@xemahq/biome-database-nest 0.12.1 → 0.12.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/biome-database-nest",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Explicit database migration ownership, least-privilege runtime verification, and schema-qualified Prisma wiring for Xema biome services.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -18,8 +18,7 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "devDependencies": {
     "@nestjs/common": "11.1.13",
@@ -35,8 +34,8 @@
     "ts-jest": "^29.4.9",
     "typescript": "5.9.3",
     "@xemahq/platform-common": "^0.7.4",
-    "@xemahq/xema-decorators": "0.5.3",
-    "@xemahq/service-registry-nest": "0.7.0"
+    "@xemahq/xema-decorators": "0.5.4",
+    "@xemahq/service-registry-nest": "0.7.1"
   },
   "peerDependencies": {
     "@nestjs/common": "^10 || ^11",

package/src/index.ts

@@ -1,115 +0,0 @@
-export { DEFAULT_BIOME_DB_KEY, deriveBiomeSchemaName } from './lib/schema-name';
-export {
-  composeIdentifier,
-  fitIdentifier,
-  IDENTIFIER_HASH_LENGTH,
-  POSTGRES_MAX_IDENTIFIER_LENGTH,
-  sanitizeIdentifierChars,
-  sanitizeIdentifierSegment,
-  type ComposeIdentifierInput,
-  type FitIdentifierInput,
-} from './lib/identifier';
-export {
-  rolesForSchema,
-  schemaRoleBase,
-  schemaRoleName,
-  SchemaRoleKind,
-  SCHEMA_ROLE_BASE_MAX_LENGTH,
-  SCHEMA_ROLE_SUFFIX_LENGTH,
-  type SchemaRoleNames,
-} from './lib/role-names';
-export {
-  resolveBiomeDatabaseConfigFromEnv,
-  type BiomeDatabaseConfig,
-} from './lib/config';
-export {
-  createBiomePrismaAdapter,
-  createBiomePrismaAdapterFromEnv,
-} from './lib/adapter';
-export {
-  fetchSystemDatabaseConfig,
-  type SystemDatabaseConfigRequest,
-} from './lib/control-plane-client';
-export {
-  resolveControlPlaneBaseUrl,
-  ORG_DATABASE_POOL_SERVICE_NAME,
-  type ControlPlaneDiscoveryOptions,
-} from './lib/control-plane-discovery';
-export {
-  bootstrapBiomeDatabases,
-  type BiomeDatabaseDeclaration,
-  type BootstrapBiomeDatabasesOptions,
-} from './lib/bootstrap';
-export { BiomeDatabaseMigrationMode } from './lib/migration-mode';
-export {
-  BiomeDatabaseModule,
-  BIOME_DATABASE_READY,
-  type ApplicationManagedBiomeDatabaseModuleOptions,
-  type BiomeDatabaseModuleOptions,
-} from './lib/nest/biome-database.module';
-export {
-  createBiomePrismaService,
-  type BiomePrismaClient,
-  type BiomePrismaClientCtor,
-  type BiomePrismaServiceInstance,
-  type CreateBiomePrismaServiceOptions,
-  type TenantIsolationServiceOptions,
-  type TenantScopedApi,
-} from './lib/nest/prisma-service-factory';
-export {
-  TenantIsolationMode,
-  TENANT_ISOLATION_MODE_ENV_VAR,
-  resolveTenantIsolationMode,
-} from './lib/tenant-isolation/tenant-isolation-mode';
-export {
-  TenantIsolationError,
-  TenantIsolationViolationKind,
-  formatTenantIsolationViolation,
-  type TenantIsolationViolation,
-} from './lib/tenant-isolation/tenant-isolation-error';
-export {
-  PrismaModelOperation,
-  scopeArgsToOrg,
-  type OrgScopeOutcome,
-  type OrgScopeRequest,
-} from './lib/tenant-isolation/org-scope';
-export {
-  DEFAULT_ORG_FIELD,
-  collectOrgScopedModels,
-  createTenantIsolationExtension,
-  readRuntimeModels,
-  type CreateTenantIsolationExtensionOptions,
-  type RuntimeDataModelField,
-  type RuntimeDataModelModel,
-  type TenantIsolationExtensionDefinition,
-  type TenantIsolationLogger,
-  type TenantIsolationQueryContext,
-} from './lib/tenant-isolation/tenant-isolation.extension';
-export {
-  assertUnscopedModelsDeclared,
-  collectUnscopableModels,
-  formatUnscopedModelReport,
-  normalizeUnscopedModelDeclarations,
-  UndeclaredUnscopedModelsError,
-  type AssertUnscopedModelsOptions,
-  type NormalizedUnscopedModelDeclaration,
-  type UnscopedModelDeclaration,
-  type UnscopedModelDeclarations,
-} from './lib/tenant-isolation/unscoped-models';
-export {
-  assertOrgErasureMatchesModels,
-  eraseOrgData,
-  OrgErasureBlockedError,
-  OrgErasureMatchesNothingError,
-  type EraseOrgDataOptions,
-  type OrgErasureReport,
-} from './lib/tenant-isolation/org-erasure';
-export {
-  OrgErasureModule,
-  OrgErasureController,
-  ORG_ERASURE_RUNNER,
-  ORG_DATA_ERASURE_CAPABILITY,
-  ORG_ERASURE_ROUTE_PATH,
-  type OrgErasureModuleOptions,
-  type OrgErasureRunner,
-} from './lib/nest/org-erasure.module';

package/src/lib/adapter.ts

@@ -1,117 +0,0 @@
-import { PrismaPg } from '@prisma/adapter-pg';
-import {
-  composeBiomeDatabaseUrl,
-  ensureBiomeDbSearchPath,
-} from '@xemahq/platform-common';
-
-import { resolveBiomeDatabaseConfigFromEnv } from './config';
-
-import type { BiomeDatabaseConfig } from './config';
-
-const DEFAULT_POOL_MAX = 3;
-
-/**
- * Build a connection string from a {@link BiomeDatabaseConfig}, with `?schema=`
- * when a per-biome schema is set and the libpq `search_path` option applied so
- * RAW queries also resolve to the biome schema.
- *
- * @throws if the config is missing a part required to form a URL.
- */
-function buildBiomeConnectionString(config: BiomeDatabaseConfig): string {
-  const url = composeBiomeDatabaseUrl({
-    user: config.username,
-    password: config.password,
-    host: config.host,
-    port: String(config.port),
-    database: config.database,
-    ...(config.schema !== undefined ? { schema: config.schema } : {}),
-    ...(config.sslParams !== undefined ? { sslParams: config.sslParams } : {}),
-  });
-  if (url === null) {
-    throw new Error(
-      'createBiomePrismaAdapter: incomplete BiomeDatabaseConfig — ' +
-        'host/port/database/username/password are all required.',
-    );
-  }
-  return ensureBiomeDbSearchPath(url);
-}
-
-/**
- * Construct a {@link PrismaPg} driver-adapter pool whose Prisma Client qualifies
- * ORM table names with the biome schema.
- *
- * THIS IS THE CENTRALIZED FIX. `@prisma/adapter-pg` (Prisma 7) ignores BOTH the
- * URL `?schema=` and the connection `search_path` when qualifying ORM-emitted
- * SQL — it falls back to `public.<table>` unless the schema is passed as the
- * SECOND constructor argument. Passing `{ schema }` here makes Prisma emit
- * `biome_<id>.<table>`. `ensureBiomeDbSearchPath` separately fixes RAW queries.
- * Constructing the adapter correctly is the ONLY thing this function does, so
- * the correct construction is the only construction a biome can perform.
- */
-export function createBiomePrismaAdapter(
-  config: BiomeDatabaseConfig,
-): PrismaPg {
-  const connectionString = buildBiomeConnectionString(config);
-  return new PrismaPg(
-    {
-      connectionString,
-      min: 1,
-      max: config.poolMax ?? DEFAULT_POOL_MAX,
-      idleTimeoutMillis: 30_000,
-    },
-    config.schema !== undefined ? { schema: config.schema } : undefined,
-  );
-}
-
-/**
- * Construct the schema-qualified adapter from the environment — the path the
- * unchanged-shape `PrismaService` calls at construction time (post-bootstrap,
- * where `DATABASE_URL`/`DB_*` are guaranteed set).
- *
- * Resolution order:
- * 1. If `DATABASE_URL` (or `DATABASE_URL_<KEY>` for a non-default key) is set,
- *    use it directly as the connection string (still applying
- *    `ensureBiomeDbSearchPath` + the `{ schema }` second-arg from `DB_SCHEMA`).
- * 2. Otherwise compose from the discrete `DB_*` vars.
- *
- * @throws if neither a `DATABASE_URL` nor a complete `DB_*` set is present.
- */
-export function createBiomePrismaAdapterFromEnv(
-  env: NodeJS.ProcessEnv = process.env,
-  dbKey?: string,
-): PrismaPg {
-  const isDefault = dbKey === undefined || dbKey === '' || dbKey === 'primary';
-  const upperSuffix = isDefault
-    ? ''
-    : `_${dbKey.toUpperCase().replace(/[^A-Z0-9]/g, '_')}`;
-
-  const directUrl = env[`DATABASE_URL${upperSuffix}`];
-  const schema = env[`DB_SCHEMA${upperSuffix}`];
-  const poolMaxRaw = env[`DB_POOL_MAX${upperSuffix}`] ?? env.DB_POOL_MAX;
-  const poolMax =
-    poolMaxRaw !== undefined && poolMaxRaw !== ''
-      ? Number.parseInt(poolMaxRaw, 10)
-      : DEFAULT_POOL_MAX;
-
-  if (directUrl !== undefined && directUrl !== '') {
-    const connectionString = ensureBiomeDbSearchPath(directUrl);
-    return new PrismaPg(
-      {
-        connectionString,
-        min: 1,
-        max: poolMax,
-        idleTimeoutMillis: 30_000,
-      },
-      schema !== undefined && schema !== '' ? { schema } : undefined,
-    );
-  }
-
-  const config = resolveBiomeDatabaseConfigFromEnv(env, dbKey);
-  if (config === null) {
-    throw new Error(
-      `createBiomePrismaAdapterFromEnv: no DATABASE_URL${upperSuffix} and no ` +
-        `DB_HOST${upperSuffix}/DB_HOST in the environment — cannot construct an adapter.`,
-    );
-  }
-  return createBiomePrismaAdapter(config);
-}

package/src/lib/bootstrap.ts

@@ -1,428 +0,0 @@
-import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-import { writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { Logger } from '@nestjs/common';
-import { PrismaMigrationRunner } from '@xemahq/migration-runner-prisma';
-import {
-  composeBiomeDatabaseUrl,
-  ensureBiomeDbSearchPath,
-} from '@xemahq/platform-common';
-import { Client } from 'pg';
-
-import { resolveBiomeDatabaseConfigFromEnv } from './config';
-import { fetchSystemDatabaseConfig } from './control-plane-client';
-import {
-  resolveControlPlaneBaseUrl,
-  type ControlPlaneDiscoveryOptions,
-} from './control-plane-discovery';
-import { DEFAULT_BIOME_DB_KEY } from './schema-name';
-
-import type { BiomeDatabaseConfig } from './config';
-import type { BiomeDatabaseMigrationMode } from './migration-mode';
-import type { KernelState } from '@xemahq/kernel-contracts/kernel-state';
-
-/** One database whose schema and Prisma migrations the application owns. */
-export interface BiomeDatabaseDeclaration {
-  /** Defaults to `'primary'`. */
-  readonly key?: string;
-  /** Directory containing `prisma/` (cwd for `prisma migrate deploy`). */
-  readonly workspaceDir: string;
-}
-
-
-interface BootstrapBiomeDatabasesCommonOptions {
-  readonly biomeId: string;
-  /**
-   * A service bearer, or a factory that mints one. Required whenever the
-   * selected credential path is the control plane. Its address is discovered
-   * from the service registry via {@link kernelState}.
-   */
-  readonly serviceToken?: string | (() => Promise<string>);
-  /**
-   * The app's `KernelState` backend (injected via `KERNEL_STATE_TOKEN`). Used to
-   * discover the `org-database-pool-api` control-plane address from the service
-   * registry. Required on the control-plane path; unused when every declared
-   * database explicitly resolves from the environment.
-   */
-  readonly kernelState: KernelState;
-  /** Optional bounded-backoff tuning for control-plane discovery. */
-  readonly controlPlaneDiscovery?: ControlPlaneDiscoveryOptions;
-}
-
-export interface ApplicationManagedBootstrapOptions
-  extends BootstrapBiomeDatabasesCommonOptions {
-  readonly migrationMode: BiomeDatabaseMigrationMode.ApplicationManaged;
-  readonly databases: readonly BiomeDatabaseDeclaration[];
-  /**
-   * Postgres extensions this biome needs, ensured in the SHARED `public` schema
-   * BEFORE migrations run (e.g. `['vector']` for pgvector). A Postgres
-   * extension can exist in only ONE schema per database, so installing it in
-   * each biome's own schema would make whichever biome migrates first win and
-   * every later biome fail to resolve the type. Installing in `public` (which
-   * every biome's search_path includes) keeps it shared. `CREATE EXTENSION IF
-   * NOT EXISTS` is idempotent; only declare extensions the biome actually uses
-   * so non-Postgres-extension environments (local dev) are unaffected.
-   */
-  readonly requiredExtensions?: readonly string[];
-}
-
-
-export type BootstrapBiomeDatabasesOptions =
-  ApplicationManagedBootstrapOptions;
-
-const LOG_PREFIX = '[biome-database]';
-
-/**
- * Boot-progress sink. A published SDK must not write to the host's raw
- * stdout: this bootstrap runs from a service's `main.ts`, so its output
- * belongs on the same Nest logger transport as the rest of that service's
- * boot. `Logger`'s static/instance API works before `NestFactory.create`,
- * which is exactly when this runs.
- */
-const bootstrapLogger = new Logger('BiomeDatabaseBootstrap');
-
-function upperKeySuffix(key: string): string {
-  return key === DEFAULT_BIOME_DB_KEY
-    ? ''
-    : `_${key.toUpperCase().replace(/[^A-Z0-9]/g, '_')}`;
-}
-
-async function resolveServiceToken(
-  serviceToken: string | (() => Promise<string>) | undefined,
-): Promise<string> {
-  if (serviceToken === undefined) {
-    throw new Error(
-      `${LOG_PREFIX} no local DB_* override and no serviceToken supplied — ` +
-        'cannot authenticate to the control plane.',
-    );
-  }
-  return typeof serviceToken === 'function' ? serviceToken() : serviceToken;
-}
-
-/**
- * Resolve config for one database: local `DB_*` override FIRST, control plane
- * as the fallback. Throws if neither yields a config (no silent default). The
- * control-plane base URL is obtained via {@link getControlPlaneBaseUrl}, which
- * discovers `org-database-pool-api` from the service registry (memoized across
- * databases so discovery runs at most once per bootstrap).
- */
-async function resolveDatabaseConfig(
-  opts: BootstrapBiomeDatabasesCommonOptions,
-  key: string,
-  getControlPlaneBaseUrl: () => Promise<string>,
-): Promise<BiomeDatabaseConfig> {
-  const local = resolveBiomeDatabaseConfigFromEnv(process.env, key);
-  if (local !== null) {
-    return local;
-  }
-  const baseUrl = await getControlPlaneBaseUrl();
-  const token = await resolveServiceToken(opts.serviceToken);
-  return fetchSystemDatabaseConfig(baseUrl, token, {
-    biomeId: opts.biomeId,
-    ...(key !== DEFAULT_BIOME_DB_KEY ? { dbKey: key } : {}),
-  });
-}
-
-
-/**
- * If the config carries an inline CA PEM, write it to a deterministic temp file
- * and rewrite `sslParams` so `sslrootcert` points at it. Returns the config to
- * use downstream. When no inline CA is present, the config is returned as-is
- * (any already-mounted `sslrootcert` path in `sslParams` is preserved).
- */
-async function materializeInlineCaCert(
-  biomeId: string,
-  key: string,
-  config: BiomeDatabaseConfig,
-): Promise<BiomeDatabaseConfig> {
-  if (config.caCertPem === undefined || config.caCertPem === '') {
-    return config;
-  }
-  const hash = createHash('sha256')
-    .update(`${biomeId}:${key}`)
-    .digest('hex')
-    .slice(0, 16);
-  const certPath = join(tmpdir(), `xema-biome-db-ca-${hash}.crt`);
-  await writeFile(certPath, config.caCertPem, { mode: 0o600 });
-
-  const params = new URLSearchParams(config.sslParams ?? '');
-  params.set('sslrootcert', certPath);
-  if (!params.has('sslmode')) {
-    params.set('sslmode', 'verify-full');
-  }
-  bootstrapLogger.log(
-    `${LOG_PREFIX} biome=${biomeId} key=${key}: wrote inline CA cert to ${certPath}`,
-  );
-  return { ...config, sslParams: params.toString() };
-}
-
-/**
- * Ensure `config.schema` exists. No-op when the config has no schema (dedicated
- * DB). Uses a per-schema advisory lock inside a txn so concurrent replicas
- * serialize the `CREATE SCHEMA IF NOT EXISTS`.
- */
-/**
- * Build the node-postgres `ssl` option from the config's `sslParams` /
- * `caCertPem`. Managed Postgres (e.g. DigitalOcean) REQUIRES TLS — a raw
- * `Client` with no `ssl` is rejected at connect. We mirror libpq `sslmode`:
- *   - absent / `disable`            → no TLS
- *   - `require` / `prefer`          → encrypt, do NOT verify the chain/host
- *   - `verify-ca` / `verify-full`   → verify against the CA (the CA comes from
- *                                     inline `caCertPem` or the `sslrootcert`
- *                                     file path in `sslParams`)
- */
-function buildPgSsl(
-  config: BiomeDatabaseConfig,
-): false | { ca?: string; rejectUnauthorized: boolean } {
-  const params = new URLSearchParams(config.sslParams ?? '');
-  const sslmode = params.get('sslmode');
-  if (sslmode === null || sslmode === 'disable') {
-    return false;
-  }
-  const verify = sslmode === 'verify-ca' || sslmode === 'verify-full';
-  const caPath = params.get('sslrootcert');
-  const ca =
-    config.caCertPem ?? (caPath ? readFileSync(caPath, 'utf8') : undefined);
-  return {
-    ...(ca !== undefined ? { ca } : {}),
-    rejectUnauthorized: verify,
-  };
-}
-
-function isValidExtensionName(name: string): boolean {
-  return /^[a-z0-9_]+$/i.test(name);
-}
-
-async function ensureSchemaExists(
-  biomeId: string,
-  key: string,
-  config: BiomeDatabaseConfig,
-  requiredExtensions: readonly string[],
-): Promise<void> {
-  const schema = config.schema;
-  const hasSchema = schema !== undefined && schema !== '';
-  if (!hasSchema && requiredExtensions.length === 0) {
-    return;
-  }
-  const client = new Client({
-    host: config.host,
-    port: config.port,
-    database: config.database,
-    user: config.username,
-    password: config.password,
-    ssl: buildPgSsl(config),
-  });
-  await client.connect();
-  try {
-    // Shared extensions FIRST, in `public` (a Postgres extension can live in
-    // only ONE schema per DB; `public` is in every biome's search_path so the
-    // type/ops resolve everywhere). Idempotent; runs before migrate so a
-    // migration's own `CREATE EXTENSION IF NOT EXISTS` no-ops.
-    for (const ext of requiredExtensions) {
-      if (!isValidExtensionName(ext)) {
-        throw new Error(
-          `${LOG_PREFIX} biome=${biomeId}: invalid extension name "${ext}".`,
-        );
-      }
-      await client.query(
-        `CREATE EXTENSION IF NOT EXISTS "${ext}" SCHEMA public`,
-      );
-      bootstrapLogger.log(
-        `${LOG_PREFIX} biome=${biomeId} key=${key}: ensured extension "${ext}" in public`,
-      );
-    }
-    if (hasSchema) {
-      await client.query('BEGIN');
-      await client.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
-        schema,
-      ]);
-      await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}"`);
-      await client.query('COMMIT');
-      bootstrapLogger.log(
-        `${LOG_PREFIX} biome=${biomeId} key=${key}: ensured schema "${schema}" exists`,
-      );
-    }
-  } catch (err) {
-    await client.query('ROLLBACK').catch(() => undefined);
-    throw err;
-  } finally {
-    await client.end();
-  }
-}
-
-/** Build the direct connection URL for a resolved database config. */
-function buildDirectConnectionUrl(
-  biomeId: string,
-  key: string,
-  config: BiomeDatabaseConfig,
-): string {
-  const directUrl = composeBiomeDatabaseUrl({
-    user: config.username,
-    password: config.password,
-    host: config.host,
-    port: String(config.port),
-    database: config.database,
-    ...(config.schema !== undefined ? { schema: config.schema } : {}),
-    ...(config.sslParams !== undefined ? { sslParams: config.sslParams } : {}),
-  });
-  if (directUrl === null) {
-    throw new Error(
-      `${LOG_PREFIX} biome=${biomeId} key=${key}: incomplete config — cannot form a database URL.`,
-    );
-  }
-  return ensureBiomeDbSearchPath(directUrl);
-}
-
-async function runMigrations(
-  biomeId: string,
-  key: string,
-  workspaceDir: string,
-  migrateUrl: string,
-): Promise<void> {
-  bootstrapLogger.log(
-    `${LOG_PREFIX} biome=${biomeId} key=${key}: running prisma migrate deploy (cwd=${workspaceDir})`,
-  );
-  // The migrate connection MUST carry `public` in its search_path (not just the
-  // biome schema) so migrations resolve SHARED objects that live in `public` —
-  // notably the pgvector `vector`/`halfvec` types and their operator classes.
-  // pgvector can only be installed in ONE schema per database; the shared
-  // xema_biomes DB keeps it in `public`. Without `,public` here, a biome whose
-  // schema is the migrate target cannot see `public.vector` and CREATE TABLE
-  // with a `vector` column fails (`type "vector" does not exist`). The runtime
-  // URL already gets this via `ensureBiomeDbSearchPath`; the migrate URL needs
-  // it too. `ensureBiomeDbSearchPath` is idempotent.
-  const result = await new PrismaMigrationRunner().run({
-    workspaceDir,
-    connectionUrl: migrateUrl,
-    env: {},
-  });
-  if (result.exitCode !== 0) {
-    throw new Error(
-      `${LOG_PREFIX} biome=${biomeId} key=${key}: migrations failed (exit ${result.exitCode}):\n${result.output}`,
-    );
-  }
-}
-
-/**
- * Build the STEADY-STATE runtime URL. When the config declares a transaction
- * pooler (`poolerHost`), the runtime connection is routed through it — the fix
- * for connection fan-out across many replicas × biomes — while `migrateUrl`
- * (direct) is what schema-create and `prisma migrate deploy` already used.
- *
- * The app→pooler leg is normally in-cluster plaintext (`sslmode=disable` by
- * default); the pooler terminates the managed-Postgres TLS on its own upstream
- * leg. Both URLs carry the libpq `search_path` option (via
- * `ensureBiomeDbSearchPath`) so RAW queries resolve to the biome schema — the
- * pooler must be configured to track `search_path` per-client (PgBouncer ≥1.23
- * `track_extra_parameters = search_path`) so transaction pooling stays correct.
- *
- * No pooler declared → returns the direct runtime URL (current behavior).
- */
-function buildRuntimeUrl(
-  biomeId: string,
-  key: string,
-  config: BiomeDatabaseConfig,
-  directUrl: string,
-): string {
-  if (config.poolerHost === undefined || config.poolerHost === '') {
-    return ensureBiomeDbSearchPath(directUrl);
-  }
-  const pooledUrl = composeBiomeDatabaseUrl({
-    user: config.username,
-    password: config.password,
-    host: config.poolerHost,
-    port: String(config.poolerPort ?? config.port),
-    database: config.database,
-    ...(config.schema !== undefined ? { schema: config.schema } : {}),
-    sslParams: config.poolerSslParams ?? 'sslmode=disable',
-  });
-  if (pooledUrl === null) {
-    throw new Error(
-      `${LOG_PREFIX} biome=${biomeId} key=${key}: incomplete config — cannot form a pooled runtime URL.`,
-    );
-  }
-  bootstrapLogger.log(
-    `${LOG_PREFIX} biome=${biomeId} key=${key}: runtime routed through pooler ${config.poolerHost}:${config.poolerPort ?? config.port}`,
-  );
-  return ensureBiomeDbSearchPath(pooledUrl);
-}
-
-
-
-
-/**
- * Export the resolved connection into the env the unchanged-shape
- * `PrismaService` reads. The primary DB lands on `DATABASE_URL`/`DB_SCHEMA`;
- * additional keys land on `DATABASE_URL_<KEY>`/`DB_SCHEMA_<KEY>`.
- */
-function exportResolvedEnv(
-  key: string,
-  config: BiomeDatabaseConfig,
-  runtimeUrl: string,
-): void {
-  const suffix = upperKeySuffix(key);
-  process.env[`DATABASE_URL${suffix}`] = runtimeUrl;
-  if (config.schema !== undefined && config.schema !== '') {
-    process.env[`DB_SCHEMA${suffix}`] = config.schema;
-  }
-}
-
-/**
- * Bootstrap every declared biome database according to its explicit migration
- * ownership mode.
- *
- * Application-managed mode retains schema/extension creation and Prisma
- * migration execution. Externally-managed mode performs no DDL and never
- * invokes the migration runner: it resolves only the explicitly selected
- * runtime credential, proves its least-privilege contract and migration
- * compatibility, then exports the verified runtime URL.
- */
-export async function bootstrapBiomeDatabases(
-  opts: BootstrapBiomeDatabasesOptions,
-): Promise<void> {
-  // Discover the control-plane address at most once, and only when a database
-  // actually needs it (i.e. has no local DB_* override).
-  let cachedBaseUrl: string | undefined;
-  const getControlPlaneBaseUrl = async (): Promise<string> => {
-    if (cachedBaseUrl === undefined) {
-      cachedBaseUrl = await resolveControlPlaneBaseUrl(
-        opts.kernelState,
-        opts.controlPlaneDiscovery,
-      );
-    }
-    return cachedBaseUrl;
-  };
-
-  for (const decl of opts.databases) {
-      const key = decl.key ?? DEFAULT_BIOME_DB_KEY;
-      bootstrapLogger.log(
-        `${LOG_PREFIX} biome=${opts.biomeId} key=${key}: resolving config for mode=${opts.migrationMode}`,
-      );
-      const rawConfig = await resolveDatabaseConfig(
-        opts,
-        key,
-        getControlPlaneBaseUrl,
-      );
-      const config = await materializeInlineCaCert(
-        opts.biomeId,
-        key,
-        rawConfig,
-      );
-      const directUrl = buildDirectConnectionUrl(opts.biomeId, key, config);
-      await ensureSchemaExists(
-        opts.biomeId,
-        key,
-        config,
-        opts.requiredExtensions ?? [],
-      );
-      await runMigrations(opts.biomeId, key, decl.workspaceDir, directUrl);
-      const runtimeUrl = buildRuntimeUrl(opts.biomeId, key, config, directUrl);
-      exportResolvedEnv(key, config, runtimeUrl);
-      bootstrapLogger.log(
-        `${LOG_PREFIX} biome=${opts.biomeId} key=${key}: bootstrap complete`,
-      );
-  }
-}