@agentic-kit/db-tools 0.2.0

package/LICENSE

@@ -0,0 +1,23 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 Dan Lynch <pyramation@gmail.com>
+Copyright (c) 2025 Constructive <developers@constructive.io>
+Copyright (c) 2020-present, Interweb, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,138 @@
+# @agentic-kit/db-tools
+
+<p align="center" width="100%">
+  <img height="250" src="https://raw.githubusercontent.com/constructive-io/constructive/refs/heads/main/assets/outline-logo.svg" />
+</p>
+
+<p align="center" width="100%">
+  <a href="https://github.com/constructive-io/constructive/actions/workflows/run-tests.yaml">
+    <img height="20" src="https://github.com/constructive-io/constructive/actions/workflows/run-tests.yaml/badge.svg" />
+  </a>
+   <a href="https://github.com/constructive-io/constructive/blob/main/LICENSE"><img height="20" src="https://img.shields.io/badge/license-MIT-blue.svg"/></a>
+   <a href="https://www.npmjs.com/package/@agentic-kit/db-tools"><img height="20" src="https://img.shields.io/github/package-json/v/constructive-io/constructive?filename=agentic%2Fdb-tools%2Fpackage.json"/></a>
+</p>
+
+The Constructive typed database tools, as **harness-neutral** [`HarnessTool`](https://www.npmjs.com/package/@agentic-kit/harness)s: zod parameters, `execute(params, { cwd, signal })`, and no coding-agent SDK anywhere in the package. Binding them to a harness is the *adapter's* job — [`@agentic-kit/pi`](https://www.npmjs.com/package/@agentic-kit/pi) does it with `toPiTool()` — so a second, compatible harness registers the same 18 tools without a fork.
+
+```
+@agentic-kit/db-tools ──► @agentic-kit/harness (HarnessTool)
+        ▲
+        ├── @agentic-kit/pi        toPiTool()  ──► pi's ToolDefinition
+        └── your adapter           toXTool()   ──► your harness's tool shape
+```
+
+```bash
+npm install @agentic-kit/db-tools
+```
+
+## What's inside
+
+- **18 typed db tools** — `provision_database`, `provision_blueprint`, `describe_schema`, `add_relation`, `delete_table`, `create_field` / `update_field` / `delete_field`, `add_policies`, `add_records`, `manage_entity_types`, `create_api_key`, `run_codegen`, and the template suite (`list` / `create` / `apply` / `update` / `delete`). `constructiveDbTools` is the list, in registration order.
+- **Host injection** — credentials, backend endpoints and data-plane tokens come from the host application, not from the package. Call `configureHost()` once at startup; the tools read it lazily per call.
+- **Project context** — `resolveProjectContext` / `resolveDataToken` resolve the database a tool acts on from the cwd's `.env` plus the host's session, and `deriveSubdomainEndpoint` derives its per-database endpoints.
+- **Provisioning model** — the pinned `node-type-registry` presets, the provision manifest, and overlay resolution (`resolveProvisionModules`).
+- **`toolSchema`** — a tool's zod parameters as plain JSON Schema, for adapters whose harness wants JSON Schema rather than zod.
+
+## Usage
+
+```ts
+import { configureHost, constructiveDbTools } from '@agentic-kit/db-tools';
+
+configureHost({
+  account: () => ({ userId, accessToken }),
+  backendConfig: () => ({ apiEndpoint, modulesEndpoint }),
+  signInHint: 'Run `agent login` to sign in.'
+});
+
+for (const tool of constructiveDbTools) {
+  myHarness.registerTool(myToolBinding(tool));
+}
+```
+
+A tool executes against nothing but its params and a context, so it is callable directly — which is also how the tests drive it:
+
+```ts
+const result = await describeSchemaTool.execute({ database_name: 'my-app' }, { cwd: process.cwd() });
+```
+
+## Related
+
+| Package | Role |
+| --- | --- |
+| [`@agentic-kit/harness`](https://www.npmjs.com/package/@agentic-kit/harness) | the neutral contracts: `HarnessTool`, `HarnessAdapter`, the run gate |
+| [`@agentic-kit/pi`](https://www.npmjs.com/package/@agentic-kit/pi) | the pi adapter: binds these tools and attaches a run's lanes to a pi session |
+| [`@agentic-kit/cli`](https://www.npmjs.com/package/@agentic-kit/cli) | the `agent` CLI, which materializes the tools into a pi agent dir |
+
+---
+
+## Education and Tutorials
+
+ 1. 🚀 [Quickstart: Getting Up and Running](https://constructive.io/learn/quickstart)
+Get started with modular databases in minutes. Install prerequisites and deploy your first module.
+
+ 2. 📦 [Modular PostgreSQL Development with Database Packages](https://constructive.io/learn/modular-postgres)
+Learn to organize PostgreSQL projects with pgpm workspaces and reusable database modules.
+
+ 3. ✏️ [Authoring Database Changes](https://constructive.io/learn/authoring-database-changes)
+Master the workflow for adding, organizing, and managing database changes with pgpm.
+
+ 4. 🧪 [End-to-End PostgreSQL Testing with TypeScript](https://constructive.io/learn/e2e-postgres-testing)
+Master end-to-end PostgreSQL testing with ephemeral databases, RLS testing, and CI/CD automation.
+
+ 5. ⚡ [Supabase Testing](https://constructive.io/learn/supabase)
+Use TypeScript-first tools to test Supabase projects with realistic RLS, policies, and auth contexts.
+
+ 6. 💧 [Drizzle ORM Testing](https://constructive.io/learn/drizzle-testing)
+Run full-stack tests with Drizzle ORM, including database setup, teardown, and RLS enforcement.
+
+ 7. 🔧 [Troubleshooting](https://constructive.io/learn/troubleshooting)
+Common issues and solutions for pgpm, PostgreSQL, and testing.
+
+## Related Constructive Tooling
+
+### 📦 Package Management
+
+* [pgpm](https://github.com/constructive-io/constructive/tree/main/pgpm/pgpm): **🖥️ PostgreSQL Package Manager** for modular Postgres development. Works with database workspaces, scaffolding, migrations, seeding, and installing database packages.
+
+### 🧪 Testing
+
+* [pgsql-test](https://github.com/constructive-io/constructive/tree/main/postgres/pgsql-test): **📊 Isolated testing environments** with per-test transaction rollbacks—ideal for integration tests, complex migrations, and RLS simulation.
+* [pglite-test](https://github.com/constructive-io/constructive/tree/main/postgres/pglite-test): **🪶 Drop-in pgsql-test replacement backed by PGlite** — in-process Postgres, no server required, instance-per-suite isolation.
+* [pgsql-seed](https://github.com/constructive-io/constructive/tree/main/postgres/pgsql-seed): **🌱 PostgreSQL seeding utilities** for CSV, JSON, SQL data loading, and pgpm deployment.
+* [supabase-test](https://github.com/constructive-io/constructive/tree/main/postgres/supabase-test): **🧪 Supabase-native test harness** preconfigured for the local Supabase stack—per-test rollbacks, JWT/role context helpers, and CI/GitHub Actions ready.
+* [graphile-test](https://github.com/constructive-io/constructive/tree/main/graphile/graphile-test): **🔐 Authentication mocking** for Graphile-focused test helpers and emulating row-level security contexts.
+* [pg-query-context](https://github.com/constructive-io/constructive/tree/main/postgres/pg-query-context): **🔒 Session context injection** to add session-local context (e.g., `SET LOCAL`) into queries—ideal for setting `role`, `jwt.claims`, and other session settings.
+
+### 🧠 Parsing & AST
+
+* [pgsql-parser](https://www.npmjs.com/package/pgsql-parser): **🔄 SQL conversion engine** that interprets and converts PostgreSQL syntax.
+* [libpg-query-node](https://www.npmjs.com/package/libpg-query): **🌉 Node.js bindings** for `libpg_query`, converting SQL into parse trees.
+* [pg-proto-parser](https://www.npmjs.com/package/pg-proto-parser): **📦 Protobuf parser** for parsing PostgreSQL Protocol Buffers definitions to generate TypeScript interfaces, utility functions, and JSON mappings for enums.
+* [@pgsql/enums](https://www.npmjs.com/package/@pgsql/enums): **🏷️ TypeScript enums** for PostgreSQL AST for safe and ergonomic parsing logic.
+* [@pgsql/types](https://www.npmjs.com/package/@pgsql/types): **📝 Type definitions** for PostgreSQL AST nodes in TypeScript.
+* [@pgsql/utils](https://www.npmjs.com/package/@pgsql/utils): **🛠️ AST utilities** for constructing and transforming PostgreSQL syntax trees.
+
+### 📚 Documentation & Skills
+
+* [constructive-skills](https://github.com/constructive-io/constructive-skills): **📖 Platform documentation and AI agent skills** — feature catalog, blueprint reference, SDK guides (i18n, billing, limits, events, uploads, security, entities, search, AI), and deployment guides.
+
+Install skills for AI coding agents:
+
+```bash
+# All platform skills (security, blueprints, codegen, billing, etc.)
+npx skills add constructive-io/constructive-skills
+
+# Individual repo skills (pgpm, testing, CLI, search, etc.)
+npx skills add https://github.com/constructive-io/constructive --skill pgpm
+npx skills add https://github.com/constructive-io/constructive --skill constructive-testing
+```
+
+## Credits
+
+**🛠 Built by the [Constructive](https://constructive.io) team — creators of modular Postgres tooling for secure, composable backends. If you like our work, contribute on [GitHub](https://github.com/constructive-io).**
+
+## Disclaimer
+
+AS DESCRIBED IN THE LICENSES, THE SOFTWARE IS PROVIDED "AS IS", AT YOUR OWN RISK, AND WITHOUT WARRANTIES OF ANY KIND.
+
+No developer or entity involved in creating this software will be liable for any claims or damages whatsoever associated with your use, inability to use, or your interaction with other users of the code, including any direct, indirect, incidental, special, exemplary, punitive or consequential damages, or loss of profits, cryptocurrencies, tokens, or anything else of value.

package/app-workspace.d.ts

@@ -0,0 +1,16 @@
+export declare const NATIVE_BUILD_DEPS: string[];
+export declare const IGNORED_BUILDS_RE: RegExp;
+export declare function run(cmd: string, args: string[], cwd: string, env?: Record<string, string>): Promise<{
+    ok: boolean;
+    out: string;
+}>;
+export declare function ensureWorkspaceConfig(cwd: string): Promise<void>;
+export declare function pinCodegenLatest(appDir: string): Promise<void>;
+export declare function ensureAppScaffold(cwd: string): Promise<{
+    ok: boolean;
+    out: string;
+}>;
+export declare function prewarmAppWorkspace(cwd: string): Promise<{
+    ok: boolean;
+    out: string;
+}>;

package/app-workspace.js

@@ -0,0 +1,145 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IGNORED_BUILDS_RE = exports.NATIVE_BUILD_DEPS = void 0;
+exports.run = run;
+exports.ensureWorkspaceConfig = ensureWorkspaceConfig;
+exports.pinCodegenLatest = pinCodegenLatest;
+exports.ensureAppScaffold = ensureAppScaffold;
+exports.prewarmAppWorkspace = prewarmAppWorkspace;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+// pnpm 11.8 no longer reads the `pnpm` field from a non-root package.json, so the
+// template's `pnpm.overrides.graphql` (in packages/app/package.json) is silently
+// ignored. Without that override two graphql versions (16.13.0 + 16.14.0) get
+// installed, which instantiates two copies of `grafast` under DIFFERENT
+// peer-dependency hash contexts. graphile-search then resolves in one context
+// while graphile-connection-filter was linked under the other, so codegen dies
+// with `Cannot find module 'graphile-connection-filter'`. Hoisting the override
+// to the ROOT pnpm-workspace.yaml (which pnpm 11.8 DOES read) collapses graphql —
+// and therefore grafast — to a single version, and the missing module resolves
+// (PNPM-GRAPHQL-OVERRIDE-001). We also strip the nested packages/app
+// pnpm-workspace.yaml the template ships, and keep onlyBuiltDependencies so the
+// native deps build where honored (PNPM-BUILDS-001).
+exports.NATIVE_BUILD_DEPS = ['esbuild', 'sharp', 'unrs-resolver'];
+exports.IGNORED_BUILDS_RE = /ERR_PNPM_IGNORED_BUILDS|Ignored build scripts/;
+const DEFAULT_GRAPHQL_OVERRIDE = '16.14.0';
+const TEMPLATE_REPO = 'https://github.com/constructive-io/sandbox-templates';
+const TEMPLATE_SUBDIR = node_path_1.default.join('nextjs', 'constructive-app');
+async function run(cmd, args, cwd, env) {
+    try {
+        const { stdout, stderr } = await execFileAsync(cmd, args, {
+            cwd,
+            timeout: 5 * 60_000,
+            encoding: 'utf-8',
+            maxBuffer: 32 * 1024 * 1024,
+            env: env ? { ...process.env, ...env } : process.env,
+        });
+        return { ok: true, out: `${stdout}${stderr}`.trim() };
+    }
+    catch (err) {
+        const e = err;
+        return { ok: false, out: `${e.stdout ?? ''}${e.stderr ?? ''}`.trim() || e.message || 'failed' };
+    }
+}
+// Read the graphql pin the template wants from its (now-ignored) pnpm.overrides
+// so we propagate the template's own value instead of hardcoding ours.
+async function templateGraphqlOverride(cwd) {
+    try {
+        const pkg = JSON.parse(await (0, promises_1.readFile)(node_path_1.default.join(cwd, 'packages', 'app', 'package.json'), 'utf8'));
+        const v = pkg?.pnpm?.overrides?.graphql;
+        return typeof v === 'string' && v.length > 0 ? v : DEFAULT_GRAPHQL_OVERRIDE;
+    }
+    catch {
+        return DEFAULT_GRAPHQL_OVERRIDE;
+    }
+}
+async function ensureWorkspaceConfig(cwd) {
+    const nested = node_path_1.default.join(cwd, 'packages', 'app', 'pnpm-workspace.yaml');
+    if ((0, node_fs_1.existsSync)(nested)) {
+        await (0, promises_1.rm)(nested, { force: true });
+    }
+    const graphqlPin = await templateGraphqlOverride(cwd);
+    const builds = exports.NATIVE_BUILD_DEPS.map((d) => `  - ${d}`).join('\n');
+    const text = `packages:\n  - "packages/*"\n\n` +
+        `overrides:\n  graphql: ${graphqlPin}\n\n` +
+        `onlyBuiltDependencies:\n${builds}\n`;
+    await (0, promises_1.writeFile)(node_path_1.default.join(cwd, 'pnpm-workspace.yaml'), text);
+}
+// Force @constructive-io/graphql-codegen to `latest` in the app package.json
+// before the single install — older 4.9.x throws on PostGraphile `filter` inputs
+// (TS-001).
+async function pinCodegenLatest(appDir) {
+    const pkgPath = node_path_1.default.join(appDir, 'package.json');
+    const pkg = JSON.parse(await (0, promises_1.readFile)(pkgPath, 'utf8'));
+    for (const field of ['devDependencies', 'dependencies']) {
+        if (pkg[field]?.['@constructive-io/graphql-codegen']) {
+            pkg[field]['@constructive-io/graphql-codegen'] = 'latest';
+        }
+    }
+    await (0, promises_1.writeFile)(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+}
+// The Constructive Next.js app is just the `nextjs/constructive-app` tree from
+// the sandbox-templates repo — it ships no `____VAR____` placeholders, so there
+// is nothing to templatize. `pgpm init` only fetches and copies that tree, but
+// its CLI is unreliable in the non-TTY agent shell, which made the agent thrash
+// for minutes. Materialize `packages/app` deterministically by shallow-cloning
+// the template instead (PGPM-001).
+async function ensureAppScaffold(cwd) {
+    const appDir = node_path_1.default.join(cwd, 'packages', 'app');
+    if ((0, node_fs_1.existsSync)(node_path_1.default.join(appDir, 'package.json'))) {
+        return { ok: true, out: 'packages/app already scaffolded' };
+    }
+    const tmp = node_path_1.default.join(node_os_1.default.tmpdir(), `airpage-app-template-${process.pid}`);
+    await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+    const clone = await run('git', ['clone', '--depth', '1', TEMPLATE_REPO, tmp], cwd);
+    if (!clone.ok) {
+        await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+        return { ok: false, out: `Template clone failed:\n${clone.out}` };
+    }
+    const src = node_path_1.default.join(tmp, TEMPLATE_SUBDIR);
+    if (!(0, node_fs_1.existsSync)(src)) {
+        await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+        return { ok: false, out: `Template subdir ${TEMPLATE_SUBDIR} missing in ${TEMPLATE_REPO}` };
+    }
+    try {
+        await (0, promises_1.mkdir)(node_path_1.default.dirname(appDir), { recursive: true });
+        await (0, promises_1.cp)(src, appDir, { recursive: true });
+    }
+    catch (err) {
+        await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+        return {
+            ok: false,
+            out: `Copying template into packages/app failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    await (0, promises_1.rm)(tmp, { recursive: true, force: true });
+    return { ok: true, out: 'Scaffolded packages/app from the constructive-app template.' };
+}
+// Scaffold packages/app, hoist the workspace config, pin codegen, and run the one
+// clean install. All of this is database-INDEPENDENT, so it can be prewarmed
+// concurrently with the ~90s provision_database backend mutation to keep clone +
+// install off run_codegen's critical path. Best-effort and fully idempotent:
+// run_codegen re-runs the same steps, finding the scaffold present and the install
+// already satisfied (a fast no-op). Errors are swallowed by callers that prewarm —
+// run_codegen surfaces any real failure later.
+async function prewarmAppWorkspace(cwd) {
+    const scaffold = await ensureAppScaffold(cwd);
+    if (!scaffold.ok)
+        return scaffold;
+    const appDir = node_path_1.default.join(cwd, 'packages', 'app');
+    await ensureWorkspaceConfig(cwd);
+    await pinCodegenLatest(appDir);
+    const install = await run('pnpm', ['install', '--no-frozen-lockfile'], cwd);
+    if (!install.ok && !exports.IGNORED_BUILDS_RE.test(install.out)) {
+        return { ok: false, out: `pnpm install failed:\n${install.out}` };
+    }
+    return { ok: true, out: 'Prewarmed packages/app scaffold + install.' };
+}

package/context.d.ts

@@ -0,0 +1,62 @@
+import { api, modules } from '@constructive-io/sdk';
+export type ApiClient = ReturnType<typeof api.createClient>;
+export type ModulesClient = ReturnType<typeof modules.createClient>;
+export type ProjectContext = {
+    api: ApiClient;
+    modules: ModulesClient;
+    databaseId: string;
+    schemaId: string;
+    ownerId: string | undefined;
+    apiEndpoint: string;
+    modulesEndpoint: string;
+    databaseName: string;
+    accessToken: string;
+    dataEndpoint: string;
+};
+export type ProjectContextFailureCode = 'no-env' | 'missing-credentials' | 'db-missing' | 'account-mismatch' | 'backend-unreachable' | 'schema-unresolved';
+export type ResolveResult = {
+    context: ProjectContext | null;
+    reason: string;
+    code?: ProjectContextFailureCode;
+};
+export declare const CONTEXT_ENV_KEYS: readonly ["ACCESS_TOKEN", "DATABASE_ID", "API_ENDPOINT", "MODULES_ENDPOINT", "DATABASE_NAME", "OWNER_ID"];
+export type ContextEnvKey = (typeof CONTEXT_ENV_KEYS)[number];
+/** Prefix for injected variables: `ACCESS_TOKEN` is far too generic to claim in
+ *  a shared process environment, `CONSTRUCTIVE_ACCESS_TOKEN` is not. Inside a
+ *  project `.env` the bare names stay readable (and are what the scaffolder
+ *  writes), so both spellings resolve, prefixed winning. */
+export declare const CONTEXT_ENV_PREFIX = "CONSTRUCTIVE_";
+/** Values keyed by name, or a lookup function (a host with a secret store). */
+export type ContextSource = Record<string, string | undefined> | ((name: string) => string | undefined);
+/** Use the process environment (or any injected record) as the source. */
+export declare function fromEnvironment(environment?: Record<string, string | undefined>): ContextSource;
+/** Read a project `.env` as the source. The file is authoritative here — the
+ *  key in it belongs to whatever backend wrote it, so it is not merged under
+ *  the ambient environment. Returns null when the file is absent. */
+export declare function fromEnvFile(cwd: string): Promise<ContextSource | null>;
+export type ResolveOptions = {
+    /** Which plane the context is for. Ownership gates the control plane only:
+     *  schema editing and provisioning act under the signed-in account, so a
+     *  foreign-owned binding is blocked ('account-mismatch'). The data plane
+     *  (real rows via app end-user tokens) never checks desktop-account
+     *  ownership — a live foreign-owned database serves data fine, exactly as
+     *  the app itself does in the Preview. */
+    plane?: 'control' | 'data';
+};
+/**
+ * Resolve the project context from injected values, or from a project folder.
+ *
+ * Passing a `cwd` string keeps the original behavior (read `<cwd>/.env`) so
+ * existing hosts — Constructive Desktop, the confirm gate — are unchanged.
+ * Headless hosts pass values instead: `fromEnvironment()` for a container or
+ * Job, an explicit record for anything else.
+ */
+export declare function resolveProjectContext(input: string | ContextSource, options?: ResolveOptions): Promise<ResolveResult>;
+export type DataTokenResult = {
+    token?: string;
+    userId?: string;
+    reason?: string;
+};
+export declare function resolveDataToken(context: ProjectContext): Promise<DataTokenResult>;
+export declare function deriveSubdomainEndpoint(baseEndpoint: string, firstLabel: string): string;
+export declare function resolveOrgName(ownerId: string): Promise<string | undefined>;