@tangle-network/starter-foundry 0.5.4 → 0.7.2

package/registry/layers/framework/healthcare-hipaa-backend/files/encounters.ts

@@ -0,0 +1,89 @@
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { eq } from 'drizzle-orm'
+import { db } from '../db/client.ts'
+import { encounters } from '../db/schema.ts'
+import { decryptPhi, encryptPhi } from '../encryption.ts'
+import { withPhiAccess } from './phi-access.ts'
+
+async function readJsonBody(request: IncomingMessage): Promise<unknown> {
+  const chunks: Buffer[] = []
+  for await (const chunk of request) chunks.push(chunk as Buffer)
+  const raw = Buffer.concat(chunks).toString('utf8')
+  return raw ? JSON.parse(raw) : null
+}
+
+export const getEncounter = withPhiAccess(
+  'read',
+  'encounter',
+  (request) => {
+    const url = new URL(request.url ?? '', 'http://localhost')
+    return url.pathname.split('/').pop() ?? null
+  },
+  async (_request, response, ctx) => {
+    if (!ctx.resourceId) {
+      response.writeHead(400, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'encounter id required' }))
+      return
+    }
+    const rows = await db.select().from(encounters).where(eq(encounters.id, ctx.resourceId)).limit(1)
+    const row = rows[0]
+    if (!row) {
+      response.writeHead(404, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'encounter not found' }))
+      return
+    }
+    // Billing role sees codes for claims but not clinical notes (minimum-necessary).
+    const body: Record<string, unknown> = {
+      id: row.id,
+      patientId: row.patientId,
+      providerId: row.providerId,
+      encounteredAt: row.encounteredAt,
+      cptCode: row.cptCode,
+      icd10Codes: row.icd10Codes,
+    }
+    if (ctx.actor.role === 'clinician' || ctx.actor.role === 'admin') {
+      body.notes = decryptPhi(row.encryptedNotes)
+    }
+    response.writeHead(200, { 'content-type': 'application/json' })
+    response.end(JSON.stringify(body))
+  },
+)
+
+export const createEncounter = withPhiAccess(
+  'create',
+  'encounter',
+  () => null,
+  async (request, response, ctx) => {
+    if (ctx.actor.role !== 'clinician' && ctx.actor.role !== 'admin') {
+      response.writeHead(403, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'only clinicians can create encounters' }))
+      return
+    }
+    const body = (await readJsonBody(request)) as {
+      patientId?: string
+      providerId?: string
+      encounteredAt?: string
+      notes?: string
+      cptCode?: string
+      icd10Codes?: string[]
+    } | null
+    if (!body?.patientId || !body.providerId || !body.encounteredAt) {
+      response.writeHead(422, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'patientId, providerId, encounteredAt required' }))
+      return
+    }
+    const [inserted] = await db
+      .insert(encounters)
+      .values({
+        patientId: body.patientId,
+        providerId: body.providerId,
+        encounteredAt: new Date(body.encounteredAt),
+        encryptedNotes: encryptPhi(body.notes ?? null),
+        cptCode: body.cptCode ?? null,
+        icd10Codes: body.icd10Codes ?? [],
+      })
+      .returning({ id: encounters.id })
+    response.writeHead(201, { 'content-type': 'application/json' })
+    response.end(JSON.stringify(inserted))
+  },
+)

package/registry/layers/framework/healthcare-hipaa-backend/files/encryption.ts

@@ -0,0 +1,69 @@
+// Field-level PHI encryption using AES-256-GCM.
+//
+// Wire format (bytea stored in Postgres):
+//   [12-byte IV][16-byte GCM tag][N-byte ciphertext]
+//
+// Key sourcing:
+//   Dev: PHI_ENCRYPTION_KEY env — 64-char hex (32 bytes) OR 44-char base64.
+//   Prod: rotate via envelope encryption with a KMS (AWS KMS, GCP KMS,
+//         HashiCorp Vault). This module accepts a raw 32-byte key; the
+//         KMS wrapping belongs in src/kms.ts (add when you wire prod).
+//
+// The random IV per encryption is REQUIRED for AES-GCM security. Reusing
+// IV + key on different plaintexts breaks confidentiality and lets an
+// attacker recover both plaintexts from the keystream XOR.
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
+
+const ALGO = 'aes-256-gcm'
+const IV_LEN = 12
+const TAG_LEN = 16
+
+function loadKey(): Buffer {
+  const raw = process.env['PHI_ENCRYPTION_KEY']
+  if (!raw) {
+    throw new Error(
+      'PHI_ENCRYPTION_KEY is not set — refusing to start. ' +
+        'Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"',
+    )
+  }
+  let key: Buffer
+  if (/^[0-9a-fA-F]{64}$/.test(raw)) {
+    key = Buffer.from(raw, 'hex')
+  } else {
+    key = Buffer.from(raw, 'base64')
+  }
+  if (key.length !== 32) {
+    throw new Error(`PHI_ENCRYPTION_KEY must be 32 bytes (got ${key.length}). Use hex or base64.`)
+  }
+  return key
+}
+
+let cachedKey: Buffer | null = null
+function key(): Buffer {
+  if (!cachedKey) cachedKey = loadKey()
+  return cachedKey
+}
+
+/** Encrypt a string as a bytea payload. Returns null for null/undefined input so optional columns stay null. */
+export function encryptPhi(plaintext: string | null | undefined): Buffer | null {
+  if (plaintext == null) return null
+  const iv = randomBytes(IV_LEN)
+  const cipher = createCipheriv(ALGO, key(), iv)
+  const ct = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
+  const tag = cipher.getAuthTag()
+  return Buffer.concat([iv, tag, ct])
+}
+
+/** Decrypt a bytea payload back to plaintext. Throws on auth-tag mismatch (tampering / wrong key). */
+export function decryptPhi(payload: Buffer | null | undefined): string | null {
+  if (payload == null) return null
+  if (payload.length < IV_LEN + TAG_LEN + 1) {
+    throw new Error('encrypted payload too short — is this an AES-GCM blob?')
+  }
+  const iv = payload.subarray(0, IV_LEN)
+  const tag = payload.subarray(IV_LEN, IV_LEN + TAG_LEN)
+  const ct = payload.subarray(IV_LEN + TAG_LEN)
+  const decipher = createDecipheriv(ALGO, key(), iv)
+  decipher.setAuthTag(tag)
+  return Buffer.concat([decipher.update(ct), decipher.final()]).toString('utf8')
+}

package/registry/layers/framework/healthcare-hipaa-backend/files/hipaa.md

@@ -0,0 +1,65 @@
+# HIPAA compliance surface for starter-foundry-healthcare
+
+This file is the committed record of the compliance controls this scaffold
+implements. It is NOT a legal document — work with counsel before storing real
+PHI. Before shipping, every checkbox below must be a real Yes.
+
+## Technical safeguards (45 CFR 164.312)
+
+| Control | Scaffold implementation | Production gap |
+| ------- | ---------------------- | -------------- |
+| Access control — unique user ID (a)(2)(i) | X-Actor-Id header; real auth layer in `auth:` slot | Wire Clerk/better-auth/mTLS |
+| Automatic logoff (a)(2)(iii) | Session TTL set in auth layer | Verify in prod config |
+| Encryption at rest (a)(2)(iv) | AES-256-GCM via `src/encryption.ts`, one random IV per field | Move key to KMS (envelope encryption) |
+| Audit controls (b) | Append-only `audit_logs` + trigger blocks UPDATE/DELETE | Ship logs to SIEM with 6-year retention |
+| Integrity controls (c)(2) | GCM auth tag on every PHI field | N/A |
+| Transmission security (e)(1) | Postgres `ssl: 'require'` in `src/db/client.ts` | Terminate TLS 1.2+ at ingress; disable HTTP |
+
+## Administrative safeguards (45 CFR 164.308)
+
+- **BAA with every subprocessor** before real PHI is stored. List: cloud provider, managed Postgres, email, error tracking, APM, log aggregator, CI provider.
+- **Workforce training** on phishing, ePHI handling, breach reporting.
+- **Incident response plan** with breach notification paths (HHS + affected individuals within 60 days per 164.404).
+- **Risk analysis** documented annually; re-run after any architecture change.
+
+## Physical safeguards (45 CFR 164.310)
+
+- Production PHI only in HIPAA-eligible cloud regions with BAAs in place.
+- No PHI on developer laptops. Staging + dev use synthetic data only.
+
+## Minimum-necessary rule (164.502(b))
+
+API responses are filtered by actor role:
+
+- `clinician`, `admin` — full PHI
+- `billing` — codes + demographics, NO notes / NO SSN
+- `patient` — own records only (enforce via resource-ownership check in the handler — this starter does NOT implement that)
+
+## Audit log invariants
+
+- Every read of a patient or encounter writes one row BEFORE the response is sent.
+- `audit_logs` has NO UPDATE / DELETE grants in production. The migration sets up a trigger that raises on attempts.
+- Audit rows include `actorId`, `actorRole`, `action`, `resourceType`, `resourceId`, `reason`, `ipAddress`, `userAgent`, `occurredAt`.
+
+## Break-glass & deletion
+
+- HIPAA right of access (164.524): implement `GET /api/patients/:id/export` (not shipped in starter — add per your workflow).
+- Right to amend (164.526) — use an `amendments` table referencing the original encounter; do NOT overwrite.
+- Accounting of disclosures (164.528) — the audit log already satisfies this.
+
+## Cryptographic key management
+
+- `PHI_ENCRYPTION_KEY` is a 32-byte key (hex or base64 encoded).
+- Rotate annually or after suspected compromise. Rotation strategy:
+  1. Load old key + new key.
+  2. Re-encrypt each PHI column in a background job.
+  3. Remove old key from secret store.
+- In production, use envelope encryption: a per-tenant data key encrypted by a KMS CMK. Replace `loadKey()` in `src/encryption.ts` with a KMS-backed resolver.
+
+## What this scaffold does NOT do
+
+- No row-level security. Add Postgres RLS policies per-tenant before multi-tenant prod.
+- No API rate limiting. Enumeration attacks on `/api/patients/:id` are cheap without it.
+- No patient-portal auth flow. Use the `auth:` slot + add a resource-ownership check.
+- No BAA with any subprocessor. That's a business / legal step.
+- No PHI export pipeline. Design per your workflow.

package/registry/layers/framework/healthcare-hipaa-backend/files/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "{{packageName}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "node --watch --experimental-strip-types src/server.ts",
+    "start": "node --experimental-strip-types src/server.ts",
+    "typecheck": "tsc --noEmit",
+    "validate": "node validate-hipaa.mjs",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate"
+  },
+  "dependencies": {
+    "drizzle-orm": "^0.36.0",
+    "postgres": "^3.4.5"
+  },
+  "devDependencies": {
+    "drizzle-kit": "^0.30.0",
+    "typescript": "^5.9.0",
+    "@types/node": "^20.17.0"
+  }
+}

package/registry/layers/framework/healthcare-hipaa-backend/files/patients.ts

@@ -0,0 +1,86 @@
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { eq } from 'drizzle-orm'
+import { db } from '../db/client.ts'
+import { patients } from '../db/schema.ts'
+import { decryptPhi, encryptPhi } from '../encryption.ts'
+import { withPhiAccess } from './phi-access.ts'
+
+async function readJsonBody(request: IncomingMessage): Promise<unknown> {
+  const chunks: Buffer[] = []
+  for await (const chunk of request) chunks.push(chunk as Buffer)
+  const raw = Buffer.concat(chunks).toString('utf8')
+  return raw ? JSON.parse(raw) : null
+}
+
+export const getPatient = withPhiAccess(
+  'read',
+  'patient',
+  (request) => {
+    const url = new URL(request.url ?? '', 'http://localhost')
+    return url.pathname.split('/').pop() ?? null
+  },
+  async (_request, response, ctx) => {
+    if (!ctx.resourceId) {
+      response.writeHead(400, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'patient id required' }))
+      return
+    }
+    const rows = await db.select().from(patients).where(eq(patients.id, ctx.resourceId)).limit(1)
+    const row = rows[0]
+    if (!row) {
+      response.writeHead(404, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'patient not found' }))
+      return
+    }
+    // Minimum-necessary filtering by role — billing doesn't get SSN.
+    const body: Record<string, unknown> = {
+      id: row.id,
+      mrn: row.mrn,
+      sex: row.sex,
+      name: decryptPhi(row.encryptedName),
+      dob: decryptPhi(row.encryptedDob),
+    }
+    if (ctx.actor.role === 'clinician' || ctx.actor.role === 'admin') {
+      body.ssn = decryptPhi(row.encryptedSsn)
+    }
+    response.writeHead(200, { 'content-type': 'application/json' })
+    response.end(JSON.stringify(body))
+  },
+)
+
+export const createPatient = withPhiAccess(
+  'create',
+  'patient',
+  () => null,
+  async (request, response, ctx) => {
+    if (ctx.actor.role === 'billing' || ctx.actor.role === 'patient') {
+      response.writeHead(403, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'role cannot create patient records' }))
+      return
+    }
+    const body = (await readJsonBody(request)) as {
+      mrn?: string
+      name?: string
+      dob?: string
+      ssn?: string
+      sex?: 'M' | 'F' | 'X'
+    } | null
+    if (!body?.mrn || !body.name || !body.dob) {
+      response.writeHead(422, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'mrn, name, dob are required' }))
+      return
+    }
+    const [inserted] = await db
+      .insert(patients)
+      .values({
+        mrn: body.mrn,
+        encryptedName: encryptPhi(body.name)!,
+        encryptedDob: encryptPhi(body.dob)!,
+        encryptedSsn: encryptPhi(body.ssn ?? null),
+        sex: body.sex ?? null,
+      })
+      .returning({ id: patients.id, mrn: patients.mrn })
+    response.writeHead(201, { 'content-type': 'application/json' })
+    response.end(JSON.stringify(inserted))
+  },
+)

package/registry/layers/framework/healthcare-hipaa-backend/files/phi-access.ts

@@ -0,0 +1,85 @@
+// PHI-access middleware. Every API route that returns PHI wraps its handler
+// with `withPhiAccess(...)`, which:
+//   1. Asserts the request is authenticated and has a role.
+//   2. Writes an AuditLog row BEFORE the handler runs (so even an error path
+//      produces an audit trail — "attempted access" is itself auditable).
+//   3. Forwards actor context to the handler.
+//
+// If you add a new route that touches patients/encounters, you MUST wrap it.
+// The validate-hipaa.mjs check fails the scaffold if this file is gutted.
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { db } from '../db/client.ts'
+import { auditLogs } from '../db/schema.ts'
+
+export interface Actor {
+  id: string
+  role: 'clinician' | 'billing' | 'admin' | 'patient'
+}
+
+export interface PhiAccessContext {
+  actor: Actor
+  resourceType: 'patient' | 'encounter' | 'provider'
+  resourceId: string | null
+  /** HIPAA minimum-necessary rule: every PHI read needs a documented purpose. */
+  reason: string
+}
+
+export type PhiHandler = (
+  request: IncomingMessage,
+  response: ServerResponse,
+  context: PhiAccessContext,
+) => Promise<void> | void
+
+/**
+ * Resolve the calling actor from the request. This starter reads the
+ * X-Actor-Id / X-Actor-Role headers — wire up a real auth layer
+ * (Clerk, better-auth, mTLS, OAuth) before storing real PHI.
+ */
+function resolveActor(request: IncomingMessage): Actor | null {
+  const id = request.headers['x-actor-id']
+  const role = request.headers['x-actor-role']
+  if (typeof id !== 'string' || typeof role !== 'string') return null
+  if (!['clinician', 'billing', 'admin', 'patient'].includes(role)) return null
+  return { id, role: role as Actor['role'] }
+}
+
+export function withPhiAccess(
+  action: 'read' | 'create' | 'update',
+  resourceType: PhiAccessContext['resourceType'],
+  extractResourceId: (request: IncomingMessage) => string | null,
+  handler: PhiHandler,
+): (request: IncomingMessage, response: ServerResponse) => Promise<void> {
+  return async (request, response) => {
+    const actor = resolveActor(request)
+    if (!actor) {
+      response.writeHead(401, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'unauthenticated' }))
+      return
+    }
+
+    const resourceId = extractResourceId(request)
+    const reason = (request.headers['x-access-reason'] as string | undefined) ?? 'unspecified'
+
+    // Write the audit log row BEFORE handling the request. If the DB write
+    // fails we refuse the request rather than serve PHI without a trail.
+    try {
+      await db.insert(auditLogs).values({
+        actorId: actor.id,
+        actorRole: actor.role,
+        action,
+        resourceType,
+        resourceId,
+        reason,
+        ipAddress: (request.socket.remoteAddress ?? '').slice(0, 45),
+        userAgent: (request.headers['user-agent'] ?? '').slice(0, 500),
+      })
+    } catch (err) {
+      // Fail-closed: no audit log, no PHI access.
+      response.writeHead(503, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ error: 'audit log unavailable; refusing PHI access' }))
+      return
+    }
+
+    await handler(request, response, { actor, resourceType, resourceId, reason })
+  }
+}

package/registry/layers/framework/healthcare-hipaa-backend/files/schema.ts

@@ -0,0 +1,82 @@
+// Healthcare HIPAA-aligned schema. Every column that can contain PHI is
+// declared `encrypted` (bytea) and must be written via src/encryption.ts —
+// there is intentionally no plaintext PHI column.
+//
+// Append-only invariant on audit_logs is enforced by the migration in
+// drizzle/0001_auditlog_append_only.sql (trigger that raises on UPDATE/DELETE).
+import { pgTable, uuid, varchar, timestamp, jsonb, text, integer, customType } from 'drizzle-orm/pg-core'
+import { relations } from 'drizzle-orm'
+
+// Custom type for AES-256-GCM payload: { iv, tag, ciphertext } encoded as a
+// single bytea. src/encryption.ts owns the wire format.
+const encrypted = customType<{ data: Buffer; driverData: Buffer }>({
+  dataType: () => 'bytea',
+})
+
+export const providers = pgTable('providers', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  npi: varchar('npi', { length: 10 }).notNull().unique(),
+  name: varchar('name', { length: 200 }).notNull(),
+  specialty: varchar('specialty', { length: 100 }),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+})
+
+export const patients = pgTable('patients', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  // Medical Record Number — internal identifier, not PHI by itself but treat as sensitive.
+  mrn: varchar('mrn', { length: 50 }).notNull().unique(),
+  // Below are PHI. Encrypted at rest via AES-256-GCM.
+  encryptedName: encrypted('encrypted_name').notNull(),
+  encryptedDob: encrypted('encrypted_dob').notNull(),
+  encryptedSsn: encrypted('encrypted_ssn'),
+  sex: varchar('sex', { length: 1 }),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+})
+
+export const encounters = pgTable('encounters', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  patientId: uuid('patient_id').notNull().references(() => patients.id, { onDelete: 'restrict' }),
+  providerId: uuid('provider_id').notNull().references(() => providers.id, { onDelete: 'restrict' }),
+  encounteredAt: timestamp('encountered_at', { withTimezone: true }).notNull(),
+  // Free-text clinical notes — PHI, encrypted.
+  encryptedNotes: encrypted('encrypted_notes'),
+  cptCode: varchar('cpt_code', { length: 5 }),
+  icd10Codes: jsonb('icd10_codes').$type<string[]>().default([]),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+})
+
+/**
+ * Append-only audit log. Every read of PHI writes a row here BEFORE the
+ * response is sent. UPDATE and DELETE are blocked by a database trigger
+ * (see drizzle/0001_auditlog_append_only.sql — generate with db:generate).
+ */
+export const auditLogs = pgTable('audit_logs', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  actorId: varchar('actor_id', { length: 128 }).notNull(),
+  actorRole: varchar('actor_role', { length: 64 }).notNull(),
+  action: varchar('action', { length: 32 }).notNull(), // 'read' | 'create' | 'update'
+  resourceType: varchar('resource_type', { length: 32 }).notNull(),
+  resourceId: uuid('resource_id'),
+  // Free-text justification — required under HIPAA minimum-necessary rule.
+  reason: text('reason'),
+  occurredAt: timestamp('occurred_at', { withTimezone: true }).notNull().defaultNow(),
+  ipAddress: varchar('ip_address', { length: 45 }),
+  userAgent: text('user_agent'),
+})
+
+export const patientsRelations = relations(patients, ({ many }) => ({
+  encounters: many(encounters),
+}))
+
+export const encountersRelations = relations(encounters, ({ one }) => ({
+  patient: one(patients, { fields: [encounters.patientId], references: [patients.id] }),
+  provider: one(providers, { fields: [encounters.providerId], references: [providers.id] }),
+}))
+
+export type Patient = typeof patients.$inferSelect
+export type NewPatient = typeof patients.$inferInsert
+export type Provider = typeof providers.$inferSelect
+export type Encounter = typeof encounters.$inferSelect
+export type AuditLog = typeof auditLogs.$inferSelect
+export type NewAuditLog = typeof auditLogs.$inferInsert

package/registry/layers/framework/healthcare-hipaa-backend/files/server.ts

@@ -0,0 +1,43 @@
+import http from 'node:http'
+import { createPatient, getPatient } from './api/patients.ts'
+import { createEncounter, getEncounter } from './api/encounters.ts'
+
+const port = Number.parseInt(process.env.PORT ?? '8100', 10)
+
+// Only the /health probe is unauthenticated. Every /api/* route runs through
+// withPhiAccess which requires auth headers + writes an audit log row.
+const server = http.createServer(async (request, response) => {
+  const url = new URL(request.url ?? '/', `http://127.0.0.1:${port}`)
+
+  if (url.pathname === '/health') {
+    response.writeHead(200, { 'content-type': 'application/json' })
+    response.end(JSON.stringify({ status: 'ok', service: 'starter-foundry-healthcare' }))
+    return
+  }
+
+  if (url.pathname === '/api/patients' && request.method === 'POST') {
+    await createPatient(request, response)
+    return
+  }
+  if (url.pathname.startsWith('/api/patients/') && request.method === 'GET') {
+    await getPatient(request, response)
+    return
+  }
+
+  if (url.pathname === '/api/encounters' && request.method === 'POST') {
+    await createEncounter(request, response)
+    return
+  }
+  if (url.pathname.startsWith('/api/encounters/') && request.method === 'GET') {
+    await getEncounter(request, response)
+    return
+  }
+
+  response.writeHead(404, { 'content-type': 'application/json' })
+  response.end(JSON.stringify({ error: 'not found' }))
+})
+
+server.listen(port, '0.0.0.0', () => {
+  // eslint-disable-next-line no-console
+  console.log(`starter-foundry-healthcare listening on ${port}`)
+})

package/registry/layers/framework/healthcare-hipaa-backend/files/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "allowImportingTsExtensions": true,
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "noEmit": true
+  },
+  "include": ["src/**/*.ts", "drizzle.config.ts"]
+}