@tangle-network/starter-foundry 0.5.4 → 0.7.0

package/registry/layers/framework/hls-origin/files/server.ts

@@ -0,0 +1,83 @@
+// HLS origin control plane.
+//
+// nginx serves the .m3u8 + .ts segments directly (zero-copy sendfile, CORS
+// already handled in nginx.conf). This Node server is the management plane:
+// it reports which streams are currently being transcoded by scanning the
+// shared hls-data volume for stream.m3u8 playlists.
+//
+// Extend with: auth, per-stream start/stop, multi-bitrate ladder selection,
+// webhook fire on stream-start / stream-end events.
+
+import http from 'node:http'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+
+const port = Number(process.env.PORT ?? '{{port}}') || 8099
+const nginxPort = Number(process.env.NGINX_PORT ?? '{{nginxPort}}') || 8080
+const hlsRoot = process.env.HLS_ROOT ?? '/var/www/hls'
+
+interface StreamInfo {
+  name: string
+  playlistUrl: string
+  segmentCount: number
+  lastModifiedMs: number
+}
+
+async function listStreams(): Promise<StreamInfo[]> {
+  let entries: string[]
+  try {
+    entries = await fs.readdir(hlsRoot)
+  } catch {
+    return []
+  }
+  const results: StreamInfo[] = []
+  for (const name of entries) {
+    const dir = path.join(hlsRoot, name)
+    const playlist = path.join(dir, 'stream.m3u8')
+    try {
+      const stat = await fs.stat(playlist)
+      const segments = (await fs.readdir(dir)).filter((f) => f.endsWith('.ts'))
+      results.push({
+        name,
+        playlistUrl: `http://localhost:${nginxPort}/hls/${name}/stream.m3u8`,
+        segmentCount: segments.length,
+        lastModifiedMs: stat.mtimeMs,
+      })
+    } catch {
+      // directory without a playlist yet — stream starting up, skip.
+    }
+  }
+  return results.sort((a, b) => b.lastModifiedMs - a.lastModifiedMs)
+}
+
+const server = http.createServer(async (req, res) => {
+  const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`)
+  res.setHeader('content-type', 'application/json')
+
+  if (req.method === 'GET' && url.pathname === '/health') {
+    res.end(
+      JSON.stringify({
+        status: 'ok',
+        service: '{{serviceName}}',
+        hlsRoot,
+        nginxPort,
+      }),
+    )
+    return
+  }
+
+  if (req.method === 'GET' && url.pathname === '/streams') {
+    const streams = await listStreams()
+    res.end(JSON.stringify({ streams }))
+    return
+  }
+
+  res.statusCode = 404
+  res.end(JSON.stringify({ error: 'not found' }))
+})
+
+server.listen(port, () => {
+  console.log(`{{serviceName}} control plane on http://localhost:${port}`)
+  console.log(`  HLS segments:    http://localhost:${nginxPort}/hls/<name>/stream.m3u8`)
+  console.log(`  List streams:    GET  /streams`)
+})

package/registry/layers/framework/hls-origin/manifest.json

@@ -0,0 +1,72 @@
+{
+  "id": "hls-origin",
+  "description": "HLS origin control plane — Node HTTP server that lists active streams by scanning the shared hls-data volume for stream.m3u8 playlists.",
+  "appliesTo": ["hls-origin"],
+  "files": [
+    {
+      "source": "files/server.ts",
+      "target": "src/server.ts"
+    }
+  ],
+  "packageDeps": {
+    "devDependencies": {
+      "@types/node": "^20.17.0",
+      "tsx": "^4.19.2",
+      "typescript": "^5.9.0"
+    }
+  },
+  "buildHints": {
+    "whenToUse": "Any project that needs an HLS live-streaming origin: self-hosted Twitch-style ingest, live event broadcasting, video CDN origin, or multi-stream monitoring dashboards. Use when you need a segmented .m3u8 playlist that browsers can pull directly.",
+    "firstSteps": [
+      "Run `pnpm install` then `docker compose up -d` — nginx starts on port {{nginxPort}}, the ffmpeg container stays idle waiting for streams.",
+      "Run `pnpm dev` to start the control plane on port {{port}}. GET /health confirms the server and volume config. GET /streams lists active HLS streams.",
+      "Run `./start-stream.sh testsrc demo` to transcode a synthetic test pattern — segments appear in the shared hls-data volume immediately.",
+      "Open `http://localhost:{{nginxPort}}/hls/demo/stream.m3u8` in Safari or an hls.js player to confirm the live stream.",
+      "Extend `src/server.ts` to add per-stream start/stop endpoints, auth middleware, or webhook callbacks on stream-start/stream-end events."
+    ],
+    "gotchas": [
+      "Segment duration is a latency/stability tradeoff — 2s segments give ~6s glass-to-glass latency with a 3-segment buffer; shorter segments reduce latency at the cost of more playlist churn and higher buffering risk on flaky networks.",
+      "Browsers require CORS on both the playlist AND every segment. The nginx.conf adds Access-Control-Allow-Origin to .m3u8 and .ts responses — removing either header breaks HLS.js.",
+      "Safari plays HLS natively; Chrome/Firefox need hls.js. Feature-detect with `video.canPlayType('application/vnd.apple.mpegurl')` — non-empty means native, otherwise bundle hls.js.",
+      "ffmpeg's `-hls_flags delete_segments` is mandatory for a rolling window — without it the origin fills disk with every 2s segment ever transcoded.",
+      "RTMP ingest is TCP port 1935, plaintext. Put nginx-rtmp or srtrelay in front for auth/TLS; the ffmpeg container here assumes a trusted ingest source.",
+      "libx264 in start-stream.sh is CPU-bound and single-stream. For production scale use h264_videotoolbox (macOS) or h264_nvenc (NVIDIA) by passing a custom FFMPEG_EXTRA_ARGS environment variable."
+    ],
+    "architectureNotes": [
+      "nginx and ffmpeg share the hls-data named volume — ffmpeg writes .ts segments and .m3u8 playlists, nginx reads them with sendfile(). The Node server never touches media data.",
+      "The Node control plane is a management API only: it scans the hls-data volume for active playlists and exposes them over HTTP. Keep media delivery on nginx, not Node.",
+      "Each stream is a sub-directory of /var/www/hls/ — stream name maps directly to the URL path: /hls/<name>/stream.m3u8. This makes per-stream isolation trivial."
+    ],
+    "placeholders": [
+      {
+        "path": "src/server.ts",
+        "description": "Template variables {{port}}, {{nginxPort}}, {{serviceName}} are replaced at compose time. The /health and /streams routes are fully wired — add auth, per-stream lifecycle endpoints, or webhook hooks here."
+      }
+    ]
+  },
+  "contextHints": {
+    "commands": [
+      "pnpm install",
+      "docker compose up -d",
+      "pnpm dev",
+      "./start-stream.sh testsrc demo",
+      "./start-stream.sh <input-file-or-rtmp-url> <stream-name>",
+      "open http://localhost:{{nginxPort}}/hls/demo/stream.m3u8",
+      "pnpm run validate"
+    ],
+    "entrypoints": [
+      "src/server.ts",
+      "nginx.conf",
+      "start-stream.sh",
+      "docker-compose.yml"
+    ],
+    "preview": {
+      "path": "/health"
+    },
+    "extensionPoints": [
+      "src/server.ts",
+      "nginx.conf",
+      "start-stream.sh"
+    ]
+  }
+}

package/registry/layers/framework/hugo-static/files/_index.md

@@ -0,0 +1,18 @@
+---
+title: "Starter Foundry Hugo"
+---
+
+Hugo content site with minimal theme.
+
+Drop posts under `content/posts/` as Markdown files with YAML front matter:
+
+```markdown
+---
+title: "My First Post"
+date: 2024-01-01
+draft: false
+---
+Post body here.
+```
+
+Layouts override in `layouts/_default/` and page-specific templates live under `layouts/<section>/`.

package/registry/layers/framework/hugo-static/files/baseof.html

@@ -0,0 +1,22 @@
+<!doctype html>
+<html lang="{{ .Site.LanguageCode }}">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{{ .Title | default .Site.Title }}</title>
+    <style>
+      body { font-family: ui-sans-serif, system-ui, sans-serif; max-width: 720px; margin: 2rem auto; padding: 0 1rem; color: #0f172a; }
+      header { border-bottom: 1px solid #e2e8f0; margin-bottom: 1.5rem; padding-bottom: 1rem; }
+      h1 { margin: 0 0 .25rem; }
+    </style>
+  </head>
+  <body>
+    <header>
+      <h1>{{ .Site.Title }}</h1>
+      <p>{{ .Site.Params.subtitle }}</p>
+    </header>
+    <main>
+      {{ block "main" . }}{{ end }}
+    </main>
+  </body>
+</html>

package/registry/layers/framework/hugo-static/files/index.html

@@ -0,0 +1,13 @@
+{{ define "main" }}
+  <article>
+    {{ .Content }}
+    {{ with .Site.RegularPages }}
+      <h2>Posts</h2>
+      <ul>
+        {{ range . }}
+          <li><a href="{{ .RelPermalink }}">{{ .Title }}</a></li>
+        {{ end }}
+      </ul>
+    {{ end }}
+  </article>
+{{ end }}

package/registry/layers/framework/hugo-static/files/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "hugo-static-scaffold",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "hugo server -D --port 1313",
+    "build": "hugo --minify",
+    "preview": "hugo server --minify --port 1313"
+  },
+  "devDependencies": {
+    "hugo-extended": "^0.127.0"
+  }
+}

package/registry/layers/framework/hugo-static/manifest.json

@@ -0,0 +1,70 @@
+{
+  "id": "hugo-static",
+  "description": "Hugo framework layer — _default baseof layout, home template, and index content; boots with `pnpm dev` after install.",
+  "appliesTo": ["hugo-static"],
+  "files": [
+    { "source": "files/baseof.html", "target": "layouts/_default/baseof.html" },
+    { "source": "files/index.html", "target": "layouts/index.html" },
+    { "source": "files/_index.md", "target": "content/_index.md" },
+    { "source": "files/package.json", "target": "package.json" },
+    { "source": "files/.gitignore", "target": ".gitignore" }
+  ],
+  "packageDeps": {
+    "devDependencies": {
+      "hugo-extended": "^0.127.0"
+    }
+  },
+  "buildHints": {
+    "whenToUse": "Content-heavy static sites, blogs, documentation hubs, and marketing pages where Go template layouts and sub-second build times are the primary constraint.",
+    "firstSteps": [
+      "Run `pnpm install` to fetch the Hugo binary via the `hugo-extended` npm wrapper, then `pnpm dev` — Hugo serves on port 1313 with live reload.",
+      "`config.toml` at the project root controls the site title, baseURL, and params. Edit `params.subtitle` to update the subheading rendered in `baseof.html`.",
+      "Drop Markdown posts under `content/posts/` with YAML front matter (`title`, `date`, `draft: false`). They appear automatically in the home page list via `{{ .Site.RegularPages }}`.",
+      "Override a single-page template by creating `layouts/_default/single.html` with a `{{ define \"main\" }}` block — it inherits the chrome from `baseof.html`.",
+      "Run `pnpm build` to emit minified output to `public/` — deploy that directory to any static host (Netlify, Cloudflare Pages, GitHub Pages)."
+    ],
+    "gotchas": [
+      "Hugo's live-reload snippet is injected by `hugo server -D` only; it is stripped from `pnpm build` output — do not reference it in templates.",
+      "The `{{ with .Site.RegularPages }}` block in `layouts/index.html` lists only published pages. Set `draft: false` in front matter or pass `-D` to the server to see drafts.",
+      "`config.toml` `baseURL` must end with `/` and match the deployment domain; relative URLs break RSS and canonical tags when it does not.",
+      "Hugo template errors surface as blank output, not runtime panics. Add `{{ warnf \"%v\" . }}` in a template to inspect the data context during development."
+    ],
+    "architectureNotes": [
+      "Layout lookup: `layouts/<type>/<kind>.html` → `layouts/_default/<kind>.html` → `baseof.html`. Every page type only needs to define `{{ define \"main\" }}`; the surrounding chrome comes from `baseof.html`.",
+      "Content files in `content/` are data; layouts in `layouts/` are views. Keep reusable markup in `layouts/partials/` rather than inlining it in page templates."
+    ],
+    "placeholders": [
+      {
+        "path": "content/_index.md",
+        "description": "Home page content — replace the body text with real copy. The front matter `title` matches the site title in `config.toml` by convention."
+      },
+      {
+        "path": "layouts/index.html",
+        "description": "Home page template — wraps `.Content` from `content/_index.md` and lists all regular pages. Add section-specific markup or shortcodes here."
+      }
+    ]
+  },
+  "contextHints": {
+    "commands": [
+      "pnpm install",
+      "pnpm dev",
+      "pnpm build"
+    ],
+    "entrypoints": [
+      "config.toml",
+      "layouts/_default/baseof.html",
+      "layouts/index.html",
+      "content/_index.md"
+    ],
+    "preview": {
+      "port": "1313",
+      "path": "/"
+    },
+    "extensionPoints": [
+      "layouts/partials/",
+      "layouts/_default/single.html",
+      "content/posts/",
+      "static/"
+    ]
+  }
+}

package/registry/layers/framework/jupyter-book/files/chapter-1.md

@@ -0,0 +1,30 @@
+---
+jupytext:
+  text_representation:
+    extension: .md
+    format_name: myst
+kernelspec:
+  display_name: Python 3
+  language: python
+  name: python3
+---
+
+# Chapter 1: Your first executable chapter
+
+This chapter is written in [MyST Markdown](https://mystmd.org/). It can
+embed executable code blocks that Jupyter Book runs at build time.
+
+```{code-cell} python
+import numpy as np
+import matplotlib.pyplot as plt
+
+x = np.linspace(0, 2 * np.pi, 256)
+plt.plot(x, np.sin(x))
+plt.title("sin(x) on [0, 2π]")
+plt.tight_layout()
+plt.show()
+```
+
+Swap this for real content, or add a `.ipynb` file and list it in
+`_toc.yml`. Anything in a code cell runs under the Python environment
+from `requirements.txt`.

package/registry/layers/framework/jupyter-book/manifest.json

@@ -0,0 +1,63 @@
+{
+  "id": "jupyter-book",
+  "description": "Jupyter Book framework layer — seeds content/chapter-1.md with a MyST executable code cell wired into the book's _toc.yml; NumPy and Matplotlib deps are already in requirements.txt.",
+  "appliesTo": ["jupyter-book"],
+  "files": [
+    {
+      "source": "files/chapter-1.md",
+      "target": "content/chapter-1.md"
+    }
+  ],
+  "buildHints": {
+    "whenToUse": "Scientific documentation, course notes, research reports, or any project that publishes executable notebooks as a navigable multi-page website. Jupyter Book renders MyST Markdown and .ipynb files via Sphinx; outputs include static HTML and optionally LaTeX/PDF.",
+    "firstSteps": [
+      "Install deps: `pip install -r requirements.txt` (installs jupyter-book, numpy, matplotlib).",
+      "Build the book: `jupyter-book build .` — HTML lands in `_build/html/`.",
+      "Preview locally: `python -m http.server --directory _build/html 8098` then open http://localhost:8098.",
+      "Validate the scaffold: `node validate-jupyter-book.mjs` — prints 'jupyter-book starter ok' when all required files are present.",
+      "Add more content: create `.md` or `.ipynb` files under `content/`, then list them as chapters in `_toc.yml`."
+    ],
+    "gotchas": [
+      "`.md` files that use `{code-cell}` directives must carry a YAML front matter block with `kernelspec` (see `chapter-1.md`). Without it Jupyter Book treats the blocks as static fenced code and skips execution entirely.",
+      "`execute_notebooks: auto` in `_config.yml` runs code cells at build time — if NumPy or Matplotlib are missing from `requirements.txt` the build fails with a kernel error. Keep pip deps in sync with imports.",
+      "The `_toc.yml` `root:` field must be a file path without extension; it points to `content/intro`, not `content/intro.md`.",
+      "`{{headline}}` and `{{author}}` in `_config.yml` are template placeholders substituted at compose time — do not hard-code values there.",
+      "Jupyter Book caches notebook outputs in `_build/`; delete that directory when switching Python environments or after adding new packages to avoid stale kernel state.",
+      "The validator (`validate-jupyter-book.mjs`) requires Node.js — it checks structure only, not Python execution. Run `pip install -r requirements.txt` separately before the full `jupyter-book build`."
+    ],
+    "architectureNotes": [
+      "All navigable pages are listed in `_toc.yml`; `_config.yml` sets global metadata, Sphinx extensions, and HTML theme options.",
+      "MyST Markdown (`.md`) and Jupyter Notebooks (`.ipynb`) are first-class citizens — mix them freely in `content/`.",
+      "The `execute_notebooks: auto` policy only re-runs cells when source has changed (Jupyter Book caches results); for reproducibility pin all package versions in `requirements.txt`."
+    ],
+    "placeholders": [
+      {
+        "path": "content/chapter-1.md",
+        "description": "Demo chapter with a NumPy/Matplotlib code cell. Replace with real content or swap for a .ipynb notebook. If keeping it as a .md file with {code-cell} directives, preserve the YAML front matter (jupytext + kernelspec blocks) — removing it silences execution. Ensure the file is listed in _toc.yml."
+      }
+    ]
+  },
+  "contextHints": {
+    "commands": [
+      "pip install -r requirements.txt",
+      "jupyter-book build .",
+      "python -m http.server --directory _build/html 8098",
+      "node validate-jupyter-book.mjs"
+    ],
+    "entrypoints": [
+      "_config.yml",
+      "_toc.yml",
+      "content/intro.md",
+      "content/chapter-1.md"
+    ],
+    "preview": {
+      "port": "8098",
+      "path": "/"
+    },
+    "extensionPoints": [
+      "content/",
+      "_toc.yml",
+      "requirements.txt"
+    ]
+  }
+}

package/registry/layers/framework/k12-edtech/files/README.md

@@ -0,0 +1,79 @@
+# K-12 SIS / Gradebook API
+
+K-12 student information system and gradebook REST API with a FERPA-aligned audit trail. Built with Node.js (no framework), Drizzle ORM, and PostgreSQL.
+
+## Prerequisites
+
+- Node.js ≥ 22.12 (required for `--experimental-strip-types` and `node:module/stripTypeScriptTypes`)
+- PostgreSQL database
+- pnpm
+
+## Quick start
+
+```sh
+# 1. Install dependencies
+pnpm install
+
+# 2. Point at a Postgres database
+export DATABASE_URL="postgres://user:pass@localhost:5432/k12_dev"
+
+# 3. Generate + apply migrations
+pnpm db:generate
+pnpm db:migrate
+
+# 4. Start the dev server (hot-reload via --watch)
+pnpm dev
+# → listening on port 8103
+
+# 5. Verify the scaffold
+curl http://localhost:8103/health
+# → {"status":"ok","service":"starter-foundry-k12"}
+```
+
+## Typecheck
+
+```sh
+npx tsc --noEmit
+```
+
+No build step is needed — the server runs TypeScript directly via Node's strip-types loader.
+
+## API routes
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/health` | Liveness check |
+| POST | `/api/classes` | Create a class (requires `teacherId`) |
+| GET | `/api/classes/:id/roster` | Active enrollments for a class |
+| POST | `/api/classes/:id/assignments` | Create an assignment |
+| POST | `/api/assignments/:id/submissions` | Submit work for an assignment |
+| POST | `/api/submissions/:id/grade` | Grade a submission (teacher/admin only) |
+| GET | `/api/students/:id/grades` | Fetch a student's grades — **FERPA audit-logged** |
+
+Pass actor identity on every request via headers:
+- `x-actor-id`: actor UUID (teacher UUID or parent UUID)
+- `x-actor-role`: `teacher` | `admin` | `parent` | `student`
+- `x-access-reason` *(optional)*: free-text reason recorded in the audit log
+
+## Data model
+
+`Student → Enrollment → Class ← Teacher`  
+`Enrollment → Assignment → Submission → Grade`  
+`Parent → ParentStudent → Student`  
+`GradeAccessLog` — one row written **before** each grade disclosure (FERPA §99.32)
+
+## FERPA notes
+
+- Every call to `GET /api/students/:id/grades` writes a `GradeAccessLog` row before returning data. **Do not remove or async-detach this write.**
+- Parent access is gated by `ParentStudent.canAccessGrades` AND `ParentStudent.custodialRights`. Non-custodial parents must have `custodialRights = false`.
+- Grades are immutable: amendments are new `Grade` rows with `amendmentOfGradeId` pointing to the prior row, never `UPDATE`s.
+- Student PII (names, grades) must not appear in stdout logs or error-tracking payloads.
+
+## Extending
+
+| What | Where |
+|------|-------|
+| Add tables | `src/db/schema.ts` |
+| New API routes | `src/api/` + wire in `src/server.ts` |
+| SIS import adapter (OneRoster / Clever) | `src/sis/` |
+| Background jobs (grade aggregation, reports) | `src/jobs/` |

package/registry/layers/framework/k12-edtech/files/classroom.ts

@@ -0,0 +1,119 @@
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { and, eq, isNull } from 'drizzle-orm'
+import { db } from '../db/client.ts'
+import { assignments, classes, enrollments, students, submissions } from '../db/schema.ts'
+
+async function readJsonBody(request: IncomingMessage): Promise<unknown> {
+  const chunks: Buffer[] = []
+  for await (const chunk of request) chunks.push(chunk as Buffer)
+  const raw = Buffer.concat(chunks).toString('utf8')
+  return raw ? JSON.parse(raw) : null
+}
+
+export async function createClass(request: IncomingMessage, response: ServerResponse) {
+  const body = (await readJsonBody(request)) as {
+    code?: string
+    title?: string
+    subject?: string
+    academicYear?: string
+    term?: string
+    teacherId?: string
+  } | null
+  if (!body?.code || !body.title || !body.subject || !body.academicYear || !body.term || !body.teacherId) {
+    response.writeHead(422, { 'content-type': 'application/json' })
+    response.end(JSON.stringify({ error: 'code, title, subject, academicYear, term, teacherId required' }))
+    return
+  }
+  const [row] = await db
+    .insert(classes)
+    .values({
+      code: body.code,
+      title: body.title,
+      subject: body.subject,
+      academicYear: body.academicYear,
+      term: body.term,
+      teacherId: body.teacherId,
+    })
+    .returning()
+  response.writeHead(201, { 'content-type': 'application/json' })
+  response.end(JSON.stringify(row))
+}
+
+export async function classRoster(
+  _request: IncomingMessage,
+  response: ServerResponse,
+  classId: string,
+) {
+  const rows = await db
+    .select({
+      enrollmentId: enrollments.id,
+      studentId: students.id,
+      firstName: students.firstName,
+      lastName: students.lastName,
+      grade: students.grade,
+      enrolledAt: enrollments.enrolledAt,
+    })
+    .from(enrollments)
+    .innerJoin(students, eq(enrollments.studentId, students.id))
+    .where(and(eq(enrollments.classId, classId), isNull(enrollments.droppedAt)))
+  response.writeHead(200, { 'content-type': 'application/json' })
+  response.end(JSON.stringify({ classId, roster: rows }))
+}
+
+export async function createAssignment(
+  request: IncomingMessage,
+  response: ServerResponse,
+  classId: string,
+) {
+  const body = (await readJsonBody(request)) as {
+    title?: string
+    description?: string
+    totalPoints?: number
+    dueAt?: string
+  } | null
+  if (!body?.title || typeof body.totalPoints !== 'number') {
+    response.writeHead(422, { 'content-type': 'application/json' })
+    response.end(JSON.stringify({ error: 'title and totalPoints required' }))
+    return
+  }
+  const [row] = await db
+    .insert(assignments)
+    .values({
+      classId,
+      title: body.title,
+      description: body.description ?? null,
+      totalPoints: body.totalPoints,
+      dueAt: body.dueAt ? new Date(body.dueAt) : null,
+    })
+    .returning()
+  response.writeHead(201, { 'content-type': 'application/json' })
+  response.end(JSON.stringify(row))
+}
+
+export async function submitAssignment(
+  request: IncomingMessage,
+  response: ServerResponse,
+  assignmentId: string,
+) {
+  const body = (await readJsonBody(request)) as {
+    studentId?: string
+    content?: string
+    attachments?: Array<{ uri: string; filename: string }>
+  } | null
+  if (!body?.studentId) {
+    response.writeHead(422, { 'content-type': 'application/json' })
+    response.end(JSON.stringify({ error: 'studentId required' }))
+    return
+  }
+  const [row] = await db
+    .insert(submissions)
+    .values({
+      assignmentId,
+      studentId: body.studentId,
+      content: body.content ?? null,
+      attachments: body.attachments ?? [],
+    })
+    .returning()
+  response.writeHead(201, { 'content-type': 'application/json' })
+  response.end(JSON.stringify(row))
+}

package/registry/layers/framework/k12-edtech/files/db.ts

@@ -0,0 +1,8 @@
+import postgres from 'postgres'
+import { drizzle } from 'drizzle-orm/postgres-js'
+import * as schema from './schema.ts'
+
+const url = process.env.DATABASE_URL
+if (!url) throw new Error('DATABASE_URL is required')
+const client = postgres(url, { ssl: 'prefer', max: 10 })
+export const db = drizzle(client, { schema })

package/registry/layers/framework/k12-edtech/files/drizzle.config.ts

@@ -0,0 +1,9 @@
+import type { Config } from 'drizzle-kit'
+
+export default {
+  schema: './src/db/schema.ts',
+  out: './drizzle',
+  dialect: 'postgresql',
+  dbCredentials: { url: process.env.DATABASE_URL ?? '' },
+  strict: true,
+} satisfies Config