alepha 0.23.0 → 0.24.0

package/dist/cli/core/index.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
-import { $atom, $hook, $inject, $module, $state, Alepha, AlephaError, __alephaRef, t } from "alepha";
-import { $command, CliProvider, EnvUtils, Runner } from "alepha/command";
+import { $atom, $hook, $inject, $module, $state, Alepha, AlephaError, __alephaRef, z } from "alepha";
+import { $command, CliProvider, EnvUtils } from "alepha/command";
 import { $logger, ConsoleColorProvider } from "alepha/logger";
 import { FileSystemProvider, ShellProvider } from "alepha/system";
 import { createHash } from "node:crypto";
@@ -11,7 +11,7 @@ import pkg from "alepha/package.json" with { type: "json" };
 import { analyzer } from "vite-bundle-analyzer";
 import { KV_DEFAULT_BINDING } from "alepha/cache";
 import { SEND_EMAIL_DEFAULT_BINDING } from "alepha/email/cloudflare";
-import { QUEUE_DEFAULT_BINDING } from "alepha/queue";
+import { QUEUE_DEFAULT_BINDING, QUEUE_DEFAULT_MAX_RETRIES } from "alepha/queue";
 import { promisify } from "node:util";
 import { brotliCompress, gzip } from "node:zlib";
 import { exec, spawn } from "node:child_process";
@@ -20,10 +20,10 @@ import { pathToFileURL } from "node:url";
 //#region ../../src/cli/core/atoms/appEntryOptions.ts
 const appEntryOptions = $atom({
 	name: "alepha.cli.appEntry.options",
-	schema: t.object({
-		server: t.optional(t.text()),
-		browser: t.optional(t.text()),
-		style: t.optional(t.text())
+	schema: z.object({
+		server: z.text().optional(),
+		browser: z.text().optional(),
+		style: z.text().optional()
 	}),
 	default: {}
 });
@@ -38,14 +38,14 @@ const appEntryOptions = $atom({
 const buildOptions = $atom({
 	name: "alepha.cli.build.options",
 	description: "Build configuration options",
-	schema: t.object({
+	schema: z.object({
 		/**
 		* Generate build stats report.
 		*
 		* - `true` - Generate a static HTML report
 		* - `"json"` - Generate a JSON report
 		*/
-		stats: t.optional(t.union([t.boolean(), t.enum(["json"])])),
+		stats: z.union([z.boolean(), z.enum(["json"])]).optional(),
 		/**
 		* Deployment target for the build output.
 		*
@@ -53,13 +53,13 @@ const buildOptions = $atom({
 		* - `vercel` - Generate Vercel deployment configuration (forces node runtime)
 		* - `cloudflare` - Generate Cloudflare Workers configuration (forces workerd runtime)
 		*/
-		target: t.optional(t.enum([
+		target: z.enum([
 			"bare",
 			"docker",
 			"vercel",
 			"cloudflare",
 			"static"
-		])),
+		]).optional(),
 		/**
 		* JavaScript runtime for the build output.
 		*
@@ -71,71 +71,71 @@ const buildOptions = $atom({
 		* - `cloudflare` always uses `workerd`
 		* - `vercel` always uses `node`
 		*/
-		runtime: t.optional(t.enum([
+		runtime: z.enum([
 			"node",
 			"bun",
 			"workerd"
-		])),
+		]).optional(),
 		/**
 		* Output directory configuration.
 		*/
-		output: t.optional(t.object({
+		output: z.object({
 			/**
 			* Root dist directory.
 			*
 			* @default "dist"
 			*/
-			dist: t.optional(t.string({ default: "dist" })),
+			dist: z.string().default("dist").optional(),
 			/**
 			* Public/client subdirectory.
 			*
 			* @default "public"
 			*/
-			public: t.optional(t.string({ default: "public" }))
-		})),
+			public: z.string().default("public").optional()
+		}).optional(),
 		/**
 		* Vercel-specific deployment configuration.
 		*
 		* Note: Set `target: "vercel"` to enable Vercel deployment.
 		* This object is only for additional configuration.
 		*/
-		vercel: t.optional(t.object({
-			projectName: t.optional(t.string()),
-			orgId: t.optional(t.string()),
-			projectId: t.optional(t.string()),
-			config: t.optional(t.object({ crons: t.optional(t.array(t.object({
-				path: t.string(),
-				schedule: t.string()
-			}))) }))
-		})),
+		vercel: z.object({
+			projectName: z.string().optional(),
+			orgId: z.string().optional(),
+			projectId: z.string().optional(),
+			config: z.object({ crons: z.array(z.object({
+				path: z.string(),
+				schedule: z.string()
+			})).optional() }).optional()
+		}).optional(),
 		/**
 		* Cloudflare-specific deployment configuration.
 		*
 		* Note: Set `target: "cloudflare"` to enable Cloudflare deployment.
 		* This object is only for additional configuration.
 		*/
-		cloudflare: t.optional(t.object({ config: t.optional(t.json()) })),
+		cloudflare: z.object({ config: z.json().optional() }).optional(),
 		/**
 		* Docker-specific deployment configuration.
 		*
 		* Note: Set `target: "docker"` to enable Docker deployment.
 		* This object is only for additional configuration.
 		*/
-		docker: t.optional(t.object({
+		docker: z.object({
 			/**
 			* Base image for the Dockerfile (FROM instruction).
 			*
 			* @default "node:24-alpine" for node runtime
 			* @default "oven/bun:alpine" for bun runtime
 			*/
-			from: t.optional(t.string()),
+			from: z.string().optional(),
 			/**
 			* Command to run in the Docker container.
 			*
 			* @default "node" for node runtime
 			* @default "bun" for bun runtime
 			*/
-			command: t.optional(t.string()),
+			command: z.string().optional(),
 			/**
 			* Extra packages to install globally in the generated image.
 			*
@@ -149,11 +149,11 @@ const buildOptions = $atom({
 			*
 			* @example install: ["wrangler"]
 			*/
-			install: t.optional(t.array(t.string())),
+			install: z.array(z.string()).optional(),
 			/**
 			* Docker build options (used when --image flag is passed).
 			*/
-			image: t.optional(t.object({
+			image: z.object({
 				/**
 				* Default image tag (name without version).
 				*
@@ -165,13 +165,13 @@ const buildOptions = $atom({
 				* @example "myproject/myapp"
 				* @example "ghcr.io/myorg/myapp"
 				*/
-				tag: t.string(),
+				tag: z.string(),
 				/**
 				* Additional arguments to pass to `docker build`.
 				*
 				* @example '--platform linux/amd64 --no-cache'
 				*/
-				args: t.optional(t.string()),
+				args: z.string().optional(),
 				/**
 				* Auto-add OCI standard labels (revision, created, version).
 				*
@@ -180,8 +180,8 @@ const buildOptions = $atom({
 				* - org.opencontainers.image.created (build timestamp)
 				* - org.opencontainers.image.version (from image tag)
 				*/
-				oci: t.optional(t.boolean())
-			})),
+				oci: z.boolean().optional()
+			}).optional(),
 			/**
 			* Compile the server entry to a single static binary using
 			* `bun build --compile`, then package it inside a minimal base image
@@ -197,7 +197,7 @@ const buildOptions = $atom({
 			*
 			* Pass `true` to enable with defaults, or an object to override.
 			*/
-			compile: t.optional(t.union([t.boolean(), t.object({
+			compile: z.union([z.boolean(), z.object({
 				/**
 				* Bun target triple, e.g. `bun-linux-x64-musl`,
 				* `bun-linux-arm64-musl`, or `bun-linux-x64-modern-musl`
@@ -205,27 +205,27 @@ const buildOptions = $atom({
 				*
 				* @default derived from host arch — always linux-musl.
 				*/
-				target: t.optional(t.string()),
+				target: z.string().optional(),
 				/**
 				* Base image for the generated Dockerfile.
 				*
 				* @default "gcr.io/distroless/static-debian12"
 				*/
-				base: t.optional(t.string()),
+				base: z.string().optional(),
 				/**
 				* Minify the compiled output.
 				*
 				* @default true
 				*/
-				minify: t.optional(t.boolean())
-			})]))
-		})),
+				minify: z.boolean().optional()
+			})]).optional()
+		}).optional(),
 		/**
 		* Static site deployment configuration.
 		*
 		* Note: Set `target: "static"` to enable static site generation.
 		*/
-		static: t.optional(t.object({ 
+		static: z.object({ 
 		/**
 		* Surge domain for deployment.
 		*
@@ -235,36 +235,36 @@ const buildOptions = $atom({
 		* @example "my-app.surge.sh"
 		* @example "my-custom-domain.com"
 		*/
-domain: t.optional(t.string()) })),
+domain: z.string().optional() }).optional(),
 		/**
 		* PWA (Progressive Web App) configuration.
 		*
 		* Generates a web app manifest and enables installability.
 		* Requires a client-side bundle (React).
 		*/
-		pwa: t.optional(t.object({
+		pwa: z.object({
 			/**
 			* Full application name displayed on the splash screen
 			* and in the OS app switcher.
 			*/
-			name: t.string(),
+			name: z.string(),
 			/**
 			* Short name displayed on the home screen icon.
 			* Falls back to `name` if omitted.
 			*/
-			shortName: t.optional(t.string()),
+			shortName: z.string().optional(),
 			/**
 			* Theme color used for the browser toolbar and OS chrome.
 			*
 			* @default "#ffffff"
 			*/
-			themeColor: t.optional(t.string()),
+			themeColor: z.string().optional(),
 			/**
 			* Background color for the splash screen.
 			*
 			* @default "#ffffff"
 			*/
-			backgroundColor: t.optional(t.string()),
+			backgroundColor: z.string().optional(),
 			/**
 			* Display mode for the installed PWA.
 			*
@@ -275,19 +275,19 @@ domain: t.optional(t.string()) })),
 			*
 			* @default "standalone"
 			*/
-			display: t.optional(t.enum([
+			display: z.enum([
 				"standalone",
 				"fullscreen",
 				"minimal-ui",
 				"browser"
-			])),
+			]).optional(),
 			/**
 			* Enable offline support via service worker.
 			*
 			* TODO: Not yet implemented.
 			*/
-			offline: t.optional(t.boolean())
-		}))
+			offline: z.boolean().optional()
+		}).optional()
 	}),
 	default: {}
 });
@@ -302,11 +302,11 @@ domain: t.optional(t.string()) })),
 const devOptions = $atom({
 	name: "alepha.cli.dev.options",
 	description: "Dev configuration options",
-	schema: t.object({ 
+	schema: z.object({ 
 	/**
 	* Disable Vite React plugin.
 	*/
-noViteReactPlugin: t.optional(t.boolean({ default: false })) }),
+noViteReactPlugin: z.boolean().default(false).optional() }),
 	default: {}
 });
 //#endregion
@@ -1255,11 +1255,11 @@ export class HelloController {
 //#endregion
 //#region ../../src/cli/core/templates/apiHelloResponseSchemaTs.ts
 const apiHelloResponseSchemaTs = () => {
-	return `import { type Static, t } from "alepha";
+	return `import { type Static, z } from "alepha";
 
-export const helloResponseSchema = t.object({
-  appName: t.text(),
-  serverTime: t.datetime(),
+export const helloResponseSchema = z.object({
+  appName: z.text(),
+  serverTime: z.datetime(),
 });
 
 export type HelloResponse = Static<typeof helloResponseSchema>;
@@ -2066,6 +2066,14 @@ var BuildClientTask = class extends BuildTask {
 //#region ../../src/cli/core/tasks/BuildCloudflareTask.ts
 const CLOUDFLARE_EMAIL_PROVIDER_NAME = "CloudflareEmailProvider";
 /**
+* Best-effort Cloudflare zone (registrable domain) for a wildcard Worker route:
+* strip the leading `*.` and any subdomain labels, keep the last two — e.g.
+* `*.club.alepha.dev` → `alepha.dev`, `*.alepha.club` → `alepha.club`. Correct
+* for single-label TLDs (the common case); a multi-label public suffix
+* (`.co.uk`) or a CF subdomain zone needs an explicit `CLOUDFLARE_ZONE`.
+*/
+const deriveZone = (domain) => domain.replace(/^\*\./, "").split(".").slice(-2).join(".");
+/**
 * Generate Cloudflare Workers deployment configuration.
 *
 * Creates:
@@ -2111,16 +2119,16 @@ var BuildCloudflareTask = class BuildCloudflareTask extends BuildTask {
 			head_sampling_rate: 1
 		};
 		this.enhanceDomain(wrangler);
+		this.enhanceServices(wrangler);
 		this.enhanceCron(ctx, wrangler);
 		this.enhanceDatabase(wrangler);
 		this.enhanceR2(wrangler);
 		this.enhanceKV(wrangler);
 		this.enhanceQueue(wrangler);
 		this.enhanceEmail(ctx, wrangler);
-		const containers = this.enhanceContainers(ctx, wrangler);
 		await this.fs.writeFile(this.fs.join(root, distDir, "wrangler.jsonc"), JSON.stringify(wrangler, null, 2));
-		if (!ctx.manifest) await this.writeManifest(ctx, root, distDir, name, containers);
-		await this.writeWorkerEntryPoint(root, distDir, containers);
+		if (!ctx.manifest) await this.writeManifest(ctx, root, distDir, name);
+		await this.writeWorkerEntryPoint(root, distDir);
 	}
 	/**
 	* Write `dist/manifest.json` — a build-time snapshot of everything
@@ -2129,7 +2137,7 @@ var BuildCloudflareTask = class BuildCloudflareTask extends BuildTask {
 	* the deploy path can skip the Vite-based introspection step and the
 	* workspace's runtime npm install.
 	*/
-	async writeManifest(ctx, root, distDir, name, containers) {
+	async writeManifest(ctx, root, distDir, name) {
 		let hasDatabase = false;
 		let hasBucket = false;
 		let hasKV = false;
@@ -2176,32 +2184,36 @@ var BuildCloudflareTask = class BuildCloudflareTask extends BuildTask {
 				hasCron: crons.length > 0
 			},
 			crons,
-			containers: containers.map((c) => ({
-				name: c.name,
-				className: c.className,
-				image: c.image,
-				port: c.port,
-				sleepAfter: c.sleepAfter,
-				instanceType: c.instanceType,
-				maxInstances: c.maxInstances
-			})),
 			email,
 			env
 		};
 		await this.fs.writeFile(this.fs.join(root, distDir, "manifest.json"), JSON.stringify(manifest, null, 2));
 	}
+	/** Worker-to-worker service bindings, from CLOUDFLARE_SERVICES (JSON). */
+	enhanceServices(wrangler) {
+		const raw = process.env.CLOUDFLARE_SERVICES;
+		if (!raw) return;
+		const services = JSON.parse(raw);
+		if (services.length > 0) wrangler.services = services;
+	}
 	enhanceDomain(wrangler) {
 		const domain = process.env.CLOUDFLARE_DOMAIN;
 		if (!domain) return;
 		if (domain.includes("*")) {
-			const zone = process.env.CLOUDFLARE_ZONE;
-			if (!zone) throw new Error(`Wildcard domain "${domain}" requires CLOUDFLARE_ZONE to be set (the parent zone name, e.g. "alepha.dev").`);
+			const zone = process.env.CLOUDFLARE_ZONE || deriveZone(domain);
 			wrangler.routes = [{
 				pattern: domain.endsWith("/*") ? domain : `${domain}/*`,
 				zone_name: zone
 			}];
 			return;
 		}
+		if (process.env.CLOUDFLARE_ZONE) {
+			wrangler.routes = [{
+				pattern: `${domain}/*`,
+				zone_name: process.env.CLOUDFLARE_ZONE
+			}];
+			return;
+		}
 		wrangler.routes = [{
 			pattern: domain,
 			custom_domain: true
@@ -2236,13 +2248,11 @@ var BuildCloudflareTask = class BuildCloudflareTask extends BuildTask {
 		if (!url?.startsWith("d1:")) return;
 		const [dbName, id] = url.replace("d1://", "").replace("d1:", "").split(":");
 		const binding = BuildCloudflareTask.D1_BINDING;
-		const jurisdiction = process.env.CLOUDFLARE_JURISDICTION;
 		wrangler.d1_databases = wrangler.d1_databases || [];
 		wrangler.d1_databases.push({
 			binding,
 			database_name: dbName,
-			database_id: id,
-			...jurisdiction ? { jurisdiction } : {}
+			database_id: id
 		});
 		wrangler.vars ??= {};
 		wrangler.vars.DATABASE_URL = `d1://${binding}`;
@@ -2291,8 +2301,13 @@ var BuildCloudflareTask = class BuildCloudflareTask extends BuildTask {
 			binding: QUEUE_DEFAULT_BINDING,
 			queue: queueName
 		});
+		const maxRetries = Number(process.env.CLOUDFLARE_QUEUE_MAX_RETRIES);
 		wrangler.queues.consumers = wrangler.queues.consumers || [];
-		wrangler.queues.consumers.push({ queue: queueName });
+		wrangler.queues.consumers.push({
+			queue: queueName,
+			dead_letter_queue: process.env.CLOUDFLARE_QUEUE_DLQ_NAME || `${queueName}-dlq`,
+			max_retries: Number.isSafeInteger(maxRetries) ? maxRetries : QUEUE_DEFAULT_MAX_RETRIES
+		});
 	}
 	enhanceEmail(ctx, wrangler) {
 		let binding;
@@ -2306,96 +2321,25 @@ var BuildCloudflareTask = class BuildCloudflareTask extends BuildTask {
 		if (wrangler.send_email.some((b) => b.name === binding)) return;
 		wrangler.send_email.push({ name: binding });
 	}
-	/**
-	* Discover `$container` primitives and emit the matching Cloudflare
-	* Containers bindings, Durable Object bindings, and migrations into
-	* `wrangler.jsonc`. The DO class declarations are added later, when
-	* the worker entry point is written.
-	*
-	* Returns the list of container descriptors so
-	* `writeWorkerEntryPoint` can emit `export class <NAME> extends
-	* Container` declarations referencing them.
-	*/
-	discoverContainers(ctx) {
-		return ctx.alepha.primitives("container").map((p) => ({
-			name: p.name.toUpperCase(),
-			className: p.name.split(/[^a-zA-Z0-9]/).filter(Boolean).map((s) => s[0].toUpperCase() + s.slice(1)).join(""),
-			image: p.options.image,
-			port: p.options.port ?? 3e3,
-			sleepAfter: typeof p.options.sleepAfter === "string" ? p.options.sleepAfter : "15m",
-			instanceType: p.options.instanceType === "dev" ? "lite" : p.options.instanceType ?? "lite",
-			maxInstances: p.options.maxInstances ?? 5,
-			envVars: p.options.envVars
-		}));
-	}
-	/**
-	* Expand a short image ref (e.g. `alepha-rocket:0.1.0`) into the
-	* fully-qualified `registry.cloudflare.com/<account>/<image>:<tag>`
-	* URL that wrangler validates at deploy time.
-	*
-	* Cloudflare Containers only pulls from `registry.cloudflare.com`;
-	* wrangler accepts either a Dockerfile path or a fully-qualified
-	* registry URL in the `image` field — not a bare DockerHub-style
-	* name. We let `$container({ image })` callers write the short
-	* form (it matches what `wrangler containers push <local>` accepts
-	* + matches the local docker tag) and rewrite to the CF registry
-	* URL here.
-	*
-	* Pass-through cases:
-	*   - already a full URL: starts with `registry.cloudflare.com/`
-	*     or contains a scheme/`://`
-	*   - looks like a Dockerfile path: starts with `./` or `/`
-	*/
-	resolveContainerImage(image) {
-		if (image.startsWith("./") || image.startsWith("/") || image.startsWith("registry.cloudflare.com/") || image.includes("://")) return image;
-		const accountId = process.env.CLOUDFLARE_ACCOUNT_ID;
-		if (!accountId) return image;
-		return `registry.cloudflare.com/${accountId}/${image}`;
-	}
-	enhanceContainers(ctx, wrangler) {
-		const descriptors = ctx.manifest ? ctx.manifest.containers : this.discoverContainers(ctx);
-		if (descriptors.length === 0) return [];
-		wrangler.containers = wrangler.containers || [];
-		wrangler.durable_objects = wrangler.durable_objects || {};
-		wrangler.durable_objects.bindings = wrangler.durable_objects.bindings || [];
-		wrangler.migrations = wrangler.migrations || [];
-		const newSqliteClasses = [];
-		for (const d of descriptors) {
-			wrangler.containers.push({
-				class_name: d.className,
-				image: this.resolveContainerImage(d.image),
-				instance_type: d.instanceType,
-				max_instances: d.maxInstances
-			});
-			wrangler.durable_objects.bindings.push({
-				name: d.name,
-				class_name: d.className
-			});
-			newSqliteClasses.push(d.className);
-		}
-		if (newSqliteClasses.length > 0) wrangler.migrations.push({
-			tag: "containers-v1",
-			new_sqlite_classes: newSqliteClasses
-		});
-		return descriptors;
-	}
-	async writeWorkerEntryPoint(root, distDir, containers = []) {
-		const containerDeclarations = containers.map((c) => {
-			const envVars = c.envVars ? `  envVars = ${JSON.stringify(c.envVars)};\n` : "";
-			return `export class ${c.className} extends globalThis.__alepha_CloudflareContainer {\n  defaultPort = ${c.port};\n  sleepAfter = "${c.sleepAfter}";\n${envVars}}`;
-		}).join("\n\n");
+	async writeWorkerEntryPoint(root, distDir) {
 		const workerCode = `
 import "./index.js";
 
-// Stash the per-invocation \`executionCtx.waitUntil\` in the Alepha store
-// so background work (notably $job direct dispatch) can keep the isolate
-// alive past the response.
-const setWaitUntil = (executionCtx) => {
-  if (executionCtx && typeof executionCtx.waitUntil === "function") {
-    __alepha.set("cloudflare.waitUntil", (p) => executionCtx.waitUntil(p));
-  } else {
-    __alepha.set("cloudflare.waitUntil", undefined);
-  }
+// Run an invocation inside an Alepha fork carrying THIS invocation's
+// \`executionCtx.waitUntil\`, so background work (notably $job direct dispatch)
+// can keep the isolate alive past the response.
+//
+// It must be the async context, never the shared store: one isolate serves
+// concurrent invocations, so a store slot would let request B overwrite
+// request A's handle — A's background work would then call B's already-returned
+// context ("waitUntil after response") and be silently dropped.
+const withExecutionContext = (executionCtx, fn) => {
+  const waitUntil =
+    executionCtx && typeof executionCtx.waitUntil === "function"
+      ? (p) => executionCtx.waitUntil(p)
+      : undefined;
+
+  return __alepha.context.run(fn, { "cloudflare.waitUntil": waitUntil });
 };
 
 // Bind the per-invocation Worker \`env\`: keep the full binding (D1, R2, KV, …)
@@ -2411,7 +2355,6 @@ export default {
     const ctx = { req: request, res: undefined };
 
     bindEnv(env);
-    setWaitUntil(executionCtx);
 
     try {
       await __alepha.start();
@@ -2420,14 +2363,15 @@ export default {
       return new Response("Internal Server Error", { status: 500 });
     }
 
-    await __alepha.events.emit("web:request", ctx);
+    await withExecutionContext(executionCtx, () =>
+      __alepha.events.emit("web:request", ctx),
+    );
 
     return ctx.res;
   },
 
   scheduled: async (event, env, executionCtx) => {
     bindEnv(env);
-    setWaitUntil(executionCtx);
 
     try {
       await __alepha.start();
@@ -2436,15 +2380,16 @@ export default {
       throw err;
     }
 
-    await __alepha.events.emit("cloudflare:scheduled", {
-      cron: event.cron,
-      scheduledTime: event.scheduledTime,
-    });
+    await withExecutionContext(executionCtx, () =>
+      __alepha.events.emit("cloudflare:scheduled", {
+        cron: event.cron,
+        scheduledTime: event.scheduledTime,
+      }),
+    );
   },
 
   queue: async (batch, env, executionCtx) => {
     bindEnv(env);
-    setWaitUntil(executionCtx);
 
     try {
       await __alepha.start();
@@ -2453,19 +2398,20 @@ export default {
       throw err;
     }
 
-    for (const msg of batch.messages) {
-      try {
-        await __alepha.events.emit("cloudflare:queue", msg.body);
-        msg.ack();
-      } catch (e) {
-        msg.retry();
+    await withExecutionContext(executionCtx, async () => {
+      for (const msg of batch.messages) {
+        try {
+          await __alepha.events.emit("cloudflare:queue", msg.body);
+          msg.ack();
+        } catch (e) {
+          msg.retry();
+        }
       }
-    }
+    });
   },
 };
 `.trim();
-		const containerBlock = containers.length > 0 ? `${containerDeclarations}\n\n` : "";
-		await this.fs.writeFile(this.fs.join(root, distDir, "main.cloudflare.js"), `${this.warningComment}\n${containerBlock}${workerCode}`.trim());
+		await this.fs.writeFile(this.fs.join(root, distDir, "main.cloudflare.js"), `${this.warningComment}\n${workerCode}`.trim());
 	}
 };
 //#endregion
@@ -3418,36 +3364,24 @@ var BuildCommand = class {
 		name: "build",
 		mode: "production",
 		description: "Build the project for production",
-		flags: t.object({
-			stats: t.optional(t.union([t.boolean(), t.enum(["json"])], { description: "Generate build stats report" })),
-			target: t.optional(t.enum([
+		flags: z.object({
+			stats: z.union([z.boolean(), z.enum(["json"])]).describe("Generate build stats report").optional(),
+			target: z.enum([
 				"bare",
 				"docker",
 				"vercel",
 				"cloudflare",
 				"cf",
 				"static"
-			], {
-				aliases: ["t"],
-				description: "Deployment target (cf = cloudflare)"
-			})),
-			runtime: t.optional(t.enum([
+			]).meta({ aliases: ["t"] }).describe("Deployment target (cf = cloudflare)").optional(),
+			runtime: z.enum([
 				"node",
 				"bun",
 				"workerd"
-			], {
-				aliases: ["r"],
-				description: "JavaScript runtime"
-			})),
-			image: t.optional(t.union([t.boolean(), t.text()], {
-				aliases: ["i"],
-				description: "Build Docker image. Use -i for latest, -i=<version> for specific version"
-			})),
-			compile: t.optional(t.boolean({
-				aliases: ["c"],
-				description: "Compile server to a single static binary (requires --target=docker --runtime=bun)"
-			})),
-			prebuilt: t.optional(t.boolean({ description: "Skip the bundle steps (Vite client/server + asset compression). Only regenerates target-specific deploy config (e.g. wrangler.jsonc). Use when `dist/` is already built and you just need the config refreshed." }))
+			]).meta({ aliases: ["r"] }).describe("JavaScript runtime").optional(),
+			image: z.union([z.boolean(), z.text()]).meta({ aliases: ["i"] }).describe("Build Docker image. Use -i for latest, -i=<version> for specific version").optional(),
+			compile: z.boolean().meta({ aliases: ["c"] }).describe("Compile server to a single static binary (requires --target=docker --runtime=bun)").optional(),
+			prebuilt: z.boolean().describe("Skip the bundle steps (Vite client/server + asset compression). Only regenerates target-specific deploy config (e.g. wrangler.jsonc). Use when `dist/` is already built and you just need the config refreshed.").optional()
 		}),
 		handler: async ({ flags, run, root }) => {
 			process.env.NODE_ENV = "production";
@@ -3545,7 +3479,7 @@ var CleanCommand = class {
 };
 //#endregion
 //#region ../../src/cli/core/commands/db.ts
-const drizzleCommandFlags = t.object({ provider: t.optional(t.text({ description: "Database provider name to target (e.g., 'postgres', 'sqlite')" })) });
+const drizzleCommandFlags = z.object({ provider: z.text({ description: "Database provider name to target (e.g., 'postgres', 'sqlite')" }).optional() });
 var DbCommand = class {
 	log = $logger();
 	fs = $inject(FileSystemProvider);
@@ -3553,7 +3487,6 @@ var DbCommand = class {
 	pm = $inject(PackageManagerUtils);
 	entryProvider = $inject(AppEntryProvider);
 	viteUtil = $inject(ViteUtils);
-	runner = $inject(Runner);
 	/**
 	* Check if database migrations are up to date.
 	*/
@@ -3561,12 +3494,12 @@ var DbCommand = class {
 		name: "check",
 		mode: true,
 		description: "Check if migration files are up to date",
-		args: t.optional(t.text({
+		args: z.text({
 			title: "path",
 			description: "Path to the Alepha server entry file"
-		})),
+		}).optional(),
 		flags: drizzleCommandFlags,
-		handler: async ({ args, root }) => {
+		handler: async ({ flags, root }) => {
 			const rootDir = root;
 			this.log.debug(`Using project root: ${rootDir}`);
 			const entry = await this.entryProvider.getAppEntry(root);
@@ -3577,16 +3510,18 @@ var DbCommand = class {
 			const repositoryProvider = alepha.inject("RepositoryProvider");
 			const drizzleKitProvider = alepha.inject("DrizzleKitProvider");
 			const accepted = /* @__PURE__ */ new Set([]);
+			const drifted = [];
 			for (const primitive of repositoryProvider.getRepositories()) {
 				const provider = primitive.provider;
 				const providerName = provider.name;
 				if (accepted.has(providerName)) continue;
 				accepted.add(providerName);
+				if (flags.provider && flags.provider !== providerName) continue;
 				const migrationDir = this.fs.join(rootDir, "migrations", providerName);
 				const journalBuffer = await this.fs.readFile(this.fs.join(migrationDir, "meta", "_journal.json")).catch(() => null);
 				if (!journalBuffer) {
-					this.log.info("No migration journal found.");
-					return;
+					this.log.info(`No migration journal found for '${providerName}'.`);
+					continue;
 				}
 				const journal = JSON.parse(journalBuffer.toString("utf-8"));
 				const lastMigration = journal.entries[journal.entries.length - 1];
@@ -3594,18 +3529,27 @@ var DbCommand = class {
 				const lastSnapshot = JSON.parse(snapshotBuffer.toString("utf-8"));
 				const { statements: migrationStatements } = await drizzleKitProvider.generateMigration(provider, lastSnapshot, { withoutSchema: true });
 				if (migrationStatements.length === 0) {
-					this.log.info("No changes detected.");
-					return;
+					this.log.info(`No changes detected for '${providerName}'.`);
+					continue;
+				}
+				drifted.push({
+					provider: providerName,
+					statements: migrationStatements
+				});
+			}
+			if (drifted.length > 0) {
+				for (const { provider: providerName, statements } of drifted) {
+					this.log.info("");
+					this.log.info(`Detected migration statements for '${providerName}':`);
+					this.log.info("");
+					for (const stmt of statements) this.log.info(stmt);
+					this.log.info("");
+					this.log.info(`At least ${statements.length} change(s) detected.`);
 				}
 				this.log.info("");
-				this.log.info("Detected migration statements:");
-				this.log.info("");
-				for (const stmt of migrationStatements) this.log.info(stmt);
-				this.log.info("");
-				this.log.info(`At least ${migrationStatements.length} change(s) detected.`);
 				this.log.info("Please, run 'alepha db migrations generate' to update the migration files.");
 				this.log.info("");
-				throw new AlephaError("Database migrations are not up to date.");
+				throw new AlephaError(`Database migrations are not up to date (${drifted.map((d) => d.provider).join(", ")}).`);
 			}
 		}
 	});
@@ -3616,13 +3560,13 @@ var DbCommand = class {
 		name: "create",
 		mode: true,
 		description: "Generate migration files from current schema",
-		args: t.optional(t.text({
+		args: z.text({
 			title: "path",
 			description: "Path to the Alepha server entry file"
-		})),
-		flags: t.extend(drizzleCommandFlags, {
-			custom: t.optional(t.boolean({ description: "Generate an empty migration file for custom SQL (e.g., for data migrations or manual adjustments)" })),
-			name: t.optional(t.text({ description: "Name for the generated migration file" }))
+		}).optional(),
+		flags: drizzleCommandFlags.extend({
+			custom: z.boolean().describe("Generate an empty migration file for custom SQL (e.g., for data migrations or manual adjustments)").optional(),
+			name: z.text({ description: "Name for the generated migration file" }).optional()
 		}),
 		handler: async ({ args, flags, root }) => {
 			const parts = [];
@@ -3646,11 +3590,11 @@ var DbCommand = class {
 		name: "push",
 		mode: true,
 		description: "Push database schema changes directly to the database",
-		args: t.optional(t.text({
+		args: z.text({
 			title: "path",
 			description: "Path to the Alepha server entry file"
-		})),
-		flags: t.extend(drizzleCommandFlags, { dryRun: t.optional(t.boolean({ description: "Preview SQL statements without executing them" })) }),
+		}).optional(),
+		flags: drizzleCommandFlags.extend({ dryRun: z.boolean().describe("Preview SQL statements without executing them").optional() }),
 		handler: async ({ root, args, flags }) => {
 			if (flags.dryRun) {
 				const entry = await this.entryProvider.getAppEntry(root);
@@ -3705,10 +3649,10 @@ var DbCommand = class {
 		name: "apply",
 		mode: true,
 		description: "Apply pending migrations to the database",
-		args: t.optional(t.text({
+		args: z.text({
 			title: "path",
 			description: "Path to the Alepha server entry file"
-		})),
+		}).optional(),
 		flags: drizzleCommandFlags,
 		handler: async ({ root, run, mode }) => {
 			const entry = await this.entryProvider.getAppEntry(root);
@@ -3716,7 +3660,6 @@ var DbCommand = class {
 				name: `db migrate (${mode || "development"})`,
 				handler: async () => {
 					process.env.MIGRATE = "true";
-					if (this.runner.useDynamicLogger) process.env.LOG_LEVEL = "warn";
 					await (await this.viteUtil.runAlepha({
 						entry,
 						mode: "production"
@@ -3732,10 +3675,10 @@ var DbCommand = class {
 		name: "studio",
 		mode: true,
 		description: "Launch Drizzle Studio database browser",
-		args: t.optional(t.text({
+		args: z.text({
 			title: "path",
 			description: "Path to the Alepha server entry file"
-		})),
+		}).optional(),
 		flags: drizzleCommandFlags,
 		handler: async ({ root, args, flags }) => {
 			await this.runDrizzleKitCommand({
@@ -3816,6 +3759,9 @@ var DbCommand = class {
 				rootDir,
 				command: options.command
 			});
+			const migrationsDir = this.fs.join(rootDir, "migrations", providerName);
+			const isGenerate = options.command === "generate";
+			const before = isGenerate ? new Set(await this.fs.ls(migrationsDir).catch(() => [])) : /* @__PURE__ */ new Set();
 			const flags = options.commandFlags ? ` ${options.commandFlags}` : "";
 			const drizzleKit = this.utils.resolveBin("drizzle-kit");
 			await this.utils.exec(`node "${drizzleKit}" ${options.command} --config=${drizzleConfigJsPath}${flags}`, {
@@ -3825,7 +3771,10 @@ var DbCommand = class {
 					NODE_OPTIONS: [process.env.NODE_OPTIONS, "--import tsx"].filter(Boolean).join(" ")
 				}
 			});
-			if (options.command === "generate" && dialect === "postgresql") await this.stripPublicSchemaFromMigrations(this.fs.join(rootDir, "migrations", providerName));
+			if (!isGenerate) continue;
+			if (dialect === "postgresql") await this.stripPublicSchemaFromMigrations(migrationsDir);
+			const after = await this.fs.ls(migrationsDir).catch(() => []);
+			await this.assertNoDestructiveMigrations(migrationsDir, after.filter((file) => !before.has(file)));
 		}
 	}
 	/**
@@ -3848,6 +3797,53 @@ var DbCommand = class {
 		}
 	}
 	/**
+	* Refuse a freshly generated migration that drops a table.
+	*
+	* Drizzle rebuilds a SQLite table by dropping and recreating it. On
+	* Cloudflare D1 that is a data-loss bomb: D1 ignores `PRAGMA
+	* foreign_keys=OFF`, so dropping a table that other tables reference with
+	* `ON DELETE CASCADE` silently wipes every child row — with no error, on
+	* deploy, in production.
+	*
+	* The generated file is left on disk on purpose: the point is to force a
+	* human to read it. If the drop really is intended, keep the file and move
+	* on (a re-run detects no schema diff, so nothing is regenerated and this
+	* guard stays quiet).
+	*/
+	async assertNoDestructiveMigrations(migrationsDir, files) {
+		const offenders = [];
+		for (const file of files) {
+			if (!file.endsWith(".sql")) continue;
+			const content = await this.fs.readFile(this.fs.join(migrationsDir, file));
+			const drops = this.findDropTableStatements(content.toString("utf-8"));
+			for (const drop of drops) offenders.push(`  ${file}: ${drop}`);
+		}
+		if (offenders.length === 0) return;
+		throw new AlephaError([
+			`Refusing to generate a destructive migration: DROP TABLE found in ${offenders.length} statement(s).`,
+			"",
+			...offenders,
+			"",
+			"On Cloudflare D1, dropping a table that CASCADE children reference wipes those child rows silently.",
+			"Review the generated file above. If the drop is intentional, keep it and re-run — nothing will be regenerated.",
+			"If it is not, delete the file and adjust your schema (e.g. keep the column, or drop it in a hand-written migration)."
+		].join("\n"));
+	}
+	/**
+	* Extract `DROP TABLE` statements from a SQL migration, skipping any that sit
+	* inside a `--` line comment.
+	*/
+	findDropTableStatements(sql) {
+		const statements = [];
+		for (const rawLine of sql.split(/\r?\n/)) {
+			const line = rawLine.trim();
+			if (line.startsWith("--")) continue;
+			const code = line.split("--")[0];
+			if (/\bDROP\s+TABLE\b/i.test(code)) statements.push(code.trim());
+		}
+		return statements;
+	}
+	/**
 	* Prepare Drizzle configuration files for a database provider.
 	*/
 	async prepareDrizzleConfig(options) {
@@ -4341,7 +4337,7 @@ if (import.meta.hot) {
 			const file = queue.pop();
 			if (invalidated.has(file)) continue;
 			invalidated.add(file);
-			const mods = new Set([...graph.getModulesByFile(file) ?? [], ...graph.getModuleById(file) ? [graph.getModuleById(file)] : []]);
+			const mods = /* @__PURE__ */ new Set([...graph.getModulesByFile(file) ?? [], ...graph.getModuleById(file) ? [graph.getModuleById(file)] : []]);
 			if (mods.size === 0) continue;
 			for (const mod of mods) {
 				graph.invalidateModule(mod);
@@ -4366,7 +4362,7 @@ if (import.meta.hot) {
 				if (/[/\\]\.idea[/\\]/.test(file)) return;
 				console.log();
 				console.log(this.colors.set("CYAN", "  ⟳ Retrying..."));
-				const filesToInvalidate = new Set([file]);
+				const filesToInvalidate = /* @__PURE__ */ new Set([file]);
 				try {
 					const alepha = await this.loadAlepha(false, filesToInvalidate);
 					this.waitingForRetry = false;
@@ -4473,7 +4469,7 @@ var DevCommand = class {
 		name: "dev",
 		mode: true,
 		description: "Run the project in development mode",
-		flags: t.object({ only: t.optional(t.string({ description: "Run only specific apps (comma-separated: --only api,companion)" })) }),
+		flags: z.object({ only: z.string().describe("Run only specific apps (comma-separated: --only api,companion)").optional() }),
 		handler: async ({ root, flags }) => {
 			const apps = await this.discoverApps(root);
 			if (apps.length > 0) await this.runMultiple(root, apps, flags);
@@ -4610,12 +4606,12 @@ const DEFAULT_IGNORE = [
 */
 const changelogOptions = $atom({
 	name: "alepha.cli.changelog.options",
-	schema: t.object({ 
+	schema: z.object({ 
 	/**
 	* Scopes to ignore (e.g., "project", "release", "chore").
 	* Commits like `feat(chore): ...` will be excluded from changelog.
 	*/
-ignore: t.optional(t.array(t.string())) }),
+ignore: z.array(z.string()).optional() }),
 	default: { ignore: DEFAULT_IGNORE }
 });
 //#endregion
@@ -4756,25 +4752,19 @@ var ChangelogCommand = class {
 	command = $command({
 		name: "changelog",
 		description: "Generate changelog from conventional commits (outputs to stdout)",
-		flags: t.object({
+		flags: z.object({
 			/**
 			* Show changes from this ref (tag, commit, branch).
 			* Defaults to the latest version tag.
 			* Example: --from=1.0.0
 			*/
-			from: t.optional(t.string({
-				aliases: ["f"],
-				description: "Starting ref (default: latest tag)"
-			})),
+			from: z.string().meta({ aliases: ["f"] }).describe("Starting ref (default: latest tag)").optional(),
 			/**
 			* Show changes up to this ref (tag, commit, branch).
 			* Defaults to HEAD.
 			* Example: --to=main
 			*/
-			to: t.optional(t.string({
-				aliases: ["t"],
-				description: "Ending ref (default: HEAD)"
-			}))
+			to: z.string().meta({ aliases: ["t"] }).describe("Ending ref (default: HEAD)").optional()
 		}),
 		handler: async ({ flags, root }) => {
 			const git = (cmd) => this.git.exec(cmd, root);
@@ -4816,10 +4806,10 @@ var GenEnvCommand = class {
 	command = $command({
 		name: "env",
 		description: "Extract environment variables from server entry file",
-		flags: t.object({ out: t.optional(t.text({
+		flags: z.object({ out: z.text({
 			aliases: ["o"],
 			description: "Output file path (e.g., .env)"
-		})) }),
+		}).optional() }),
 		handler: async ({ root, flags }) => {
 			const alepha = await this.utils.loadAlephaFromServerEntryFile({
 				root,
@@ -4851,10 +4841,10 @@ var OpenApiCommand = class {
 	command = $command({
 		name: "openapi",
 		description: "Generate OpenAPI specification from actions",
-		flags: t.object({ out: t.optional(t.text({
+		flags: z.object({ out: z.text({
 			aliases: ["o"],
 			description: "Output file path"
-		})) }),
+		}).optional() }),
 		handler: async ({ root, flags }) => {
 			const alepha = await this.utils.loadAlephaFromServerEntryFile({
 				root,
@@ -4915,28 +4905,22 @@ var InitCommand = class {
 	init = $command({
 		name: "init",
 		description: "Add missing Alepha configuration files to the project",
-		args: t.optional(t.text({
+		args: z.text({
 			title: "path",
 			trim: true,
 			lowercase: true
-		})),
-		flags: t.object({
-			pm: t.optional(t.enum([
+		}).optional(),
+		flags: z.object({
+			pm: z.enum([
 				"yarn",
 				"npm",
 				"pnpm",
 				"bun"
-			], { description: "Package manager to use" })),
-			api: t.optional(t.boolean({ description: "Include API module structure (src/api/)" })),
-			react: t.optional(t.boolean({
-				aliases: ["r"],
-				description: "Include React dependencies and web module (src/web/)"
-			})),
-			tailwind: t.optional(t.boolean({ description: "Include Tailwind CSS with Vite plugin. Implies --react" })),
-			force: t.optional(t.boolean({
-				aliases: ["f"],
-				description: "Override existing files"
-			}))
+			]).describe("Package manager to use").optional(),
+			api: z.boolean().describe("Include API module structure (src/api/)").optional(),
+			react: z.boolean().meta({ aliases: ["r"] }).describe("Include React dependencies and web module (src/web/)").optional(),
+			tailwind: z.boolean().describe("Include Tailwind CSS with Vite plugin. Implies --react").optional(),
+			force: z.boolean().meta({ aliases: ["f"] }).describe("Override existing files").optional()
 		}),
 		handler: async ({ run, flags, root, args }) => {
 			await this.scaffolder.init({
@@ -4994,15 +4978,15 @@ var PackCommand = class {
 	pack = $command({
 		name: "pack",
 		description: "Pack the workspace into a deployable tar.gz (for `alepha platform --prebuilt` consumers like Alepha Rocket).",
-		flags: t.object({
-			tag: t.optional(t.text({
+		flags: z.object({
+			tag: z.text({
 				aliases: ["t"],
 				description: "Tag suffix for the artifact name (Docker-style). Defaults to `latest` → `<project>-latest.tar.gz`. Pass a real version like `0.0.2` for a pinned artifact."
-			})),
-			output: t.optional(t.text({
+			}).optional(),
+			output: z.text({
 				aliases: ["o"],
 				description: "Output directory for the tar.gz (default: current dir)."
-			}))
+			}).optional()
 		}),
 		handler: async ({ flags, root, run }) => {
 			const pkgPath = this.fs.join(root, "package.json");
@@ -5057,10 +5041,7 @@ var RootCommand = class {
 	*/
 	root = $command({
 		root: true,
-		flags: t.object({ version: t.optional(t.boolean({
-			description: "Show Alepha CLI version",
-			aliases: ["v"]
-		})) }),
+		flags: z.object({ version: z.boolean().meta({ aliases: ["v"] }).describe("Show Alepha CLI version").optional() }),
 		handler: async ({ flags }) => {
 			if (flags.version) {
 				this.log.info(this.color.set("WHITE_BOLD", `Alepha v${version}`));
@@ -5080,18 +5061,12 @@ var TestCommand = class {
 	test = $command({
 		name: "test",
 		description: "Run tests using Vitest. Pass a filter to run only matching specs, e.g. `alepha test user` or `alepha test test/auth.spec.ts`",
-		args: t.optional(t.text({
+		args: z.text({
 			title: "filter",
 			description: "Only run spec files whose path matches this string"
-		})),
-		flags: t.object({ config: t.optional(t.string({
-			description: "Path to Vitest config file",
-			alias: "c"
-		})) }),
-		env: t.object({ VITEST_ARGS: t.optional(t.string({
-			default: "",
-			description: "Additional arguments to pass to Vitest. E.g., --coverage"
-		})) }),
+		}).optional(),
+		flags: z.object({ config: z.string().meta({ alias: "c" }).describe("Path to Vitest config file").optional() }),
+		env: z.object({ VITEST_ARGS: z.string().describe("Additional arguments to pass to Vitest. E.g., --coverage").default("").optional() }),
 		handler: async ({ run, root, flags, env, args }) => {
 			await this.scaffolder.ensureConfig(root, { tsconfigJson: true });
 			const config = flags.config ? `--config=${flags.config}` : "";