emdash 0.34.0 → 0.35.0

package/dist/cli/index.mjs

@@ -1,57 +1,62 @@
 #!/usr/bin/env node
-import { a as runMigrations, o as __exportAll, r as getMigrationStatus } from "../runner-BiDvq5dv.mjs";
+import { a as getMigrationStatus, c as __exportAll, s as runMigrations } from "../runner-C1T11CfC.mjs";
 import { t as EmDashDatabaseError } from "../errors-9P_FDrJ_.mjs";
 import { t as validateIdentifier } from "../validate-BpwoDOgt.mjs";
 import { u as listTablesLike } from "../dialect-helpers-BSbfaO3F.mjs";
 import { i as isI18nEnabled, r as getI18nConfig } from "../config-C3EBstHi.mjs";
 import "../after-CBU2vkoO.mjs";
 import "../object-cache-71tPfV4A.mjs";
-import { t as ContentRepository } from "../content-BNfwh7xX.mjs";
+import { t as ContentRepository } from "../content-ZHCc1ngN.mjs";
 import { n as isMissingTableError } from "../db-errors-Cl-sKYTm.mjs";
 import { n as slugify } from "../slugify-B994zkXC.mjs";
 import { a as encodeBase64url } from "../base64-CvLhUKQv.mjs";
 import "../types-CQPWhPxE.mjs";
 import { t as MediaRepository } from "../media-CzhAn2--.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-CPeM8d2o.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-BqCZ1TdU.mjs";
 import { t as OptionsRepository } from "../options-CBXIHUoT.mjs";
 import "../redirect-COsS6SWJ.mjs";
 import "../request-cache-BSUptuJR.mjs";
 import "../byline-registry-DDun8sxh.mjs";
-import "../field-defs-cache-hg6QkjV9.mjs";
-import { t as BylineRepository } from "../byline-pEcoDps8.mjs";
+import "../field-defs-cache-BzwBlJrR.mjs";
+import { t as BylineRepository } from "../byline-yjvWq4ip.mjs";
 import "../dist-D_6CKR8z.mjs";
-import "../fts-manager-CZ-5dVwJ.mjs";
+import "../fts-manager-DyZEohZC.mjs";
 import { kyselyLogOption } from "../database/instrumentation.mjs";
-import "../loader-DLBqRiGP.mjs";
-import "../content-refresh-DNERP4-f.mjs";
-import "../collection-deletion-C8BugSGz.mjs";
-import { n as SchemaRegistry } from "../registry-C581V4TP.mjs";
-import "../settings-B372MV0p.mjs";
+import "../loader-CdG_Ci3H.mjs";
+import "../content-refresh-B_8SJzuU.mjs";
+import "../collection-deletion-DQPvMD8R.mjs";
+import { n as SchemaRegistry } from "../registry-Cqa2I749.mjs";
+import "../settings-xRdoUZr0.mjs";
 import { i as pluginManifestSchema } from "../manifest-schema-BXbUAHod.mjs";
 import { i as isDeprecatedCapability, t as CAPABILITY_RENAMES } from "../types-CP1CflWf.mjs";
 import "../ssrf-Cpvg_n3A.mjs";
 import "../ssrf-DpXgKsna.mjs";
-import { t as validateSeed } from "../validate-BkqIG_Uj.mjs";
-import { t as applySeed } from "../apply-D5zfeD09.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-dtYs2hDo.mjs";
+import { t as validateSeed } from "../validate-BMLBvxOC.mjs";
+import { t as applySeed } from "../apply-kUDt80-G.mjs";
+import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-B252yQUf.mjs";
+import "../identity-Ys6Dlc9C.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-BEgsAQEU.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { t as convertDataForRead } from "../portable-text-DhKbDAGr.mjs";
+import { t as convertDataForRead } from "../portable-text-imBW5cHK.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, getCachedAccessToken, isAccessRedirect, resolveCustomHeaders, runCloudflaredLogin } from "../client/cf-access.mjs";
 import { EmDashClient } from "../client/index.mjs";
-import { r as fileExists$4, t as bundleCommand } from "../bundle-CBEXrBnb.mjs";
+import { r as fileExists$4, t as bundleCommand } from "../bundle-vn56sLos.mjs";
+import { createRequire } from "node:module";
 import { Kysely, SqliteDialect, sql } from "kysely";
 import { createGzipDecoder, unpackTar } from "modern-tar";
+import { pathToFileURL } from "node:url";
+import { access, mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, parse, resolve } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
 import BetterSqlite3 from "better-sqlite3";
-import { access, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { defineCommand, runCommand, runMain } from "citty";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
-import { parse, printParseErrorCode } from "jsonc-parser";
-import { parse as parse$1 } from "smol-toml";
+import { parse as parse$1, printParseErrorCode } from "jsonc-parser";
+import { parse as parse$2 } from "smol-toml";
+import { createInterface } from "node:readline/promises";
 
 //#region src/cli/commands/auth.ts
 /**
@@ -130,7 +135,7 @@ function resolveCredentialKey(baseUrl) {
 	try {
 		const url = new URL(baseUrl);
 		if (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]") {
-			const projectPath = findProjectRoot(process.cwd());
+			const projectPath = findProjectRoot$1(process.cwd());
 			if (projectPath) return `path:${projectPath}`;
 			return url.origin;
 		}
@@ -142,7 +147,7 @@ function resolveCredentialKey(baseUrl) {
 /**
 * Walk up from cwd to find the project root (directory containing astro.config.*).
 */
-function findProjectRoot(from) {
+function findProjectRoot$1(from) {
 	let dir = resolve(from);
 	const root = resolve("/");
 	while (dir !== root) {
@@ -1080,7 +1085,7 @@ async function fileExists$2(path) {
 		return false;
 	}
 }
-function isRecord(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sourcePosition(source, offset) {
@@ -1107,7 +1112,7 @@ async function checkSchedulerWiringAtPath(cwd, configPath) {
 	const configSource = await readFile(configPath, "utf8");
 	let parsed;
 	if (configPath.endsWith(".toml")) try {
-		parsed = parse$1(configSource);
+		parsed = parse$2(configSource);
 	} catch (error) {
 		return [{
 			name: "scheduler config",
@@ -1117,7 +1122,7 @@ async function checkSchedulerWiringAtPath(cwd, configPath) {
 	}
 	else {
 		const parseErrors = [];
-		parsed = parse(configSource, parseErrors, {
+		parsed = parse$1(configSource, parseErrors, {
 			allowTrailingComma: true,
 			disallowComments: false
 		});
@@ -1131,12 +1136,12 @@ async function checkSchedulerWiringAtPath(cwd, configPath) {
 			}];
 		}
 	}
-	if (!isRecord(parsed)) return [{
+	if (!isRecord$2(parsed)) return [{
 		name: "scheduler config",
 		status: "fail",
 		message: `could not parse ${configPath}: expected an object — fix the Wrangler configuration syntax`
 	}];
-	const triggers = isRecord(parsed.triggers) ? parsed.triggers : null;
+	const triggers = isRecord$2(parsed.triggers) ? parsed.triggers : null;
 	const hasCronTrigger = Array.isArray(triggers?.crons) && triggers.crons.some((cron) => typeof cron === "string" && cron.trim().length > 0);
 	const main = typeof parsed.main === "string" && parsed.main.trim() ? parsed.main : null;
 	if (!main) return [{
@@ -1149,7 +1154,7 @@ async function checkSchedulerWiringAtPath(cwd, configPath) {
 	try {
 		hasScheduledHandler = workerExportsScheduledMaintenance(await readFile(workerPath, "utf8"));
 	} catch (error) {
-		if ((isRecord(error) && typeof error.code === "string" ? error.code : null) !== "ENOENT") return [{
+		if ((isRecord$2(error) && typeof error.code === "string" ? error.code : null) !== "ENOENT") return [{
 			name: "scheduler handler",
 			status: "fail",
 			message: `could not read Worker entry ${workerPath}: ${error instanceof Error ? error.message : "unknown I/O error"} — check the file path and permissions`
@@ -2599,6 +2604,522 @@ const menuCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/migrations/config-loader.ts
+const ASTRO_CONFIG_FILENAMES = [
+	"astro.config.mjs",
+	"astro.config.js",
+	"astro.config.ts",
+	"astro.config.mts"
+];
+var MigrationConfigLoaderError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "MigrationConfigLoaderError";
+	}
+};
+async function isAccessible(path) {
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findAstroConfigFile(projectRoot, configFile) {
+	const root = resolve(projectRoot);
+	if (configFile) {
+		const explicitPath = isAbsolute(configFile) ? configFile : resolve(root, configFile);
+		if (await isAccessible(explicitPath)) return explicitPath;
+		throw new MigrationConfigLoaderError(`Astro config file not found: ${explicitPath}`);
+	}
+	for (const filename of ASTRO_CONFIG_FILENAMES) {
+		const candidate = resolve(root, filename);
+		if (await isAccessible(candidate)) return candidate;
+	}
+	throw new MigrationConfigLoaderError(`No Astro config file found in ${root}`);
+}
+function projectRequire(projectRoot) {
+	return createRequire(resolve(projectRoot, "package.json"));
+}
+async function importModule(path) {
+	return import(pathToFileURL(path).href);
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+function moduleExport$1(module, name) {
+	if (!isRecord$1(module)) return void 0;
+	const direct = module[name];
+	if (direct !== void 0) return direct;
+	const defaultExport = module.default;
+	return isRecord$1(defaultExport) ? defaultExport[name] : void 0;
+}
+function isCoreMigrationIdentity(value) {
+	return isRecord$1(value) && typeof value.emdashVersion === "string" && Array.isArray(value.names) && value.names.every((name) => typeof name === "string") && typeof value.fingerprint === "string";
+}
+async function loadProjectConfig(projectRoot, configFile) {
+	let viteEntrypoint;
+	try {
+		viteEntrypoint = createRequire(projectRequire(projectRoot).resolve("astro")).resolve("vite");
+	} catch (error) {
+		throw new MigrationConfigLoaderError("Could not resolve Vite through the project's Astro installation", { cause: error });
+	}
+	const loadConfigFromFile = moduleExport$1(await importModule(viteEntrypoint), "loadConfigFromFile");
+	if (typeof loadConfigFromFile !== "function") throw new MigrationConfigLoaderError("The Vite installation used by project-local Astro does not export loadConfigFromFile");
+	const loaded = await Reflect.apply(loadConfigFromFile, void 0, [
+		{
+			command: "build",
+			mode: "production"
+		},
+		configFile,
+		projectRoot,
+		"silent"
+	]);
+	if (!isRecord$1(loaded) || !Object.hasOwn(loaded, "config")) throw new MigrationConfigLoaderError(`Vite could not load Astro config: ${configFile}`);
+	return loaded.config;
+}
+async function loadProjectIdentity(projectRoot) {
+	let identityEntrypoint;
+	try {
+		identityEntrypoint = projectRequire(projectRoot).resolve("emdash/migrations");
+	} catch (error) {
+		throw new MigrationConfigLoaderError("Could not resolve emdash/migrations from the project", { cause: error });
+	}
+	const getIdentity = moduleExport$1(await importModule(identityEntrypoint), "getCoreMigrationIdentity");
+	if (typeof getIdentity !== "function") throw new MigrationConfigLoaderError("The project-local emdash/migrations module does not export getCoreMigrationIdentity");
+	const identity = await Reflect.apply(getIdentity, void 0, []);
+	if (!isCoreMigrationIdentity(identity)) throw new MigrationConfigLoaderError("The project-local emdash/migrations module returned an invalid migration identity");
+	return identity;
+}
+const defaultDependencies$1 = {
+	findConfigFile: findAstroConfigFile,
+	loadConfig: loadProjectConfig,
+	loadIdentity: loadProjectIdentity
+};
+function asAstroConfig(value) {
+	if (typeof value !== "object" || value === null) throw new MigrationConfigLoaderError("Astro config must export an object");
+	return value;
+}
+async function buildMigrationManifestFromConfig(options, dependencies = defaultDependencies$1) {
+	const projectRoot = resolve(options.projectRoot);
+	const configFile = await dependencies.findConfigFile(projectRoot, options.configFile);
+	const config = asAstroConfig(await dependencies.loadConfig(projectRoot, configFile));
+	const matchingIntegrations = (Array.isArray(config.integrations) ? config.integrations : []).filter((integration) => getMigrationIntegrationMetadata(integration) !== void 0);
+	if (matchingIntegrations.length !== 1) throw new MigrationConfigLoaderError(`Expected exactly one EmDash integration with migration metadata (${String(MIGRATION_CONFIG_SYMBOL)}), found ${matchingIntegrations.length}`);
+	const metadata = getMigrationIntegrationMetadata(matchingIntegrations[0]);
+	if (!metadata?.database) throw new MigrationConfigLoaderError("The EmDash integration does not provide database migration metadata");
+	return buildMigrationManifest({
+		identity: await dependencies.loadIdentity(projectRoot),
+		i18n: normalizeAstroI18n(config.i18n),
+		database: metadata.database
+	});
+}
+
+//#endregion
+//#region src/cli/commands/migrate.ts
+const FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
+const SAFE_TARGET_KIND_PATTERN = /^[a-z][a-z0-9_-]*$/;
+const SAFE_MIGRATION_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const CREDENTIAL_URL_PATTERN = /:\/\/[^/\s]+@/;
+const CREDENTIAL_QUERY_PATTERN = /[?&](?:auth|credential|key|password|secret|signature|token)=/i;
+const MIGRATE_EXIT_CODES = Object.freeze({
+	success: 0,
+	error: 1,
+	pending: 2,
+	unknownApplied: 3,
+	confirmation: 4,
+	interrupted: 130
+});
+var MigrateCommandError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MigrateCommandError";
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function moduleExport(module, name) {
+	if (!isRecord(module)) return void 0;
+	const direct = Reflect.get(module, name);
+	if (direct !== void 0) return direct;
+	const defaultExport = Reflect.get(module, "default");
+	return isRecord(defaultExport) ? Reflect.get(defaultExport, name) : void 0;
+}
+async function importProjectModule(projectRoot, specifier) {
+	let resolvedEntrypoint;
+	try {
+		resolvedEntrypoint = createRequire(resolve(projectRoot, "package.json")).resolve(specifier);
+	} catch {
+		throw new MigrateCommandError(`Could not resolve ${specifier} from the project.`);
+	}
+	return import(pathToFileURL(resolvedEntrypoint).href);
+}
+function validateIdentity(value) {
+	if (!isRecord(value) || typeof value.emdashVersion !== "string" || !Array.isArray(value.names) || !value.names.every((name) => typeof name === "string") || typeof value.fingerprint !== "string" || !FINGERPRINT_PATTERN.test(value.fingerprint)) throw new MigrateCommandError("The project-local emdash/migrations module returned an invalid migration identity.");
+	return {
+		emdashVersion: value.emdashVersion,
+		names: [...value.names],
+		fingerprint: value.fingerprint
+	};
+}
+async function loadProjectMigrationIdentity(projectRoot) {
+	const getIdentity = moduleExport(await importProjectModule(projectRoot, "emdash/migrations"), "getCoreMigrationIdentity");
+	if (typeof getIdentity !== "function") throw new MigrateCommandError("The project-local emdash/migrations module does not export getCoreMigrationIdentity.");
+	return validateIdentity(await Reflect.apply(getIdentity, void 0, []));
+}
+async function loadProjectMigrationExecutor(projectRoot, entrypoint) {
+	const factory = moduleExport(await importProjectModule(projectRoot, entrypoint), "createMigrationExecutor");
+	if (typeof factory !== "function") throw new MigrateCommandError(`The project-local ${entrypoint} module does not export createMigrationExecutor.`);
+	return (manifestConfig, context) => Reflect.apply(factory, void 0, [manifestConfig, context]);
+}
+async function findProjectRoot(start) {
+	let current = resolve(start);
+	const filesystemRoot = parse(current).root;
+	for (;;) {
+		try {
+			await readFile(resolve(current, "package.json"), "utf8");
+			return current;
+		} catch (error) {
+			if (isRecord(error) && error.code !== "ENOENT" && error.code !== "ENOTDIR") throw new MigrateCommandError("Could not read the project package.json.");
+		}
+		if (current === filesystemRoot) break;
+		current = dirname(current);
+	}
+	throw new MigrateCommandError("Could not find a project root containing package.json.");
+}
+async function readMigrationManifestFile(path, isDefault) {
+	let source;
+	try {
+		source = await readFile(path, "utf8");
+	} catch (error) {
+		if (isDefault && isRecord(error) && (error.code === "ENOENT" || error.code === "ENOTDIR")) throw new MigrateCommandError(`No migration manifest found at ${path}. Build the project or use --from-config.`);
+		throw new MigrateCommandError(`Could not read migration manifest: ${path}`);
+	}
+	try {
+		return JSON.parse(source);
+	} catch {
+		throw new MigrateCommandError(`Migration manifest is not valid JSON: ${path}`);
+	}
+}
+async function confirmWithReadline(message) {
+	const prompt = createInterface({
+		input: process.stdin,
+		output: process.stderr
+	});
+	try {
+		const answer = await prompt.question(`${message} [y/N] `);
+		return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+	} finally {
+		prompt.close();
+	}
+}
+function onProcessSignal(signal, handler) {
+	const listener = () => {
+		handler().finally(() => process.exit(MIGRATE_EXIT_CODES.interrupted));
+	};
+	process.once(signal, listener);
+	return () => process.removeListener(signal, listener);
+}
+const defaultDependencies = {
+	cwd: process.cwd(),
+	env: process.env,
+	interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+	findProjectRoot,
+	readManifest: readMigrationManifestFile,
+	buildManifestFromConfig: (projectRoot, configFile) => buildMigrationManifestFromConfig({
+		projectRoot,
+		configFile
+	}),
+	loadProjectIdentity: loadProjectMigrationIdentity,
+	loadProjectExecutor: loadProjectMigrationExecutor,
+	confirm: confirmWithReadline,
+	writeStdout: (value) => process.stdout.write(`${value}\n`),
+	writeStderr: (value) => process.stderr.write(`${value}\n`),
+	onSignal: onProcessSignal,
+	cleanupTimeoutMs: 2e3
+};
+function validateOptions(options) {
+	if (options.manifest && options.fromConfig) throw new MigrateCommandError("--manifest and --from-config cannot be used together.");
+	if (options.config && !options.fromConfig) throw new MigrateCommandError("--config requires --from-config.");
+	if (options.check && options.status) throw new MigrateCommandError("--check and --status cannot be used together.");
+	if (options.expectedTargetFingerprint && !FINGERPRINT_PATTERN.test(options.expectedTargetFingerprint)) throw new MigrateCommandError("--expected-target-fingerprint must be a SHA-256 fingerprint.");
+}
+function hasControlCharacter(value) {
+	for (let index = 0; index < value.length; index++) {
+		const code = value.charCodeAt(index);
+		if (code <= 31 || code === 127) return true;
+	}
+	return false;
+}
+function targetField(value, name) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || value.length === 0 || hasControlCharacter(value) || CREDENTIAL_URL_PATTERN.test(value) || CREDENTIAL_QUERY_PATTERN.test(value)) throw new MigrateCommandError(`The executor returned an unsafe migration target ${name}.`);
+	return value;
+}
+function immutableTarget(value) {
+	if (!isRecord(value)) throw new MigrateCommandError("The executor returned an invalid migration target.");
+	const kind = targetField(value.kind, "kind");
+	const label = targetField(value.label, "label");
+	const fingerprint = targetField(value.fingerprint, "fingerprint");
+	if (!kind || !SAFE_TARGET_KIND_PATTERN.test(kind) || !label || !fingerprint || !FINGERPRINT_PATTERN.test(fingerprint)) throw new MigrateCommandError("The executor returned an invalid migration target.");
+	const target = {
+		kind,
+		label,
+		fingerprint
+	};
+	const accountId = targetField(value.accountId, "accountId");
+	const environment = targetField(value.environment, "environment");
+	const resourceId = targetField(value.resourceId, "resourceId");
+	if (accountId) target.accountId = accountId;
+	if (environment) target.environment = environment;
+	if (resourceId) target.resourceId = resourceId;
+	return Object.freeze(target);
+}
+function safeMigrationNames(value, field) {
+	if (!Array.isArray(value) || !value.every((name) => typeof name === "string" && SAFE_MIGRATION_NAME_PATTERN.test(name))) throw new MigrateCommandError(`The migration executor returned an invalid ${field} report.`);
+	return [...value];
+}
+function safeReport(value, target) {
+	if (!isRecord(value)) throw new MigrateCommandError("The migration executor returned an invalid report.");
+	const reportTarget = immutableTarget(value.target);
+	if (reportTarget.kind !== target.kind || reportTarget.label !== target.label || reportTarget.fingerprint !== target.fingerprint || reportTarget.accountId !== target.accountId || reportTarget.environment !== target.environment || reportTarget.resourceId !== target.resourceId) throw new MigrateCommandError("The migration executor report target does not match the confirmed target.");
+	return {
+		target: { ...reportTarget },
+		knownApplied: safeMigrationNames(value.knownApplied, "knownApplied"),
+		pending: safeMigrationNames(value.pending, "pending"),
+		unknownApplied: safeMigrationNames(value.unknownApplied, "unknownApplied"),
+		executed: safeMigrationNames(value.executed, "executed")
+	};
+}
+function printTarget(target, write) {
+	write(`Migration target: ${target.kind} ${target.label}`);
+	if (target.accountId) write(`Account: ${target.accountId}`);
+	if (target.environment) write(`Environment: ${target.environment}`);
+	if (target.resourceId) write(`Resource: ${target.resourceId}`);
+	write(`Target fingerprint: ${target.fingerprint}`);
+}
+function printNameSet(label, names, write) {
+	write(`${label}: ${names.length === 0 ? "none" : names.join(", ")}`);
+}
+function printHumanReport(report, write) {
+	printNameSet("Known applied", report.knownApplied, write);
+	printNameSet("Pending", report.pending, write);
+	printNameSet("Unknown applied", report.unknownApplied, write);
+	printNameSet("Executed", report.executed, write);
+}
+function reportExitCode(options, report) {
+	if (!options.check) return MIGRATE_EXIT_CODES.success;
+	if (report.unknownApplied.length > 0) return MIGRATE_EXIT_CODES.unknownApplied;
+	if (report.pending.length > 0) return MIGRATE_EXIT_CODES.pending;
+	return MIGRATE_EXIT_CODES.success;
+}
+function createOverrides(options) {
+	return {
+		database: options.database,
+		databaseUrlEnv: options.databaseUrlEnv,
+		d1: options.d1,
+		accountId: options.accountId,
+		wranglerConfig: options.wranglerConfig,
+		wranglerEnv: options.wranglerEnv
+	};
+}
+function bounded(operation, timeoutMs) {
+	let timer;
+	const timeout = new Promise((resolveTimeout) => {
+		timer = setTimeout(resolveTimeout, timeoutMs, "timeout");
+	});
+	const completion = operation.then(() => "complete", () => "failed");
+	return Promise.race([completion, timeout]).finally(() => clearTimeout(timer));
+}
+async function loadManifest(options, projectRoot, dependencies) {
+	if (options.fromConfig) {
+		dependencies.writeStderr(`Using trusted evaluated Astro configuration${options.config ? `: ${options.config}` : "."}`);
+		return dependencies.buildManifestFromConfig(projectRoot, options.config);
+	}
+	const isDefault = !options.manifest;
+	const path = options.manifest ? isAbsolute(options.manifest) ? options.manifest : resolve(projectRoot, options.manifest) : resolve(projectRoot, ".emdash/migrations.json");
+	return dependencies.readManifest(path, isDefault);
+}
+function redactExecutorMessage(message, env) {
+	let redacted = message.replace(/[A-Za-z][A-Za-z0-9+.-]*:\/\/\S+/g, "[REDACTED_URL]").replace(/\b(auth|credential|key|password|secret|signature|token)\s*[=:]\s*\S+/gi, "$1=[REDACTED]");
+	for (const value of Object.values(env)) if (value && value.length >= 4) redacted = redacted.replaceAll(value, "[REDACTED]");
+	return redacted.replaceAll(/[\r\n\t]/g, " ").slice(0, 1e3);
+}
+function safeCommandMessage(error, env) {
+	if (error instanceof MigrateCommandError || error instanceof MigrationManifestValidationError) return error.message;
+	if (error instanceof Error && error.message) return redactExecutorMessage(error.message, env);
+	return "Migration command failed. Check the project configuration, target, and credentials.";
+}
+async function runMigrateCommand(options, dependencies = defaultDependencies) {
+	let executor;
+	let disposePromise;
+	let interrupted = false;
+	let primaryFailure = false;
+	let exitCode = MIGRATE_EXIT_CODES.error;
+	const interruptedResult = Symbol("interrupted");
+	let resolveInterruption;
+	const interruption = new Promise((resolveInterrupted) => {
+		resolveInterruption = () => resolveInterrupted(interruptedResult);
+	});
+	const dispose = () => {
+		disposePromise ??= executor?.dispose?.() ?? Promise.resolve();
+		return disposePromise;
+	};
+	const removeSignalHandlers = [];
+	const execute = async () => {
+		try {
+			validateOptions(options);
+			const projectRoot = await dependencies.findProjectRoot(dependencies.cwd);
+			const manifest = await validateMigrationManifest(await loadManifest(options, projectRoot, dependencies), await dependencies.loadProjectIdentity(projectRoot));
+			executor = await (await dependencies.loadProjectExecutor(projectRoot, manifest.database.executorEntrypoint))(manifest.database.executorConfig, {
+				projectRoot,
+				env: dependencies.env,
+				overrides: createOverrides(options)
+			});
+			const target = immutableTarget(executor.target);
+			printTarget(target, dependencies.writeStderr);
+			const onSignal = async () => {
+				interrupted = true;
+				await bounded(dispose(), dependencies.cleanupTimeoutMs);
+				resolveInterruption?.();
+			};
+			removeSignalHandlers.push(dependencies.onSignal("SIGINT", onSignal), dependencies.onSignal("SIGTERM", onSignal));
+			const applying = !options.check && !options.status;
+			if (applying && target.kind === "d1") dependencies.writeStderr("Warning: D1 migration jobs must be serialized externally by Cloudflare account and database UUID; this command does not coordinate concurrent applies.");
+			if (applying) {
+				if (options.expectedTargetFingerprint) {
+					if (options.expectedTargetFingerprint !== target.fingerprint) {
+						dependencies.writeStderr("Expected target fingerprint does not match the target.");
+						exitCode = MIGRATE_EXIT_CODES.confirmation;
+						return exitCode;
+					}
+				} else if (!dependencies.interactive || options.json) {
+					dependencies.writeStderr("Noninteractive apply requires --expected-target-fingerprint with the displayed fingerprint.");
+					exitCode = MIGRATE_EXIT_CODES.confirmation;
+					return exitCode;
+				} else if (!await dependencies.confirm(`Apply EmDash migrations to ${target.label}?`)) {
+					dependencies.writeStderr("Migration cancelled.");
+					exitCode = MIGRATE_EXIT_CODES.confirmation;
+					return exitCode;
+				}
+			}
+			const rawReport = await Promise.race([executor.execute({
+				action: applying ? "apply" : "check",
+				i18n: manifest.i18n,
+				artifact: {
+					emdashVersion: manifest.emdashVersion,
+					migrationSetFingerprint: manifest.migrationSet.fingerprint
+				}
+			}), interruption]);
+			if (rawReport === interruptedResult || interrupted) {
+				exitCode = MIGRATE_EXIT_CODES.interrupted;
+				return exitCode;
+			}
+			const report = safeReport(rawReport, target);
+			if (options.json) dependencies.writeStdout(JSON.stringify(report));
+			else printHumanReport(report, dependencies.writeStdout);
+			exitCode = reportExitCode(options, report);
+			return exitCode;
+		} catch (error) {
+			primaryFailure = true;
+			dependencies.writeStderr(safeCommandMessage(error, dependencies.env));
+			exitCode = interrupted ? MIGRATE_EXIT_CODES.interrupted : MIGRATE_EXIT_CODES.error;
+			return exitCode;
+		}
+	};
+	try {
+		exitCode = await execute();
+	} finally {
+		for (const remove of removeSignalHandlers) remove();
+		if (executor) {
+			if (await bounded(dispose(), dependencies.cleanupTimeoutMs) !== "complete" && !primaryFailure && !interrupted) {
+				dependencies.writeStderr("Migration executor cleanup failed.");
+				exitCode = MIGRATE_EXIT_CODES.error;
+			}
+		}
+	}
+	return exitCode;
+}
+const migrateCommand = defineCommand({
+	meta: {
+		name: "migrate",
+		description: "Check or apply deployment-managed EmDash migrations"
+	},
+	args: {
+		manifest: {
+			type: "string",
+			description: "Migration manifest path"
+		},
+		"from-config": {
+			type: "boolean",
+			description: "Build the manifest from Astro config"
+		},
+		config: {
+			type: "string",
+			description: "Astro config path (requires --from-config)"
+		},
+		check: {
+			type: "boolean",
+			description: "Check for pending or unknown migrations"
+		},
+		status: {
+			type: "boolean",
+			description: "Report all migration status sets"
+		},
+		json: {
+			type: "boolean",
+			description: "Print the stable JSON report"
+		},
+		"expected-target-fingerprint": {
+			type: "string",
+			description: "Required target fingerprint for noninteractive apply"
+		},
+		database: {
+			type: "string",
+			description: "Override the SQLite database path"
+		},
+		"database-url-env": {
+			type: "string",
+			description: "Override the database URL environment-variable name"
+		},
+		d1: {
+			type: "string",
+			description: "Override the D1 database UUID or name"
+		},
+		"account-id": {
+			type: "string",
+			description: "Override the Cloudflare account ID"
+		},
+		"wrangler-config": {
+			type: "string",
+			description: "Override the Wrangler config path"
+		},
+		"wrangler-env": {
+			type: "string",
+			description: "Override the Wrangler environment"
+		}
+	},
+	async run({ args }) {
+		process.exitCode = await runMigrateCommand({
+			manifest: args.manifest,
+			fromConfig: args["from-config"],
+			config: args.config,
+			check: args.check,
+			status: args.status,
+			json: args.json,
+			expectedTargetFingerprint: args["expected-target-fingerprint"],
+			database: args.database,
+			databaseUrlEnv: args["database-url-env"],
+			d1: args.d1,
+			accountId: args["account-id"],
+			wranglerConfig: args["wrangler-config"],
+			wranglerEnv: args["wrangler-env"]
+		});
+	}
+});
+
 //#endregion
 //#region src/cli/commands/plugin-init.ts
 /**
@@ -3141,7 +3662,7 @@ const publishCommand = defineCommand({
 			const pluginDir = resolve(args.dir);
 			try {
 				const { runCommand } = await import("citty");
-				const { bundleCommand } = await import("../bundle-CBEXrBnb.mjs").then((n) => n.n);
+				const { bundleCommand } = await import("../bundle-vn56sLos.mjs").then((n) => n.n);
 				await runCommand(bundleCommand, { rawArgs: ["--dir", pluginDir] });
 			} catch {
 				consola.error("Build failed");
@@ -4125,28 +4646,6 @@ const typesCommand = defineCommand({
 
 //#endregion
 //#region src/cli/index.ts
-/**
-* EmDash CLI
-*
-* Built with citty + clack (same stack as Nuxt CLI)
-*
-* Commands:
-* - init: Bootstrap database from template config, or interactive setup
-* - types: Generate TypeScript types from schema
-* - dev: [DEPRECATED, hidden] Run dev server with a local SQLite database
-* - seed: Apply a seed file to the database
-* - export-seed: Export database schema and content as a seed file
-* - secrets: Generate and inspect EmDash secrets (encryption keys, etc.)
-* - auth: [DEPRECATED] Generate auth secret (use `secrets` instead)
-* - login/logout/whoami: Session management
-* - content: Create, read, update, delete content
-* - schema: Manage collections and fields
-* - media: Upload and manage media
-* - search: Full-text search
-* - taxonomy: Manage taxonomies and terms
-* - menu: Manage navigation menus
-* - plugin: Plugin management (init, bundle, validate, publish, login, logout)
-*/
 runMain(defineCommand({
 	meta: {
 		name: "emdash",
@@ -4159,6 +4658,7 @@ runMain(defineCommand({
 		dev: devCommand,
 		doctor: doctorCommand,
 		seed: seedCommand,
+		migrate: migrateCommand,
 		"export-seed": exportSeedCommand,
 		secrets: secretsCommand,
 		auth: authCommand,