feat: add spacetimedb json migration tooling

scripts/spacetime-publish-maincloud.sh

@@ -7,6 +7,8 @@ SERVER_RS_DIR="${REPO_ROOT}/server-rs"
 MODULE_PATH="${SERVER_RS_DIR}/target/wasm32-unknown-unknown/release/spacetime_module.wasm"
 SPACETIME_SERVER_ALIAS="maincloud"
 CLEAR_DATABASE=0
+MIGRATION_BOOTSTRAP_SECRET=""
+MIGRATION_BOOTSTRAP_SECRET_MODE="auto"
 
 load_env_file() {
   local env_file="$1"
@@ -39,13 +41,45 @@ usage() {
   npm run spacetime:publish:maincloud
   npm run spacetime:publish:maincloud -- --database <database>
   npm run spacetime:publish:maincloud -- --clear-database
+  npm run spacetime:publish:maincloud -- --no-migration-bootstrap-secret
 
 说明:
   发布 server-rs/crates/spacetime-module 到 SpacetimeDB Maincloud。
   数据库名优先读取 --database，其次读取 GENARRATIVE_SPACETIME_MAINCLOUD_DATABASE。
+  默认在构建 wasm 前随机生成迁移引导密钥，注入 GENARRATIVE_SPACETIME_MIGRATION_BOOTSTRAP_SECRET 并显示在控制台。
 EOF
 }
 
+generate_migration_bootstrap_secret() {
+  node -e 'const crypto = require("crypto"); process.stdout.write(crypto.randomBytes(32).toString("hex"));'
+}
+
+prepare_migration_bootstrap_secret() {
+  case "${MIGRATION_BOOTSTRAP_SECRET_MODE}" in
+    auto)
+      MIGRATION_BOOTSTRAP_SECRET="$(generate_migration_bootstrap_secret)"
+      ;;
+    manual)
+      if [[ "${#MIGRATION_BOOTSTRAP_SECRET}" -lt 16 ]]; then
+        echo "[spacetime:maincloud] 迁移引导密钥至少需要 16 个字符。" >&2
+        exit 1
+      fi
+      ;;
+    disabled)
+      unset GENARRATIVE_SPACETIME_MIGRATION_BOOTSTRAP_SECRET
+      echo "[spacetime:maincloud] 未启用迁移引导密钥。"
+      return
+      ;;
+    *)
+      echo "[spacetime:maincloud] 未知迁移引导密钥模式: ${MIGRATION_BOOTSTRAP_SECRET_MODE}" >&2
+      exit 1
+      ;;
+  esac
+
+  export GENARRATIVE_SPACETIME_MIGRATION_BOOTSTRAP_SECRET="${MIGRATION_BOOTSTRAP_SECRET}"
+  echo "[spacetime:maincloud] 迁移引导密钥: ${MIGRATION_BOOTSTRAP_SECRET}"
+}
+
 load_env_file "${REPO_ROOT}/.env"
 load_env_file "${REPO_ROOT}/.env.local"
 
@@ -70,6 +104,16 @@ while [[ $# -gt 0 ]]; do
       CLEAR_DATABASE=1
       shift
       ;;
+    --migration-bootstrap-secret)
+      MIGRATION_BOOTSTRAP_SECRET="${2:?缺少 --migration-bootstrap-secret 的值}"
+      MIGRATION_BOOTSTRAP_SECRET_MODE="manual"
+      shift 2
+      ;;
+    --no-migration-bootstrap-secret)
+      MIGRATION_BOOTSTRAP_SECRET=""
+      MIGRATION_BOOTSTRAP_SECRET_MODE="disabled"
+      shift
+      ;;
     *)
       echo "[spacetime:maincloud] 未知参数: $1" >&2
       usage >&2
@@ -89,11 +133,18 @@ if ! command -v cargo >/dev/null 2>&1; then
   exit 1
 fi
 
+if ! command -v node >/dev/null 2>&1; then
+  echo "[spacetime:maincloud] 缺少 node 命令，无法生成迁移引导密钥。" >&2
+  exit 1
+fi
+
 if ! command -v spacetime >/dev/null 2>&1; then
   echo "[spacetime:maincloud] 缺少 spacetime CLI，请先安装并登录 Maincloud。" >&2
   exit 1
 fi
 
+prepare_migration_bootstrap_secret
+
 echo "[spacetime:maincloud] 构建 spacetime-module wasm"
 cargo build \
   --manifest-path "${SERVER_RS_DIR}/Cargo.toml" \