void 0.10.13 → 0.20.1

package/dist/{env-validation-Dea3v3ej.mjs → env-validation-ENpMy6Ez.mjs}

@@ -1,10 +1,9 @@
-import { n as __exportAll } from "./rolldown-runtime-DJK8HYOj.mjs";
-import { a as join, c as resolve, n as dirname } from "./dist-DaKKDf8D.mjs";
+import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
+import { l as resolve, n as dirname, o as join } from "./dist-BrsS7cai.mjs";
 import { i as voidWarn } from "./log-ChfPKsVd.mjs";
-import { c as mergeAndExpand, l as parseDotenvFile, o as resolveWranglerArgv } from "./preset-BjyR3lzz.mjs";
-import { t as findEnvFile } from "./env-types-QBj-ndax.mjs";
-import { getSecretOverride } from "./runtime/env-helpers.mjs";
-import { t as isLikelySecretKey } from "./env-mask-Dd47NbR6.mjs";
+import { t as findEnvFile } from "./env-types-BNPhro-M.mjs";
+import { a as loadLocalEnv, i as isClientEnvKey, r as findLegacyEnvFiles } from "./env-D4Emu-M_.mjs";
+import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
@@ -77,7 +76,7 @@ async function loadUserEnvFile(envFile) {
 * Shared env-schema validation for CLI commands.
 *
 * Loads the user's `env.ts` (which calls `defineEnv` as a side effect),
-* collects sources of env values (`.env*` files, remote secrets), and
+* validates the local `.env` or remote production-secret state, and
 * validates each declared key against the registered schema.
 *
 * Used by both `void deploy` (hard error on missing prod env) and
@@ -88,7 +87,6 @@ var env_validation_exports = /* @__PURE__ */ __exportAll({
 	SelfHostFirstDeployError: () => SelfHostFirstDeployError,
 	SelfHostSchemaError: () => SelfHostSchemaError,
 	SelfHostSecretListError: () => SelfHostSecretListError,
-	collectPlaintextVarWarningsFromVars: () => collectPlaintextVarWarningsFromVars,
 	computeInvalidEmittedKeys: () => computeInvalidEmittedKeys,
 	createDefaultSecretListRunner: () => createDefaultSecretListRunner,
 	deriveSelfHostEnvContextFromVars: () => deriveSelfHostEnvContextFromVars,
@@ -96,23 +94,29 @@ var env_validation_exports = /* @__PURE__ */ __exportAll({
 	dischargeSelfHostEnvContext: () => dischargeSelfHostEnvContext,
 	fetchRemoteSecretNames: () => fetchRemoteSecretNames,
 	formatEnvReport: () => formatEnvReport,
-	getDeployEnvDefaults: () => getDeployEnvDefaults,
+	listSelfHostSecretNames: () => listSelfHostSecretNames,
 	readEmittedWorkerVars: () => readEmittedWorkerVars,
 	secretListEnv: () => secretListEnv,
 	selfHostSchemaFailureMessage: () => selfHostSchemaFailureMessage,
-	validateProdEnv: () => validateProdEnv
+	validateProdEnv: () => validateProdEnv,
+	validateSecretValues: () => validateSecretValues
 });
 /**
-* After the user's env.ts has been imported (via `validateProdEnv` or
-* `loadSchema`), read the registered schema's `.default(value)` entries.
-* Returns `{}` if no schema was registered.
+* Validate plaintext while it is still available to `void secret put/sync`.
+* Existing remote values remain unreadable and are validated again at worker boot.
 */
-async function getDeployEnvDefaults(root) {
+async function validateSecretValues(root, entries) {
 	const envFile = findEnvFile(root);
-	if (!envFile) return {};
-	const mod = await loadSchema(envFile);
-	if (!mod) return {};
-	return mod._getSchemaDefaults();
+	if (!envFile) throw new Error("secret: env.ts is required before setting production values.");
+	const schema = (await loadSchema(envFile))?._getRegisteredSchema();
+	if (!schema) throw new Error("secret: env.ts did not register a schema with defineEnv().");
+	for (const { name, value } of entries) {
+		if (isClientEnvKey(name)) throw new Error(`secret: ${name} is client-exposed. Set it in the build shell or give it a schema default.`);
+		const validator = schema[name];
+		if (!validator) throw new Error(`secret: ${name} is not declared in env.ts.`);
+		const result = validator["~standard"].validate(value);
+		if ((result instanceof Promise ? await result : result).issues) throw new Error(`secret: ${name} failed env.ts validation.`);
+	}
 }
 /** Load the registered schema by importing the user's env.ts. */
 async function loadSchema(envFile) {
@@ -130,11 +134,13 @@ function emptyReport() {
 	};
 }
 /**
-* Validate the user's env schema against the union of .env files and
-* remote secret names. Remote secrets are treated as "present" (we can't
-* fetch their values), which is sufficient for the missing-key check.
+* Validate local development against `.env` + the shell, or production
+* against the build shell + remote secret names. `.env` is never a
+* production source.
 */
 async function validateProdEnv(root, options) {
+	const legacyFiles = findLegacyEnvFiles(root);
+	if (legacyFiles.length > 0) throw new Error(`env: only .env is supported for local development. Remove ${legacyFiles.join(", ")} and follow the env migration guide.`);
 	const envFile = findEnvFile(root);
 	if (!envFile) return {
 		hasSchema: false,
@@ -145,16 +151,16 @@ async function validateProdEnv(root, options) {
 		hasSchema: false,
 		report: emptyReport()
 	};
-	const merged = mergeAndExpand((options.productionOnly ? [".env", ".env.production"] : [
-		".env",
-		".env.local",
-		".env.production",
-		".env.production.local"
-	]).map((file) => parseDotenvFile(join(root, file), { expand: false })), { onWarn: (msg) => voidWarn(msg) });
+	const local = options.productionOnly ? {} : loadLocalEnv(root, { onWarn: (message) => voidWarn(message) });
+	const shell = options.productionOnly ? Object.fromEntries(Object.entries(process.env).filter(([key]) => isClientEnvKey(key))) : process.env;
+	const merged = {
+		...local,
+		...shell
+	};
 	const report = await mod.validateAllEnv(merged);
 	const remoteSet = new Set(options.remoteSecrets ?? []);
 	if (remoteSet.size > 0 && report.missing.length > 0) {
-		report.missing = report.missing.filter((key) => !remoteSet.has(key));
+		report.missing = report.missing.filter((key) => isClientEnvKey(key) || !remoteSet.has(key));
 		if (report.missing.length === 0 && report.invalid.length === 0) report.valid = true;
 	}
 	return {
@@ -185,29 +191,6 @@ async function fetchRemoteSecretNames(client, projectId) {
 	}
 }
 /**
-* A `scheme://user:password@host…` connection URL — the shape that carries a
-* live credential in a key nothing in the NAME heuristic would catch. The
-* motivating case is `DATABASE_URL`: `SECRET_KEY_RE` has no `URL`/`DATABASE`
-* branch, and the shared `isLikelySecretValue` cannot help either — its
-* `HIGH_ENTROPY_RE` character class excludes `@`, so a connection URL never
-* matches it. Both halves of the userinfo must be non-empty, so a bare
-* `postgres://host/db` or a password-less `https://user@host` is NOT flagged.
-*
-* Deliberately local to the DEPLOY-side warning rather than added to
-* `shared/env-mask.ts`: that module is also the runtime/managed redaction
-* heuristic, and widening it would change masking behaviour well outside this
-* warning.
-*/
-const CREDENTIAL_URL_VALUE_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/;
-/**
-* `true` when a var's VALUE is a connection URL carrying inline credentials.
-* Inspecting the value is safe here: only the KEY name ever leaves
-* {@link collectPlaintextVarWarningsFromVars}.
-*/
-function isCredentialBearingUrlValue(value) {
-	return typeof value === "string" && CREDENTIAL_URL_VALUE_RE.test(value);
-}
-/**
 * The required-key set, derived independently of how any validator treats
 * the empty string. A key is required iff its validator REJECTS the ABSENT
 * value (probe with `undefined`) — the SAME notion of "required" the managed
@@ -259,7 +242,7 @@ var SelfHostSecretListError = class extends Error {
 /**
 * FIRST-DEPLOY specialization of {@link SelfHostSecretListError}: the remote
 * secret list could not be fetched because the worker has NOT been deployed
-* yet. wrangler 4.107's `secret list` catches the API worker-not-found error
+* yet. wrangler 4.131's `secret list` catches the API worker-not-found error
 * (codes 10007 / 10090 — `WORKER_NOT_FOUND` / `WORKER_LEGACY_ENVIRONMENT_NOT_FOUND`,
 * per `isWorkerNotFoundError` in wrangler-dist/cli.js) and rethrows a `UserError`
 * ("… not found. If this is a new Worker, run `wrangler deploy` first to create
@@ -283,8 +266,8 @@ var SelfHostFirstDeployError = class extends SelfHostSecretListError {
 };
 /**
 * The env schema is not satisfied for a self-host production deploy: required
-* keys are missing (not in `.env`/`.env.production` and not present as remote
-* worker secrets), local values are invalid, or an EMPTY local assignment would
+* keys are missing from remote worker secrets, values are invalid, or an EMPTY
+* plaintext assignment would
 * shadow a remote secret. The message and the attached `report` carry the
 * offending key NAMES plus stable, values-free reason codes only — never raw
 * input, never resolved values — so nothing on this path can echo a secret
@@ -365,22 +348,20 @@ async function deriveSelfHostSchemaFacts(root) {
 	const envFile = findEnvFile(root);
 	if (envFile == null) return {
 		hasSchema: false,
-		requiredKeys: [],
-		secretKeys: []
+		serverKeys: [],
+		requiredKeys: []
 	};
 	const mod = await withSchemaBoundary("schema-load-failed", () => loadSchema(envFile));
 	if (!mod) return {
 		hasSchema: false,
-		requiredKeys: [],
-		secretKeys: []
+		serverKeys: [],
+		requiredKeys: []
 	};
 	const schema = mod._getRegisteredSchema() ?? {};
-	const requiredKeys = await withSchemaBoundary("schema-validation-error", () => requiredSchemaKeys(schema));
-	const secretKeys = Object.keys(schema).filter((key) => getSecretOverride(schema[key]) === "secret");
 	return {
 		hasSchema: true,
-		requiredKeys: [...requiredKeys],
-		secretKeys
+		serverKeys: Object.keys(schema).filter((key) => !isClientEnvKey(key)),
+		requiredKeys: [...await withSchemaBoundary("schema-validation-error", () => requiredSchemaKeys(schema))].filter((key) => !isClientEnvKey(key))
 	};
 }
 /**
@@ -515,50 +496,6 @@ async function computeInvalidEmittedKeys(root, emittedVars) {
 	for (const key of report.missing) if (Object.hasOwn(emittedVars, key)) invalid.add(key);
 	return Array.from(invalid).sort((a, b) => a.localeCompare(b));
 }
-/**
-* Classify the secret-looking keys among the REAL worker `vars` the build baked
-* into `dist/ssr/wrangler.json` (ground truth). PURE: for each emitted var key, a
-* `.secret()`-flagged key ({@link SelfHostSchemaFacts.secretKeys}) is
-* `schema-secret`; otherwise the shared {@link isLikelySecretKey} name heuristic
-* applies (so a secret-looking key ships plaintext regardless of any schema, and
-* heuristic classification still works with no env.ts at all); failing both, a
-* VALUE shaped like a credential-bearing connection URL
-* ({@link isCredentialBearingUrlValue}) flags the key as `value-shape`, catching
-* the `DATABASE_URL`-class leak no name heuristic sees.
-*
-* KEYS ONLY leave here — a value may be INSPECTED to classify it, but is never
-* copied into the result, so no caller can format a value into a log.
-*/
-function collectPlaintextVarWarningsFromVars(emittedVars, secretFlaggedKeys) {
-	const flagged = new Set(secretFlaggedKeys);
-	const keys = Object.keys(emittedVars);
-	const secretKeys = [];
-	for (const key of keys) {
-		if (flagged.has(key)) {
-			secretKeys.push({
-				key,
-				reason: "schema-secret"
-			});
-			continue;
-		}
-		if (isLikelySecretKey(key)) {
-			secretKeys.push({
-				key,
-				reason: "heuristic"
-			});
-			continue;
-		}
-		if (isCredentialBearingUrlValue(emittedVars[key])) secretKeys.push({
-			key,
-			reason: "value-shape"
-		});
-	}
-	secretKeys.sort((a, b) => a.key.localeCompare(b.key));
-	return {
-		secretKeys,
-		totalVarKeys: keys.length
-	};
-}
 /** Build a values-free invalid {@link EnvValidationReport} from key names only. */
 function invalidEnvReport(missing, invalidKeys) {
 	return {
@@ -599,12 +536,7 @@ async function dischargeSelfHostEnvContext(context, options) {
 			remoteSecretNames: null
 		};
 	}
-	reconcileSelfHostWorkerName(options.configPath, options.workerName);
-	const effectiveAccountId = reconcileSelfHostAccount(options.configPath, options.accountId);
-	const remoteSecretNames = await fetchSelfHostSecretNames(options.runWrangler ?? createDefaultSecretListRunner(options.root, {
-		accountId: effectiveAccountId,
-		timeoutMs: options.timeoutMs
-	}), options.configPath, context.absentRequired);
+	const remoteSecretNames = await listSelfHostSecretNames(options, context.absentRequired);
 	const remoteSet = new Set(remoteSecretNames);
 	const stillMissing = context.absentRequired.filter((key) => !remoteSet.has(key));
 	if (stillMissing.length > 0 || invalidKeys.length > 0) throw selfHostEnvError(invalidEnvReport(stillMissing, invalidKeys));
@@ -616,7 +548,7 @@ async function dischargeSelfHostEnvContext(context, options) {
 /**
 * Read the pinned config's top-level `account_id` and reconcile it with
 * the caller's requested account, mirroring the provisioner's account gate
-* (provision.ts `provisionCloudflareResourcesLocked`). wrangler 4.107 gives the
+* (provision.ts `provisionCloudflareResourcesLocked`). wrangler 4.131 gives the
 * config's `account_id` PRECEDENCE over `CLOUDFLARE_ACCOUNT_ID`, so a real
 * config-vs-requested mismatch is a fail-closed error (thrown BEFORE any spawn).
 * Returns the ONE effective account to pin (config wins, else requested), or
@@ -731,7 +663,7 @@ function selfHostEnvError(report) {
 		lines.push("Invalid env vars:");
 		for (const key of invalidKeys) lines.push(`  • ${key} (${SELF_HOST_INVALID_REASON})`);
 	}
-	if (missing.length > 0) lines.push("", "Set each missing production secret with `wrangler secret put <NAME>`, or add a value to .env / .env.production.");
+	if (missing.length > 0) lines.push("", "Set each missing production secret with `void secret put <NAME>`.");
 	const safeReport = {
 		valid: report.valid,
 		missing: report.missing,
@@ -759,7 +691,7 @@ function describeVarSource(source) {
 * The hard error for a REQUIRED key set to an EMPTY value (`FOO=""`) in
 * the effective build map. Values-free (key names + source KIND/filename only),
 * thrown ALWAYS — independent of whether the key exists as a remote secret. The
-* build bakes the empty string into plaintext `vars`, and wrangler 4.107 gives a
+* build bakes the empty string into plaintext `vars`, and wrangler 4.131 gives a
 * config var precedence over a same-named remote secret (`checkRemoteSecretsOverride`
 * in wrangler-dist/cli.js warns "… will replace these remote secrets with the
 * configuration values"), so shipping this would ship an empty value for a
@@ -807,13 +739,11 @@ function firstDeployMessage(missingKeys) {
 		...sorted.map((key) => `  • ${key}`),
 		"",
 		"Bootstrap them on the draft Worker before deploying:",
-		...names.map((key) => `  wrangler secret put ${key}`),
-		"",
-		"or add a value to .env / .env.production, then run the deploy again."
+		...names.map((key) => `  void secret put ${key}`)
 	].join("\n");
 }
 /**
-* The exact `wrangler secret list` argv. Verified against the wrangler 4.107.0
+* The exact `wrangler secret list` argv. Verified against the wrangler 4.131.0
 * bundle (`wrangler-dist/cli.js`, `secretListCommand`):
 *   - `secret list` accepts `--format` with choices `json`/`pretty`; `json` is
 *     the default AND suppresses the banner (`printBanner` is format==='pretty'),
@@ -840,7 +770,7 @@ function secretListArgs(configPath) {
 	];
 }
 /**
-* wrangler 4.107's `secret list` worker-not-found signal. When the worker has
+* wrangler 4.131's `secret list` worker-not-found signal. When the worker has
 * never been deployed, `fetchSecrets` throws the API worker-not-found error and
 * `secretListCommand.handler` — ONLY when `isWorkerNotFoundError(e)` is true
 * (`e.code === 10007` WORKER_NOT_FOUND or `10090`
@@ -879,7 +809,7 @@ function secretListFailureMessage(reason, detail) {
 	switch (reason) {
 		case "spawn-error": return `${base} (reason: spawn-error) — the wrangler process could not be started. Check that wrangler is installed and the pinned config path is valid.`;
 		case "signal": return `${base} (reason: signal) — the process was terminated by ${detail.signal ?? "a signal"} before completing.`;
-		case "nonzero-exit": return `${base} (reason: nonzero-exit, status ${detail.exitCode ?? "unknown"}). Re-run \`wrangler secret list -c <config>\` to see wrangler’s own diagnostics.`;
+		case "nonzero-exit": return `${base} (reason: nonzero-exit, status ${detail.exitCode ?? "unknown"}). Run \`void secret list\` to retry through Void and see the Cloudflare diagnostics.`;
 		case "malformed-output": return `${base} (reason: malformed-output) — \`wrangler secret list --format=json\` did not return the expected JSON array of secret objects.`;
 	}
 }
@@ -936,6 +866,22 @@ async function fetchSelfHostSecretNames(run, configPath, missingKeys) {
 	return names;
 }
 /**
+* List one pinned self-host Worker's remote secret names. Reconciles the root
+* config's worker/account identity before spawning wrangler, then delegates to
+* the same strict, values-free parser used by the production env gate.
+*
+* Exported so deploy-owned secret provisioning can share the exact same
+* first-deploy and malformed-output classification without duplicating it.
+*/
+async function listSelfHostSecretNames(options, missingKeys = []) {
+	reconcileSelfHostWorkerName(options.configPath, options.workerName);
+	const effectiveAccountId = reconcileSelfHostAccount(options.configPath, options.accountId);
+	return fetchSelfHostSecretNames(options.runWrangler ?? createDefaultSecretListRunner(options.root, {
+		accountId: effectiveAccountId,
+		timeoutMs: options.timeoutMs
+	}), options.configPath, missingKeys);
+}
+/**
 * Hard timeout for one `wrangler secret list` invocation — same bound as the
 * provisioner's per-command timeout. A hung wrangler must never hang the
 * whole deploy preflight.
@@ -1066,4 +1012,4 @@ function secretListEnv(accountId, platform) {
 	return env;
 }
 //#endregion
-export { collectPlaintextVarWarningsFromVars as a, env_validation_exports as c, getDeployEnvDefaults as d, readEmittedWorkerVars as f, loadUserEnvFile as h, SelfHostSecretListError as i, fetchRemoteSecretNames as l, validateProdEnv as m, SelfHostFirstDeployError as n, deriveSelfHostEnvContextFromVars as o, selfHostSchemaFailureMessage as p, SelfHostSchemaError as r, dischargeSelfHostEnvContext as s, SelfHostEnvValidationError as t, formatEnvReport as u };
+export { deriveSelfHostEnvContextFromVars as a, fetchRemoteSecretNames as c, readEmittedWorkerVars as d, selfHostSchemaFailureMessage as f, loadUserEnvFile as h, SelfHostSecretListError as i, formatEnvReport as l, validateSecretValues as m, SelfHostFirstDeployError as n, dischargeSelfHostEnvContext as o, validateProdEnv as p, SelfHostSchemaError as r, env_validation_exports as s, SelfHostEnvValidationError as t, listSelfHostSecretNames as u };

package/dist/{gen-BzXf3Jh2.mjs → gen-DI2YwdBM.mjs}

@@ -1,11 +1,11 @@
-import { a as join, n as dirname, s as relative } from "./dist-DaKKDf8D.mjs";
-import { D as outro, T as log, a as cliTitle, j as isCancel, k as select, w as intro, x as cancel } from "./agents-CtgBYqld.mjs";
-import { n as readProjectPaths } from "./project-paths-BQd7OmIo.mjs";
-import { n as ensureProjectTsconfig } from "./project-tsconfig-B-QtXjLQ.mjs";
-import { c as getDatabaseDialect, f as readConfig } from "./config-qHGgPuWT.mjs";
-import { n as writeDrizzleConfig } from "./config-CutEMNGJ.mjs";
-import { c as collectMigrations, n as listDrizzleArtifacts, t as assertJournalCoherence, u as readJournal } from "./validate-Cw_RLeTj.mjs";
-import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DJn3SAHF.mjs";
+import { c as relative, n as dirname, o as join } from "./dist-BrsS7cai.mjs";
+import { C as cancel, D as log, E as intro, F as isCancel, j as select, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
+import { n as readProjectPaths } from "./project-paths-SK8nMHPp.mjs";
+import { c as getDatabaseDialect, f as readConfig } from "./config-BQFq7QvD.mjs";
+import { n as ensureProjectTsconfig } from "./project-tsconfig-Ql2XsSQp.mjs";
+import { c as collectMigrations, n as listDrizzleArtifacts, t as assertJournalCoherence, u as readJournal } from "./validate-tBBN_dXH.mjs";
+import { n as writeDrizzleConfig } from "./config-NOG_U1aK.mjs";
+import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DxSInkzL.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
@@ -121,6 +121,37 @@ function drizzleImportsForColumnsPg(columns) {
 	}
 	return [...types].sort();
 }
+function drizzleColumnDefMySql(col) {
+	const { name, type } = col;
+	switch (type) {
+		case "string":
+		case "text": return `  ${name}: text("${name}").notNull(),`;
+		case "integer": return `  ${name}: int("${name}").notNull(),`;
+		case "boolean": return `  ${name}: boolean("${name}").notNull().default(false),`;
+		case "real": return `  ${name}: double("${name}").notNull(),`;
+		default: return `  ${name}: text("${name}"),`;
+	}
+}
+function drizzleImportsForColumnsMySql(columns) {
+	const types = /* @__PURE__ */ new Set([
+		"int",
+		"text",
+		"timestamp"
+	]);
+	for (const col of columns) switch (col.type) {
+		case "integer":
+			types.add("int");
+			break;
+		case "boolean":
+			types.add("boolean");
+			break;
+		case "real":
+			types.add("double");
+			break;
+		default: types.add("text");
+	}
+	return [...types].sort();
+}
 function detectValidator(root) {
 	const pkgPath = join(root, "package.json");
 	if (!existsSync(pkgPath)) return null;
@@ -161,7 +192,7 @@ async function resolveValidator(root) {
 			}
 		]
 	});
-	if (isCancel(choice)) {
+	if (isCancel(choice) || typeof choice === "symbol") {
 		cancel("Cancelled.");
 		process.exit(0);
 	}
@@ -369,6 +400,23 @@ async function runModel(root, name, columns) {
 			"});",
 			""
 		].join("\n");
+	} else if (dialect === "mysql") {
+		const colDefs = columns.map((col) => drizzleColumnDefMySql(col));
+		const columnImports = drizzleImportsForColumnsMySql(columns);
+		const allCols = [
+			`  id: int("id").autoincrement().primaryKey(),`,
+			...colDefs,
+			`  createdAt: timestamp("created_at").notNull().defaultNow(),`,
+			`  updatedAt: timestamp("updated_at").notNull().defaultNow(),`
+		];
+		content = [
+			`import { mysqlTable, ${columnImports.join(", ")} } from "void/schema-mysql";`,
+			"",
+			`export const ${name} = mysqlTable("${name}", {`,
+			...allCols,
+			"});",
+			""
+		].join("\n");
 	} else {
 		const colDefs = columns.map((col) => drizzleColumnDef(col));
 		const columnImports = drizzleImportsForColumns(columns);
@@ -412,7 +460,8 @@ function runMigration(root, name) {
 		log.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	if (existsSync(join(migrationsDir, "migrations.js"))) {
+	const bundlePath = join(migrationsDir, "migrations.js");
+	if (existsSync(bundlePath)) {
 		log.error("Your project uses Drizzle's bundled migration format (db/migrations/migrations.js).\n`void gen migration` cannot add custom hand-written migrations to a bundled project\nbecause the bundle must be regenerated by drizzle-kit.\n\nEither run `drizzle-kit generate` to regenerate the bundle, or migrate away from\nbundled mode by deleting db/migrations/migrations.js and re-running `void db generate`.");
 		process.exit(1);
 	}
@@ -421,7 +470,8 @@ function runMigration(root, name) {
 		const lastEntry = existingJournal.entries[existingJournal.entries.length - 1];
 		const metaDir = join(migrationsDir, "meta");
 		const lastSnapshotPrefix = lastEntry.tag.split("_")[0];
-		if (!existsSync(join(metaDir, `${lastSnapshotPrefix}_snapshot.json`))) {
+		const prevSnapshotPath = join(metaDir, `${lastSnapshotPrefix}_snapshot.json`);
+		if (!existsSync(prevSnapshotPath)) {
 			log.error(`db/migrations/meta/_journal.json's last entry is \`${lastEntry.tag}\` but the matching snapshot \`${lastSnapshotPrefix}_snapshot.json\` is missing under meta/.`);
 			log.error("Restore the snapshot from version control, or regenerate migrations with `void db generate` before running `void gen migration`.");
 			process.exit(1);
@@ -433,9 +483,10 @@ function runMigration(root, name) {
 		let journalDialect;
 		if (existingJournal.dialect === "sqlite") journalDialect = "sqlite";
 		else if (existingJournal.dialect === "postgresql") journalDialect = "postgresql";
+		else if (existingJournal.dialect === "mysql") journalDialect = "mysql";
 		else {
 			log.error(`db/migrations/meta/_journal.json has an unsupported dialect: \`${existingJournal.dialect}\`.`);
-			log.error("void supports `sqlite` and `postgresql` only. Restore the journal from version control, or drop db/migrations/ and regenerate from scratch.");
+			log.error("void supports `sqlite`, `postgresql`, and `mysql` only. Restore the journal from version control, or drop db/migrations/ and regenerate from scratch.");
 			process.exit(1);
 		}
 		const configDialect = getDatabaseDialect(readConfig(root));
@@ -444,7 +495,9 @@ function runMigration(root, name) {
 			log.error(`Generating a new custom migration now would append a snapshot in the wrong dialect. Revert void.json's \`database\` field to ${journalDialect}, or drop db/migrations/ and regenerate from scratch.`);
 			process.exit(1);
 		}
-		const configPath = journalDialect === "postgresql" ? writeDrizzleConfig(root, "postgresql://dummy", "postgresql") : writeDrizzleConfig(root, ":memory:");
+		const authSchemaPath = join(root, ".void", "better-auth-schema.ts");
+		const additionalSchemas = existsSync(authSchemaPath) ? [authSchemaPath] : void 0;
+		const configPath = writeDrizzleConfig(root, journalDialect === "postgresql" ? "postgresql://dummy" : journalDialect === "mysql" ? "mysql://dummy" : ":memory:", journalDialect, { additionalSchemas });
 		const childEnv = buildDrizzleKitSpawnEnv(root);
 		const result = spawnSync(process.execPath, [
 			drizzleKitBin,
@@ -494,7 +547,8 @@ function runMigration(root, name) {
 			process.exit(1);
 		}
 	}
-	writeIfNotExists(join(migrationsDir, `${`${getMigrationTimestamp(migrationsDir)}_${name}`}.sql`), `-- ${name}\n`);
+	const tag = `${getMigrationTimestamp(migrationsDir)}_${name}`;
+	writeIfNotExists(join(migrationsDir, `${tag}.sql`), `-- ${name}\n`);
 	outro("Migration created.");
 }
 function runRoute(root, routePath, methods) {
@@ -512,7 +566,8 @@ ${methods.map((m) => {
 function runMiddleware(root, name) {
 	const middlewareDir = readProjectPaths(root).middlewareDir;
 	mkdirSync(middlewareDir, { recursive: true });
-	writeIfNotExists(join(middlewareDir, `${getNextMiddlewareNumber(middlewareDir)}.${name}.ts`), `import { defineMiddleware } from "void";
+	const num = getNextMiddlewareNumber(middlewareDir);
+	writeIfNotExists(join(middlewareDir, `${num}.${name}.ts`), `import { defineMiddleware } from "void";
 
 export default defineMiddleware(async (c, next) => {
   // TODO: implement ${name} middleware

package/dist/generate-RTK8_kK1.mjs

@@ -0,0 +1,47 @@
+import { n as dirname, o as join } from "./dist-BrsS7cai.mjs";
+import { c as collectMigrations } from "./validate-tBBN_dXH.mjs";
+import { n as openMigrationValidationDatabase } from "./sqlite-validation-BzKMWnO4.mjs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+//#region src/drizzle/generate.ts
+function snapshotFiles(root) {
+	const files = /* @__PURE__ */ new Map();
+	if (existsSync(root)) {
+		for (const entry of readdirSync(root, {
+			recursive: true,
+			withFileTypes: true
+		})) if (entry.isFile()) {
+			const path = join(entry.parentPath, entry.name);
+			files.set(path, readFileSync(path));
+		}
+	}
+	return files;
+}
+/** Keep SQL and Drizzle's snapshot/journal together when generation fails validation. */
+async function generateValidatedSqliteMigrations(migrationsDir, generate) {
+	try {
+		(await openMigrationValidationDatabase(collectMigrations(migrationsDir))).close();
+	} catch (cause) {
+		throw new Error(`${cause instanceof Error ? cause.message : String(cause)}\nRepair the unapplied migration before generating again. Drizzle diffs snapshots; rerunning generation does not repair existing SQL.`, { cause });
+	}
+	const existed = existsSync(migrationsDir);
+	const previous = snapshotFiles(migrationsDir);
+	try {
+		generate();
+		(await openMigrationValidationDatabase(collectMigrations(migrationsDir))).close();
+	} catch (cause) {
+		if (!existed) rmSync(migrationsDir, {
+			recursive: true,
+			force: true
+		});
+		else {
+			for (const path of snapshotFiles(migrationsDir).keys()) if (!previous.has(path)) rmSync(path);
+			for (const [path, contents] of previous) {
+				mkdirSync(dirname(path), { recursive: true });
+				writeFileSync(path, contents);
+			}
+		}
+		throw new Error(`${cause instanceof Error ? cause.message : String(cause)}\nMigration generation failed; previous SQL, snapshots and journal were restored. Review the schema change before retrying. For additive changes, use an additive migration rather than rebuilding existing tables.`, { cause });
+	}
+}
+//#endregion
+export { generateValidatedSqliteMigrations };