@xhulz/nina 0.46.0 → 0.47.0

package/releases/0.47.0/surfaces/money/tree/.claude/patterns.md

@@ -0,0 +1,49 @@
+<!-- nina:slot money.1 -->
+
+---
+
+## Monetary values & percentages
+
+- **Money is an integer of the currency's minor unit**, end to end — {{MINOR_UNIT}}, never a float, never a type that can hold a fraction of one. Source of precision: `{{MONEY_MODULE}}`.
+- **Percentages are basis points** (`40% → 4000`, `100% → 10000`) so a distribution is exact without floating point.
+- **Parsing, formatting and percentage arithmetic live in one module and nowhere else.** A second place that turns a string into money is a second rounding rule, and the two will disagree on a value somebody is owed.
+- **Never** convert to a floating-point type before formatting, and never let a display format round a stored value.
+- Monetary database columns are integer. JSON responses serialize them as **strings**, not numbers, so no client parses them into a float. The service owns the conversion.
+
+<!-- nina:slot money.2 -->
+
+---
+
+## Distribution invariants (enforced by reviewer + unit tests)
+
+The distribution engine lives in `{{CORE_PKG}}`. It is pure and total over integer {{MINOR_UNIT}}:
+
+- A destination is either a percentage (basis points of the amount) or a fixed value.
+- `total = Σ destinations`, computed in {{MINOR_UNIT}}.
+- `total > amount` → **reject.** Never clamp, never distribute what is not there.
+- `total < amount` → **allow**, surface the shortfall, and leave the remainder **parked**. Silence is the defect here: an unexplained remainder is indistinguishable from a bug.
+- `total = amount` → OK.
+- A retention is just another destination — the same arithmetic applies to it, with no special case.
+
+<!-- nina:slot money.3 -->
+
+---
+
+## State machines & idempotency (enforced by reviewer)
+
+- **Every money-moving entity is a state machine.** Its states and legal transitions are declared in `.claude/architecture.md`; the code follows the declaration, not the other way round. Illegal transitions throw; they are never silently coerced.
+- **Every transition writes an audit row** (entity type, entity id, from, to, actor). No transition without a trail — the trail is what makes a money bug diagnosable after the money has moved.
+- **Outbound transfers are idempotent.** Each carries a unique key, and dedupe happens before the side effect, at the serialization point.
+- **One serialization point per balance.** Whatever computes and dispatches against a single balance never runs concurrently with itself. Two concurrent runs over one balance is how a double send happens even when every individual write is correct.
+
+<!-- nina:slot money.4 -->
+- **Money computation and dispatch go through the serialization point.** Routes, queue consumers and tools never run a distribution or a transfer synchronously in the request path.
+
+<!-- nina:slot money.5 -->
+- **The distribution engine lives in `{{CORE_PKG}}`.** Services call it as a pure function; they do not embed money logic inline.
+
+<!-- nina:slot money.6 -->
+- Idempotency on money-moving writes: the record carries an idempotency key, and the serialization point refuses the second attempt *before* the side effect.
+
+<!-- nina:slot money.7 -->
+- `{{CORE_PKG}}` is the most-tested package — pure functions over fixtures. Cover the distribution invariants exhaustively: over, under, exact, mixed percentage and fixed, and rounding.

package/releases/0.47.0/surfaces/money/tree/.claude/pipeline.md

@@ -0,0 +1,2 @@
+<!-- nina:slot money.1 -->
+  - **Money invariants respected** — a distribution never exceeds the amount; a shortfall is parked, not distributed; transfers idempotent; every transition audited.

package/releases/0.47.0/surfaces/money/tree/.claude/retrieval.md

@@ -0,0 +1,2 @@
+<!-- nina:slot money.1 -->
+| New distribution / transfer logic | `.claude/architecture.md` § *Money*, `.claude/patterns.md` § *Distribution invariants*, `{{CORE_PKG}}/` | architect → implementer → reviewer → qa |

package/releases/0.47.0/surfaces/money/tree/CLAUDE.md

@@ -0,0 +1,11 @@
+<!-- nina:slot money.1 -->
+3. **An outbound transfer is idempotent — it is NEVER sent twice.** Every transfer carries an idempotency key, and deduplication happens at a single serialization point **before** the side effect, never after it. A retry, a re-delivered queue message, a double-click and a replayed webhook must all collapse to one transfer. This is the highest-blast-radius invariant in the system: almost everything else can be corrected afterwards, and a duplicated transfer cannot.
+
+<!-- nina:slot money.2 -->
+4. **Conservation — what comes in equals what goes out plus what is retained.** A distribution may NEVER exceed the amount it distributes → **block**. If it is **less**, **alert** and leave the remainder **parked** and visible — never silently distributed, never silently absorbed. All arithmetic is integer {{MINOR_UNIT}}; percentages are basis points. The LLM never computes a monetary value.
+
+<!-- nina:slot money.3 -->
+5. **State-machine integrity.** Every money-moving entity has an explicit set of states and legal transitions, declared in `.claude/architecture.md` § *State machines* — not inferred from whatever code happens to exist. Only declared transitions are legal; an illegal one throws and is never silently coerced. **Every transition writes an audit row** (entity, id, from → to, actor, when). Skipping a state, inventing one, or landing a transition with no audit row is a hard reject.
+
+<!-- nina:slot money.4 -->
+- **money movement**: anything that creates, moves, settles or records a balance

package/releases/0.47.0/surfaces/pii/tree/.claude/agents/dba.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- **Privacy.** No sensitive value in clear text where it must not be. The categories are declared in `.claude/architecture.md` § *Privacy* — they are not decided per query, and not decided by you. **Document bytes live only in the object store, referenced by key: the column holds the key, never the bytes.** Any column the architect's spec flagged for masking must be encrypted at rest. Reject a schema that widens what is stored in the clear.

package/releases/0.47.0/surfaces/pii/tree/.claude/agents/devops.md

@@ -0,0 +1,8 @@
+<!-- nina:slot pii.1 -->
+
+**Point it at an UNAUTHENTICATED route — a sign-in page is the right one.** Never sign in, and never
+screenshot a signed-in page. Accounts on deployed environments hold real personal data, and a
+screenshot or a console dump pulls it into agent transcripts and logs, where it persists and nobody
+ever looks for it again. That is a privacy leak with no upside here: the sign-in page proves
+everything this check is for. It renders from the same bundle, it exercises the same build-time env
+inlining (a missing variable blanks it identically), and it needs no session.

package/releases/0.47.0/surfaces/pii/tree/.claude/agents/reviewer.md

@@ -0,0 +1,8 @@
+<!-- nina:slot pii.1 -->
+- Check for privacy regressions: **no sensitive value in a log, an error message — a library's own included — a URL or a test fixture**, per the categories in `.claude/architecture.md` § *Privacy*; document bytes only in the object store, never plaintext in the database; no leaked secret.
+
+<!-- nina:slot pii.2 -->
+- **privacy** — the privacy check above, in full: no sensitive value in a log, an error message, a
+  URL or a test fixture; document bytes only in the object store; no leaked secret. Where
+  **tenant-and-privacy** is dispatched, its reviewer owns this too and there is no separate one; where
+  it is not, this is a dimension of its own. Either way it is never nobody's.

package/releases/0.47.0/surfaces/pii/tree/.claude/agents/secops.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- **Privacy (Hard Rule #8)** — the categories declared in `.claude/architecture.md` § *Privacy* must never appear in logs, in responses that do not need them, in error paths, or in the database in clear text. Check every endpoint that returns a person's record for fields it includes by accident: a `select` that quietly grew a column is the usual way this leaks. Check the error paths too — they are written last and reviewed least — and what the libraries on them print or carry in their own errors, bound values included.

package/releases/0.47.0/surfaces/pii/tree/.claude/agents/solidity-auditor.md

@@ -0,0 +1,5 @@
+<!-- nina:slot pii.1 -->
+- **Nothing personal reaches the chain.** What is written on-chain is public, permanent, and beyond
+  deletion by anyone — including by you, and including after a subject asks. A hash of a personal
+  identifier is not a protection: it is a lookup table for whoever holds the input set. Reject a
+  personal datum stored in state, emitted in an event, or passed as calldata.

package/releases/0.47.0/surfaces/pii/tree/CLAUDE.md

@@ -0,0 +1,5 @@
+<!-- nina:slot pii.1 -->
+8. **Sensitive personal data is classified, and the classification is enforced.** What counts as sensitive here — identity documents, financial identifiers, anything a person would not expect to be readable by whoever can read a log — is declared in `.claude/architecture.md` § *Privacy*, along with the regime that governs it ({{PRIVACY_REGIME}}). Encrypted at rest. **No sensitive value in a log, an error message, a URL, an analytics event, or an agent transcript** — the places nobody thinks about are exactly the ones that persist. That includes what a library puts in its own errors and prints itself: a database client's error can carry the query and every bound value, and a framework can log a whole error past the logger it was given. A database error is mapped at the data layer to a typed error from a closed list before anything logs or returns it, and a test proves that a bound value it writes reaches no thrown error. Document bytes live only in the object store, referenced by key, never in the database in clear text.
+
+<!-- nina:slot pii.2 -->
+- **personal data**: where it is collected, stored, logged or sent

package/releases/0.47.0/surfaces/prisma/tree/.claude/agents/architect.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.47.0/surfaces/prisma/tree/.claude/agents/dba.md

@@ -0,0 +1,42 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-cli` | **before ANY `prisma` CLI command** — `validate`, `format`, `migrate dev`, `migrate diff`, `migrate deploy`. Flags differ between versions, and one of them (`migrate diff --shadow-database-url` against a live database) destroys the database it points at |
+| `prisma-client-api` | auditing a new or changed query — filters, operators, `$transaction` semantics. Through a driver adapter, cite the adapter's installed source for what a transaction does: the skill describes the default engine, and an adapter can roll back less |
+
+<!-- nina:slot prisma.2 -->
+Neither skill covers a **caching or edge layer sitting on top of the client** — cache strategy,
+edge-client behaviour and the rule about never caching a read that authorizes a write belong to that
+layer's own integration doc, declared like any other integration. A skill does not replace it.
+
+<!-- nina:slot prisma.3 -->
+- **With Prisma, both offline.** Run `pnpm --filter {{DB_PKG_NAME}} exec prisma validate`; it must pass. Then run `prisma migrate diff` in its **offline, file-only form** and read the generated SQL, not just the Prisma delta. Its flags changed in Prisma 7, so read the installed major (`prisma --version`) before writing the command:
+
+   ```
+   # Prisma 6. Compare the PREVIOUS schema against the working one — pure file-to-file, no database.
+   git show HEAD:{{DB_PKG}}/prisma/schema.prisma > /tmp/schema-head.prisma
+   pnpm --filter {{DB_PKG_NAME}} exec prisma migrate diff \
+     --from-schema-datamodel /tmp/schema-head.prisma \
+     --to-schema-datamodel prisma/schema.prisma \
+     --script
+   ```
+
+   From Prisma 7 the two flags are `--from-schema` and `--to-schema`, and the schema engine starts from the
+   datasource in `prisma.config.ts` even for this diff: with none there, it prints nothing and exits 0. For
+   SQLite a placeholder the diff never opens is enough, a `file:` URL under a gitignored directory; for any
+   other provider, find out what the diff opens before you give it one. Never a real database's URL. A first schema has nothing at `HEAD`: diff it `--from-empty`. Compare the output against the
+   hand-written `migration.sql` to confirm the declarative parts match.
+
+   ⚠️ **Do NOT reach for `--from-migrations`.** It looks like the natural choice and it is a trap:
+   Prisma refuses it without a shadow database (`--shadow-database-url`, or from Prisma 7 a
+   `shadowDatabaseUrl` in `prisma.config.ts`), which pushes you toward supplying a database URL — the exact move that destroys databases (below). The file-to-file form above answers the
+   same question with no database involved.
+
+   ⛔ **NEVER point `--shadow-database-url`, `--from-url`, `--to-url`, `--from-schema-datasource` — or, from Prisma 7, a `shadowDatabaseUrl` or the config datasource behind `--from-config-datasource` — at a real database, most of all not the one `{{SECRETS_LOCAL}}` names.** Prisma **executes** the entire migration history against whatever database those flags name, which **DESTROYS ALL DATA** in it. A shadow database must be a disposable, empty database and nothing else. It does not announce itself: the command completes with a reassuring "empty migration" result and no error, having already destroyed everything in the database it was pointed at. If the offline form above cannot answer your question, **STOP and report that to the orchestrator** instead of reaching for a database URL.
+
+<!-- nina:slot prisma.4 -->
+- **Where reads are cached through Prisma Accelerate,** every `findUnique` / `findMany` on a hot read path names its `cacheStrategy` (`ttl` / `swr`), and one that feeds a correctness-critical write names none.
+
+<!-- nina:slot prisma.5 -->
+- **On an edge runtime,** new Prisma code paths use the edge client of the installed major: `@prisma/client/edge` up to Prisma 6; from 7, the client the `prisma-client` generator writes with the platform's `runtime` set, imported from where it is generated — `@prisma/client/edge` fails there with `MODULE_NOT_FOUND`.
+
+<!-- nina:slot prisma.6 -->
+- Run a Prisma command that writes to a real database — `prisma migrate dev`, `migrate deploy`, `migrate reset`, `migrate resolve`, `db push`, `db execute`, `$executeRaw*` — or **any `prisma migrate diff` variant carrying a database URL**, which silently wipes the database it points at.

package/releases/0.47.0/surfaces/prisma/tree/.claude/agents/devops.md

@@ -0,0 +1,11 @@
+<!-- nina:slot prisma.1 -->
+- **`prisma-cli`** — before `migrate deploy` or any other Prisma CLI command against a real database.
+
+<!-- nina:slot prisma.2 -->
+- **Prisma migrations go out with `prisma migrate deploy`**, and nothing else changes a shared database's schema.
+
+<!-- nina:slot prisma.3 -->
+- Run `prisma migrate diff --shadow-database-url <url>` against any live database. It **executes** the migration history against that database, destroying everything in it, and reports success. Use a disposable shadow database or don't run it.
+
+<!-- nina:slot prisma.4 -->
+- Run `prisma migrate reset` against a shared database, ever.

package/releases/0.47.0/surfaces/prisma/tree/.claude/agents/implementer.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.47.0/surfaces/prisma/tree/.claude/agents/integration-tester.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-cli` | a Prisma CLI command |

package/releases/0.47.0/surfaces/prisma/tree/.claude/agents/reviewer.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.47.0/surfaces/prisma/tree/.claude/patterns.md

@@ -0,0 +1,15 @@
+<!-- nina:slot prisma.1 -->
+- **Database table/column names** (Prisma `@map` / `@@map`): `snake_case` in SQL, `camelCase` in TS.
+
+<!-- nina:slot prisma.2 -->
+- Where Prisma reads are cached through Accelerate, `cacheStrategy` lives in `{{DB_PKG}}`: services do not add, strip, or override cache policies.
+
+<!-- nina:slot prisma.3 -->
+
+### Prisma
+
+- Schema lives in `{{DB_PKG}}/prisma/schema.prisma`. Nowhere else.
+- **Never write raw SQL** unless justified in a code comment with perf data.
+- N+1 is solved with `include` / `select`, chosen deliberately.
+- Where reads are cached through Accelerate, every `findUnique` / `findMany` on a hot path defines its `cacheStrategy`, and no direct connection string is embedded in code.
+- Tests run a real Prisma client against a real database; the client is never mocked.

package/releases/0.47.0/surfaces/prisma/tree/CLAUDE.md

@@ -0,0 +1,5 @@
+<!-- nina:slot prisma.1 -->
+| Run any `prisma` CLI command (the database gate, devops, and the integration gate where there is one) | `prisma-cli` | flags differ between versions; `migrate diff --shadow-database-url` against a live DB wiped dev/staging once |
+
+<!-- nina:slot prisma.2 -->
+| Write or audit a Prisma query (architect, implementer, the database gate, reviewer) | `prisma-client-api` | filters, operators, `$transaction` semantics. a caching or edge layer on top of the client is **NOT covered** — its cache strategy belongs to that layer's own integration doc |

package/src/commands/check.mjs

@@ -18,7 +18,7 @@ import { existsSync } from 'node:fs';
 import { join, resolve, sep } from 'node:path';
 import { SLOT, closedGate, defaultedSlots, layerRootFor, noticeOf, readLayerText, stripWhy, walk } from './compose.mjs';
 import { PLACEHOLDER, defaultVocabulary } from '../vocabulary.mjs';
-import { NEEDS } from '../surfaces.mjs';
+import { missingNeeds } from '../surfaces.mjs';
 
 /** Fields every declared integration must carry, and why each one matters. */
 const INTEGRATION_FIELDS = {
@@ -232,7 +232,8 @@ export async function check(argv, ctx) {
   }
   for (const s of new Set(surfaces)) {
     if (surfaces.filter((x) => x === s).length > 1) notes.push(`surface "${s}" is declared more than once`);
-    if (NEEDS[s] && !surfaces.includes(NEEDS[s])) problems.push(`surface "${s}" is a stack of "${NEEDS[s]}", which this profile does not declare — its rules have nowhere to land`);
+    const missing = missingNeeds(s, surfaces);
+    if (missing.length > 0) problems.push(`surface "${s}" is a stack of "${missing.join('" and "')}", which this profile does not declare — its rules have nowhere to land`);
   }
 
   // What the project has chosen to decide later, and why: a vocabulary name, a document or a project slot,
@@ -281,9 +282,14 @@ export async function check(argv, ctx) {
     for (const [field, why] of Object.entries(INTEGRATION_FIELDS)) {
       if (!entry?.[field]) problems.push(`${label} has no "${field}" — it ${why}`);
     }
-    if (entry?.kind && !KINDS.includes(entry.kind)) {
-      problems.push(`${label} has kind "${entry.kind}" — expected one of ${KINDS.join(', ')}`);
+    // A client library over a platform binding is both kinds: its own behavior is cited from its installed
+    // source, the binding's from the emulator, and one kind left half its premises with no form of evidence.
+    const kinds = [entry?.kind].flat().filter((kind) => kind !== undefined && kind !== null && kind !== '');
+    if (Array.isArray(entry?.kind) && kinds.length === 0) problems.push(`${label} has no "kind" — it ${INTEGRATION_FIELDS.kind}`);
+    for (const kind of kinds) {
+      if (!KINDS.includes(kind)) problems.push(`${label} has kind "${kind}" — expected one of ${KINDS.join(', ')}, or a list of them`);
     }
+    if (new Set(kinds).size < kinds.length) notes.push(`${label} lists a kind more than once`);
     if (entry?.slug && !existsSync(join(target, '.claude', 'integrations', `${entry.slug}.md`))) {
       owe(`.claude/integrations/${entry.slug}.md`, `${label} has no doc at .claude/integrations/${entry.slug}.md — a premise has nowhere to live`);
     }

package/src/commands/compose.mjs

@@ -33,7 +33,7 @@ export { layerRootFor };
  * to write it nothing about what belongs there. Matching keys on the id, so a fragment
  * written without the label still fills the slot.
  */
-export const SLOT = /^<!-- nina:slot ([a-z-]+\.\d+)(?:\s+([^>]*?))?\s*-->$/;
+export const SLOT = /^<!-- nina:slot ([a-z][a-z0-9-]*\.\d+)(?:\s+([^>]*?))?\s*-->$/;
 
 /** A passage that tells why a rule exists as history: kept in the layers, dropped from what is composed. */
 const WHY = /<!-- nina:why -->[\s\S]*?<!-- \/nina:why -->/g;
@@ -60,7 +60,7 @@ export function stripWhy(text, { keepLines = false } = {}) {
  * `integration-tester` because there is an external service. Composing them into a
  * project that declares neither would hand it a gate with nothing to gate.
  */
-export const REQUIRES = /^<!-- nina:requires ([a-z-]+) -->\n/;
+export const REQUIRES = /^<!-- nina:requires ([a-z][a-z0-9-]*) -->\n/;
 
 /**
  * The surface a core file is gated on when the project does not declare it — the file is not composed there —
@@ -79,7 +79,7 @@ export function closedGate(text, surfaces) {
  * A slot inside a line — text before it, and the marker last. Filled with its fragment collapsed
  * to one line; dropped, like any slot, when its surface is not declared.
  */
-const INLINE_SLOT = /<!-- nina:slot ([a-z-]+\.\d+)(?:\s+[^>]*?)?\s*-->/g;
+const INLINE_SLOT = /<!-- nina:slot ([a-z][a-z0-9-]*\.\d+)(?:\s+[^>]*?)?\s*-->/g;
 
 /**
  * Matches YAML frontmatter at the very start of a file.

package/src/commands/init.mjs

@@ -21,7 +21,7 @@ import { join, resolve } from 'node:path';
 import { REQUIRES, SLOT, byVersion, closedGate, composedPaths, composeProject, defaultedSlots, layerRootFor, projectOwned, walk } from './compose.mjs';
 import { owedDocuments } from './check.mjs';
 import { PLACEHOLDER, defaultVocabulary } from '../vocabulary.mjs';
-import { DETECTABLE, NEEDS } from '../surfaces.mjs';
+import { DETECTABLE, missingNeeds } from '../surfaces.mjs';
 import { bold, dim, green, pink } from '../look.mjs';
 
 /**
@@ -35,11 +35,13 @@ const QUESTIONS = {
   'external-api': 'Does it depend on anything whose behavior it does not define?',
   db: 'Does it own persistent data of its own?',
   prisma: 'Does it reach that data through Prisma?',
+  drizzle: 'Does it reach that data through Drizzle?',
   money: 'Does it conserve and distribute an amount — money in equals money out plus retained?',
   pii: 'Does it hold data about people that would harm someone specific if it leaked?',
   integrations: 'Does it depend on anything whose behavior it does not define?',
   frontend: 'Does it render a screen a person looks at?',
   'edge-cf': 'Does it run on Cloudflare Workers or Pages?',
+  d1: 'Does it keep that data in Cloudflare D1?',
   // Not "does it use blockchain" — that is a technology, and a technology is not a reason to
   // gate anything. What this surface costs is immutability: code that ships cannot be edited.
   blockchain: 'Does it deploy code that cannot be changed once it is live?',
@@ -59,7 +61,7 @@ function questionFor(surface) {
  * The order the interview asks in: the surfaces most projects have first, the rare ones last. Asked
  * alphabetically, the first question a web app met was whether it deploys immutable code.
  */
-const ASK_ORDER = ['db', 'prisma', 'frontend', 'integrations', 'pii', 'money', 'edge-cf', 'blockchain'];
+const ASK_ORDER = ['db', 'prisma', 'drizzle', 'frontend', 'integrations', 'pii', 'money', 'edge-cf', 'd1', 'blockchain'];
 
 /**
  * The surfaces a core offers, in the order the interview asks them; one it does not know goes last.
@@ -223,7 +225,7 @@ async function interview(available, matched, impacts) {
     for (const [n, s] of order.entries()) {
       // A stack is asked about only where its concern was answered yes: asked whether data it does not
       // own goes through Prisma, a project has nothing true to answer.
-      if (NEEDS[s] && !surfaces.includes(NEEDS[s])) continue;
+      if (missingNeeds(s, surfaces).length > 0) continue;
       const i = impacts[s];
       const reason = matched.find((d) => d.surface === s)?.why;
       // What a yes brings, in what a person would recognise: roles, rules, agents. The count of

package/src/commands/upgrade.mjs

@@ -15,7 +15,7 @@ import { describeMove, HARNESS, interruptedMove, movedFrom, moveJournal, readPro
 import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { REMOVED, composeProject, composedPaths, defaultedSlots, layerRootFor, walk } from './compose.mjs';
-import { NEEDS, detected } from '../surfaces.mjs';
+import { detected, missingNeeds } from '../surfaces.mjs';
 import { filledSlots, projectSlots, referencedVocabulary } from './check.mjs';
 import { EXPECT_ENV } from '../expected.mjs';
 import { closeAnswered } from './learn.mjs';
@@ -297,7 +297,7 @@ export async function upgrade(argv, ctx) {
   // them in silence: the rules that were in its specs yesterday are not there after the move.
   const offeredBefore = (await surfacesIn(from.dir));
   const offered = detected(await walk(target)).filter(
-    (d) => available.includes(d.surface) && !offeredBefore.includes(d.surface) && !surfaces.includes(d.surface) && (!NEEDS[d.surface] || kept.includes(NEEDS[d.surface])),
+    (d) => available.includes(d.surface) && !offeredBefore.includes(d.surface) && !surfaces.includes(d.surface) && missingNeeds(d.surface, kept).length === 0,
   );
 
   const [vocabBefore, vocabAfter] = [

package/src/surfaces.mjs

@@ -12,17 +12,33 @@
  * `init`, `check` and `upgrade` all read this, so a surface's evidence and its prerequisite are stated once.
  */
 
+/** A drizzle-kit config, which a Drizzle project usually has and nothing else names so. */
+const DRIZZLE_CONFIG = /(^|\/)drizzle\.config\.[cm]?[jt]s$/;
+
 /** Surfaces a repository reveals by its files. The rest are claims about the domain. */
 export const DETECTABLE = [
-  { surface: 'db', why: 'a Prisma schema', test: (f) => f.some((p) => p.endsWith('schema.prisma')) },
+  { surface: 'db', why: 'a Prisma schema or a drizzle-kit config', test: (f) => f.some((p) => p.endsWith('schema.prisma') || DRIZZLE_CONFIG.test(p)) },
   { surface: 'prisma', why: 'a Prisma schema', test: (f) => f.some((p) => p.endsWith('schema.prisma')) },
+  { surface: 'drizzle', why: 'a drizzle-kit config', test: (f) => f.some((p) => DRIZZLE_CONFIG.test(p)) },
   { surface: 'edge-cf', why: 'a wrangler config', test: (f) => f.some((p) => /(^|\/)wrangler\.(toml|jsonc?)$/.test(p)) },
   { surface: 'frontend', why: 'a Vite config', test: (f) => f.some((p) => /(^|\/)vite\.config\.[cm]?[jt]s$/.test(p)) },
   { surface: 'blockchain', why: 'a Foundry or Hardhat config', test: (f) => f.some((p) => /(^|\/)(foundry\.toml|hardhat\.config\.[cm]?[jt]s)$/.test(p)) },
 ];
 
-/** A stack surface, and the concern it is a stack of: declared without it, its rules have nowhere to land. */
-export const NEEDS = { prisma: 'db' };
+/**
+ * A stack surface, and every surface it is a stack of: declared without one of them, its rules have nowhere
+ * to land. Most stacks need one concern; an engine that only runs on one platform needs the platform too.
+ */
+export const NEEDS = { prisma: ['db'], drizzle: ['db'], d1: ['db', 'edge-cf'] };
+
+/**
+ * What a stack needs that a profile does not declare — empty for a surface that is not a stack.
+ *
+ * @param {string} surface - The surface asked about.
+ * @param {string[]} declared - The surfaces declared, or answered yes so far.
+ * @returns {string[]}
+ */
+export const missingNeeds = (surface, declared) => (NEEDS[surface] ?? []).filter((need) => !declared.includes(need));
 
 /**
  * The surfaces a project's files reveal, with the evidence for each.