 @@ WORKDIR /app
 ENV NPM_CONFIG_CACHE=/root/.npm
 ENV NPM_CONFIG_PREFER_OFFLINE=true
 
-# Reuse npm cache across builds (requires BuildKit)
-ENV NPM_CONFIG_CACHE=/root/.npm
-ENV NPM_CONFIG_PREFER_OFFLINE=true
-
 # Install build dependencies for native modules (better-sqlite3, bcrypt)
-RUN apk add --no-cache python3 make g++
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends python3 make g++ \
+  && rm -rf /var/lib/apt/lists/*
 
 # Copy package files
 COPY package.json package-lock.json ./
 
 # Install dependencies (including dev dependencies needed for build)
-RUN --mount=type=cache,target=/root/.npm \
+RUN --mount=type=cache,target=/root/.npm,id=zintrust-npm-cache,sharing=locked \
   npm config set fetch-retries 5 \
     && npm config set fetch-retry-mintimeout 20000 \
     && npm config set fetch-retry-maxtimeout 120000 \
@@ -112,10 +126,10 @@ COPY . .
 
 # Build TypeScript to JavaScript
 ARG BUILD_VARIANT=full
-RUN --mount=type=cache,target=/root/.npm npm run build:dk
+RUN --mount=type=cache,target=/root/.npm,id=zintrust-npm-cache,sharing=locked npm run build:dk
 
 # Runtime Stage - Production image
-FROM node:20-alpine AS runtime
+FROM node:20-bookworm-slim AS runtime
 
 WORKDIR /app
 
@@ -125,17 +139,18 @@ ENV PORT=7772
 ENV HOST=0.0.0.0
 
 # Create non-root user for security
-RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
+RUN groupadd -g 1001 nodejs && useradd -u 1001 -g 1001 -m -s /usr/sbin/nologin nodejs
 
 # Copy package files for production dependencies
 COPY package.json package-lock.json ./
 
 # Install only production dependencies (requires build tools for native modules)
-RUN --mount=type=cache,target=/root/.npm \
-  apk add --no-cache --virtual .build-deps python3 make g++ \
+RUN --mount=type=cache,target=/root/.npm,id=zintrust-npm-cache,sharing=locked \
+  apt-get update \
+  && apt-get install -y --no-install-recommends python3 make g++ \
   && npm ci --omit=dev \
-    && apk del .build-deps \
-    && npm cache clean --force
+  && apt-get purge -y --auto-remove python3 make g++ \
+  && rm -rf /var/lib/apt/lists/*
 
 # Copy compiled code from builder stage
 COPY --from=builder /app/dist ./dist
@@ -157,7 +172,7 @@ EXPOSE 7772
 # Start application (compiled JS; no tsx needed in runtime)
 CMD ["node", "dist/src/boot/bootstrap.js"]
 `;
-const backupSuffix = () => new Date().toISOString().replace(/[:.]/g, '-');
+const backupSuffix = () => new Date().toISOString().replaceAll(/[:.]/g, '-');
 const backupFileIfExists = (filePath) => {
     if (!existsSync(filePath))
         return;

package/src/cli/commands/InitEcosystemCommand.d.ts

@@ -0,0 +1,6 @@
+import { type IBaseCommand } from '../BaseCommand';
+export declare const InitEcosystemCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+export default InitEcosystemCommand;
+//# sourceMappingURL=InitEcosystemCommand.d.ts.map

package/src/cli/commands/InitEcosystemCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InitEcosystemCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/InitEcosystemCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAoDlE,eAAO,MAAM,oBAAoB;cACrB,YAAY;EAOtB,CAAC;AAEH,eAAe,oBAAoB,CAAC"}

package/src/cli/commands/InitEcosystemCommand.js

@@ -0,0 +1,51 @@
+import { BaseCommand } from '../BaseCommand.js';
+import { PromptHelper } from '../PromptHelper.js';
+import { Logger } from '../../config/logger.js';
+import { copyFileSync, existsSync, readFileSync, writeFileSync } from '../../node-singletons/fs.js';
+import { join } from '../../node-singletons/path.js';
+import { fileURLToPath } from '../../node-singletons/url.js';
+const backupSuffix = () => new Date().toISOString().replaceAll(/[:.]/g, '-');
+const backupFileIfExists = (filePath) => {
+    if (!existsSync(filePath))
+        return;
+    const backupPath = `${filePath}.bak.${backupSuffix()}`;
+    copyFileSync(filePath, backupPath);
+    Logger.info(`🗂️ Backup created: ${backupPath}`);
+};
+const readTemplate = (relPathFromThisModule) => {
+    const absPath = fileURLToPath(new URL(relPathFromThisModule, import.meta.url));
+    return readFileSync(absPath, 'utf-8');
+};
+const TEMPLATE_ECOSYSTEM = readTemplate('../../templates/docker/docker-compose.ecosystem.yml.tpl');
+const TEMPLATE_SCHEDULES = readTemplate('../../templates/docker/docker-compose.schedules.yml.tpl');
+const writeScaffoldFile = async (cwd, fileName, content) => {
+    const outPath = join(cwd, fileName);
+    let shouldWrite = true;
+    if (existsSync(outPath)) {
+        shouldWrite = await PromptHelper.confirm(`${fileName} already exists. Overwrite?`, false);
+    }
+    if (!shouldWrite) {
+        Logger.info(`Skipped ${fileName}`);
+        return;
+    }
+    backupFileIfExists(outPath);
+    writeFileSync(outPath, content);
+    Logger.info(`✅ Created ${fileName}`);
+};
+const execute = async () => {
+    const cwd = process.cwd();
+    await writeScaffoldFile(cwd, 'docker-compose.ecosystem.yml', TEMPLATE_ECOSYSTEM);
+    await writeScaffoldFile(cwd, 'docker-compose.schedules.yml', TEMPLATE_SCHEDULES);
+    Logger.info('✅ Ecosystem scaffolding complete.');
+    Logger.info('Next: docker compose -f docker-compose.ecosystem.yml up -d');
+};
+export const InitEcosystemCommand = Object.freeze({
+    create() {
+        return BaseCommand.create({
+            name: 'init:ecosystem',
+            description: 'Scaffold docker-compose.ecosystem.yml and docker-compose.schedules.yml',
+            execute,
+        });
+    },
+});
+export default InitEcosystemCommand;

package/src/cli/commands/MigrateCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MigrateCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/MigrateCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA6ZrE;;GAEG;AACH,eAAO,MAAM,cAAc;IACzB;;OAEG;cACO,YAAY;EAUtB,CAAC"}
+{"version":3,"file":"MigrateCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/MigrateCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA0erE;;GAEG;AACH,eAAO,MAAM,cAAc;IACzB;;OAEG;cACO,YAAY;EAUtB,CAAC"}

package/src/cli/commands/MigrateCommand.js

@@ -8,6 +8,7 @@ import { WranglerConfig } from '../d1/WranglerConfig.js';
 import { WranglerD1 } from '../d1/WranglerD1.js';
 import { PromptHelper } from '../PromptHelper.js';
 import { confirmProductionRun, mapConnectionToOrmConfig, parseRollbackSteps, } from '../utils/DatabaseCliUtils.js';
+import { EnvFileLoader } from '../utils/EnvFileLoader.js';
 import { readEnvString } from '../../common/ExternalServiceUtils.js';
 import { databaseConfig } from '../../config/database.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
@@ -52,7 +53,7 @@ const getServiceArgs = (options) => {
     return { service: serviceArg, includeGlobal };
 };
 const isDestructiveAction = (options) => options['fresh'] === true || options['reset'] === true || options['rollback'] === true;
-const isD1Driver = (driver) => driver === 'd1' || driver === 'd1-remote';
+const isWranglerD1Driver = (driver) => driver === 'd1';
 const describeTargetDatabase = (conn) => {
     switch (conn.driver) {
         case 'sqlite':
@@ -189,33 +190,47 @@ const runD1Actions = async (params) => {
         cmd.info(output);
     cmd.success('D1 migrations completed successfully');
 };
-const processConnection = async (conn, options, cmd, interactive) => {
-    // Avoid confusion: `--database` is a D1-only option (Wrangler binding name), not DB_DATABASE.
-    if (isD1Driver(conn.driver)) {
+const logOptionsForConn = (cmd, conn, options) => {
+    if (isWranglerD1Driver(conn.driver)) {
         cmd.debug(`Migrate command executed with options: ${JSON.stringify(options)}`);
+        return;
     }
-    else {
-        const optionsForLog = { ...options };
-        delete optionsForLog['database'];
-        delete optionsForLog['local'];
-        delete optionsForLog['remote'];
-        cmd.debug(`Migrate command executed with options: ${JSON.stringify(optionsForLog)}`);
+    const optionsForLog = { ...options };
+    delete optionsForLog['database'];
+    delete optionsForLog['local'];
+    delete optionsForLog['remote'];
+    cmd.debug(`Migrate command executed with options: ${JSON.stringify(optionsForLog)}`);
+};
+const warnIfAdapterMissing = (cmd, conn) => {
+    if (conn.driver === 'mysql' && DatabaseAdapterRegistry.get('mysql') === undefined) {
+        cmd.warn('MySQL adapter is not installed/registered; migrations may not hit a real MySQL DB.');
+        cmd.warn('Install via `zin plugin install adapter:mysql` (or `zin add db:mysql`).');
+        cmd.debug('[debug] Expected a side-effect import in src/zintrust.plugins.ts like: import "@zintrust/db-mysql/register";');
     }
-    const { globalDir, extension, separateTracking } = getMigrationDirs();
-    const { service, includeGlobal } = getServiceArgs(options);
-    if (isD1Driver(conn.driver)) {
-        await runD1Actions({
-            options,
-            cmd,
-            projectRoot: process.cwd(),
-            globalDir,
-            extension,
-            separateTracking,
-            service,
-            includeGlobal,
-        });
-        return;
+    if (conn.driver === 'postgresql' && DatabaseAdapterRegistry.get('postgresql') === undefined) {
+        cmd.warn('PostgreSQL adapter is not installed/registered; migrations may not hit a real PostgreSQL DB.');
+        cmd.warn('Install via `zin plugin install adapter:postgres` (or `zin add db:postgres`).');
     }
+};
+const withD1RemoteSqlMode = async (fn) => {
+    if (typeof process === 'undefined' || process.env === undefined)
+        return fn();
+    const prev = process.env['D1_REMOTE_MODE'];
+    process.env['D1_REMOTE_MODE'] = 'sql';
+    try {
+        return await fn();
+    }
+    finally {
+        if (prev === undefined) {
+            delete process.env['D1_REMOTE_MODE'];
+        }
+        else {
+            process.env['D1_REMOTE_MODE'] = prev;
+        }
+    }
+};
+const runOrmMigrationsForConn = async (params) => {
+    const { conn, options, cmd, interactive, globalDir, extension, separateTracking, service, includeGlobal, } = params;
     const ormConfig = mapConnectionToOrmConfig(conn);
     const destructive = isDestructiveAction(options);
     const force = options['force'] === true;
@@ -231,18 +246,7 @@ const processConnection = async (conn, options, cmd, interactive) => {
     cmd.info(`[i] Target database: ${describeTargetDatabase(conn)}`);
     cmd.info('[i] Migration tracking table: migrations');
     cmd.debug(`[debug] Registered database adapters: ${DatabaseAdapterRegistry.list().join(', ')}`);
-    // Warn only when the adapter truly isn't registered.
-    // Adapters are registered via side-effect imports in src/zintrust.plugins.ts
-    // (generated by `zin plugin install`) and are loaded at CLI startup.
-    if (conn.driver === 'mysql' && DatabaseAdapterRegistry.get('mysql') === undefined) {
-        cmd.warn('MySQL adapter is not installed/registered; migrations may not hit a real MySQL DB.');
-        cmd.warn('Install via `zin plugin install adapter:mysql` (or `zin add db:mysql`).');
-        cmd.debug('[debug] Expected a side-effect import in src/zintrust.plugins.ts like: import "@zintrust/db-mysql/register";');
-    }
-    if (conn.driver === 'postgresql' && DatabaseAdapterRegistry.get('postgresql') === undefined) {
-        cmd.warn('PostgreSQL adapter is not installed/registered; migrations may not hit a real PostgreSQL DB.');
-        cmd.warn('Install via `zin plugin install adapter:postgres` (or `zin add db:postgres`).');
-    }
+    warnIfAdapterMissing(cmd, conn);
     const db = Database.create(ormConfig);
     await db.connect();
     try {
@@ -261,7 +265,45 @@ const processConnection = async (conn, options, cmd, interactive) => {
         await db.disconnect();
     }
 };
+const processConnection = async (conn, options, cmd, interactive) => {
+    // Avoid confusion: `--database` is a D1-only option (Wrangler binding name), not DB_DATABASE.
+    logOptionsForConn(cmd, conn, options);
+    const { globalDir, extension, separateTracking } = getMigrationDirs();
+    const { service, includeGlobal } = getServiceArgs(options);
+    if (isWranglerD1Driver(conn.driver)) {
+        await runD1Actions({
+            options,
+            cmd,
+            projectRoot: process.cwd(),
+            globalDir,
+            extension,
+            separateTracking,
+            service,
+            includeGlobal,
+        });
+        return;
+    }
+    const run = async () => runOrmMigrationsForConn({
+        conn,
+        options,
+        cmd,
+        interactive,
+        globalDir,
+        extension,
+        separateTracking,
+        service,
+        includeGlobal,
+    });
+    if (conn.driver === 'd1-remote') {
+        cmd.info('[i] d1-remote migrations: using SQL mode automatically for this CLI run');
+        await withD1RemoteSqlMode(run);
+        return;
+    }
+    await run();
+};
 const executeMigrate = async (options, cmd) => {
+    // Ensure .env overlays are loaded for CLI runs (needed for d1-remote signing fallbacks).
+    EnvFileLoader.ensureLoaded();
     const interactive = getInteractive(options);
     const targets = [];
     if (options['all'] === true) {

package/src/cli/commands/MigrateWorkerCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MigrateWorkerCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/MigrateWorkerCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAqKrE,eAAO,MAAM,oBAAoB;cACrB,YAAY;EAUtB,CAAC"}
+{"version":3,"file":"MigrateWorkerCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/MigrateWorkerCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAiNrE,eAAO,MAAM,oBAAoB;cACrB,YAAY;EAUtB,CAAC"}

package/src/cli/commands/MigrateWorkerCommand.js

@@ -9,6 +9,19 @@ import { Migrator } from '../../migrations/Migrator.js';
 import * as path from '../../node-singletons/path.js';
 import { Database } from '../../orm/Database.js';
 import { DatabaseAdapterRegistry } from '../../orm/DatabaseAdapterRegistry.js';
+const isBuiltInDriver = (driver) => driver === 'sqlite' ||
+    driver === 'mysql' ||
+    driver === 'postgresql' ||
+    driver === 'sqlserver' ||
+    driver === 'd1' ||
+    driver === 'd1-remote';
+const getWorkerPersistenceConnectionName = () => {
+    if (typeof process === 'undefined')
+        return 'default';
+    const raw = process.env?.['WORKER_PERSISTENCE_DB_CONNECTION'];
+    const value = typeof raw === 'string' ? raw.trim() : '';
+    return value.length > 0 ? value : 'default';
+};
 const addOptions = (command) => {
     command
         .option('--status', 'Display migration status (applied, pending, failed)')
@@ -80,10 +93,16 @@ const runForConnection = async (conn, options, cmd, interactive) => {
     });
     if (!proceed)
         return;
-    if (!DatabaseAdapterRegistry.has(conn.driver)) {
+    if (!isBuiltInDriver(conn.driver) && !DatabaseAdapterRegistry.has(conn.driver)) {
         cmd.warn(`Missing adapter for driver: ${conn.driver}`);
         cmd.warn(`Install via 'zin plugin install adapter:${conn.driver}' (or 'zin add db:${conn.driver}').`);
     }
+    const previousD1RemoteMode = typeof process === 'undefined' ? undefined : process.env['D1_REMOTE_MODE'];
+    if (conn.driver === 'd1-remote' && typeof process !== 'undefined') {
+        // Important: set BEFORE Database.create() so D1RemoteAdapter is constructed in SQL mode.
+        // Registry mode uses /zin/d1/statement, which is not appropriate for migrations.
+        process.env['D1_REMOTE_MODE'] = 'sql';
+    }
     const ormConfig = mapConnectionToOrmConfig(conn);
     const db = Database.create(ormConfig);
     await db.connect();
@@ -98,6 +117,14 @@ const runForConnection = async (conn, options, cmd, interactive) => {
         await runActions(migrator, options, cmd, conn.driver);
     }
     finally {
+        if (conn.driver === 'd1-remote' && typeof process !== 'undefined') {
+            if (previousD1RemoteMode === undefined) {
+                delete process.env['D1_REMOTE_MODE'];
+            }
+            else {
+                process.env['D1_REMOTE_MODE'] = previousD1RemoteMode;
+            }
+        }
         await db.disconnect();
     }
 };
@@ -110,7 +137,14 @@ const executeMigrateWorker = async (options, cmd) => {
         }
     }
     else {
-        targets.push({ name: 'default', config: databaseConfig.getConnection() });
+        const selected = getWorkerPersistenceConnectionName();
+        const hasSelected = selected.length > 0;
+        const connections = databaseConfig.connections;
+        const configured = hasSelected ? connections[selected] : undefined;
+        targets.push({
+            name: hasSelected ? selected : 'default',
+            config: configured ?? databaseConfig.getConnection(),
+        });
     }
     let sequence = Promise.resolve();
     for (const { name, config } of targets) {

package/src/cli/commands/NewCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NewCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/NewCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAerE,KAAK,YAAY,GAAG,OAAO,GAAG,KAAK,GAAG,cAAc,GAAG,WAAW,CAAC;AACnE,KAAK,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AAYhF,UAAU,sBAAsB;IAC9B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAwPhD,UAAU,WAAY,SAAQ,YAAY;IACxC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxF,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,gBAAgB,EAAE,CAAC;IACjF,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;IAChC,YAAY,IAAI,MAAM,CAAC;IACvB,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,sBAAsB,EAC9B,SAAS,CAAC,EAAE,OAAO,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACpE;AAwOD;;;GAGG;AACH,eAAO,MAAM,UAAU;IACrB;;OAEG;cACO,WAAW;EAGrB,CAAC"}
+{"version":3,"file":"NewCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/NewCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAgBrE,KAAK,YAAY,GAAG,OAAO,GAAG,KAAK,GAAG,cAAc,GAAG,WAAW,CAAC;AACnE,KAAK,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AAYhF,UAAU,sBAAsB;IAC9B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAwPhD,UAAU,WAAY,SAAQ,YAAY;IACxC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxF,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,gBAAgB,EAAE,CAAC;IACjF,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;IAChC,YAAY,IAAI,MAAM,CAAC;IACvB,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,sBAAsB,EAC9B,SAAS,CAAC,EAAE,OAAO,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACpE;AA0RD;;;GAGG;AACH,eAAO,MAAM,UAAU;IACrB;;OAEG;cACO,WAAW;EAGrB,CAAC"}

package/src/cli/commands/NewCommand.js

@@ -8,6 +8,7 @@ import { extractErrorMessage, resolvePackageManager } from '../../common/index.j
 import { appConfig } from '../../config/app.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
 import { execFileSync } from '../../node-singletons/child-process.js';
+import fs from '../../node-singletons/fs.js';
 import * as path from '../../node-singletons/path.js';
 import chalk from 'chalk';
 const getGitBinary = () => 'git';
@@ -233,9 +234,39 @@ const addOptions = (command) => {
     command.option('--install', 'Force dependency installation (useful to override CI defaults)');
     command.option('--package-manager <manager>', 'Package manager to use (npm, yarn, pnpm)');
     command.option('--governance', 'Install governance tooling (ESLint + architecture tests)', false);
+    command.option('--with-d1-proxy', 'Add @zintrust/cloudflare-d1-proxy to package.json (for deploying the D1 proxy worker)', false);
     command.option('--force', 'Overwrite existing directory');
     command.option('--overwrite', 'Overwrite existing directory');
 };
+const maybeAddD1ProxyDependency = (projectPath, options, log) => {
+    const enabled = options['withD1Proxy'] === true || options['with-d1-proxy'] === true;
+    if (!enabled)
+        return;
+    const packageJsonPath = path.join(projectPath, 'package.json');
+    if (!fs.existsSync(packageJsonPath)) {
+        log.warn(`Could not add @zintrust/cloudflare-d1-proxy (missing package.json at ${packageJsonPath})`);
+        return;
+    }
+    try {
+        const raw = fs.readFileSync(packageJsonPath, 'utf8');
+        const pkg = JSON.parse(raw);
+        const dependencies = { ...pkg.dependencies };
+        if (typeof dependencies['@zintrust/cloudflare-d1-proxy'] !== 'string') {
+            // Avoid pinning to core version (they can differ). Use a safe caret range.
+            dependencies['@zintrust/cloudflare-d1-proxy'] = '^0.1.42';
+        }
+        const next = {
+            ...pkg,
+            dependencies,
+        };
+        fs.writeFileSync(packageJsonPath, JSON.stringify(next, null, 2) + '\n');
+        log.info('✅ Added @zintrust/cloudflare-d1-proxy to dependencies');
+    }
+    catch (error) {
+        ErrorFactory.createCliError('Failed to update package.json with D1 proxy dependency', error);
+        log.warn('Please add @zintrust/cloudflare-d1-proxy manually if you need the proxy worker.');
+    }
+};
 const resolveProjectName = async (options) => {
     const argName = options.args?.[0];
     const projectName = argName ?? (await PromptHelper.projectName('my-zintrust-app', true));
@@ -285,6 +316,8 @@ const createProject = async (target, options, command) => {
             throw ErrorFactory.createCliError(gov.message ?? 'Governance scaffolding failed', gov);
         }
     }
+    // Optional dependency injection must happen before `npm/yarn/pnpm install`.
+    maybeAddD1ProxyDependency(target.projectPath, options, command);
 };
 const maybeInitializeGit = (options, command, target) => {
     if (options['git'] !== false) {

package/src/cli/commands/PutCommand.d.ts

@@ -0,0 +1,6 @@
+import { type IBaseCommand } from '../BaseCommand';
+export declare const PutCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+export default PutCommand;
+//# sourceMappingURL=PutCommand.d.ts.map

package/src/cli/commands/PutCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PutCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PutCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAmNvF,eAAO,MAAM,UAAU;cACX,YAAY;EAWtB,CAAC;AAEH,eAAe,UAAU,CAAC"}