@hogsend/db 0.0.1

package/drizzle/meta/_journal.json

@@ -0,0 +1,69 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1779641370049,
+      "tag": "0000_nifty_songbird",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1779658680434,
+      "tag": "0001_minor_shockwave",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1779716216920,
+      "tag": "0002_early_owl",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1779720417749,
+      "tag": "0003_bizarre_annihilus",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1779720793723,
+      "tag": "0004_brave_betty_brant",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1779722442726,
+      "tag": "0005_groovy_princess_powerful",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "7",
+      "when": 1779731629096,
+      "tag": "0006_groovy_charles_xavier",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1779788398665,
+      "tag": "0007_serious_captain_universe",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1780308366878,
+      "tag": "0008_demonic_agent_brand",
+      "breakpoints": true
+    }
+  ]
+}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@hogsend/db",
+  "version": "0.0.1",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dougwithseismic/hogsend.git",
+    "directory": "packages/db"
+  },
+  "sideEffects": false,
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./schema": "./src/schema/index.ts"
+  },
+  "files": [
+    "src",
+    "drizzle",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "drizzle-orm": ">=0.45.0"
+  },
+  "dependencies": {
+    "drizzle-orm": "^0.45.2",
+    "postgres": "^3.4.9"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.1",
+    "drizzle-kit": "^0.31.10",
+    "tsx": "^4.22.3",
+    "@repo/typescript-config": "^0.0.0"
+  },
+  "scripts": {
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "tsx src/migrate.ts",
+    "db:migrate:client": "tsx src/migrate-client.ts",
+    "db:push": "drizzle-kit push",
+    "db:studio": "drizzle-kit studio",
+    "db:pull": "drizzle-kit pull",
+    "db:seed": "tsx src/seed.ts",
+    "check-types": "tsc --noEmit"
+  }
+}

package/src/index.ts

@@ -0,0 +1,35 @@
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+import * as schema from "./schema/index.js";
+
+export function createDatabase(opts: { url: string }) {
+  const client = postgres(opts.url, {
+    max: 10,
+    idle_timeout: 20,
+    connect_timeout: 10,
+  });
+
+  const db = drizzle(client, { schema });
+
+  return { db, client };
+}
+
+export type Database = ReturnType<typeof createDatabase>["db"];
+export type DatabaseClient = ReturnType<typeof postgres>;
+
+export { migrateClient, migrateEngine, migrateTrack } from "./migrate.js";
+export * from "./schema/index.js";
+export {
+  CLIENT_MIGRATIONS_SCHEMA,
+  CLIENT_MIGRATIONS_TABLE,
+  ENGINE_MIGRATIONS_SCHEMA,
+  ENGINE_MIGRATIONS_TABLE,
+  getBundledMigrations,
+  getClientSchemaVersion,
+  getEngineSchemaVersion,
+  getSchemaVersion,
+  type JournalShape,
+  type MigrationEntry,
+  type SchemaVersion,
+} from "./version.js";
+export { schema };

package/src/migrate-client.ts

@@ -0,0 +1,56 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { migrateClient } from "./migrate.js";
+import type { JournalShape } from "./version.js";
+
+// Client-track migrate CLI shim. Reads the client repo's migrations folder from
+// `CLIENT_MIGRATIONS_FOLDER` (set per service to the client repo's `migrations`
+// dir), loads its journal, and applies it into `drizzle.__client_migrations`.
+//
+// Skips gracefully when the folder is unset/absent/empty so the same railway
+// `preDeployCommand` works for this dogfood repo (no client migrations) and for
+// scaffolded client repos.
+async function run(): Promise<void> {
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    console.error("DATABASE_URL environment variable is required");
+    process.exit(1);
+  }
+
+  const folder = process.env.CLIENT_MIGRATIONS_FOLDER;
+  if (!folder) {
+    console.log(
+      "[client] CLIENT_MIGRATIONS_FOLDER not set — no client migrations to apply, skipping.",
+    );
+    return;
+  }
+  if (!existsSync(folder)) {
+    console.log(`[client] Migrations folder ${folder} not found — skipping.`);
+    return;
+  }
+
+  const journalPath = join(folder, "meta", "_journal.json");
+  if (!existsSync(journalPath)) {
+    console.log(
+      `[client] No meta/_journal.json in ${folder} — empty client track, skipping.`,
+    );
+    return;
+  }
+
+  const journal = JSON.parse(readFileSync(journalPath, "utf8")) as JournalShape;
+  if (!journal.entries || journal.entries.length === 0) {
+    console.log("[client] Empty journal — nothing to apply, skipping.");
+    return;
+  }
+
+  await migrateClient(databaseUrl, folder, journal);
+}
+
+run()
+  .then(() => {
+    process.exit(0);
+  })
+  .catch((err) => {
+    console.error("Client migration failed:", err);
+    process.exit(1);
+  });

package/src/migrate.ts

@@ -0,0 +1,173 @@
+import { existsSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { drizzle } from "drizzle-orm/postgres-js";
+import { migrate } from "drizzle-orm/postgres-js/migrator";
+import postgres from "postgres";
+import {
+  CLIENT_MIGRATIONS_SCHEMA,
+  CLIENT_MIGRATIONS_TABLE,
+  ENGINE_MIGRATIONS_SCHEMA,
+  ENGINE_MIGRATIONS_TABLE,
+  getClientSchemaVersion,
+  getEngineSchemaVersion,
+  type JournalShape,
+  type SchemaVersion,
+} from "./version.js";
+
+// Stable advisory-lock key so two concurrent deploys / replicas can never run
+// migrations at the same time — the second blocks on the lock. Both tracks use
+// the same key: a client migrate cannot race an engine migrate on the same DB
+// (the desired serialization, not a bug), and sequential engine-then-client
+// calls each acquire+release so there is no deadlock.
+const ADVISORY_LOCK_KEY = 4812007;
+
+type Db = ReturnType<typeof drizzle>;
+type Client = ReturnType<typeof postgres>;
+
+export interface MigrateTrackOptions {
+  /** Already-constructed postgres-js client (max:1, idle_timeout:0). */
+  client: Client;
+  /** drizzle(client) instance bound to that client. */
+  db: Db;
+  migrationsFolder: string;
+  migrationsTable: string;
+  migrationsSchema: string;
+  /** Per-track version probe so logging reports the right pending set. */
+  version: (db: Db) => Promise<SchemaVersion>;
+  /** Label for log lines, e.g. "engine" / "client". */
+  label: string;
+}
+
+/**
+ * Apply one migration track under the shared advisory lock + statement guards.
+ * Generalized from the original single-track `run()`.
+ */
+export async function migrateTrack(opts: MigrateTrackOptions): Promise<void> {
+  const { client, db, migrationsFolder, migrationsTable, migrationsSchema } =
+    opts;
+
+  // Fail fast instead of queueing forever behind a lock on a busy table; a
+  // migration that can't get its lock in 10s is safer aborted and retried.
+  await client`SET lock_timeout = '10s'`;
+  // Cap any single statement. Long-running DDL or bulk UPDATEs against a live
+  // table belong in a Hatchet backfill job, not in a migration (UPGRADING.md).
+  await client`SET statement_timeout = '15min'`;
+
+  // Serialize migrations across concurrent deploys / multiple replicas.
+  await client`SELECT pg_advisory_lock(${ADVISORY_LOCK_KEY})`;
+  try {
+    const before = await opts.version(db);
+    if (before.inSync) {
+      console.log(
+        `[${opts.label}] Schema already up to date at ${before.applied ?? "(empty)"} — nothing to apply.`,
+      );
+      return;
+    }
+    console.log(
+      `[${opts.label}] Applying ${before.pending.length} migration(s): ${before.pending.join(", ")}`,
+    );
+    await migrate(db, { migrationsFolder, migrationsTable, migrationsSchema });
+    const after = await opts.version(db);
+    console.log(
+      `[${opts.label}] Migrations complete. Schema now at ${after.applied}.`,
+    );
+  } finally {
+    await client`SELECT pg_advisory_unlock(${ADVISORY_LOCK_KEY})`;
+  }
+}
+
+function createMigrateClient(databaseUrl: string): { client: Client; db: Db } {
+  // Single dedicated connection. `idle_timeout: 0` keeps it from dropping
+  // mid-run.
+  const client = postgres(databaseUrl, {
+    max: 1,
+    idle_timeout: 0,
+    connection: { application_name: "hogsend-migrate" },
+  });
+  return { client, db: drizzle(client) };
+}
+
+/** Engine track: bundled `@hogsend/db/drizzle` folder + default ledger. */
+export async function migrateEngine(databaseUrl: string): Promise<void> {
+  const migrationsFolder = new URL("../drizzle", import.meta.url).pathname;
+  if (!existsSync(migrationsFolder)) {
+    console.log("[engine] No migrations folder found, skipping.");
+    return;
+  }
+  const { client, db } = createMigrateClient(databaseUrl);
+  try {
+    await migrateTrack({
+      client,
+      db,
+      migrationsFolder,
+      migrationsTable: ENGINE_MIGRATIONS_TABLE,
+      migrationsSchema: ENGINE_MIGRATIONS_SCHEMA,
+      version: getEngineSchemaVersion,
+      label: "engine",
+    });
+  } finally {
+    await client.end();
+  }
+}
+
+/**
+ * Client track: the caller's migrations folder + `__client_migrations` ledger.
+ * The caller also supplies the client journal so the version probe can
+ * short-circuit on an already-in-sync ledger.
+ */
+export async function migrateClient(
+  databaseUrl: string,
+  migrationsFolder: string,
+  journal: JournalShape,
+): Promise<void> {
+  if (!existsSync(migrationsFolder)) {
+    console.log("[client] No migrations folder found, skipping.");
+    return;
+  }
+  const { client, db } = createMigrateClient(databaseUrl);
+  try {
+    await migrateTrack({
+      client,
+      db,
+      migrationsFolder,
+      migrationsTable: CLIENT_MIGRATIONS_TABLE,
+      migrationsSchema: CLIENT_MIGRATIONS_SCHEMA,
+      version: (d) => getClientSchemaVersion(d, journal),
+      label: "client",
+    });
+  } finally {
+    await client.end();
+  }
+}
+
+// --- CLI entrypoint (the `db:migrate` script) -----------------------------
+//
+// Engine only. `@hogsend/db` has no knowledge of any client repo's migrations
+// folder, so the client track is invoked separately via `migrate-client.ts`
+// (the `db:migrate:client` script).
+async function run(): Promise<void> {
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    console.error("DATABASE_URL environment variable is required");
+    process.exit(1);
+  }
+  await migrateEngine(databaseUrl);
+}
+
+// Only run when invoked directly (e.g. `tsx src/migrate.ts`). Guard so that
+// re-exporting `migrateEngine`/`migrateClient` from `index.ts` does not fire a
+// real migration + `process.exit` at import time.
+const invokedDirectly =
+  process.argv[1] !== undefined &&
+  import.meta.url === pathToFileURL(process.argv[1]).href;
+
+if (invokedDirectly) {
+  run()
+    .then(() => {
+      process.exit(0);
+    })
+    .catch((err) => {
+      console.error("Migration failed:", err);
+      process.exit(1);
+    });
+}

package/src/schema/_shared.ts

@@ -0,0 +1,10 @@
+import { timestamp } from "drizzle-orm/pg-core";
+
+export const timestamps = {
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .defaultNow()
+    .notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .defaultNow()
+    .notNull(),
+};

package/src/schema/alert-history.ts

@@ -0,0 +1,21 @@
+import { index, jsonb, pgTable, text, uuid } from "drizzle-orm/pg-core";
+import { timestamps } from "./_shared.js";
+import { alertRules } from "./alert-rules.js";
+
+export const alertHistory = pgTable(
+  "alert_history",
+  {
+    id: uuid("id").defaultRandom().primaryKey(),
+    alertRuleId: uuid("alert_rule_id")
+      .notNull()
+      .references(() => alertRules.id),
+    payload: jsonb("payload").$type<Record<string, unknown>>(),
+    deliveryStatus: text("delivery_status").notNull(),
+    error: text("error"),
+    ...timestamps,
+  },
+  (table) => [
+    index("alert_history_rule_id_idx").on(table.alertRuleId),
+    index("alert_history_created_at_idx").on(table.createdAt),
+  ],
+);

package/src/schema/alert-rules.ts

@@ -0,0 +1,36 @@
+import {
+  boolean,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uuid,
+} from "drizzle-orm/pg-core";
+import { timestamps } from "./_shared.js";
+import { alertChannelEnum, alertRuleTypeEnum } from "./enums.js";
+
+export const alertRules = pgTable(
+  "alert_rules",
+  {
+    id: uuid("id").defaultRandom().primaryKey(),
+    name: text("name").notNull(),
+    type: alertRuleTypeEnum("type").notNull(),
+    threshold: jsonb("threshold").$type<Record<string, number>>().notNull(),
+    channel: alertChannelEnum("channel").notNull(),
+    channelConfig: jsonb("channel_config")
+      .$type<Record<string, string>>()
+      .notNull(),
+    enabled: boolean("enabled").notNull().default(true),
+    cooldownMinutes: integer("cooldown_minutes").notNull().default(60),
+    lastFiredAt: timestamp("last_fired_at", {
+      withTimezone: true,
+    }),
+    ...timestamps,
+  },
+  (table) => [
+    index("alert_rules_type_idx").on(table.type),
+    index("alert_rules_enabled_idx").on(table.enabled),
+  ],
+);

package/src/schema/api-keys.ts

@@ -0,0 +1,30 @@
+import {
+  index,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uuid,
+} from "drizzle-orm/pg-core";
+import { timestamps } from "./_shared.js";
+
+export const apiKeys = pgTable(
+  "api_keys",
+  {
+    id: uuid("id").defaultRandom().primaryKey(),
+    organizationId: text("organization_id"),
+    name: text("name").notNull(),
+    keyPrefix: text("key_prefix").notNull(),
+    keyHash: text("key_hash").notNull().unique(),
+    scopes: jsonb("scopes").$type<string[]>().notNull().default(["read"]),
+    createdBy: text("created_by"),
+    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    ...timestamps,
+  },
+  (table) => [
+    index("api_keys_key_hash_idx").on(table.keyHash),
+    index("api_keys_revoked_at_idx").on(table.revokedAt),
+  ],
+);

package/src/schema/audit-logs.ts

@@ -0,0 +1,22 @@
+import { index, jsonb, pgTable, text, uuid } from "drizzle-orm/pg-core";
+import { timestamps } from "./_shared.js";
+
+export const auditLogs = pgTable(
+  "audit_logs",
+  {
+    id: uuid("id").defaultRandom().primaryKey(),
+    actor: text("actor").notNull(),
+    actorKeyId: uuid("actor_key_id"),
+    action: text("action").notNull(),
+    resource: text("resource").notNull(),
+    resourceId: text("resource_id"),
+    detail: jsonb("detail").$type<Record<string, unknown>>(),
+    ipAddress: text("ip_address"),
+    ...timestamps,
+  },
+  (table) => [
+    index("audit_logs_actor_idx").on(table.actor),
+    index("audit_logs_resource_idx").on(table.resource, table.resourceId),
+    index("audit_logs_created_at_idx").on(table.createdAt),
+  ],
+);

package/src/schema/auth.ts

@@ -0,0 +1,89 @@
+import { boolean, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { timestamps } from "./_shared.js";
+
+export const user = pgTable("user", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  emailVerified: boolean("email_verified").notNull().default(false),
+  image: text("image"),
+  ...timestamps,
+});
+
+export const session = pgTable("session", {
+  id: text("id").primaryKey(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  token: text("token").notNull().unique(),
+  ipAddress: text("ip_address"),
+  userAgent: text("user_agent"),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  activeOrganizationId: text("active_organization_id"),
+  ...timestamps,
+});
+
+export const account = pgTable("account", {
+  id: text("id").primaryKey(),
+  accountId: text("account_id").notNull(),
+  providerId: text("provider_id").notNull(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  accessToken: text("access_token"),
+  refreshToken: text("refresh_token"),
+  idToken: text("id_token"),
+  accessTokenExpiresAt: timestamp("access_token_expires_at", {
+    withTimezone: true,
+  }),
+  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", {
+    withTimezone: true,
+  }),
+  scope: text("scope"),
+  password: text("password"),
+  ...timestamps,
+});
+
+export const verification = pgTable("verification", {
+  id: text("id").primaryKey(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  ...timestamps,
+});
+
+export const organization = pgTable("organization", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").unique(),
+  logo: text("logo"),
+  metadata: text("metadata"),
+  ...timestamps,
+});
+
+export const member = pgTable("member", {
+  id: text("id").primaryKey(),
+  organizationId: text("organization_id")
+    .notNull()
+    .references(() => organization.id, { onDelete: "cascade" }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  role: text("role").notNull().default("member"),
+  ...timestamps,
+});
+
+export const invitation = pgTable("invitation", {
+  id: text("id").primaryKey(),
+  organizationId: text("organization_id")
+    .notNull()
+    .references(() => organization.id, { onDelete: "cascade" }),
+  email: text("email").notNull(),
+  role: text("role"),
+  status: text("status").notNull().default("pending"),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  inviterId: text("inviter_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  ...timestamps,
+});

package/src/schema/contacts.ts

@@ -0,0 +1,31 @@
+import {
+  index,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uuid,
+} from "drizzle-orm/pg-core";
+import { timestamps } from "./_shared.js";
+
+export const contacts = pgTable(
+  "contacts",
+  {
+    id: uuid("id").defaultRandom().primaryKey(),
+    organizationId: text("organization_id"),
+    externalId: text("external_id").notNull().unique(),
+    email: text("email"),
+    properties: jsonb("properties")
+      .$type<Record<string, unknown>>()
+      .default({}),
+    firstSeenAt: timestamp("first_seen_at", { withTimezone: true })
+      .defaultNow()
+      .notNull(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true })
+      .defaultNow()
+      .notNull(),
+    deletedAt: timestamp("deleted_at", { withTimezone: true }),
+    ...timestamps,
+  },
+  (table) => [index("contacts_email_idx").on(table.email)],
+);

package/src/schema/dead-letter-queue.ts

@@ -0,0 +1,31 @@
+import {
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uuid,
+} from "drizzle-orm/pg-core";
+import { timestamps } from "./_shared.js";
+import { dlqStatusEnum } from "./enums.js";
+
+export const deadLetterQueue = pgTable(
+  "dead_letter_queue",
+  {
+    id: uuid("id").defaultRandom().primaryKey(),
+    source: text("source").notNull(),
+    sourceId: text("source_id"),
+    payload: jsonb("payload").$type<Record<string, unknown>>().notNull(),
+    error: text("error").notNull(),
+    retryCount: integer("retry_count").notNull().default(0),
+    status: dlqStatusEnum("status").notNull().default("pending"),
+    retriedAt: timestamp("retried_at", { withTimezone: true }),
+    ...timestamps,
+  },
+  (table) => [
+    index("dlq_source_idx").on(table.source),
+    index("dlq_status_idx").on(table.status),
+    index("dlq_created_at_idx").on(table.createdAt),
+  ],
+);