@pipeline-builder/pipeline-data 0.0.1

package/lib/database/drizzle-schema.js

@@ -0,0 +1,66 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+//
+// Barrel for the Drizzle schema. The table/type definitions live in per-domain
+// files under `./schema/*`; this module re-exports every one of them so the
+// public API is byte-identical to the previous single-file schema. Existing
+// `import { ... } from '.../drizzle-schema'` sites and the aggregate `schema`
+// object below both continue to resolve exactly as before.
+//
+export * from './schema/plugin.js';
+export * from './schema/pipeline.js';
+export * from './schema/pipeline-template.js';
+export * from './schema/message.js';
+export * from './schema/message-attachment.js';
+export * from './schema/compliance.js';
+export * from './schema/dashboard.js';
+export * from './schema/alert.js';
+import { orgAlertDestination, orgAlertRule } from './schema/alert.js';
+import { compliancePolicy, complianceRule, complianceRuleHistory, complianceAuditLog, complianceExemption, complianceRuleSubscription, complianceScan, complianceScanSchedule, complianceNotificationPreference, complianceNotificationLog, complianceRole, complianceReport, complianceReportSchedule, } from './schema/compliance.js';
+import { dashboard, dashboardPanel } from './schema/dashboard.js';
+import { messageAttachment } from './schema/message-attachment.js';
+import { message } from './schema/message.js';
+import { pipelineTemplate } from './schema/pipeline-template.js';
+import { pipeline, pipelineRegistry, pipelineEvent, deploymentOutcome, ingestHealth, incident, doraSettings } from './schema/pipeline.js';
+import { plugin } from './schema/plugin.js';
+/**
+ * Complete Drizzle schema export
+ */
+export const schema = {
+    plugin,
+    pipeline,
+    pipelineTemplate,
+    message,
+    messageAttachment,
+    pipelineRegistry,
+    pipelineEvent,
+    // DORA post-deploy outcome markers + per-org ingestion health
+    deploymentOutcome,
+    ingestHealth,
+    // Production incidents (webhook-ingested) → automated post-deploy CFR + MTTR
+    incident,
+    // Per-org DORA overrides (incident correlation window)
+    doraSettings,
+    // Observability dashboards (user-editable replacement for code-defined dashboards)
+    dashboard,
+    dashboardPanel,
+    // Per-org alert notification destinations (multi-tenant alerting)
+    orgAlertDestination,
+    // per-org operator-authored alert rules  materialized into Prom YAML.
+    orgAlertRule,
+    // Compliance tables
+    compliancePolicy,
+    complianceRule,
+    complianceRuleHistory,
+    complianceAuditLog,
+    complianceExemption,
+    complianceRuleSubscription,
+    complianceScan,
+    complianceScanSchedule,
+    complianceNotificationPreference,
+    complianceNotificationLog,
+    complianceRole,
+    complianceReport,
+    complianceReportSchedule,
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZHJpenpsZS1zY2hlbWEuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZGF0YWJhc2UvZHJpenpsZS1zY2hlbWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxFQUFFO0FBQ0YsK0VBQStFO0FBQy9FLDRFQUE0RTtBQUM1RSw0RUFBNEU7QUFDNUUsOEVBQThFO0FBQzlFLDJEQUEyRDtBQUMzRCxFQUFFO0FBRUYsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLG1CQUFtQixDQUFDO0FBRWxDLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxZQUFZLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUN0RSxPQUFPLEVBQ0wsZ0JBQWdCLEVBQ2hCLGNBQWMsRUFDZCxxQkFBcUIsRUFDckIsa0JBQWtCLEVBQ2xCLG1CQUFtQixFQUNuQiwwQkFBMEIsRUFDMUIsY0FBYyxFQUNkLHNCQUFzQixFQUN0QixnQ0FBZ0MsRUFDaEMseUJBQXlCLEVBQ3pCLGNBQWMsRUFDZCxnQkFBZ0IsRUFDaEIsd0JBQXdCLEdBQ3pCLE1BQU0sd0JBQXdCLENBQUM7QUFDaEMsT0FBTyxFQUFFLFNBQVMsRUFBRSxjQUFjLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNuRSxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDOUMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDakUsT0FBTyxFQUFFLFFBQVEsRUFBRSxnQkFBZ0IsRUFBRSxhQUFhLEVBQUUsaUJBQWlCLEVBQUUsWUFBWSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUMxSSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFNUM7O0dBRUc7QUFDSCxNQUFNLENBQUMsTUFBTSxNQUFNLEdBQUc7SUFDcEIsTUFBTTtJQUNOLFFBQVE7SUFDUixnQkFBZ0I7SUFDaEIsT0FBTztJQUNQLGlCQUFpQjtJQUNqQixnQkFBZ0I7SUFDaEIsYUFBYTtJQUNiLDhEQUE4RDtJQUM5RCxpQkFBaUI7SUFDakIsWUFBWTtJQUNaLDZFQUE2RTtJQUM3RSxRQUFRO0lBQ1IsdURBQXVEO0lBQ3ZELFlBQVk7SUFDWixtRkFBbUY7SUFDbkYsU0FBUztJQUNULGNBQWM7SUFDZCxrRUFBa0U7SUFDbEUsbUJBQW1CO0lBQ25CLHNFQUFzRTtJQUN0RSxZQUFZO0lBQ1osb0JBQW9CO0lBQ3BCLGdCQUFnQjtJQUNoQixjQUFjO0lBQ2QscUJBQXFCO0lBQ3JCLGtCQUFrQjtJQUNsQixtQkFBbUI7SUFDbkIsMEJBQTBCO0lBQzFCLGNBQWM7SUFDZCxzQkFBc0I7SUFDdEIsZ0NBQWdDO0lBQ2hDLHlCQUF5QjtJQUN6QixjQUFjO0lBQ2QsZ0JBQWdCO0lBQ2hCLHdCQUF3QjtDQUNoQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8vXG4vLyBCYXJyZWwgZm9yIHRoZSBEcml6emxlIHNjaGVtYS4gVGhlIHRhYmxlL3R5cGUgZGVmaW5pdGlvbnMgbGl2ZSBpbiBwZXItZG9tYWluXG4vLyBmaWxlcyB1bmRlciBgLi9zY2hlbWEvKmA7IHRoaXMgbW9kdWxlIHJlLWV4cG9ydHMgZXZlcnkgb25lIG9mIHRoZW0gc28gdGhlXG4vLyBwdWJsaWMgQVBJIGlzIGJ5dGUtaWRlbnRpY2FsIHRvIHRoZSBwcmV2aW91cyBzaW5nbGUtZmlsZSBzY2hlbWEuIEV4aXN0aW5nXG4vLyBgaW1wb3J0IHsgLi4uIH0gZnJvbSAnLi4uL2RyaXp6bGUtc2NoZW1hJ2Agc2l0ZXMgYW5kIHRoZSBhZ2dyZWdhdGUgYHNjaGVtYWBcbi8vIG9iamVjdCBiZWxvdyBib3RoIGNvbnRpbnVlIHRvIHJlc29sdmUgZXhhY3RseSBhcyBiZWZvcmUuXG4vL1xuXG5leHBvcnQgKiBmcm9tICcuL3NjaGVtYS9wbHVnaW4uanMnO1xuZXhwb3J0ICogZnJvbSAnLi9zY2hlbWEvcGlwZWxpbmUuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9zY2hlbWEvcGlwZWxpbmUtdGVtcGxhdGUuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9zY2hlbWEvbWVzc2FnZS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NjaGVtYS9tZXNzYWdlLWF0dGFjaG1lbnQuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9zY2hlbWEvY29tcGxpYW5jZS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NjaGVtYS9kYXNoYm9hcmQuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9zY2hlbWEvYWxlcnQuanMnO1xuXG5pbXBvcnQgeyBvcmdBbGVydERlc3RpbmF0aW9uLCBvcmdBbGVydFJ1bGUgfSBmcm9tICcuL3NjaGVtYS9hbGVydC5qcyc7XG5pbXBvcnQge1xuICBjb21wbGlhbmNlUG9saWN5LFxuICBjb21wbGlhbmNlUnVsZSxcbiAgY29tcGxpYW5jZVJ1bGVIaXN0b3J5LFxuICBjb21wbGlhbmNlQXVkaXRMb2csXG4gIGNvbXBsaWFuY2VFeGVtcHRpb24sXG4gIGNvbXBsaWFuY2VSdWxlU3Vic2NyaXB0aW9uLFxuICBjb21wbGlhbmNlU2NhbixcbiAgY29tcGxpYW5jZVNjYW5TY2hlZHVsZSxcbiAgY29tcGxpYW5jZU5vdGlmaWNhdGlvblByZWZlcmVuY2UsXG4gIGNvbXBsaWFuY2VOb3RpZmljYXRpb25Mb2csXG4gIGNvbXBsaWFuY2VSb2xlLFxuICBjb21wbGlhbmNlUmVwb3J0LFxuICBjb21wbGlhbmNlUmVwb3J0U2NoZWR1bGUsXG59IGZyb20gJy4vc2NoZW1hL2NvbXBsaWFuY2UuanMnO1xuaW1wb3J0IHsgZGFzaGJvYXJkLCBkYXNoYm9hcmRQYW5lbCB9IGZyb20gJy4vc2NoZW1hL2Rhc2hib2FyZC5qcyc7XG5pbXBvcnQgeyBtZXNzYWdlQXR0YWNobWVudCB9IGZyb20gJy4vc2NoZW1hL21lc3NhZ2UtYXR0YWNobWVudC5qcyc7XG5pbXBvcnQgeyBtZXNzYWdlIH0gZnJvbSAnLi9zY2hlbWEvbWVzc2FnZS5qcyc7XG5pbXBvcnQgeyBwaXBlbGluZVRlbXBsYXRlIH0gZnJvbSAnLi9zY2hlbWEvcGlwZWxpbmUtdGVtcGxhdGUuanMnO1xuaW1wb3J0IHsgcGlwZWxpbmUsIHBpcGVsaW5lUmVnaXN0cnksIHBpcGVsaW5lRXZlbnQsIGRlcGxveW1lbnRPdXRjb21lLCBpbmdlc3RIZWFsdGgsIGluY2lkZW50LCBkb3JhU2V0dGluZ3MgfSBmcm9tICcuL3NjaGVtYS9waXBlbGluZS5qcyc7XG5pbXBvcnQgeyBwbHVnaW4gfSBmcm9tICcuL3NjaGVtYS9wbHVnaW4uanMnO1xuXG4vKipcbiAqIENvbXBsZXRlIERyaXp6bGUgc2NoZW1hIGV4cG9ydFxuICovXG5leHBvcnQgY29uc3Qgc2NoZW1hID0ge1xuICBwbHVnaW4sXG4gIHBpcGVsaW5lLFxuICBwaXBlbGluZVRlbXBsYXRlLFxuICBtZXNzYWdlLFxuICBtZXNzYWdlQXR0YWNobWVudCxcbiAgcGlwZWxpbmVSZWdpc3RyeSxcbiAgcGlwZWxpbmVFdmVudCxcbiAgLy8gRE9SQSBwb3N0LWRlcGxveSBvdXRjb21lIG1hcmtlcnMgKyBwZXItb3JnIGluZ2VzdGlvbiBoZWFsdGhcbiAgZGVwbG95bWVudE91dGNvbWUsXG4gIGluZ2VzdEhlYWx0aCxcbiAgLy8gUHJvZHVjdGlvbiBpbmNpZGVudHMgKHdlYmhvb2staW5nZXN0ZWQpIOKGkiBhdXRvbWF0ZWQgcG9zdC1kZXBsb3kgQ0ZSICsgTVRUUlxuICBpbmNpZGVudCxcbiAgLy8gUGVyLW9yZyBET1JBIG92ZXJyaWRlcyAoaW5jaWRlbnQgY29ycmVsYXRpb24gd2luZG93KVxuICBkb3JhU2V0dGluZ3MsXG4gIC8vIE9ic2VydmFiaWxpdHkgZGFzaGJvYXJkcyAodXNlci1lZGl0YWJsZSByZXBsYWNlbWVudCBmb3IgY29kZS1kZWZpbmVkIGRhc2hib2FyZHMpXG4gIGRhc2hib2FyZCxcbiAgZGFzaGJvYXJkUGFuZWwsXG4gIC8vIFBlci1vcmcgYWxlcnQgbm90aWZpY2F0aW9uIGRlc3RpbmF0aW9ucyAobXVsdGktdGVuYW50IGFsZXJ0aW5nKVxuICBvcmdBbGVydERlc3RpbmF0aW9uLFxuICAvLyBwZXItb3JnIG9wZXJhdG9yLWF1dGhvcmVkIGFsZXJ0IHJ1bGVzICBtYXRlcmlhbGl6ZWQgaW50byBQcm9tIFlBTUwuXG4gIG9yZ0FsZXJ0UnVsZSxcbiAgLy8gQ29tcGxpYW5jZSB0YWJsZXNcbiAgY29tcGxpYW5jZVBvbGljeSxcbiAgY29tcGxpYW5jZVJ1bGUsXG4gIGNvbXBsaWFuY2VSdWxlSGlzdG9yeSxcbiAgY29tcGxpYW5jZUF1ZGl0TG9nLFxuICBjb21wbGlhbmNlRXhlbXB0aW9uLFxuICBjb21wbGlhbmNlUnVsZVN1YnNjcmlwdGlvbixcbiAgY29tcGxpYW5jZVNjYW4sXG4gIGNvbXBsaWFuY2VTY2FuU2NoZWR1bGUsXG4gIGNvbXBsaWFuY2VOb3RpZmljYXRpb25QcmVmZXJlbmNlLFxuICBjb21wbGlhbmNlTm90aWZpY2F0aW9uTG9nLFxuICBjb21wbGlhbmNlUm9sZSxcbiAgY29tcGxpYW5jZVJlcG9ydCxcbiAgY29tcGxpYW5jZVJlcG9ydFNjaGVkdWxlLFxufSBhcyBjb25zdDtcbiJdfQ==

package/lib/database/index.d.ts

@@ -0,0 +1,5 @@
+export * from './drizzle-schema.js';
+export * from './postgres-connection.js';
+export * from './retry-strategy.js';
+export * from './tenancy.js';
+export { runMigrations, type MigrateOptions } from './migrator.js';

package/lib/database/index.js

@@ -0,0 +1,8 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export * from './drizzle-schema.js';
+export * from './postgres-connection.js';
+export * from './retry-strategy.js';
+export * from './tenancy.js';
+export { runMigrations } from './migrator.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZGF0YWJhc2UvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixPQUFPLEVBQUUsYUFBYSxFQUF1QixNQUFNLGVBQWUsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5leHBvcnQgKiBmcm9tICcuL2RyaXp6bGUtc2NoZW1hLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vcG9zdGdyZXMtY29ubmVjdGlvbi5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3JldHJ5LXN0cmF0ZWd5LmpzJztcbmV4cG9ydCAqIGZyb20gJy4vdGVuYW5jeS5qcyc7XG5leHBvcnQgeyBydW5NaWdyYXRpb25zLCB0eXBlIE1pZ3JhdGVPcHRpb25zIH0gZnJvbSAnLi9taWdyYXRvci5qcyc7XG4iXX0=

package/lib/database/migrator.d.ts

@@ -0,0 +1,20 @@
+export interface MigrateOptions {
+    /** Absolute path to the migrations folder. Defaults to `<package>/drizzle`. */
+    migrationsFolder?: string;
+    /** Schema-qualified migrations table name. Defaults to `__drizzle_migrations`. */
+    migrationsTable?: string;
+    /** Skip the runner entirely (for tests or when a deploy uses an external migration tool). */
+    skip?: boolean;
+}
+/**
+ * Run any pending Drizzle migrations against the configured Postgres.
+ *
+ * No-ops gracefully when:
+ *   - `options.skip` is true
+ *   - `RUN_DB_MIGRATIONS` env var is set to a falsy value (`0`/`false`)
+ *   - the migrations folder doesn't exist (fresh repo, nothing generated yet)
+ *
+ * Throws on any actual migration failure so the service refuses to start
+ * with a half-applied schema.
+ */
+export declare function runMigrations(options?: MigrateOptions): Promise<void>;

package/lib/database/migrator.js

@@ -0,0 +1,80 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Drizzle migration runner.
+ *
+ * Idempotent: safe to call on every service start. drizzle tracks applied
+ * migrations in the `__drizzle_migrations` table and skips ones already run.
+ *
+ * The migration files live at `packages/pipeline-data/drizzle/` and are
+ * generated from the `drizzle-schema.ts` source via `pnpm db:generate`
+ * (which invokes `drizzle-kit generate`).
+ *
+ * For brand-new deploys, `postgres-init.sql` still creates the baseline
+ * tables — the migration runner will skip its initial baseline migration
+ * because the tables already exist (drizzle uses CREATE TABLE IF NOT EXISTS
+ * by default for the snapshot-based generator). Future schema changes ship
+ * as additive migrations.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import { createLogger } from '@pipeline-builder/api-core';
+import { migrate } from 'drizzle-orm/node-postgres/migrator';
+import { getConnection } from './postgres-connection.js';
+const logger = createLogger('migrator');
+// ESM has no __dirname; derive it from this module's URL. Without this the
+// migration runner threw `ReferenceError: __dirname is not defined` at startup
+// (onBeforeStart → runMigrations), crash-looping every service that migrates.
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+/** Resolve the default migrations folder relative to this package. */
+function defaultMigrationsFolder() {
+    // src/database/migrator.ts → up two levels → package root, then ./drizzle
+    return path.resolve(__dirname, '..', '..', 'drizzle');
+}
+/**
+ * Run any pending Drizzle migrations against the configured Postgres.
+ *
+ * No-ops gracefully when:
+ *   - `options.skip` is true
+ *   - `RUN_DB_MIGRATIONS` env var is set to a falsy value (`0`/`false`)
+ *   - the migrations folder doesn't exist (fresh repo, nothing generated yet)
+ *
+ * Throws on any actual migration failure so the service refuses to start
+ * with a half-applied schema.
+ */
+export async function runMigrations(options = {}) {
+    if (options.skip) {
+        logger.info('Migration runner skipped via options.skip');
+        return;
+    }
+    const envFlag = process.env.RUN_DB_MIGRATIONS;
+    if (envFlag !== undefined && (envFlag === '0' || envFlag.toLowerCase() === 'false')) {
+        logger.info('Migration runner skipped via RUN_DB_MIGRATIONS env');
+        return;
+    }
+    const migrationsFolder = options.migrationsFolder ?? defaultMigrationsFolder();
+    if (!fs.existsSync(migrationsFolder)) {
+        logger.info('No migrations folder found, nothing to run', { migrationsFolder });
+        return;
+    }
+    const journalPath = path.join(migrationsFolder, 'meta', '_journal.json');
+    if (!fs.existsSync(journalPath)) {
+        logger.info('No drizzle journal found, nothing to run', { journalPath });
+        return;
+    }
+    const conn = getConnection();
+    const migrationsTable = options.migrationsTable ?? '__drizzle_migrations';
+    logger.info('Running pending Drizzle migrations', { migrationsFolder, migrationsTable });
+    try {
+        await migrate(conn.db, { migrationsFolder, migrationsTable });
+        logger.info('Drizzle migrations complete');
+    }
+    catch (err) {
+        logger.error('Drizzle migration failed — refusing to start', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlncmF0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZGF0YWJhc2UvbWlncmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7Ozs7Ozs7Ozs7O0dBZUc7QUFFSCxPQUFPLEtBQUssRUFBRSxNQUFNLElBQUksQ0FBQztBQUN6QixPQUFPLEtBQUssSUFBSSxNQUFNLE1BQU0sQ0FBQztBQUM3QixPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sS0FBSyxDQUFDO0FBQ3BDLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUMxRCxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sb0NBQW9DLENBQUM7QUFDN0QsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBRXpELE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUV4QywyRUFBMkU7QUFDM0UsK0VBQStFO0FBQy9FLDhFQUE4RTtBQUM5RSxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0FBVy9ELHNFQUFzRTtBQUN0RSxTQUFTLHVCQUF1QjtJQUM5QiwwRUFBMEU7SUFDMUUsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLFNBQVMsQ0FBQyxDQUFDO0FBQ3hELENBQUM7QUFFRDs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxhQUFhLENBQUMsT0FBTyxHQUFtQixFQUFFO0lBQzlELElBQUksT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkNBQTJDLENBQUMsQ0FBQztRQUN6RCxPQUFPO0lBQ1QsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsaUJBQWlCLENBQUM7SUFDOUMsSUFBSSxPQUFPLEtBQUssU0FBUyxJQUFJLENBQUMsT0FBTyxLQUFLLEdBQUcsSUFBSSxPQUFPLENBQUMsV0FBVyxFQUFFLEtBQUssT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNwRixNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7UUFDbEUsT0FBTztJQUNULENBQUM7SUFFRCxNQUFNLGdCQUFnQixHQUFHLE9BQU8sQ0FBQyxnQkFBZ0IsSUFBSSx1QkFBdUIsRUFBRSxDQUFDO0lBQy9FLElBQUksQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUNyQyxNQUFNLENBQUMsSUFBSSxDQUFDLDRDQUE0QyxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLE9BQU87SUFDVCxDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxNQUFNLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDekUsSUFBSSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNoQyxNQUFNLENBQUMsSUFBSSxDQUFDLDBDQUEwQyxFQUFFLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztRQUN6RSxPQUFPO0lBQ1QsQ0FBQztJQUVELE1BQU0sSUFBSSxHQUFHLGFBQWEsRUFBRSxDQUFDO0lBQzdCLE1BQU0sZUFBZSxHQUFHLE9BQU8sQ0FBQyxlQUFlLElBQUksc0JBQXNCLENBQUM7SUFFMUUsTUFBTSxDQUFDLElBQUksQ0FBQyxvQ0FBb0MsRUFBRSxFQUFFLGdCQUFnQixFQUFFLGVBQWUsRUFBRSxDQUFDLENBQUM7SUFDekYsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxFQUFFLGdCQUFnQixFQUFFLGVBQWUsRUFBRSxDQUFDLENBQUM7UUFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO0lBQzdDLENBQUM7SUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1FBQ2IsTUFBTSxDQUFDLEtBQUssQ0FBQyw4Q0FBOEMsRUFBRTtZQUMzRCxLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQztTQUN4RCxDQUFDLENBQUM7UUFDSCxNQUFNLEdBQUcsQ0FBQztJQUNaLENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogRHJpenpsZSBtaWdyYXRpb24gcnVubmVyLlxuICpcbiAqIElkZW1wb3RlbnQ6IHNhZmUgdG8gY2FsbCBvbiBldmVyeSBzZXJ2aWNlIHN0YXJ0LiBkcml6emxlIHRyYWNrcyBhcHBsaWVkXG4gKiBtaWdyYXRpb25zIGluIHRoZSBgX19kcml6emxlX21pZ3JhdGlvbnNgIHRhYmxlIGFuZCBza2lwcyBvbmVzIGFscmVhZHkgcnVuLlxuICpcbiAqIFRoZSBtaWdyYXRpb24gZmlsZXMgbGl2ZSBhdCBgcGFja2FnZXMvcGlwZWxpbmUtZGF0YS9kcml6emxlL2AgYW5kIGFyZVxuICogZ2VuZXJhdGVkIGZyb20gdGhlIGBkcml6emxlLXNjaGVtYS50c2Agc291cmNlIHZpYSBgcG5wbSBkYjpnZW5lcmF0ZWBcbiAqICh3aGljaCBpbnZva2VzIGBkcml6emxlLWtpdCBnZW5lcmF0ZWApLlxuICpcbiAqIEZvciBicmFuZC1uZXcgZGVwbG95cywgYHBvc3RncmVzLWluaXQuc3FsYCBzdGlsbCBjcmVhdGVzIHRoZSBiYXNlbGluZVxuICogdGFibGVzIOKAlCB0aGUgbWlncmF0aW9uIHJ1bm5lciB3aWxsIHNraXAgaXRzIGluaXRpYWwgYmFzZWxpbmUgbWlncmF0aW9uXG4gKiBiZWNhdXNlIHRoZSB0YWJsZXMgYWxyZWFkeSBleGlzdCAoZHJpenpsZSB1c2VzIENSRUFURSBUQUJMRSBJRiBOT1QgRVhJU1RTXG4gKiBieSBkZWZhdWx0IGZvciB0aGUgc25hcHNob3QtYmFzZWQgZ2VuZXJhdG9yKS4gRnV0dXJlIHNjaGVtYSBjaGFuZ2VzIHNoaXBcbiAqIGFzIGFkZGl0aXZlIG1pZ3JhdGlvbnMuXG4gKi9cblxuaW1wb3J0ICogYXMgZnMgZnJvbSAnZnMnO1xuaW1wb3J0ICogYXMgcGF0aCBmcm9tICdwYXRoJztcbmltcG9ydCB7IGZpbGVVUkxUb1BhdGggfSBmcm9tICd1cmwnO1xuaW1wb3J0IHsgY3JlYXRlTG9nZ2VyIH0gZnJvbSAnQHBpcGVsaW5lLWJ1aWxkZXIvYXBpLWNvcmUnO1xuaW1wb3J0IHsgbWlncmF0ZSB9IGZyb20gJ2RyaXp6bGUtb3JtL25vZGUtcG9zdGdyZXMvbWlncmF0b3InO1xuaW1wb3J0IHsgZ2V0Q29ubmVjdGlvbiB9IGZyb20gJy4vcG9zdGdyZXMtY29ubmVjdGlvbi5qcyc7XG5cbmNvbnN0IGxvZ2dlciA9IGNyZWF0ZUxvZ2dlcignbWlncmF0b3InKTtcblxuLy8gRVNNIGhhcyBubyBfX2Rpcm5hbWU7IGRlcml2ZSBpdCBmcm9tIHRoaXMgbW9kdWxlJ3MgVVJMLiBXaXRob3V0IHRoaXMgdGhlXG4vLyBtaWdyYXRpb24gcnVubmVyIHRocmV3IGBSZWZlcmVuY2VFcnJvcjogX19kaXJuYW1lIGlzIG5vdCBkZWZpbmVkYCBhdCBzdGFydHVwXG4vLyAob25CZWZvcmVTdGFydCDihpIgcnVuTWlncmF0aW9ucyksIGNyYXNoLWxvb3BpbmcgZXZlcnkgc2VydmljZSB0aGF0IG1pZ3JhdGVzLlxuY29uc3QgX19kaXJuYW1lID0gcGF0aC5kaXJuYW1lKGZpbGVVUkxUb1BhdGgoaW1wb3J0Lm1ldGEudXJsKSk7XG5cbmV4cG9ydCBpbnRlcmZhY2UgTWlncmF0ZU9wdGlvbnMge1xuICAvKiogQWJzb2x1dGUgcGF0aCB0byB0aGUgbWlncmF0aW9ucyBmb2xkZXIuIERlZmF1bHRzIHRvIGA8cGFja2FnZT4vZHJpenpsZWAuICovXG4gIG1pZ3JhdGlvbnNGb2xkZXI/OiBzdHJpbmc7XG4gIC8qKiBTY2hlbWEtcXVhbGlmaWVkIG1pZ3JhdGlvbnMgdGFibGUgbmFtZS4gRGVmYXVsdHMgdG8gYF9fZHJpenpsZV9taWdyYXRpb25zYC4gKi9cbiAgbWlncmF0aW9uc1RhYmxlPzogc3RyaW5nO1xuICAvKiogU2tpcCB0aGUgcnVubmVyIGVudGlyZWx5IChmb3IgdGVzdHMgb3Igd2hlbiBhIGRlcGxveSB1c2VzIGFuIGV4dGVybmFsIG1pZ3JhdGlvbiB0b29sKS4gKi9cbiAgc2tpcD86IGJvb2xlYW47XG59XG5cbi8qKiBSZXNvbHZlIHRoZSBkZWZhdWx0IG1pZ3JhdGlvbnMgZm9sZGVyIHJlbGF0aXZlIHRvIHRoaXMgcGFja2FnZS4gKi9cbmZ1bmN0aW9uIGRlZmF1bHRNaWdyYXRpb25zRm9sZGVyKCk6IHN0cmluZyB7XG4gIC8vIHNyYy9kYXRhYmFzZS9taWdyYXRvci50cyDihpIgdXAgdHdvIGxldmVscyDihpIgcGFja2FnZSByb290LCB0aGVuIC4vZHJpenpsZVxuICByZXR1cm4gcGF0aC5yZXNvbHZlKF9fZGlybmFtZSwgJy4uJywgJy4uJywgJ2RyaXp6bGUnKTtcbn1cblxuLyoqXG4gKiBSdW4gYW55IHBlbmRpbmcgRHJpenpsZSBtaWdyYXRpb25zIGFnYWluc3QgdGhlIGNvbmZpZ3VyZWQgUG9zdGdyZXMuXG4gKlxuICogTm8tb3BzIGdyYWNlZnVsbHkgd2hlbjpcbiAqICAgLSBgb3B0aW9ucy5za2lwYCBpcyB0cnVlXG4gKiAgIC0gYFJVTl9EQl9NSUdSQVRJT05TYCBlbnYgdmFyIGlzIHNldCB0byBhIGZhbHN5IHZhbHVlIChgMGAvYGZhbHNlYClcbiAqICAgLSB0aGUgbWlncmF0aW9ucyBmb2xkZXIgZG9lc24ndCBleGlzdCAoZnJlc2ggcmVwbywgbm90aGluZyBnZW5lcmF0ZWQgeWV0KVxuICpcbiAqIFRocm93cyBvbiBhbnkgYWN0dWFsIG1pZ3JhdGlvbiBmYWlsdXJlIHNvIHRoZSBzZXJ2aWNlIHJlZnVzZXMgdG8gc3RhcnRcbiAqIHdpdGggYSBoYWxmLWFwcGxpZWQgc2NoZW1hLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcnVuTWlncmF0aW9ucyhvcHRpb25zOiBNaWdyYXRlT3B0aW9ucyA9IHt9KTogUHJvbWlzZTx2b2lkPiB7XG4gIGlmIChvcHRpb25zLnNraXApIHtcbiAgICBsb2dnZXIuaW5mbygnTWlncmF0aW9uIHJ1bm5lciBza2lwcGVkIHZpYSBvcHRpb25zLnNraXAnKTtcbiAgICByZXR1cm47XG4gIH1cblxuICBjb25zdCBlbnZGbGFnID0gcHJvY2Vzcy5lbnYuUlVOX0RCX01JR1JBVElPTlM7XG4gIGlmIChlbnZGbGFnICE9PSB1bmRlZmluZWQgJiYgKGVudkZsYWcgPT09ICcwJyB8fCBlbnZGbGFnLnRvTG93ZXJDYXNlKCkgPT09ICdmYWxzZScpKSB7XG4gICAgbG9nZ2VyLmluZm8oJ01pZ3JhdGlvbiBydW5uZXIgc2tpcHBlZCB2aWEgUlVOX0RCX01JR1JBVElPTlMgZW52Jyk7XG4gICAgcmV0dXJuO1xuICB9XG5cbiAgY29uc3QgbWlncmF0aW9uc0ZvbGRlciA9IG9wdGlvbnMubWlncmF0aW9uc0ZvbGRlciA/PyBkZWZhdWx0TWlncmF0aW9uc0ZvbGRlcigpO1xuICBpZiAoIWZzLmV4aXN0c1N5bmMobWlncmF0aW9uc0ZvbGRlcikpIHtcbiAgICBsb2dnZXIuaW5mbygnTm8gbWlncmF0aW9ucyBmb2xkZXIgZm91bmQsIG5vdGhpbmcgdG8gcnVuJywgeyBtaWdyYXRpb25zRm9sZGVyIH0pO1xuICAgIHJldHVybjtcbiAgfVxuXG4gIGNvbnN0IGpvdXJuYWxQYXRoID0gcGF0aC5qb2luKG1pZ3JhdGlvbnNGb2xkZXIsICdtZXRhJywgJ19qb3VybmFsLmpzb24nKTtcbiAgaWYgKCFmcy5leGlzdHNTeW5jKGpvdXJuYWxQYXRoKSkge1xuICAgIGxvZ2dlci5pbmZvKCdObyBkcml6emxlIGpvdXJuYWwgZm91bmQsIG5vdGhpbmcgdG8gcnVuJywgeyBqb3VybmFsUGF0aCB9KTtcbiAgICByZXR1cm47XG4gIH1cblxuICBjb25zdCBjb25uID0gZ2V0Q29ubmVjdGlvbigpO1xuICBjb25zdCBtaWdyYXRpb25zVGFibGUgPSBvcHRpb25zLm1pZ3JhdGlvbnNUYWJsZSA/PyAnX19kcml6emxlX21pZ3JhdGlvbnMnO1xuXG4gIGxvZ2dlci5pbmZvKCdSdW5uaW5nIHBlbmRpbmcgRHJpenpsZSBtaWdyYXRpb25zJywgeyBtaWdyYXRpb25zRm9sZGVyLCBtaWdyYXRpb25zVGFibGUgfSk7XG4gIHRyeSB7XG4gICAgYXdhaXQgbWlncmF0ZShjb25uLmRiLCB7IG1pZ3JhdGlvbnNGb2xkZXIsIG1pZ3JhdGlvbnNUYWJsZSB9KTtcbiAgICBsb2dnZXIuaW5mbygnRHJpenpsZSBtaWdyYXRpb25zIGNvbXBsZXRlJyk7XG4gIH0gY2F0Y2ggKGVycikge1xuICAgIGxvZ2dlci5lcnJvcignRHJpenpsZSBtaWdyYXRpb24gZmFpbGVkIOKAlCByZWZ1c2luZyB0byBzdGFydCcsIHtcbiAgICAgIGVycm9yOiBlcnIgaW5zdGFuY2VvZiBFcnJvciA/IGVyci5tZXNzYWdlIDogU3RyaW5nKGVyciksXG4gICAgfSk7XG4gICAgdGhyb3cgZXJyO1xuICB9XG59XG4iXX0=

package/lib/database/postgres-connection.d.ts

@@ -0,0 +1,201 @@
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { Pool } from 'pg';
+/**
+ * Resolve the pg TLS/SSL config from an explicit option or the environment,
+ * following the same env-tunable pattern as the pool sizing above.
+ *
+ * Precedence:
+ *   1. An explicit `options.ssl` (constructor arg) always wins — including an
+ *      explicit `false` to force plaintext.
+ *   2. `DB_SSL` (`true`/`1` on, `false`/`0` off) or Postgres' standard
+ *      `PGSSLMODE` (`disable` = off, any other mode = on).
+ *   3. Default: ON in production (RDS connections must be encrypted in transit),
+ *      OFF everywhere else so a local Postgres without TLS keeps working.
+ *
+ * When enabled, `rejectUnauthorized` follows `DB_SSL_REJECT_UNAUTHORIZED`
+ * (default `false`): AWS RDS presents a cert signed by the RDS CA, which is not
+ * in Node's default trust store unless the CA bundle is mounted, so certificate
+ * VERIFICATION is opt-in to avoid breaking a stock RDS deploy — the channel is
+ * still ENCRYPTED. Set `DB_SSL_REJECT_UNAUTHORIZED=true` once the RDS CA bundle
+ * is wired to get full verification.
+ */
+export declare function getSslConfig(explicit?: ConnectionOptions['ssl']): boolean | {
+    rejectUnauthorized: boolean;
+};
+/**
+ * Database connection statistics for monitoring
+ */
+export interface ConnectionStats {
+    totalCount: number;
+    idleCount: number;
+    waitingCount: number;
+}
+/**
+ * Options for configuring the database connection
+ */
+export interface ConnectionOptions {
+    /** Whether to enable connection logging */
+    enableLogging?: boolean;
+    /** Whether to automatically retry failed connections */
+    enableAutoRetry?: boolean;
+    /** Maximum number of connection retry attempts */
+    maxRetries?: number;
+    /** Delay between retry attempts in milliseconds */
+    retryDelay?: number;
+    /** SSL configuration */
+    ssl?: boolean | {
+        rejectUnauthorized: boolean;
+    };
+}
+/**
+ * Singleton database connection class.
+ * Manages PostgreSQL connection pooling and Drizzle ORM instance.
+ *
+ * Features:
+ * - Singleton pattern for single connection pool
+ * - Automatic connection retry with backoff
+ * - Connection health monitoring
+ * - Graceful shutdown handling
+ * - Comprehensive error handling
+ * - Connection statistics tracking
+ *
+ * @example
+ * ```typescript
+ * import { Connection } from './connection';
+ *
+ * const connection = Connection.getInstance();
+ * const plugins = await connection.db.select().from(schema.plugin);
+ *
+ * // During shutdown
+ * await connection.close();
+ * ```
+ */
+export declare class Connection {
+    private static instance;
+    /**
+     * Drizzle ORM database instance with schema
+     */
+    readonly db: ReturnType<typeof drizzle>;
+    private readonly pool;
+    private readonly options;
+    private readonly retryStrategy;
+    private isShuttingDown;
+    /**
+     * Private constructor to enforce singleton pattern.
+     * Initializes PostgreSQL connection pool and Drizzle ORM instance.
+     *
+     * @param options - Optional configuration for the connection
+     * @throws {Error} If database initialization fails after all retries
+     */
+    private constructor();
+    /**
+     * Gets the singleton instance of the Connection class.
+     * Creates a new instance if one doesn't exist.
+     *
+     * @param options - Optional configuration (only used on first call)
+     * @returns The singleton Connection instance
+     */
+    static getInstance(options?: ConnectionOptions): Connection;
+    /**
+     * Resets the singleton instance.
+     * Useful for testing or reconfiguring the connection.
+     *
+     * @param closeExisting - Whether to close existing connection before reset
+     */
+    static reset(closeExisting?: boolean): Promise<void>;
+    /**
+     * Tests the database connection
+     *
+     * @returns Promise that resolves to true if connection is healthy
+     */
+    testConnection(): Promise<boolean>;
+    /**
+     * Gets connection pool statistics
+     *
+     * @returns Current connection pool statistics
+     */
+    getStats(): ConnectionStats;
+    /**
+     * Closes the database connection pool gracefully.
+     * Should be called during application shutdown.
+     *
+     * @param timeout - Maximum time to wait for connections to close (ms)
+     * @returns Promise that resolves when pool is closed
+     */
+    close(timeout?: number): Promise<void>;
+    /**
+     * Checks if the connection is shutting down
+     *
+     * @returns true if connection is in shutdown state
+     */
+    isClosing(): boolean;
+    /**
+     * Sets up event handlers for the connection pool
+     */
+    private setupEventHandlers;
+    /**
+     * Logs connection configuration (sanitized)
+     */
+    private logConnectionConfig;
+}
+/**
+ * Proxy-based lazy database instance
+ * The actual connection is only created when first accessed
+ *
+ * @example
+ * ```typescript
+ * import { db } from './connection';
+ *
+ * // Connection is created here on first use, not on import
+ * const plugins = await db.select().from(schema.plugin);
+ * ```
+ */
+export declare const db: import("drizzle-orm/node-postgres").NodePgDatabase<Record<string, unknown>> & {
+    $client: Pool;
+};
+/**
+ * Gets the Connection instance for advanced operations
+ *
+ * @example
+ * ```typescript
+ * import { getConnection } from './connection';
+ *
+ * const connection = getConnection();
+ * const stats = connection.getStats();
+ * console.log(`Active connections: ${stats.totalCount}`);
+ * ```
+ */
+export declare function getConnection(): Connection;
+/**
+ * Closes the database connection
+ * Should be called during application shutdown
+ *
+ * @example
+ * ```typescript
+ * import { closeConnection } from './connection';
+ *
+ * process.on('SIGTERM', async () => {
+ *   await closeConnection();
+ *   process.exit(0);
+ * });
+ * ```
+ */
+export declare function closeConnection(): Promise<void>;
+/**
+ * Tests the database connection
+ *
+ * @returns Promise that resolves to true if connection is healthy
+ *
+ * @example
+ * ```typescript
+ * import { testConnection } from './connection';
+ *
+ * if (await testConnection()) {
+ *   console.log('Database is ready');
+ * } else {
+ *   console.error('Database connection failed');
+ *   process.exit(1);
+ * }
+ * ```
+ */
+export declare function testConnection(): Promise<boolean>;