alepha 0.23.0 → 0.24.0

package/src/cli/core/commands/db.ts

@@ -1,5 +1,5 @@
-import { $inject, AlephaError, t } from "alepha";
-import { $command, Runner } from "alepha/command";
+import { $inject, AlephaError, z } from "alepha";
+import { $command } from "alepha/command";
 import { $logger } from "alepha/logger";
 import type {
   DatabaseProvider,
@@ -12,13 +12,13 @@ import { AlephaCliUtils } from "../services/AlephaCliUtils.ts";
 import { PackageManagerUtils } from "../services/PackageManagerUtils.ts";
 import { ViteUtils } from "../services/ViteUtils.ts";
 
-const drizzleCommandFlags = t.object({
-  provider: t.optional(
-    t.text({
+const drizzleCommandFlags = z.object({
+  provider: z
+    .text({
       description:
         "Database provider name to target (e.g., 'postgres', 'sqlite')",
-    }),
-  ),
+    })
+    .optional(),
 });
 
 export class DbCommand {
@@ -28,7 +28,6 @@ export class DbCommand {
   protected readonly pm = $inject(PackageManagerUtils);
   protected readonly entryProvider = $inject(AppEntryProvider);
   protected readonly viteUtil = $inject(ViteUtils);
-  protected readonly runner = $inject(Runner);
 
   /**
    * Check if database migrations are up to date.
@@ -37,14 +36,14 @@ export class DbCommand {
     name: "check",
     mode: true,
     description: "Check if migration files are up to date",
-    args: t.optional(
-      t.text({
+    args: z
+      .text({
         title: "path",
         description: "Path to the Alepha server entry file",
-      }),
-    ),
+      })
+      .optional(),
     flags: drizzleCommandFlags,
-    handler: async ({ args, root }) => {
+    handler: async ({ flags, root }) => {
       const rootDir = root;
       this.log.debug(`Using project root: ${rootDir}`);
 
@@ -59,6 +58,7 @@ export class DbCommand {
       const drizzleKitProvider =
         alepha.inject<DrizzleKitProvider>("DrizzleKitProvider");
       const accepted = new Set<string>([]);
+      const drifted: Array<{ provider: string; statements: string[] }> = [];
 
       for (const primitive of repositoryProvider.getRepositories()) {
         const provider = primitive.provider;
@@ -69,15 +69,23 @@ export class DbCommand {
 
         accepted.add(providerName);
 
+        // Honor the --provider filter (previously declared but ignored here).
+        if (flags.provider && flags.provider !== providerName) {
+          continue;
+        }
+
         const migrationDir = this.fs.join(rootDir, "migrations", providerName);
 
         const journalBuffer = await this.fs
           .readFile(this.fs.join(migrationDir, "meta", "_journal.json"))
           .catch(() => null);
 
+        // `continue`, not `return`: a journal-less or clean provider must not
+        // exit the whole handler and mask drift in the remaining providers
+        // (e.g. a clean Postgres hiding a drifted SQLite/D1 migration set).
         if (!journalBuffer) {
-          this.log.info("No migration journal found.");
-          return;
+          this.log.info(`No migration journal found for '${providerName}'.`);
+          continue;
         }
 
         const journal = JSON.parse(journalBuffer.toString("utf-8"));
@@ -97,27 +105,39 @@ export class DbCommand {
           });
 
         if (migrationStatements.length === 0) {
-          this.log.info("No changes detected.");
-          return;
+          this.log.info(`No changes detected for '${providerName}'.`);
+          continue;
         }
 
-        this.log.info("");
-        this.log.info("Detected migration statements:");
-        this.log.info("");
-        for (const stmt of migrationStatements) {
-          this.log.info(stmt);
+        drifted.push({
+          provider: providerName,
+          statements: migrationStatements,
+        });
+      }
+
+      // Report drift across ALL providers before failing.
+      if (drifted.length > 0) {
+        for (const { provider: providerName, statements } of drifted) {
+          this.log.info("");
+          this.log.info(`Detected migration statements for '${providerName}':`);
+          this.log.info("");
+          for (const stmt of statements) {
+            this.log.info(stmt);
+          }
+          this.log.info("");
+          this.log.info(`At least ${statements.length} change(s) detected.`);
         }
         this.log.info("");
-
-        this.log.info(
-          `At least ${migrationStatements.length} change(s) detected.`,
-        );
         this.log.info(
           "Please, run 'alepha db migrations generate' to update the migration files.",
         );
         this.log.info("");
 
-        throw new AlephaError("Database migrations are not up to date.");
+        throw new AlephaError(
+          `Database migrations are not up to date (${drifted
+            .map((d) => d.provider)
+            .join(", ")}).`,
+        );
       }
     },
   });
@@ -129,24 +149,24 @@ export class DbCommand {
     name: "create",
     mode: true,
     description: "Generate migration files from current schema",
-    args: t.optional(
-      t.text({
+    args: z
+      .text({
         title: "path",
         description: "Path to the Alepha server entry file",
-      }),
-    ),
-    flags: t.extend(drizzleCommandFlags, {
-      custom: t.optional(
-        t.boolean({
-          description:
-            "Generate an empty migration file for custom SQL (e.g., for data migrations or manual adjustments)",
-        }),
-      ),
-      name: t.optional(
-        t.text({
+      })
+      .optional(),
+    flags: drizzleCommandFlags.extend({
+      custom: z
+        .boolean()
+        .describe(
+          "Generate an empty migration file for custom SQL (e.g., for data migrations or manual adjustments)",
+        )
+        .optional(),
+      name: z
+        .text({
           description: "Name for the generated migration file",
-        }),
-      ),
+        })
+        .optional(),
     }),
     handler: async ({ args, flags, root }) => {
       const parts: string[] = [];
@@ -173,18 +193,17 @@ export class DbCommand {
     name: "push",
     mode: true,
     description: "Push database schema changes directly to the database",
-    args: t.optional(
-      t.text({
+    args: z
+      .text({
         title: "path",
         description: "Path to the Alepha server entry file",
-      }),
-    ),
-    flags: t.extend(drizzleCommandFlags, {
-      dryRun: t.optional(
-        t.boolean({
-          description: "Preview SQL statements without executing them",
-        }),
-      ),
+      })
+      .optional(),
+    flags: drizzleCommandFlags.extend({
+      dryRun: z
+        .boolean()
+        .describe("Preview SQL statements without executing them")
+        .optional(),
     }),
     handler: async ({ root, args, flags }) => {
       if (flags.dryRun) {
@@ -263,12 +282,12 @@ export class DbCommand {
     name: "apply",
     mode: true,
     description: "Apply pending migrations to the database",
-    args: t.optional(
-      t.text({
+    args: z
+      .text({
         title: "path",
         description: "Path to the Alepha server entry file",
-      }),
-    ),
+      })
+      .optional(),
     flags: drizzleCommandFlags,
     handler: async ({ root, run, mode }) => {
       const entry = await this.entryProvider.getAppEntry(root);
@@ -278,10 +297,6 @@ export class DbCommand {
         handler: async () => {
           process.env.MIGRATE = "true";
 
-          if (this.runner.useDynamicLogger) {
-            process.env.LOG_LEVEL = "warn";
-          }
-
           const alepha = await this.viteUtil.runAlepha({
             entry,
             mode: "production",
@@ -291,21 +306,6 @@ export class DbCommand {
         },
       });
     },
-
-    //   await run({
-    //     name: `db migrate (${mode || "development"})`,
-    //     handler: async () => {
-    //       await this.utils.exec(`tsx ${entry.server}`, {
-    //         capture: this.runner.useDynamicLogger,
-    //         env: {
-    //           ...process.env,
-    //           NODE_ENV: "production",
-    //           MIGRATE: "true",
-    //         },
-    //       });
-    //     },
-    //   });
-    // },
   });
 
   /**
@@ -315,12 +315,12 @@ export class DbCommand {
     name: "studio",
     mode: true,
     description: "Launch Drizzle Studio database browser",
-    args: t.optional(
-      t.text({
+    args: z
+      .text({
         title: "path",
         description: "Path to the Alepha server entry file",
-      }),
-    ),
+      })
+      .optional(),
     flags: drizzleCommandFlags,
     handler: async ({ root, args, flags }) => {
       await this.runDrizzleKitCommand({
@@ -423,6 +423,15 @@ export class DbCommand {
         command: options.command,
       });
 
+      const migrationsDir = this.fs.join(rootDir, "migrations", providerName);
+      const isGenerate = options.command === "generate";
+
+      // Snapshot the directory so the destructive-migration guard below only
+      // inspects files THIS run created, not the whole applied history.
+      const before = isGenerate
+        ? new Set(await this.fs.ls(migrationsDir).catch(() => []))
+        : new Set<string>();
+
       const flags = options.commandFlags ? ` ${options.commandFlags}` : "";
       // drizzle-kit ships embedded in `alepha` — resolve and run it from
       // alepha's own install, so the project never declares it.
@@ -443,14 +452,22 @@ export class DbCommand {
         },
       );
 
+      if (!isGenerate) {
+        continue;
+      }
+
       // Post-process generated SQL: strip explicit "public". schema qualifiers
       // from FK REFERENCES so migration files stay truly schema-free.
       // search_path handles resolution at runtime.
-      if (options.command === "generate" && dialect === "postgresql") {
-        await this.stripPublicSchemaFromMigrations(
-          this.fs.join(rootDir, "migrations", providerName),
-        );
+      if (dialect === "postgresql") {
+        await this.stripPublicSchemaFromMigrations(migrationsDir);
       }
+
+      const after = await this.fs.ls(migrationsDir).catch(() => []);
+      await this.assertNoDestructiveMigrations(
+        migrationsDir,
+        after.filter((file) => !before.has(file)),
+      );
     }
   }
 
@@ -480,6 +497,77 @@ export class DbCommand {
     }
   }
 
+  /**
+   * Refuse a freshly generated migration that drops a table.
+   *
+   * Drizzle rebuilds a SQLite table by dropping and recreating it. On
+   * Cloudflare D1 that is a data-loss bomb: D1 ignores `PRAGMA
+   * foreign_keys=OFF`, so dropping a table that other tables reference with
+   * `ON DELETE CASCADE` silently wipes every child row — with no error, on
+   * deploy, in production.
+   *
+   * The generated file is left on disk on purpose: the point is to force a
+   * human to read it. If the drop really is intended, keep the file and move
+   * on (a re-run detects no schema diff, so nothing is regenerated and this
+   * guard stays quiet).
+   */
+  protected async assertNoDestructiveMigrations(
+    migrationsDir: string,
+    files: string[],
+  ): Promise<void> {
+    const offenders: string[] = [];
+
+    for (const file of files) {
+      if (!file.endsWith(".sql")) continue;
+
+      const content = await this.fs.readFile(this.fs.join(migrationsDir, file));
+      const drops = this.findDropTableStatements(content.toString("utf-8"));
+
+      for (const drop of drops) {
+        offenders.push(`  ${file}: ${drop}`);
+      }
+    }
+
+    if (offenders.length === 0) {
+      return;
+    }
+
+    throw new AlephaError(
+      [
+        `Refusing to generate a destructive migration: DROP TABLE found in ${offenders.length} statement(s).`,
+        "",
+        ...offenders,
+        "",
+        "On Cloudflare D1, dropping a table that CASCADE children reference wipes those child rows silently.",
+        "Review the generated file above. If the drop is intentional, keep it and re-run — nothing will be regenerated.",
+        "If it is not, delete the file and adjust your schema (e.g. keep the column, or drop it in a hand-written migration).",
+      ].join("\n"),
+    );
+  }
+
+  /**
+   * Extract `DROP TABLE` statements from a SQL migration, skipping any that sit
+   * inside a `--` line comment.
+   */
+  protected findDropTableStatements(sql: string): string[] {
+    const statements: string[] = [];
+
+    for (const rawLine of sql.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (line.startsWith("--")) continue;
+
+      // Drop the trailing comment so `DROP TABLE x; -- ...` still matches on
+      // the statement itself and a commented-out tail can't add a false hit.
+      const code = line.split("--")[0];
+
+      if (/\bDROP\s+TABLE\b/i.test(code)) {
+        statements.push(code.trim());
+      }
+    }
+
+    return statements;
+  }
+
   /**
    * Prepare Drizzle configuration files for a database provider.
    */

package/src/cli/core/commands/dev.ts

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import { readdir, stat } from "node:fs/promises";
 import { join } from "node:path";
-import { $inject, $state, Alepha, t } from "alepha";
+import { $inject, $state, Alepha, z } from "alepha";
 import { $command } from "alepha/command";
 import { $logger } from "alepha/logger";
 import { FileSystemProvider } from "alepha/system";
@@ -33,13 +33,13 @@ export class DevCommand {
     name: "dev",
     mode: true,
     description: "Run the project in development mode",
-    flags: t.object({
-      only: t.optional(
-        t.string({
-          description:
-            "Run only specific apps (comma-separated: --only api,companion)",
-        }),
-      ),
+    flags: z.object({
+      only: z
+        .string()
+        .describe(
+          "Run only specific apps (comma-separated: --only api,companion)",
+        )
+        .optional(),
     }),
     handler: async ({ root, flags }) => {
       const apps = await this.discoverApps(root);

package/src/cli/core/commands/gen/changelog.ts

@@ -1,6 +1,6 @@
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
-import { $inject, $state, t } from "alepha";
+import { $inject, $state, z } from "alepha";
 import { $command } from "alepha/command";
 import { $logger } from "alepha/logger";
 import { changelogOptions } from "../../atoms/changelogOptions.ts";
@@ -170,29 +170,27 @@ export class ChangelogCommand {
     name: "changelog",
     description:
       "Generate changelog from conventional commits (outputs to stdout)",
-    flags: t.object({
+    flags: z.object({
       /**
        * Show changes from this ref (tag, commit, branch).
        * Defaults to the latest version tag.
        * Example: --from=1.0.0
        */
-      from: t.optional(
-        t.string({
-          aliases: ["f"],
-          description: "Starting ref (default: latest tag)",
-        }),
-      ),
+      from: z
+        .string()
+        .meta({ aliases: ["f"] })
+        .describe("Starting ref (default: latest tag)")
+        .optional(),
       /**
        * Show changes up to this ref (tag, commit, branch).
        * Defaults to HEAD.
        * Example: --to=main
        */
-      to: t.optional(
-        t.string({
-          aliases: ["t"],
-          description: "Ending ref (default: HEAD)",
-        }),
-      ),
+      to: z
+        .string()
+        .meta({ aliases: ["t"] })
+        .describe("Ending ref (default: HEAD)")
+        .optional(),
     }),
     handler: async ({ flags, root }) => {
       const git = (cmd: string) => this.git.exec(cmd, root);

package/src/cli/core/commands/gen/env.ts

@@ -1,4 +1,4 @@
-import { $inject, t } from "alepha";
+import { $inject, z } from "alepha";
 import { $command } from "alepha/command";
 import { $logger } from "alepha/logger";
 import { FileSystemProvider } from "alepha/system";
@@ -12,13 +12,13 @@ export class GenEnvCommand {
   public readonly command = $command({
     name: "env",
     description: "Extract environment variables from server entry file",
-    flags: t.object({
-      out: t.optional(
-        t.text({
+    flags: z.object({
+      out: z
+        .text({
           aliases: ["o"],
           description: "Output file path (e.g., .env)",
-        }),
-      ),
+        })
+        .optional(),
     }),
     handler: async ({ root, flags }) => {
       const alepha = await this.utils.loadAlephaFromServerEntryFile({

package/src/cli/core/commands/gen/openapi.ts

@@ -1,4 +1,4 @@
-import { $inject, t } from "alepha";
+import { $inject, z } from "alepha";
 import { $command } from "alepha/command";
 import { $logger } from "alepha/logger";
 import { ServerSwaggerProvider } from "alepha/server/swagger";
@@ -13,13 +13,13 @@ export class OpenApiCommand {
   public readonly command = $command({
     name: "openapi",
     description: "Generate OpenAPI specification from actions",
-    flags: t.object({
-      out: t.optional(
-        t.text({
+    flags: z.object({
+      out: z
+        .text({
           aliases: ["o"],
           description: "Output file path",
-        }),
-      ),
+        })
+        .optional(),
     }),
     handler: async ({ root, flags }) => {
       const alepha = await this.utils.loadAlephaFromServerEntryFile({

package/src/cli/core/commands/init.ts

@@ -1,4 +1,4 @@
-import { $inject, t } from "alepha";
+import { $inject, z } from "alepha";
 import { $command } from "alepha/command";
 import { ProjectScaffolder } from "../services/ProjectScaffolder.ts";
 
@@ -12,42 +12,37 @@ export class InitCommand {
   public readonly init = $command({
     name: "init",
     description: "Add missing Alepha configuration files to the project",
-    args: t.optional(
-      t.text({
+    args: z
+      .text({
         title: "path",
         trim: true,
         lowercase: true,
-      }),
-    ),
-    flags: t.object({
-      pm: t.optional(
-        t.enum(["yarn", "npm", "pnpm", "bun"], {
-          description: "Package manager to use",
-        }),
-      ),
+      })
+      .optional(),
+    flags: z.object({
+      pm: z
+        .enum(["yarn", "npm", "pnpm", "bun"])
+        .describe("Package manager to use")
+        .optional(),
       // choose which modules to scaffold
-      api: t.optional(
-        t.boolean({
-          description: "Include API module structure (src/api/)",
-        }),
-      ),
-      react: t.optional(
-        t.boolean({
-          aliases: ["r"],
-          description: "Include React dependencies and web module (src/web/)",
-        }),
-      ),
-      tailwind: t.optional(
-        t.boolean({
-          description: "Include Tailwind CSS with Vite plugin. Implies --react",
-        }),
-      ),
-      force: t.optional(
-        t.boolean({
-          aliases: ["f"],
-          description: "Override existing files",
-        }),
-      ),
+      api: z
+        .boolean()
+        .describe("Include API module structure (src/api/)")
+        .optional(),
+      react: z
+        .boolean()
+        .meta({ aliases: ["r"] })
+        .describe("Include React dependencies and web module (src/web/)")
+        .optional(),
+      tailwind: z
+        .boolean()
+        .describe("Include Tailwind CSS with Vite plugin. Implies --react")
+        .optional(),
+      force: z
+        .boolean()
+        .meta({ aliases: ["f"] })
+        .describe("Override existing files")
+        .optional(),
     }),
     handler: async ({ run, flags, root, args }) => {
       await this.scaffolder.init({ run, flags, root, args });

package/src/cli/core/commands/pack.ts

@@ -1,4 +1,4 @@
-import { $inject, AlephaError, t } from "alepha";
+import { $inject, AlephaError, z } from "alepha";
 import { $command } from "alepha/command";
 import { $logger } from "alepha/logger";
 import { FileSystemProvider, ShellProvider } from "alepha/system";
@@ -32,21 +32,21 @@ export class PackCommand {
     name: "pack",
     description:
       "Pack the workspace into a deployable tar.gz (for `alepha platform --prebuilt` consumers like Alepha Rocket).",
-    flags: t.object({
-      tag: t.optional(
-        t.text({
+    flags: z.object({
+      tag: z
+        .text({
           aliases: ["t"],
           description:
             "Tag suffix for the artifact name (Docker-style). Defaults to `latest` → `<project>-latest.tar.gz`. Pass a real version like `0.0.2` for a pinned artifact.",
-        }),
-      ),
-      output: t.optional(
-        t.text({
+        })
+        .optional(),
+      output: z
+        .text({
           aliases: ["o"],
           description:
             "Output directory for the tar.gz (default: current dir).",
-        }),
-      ),
+        })
+        .optional(),
     }),
     handler: async ({ flags, root, run }) => {
       const pkgPath = this.fs.join(root, "package.json");

package/src/cli/core/commands/root.ts

@@ -1,4 +1,4 @@
-import { $inject, Alepha, t } from "alepha";
+import { $inject, Alepha, z } from "alepha";
 import { $command, CliProvider } from "alepha/command";
 import { $logger, ConsoleColorProvider } from "alepha/logger";
 import { version } from "../alephaPackageJson.ts";
@@ -14,13 +14,12 @@ export class RootCommand {
    */
   public readonly root = $command({
     root: true,
-    flags: t.object({
-      version: t.optional(
-        t.boolean({
-          description: "Show Alepha CLI version",
-          aliases: ["v"],
-        }),
-      ),
+    flags: z.object({
+      version: z
+        .boolean()
+        .meta({ aliases: ["v"] })
+        .describe("Show Alepha CLI version")
+        .optional(),
     }),
     handler: async ({ flags }) => {
       if (flags.version) {