@plakboek/db 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Florian Vanthuyne
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,88 @@
+# @plakboek/db
+
+A Postgres connection factory and a forward-only, lock-safe migration runner
+for Plakboek CMS installations.
+
+## What this package provides
+
+- `createDb` -- a Drizzle (`drizzle-orm/postgres-js`) connection factory
+  over the `postgres` (porsager) driver.
+- `runMigrations` -- applies this package's own statically registered
+  migrations, holding a Postgres advisory lock for the whole run so
+  concurrent migrators can never double-apply (D-03). What Phase 6's deploy
+  step invokes.
+- `withMigrationLock`, `MigrationLockTimeoutError` -- the session-scoped
+  advisory lock primitive `runMigrations` wraps around every run.
+- The migration authoring convention every migration -- this package's own
+  and every host/host-extension migration -- follows: see
+  [`MIGRATIONS.md`](./MIGRATIONS.md).
+
+## Install
+
+```sh
+pnpm add @plakboek/db drizzle-orm
+```
+
+`drizzle-orm` is a peer dependency: bring your own version, matching the
+one this package was built against.
+
+## `createDb`
+
+```ts
+import { createDb } from '@plakboek/db';
+
+const { db, sql, close } = createDb({
+  connectionString: process.env.DATABASE_URL!,
+  maxConnections: 10, // optional, default 10
+});
+
+// db: a drizzle-orm/postgres-js database instance
+// sql: the raw `postgres` tag function, for one-off queries
+await close(); // ends the underlying connection pool
+```
+
+`createDb` validates the connection string's scheme (`postgres://` or
+`postgresql://`) before connecting, and never echoes the supplied value in
+an error -- `DbConfigError` always names the two expected schemes instead.
+
+## `runMigrations`
+
+```ts
+import { runMigrations } from '@plakboek/db';
+
+const result = await runMigrations({
+  connectionString: process.env.DATABASE_URL!,
+  lockWaitMs: 60_000, // optional, default 60000
+  lockPollIntervalMs: 250, // optional, default 250
+});
+
+// result.applied: names of migrations applied by this call
+// result.alreadyApplied: names that were already applied before this call
+```
+
+`runMigrations` is safe to call from every instance of a rolling deploy: it
+opens its own connection, holds the advisory lock for the duration of the
+run, and applies this package's statically registered `MIGRATIONS` in
+order. A second overlapping call either observes the first call's
+migrations as already applied, or throws `MigrationLockTimeoutError` if it
+gives up waiting for the lock before the first call finishes.
+
+`MIGRATIONS` ships empty at `0.1.0` -- no product schema exists before
+Phase 2. See [`MIGRATIONS.md`](./MIGRATIONS.md) for how later phases add to
+it, the transactional-vs-existence-guarded-statement decision, and what
+each thrown error class means.
+
+## Errors
+
+| Class                            | Meaning                                                                                                                       |
+| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| `DbConfigError`                  | `createDb` was given an invalid connection string.                                                                            |
+| `MigrationLockTimeoutError`      | Another migrator still holds the advisory lock after `lockWaitMs`.                                                            |
+| `MigrationRegistryError`         | The migration registry itself is structurally invalid.                                                                        |
+| `MigrationChecksumMismatchError` | An already-applied migration's SQL no longer matches its registry entry -- shipped migrations are immutable.                  |
+| `UnknownAppliedMigrationError`   | The database has a migration applied that the registry no longer contains.                                                    |
+| `MigrationOrderError`            | A new migration was inserted before one already applied -- migrations must never be reordered.                                |
+| `MigrationFailedError`           | A migration's SQL failed to apply; carries the failing statement index (non-transactional) and the original error as `cause`. |
+
+Full detail, including operator guidance per error, lives in
+[`MIGRATIONS.md`](./MIGRATIONS.md#errors).

package/dist/index.d.ts

@@ -0,0 +1,87 @@
+import { Sql } from "postgres";
+import { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import { Client } from "pg";
+//#region src/client.d.ts
+type CreateDbOptions = {
+  readonly connectionString: string;
+  readonly maxConnections?: number;
+};
+type Db = {
+  readonly db: PostgresJsDatabase;
+  readonly sql: Sql;
+  close(): Promise<void>;
+};
+export declare class DbConfigError extends Error {
+  constructor(message: string);
+}
+export declare function createDb(options: CreateDbOptions): Db;
+//#endregion
+//#region src/lock.d.ts
+export declare class MigrationLockTimeoutError extends Error {
+  readonly waitedMs: number;
+  constructor(waitedMs: number);
+}
+type LockOptions = {
+  readonly waitMs?: number;
+  readonly pollIntervalMs?: number;
+};
+//#endregion
+//#region src/migrate.d.ts
+/** One statically registered migration. `sql` is either a single
+ * transaction's worth of SQL (`transactional: true`) or a sequence of
+ * independently-committed, existence-guarded statements separated by
+ * `STATEMENT_BREAKPOINT` (`transactional: false`) -- required for
+ * statements Postgres refuses inside a transaction block. */
+type Migration = {
+  readonly name: string;
+  readonly sql: string;
+  readonly transactional: boolean;
+};
+/** Thrown by `assertValidRegistry` for a structurally invalid registry: an
+ * invalid name, a duplicate name, a non-increasing numeric prefix, or empty
+ * sql. */
+export declare class MigrationRegistryError extends Error {
+  readonly migrationName: string | undefined;
+  constructor(message: string, migrationName?: string);
+}
+/** Thrown when an already-applied migration's checksum no longer matches
+ * its registry entry -- shipped migrations are immutable. */
+export declare class MigrationChecksumMismatchError extends Error {
+  readonly migrationName: string;
+  constructor(migrationName: string);
+}
+/** Thrown when the database has an applied migration the registry no longer
+ * contains -- this package version is older than the applied schema. */
+export declare class UnknownAppliedMigrationError extends Error {
+  readonly migrationName: string;
+  constructor(migrationName: string);
+}
+/** Thrown when the registry's order no longer matches the applied migration
+ * history -- migrations must never be reordered once shipped. */
+export declare class MigrationOrderError extends Error {
+  readonly migrationName: string;
+  constructor(migrationName: string);
+}
+/** Thrown when a migration's SQL fails to apply. `statementIndex` is the
+ * zero-based index of the failing statement for a non-transactional
+ * migration, `undefined` for a transactional one (the whole migration is
+ * one statement as far as failure attribution goes). */
+export declare class MigrationFailedError extends Error {
+  readonly migrationName: string;
+  readonly statementIndex: number | undefined;
+  constructor(migrationName: string, statementIndex: number | undefined, cause: unknown);
+}
+type RunMigrationsOptions = {
+  readonly connectionString: string;
+  readonly lockWaitMs?: number;
+  readonly lockPollIntervalMs?: number;
+};
+type RunMigrationsResult = {
+  readonly applied: readonly string[];
+  readonly alreadyApplied: readonly string[];
+};
+/** Applies the package's own statically registered `MIGRATIONS`. What
+ * Phase 6's deploy step invokes. */
+export declare function runMigrations(options: RunMigrationsOptions): Promise<RunMigrationsResult>;
+//#endregion
+export type { CreateDbOptions, Db, LockOptions, Migration, RunMigrationsOptions, RunMigrationsResult };

package/dist/index.js

@@ -0,0 +1,319 @@
+import postgres from "postgres";
+import { drizzle } from "drizzle-orm/postgres-js";
+import { createHash } from "node:crypto";
+import { Client } from "pg";
+//#region src/client.ts
+var DbConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "DbConfigError";
+	}
+};
+const DEFAULT_MAX_CONNECTIONS = 10;
+const CLOSE_TIMEOUT_SECONDS = 5;
+const POSTGRES_SCHEMES = ["postgres://", "postgresql://"];
+/**
+* Validates the connection string's shape only (scheme prefix). The message
+* never echoes the supplied value (T-01-09) -- it always names the two
+* expected schemes instead.
+*/
+function assertPostgresConnectionString(connectionString) {
+	if (!(typeof connectionString === "string" && connectionString.length > 0 && POSTGRES_SCHEMES.some((scheme) => connectionString.startsWith(scheme)))) throw new DbConfigError("@plakboek/db: connectionString must be a non-empty string starting with \"postgres://\" or \"postgresql://\"");
+}
+function createDb(options) {
+	assertPostgresConnectionString(options.connectionString);
+	const max = options.maxConnections ?? DEFAULT_MAX_CONNECTIONS;
+	const sql = postgres(options.connectionString, { max });
+	return {
+		db: drizzle({ client: sql }),
+		sql,
+		async close() {
+			await sql.end({ timeout: CLOSE_TIMEOUT_SECONDS });
+		}
+	};
+}
+var MigrationLockTimeoutError = class extends Error {
+	waitedMs;
+	constructor(waitedMs) {
+		super(`@plakboek/db: another migrator still holds the migration lock after ${waitedMs}ms`);
+		this.name = "MigrationLockTimeoutError";
+		this.waitedMs = waitedMs;
+	}
+};
+const DEFAULT_WAIT_MS = 6e4;
+const DEFAULT_POLL_INTERVAL_MS = 250;
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function tryAcquire(client) {
+	return (await client.query("SELECT pg_try_advisory_lock($1::bigint) AS locked", ["4839120657231098713"])).rows[0]?.locked ?? false;
+}
+/**
+* Polls `pg_try_advisory_lock` (never a blocking `pg_advisory_lock`) until it
+* succeeds or `waitMs` elapses. A fail-fast try-lock plus bounded polling was
+* chosen over `SET lock_timeout` + a blocking acquire because `lock_timeout`
+* is a session setting: it would persist on this client for every statement
+* run afterwards, including the migrations `withMigrationLock` wraps.
+*/
+async function acquire(client, waitMs, pollIntervalMs) {
+	const start = Date.now();
+	for (;;) {
+		if (await tryAcquire(client)) return;
+		const elapsedMs = Date.now() - start;
+		if (elapsedMs >= waitMs) throw new MigrationLockTimeoutError(elapsedMs);
+		await sleep(pollIntervalMs);
+	}
+}
+async function runGuarded(fn) {
+	try {
+		return {
+			ok: true,
+			value: await fn()
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error
+		};
+	}
+}
+/**
+* Runs `fn` while holding a session-scoped Postgres advisory lock keyed by
+* `MIGRATION_LOCK_KEY`, acquired on the caller-supplied dedicated `client`.
+* Two callers can never be inside `fn` at the same time; a caller that gives
+* up waiting throws `MigrationLockTimeoutError`. If the holding backend
+* crashes or is terminated, Postgres releases the session lock itself, so a
+* waiting caller acquires it without needing this function to run at all.
+*
+* Never issues `SET`/`SET LOCAL` on `client` -- the lock is acquired and
+* released purely via `pg_try_advisory_lock`/`pg_advisory_unlock`, so no
+* session setting (e.g. `lock_timeout`) leaks into statements `fn` runs
+* afterwards on the same client.
+*
+* The unlock query always runs after `fn` settles (success or failure) --
+* this is expressed as unconditional sequential code (not a `try/finally`)
+* so returning `outcome.value` never needs an unsafe cast to narrow `T`.
+*/
+async function withMigrationLock(client, fn, options) {
+	await acquire(client, options?.waitMs ?? DEFAULT_WAIT_MS, options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
+	const outcome = await runGuarded(fn);
+	const unlocked = (await client.query("SELECT pg_advisory_unlock($1::bigint) AS unlocked", ["4839120657231098713"])).rows[0]?.unlocked ?? false;
+	if (outcome.ok) {
+		if (!unlocked) throw new Error("@plakboek/db: migration lock was not held at release -- this indicates a bug in withMigrationLock or an external pg_advisory_unlock call on the same key");
+		return outcome.value;
+	}
+	throw outcome.error;
+}
+//#endregion
+//#region src/migrations/index.ts
+/**
+* The static migration registry for @plakboek/db (D-03).
+*
+* Adding a migration:
+* 1. Create `src/migrations/NNNN_snake_name.ts` exporting a `Migration`
+*    object named `migration`.
+* 2. Add an explicit static `import` for it below.
+* 3. Append it to the `MIGRATIONS` array, in numeric order.
+*
+* Never edit, rename, or reorder a migration once it has shipped -- shipped
+* migrations are immutable (checksum-enforced) and forward-only.
+* Corrections are always a new, higher-numbered migration. See
+* ../../MIGRATIONS.md for the full authoring convention.
+*
+* MIGRATIONS ships empty at 0.1.0: no product table exists before Phase 2
+* introduces the first schema. The runner, bookkeeping table, advisory
+* lock, and every safety check are fully exercised through fixture
+* registries in this package's own tests (tests/fixtures/migrations.ts).
+*/
+const MIGRATIONS = Object.freeze([]);
+//#endregion
+//#region src/migrate.ts
+/**
+* The forward-only, statically registered migration runner (D-03). Every
+* migration is a plain `{ name, sql, transactional }` object explicitly
+* imported into `./migrations/index.ts` -- never discovered by scanning a
+* directory. `runMigrations`/`migrateWithRegistry` hold `./lock.ts`'s
+* session-scoped advisory lock for the whole run, so two concurrent
+* migrators can never double-apply. See ../MIGRATIONS.md for the authoring
+* convention every migration must follow.
+*/
+/** Bookkeeping table created (if missing) by every run. */
+const MIGRATIONS_TABLE = "plakboek_migrations";
+/** The drizzle-kit statement separator: splits a non-transactional
+* migration's `sql` into individually-run statements. */
+const STATEMENT_BREAKPOINT = "--> statement-breakpoint";
+/** Thrown by `assertValidRegistry` for a structurally invalid registry: an
+* invalid name, a duplicate name, a non-increasing numeric prefix, or empty
+* sql. */
+var MigrationRegistryError = class extends Error {
+	migrationName;
+	constructor(message, migrationName) {
+		super(message);
+		this.name = "MigrationRegistryError";
+		this.migrationName = migrationName;
+	}
+};
+/** Thrown when an already-applied migration's checksum no longer matches
+* its registry entry -- shipped migrations are immutable. */
+var MigrationChecksumMismatchError = class extends Error {
+	migrationName;
+	constructor(migrationName) {
+		super(`@plakboek/db: migration "${migrationName}" has already been applied, but its SQL no longer matches -- shipped migrations are immutable, corrections are a new migration`);
+		this.name = "MigrationChecksumMismatchError";
+		this.migrationName = migrationName;
+	}
+};
+/** Thrown when the database has an applied migration the registry no longer
+* contains -- this package version is older than the applied schema. */
+var UnknownAppliedMigrationError = class extends Error {
+	migrationName;
+	constructor(migrationName) {
+		super(`@plakboek/db: database has migration "${migrationName}" applied, but the registry does not contain it -- refusing to proceed`);
+		this.name = "UnknownAppliedMigrationError";
+		this.migrationName = migrationName;
+	}
+};
+/** Thrown when the registry's order no longer matches the applied migration
+* history -- migrations must never be reordered once shipped. */
+var MigrationOrderError = class extends Error {
+	migrationName;
+	constructor(migrationName) {
+		super(`@plakboek/db: registry order does not match applied migration history at "${migrationName}" -- migrations must never be reordered`);
+		this.name = "MigrationOrderError";
+		this.migrationName = migrationName;
+	}
+};
+/** Thrown when a migration's SQL fails to apply. `statementIndex` is the
+* zero-based index of the failing statement for a non-transactional
+* migration, `undefined` for a transactional one (the whole migration is
+* one statement as far as failure attribution goes). */
+var MigrationFailedError = class extends Error {
+	migrationName;
+	statementIndex;
+	constructor(migrationName, statementIndex, cause) {
+		super(`@plakboek/db: migration "${migrationName}" failed${statementIndex === void 0 ? "" : ` at statement index ${statementIndex}`}`, { cause });
+		this.name = "MigrationFailedError";
+		this.migrationName = migrationName;
+		this.statementIndex = statementIndex;
+	}
+};
+const MIGRATION_NAME_PATTERN = /^\d{4}_[a-z0-9_]+$/;
+/** sha256 hex digest of a migration's `sql`, used to detect an edited
+* shipped migration (T-01-30). */
+function migrationChecksum(sql) {
+	return createHash("sha256").update(sql).digest("hex");
+}
+/** Validates registry structure only (name pattern, uniqueness, strictly
+* increasing numeric prefix, non-empty sql) -- never touches a database.
+* Throws `MigrationRegistryError` on the first violation found. */
+function assertValidRegistry(migrations) {
+	const seenNames = /* @__PURE__ */ new Set();
+	let previousPrefix = -1;
+	for (const migration of migrations) {
+		if (!MIGRATION_NAME_PATTERN.test(migration.name)) throw new MigrationRegistryError(`@plakboek/db: migration name "${migration.name}" does not match ${MIGRATION_NAME_PATTERN.source}`, migration.name);
+		if (seenNames.has(migration.name)) throw new MigrationRegistryError(`@plakboek/db: duplicate migration name "${migration.name}"`, migration.name);
+		seenNames.add(migration.name);
+		const prefix = Number.parseInt(migration.name.slice(0, 4), 10);
+		if (prefix <= previousPrefix) throw new MigrationRegistryError(`@plakboek/db: migration "${migration.name}" has a numeric prefix that is not strictly increasing`, migration.name);
+		previousPrefix = prefix;
+		if (migration.sql.trim().length === 0) throw new MigrationRegistryError(`@plakboek/db: migration "${migration.name}" has empty sql`, migration.name);
+	}
+}
+async function ensureBookkeepingTable(client) {
+	await client.query(`CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
+      name text PRIMARY KEY,
+      checksum text NOT NULL,
+      applied_at timestamptz NOT NULL DEFAULT now()
+    )`);
+}
+async function readAppliedRows(client) {
+	return (await client.query(`SELECT name, checksum FROM ${MIGRATIONS_TABLE} ORDER BY applied_at ASC, name ASC`)).rows;
+}
+/** Checks every applied row against the registry (unknown / checksum
+* mismatch) and that the applied names are exactly the registry's prefix,
+* in order -- never lets a reordered or edited history proceed silently. */
+function validateAppliedHistory(appliedRows, migrations) {
+	const byName = new Map(migrations.map((migration) => [migration.name, migration]));
+	for (const row of appliedRows) {
+		const migration = byName.get(row.name);
+		if (!migration) throw new UnknownAppliedMigrationError(row.name);
+		if (migrationChecksum(migration.sql) !== row.checksum) throw new MigrationChecksumMismatchError(row.name);
+	}
+	const appliedNames = appliedRows.map((row) => row.name);
+	const registryPrefix = migrations.slice(0, appliedNames.length);
+	for (const [index, appliedName] of appliedNames.entries()) {
+		const expected = registryPrefix[index];
+		if (!expected || expected.name !== appliedName) throw new MigrationOrderError(appliedName);
+	}
+}
+async function recordApplied(client, migration) {
+	await client.query(`INSERT INTO ${MIGRATIONS_TABLE} (name, checksum) VALUES ($1, $2)`, [migration.name, migrationChecksum(migration.sql)]);
+}
+async function applyTransactional(client, migration) {
+	await client.query("BEGIN");
+	try {
+		await client.query(migration.sql);
+		await recordApplied(client, migration);
+		await client.query("COMMIT");
+	} catch (error) {
+		await client.query("ROLLBACK");
+		throw new MigrationFailedError(migration.name, void 0, error);
+	}
+}
+async function applyNonTransactional(client, migration) {
+	const statements = migration.sql.split(STATEMENT_BREAKPOINT).map((statement) => statement.trim()).filter((statement) => statement.length > 0);
+	for (const [index, statement] of statements.entries()) try {
+		await client.query(statement);
+	} catch (error) {
+		throw new MigrationFailedError(migration.name, index, error);
+	}
+	await recordApplied(client, migration);
+}
+/** Applies every pending migration in `migrations` against `client`, in
+* registry order. Does not acquire any lock -- callers that need
+* concurrency safety use `migrateWithRegistry`. Exported directly so tests
+* can prove the unlocked case has no safety (the negative control). */
+async function applyPendingMigrations(client, migrations) {
+	await ensureBookkeepingTable(client);
+	const appliedRows = await readAppliedRows(client);
+	validateAppliedHistory(appliedRows, migrations);
+	const alreadyApplied = appliedRows.map((row) => row.name);
+	const alreadyAppliedSet = new Set(alreadyApplied);
+	const pending = migrations.filter((migration) => !alreadyAppliedSet.has(migration.name));
+	const applied = [];
+	for (const migration of pending) {
+		if (migration.transactional) await applyTransactional(client, migration);
+		else await applyNonTransactional(client, migration);
+		applied.push(migration.name);
+	}
+	return {
+		applied,
+		alreadyApplied
+	};
+}
+/** Validates `migrations`, opens one `pg.Client`, and runs
+* `applyPendingMigrations` inside `withMigrationLock` -- the primitive
+* `runMigrations` and every test in this package build on. */
+async function migrateWithRegistry(options) {
+	assertValidRegistry(options.migrations);
+	const client = new Client({ connectionString: options.connectionString });
+	await client.connect();
+	try {
+		return await withMigrationLock(client, () => applyPendingMigrations(client, options.migrations), {
+			waitMs: options.lockWaitMs,
+			pollIntervalMs: options.lockPollIntervalMs
+		});
+	} finally {
+		await client.end();
+	}
+}
+/** Applies the package's own statically registered `MIGRATIONS`. What
+* Phase 6's deploy step invokes. */
+async function runMigrations(options) {
+	return await migrateWithRegistry({
+		...options,
+		migrations: MIGRATIONS
+	});
+}
+//#endregion
+export { DbConfigError, MigrationChecksumMismatchError, MigrationFailedError, MigrationLockTimeoutError, MigrationOrderError, MigrationRegistryError, UnknownAppliedMigrationError, createDb, runMigrations };

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@plakboek/db",
+  "version": "0.1.0",
+  "description": "Postgres connection factory and migration-lock primitives for Plakboek CMS installations",
+  "homepage": "https://github.com/flovan/plakboek/tree/main/packages/db#readme",
+  "bugs": {
+    "url": "https://github.com/flovan/plakboek/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/flovan/plakboek.git",
+    "directory": "packages/db"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "pg": "^8.23.0",
+    "postgres": "^3.4.9"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.18.5",
+    "@types/node": "^22.20.2",
+    "@types/pg": "^8.23.1",
+    "drizzle-orm": "^0.45.2",
+    "publint": "^0.3.24",
+    "tsdown": "^0.23.0",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.0"
+  },
+  "peerDependencies": {
+    "drizzle-orm": "^0.45.2"
+  },
+  "engines": {
+    "node": ">=22.16"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "test": "vitest run",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "check": "publint --strict && attw --pack . --profile esm-only"
+  }
+}