workerstack 0.1.0-beta.0

package/package.json

@@ -0,0 +1,286 @@
+{
+  "name": "workerstack",
+  "version": "0.1.0-beta.0",
+  "description": "Full-stack framework for Cloudflare Workers: one blueprint declares the API, auth, storage, jobs, cron, and realtime, and SSR with TanStack Start runs next to them.",
+  "keywords": [
+    "backend",
+    "better-auth",
+    "cloudflare",
+    "workers",
+    "durable-objects",
+    "drizzle",
+    "orpc",
+    "realtime",
+    "tanstack-start",
+    "typesafe"
+  ],
+  "homepage": "https://github.com/kirill-dev-pro/workerstack#readme",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kirill-dev-pro/workerstack.git",
+    "directory": "packages/workerstack"
+  },
+  "bin": {
+    "workerstack": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "skills",
+    "CHANGELOG.md",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./access": {
+      "types": "./dist/access.d.ts",
+      "default": "./dist/access.js"
+    },
+    "./codegen": {
+      "types": "./dist/codegen.d.ts",
+      "default": "./dist/codegen.js"
+    },
+    "./libsql": {
+      "types": "./dist/database/libsql.d.ts",
+      "default": "./dist/database/libsql.js"
+    },
+    "./live": {
+      "types": "./dist/live/index.d.ts",
+      "default": "./dist/live/index.js"
+    },
+    "./provision": {
+      "types": "./dist/provision.d.ts",
+      "default": "./dist/provision.js"
+    },
+    "./provision-schema": {
+      "types": "./dist/provision-schema.d.ts",
+      "default": "./dist/provision-schema.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "default": "./dist/testing.js"
+    },
+    "./workers": {
+      "types": "./dist/workers/index.d.ts",
+      "default": "./dist/workers/index.js"
+    },
+    "./vite": {
+      "types": "./dist/vite.d.ts",
+      "default": "./dist/vite.js"
+    },
+    "./schema": {
+      "types": "./dist/schema-export.d.ts",
+      "default": "./dist/schema-export.js"
+    },
+    "./typeid": {
+      "types": "./dist/typeid.d.ts",
+      "default": "./dist/typeid.js"
+    },
+    "./env": {
+      "types": "./dist/env.d.ts",
+      "default": "./dist/env.js"
+    },
+    "./blueprint": {
+      "types": "./dist/blueprint.d.ts",
+      "default": "./dist/blueprint.js"
+    },
+    "./cron": {
+      "types": "./dist/cron.d.ts",
+      "default": "./dist/cron.js"
+    },
+    "./email-smtp": {
+      "types": "./dist/email/smtp.d.ts",
+      "default": "./dist/email/smtp.js"
+    },
+    "./messaging": {
+      "types": "./dist/messaging/index.d.ts",
+      "default": "./dist/messaging/index.js"
+    },
+    "./api": {
+      "types": "./dist/api/types.d.ts",
+      "default": "./dist/api/types.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "default": "./dist/client/index.js"
+    },
+    "./client-rest": {
+      "types": "./dist/client/rest.d.ts",
+      "default": "./dist/client/rest.js"
+    },
+    "./client-react": {
+      "types": "./dist/client/react.d.ts",
+      "default": "./dist/client/react.js"
+    },
+    "./client-solid": {
+      "types": "./dist/client/solid.d.ts",
+      "default": "./dist/client/solid.js"
+    },
+    "./client-svelte": {
+      "types": "./dist/client/svelte.d.ts",
+      "default": "./dist/client/svelte.js"
+    },
+    "./client-vue": {
+      "types": "./dist/client/vue.d.ts",
+      "default": "./dist/client/vue.js"
+    },
+    "./query": {
+      "types": "./dist/query/index.d.ts",
+      "default": "./dist/query/index.js"
+    },
+    "./query-react": {
+      "types": "./dist/query/react.d.ts",
+      "default": "./dist/query/react.js"
+    },
+    "./sync": {
+      "types": "./dist/sync/index.d.ts",
+      "default": "./dist/sync/index.js"
+    },
+    "./start": {
+      "types": "./dist/start/index.d.ts",
+      "default": "./dist/start/index.js"
+    },
+    "./start/worker": {
+      "types": "./dist/start/create-start-worker.d.ts",
+      "default": "./dist/start/create-start-worker.js"
+    },
+    "./start/server-entry": {
+      "types": "./dist/start/server-entry.d.ts",
+      "default": "./dist/start/server-entry.js"
+    },
+    "./workers/entry": {
+      "types": "./dist/workers/entry.d.ts",
+      "default": "./dist/workers/entry.js"
+    },
+    "./start-auth": {
+      "types": "./dist/start/auth-client.d.ts",
+      "default": "./dist/start/auth-client.js"
+    }
+  },
+  "scripts": {
+    "build": "bun ../../scripts/build-package.ts workerstack",
+    "db:migrate": "drizzle-kit migrate",
+    "db:push": "drizzle-kit push",
+    "prepack": "bun run build",
+    "test": "bun test --parallel --timeout=30000",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@noble/hashes": "^2.3.0",
+    "@standard-schema/spec": "1.1.0",
+    "@standardserver/core": "0.7.1",
+    "esbuild": "^0.28.2",
+    "valibot": "1.4.2",
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@libsql/client": ">=0.14.0",
+    "@orpc/client": "2.0.0-beta.37",
+    "@orpc/json-schema": "2.0.0-beta.37",
+    "@orpc/openapi": "2.0.0-beta.37",
+    "@orpc/publisher": "2.0.0-beta.37",
+    "@orpc/server": "2.0.0-beta.37",
+    "@orpc/tanstack-query": "2.0.0-beta.37",
+    "@orpc/valibot": "2.0.0-beta.37",
+    "@standardserver/core": "0.7.1",
+    "@tanstack/db": "0.6.16",
+    "@tanstack/query-core": "^5.101.1",
+    "@tanstack/query-db-collection": "1.1.0",
+    "@tanstack/react-query": "^5.101.1",
+    "@tanstack/react-start": "^1.168.26",
+    "@types/nodemailer": "^6",
+    "@types/react": "^19.0.0",
+    "better-auth": "^1.7.6",
+    "drizzle-kit": "^0.30.0",
+    "drizzle-orm": "^0.45.0",
+    "drizzle-valibot": "0.4.2",
+    "react": "^19.0.0",
+    "solid-js": "2.0.0-rc.0",
+    "typescript": "^5.8.0",
+    "vue": "^3.5.0"
+  },
+  "peerDependencies": {
+    "@cloudflare/vite-plugin": "^1.62.0",
+    "@libsql/client": ">=0.14.0",
+    "@orpc/client": "2.0.0-beta.37",
+    "@orpc/json-schema": "2.0.0-beta.37",
+    "@orpc/openapi": "2.0.0-beta.37",
+    "@orpc/publisher": "2.0.0-beta.37",
+    "@orpc/server": "2.0.0-beta.37",
+    "@orpc/tanstack-query": "2.0.0-beta.37",
+    "@orpc/valibot": "2.0.0-beta.37",
+    "@tanstack/db": "0.6.16",
+    "@tanstack/query-core": "^5.101.0",
+    "@tanstack/query-db-collection": "1.1.0",
+    "@tanstack/react-query": "^5.101.0",
+    "@tanstack/react-start": ">=1.0.0",
+    "better-auth": "^1.0.0",
+    "drizzle-kit": "^0.30.0",
+    "drizzle-orm": "^0.45.0",
+    "drizzle-valibot": "0.4.2",
+    "nodemailer": ">=6 <10",
+    "react": ">=18",
+    "solid-js": ">=2.0.0-rc.0",
+    "typescript": ">=5",
+    "vue": ">=3.5",
+    "wrangler": "^4.143.0"
+  },
+  "peerDependenciesMeta": {
+    "@cloudflare/vite-plugin": {
+      "optional": true
+    },
+    "@libsql/client": {
+      "optional": true
+    },
+    "@orpc/tanstack-query": {
+      "optional": true
+    },
+    "@tanstack/db": {
+      "optional": true
+    },
+    "@tanstack/query-core": {
+      "optional": true
+    },
+    "@tanstack/query-db-collection": {
+      "optional": true
+    },
+    "@tanstack/react-query": {
+      "optional": true
+    },
+    "@tanstack/react-start": {
+      "optional": true
+    },
+    "better-auth": {
+      "optional": true
+    },
+    "drizzle-kit": {
+      "optional": true
+    },
+    "nodemailer": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "solid-js": {
+      "optional": true
+    },
+    "typescript": {
+      "optional": true
+    },
+    "vue": {
+      "optional": true
+    },
+    "wrangler": {
+      "optional": true
+    }
+  }
+}

package/skills/creating-workerstack-apps/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: creating-workerstack-apps
+description: Use when working in a repository that depends on workerstack - starting or structuring the application, adding or changing oRPC procedures, bases, middleware, access rules, jobs, storage, or realtime, choosing a runtime integration, or preparing it for production.
+---
+
+# Creating Workerstack Apps
+
+## Workflow
+
+1. Inspect the product brief and target runtime.
+2. Choose the layout from the table below.
+3. For a new app, use TanStack Start with `render: ssr` (the default); an SPA
+   sets `render: spa` in the blueprint. A 1.0 SaaS template is not available
+   yet: start from `examples/ssr-probe` (SSR) or `examples/todo-solid-native`
+   (SPA) in the workerstack repository.
+4. Configure schema, access, auth, env, storage, jobs, realtime, and the oRPC API graph.
+5. Mount the single `app.handler` integration.
+6. Add committed migrations and a deployment blueprint before production.
+7. Run the verification contract.
+
+| Condition                                                                   | Layout                                                            |
+| --------------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| Small API with short configuration                                          | `src/workerstack.ts`                                              |
+| Auth, access, jobs, env, or custom oRPC procedures need independent modules | `src/workerstack/`                                                |
+
+## Runtime decision recipe
+
+Everything runs in one Cloudflare Worker: the API, jobs and cron (Scheduler
+Durable Object), realtime (RealtimeHub), and, with `render: ssr`, the TanStack
+Start pages. There is no separate API process. `workerstack()` in `vite.config`
+wires the Worker entry; do not write `src/worker.ts` unless the app needs a
+custom fetch handler. Loaders and server functions call the backend through
+`workerstackStart<App>()` in the same isolate.
+
+Code runs in a Worker isolate: no file system, no child processes, no native
+modules, limited CPU per request. Anything that needs those (a headless
+browser, native drivers, large files in memory) belongs outside the app.
+
+Read [application structure](references/application-structure.md) before placing
+the Workerstack entry, schemas, authorization, or configuration modules, and
+before declaring procedures, bases, middleware, or errors.
+Read [runtime integrations](references/runtime-integrations.md) before mounting
+HTTP, adding a worker, or choosing a framework adapter. Read the
+[verification contract](references/verification.md) after adding the app
+scripts and again before handoff or deployment.

package/skills/creating-workerstack-apps/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: 'Creating Workerstack Apps'
+  short_description: 'Start production-ready Workerstack applications'
+  default_prompt: 'Use $creating-workerstack-apps to start a new Workerstack application.'

package/skills/creating-workerstack-apps/references/application-structure.md

@@ -0,0 +1,219 @@
+# Application structure
+
+## Separate declaration from runtime
+
+`src/workerstack/backend.ts` synchronously constructs and exports `backend =
+workerstack({...})`. The declaration is one object; `database`, `storage`,
+`messaging`, and `realtime` also accept a function of the validated
+environment, and `auth` accepts a builder over `{ db, env }`. It is pure:
+`backend.inspect({ env })` resolves it and returns a manifest without
+connecting to infrastructure, and the blueprint imports this declaration
+without starting the application.
+
+`src/workerstack/index.ts` owns the production runtime: it imports `backend`,
+calls `await backend.start()`, exports `app`, and calls `provision(app)` when the
+application owns provisioning. Keep unrelated external side effects out of the
+backend import graph.
+
+Start a small API in `src/workerstack.ts`. Split a meaningful configuration
+into `src/workerstack/` with `backend.ts`, `index.ts`, `schema/`, `access.ts`, `auth.ts`,
+`env.ts`, `jobs/`, and `api/` as needed. The entry remains the one place that
+starts the declared backend; do not create parallel app,
+database, or auth instances.
+
+## Aggregate the schema
+
+Export every domain, Better Auth, plugin, and Workerstack internal table from
+the schema object passed to `workerstack()`. Include
+`export * from 'workerstack/schema'` so migrations include the internal tables.
+Define Better Auth tables required by the selected auth flows and plugins; do
+not assume a minimal auth configuration needs every optional provider table.
+
+## Define authorization on the server
+
+Use `defineAccess(schema, rules)` for generated CRUD. Give each exposed table
+an explicit operation policy and set `ownerColumn` for owner rules. Keep auth,
+internal, and administrative tables out of generated CRUD unless deliberately
+exposing the supported `user` table.
+
+Use `scope.read` and `scope.write` to enforce tenant columns on generated
+lists, reads, and writes. For example, an organization-owned table can derive
+`{ organizationId: ctx.session?.activeOrganizationId ?? '__none__' }`, keeping
+users without an active organization outside tenant rows. Use protected oRPC
+procedures built from `o.protected` when authorization depends on related rows
+or roles; hiding a UI route is not authorization.
+
+## Extend the one API graph
+
+Declare the builder once at module scope with `defineApi({ schema, env })`. It
+infers the schema and env types from the values, so no application writes
+`WorkerstackApiBuilder<...>` by hand, and it reads nothing at runtime.
+
+```ts
+// src/workerstack/api/base.ts
+export const o = defineApi({ schema, env: envSchema })
+export const publicProcedure = o.public
+export const protectedProcedure = o.protected
+```
+
+Router modules are plain objects that import the base they need, and the entry
+passes the finished router as `api`:
+
+```ts
+// src/workerstack/api/projects.ts
+export const projectsRouter = {
+  stats: protectedProcedure.input(...).handler(...),
+}
+
+// src/workerstack/api/index.ts
+export const api = { projects: projectsRouter }
+
+// backend.ts
+workerstack({ schema, database, api })
+```
+
+Do not write a router factory that receives a bag of procedures. That shape
+only existed because `api` used to be a callback. The callback form,
+`api: (o) => ({ ... })`, still works for a router that must be built from the
+framework builder at configuration time.
+
+Use `o.public`, `o.protected`, or `o.webhook`; add `.route(...)` only when a
+stable HTTP projection is useful. Generated CRUD, custom procedures, files,
+health, and `realtime.changes` remain in the same typed oRPC graph and client.
+
+## Give a group of procedures its own base
+
+A base is an oRPC builder, so `.use()` produces another one. Declare a rule
+once instead of repeating it in every handler that depends on it:
+
+```ts
+export const adminProcedure = o.protected.use(
+  async ({ context, next, errors }) => {
+    if (context.user.role !== 'admin') {
+      throw errors.FORBIDDEN({ message: 'Admin access required' })
+    }
+    return next()
+  },
+)
+```
+
+`next({ context })` merges into the context and types it for everything
+downstream, which is how an organization scope or a resolved tenant reaches
+handlers without an argument.
+
+## Instrument the whole graph, not one base
+
+Workerstack builds the CRUD, storage, and realtime procedures itself, so they
+never pass through a base the application declares. A middleware attached to
+`o.protected` therefore measures the application's own procedures and leaves
+the generated CRUD — usually the larger share of traffic — unmeasured.
+
+Register cross-cutting middleware in the configuration instead:
+
+```ts
+const instrumentation = o.middleware(async ({ context, next, path }) => {
+  if (path[0] === 'realtime') return next()
+  const startedAt = performance.now()
+  try {
+    return await next()
+  } finally {
+    record(
+      path.join('.'),
+      performance.now() - startedAt,
+      context.peekSession()?.user?.id,
+    )
+  }
+})
+
+workerstack({
+  schema,
+  database,
+  middleware: [instrumentation],
+  api,
+})
+```
+
+Three rules apply to a graph-wide middleware. It runs before authentication, so
+`context.user` does not exist there. Read the caller with
+`context.peekSession()` after `await next()`, never `getSession()`: forcing the
+session makes every request pay for authentication, including signed webhooks
+that never needed it, and `peekSession()` is for observability only, never for
+authorization. A realtime subscription is one long-lived call, so code after
+`await next()` runs when the stream closes, not when it starts.
+
+## Raise declared errors
+
+Every procedure carries one error map: `BAD_REQUEST`, `UNAUTHORIZED`,
+`FORBIDDEN`, `NOT_FOUND`, `CONFLICT`, `PAYLOAD_TOO_LARGE`,
+`TOO_MANY_REQUESTS`. Inside a handler or middleware, raise from the `errors`
+argument, with extra context in `data.details`:
+
+```ts
+throw errors.NOT_FOUND({ message: 'Project not found' })
+```
+
+Code outside a handler — a service function or a job — has no `errors`
+argument. Throw `WorkerstackError`, which the framework maps to the same typed
+error. Do not construct `ORPCError` by hand anywhere.
+
+## Give list endpoints the shared contract
+
+`listSpec(table, options)` gives a procedure you write the same filter, sort,
+cursor, and count contract the generated CRUD list uses. Apply both parts to
+your own base, which is what preserves the row type to the client:
+
+```ts
+const logsList = listSpec(appLogs, {
+  filterable: ['level'],
+  sortable: ['createdAt'],
+})
+logs: adminProcedure.input(logsList.input).handler(logsList.handler)
+```
+
+It reads no `access` configuration; the base procedure carries the policy.
+
+## Type helpers that take the database
+
+A service module cannot reach `typeof app.db` without an import cycle back to
+the entry. Use `WorkerstackDb<typeof schema>` and `WorkerstackTx<typeof schema>`
+instead of `any`.
+
+## Keep the entry out of its own import graph
+
+The api router and everything it imports are evaluated when the entry is
+imported. A module in that graph that imports the app back — a bot client
+reading `db`, a logger reading `app.env` — closes a cycle and breaks module
+initialization. Load the app lazily in such a module.
+
+## Keep credentials environment-owned
+
+Declare validated server and browser-safe client variables in `env`. Server
+variables must not use the `PUBLIC_` prefix; client variables must use it.
+Use `app.env` (and `ctx.env`) rather than duplicating unchecked configuration.
+Commit `.env.example` with names and safe placeholders only. Keep production
+secrets, database URLs, storage credentials, and auth secrets in the runtime
+environment.
+
+Use local libSQL storage for development, and let a messaging channel without
+credentials capture instead of sending; declare production adapters and
+credentials through the declaration and the runtime environment rather than
+hard-coding them.
+
+## Publish direct writes
+
+Generated CRUD publishes realtime changes automatically. For a write through
+`app.db` or `ctx.db`, return the complete changed row, wait for its transaction
+to commit, then publish it with the table object:
+
+```ts
+const [task] = await ctx.db
+  .update(schema.tasks)
+  .set({ status: 'done' })
+  .where(eq(schema.tasks.id, taskId))
+  .returning()
+
+await ctx.realtime.publish(schema.tasks, 'update', task)
+```
+
+Do not publish from inside an enclosing transaction. The complete row lets the
+existing access filter evaluate owner and read-scope columns.

package/skills/creating-workerstack-apps/references/runtime-integrations.md

@@ -0,0 +1,96 @@
+# Runtime integrations
+
+A Workerstack 1.0 app runs on the Workers runtime: Cloudflare in production,
+celld on a VPS, and workerd under `workerstack dev`. The app does not write
+Worker code. `app.handler` is still the single Web Standard
+`Request -> Response` integration point, and a package Worker entry mounts it.
+
+## App layout
+
+```
+src/workerstack.ts   backend: schema, auth, access, storage, jobs, cron
+src/api.ts           the typed client
+src/routes/...       TanStack Start routes, loaders, server functions
+vite.config.ts       plugins: [workerstack(), viteReact()]
+```
+
+```ts
+// vite.config.ts
+import viteReact from '@vitejs/plugin-react'
+import { workerstack } from 'workerstack/vite'
+import { defineConfig } from 'vite'
+
+export default defineConfig({ plugins: [workerstack(), viteReact()] })
+```
+
+```ts
+// src/api.ts — not src/client.ts, which is a reserved Start entry point
+import { workerstackStart } from 'workerstack/start'
+
+import type { App } from './workerstack'
+
+export const { createQueryClient, createApi } = workerstackStart<App>()
+export const queryClient = createQueryClient()
+export const api = createApi(queryClient)
+```
+
+Import `App` as a type so the browser does not load server runtime code. The
+same `api` works everywhere: in the browser it calls `/api` over HTTP; in SSR,
+loaders, and server functions it calls the backend in the same isolate and
+forwards the request's cookie, so access rules apply the same way. Do not add a
+`/api/$` route, a `src/worker.ts`, or Durable Object exports.
+
+Add `@cloudflare/vite-plugin` and `wrangler` as dev dependencies. The dev and
+build scripts are `workerstack dev` and `workerstack build`.
+
+## Render modes
+
+`workerstack.blueprint.yaml` records `application.worker.render`:
+
+- `ssr` (the default for a TanStack Start app): pages render on the server in
+  the Worker; `main` is `workerstack/start/server-entry`.
+- `spa` (the default without `@tanstack/react-start`): the Worker serves the
+  API and the static client with an SPA fallback; `main` is
+  `workerstack/workers/entry`.
+
+Change the mode by editing `render` in the blueprint; `workerstack dev` keeps
+the value. Both modes build to `dist/server/index.js` and `dist/client`.
+
+A custom entry is an escape hatch for extra Durable Objects, queues, or
+routing. Create `src/server.ts`; the generator then writes
+`main: src/server.ts`:
+
+```ts
+import { createStartWorker } from 'workerstack/start/worker'
+
+import { backend } from './workerstack'
+
+const worker = createStartWorker(backend)
+export const { Scheduler, RealtimeHub, RateLimiter } = worker.durableObjects
+export default worker.handler
+```
+
+## Runtime constraints
+
+- Web APIs plus `nodejs_compat` only: no `Bun.*`, no local disk, no raw TCP
+  (SMTP, Postgres). Use HTTP providers for email; the database is libsql.
+- Files live in a bucket (R2), not on disk.
+- Long or retryable work goes to jobs (`jobs: (j) => j.define(...)`); cron
+  schedules come from `j.cron()`. The platform runs them in the Scheduler
+  Durable Object; there is no worker process and no `runWorker()`. Queue
+  handlers are at-least-once, so make them idempotent.
+- Realtime fans out through the RealtimeHub Durable Object; no Redis.
+
+## Realtime and synced collections
+
+Clients consume the typed `realtime.changes` async iterator. Idle HTTP streams
+receive a transport-only `heartbeat` every five seconds; the Workerstack query
+client filters it before cache callbacks and does not advance the Publisher
+resume ID. Do not add an application polling loop or publish heartbeat events
+through oRPC Publisher.
+
+`workerstack/sync` reconciles successful mutations from the canonical row
+returned by generated CRUD, without a follow-up list refetch. Realtime echoes
+are idempotent, and reconnect performs the full refetch used to repair drift.
+Keep custom replacement procedures compatible by returning the complete row,
+including `id`.

package/skills/creating-workerstack-apps/references/verification.md

@@ -0,0 +1,29 @@
+# Verification contract
+
+Run these gates from the application root after changing dependencies,
+configuration, or application code:
+
+```sh
+bun install
+bun test
+bun run typecheck
+bun run build
+bun run blueprint
+bun run blueprint:check
+```
+
+`bun run blueprint` generates the committed `workerstack.blueprint.yaml` from
+the configured Workerstack entry. Set `package.json#workerstack.entry` when the
+entry is not `src/workerstack.ts`. `bun run blueprint:check` must pass in CI so
+the committed declaration matches the application. Commit only the blueprint:
+`wrangler.json` is generated from it and git-ignored. `workerstack dev`
+regenerates both on startup and on each change, and `workerstack build` fails
+on a stale blueprint, then builds `dist/server` and `dist/client`.
+
+Before production, generate and commit the Drizzle `migrations/` folder.
+`provision(app)` from `workerstack/provision` only applies committed
+migrations and never imports drizzle-kit. For the local schema-push loop, import
+`provision` from `workerstack/provision-schema`; that development-only
+entrypoint requires drizzle-kit. Keep the generated migrations, blueprint,
+tests, worker entry, API mount, and deployment scripts under version control;
+never commit secrets, databases, uploads, or build output.