everything-dev 1.53.1 → 2.0.0-rc.0

package/dist/db/driver.mjs

@@ -0,0 +1,165 @@
+import { pluginMigrationSlug } from "./core.mjs";
+import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+
+//#region src/db/driver.ts
+/**
+* Resolve a plugin id to its data-schema name on a shared database.
+*
+* Schema names are unconditional `plugin_<slug>` for every workspace on the
+* shared API database. The `pluginId === "api" ? undefined` special case found
+* in older plugin copies is dead code (a plugin is never `api`); api's own
+* tables already live in `plugin_api`.
+*/
+function pluginSchemaName(pluginId) {
+	return `plugin_${pluginMigrationSlug(pluginId)}`;
+}
+/**
+* Connection-level guardrails. `ALTER DATABASE ... SET` only reaches sessions
+* opened after it runs — pooled connections that already exist never inherit
+* it, so any bound must ride on every connection's startup options. Defaults:
+* a lock wait fails after 10s (unbounded waits wedge the whole pool silently),
+* a session idle inside a transaction is reaped after 30s, and statement
+* timeout stays off unless DB_STATEMENT_TIMEOUT_MS is set (long migrations and
+* analytical queries must not break).
+*/
+/**
+* Parses a millisecond env value for a Postgres `-c` timeout setting.
+* A explicit `0` disables the timeout (Postgres semantics); garbage throws —
+* a typo must fail the boot loudly, never silently become the default.
+*/
+function timeoutMsEnv(name, fallbackMs) {
+	const raw = process.env[name];
+	if (raw === void 0 || raw.trim() === "") return fallbackMs;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed < 0) throw new Error(`[db] Invalid ${name}="${raw}" — must be a non-negative number of milliseconds (0 disables the timeout).`);
+	return parsed;
+}
+function connectionOptions(namespace) {
+	return [
+		...namespace ? [`-c search_path="${namespace}",public`] : [],
+		`-c lock_timeout=${timeoutMsEnv("DB_LOCK_TIMEOUT_MS", 1e4)}`,
+		`-c idle_in_transaction_session_timeout=${timeoutMsEnv("DB_IDLE_TX_TIMEOUT_MS", 3e4)}`,
+		...process.env.DB_STATEMENT_TIMEOUT_MS ? [`-c statement_timeout=${timeoutMsEnv("DB_STATEMENT_TIMEOUT_MS", 0)}`] : []
+	].join(" ");
+}
+const isLocalDbUrl = (url) => url.includes("localhost") || url.includes("127.0.0.1") || url.includes("host.docker.internal") || url.includes(".railway.internal");
+/**
+* TLS behavior for a non-local Postgres URL, following libpq `sslmode`
+* semantics from the connection string itself:
+*
+* - `disable`            → no TLS
+* - `prefer`/`allow`/`require` → TLS, but the server's certificate is NOT
+*   verified (libpq: `require` encrypts, it does not trust). Managed
+*   providers (Railway, Neon, Supabase poolers…) hand out `sslmode=require`
+*   URLs backed by certificates no client CA bundle can verify.
+* - `verify-ca`/`verify-full` → TLS + certificate verification.
+* - absent → verification ON (secure default for bare URLs).
+*
+* `DB_SSL_REJECT_UNAUTHORIZED` stays as an explicit operator override: it
+* wins over whatever the URL says (`"false"` disables verification, `"true"`
+* forces it).
+*/
+function resolvePoolSsl(url) {
+	if (isLocalDbUrl(url)) return false;
+	let mode = null;
+	try {
+		mode = new URL(url).searchParams.get("sslmode");
+	} catch {
+		mode = null;
+	}
+	if (process.env.DB_SSL_REJECT_UNAUTHORIZED === "false") return { rejectUnauthorized: false };
+	if (process.env.DB_SSL_REJECT_UNAUTHORIZED === "true") return { rejectUnauthorized: true };
+	switch (mode) {
+		case "disable": return false;
+		case "verify-ca":
+		case "verify-full": return { rejectUnauthorized: true };
+		case "prefer":
+		case "allow":
+		case "require": return { rejectUnauthorized: false };
+		default: return { rejectUnauthorized: true };
+	}
+}
+function buildPoolConfig(url, namespace) {
+	return {
+		connectionString: url,
+		ssl: resolvePoolSsl(url),
+		max: Number(process.env.DB_POOL_MAX) || 10,
+		connectionTimeoutMillis: Number(process.env.DB_CONNECTION_TIMEOUT_MS) || 3e4,
+		idleTimeoutMillis: Number(process.env.DB_IDLE_TIMEOUT_MS) || 3e4,
+		options: connectionOptions(namespace)
+	};
+}
+async function ensureNamespaceExists(pool, namespace) {
+	const client = await pool.connect();
+	try {
+		await client.query("BEGIN");
+		try {
+			await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", ["drizzle.__drizzle_migrations"]);
+			await client.query(`CREATE SCHEMA IF NOT EXISTS "${namespace}"`);
+			await client.query("COMMIT");
+		} catch (error) {
+			await client.query("ROLLBACK");
+			throw error;
+		}
+	} finally {
+		client.release();
+	}
+}
+function createCloseHandler(pool) {
+	let closed = false;
+	return async () => {
+		if (closed) return;
+		closed = true;
+		pool.removeAllListeners("error");
+		pool.removeAllListeners("connect");
+		await pool.end();
+	};
+}
+/**
+* Create a drizzle database driver for a plugin, choosing the engine by URL
+* scheme: `pglite:` / `:memory:` → embedded PGlite, anything else → postgres
+* (`pg.Pool`).
+*
+* Drivers stay externalized (never statically imported, never in the Module
+* Federation singleton share set) — they are loaded here via dynamic `import()`
+* only, and `drizzle-orm` appears as a runtime import for the `drizzle` entry
+* points. The `namespace` option expresses every topology the platform needs:
+* `plugin_<slug>` on a shared database, undefined for public-schema (api) or
+* dedicated-database (auth) workloads.
+*/
+async function createDatabaseDriver(url, schema, namespace) {
+	if (url.startsWith("pglite:") || url === ":memory:") {
+		const { drizzle } = await import("drizzle-orm/pglite");
+		const { PGlite } = await import("@electric-sql/pglite");
+		const rawDir = url === ":memory:" ? ":memory:" : url.replace("pglite:", "");
+		const dataDir = rawDir.endsWith("/:memory:") || rawDir === ":memory:" ? "memory://" : rawDir;
+		if (dataDir !== "memory://") mkdirSync(dirname(dataDir), { recursive: true });
+		const pglite = new PGlite(dataDir);
+		if (namespace) {
+			await pglite.exec(`CREATE SCHEMA IF NOT EXISTS "${namespace}"`);
+			await pglite.exec(`SET search_path TO "${namespace}", public`);
+		}
+		return {
+			db: drizzle(pglite, { schema }),
+			close: async () => {
+				await pglite.close();
+			}
+		};
+	}
+	const { Pool } = await import("pg");
+	const { drizzle } = await import("drizzle-orm/node-postgres");
+	const pool = new Pool(buildPoolConfig(url, namespace));
+	pool.on("error", (err) => {
+		console.error("[Database] Unexpected pool error:", err.message);
+	});
+	if (namespace) await ensureNamespaceExists(pool, namespace);
+	return {
+		db: drizzle(pool, { schema }),
+		close: createCloseHandler(pool)
+	};
+}
+
+//#endregion
+export { createDatabaseDriver, pluginSchemaName, resolvePoolSsl };
+//# sourceMappingURL=driver.mjs.map

package/dist/db/driver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.mjs","names":[],"sources":["../../src/db/driver.ts"],"sourcesContent":["import { mkdirSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport type { PgDatabase, PgQueryResultHKT } from \"drizzle-orm/pg-core\";\nimport { pluginMigrationSlug } from \"./core\";\n\nexport interface DatabaseDriver<TSchema extends Record<string, unknown>> {\n  readonly db: PgDatabase<PgQueryResultHKT, TSchema>;\n  close(): Promise<void>;\n}\n\n/**\n * Resolve a plugin id to its data-schema name on a shared database.\n *\n * Schema names are unconditional `plugin_<slug>` for every workspace on the\n * shared API database. The `pluginId === \"api\" ? undefined` special case found\n * in older plugin copies is dead code (a plugin is never `api`); api's own\n * tables already live in `plugin_api`.\n */\nexport function pluginSchemaName(pluginId: string): string {\n  return `plugin_${pluginMigrationSlug(pluginId)}`;\n}\n\ninterface PoolLike {\n  on(event: \"error\", listener: (err: Error) => void): unknown;\n  connect(): Promise<{\n    query: (sql: string, params?: unknown[]) => Promise<unknown>;\n    release: () => void;\n  }>;\n  removeAllListeners(event?: string | symbol): unknown;\n  end(): Promise<void>;\n}\n\n/**\n * Connection-level guardrails. `ALTER DATABASE ... SET` only reaches sessions\n * opened after it runs — pooled connections that already exist never inherit\n * it, so any bound must ride on every connection's startup options. Defaults:\n * a lock wait fails after 10s (unbounded waits wedge the whole pool silently),\n * a session idle inside a transaction is reaped after 30s, and statement\n * timeout stays off unless DB_STATEMENT_TIMEOUT_MS is set (long migrations and\n * analytical queries must not break).\n */\n/**\n * Parses a millisecond env value for a Postgres `-c` timeout setting.\n * A explicit `0` disables the timeout (Postgres semantics); garbage throws —\n * a typo must fail the boot loudly, never silently become the default.\n */\nfunction timeoutMsEnv(name: string, fallbackMs: number): number {\n  const raw = process.env[name];\n  if (raw === undefined || raw.trim() === \"\") return fallbackMs;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed < 0) {\n    throw new Error(\n      `[db] Invalid ${name}=\"${raw}\" — must be a non-negative number of milliseconds (0 disables the timeout).`,\n    );\n  }\n  return parsed;\n}\n\nfunction connectionOptions(namespace: string | undefined): string {\n  const settings = [\n    ...(namespace ? [`-c search_path=\"${namespace}\",public`] : []),\n    `-c lock_timeout=${timeoutMsEnv(\"DB_LOCK_TIMEOUT_MS\", 10_000)}`,\n    `-c idle_in_transaction_session_timeout=${timeoutMsEnv(\"DB_IDLE_TX_TIMEOUT_MS\", 30_000)}`,\n    ...(process.env.DB_STATEMENT_TIMEOUT_MS\n      ? [`-c statement_timeout=${timeoutMsEnv(\"DB_STATEMENT_TIMEOUT_MS\", 0)}`]\n      : []),\n  ];\n  return settings.join(\" \");\n}\n\n// host.docker.internal is docker-local development networking — the test\n// databases a container reaches through the host gateway, which do not\n// terminate TLS. `*.railway.internal` is Railway private-network traffic\n// (VPC-scoped, no public egress) whose Postgres presents a self-signed\n// certificate chain no client CA bundle can verify.\nconst isLocalDbUrl = (url: string): boolean =>\n  url.includes(\"localhost\") ||\n  url.includes(\"127.0.0.1\") ||\n  url.includes(\"host.docker.internal\") ||\n  url.includes(\".railway.internal\");\n\n/**\n * TLS behavior for a non-local Postgres URL, following libpq `sslmode`\n * semantics from the connection string itself:\n *\n * - `disable`            → no TLS\n * - `prefer`/`allow`/`require` → TLS, but the server's certificate is NOT\n *   verified (libpq: `require` encrypts, it does not trust). Managed\n *   providers (Railway, Neon, Supabase poolers…) hand out `sslmode=require`\n *   URLs backed by certificates no client CA bundle can verify.\n * - `verify-ca`/`verify-full` → TLS + certificate verification.\n * - absent → verification ON (secure default for bare URLs).\n *\n * `DB_SSL_REJECT_UNAUTHORIZED` stays as an explicit operator override: it\n * wins over whatever the URL says (`\"false\"` disables verification, `\"true\"`\n * forces it).\n */\nexport function resolvePoolSsl(url: string): false | { rejectUnauthorized: boolean } {\n  if (isLocalDbUrl(url)) return false;\n\n  let mode: string | null = null;\n  try {\n    mode = new URL(url).searchParams.get(\"sslmode\");\n  } catch {\n    mode = null;\n  }\n\n  if (process.env.DB_SSL_REJECT_UNAUTHORIZED === \"false\") return { rejectUnauthorized: false };\n  if (process.env.DB_SSL_REJECT_UNAUTHORIZED === \"true\") return { rejectUnauthorized: true };\n\n  switch (mode) {\n    case \"disable\":\n      return false;\n    case \"verify-ca\":\n    case \"verify-full\":\n      return { rejectUnauthorized: true };\n    case \"prefer\":\n    case \"allow\":\n    case \"require\":\n      return { rejectUnauthorized: false };\n    default:\n      return { rejectUnauthorized: true };\n  }\n}\n\nfunction buildPoolConfig(url: string, namespace: string | undefined) {\n  return {\n    connectionString: url,\n    ssl: resolvePoolSsl(url),\n    max: Number(process.env.DB_POOL_MAX) || 10,\n    connectionTimeoutMillis: Number(process.env.DB_CONNECTION_TIMEOUT_MS) || 30_000,\n    idleTimeoutMillis: Number(process.env.DB_IDLE_TIMEOUT_MS) || 30_000,\n    options: connectionOptions(namespace),\n  };\n}\n\nasync function ensureNamespaceExists(pool: PoolLike, namespace: string): Promise<void> {\n  const client = await pool.connect();\n  try {\n    await client.query(\"BEGIN\");\n    try {\n      // Same journal-scoped advisory lock the migration runner holds, so this\n      // CREATE SCHEMA cannot race a concurrent migration run (the runner also\n      // creates the schema inside its locked transaction). Xact-scoped: the\n      // lock releases at COMMIT/ROLLBACK or on connection death.\n      await client.query(\"SELECT pg_advisory_xact_lock(hashtextextended($1, 0))\", [\n        \"drizzle.__drizzle_migrations\",\n      ]);\n      await client.query(`CREATE SCHEMA IF NOT EXISTS \"${namespace}\"`);\n      await client.query(\"COMMIT\");\n    } catch (error) {\n      await client.query(\"ROLLBACK\");\n      throw error;\n    }\n  } finally {\n    client.release();\n  }\n}\n\nfunction createCloseHandler(pool: PoolLike): () => Promise<void> {\n  let closed = false;\n  return async () => {\n    if (closed) return;\n    closed = true;\n    pool.removeAllListeners(\"error\");\n    pool.removeAllListeners(\"connect\");\n    await pool.end();\n  };\n}\n\n/**\n * Create a drizzle database driver for a plugin, choosing the engine by URL\n * scheme: `pglite:` / `:memory:` → embedded PGlite, anything else → postgres\n * (`pg.Pool`).\n *\n * Drivers stay externalized (never statically imported, never in the Module\n * Federation singleton share set) — they are loaded here via dynamic `import()`\n * only, and `drizzle-orm` appears as a runtime import for the `drizzle` entry\n * points. The `namespace` option expresses every topology the platform needs:\n * `plugin_<slug>` on a shared database, undefined for public-schema (api) or\n * dedicated-database (auth) workloads.\n */\nexport async function createDatabaseDriver<TSchema extends Record<string, unknown>>(\n  url: string,\n  schema: TSchema,\n  namespace?: string,\n): Promise<DatabaseDriver<TSchema>> {\n  if (url.startsWith(\"pglite:\") || url === \":memory:\") {\n    const { drizzle } = await import(\"drizzle-orm/pglite\");\n    const { PGlite } = await import(\"@electric-sql/pglite\");\n    const rawDir = url === \":memory:\" ? \":memory:\" : url.replace(\"pglite:\", \"\");\n    const dataDir = rawDir.endsWith(\"/:memory:\") || rawDir === \":memory:\" ? \"memory://\" : rawDir;\n    if (dataDir !== \"memory://\") {\n      mkdirSync(dirname(dataDir), { recursive: true });\n    }\n    const pglite = new PGlite(dataDir);\n    if (namespace) {\n      await pglite.exec(`CREATE SCHEMA IF NOT EXISTS \"${namespace}\"`);\n      await pglite.exec(`SET search_path TO \"${namespace}\", public`);\n    }\n    const db = drizzle(pglite, { schema: schema as never }) as unknown as PgDatabase<\n      PgQueryResultHKT,\n      TSchema\n    >;\n    return {\n      db,\n      close: async () => {\n        await pglite.close();\n      },\n    };\n  }\n\n  const { Pool } = await import(\"pg\");\n  const { drizzle } = await import(\"drizzle-orm/node-postgres\");\n  const pool = new Pool(buildPoolConfig(url, namespace) as never) as unknown as PoolLike;\n  pool.on(\"error\", (err: Error) => {\n    console.error(\"[Database] Unexpected pool error:\", err.message);\n  });\n\n  if (namespace) {\n    await ensureNamespaceExists(pool, namespace);\n  }\n\n  const db = drizzle(pool as never, { schema: schema as never }) as unknown as PgDatabase<\n    PgQueryResultHKT,\n    TSchema\n  >;\n\n  return {\n    db,\n    close: createCloseHandler(pool),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,SAAgB,iBAAiB,UAA0B;CACzD,OAAO,UAAU,oBAAoB,QAAQ;AAC/C;;;;;;;;;;;;;;;AA0BA,SAAS,aAAa,MAAc,YAA4B;CAC9D,MAAM,MAAM,QAAQ,IAAI;CACxB,IAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,IAAI,OAAO;CACnD,MAAM,SAAS,OAAO,GAAG;CACzB,IAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,GACvC,MAAM,IAAI,MACR,gBAAgB,KAAK,IAAI,IAAI,4EAC/B;CAEF,OAAO;AACT;AAEA,SAAS,kBAAkB,WAAuC;CAShE,OAAO;EAPL,GAAI,YAAY,CAAC,mBAAmB,UAAU,SAAS,IAAI,CAAC;EAC5D,mBAAmB,aAAa,sBAAsB,GAAM;EAC5D,0CAA0C,aAAa,yBAAyB,GAAM;EACtF,GAAI,QAAQ,IAAI,0BACZ,CAAC,wBAAwB,aAAa,2BAA2B,CAAC,GAAG,IACrE,CAAC;CAEO,CAAC,CAAC,KAAK,GAAG;AAC1B;AAOA,MAAM,gBAAgB,QACpB,IAAI,SAAS,WAAW,KACxB,IAAI,SAAS,WAAW,KACxB,IAAI,SAAS,sBAAsB,KACnC,IAAI,SAAS,mBAAmB;;;;;;;;;;;;;;;;;AAkBlC,SAAgB,eAAe,KAAsD;CACnF,IAAI,aAAa,GAAG,GAAG,OAAO;CAE9B,IAAI,OAAsB;CAC1B,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,aAAa,IAAI,SAAS;CAChD,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,QAAQ,IAAI,+BAA+B,SAAS,OAAO,EAAE,oBAAoB,MAAM;CAC3F,IAAI,QAAQ,IAAI,+BAA+B,QAAQ,OAAO,EAAE,oBAAoB,KAAK;CAEzF,QAAQ,MAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK;EACL,KAAK,eACH,OAAO,EAAE,oBAAoB,KAAK;EACpC,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO,EAAE,oBAAoB,MAAM;EACrC,SACE,OAAO,EAAE,oBAAoB,KAAK;CACtC;AACF;AAEA,SAAS,gBAAgB,KAAa,WAA+B;CACnE,OAAO;EACL,kBAAkB;EAClB,KAAK,eAAe,GAAG;EACvB,KAAK,OAAO,QAAQ,IAAI,WAAW,KAAK;EACxC,yBAAyB,OAAO,QAAQ,IAAI,wBAAwB,KAAK;EACzE,mBAAmB,OAAO,QAAQ,IAAI,kBAAkB,KAAK;EAC7D,SAAS,kBAAkB,SAAS;CACtC;AACF;AAEA,eAAe,sBAAsB,MAAgB,WAAkC;CACrF,MAAM,SAAS,MAAM,KAAK,QAAQ;CAClC,IAAI;EACF,MAAM,OAAO,MAAM,OAAO;EAC1B,IAAI;GAKF,MAAM,OAAO,MAAM,yDAAyD,CAC1E,8BACF,CAAC;GACD,MAAM,OAAO,MAAM,gCAAgC,UAAU,EAAE;GAC/D,MAAM,OAAO,MAAM,QAAQ;EAC7B,SAAS,OAAO;GACd,MAAM,OAAO,MAAM,UAAU;GAC7B,MAAM;EACR;CACF,UAAU;EACR,OAAO,QAAQ;CACjB;AACF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,IAAI,SAAS;CACb,OAAO,YAAY;EACjB,IAAI,QAAQ;EACZ,SAAS;EACT,KAAK,mBAAmB,OAAO;EAC/B,KAAK,mBAAmB,SAAS;EACjC,MAAM,KAAK,IAAI;CACjB;AACF;;;;;;;;;;;;;AAcA,eAAsB,qBACpB,KACA,QACA,WACkC;CAClC,IAAI,IAAI,WAAW,SAAS,KAAK,QAAQ,YAAY;EACnD,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,QAAQ,aAAa,aAAa,IAAI,QAAQ,WAAW,EAAE;EAC1E,MAAM,UAAU,OAAO,SAAS,WAAW,KAAK,WAAW,aAAa,cAAc;EACtF,IAAI,YAAY,aACd,UAAU,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;EAEjD,MAAM,SAAS,IAAI,OAAO,OAAO;EACjC,IAAI,WAAW;GACb,MAAM,OAAO,KAAK,gCAAgC,UAAU,EAAE;GAC9D,MAAM,OAAO,KAAK,uBAAuB,UAAU,UAAU;EAC/D;EAKA,OAAO;GACL,IALS,QAAQ,QAAQ,EAAU,OAAgB,CAKlD;GACD,OAAO,YAAY;IACjB,MAAM,OAAO,MAAM;GACrB;EACF;CACF;CAEA,MAAM,EAAE,SAAS,MAAM,OAAO;CAC9B,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,MAAM,OAAO,IAAI,KAAK,gBAAgB,KAAK,SAAS,CAAU;CAC9D,KAAK,GAAG,UAAU,QAAe;EAC/B,QAAQ,MAAM,qCAAqC,IAAI,OAAO;CAChE,CAAC;CAED,IAAI,WACF,MAAM,sBAAsB,MAAM,SAAS;CAQ7C,OAAO;EACL,IANS,QAAQ,MAAe,EAAU,OAAgB,CAMzD;EACD,OAAO,mBAAmB,IAAI;CAChC;AACF"}

package/dist/db/drizzle-kit.cjs

@@ -0,0 +1,177 @@
+const require_binding = require('./binding.cjs');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+let effect = require("effect");
+let node_child_process = require("node:child_process");
+
+//#region src/db/drizzle-kit.ts
+var DrizzleKitError = class extends effect.Data.TaggedError("DrizzleKitError") {};
+var DrizzleKit = class extends effect.Context.Service()("everything-dev/DrizzleKit") {};
+/**
+* The single choke point for invoking drizzle-kit. Every child receives the
+* composition root's materialized environment (`bindingEnv`) so the config it
+* evaluates never has to re-derive credentials from ambient state.
+*/
+function spawnDrizzleKit(spec) {
+	return effect.Effect.callback((resume) => {
+		let stderr = "";
+		let settled = false;
+		const settle = (effect$1) => {
+			if (settled) return;
+			settled = true;
+			resume(effect$1);
+		};
+		const child = (0, node_child_process.spawn)(process.platform === "win32" ? "npx.cmd" : "npx", [...spec.args], {
+			cwd: spec.cwd,
+			env: spec.env,
+			stdio: spec.stdio
+		});
+		if (spec.stdio === "pipe") child.stderr?.on("data", (data) => {
+			stderr += data.toString();
+		});
+		child.on("error", (err) => {
+			const hint = err.code === "ENOENT" ? "\"npx\" not found. Ensure Node.js is installed." : err.message;
+			settle(effect.Effect.fail(new DrizzleKitError({
+				command: spec.command,
+				message: hint,
+				exitCode: void 0
+			})));
+		});
+		child.on("exit", (code) => {
+			if (code === 0 || code === null) {
+				settle(effect.Effect.void);
+				return;
+			}
+			settle(effect.Effect.fail(new DrizzleKitError({
+				command: spec.command,
+				message: `drizzle-kit ${spec.command} exited with code ${code}${stderr.trim() ? `: ${stderr.trim()}` : ""}`,
+				exitCode: code
+			})));
+		});
+		return effect.Effect.sync(() => {
+			if (child.exitCode === null && !child.killed) child.kill();
+		});
+	});
+}
+function childEnv(binding) {
+	return {
+		...process.env,
+		...require_binding.bindingEnv({
+			secretName: binding.identity.secretName,
+			url: binding.url
+		})
+	};
+}
+function workspaceConfigPath(binding) {
+	const workspaceDir = binding.identity.workspaceDir;
+	if (!workspaceDir) return void 0;
+	const configPath = (0, node_path.join)(workspaceDir, "drizzle.config.ts");
+	return (0, node_fs.existsSync)(configPath) ? configPath : void 0;
+}
+function writeGeneratedConfig(binding, projectDir) {
+	const dbDir = (0, node_path.resolve)(projectDir, ".bos", "db", binding.key);
+	(0, node_fs.mkdirSync)(dbDir, { recursive: true });
+	const configPath = (0, node_path.join)(dbDir, "drizzle.config.ts");
+	const configContent = `import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  schema: "./drizzle/schema.ts",
+  out: "./drizzle",
+  dialect: "postgresql",
+  dbCredentials: {
+    url: "${binding.url}",
+  },
+  migrations: {
+    schema: "${binding.identity.journal.schema}",
+    table: "${binding.identity.journal.table}",
+  },
+  verbose: true,
+  strict: true,
+});
+`;
+	(0, node_fs.writeFileSync)(configPath, configContent);
+	return dbDir;
+}
+const makeDrizzleKitLive = (options) => effect.Layer.succeed(DrizzleKit, {
+	studio: (binding) => effect.Effect.gen(function* () {
+		const localConfig = workspaceConfigPath(binding);
+		if (localConfig && binding.identity.workspaceDir) {
+			options.onLog?.(`Starting Drizzle Studio for ${binding.key} (local)...`);
+			yield* spawnDrizzleKit({
+				args: [
+					"drizzle-kit",
+					"studio",
+					"--config",
+					localConfig
+				],
+				cwd: binding.identity.workspaceDir,
+				env: childEnv(binding),
+				command: "studio",
+				stdio: "inherit"
+			});
+			return;
+		}
+		if (binding.source === "local") return yield* new DrizzleKitError({
+			command: "studio",
+			message: `No drizzle.config.ts found in ${binding.identity.workspaceDir ?? binding.key}. Run 'drizzle-kit init' first in the plugin workspace.`,
+			exitCode: void 0
+		});
+		options.onLog?.(`Introspecting database schema for ${binding.key}...`);
+		const dbDir = writeGeneratedConfig(binding, options.projectDir);
+		yield* spawnDrizzleKit({
+			args: [
+				"drizzle-kit",
+				"pull",
+				"--config",
+				(0, node_path.join)(dbDir, "drizzle.config.ts")
+			],
+			cwd: dbDir,
+			env: childEnv(binding),
+			command: "pull",
+			stdio: "inherit"
+		}).pipe(effect.Effect.mapError((error) => new DrizzleKitError({
+			command: "pull",
+			exitCode: error.exitCode,
+			message: `Failed to introspect database for "${binding.key}". Check that ${binding.identity.secretName} is correct and the database is reachable. ` + error.message
+		})));
+		options.onLog?.(`Starting Drizzle Studio for ${binding.key}...`);
+		yield* spawnDrizzleKit({
+			args: [
+				"drizzle-kit",
+				"studio",
+				"--config",
+				(0, node_path.join)(dbDir, "drizzle.config.ts")
+			],
+			cwd: dbDir,
+			env: childEnv(binding),
+			command: "studio",
+			stdio: "inherit"
+		});
+	}),
+	migrate: (binding) => {
+		const configPath = workspaceConfigPath(binding);
+		if (!configPath || !binding.identity.workspaceDir) return effect.Effect.fail(new DrizzleKitError({
+			command: "migrate",
+			message: `No drizzle.config.ts found in ${binding.identity.workspaceDir ?? binding.key}.`,
+			exitCode: void 0
+		}));
+		return spawnDrizzleKit({
+			args: [
+				"drizzle-kit",
+				"migrate",
+				"--config",
+				configPath
+			],
+			cwd: binding.identity.workspaceDir,
+			env: childEnv(binding),
+			command: "migrate",
+			stdio: "pipe"
+		});
+	}
+});
+
+//#endregion
+exports.DrizzleKit = DrizzleKit;
+exports.DrizzleKitError = DrizzleKitError;
+exports.makeDrizzleKitLive = makeDrizzleKitLive;
+//# sourceMappingURL=drizzle-kit.cjs.map

package/dist/db/drizzle-kit.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle-kit.cjs","names":["Data","Context","Effect","effect","spawn","bindingEnv","join","existsSync","resolve","Layer"],"sources":["../../src/db/drizzle-kit.ts"],"sourcesContent":["import { spawn } from \"node:child_process\";\nimport { existsSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { Context, Data, Effect, Layer } from \"effect\";\nimport { bindingEnv } from \"./binding\";\nimport type { DatabaseBinding } from \"./bindings\";\n\nexport class DrizzleKitError extends Data.TaggedError(\"DrizzleKitError\")<{\n  readonly command: string;\n  readonly message: string;\n  readonly exitCode: number | undefined;\n}> {}\n\nexport interface DrizzleKitService {\n  readonly studio: (binding: DatabaseBinding) => Effect.Effect<void, DrizzleKitError>;\n  readonly migrate: (binding: DatabaseBinding) => Effect.Effect<void, DrizzleKitError>;\n}\n\nexport class DrizzleKit extends Context.Service<DrizzleKit, DrizzleKitService>()(\n  \"everything-dev/DrizzleKit\",\n) {}\n\ninterface SpawnSpec {\n  readonly args: readonly string[];\n  readonly cwd: string;\n  readonly env: Record<string, string | undefined>;\n  readonly command: string;\n  readonly stdio: \"inherit\" | \"pipe\";\n}\n\n/**\n * The single choke point for invoking drizzle-kit. Every child receives the\n * composition root's materialized environment (`bindingEnv`) so the config it\n * evaluates never has to re-derive credentials from ambient state.\n */\nfunction spawnDrizzleKit(spec: SpawnSpec): Effect.Effect<void, DrizzleKitError> {\n  return Effect.callback((resume) => {\n    let stderr = \"\";\n    let settled = false;\n    const settle = (effect: Effect.Effect<void, DrizzleKitError>) => {\n      if (settled) return;\n      settled = true;\n      resume(effect);\n    };\n\n    const child = spawn(process.platform === \"win32\" ? \"npx.cmd\" : \"npx\", [...spec.args], {\n      cwd: spec.cwd,\n      env: spec.env,\n      stdio: spec.stdio,\n    });\n\n    if (spec.stdio === \"pipe\") {\n      child.stderr?.on(\"data\", (data: Buffer) => {\n        stderr += data.toString();\n      });\n    }\n\n    child.on(\"error\", (err) => {\n      const hint =\n        (err as NodeJS.ErrnoException).code === \"ENOENT\"\n          ? '\"npx\" not found. Ensure Node.js is installed.'\n          : err.message;\n      settle(\n        Effect.fail(\n          new DrizzleKitError({ command: spec.command, message: hint, exitCode: undefined }),\n        ),\n      );\n    });\n\n    child.on(\"exit\", (code) => {\n      if (code === 0 || code === null) {\n        settle(Effect.void);\n        return;\n      }\n      settle(\n        Effect.fail(\n          new DrizzleKitError({\n            command: spec.command,\n            message: `drizzle-kit ${spec.command} exited with code ${code}${\n              stderr.trim() ? `: ${stderr.trim()}` : \"\"\n            }`,\n            exitCode: code,\n          }),\n        ),\n      );\n    });\n\n    return Effect.sync(() => {\n      if (child.exitCode === null && !child.killed) child.kill();\n    });\n  });\n}\n\nfunction childEnv(binding: DatabaseBinding): Record<string, string | undefined> {\n  return {\n    ...process.env,\n    ...bindingEnv({ secretName: binding.identity.secretName, url: binding.url }),\n  };\n}\n\nfunction workspaceConfigPath(binding: DatabaseBinding): string | undefined {\n  const workspaceDir = binding.identity.workspaceDir;\n  if (!workspaceDir) return undefined;\n  const configPath = join(workspaceDir, \"drizzle.config.ts\");\n  return existsSync(configPath) ? configPath : undefined;\n}\n\nfunction writeGeneratedConfig(binding: DatabaseBinding, projectDir: string): string {\n  const dbDir = resolve(projectDir, \".bos\", \"db\", binding.key);\n  mkdirSync(dbDir, { recursive: true });\n\n  const configPath = join(dbDir, \"drizzle.config.ts\");\n  const configContent = `import { defineConfig } from \"drizzle-kit\";\n\nexport default defineConfig({\n  schema: \"./drizzle/schema.ts\",\n  out: \"./drizzle\",\n  dialect: \"postgresql\",\n  dbCredentials: {\n    url: \"${binding.url}\",\n  },\n  migrations: {\n    schema: \"${binding.identity.journal.schema}\",\n    table: \"${binding.identity.journal.table}\",\n  },\n  verbose: true,\n  strict: true,\n});\n`;\n\n  writeFileSync(configPath, configContent);\n  return dbDir;\n}\n\nexport interface DrizzleKitOptions {\n  readonly projectDir: string;\n  readonly onLog?: (message: string) => void;\n}\n\nexport const makeDrizzleKitLive = (options: DrizzleKitOptions): Layer.Layer<DrizzleKit> =>\n  Layer.succeed(DrizzleKit, {\n    studio: (binding) =>\n      Effect.gen(function* () {\n        const localConfig = workspaceConfigPath(binding);\n\n        if (localConfig && binding.identity.workspaceDir) {\n          options.onLog?.(`Starting Drizzle Studio for ${binding.key} (local)...`);\n          yield* spawnDrizzleKit({\n            args: [\"drizzle-kit\", \"studio\", \"--config\", localConfig],\n            cwd: binding.identity.workspaceDir,\n            env: childEnv(binding),\n            command: \"studio\",\n            stdio: \"inherit\",\n          });\n          return;\n        }\n\n        if (binding.source === \"local\") {\n          return yield* new DrizzleKitError({\n            command: \"studio\",\n            message:\n              `No drizzle.config.ts found in ${binding.identity.workspaceDir ?? binding.key}. ` +\n              `Run 'drizzle-kit init' first in the plugin workspace.`,\n            exitCode: undefined,\n          });\n        }\n\n        options.onLog?.(`Introspecting database schema for ${binding.key}...`);\n        const dbDir = writeGeneratedConfig(binding, options.projectDir);\n        yield* spawnDrizzleKit({\n          args: [\"drizzle-kit\", \"pull\", \"--config\", join(dbDir, \"drizzle.config.ts\")],\n          cwd: dbDir,\n          env: childEnv(binding),\n          command: \"pull\",\n          stdio: \"inherit\",\n        }).pipe(\n          Effect.mapError(\n            (error) =>\n              new DrizzleKitError({\n                command: \"pull\",\n                exitCode: error.exitCode,\n                message:\n                  `Failed to introspect database for \"${binding.key}\". ` +\n                  `Check that ${binding.identity.secretName} is correct and the database is reachable. ` +\n                  error.message,\n              }),\n          ),\n        );\n\n        options.onLog?.(`Starting Drizzle Studio for ${binding.key}...`);\n        yield* spawnDrizzleKit({\n          args: [\"drizzle-kit\", \"studio\", \"--config\", join(dbDir, \"drizzle.config.ts\")],\n          cwd: dbDir,\n          env: childEnv(binding),\n          command: \"studio\",\n          stdio: \"inherit\",\n        });\n      }),\n\n    migrate: (binding) => {\n      const configPath = workspaceConfigPath(binding);\n      if (!configPath || !binding.identity.workspaceDir) {\n        return Effect.fail(\n          new DrizzleKitError({\n            command: \"migrate\",\n            message: `No drizzle.config.ts found in ${binding.identity.workspaceDir ?? binding.key}.`,\n            exitCode: undefined,\n          }),\n        );\n      }\n      return spawnDrizzleKit({\n        args: [\"drizzle-kit\", \"migrate\", \"--config\", configPath],\n        cwd: binding.identity.workspaceDir,\n        env: childEnv(binding),\n        command: \"migrate\",\n        stdio: \"pipe\",\n      });\n    },\n  });\n"],"mappings":";;;;;;;AAOA,IAAa,kBAAb,cAAqCA,YAAK,YAAY,iBAAiB,CAAC,CAIrE,CAAC;AAOJ,IAAa,aAAb,cAAgCC,eAAQ,QAAuC,CAAC,CAC9E,2BACF,CAAC,CAAC,CAAC;;;;;;AAeH,SAAS,gBAAgB,MAAuD;CAC9E,OAAOC,cAAO,UAAU,WAAW;EACjC,IAAI,SAAS;EACb,IAAI,UAAU;EACd,MAAM,UAAU,aAAiD;GAC/D,IAAI,SAAS;GACb,UAAU;GACV,OAAOC,QAAM;EACf;EAEA,MAAM,YAAQC,0BAAM,QAAQ,aAAa,UAAU,YAAY,OAAO,CAAC,GAAG,KAAK,IAAI,GAAG;GACpF,KAAK,KAAK;GACV,KAAK,KAAK;GACV,OAAO,KAAK;EACd,CAAC;EAED,IAAI,KAAK,UAAU,QACjB,MAAM,QAAQ,GAAG,SAAS,SAAiB;GACzC,UAAU,KAAK,SAAS;EAC1B,CAAC;EAGH,MAAM,GAAG,UAAU,QAAQ;GACzB,MAAM,OACH,IAA8B,SAAS,WACpC,oDACA,IAAI;GACV,OACEF,cAAO,KACL,IAAI,gBAAgB;IAAE,SAAS,KAAK;IAAS,SAAS;IAAM,UAAU;GAAU,CAAC,CACnF,CACF;EACF,CAAC;EAED,MAAM,GAAG,SAAS,SAAS;GACzB,IAAI,SAAS,KAAK,SAAS,MAAM;IAC/B,OAAOA,cAAO,IAAI;IAClB;GACF;GACA,OACEA,cAAO,KACL,IAAI,gBAAgB;IAClB,SAAS,KAAK;IACd,SAAS,eAAe,KAAK,QAAQ,oBAAoB,OACvD,OAAO,KAAK,IAAI,KAAK,OAAO,KAAK,MAAM;IAEzC,UAAU;GACZ,CAAC,CACH,CACF;EACF,CAAC;EAED,OAAOA,cAAO,WAAW;GACvB,IAAI,MAAM,aAAa,QAAQ,CAAC,MAAM,QAAQ,MAAM,KAAK;EAC3D,CAAC;CACH,CAAC;AACH;AAEA,SAAS,SAAS,SAA8D;CAC9E,OAAO;EACL,GAAG,QAAQ;EACX,GAAGG,2BAAW;GAAE,YAAY,QAAQ,SAAS;GAAY,KAAK,QAAQ;EAAI,CAAC;CAC7E;AACF;AAEA,SAAS,oBAAoB,SAA8C;CACzE,MAAM,eAAe,QAAQ,SAAS;CACtC,IAAI,CAAC,cAAc,OAAO;CAC1B,MAAM,iBAAaC,gBAAK,cAAc,mBAAmB;CACzD,WAAOC,oBAAW,UAAU,IAAI,aAAa;AAC/C;AAEA,SAAS,qBAAqB,SAA0B,YAA4B;CAClF,MAAM,YAAQC,mBAAQ,YAAY,QAAQ,MAAM,QAAQ,GAAG;CAC3D,uBAAU,OAAO,EAAE,WAAW,KAAK,CAAC;CAEpC,MAAM,iBAAaF,gBAAK,OAAO,mBAAmB;CAClD,MAAM,gBAAgB;;;;;;;YAOZ,QAAQ,IAAI;;;eAGT,QAAQ,SAAS,QAAQ,OAAO;cACjC,QAAQ,SAAS,QAAQ,MAAM;;;;;;CAO3C,2BAAc,YAAY,aAAa;CACvC,OAAO;AACT;AAOA,MAAa,sBAAsB,YACjCG,aAAM,QAAQ,YAAY;CACxB,SAAS,YACPP,cAAO,IAAI,aAAa;EACtB,MAAM,cAAc,oBAAoB,OAAO;EAE/C,IAAI,eAAe,QAAQ,SAAS,cAAc;GAChD,QAAQ,QAAQ,+BAA+B,QAAQ,IAAI,YAAY;GACvE,OAAO,gBAAgB;IACrB,MAAM;KAAC;KAAe;KAAU;KAAY;IAAW;IACvD,KAAK,QAAQ,SAAS;IACtB,KAAK,SAAS,OAAO;IACrB,SAAS;IACT,OAAO;GACT,CAAC;GACD;EACF;EAEA,IAAI,QAAQ,WAAW,SACrB,OAAO,OAAO,IAAI,gBAAgB;GAChC,SAAS;GACT,SACE,iCAAiC,QAAQ,SAAS,gBAAgB,QAAQ,IAAI;GAEhF,UAAU;EACZ,CAAC;EAGH,QAAQ,QAAQ,qCAAqC,QAAQ,IAAI,IAAI;EACrE,MAAM,QAAQ,qBAAqB,SAAS,QAAQ,UAAU;EAC9D,OAAO,gBAAgB;GACrB,MAAM;IAAC;IAAe;IAAQ;QAAYI,gBAAK,OAAO,mBAAmB;GAAC;GAC1E,KAAK;GACL,KAAK,SAAS,OAAO;GACrB,SAAS;GACT,OAAO;EACT,CAAC,CAAC,CAAC,KACDJ,cAAO,UACJ,UACC,IAAI,gBAAgB;GAClB,SAAS;GACT,UAAU,MAAM;GAChB,SACE,sCAAsC,QAAQ,IAAI,gBACpC,QAAQ,SAAS,WAAW,+CAC1C,MAAM;EACV,CAAC,CACL,CACF;EAEA,QAAQ,QAAQ,+BAA+B,QAAQ,IAAI,IAAI;EAC/D,OAAO,gBAAgB;GACrB,MAAM;IAAC;IAAe;IAAU;QAAYI,gBAAK,OAAO,mBAAmB;GAAC;GAC5E,KAAK;GACL,KAAK,SAAS,OAAO;GACrB,SAAS;GACT,OAAO;EACT,CAAC;CACH,CAAC;CAEH,UAAU,YAAY;EACpB,MAAM,aAAa,oBAAoB,OAAO;EAC9C,IAAI,CAAC,cAAc,CAAC,QAAQ,SAAS,cACnC,OAAOJ,cAAO,KACZ,IAAI,gBAAgB;GAClB,SAAS;GACT,SAAS,iCAAiC,QAAQ,SAAS,gBAAgB,QAAQ,IAAI;GACvF,UAAU;EACZ,CAAC,CACH;EAEF,OAAO,gBAAgB;GACrB,MAAM;IAAC;IAAe;IAAW;IAAY;GAAU;GACvD,KAAK,QAAQ,SAAS;GACtB,KAAK,SAAS,OAAO;GACrB,SAAS;GACT,OAAO;EACT,CAAC;CACH;AACF,CAAC"}

package/dist/db/drizzle-kit.d.cts

@@ -0,0 +1,25 @@
+import { DatabaseBinding } from "./bindings.cjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/db/drizzle-kit.d.ts
+declare const DrizzleKitError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "DrizzleKitError";
+} & Readonly<A>;
+declare class DrizzleKitError extends DrizzleKitError_base<{
+  readonly command: string;
+  readonly message: string;
+  readonly exitCode: number | undefined;
+}> {}
+interface DrizzleKitService {
+  readonly studio: (binding: DatabaseBinding) => Effect.Effect<void, DrizzleKitError>;
+  readonly migrate: (binding: DatabaseBinding) => Effect.Effect<void, DrizzleKitError>;
+}
+declare const DrizzleKit_base: Context.ServiceClass<DrizzleKit, "everything-dev/DrizzleKit", DrizzleKitService>;
+declare class DrizzleKit extends DrizzleKit_base {}
+interface DrizzleKitOptions {
+  readonly projectDir: string;
+  readonly onLog?: (message: string) => void;
+}
+declare const makeDrizzleKitLive: (options: DrizzleKitOptions) => Layer.Layer<DrizzleKit>;
+//#endregion
+export { DrizzleKit, DrizzleKitError, DrizzleKitOptions, DrizzleKitService, makeDrizzleKitLive };
+//# sourceMappingURL=drizzle-kit.d.cts.map

package/dist/db/drizzle-kit.d.mts

@@ -0,0 +1,25 @@
+import { DatabaseBinding } from "./bindings.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/db/drizzle-kit.d.ts
+declare const DrizzleKitError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "DrizzleKitError";
+} & Readonly<A>;
+declare class DrizzleKitError extends DrizzleKitError_base<{
+  readonly command: string;
+  readonly message: string;
+  readonly exitCode: number | undefined;
+}> {}
+interface DrizzleKitService {
+  readonly studio: (binding: DatabaseBinding) => Effect.Effect<void, DrizzleKitError>;
+  readonly migrate: (binding: DatabaseBinding) => Effect.Effect<void, DrizzleKitError>;
+}
+declare const DrizzleKit_base: Context.ServiceClass<DrizzleKit, "everything-dev/DrizzleKit", DrizzleKitService>;
+declare class DrizzleKit extends DrizzleKit_base {}
+interface DrizzleKitOptions {
+  readonly projectDir: string;
+  readonly onLog?: (message: string) => void;
+}
+declare const makeDrizzleKitLive: (options: DrizzleKitOptions) => Layer.Layer<DrizzleKit>;
+//#endregion
+export { DrizzleKit, DrizzleKitError, DrizzleKitOptions, DrizzleKitService, makeDrizzleKitLive };
+//# sourceMappingURL=drizzle-kit.d.mts.map

package/dist/db/drizzle-kit.mjs

@@ -0,0 +1,175 @@
+import { bindingEnv } from "./binding.mjs";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { Context, Data, Effect, Layer } from "effect";
+import { spawn } from "node:child_process";
+
+//#region src/db/drizzle-kit.ts
+var DrizzleKitError = class extends Data.TaggedError("DrizzleKitError") {};
+var DrizzleKit = class extends Context.Service()("everything-dev/DrizzleKit") {};
+/**
+* The single choke point for invoking drizzle-kit. Every child receives the
+* composition root's materialized environment (`bindingEnv`) so the config it
+* evaluates never has to re-derive credentials from ambient state.
+*/
+function spawnDrizzleKit(spec) {
+	return Effect.callback((resume) => {
+		let stderr = "";
+		let settled = false;
+		const settle = (effect) => {
+			if (settled) return;
+			settled = true;
+			resume(effect);
+		};
+		const child = spawn(process.platform === "win32" ? "npx.cmd" : "npx", [...spec.args], {
+			cwd: spec.cwd,
+			env: spec.env,
+			stdio: spec.stdio
+		});
+		if (spec.stdio === "pipe") child.stderr?.on("data", (data) => {
+			stderr += data.toString();
+		});
+		child.on("error", (err) => {
+			const hint = err.code === "ENOENT" ? "\"npx\" not found. Ensure Node.js is installed." : err.message;
+			settle(Effect.fail(new DrizzleKitError({
+				command: spec.command,
+				message: hint,
+				exitCode: void 0
+			})));
+		});
+		child.on("exit", (code) => {
+			if (code === 0 || code === null) {
+				settle(Effect.void);
+				return;
+			}
+			settle(Effect.fail(new DrizzleKitError({
+				command: spec.command,
+				message: `drizzle-kit ${spec.command} exited with code ${code}${stderr.trim() ? `: ${stderr.trim()}` : ""}`,
+				exitCode: code
+			})));
+		});
+		return Effect.sync(() => {
+			if (child.exitCode === null && !child.killed) child.kill();
+		});
+	});
+}
+function childEnv(binding) {
+	return {
+		...process.env,
+		...bindingEnv({
+			secretName: binding.identity.secretName,
+			url: binding.url
+		})
+	};
+}
+function workspaceConfigPath(binding) {
+	const workspaceDir = binding.identity.workspaceDir;
+	if (!workspaceDir) return void 0;
+	const configPath = join(workspaceDir, "drizzle.config.ts");
+	return existsSync(configPath) ? configPath : void 0;
+}
+function writeGeneratedConfig(binding, projectDir) {
+	const dbDir = resolve(projectDir, ".bos", "db", binding.key);
+	mkdirSync(dbDir, { recursive: true });
+	const configPath = join(dbDir, "drizzle.config.ts");
+	const configContent = `import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  schema: "./drizzle/schema.ts",
+  out: "./drizzle",
+  dialect: "postgresql",
+  dbCredentials: {
+    url: "${binding.url}",
+  },
+  migrations: {
+    schema: "${binding.identity.journal.schema}",
+    table: "${binding.identity.journal.table}",
+  },
+  verbose: true,
+  strict: true,
+});
+`;
+	writeFileSync(configPath, configContent);
+	return dbDir;
+}
+const makeDrizzleKitLive = (options) => Layer.succeed(DrizzleKit, {
+	studio: (binding) => Effect.gen(function* () {
+		const localConfig = workspaceConfigPath(binding);
+		if (localConfig && binding.identity.workspaceDir) {
+			options.onLog?.(`Starting Drizzle Studio for ${binding.key} (local)...`);
+			yield* spawnDrizzleKit({
+				args: [
+					"drizzle-kit",
+					"studio",
+					"--config",
+					localConfig
+				],
+				cwd: binding.identity.workspaceDir,
+				env: childEnv(binding),
+				command: "studio",
+				stdio: "inherit"
+			});
+			return;
+		}
+		if (binding.source === "local") return yield* new DrizzleKitError({
+			command: "studio",
+			message: `No drizzle.config.ts found in ${binding.identity.workspaceDir ?? binding.key}. Run 'drizzle-kit init' first in the plugin workspace.`,
+			exitCode: void 0
+		});
+		options.onLog?.(`Introspecting database schema for ${binding.key}...`);
+		const dbDir = writeGeneratedConfig(binding, options.projectDir);
+		yield* spawnDrizzleKit({
+			args: [
+				"drizzle-kit",
+				"pull",
+				"--config",
+				join(dbDir, "drizzle.config.ts")
+			],
+			cwd: dbDir,
+			env: childEnv(binding),
+			command: "pull",
+			stdio: "inherit"
+		}).pipe(Effect.mapError((error) => new DrizzleKitError({
+			command: "pull",
+			exitCode: error.exitCode,
+			message: `Failed to introspect database for "${binding.key}". Check that ${binding.identity.secretName} is correct and the database is reachable. ` + error.message
+		})));
+		options.onLog?.(`Starting Drizzle Studio for ${binding.key}...`);
+		yield* spawnDrizzleKit({
+			args: [
+				"drizzle-kit",
+				"studio",
+				"--config",
+				join(dbDir, "drizzle.config.ts")
+			],
+			cwd: dbDir,
+			env: childEnv(binding),
+			command: "studio",
+			stdio: "inherit"
+		});
+	}),
+	migrate: (binding) => {
+		const configPath = workspaceConfigPath(binding);
+		if (!configPath || !binding.identity.workspaceDir) return Effect.fail(new DrizzleKitError({
+			command: "migrate",
+			message: `No drizzle.config.ts found in ${binding.identity.workspaceDir ?? binding.key}.`,
+			exitCode: void 0
+		}));
+		return spawnDrizzleKit({
+			args: [
+				"drizzle-kit",
+				"migrate",
+				"--config",
+				configPath
+			],
+			cwd: binding.identity.workspaceDir,
+			env: childEnv(binding),
+			command: "migrate",
+			stdio: "pipe"
+		});
+	}
+});
+
+//#endregion
+export { DrizzleKit, DrizzleKitError, makeDrizzleKitLive };
+//# sourceMappingURL=drizzle-kit.mjs.map

package/dist/db/drizzle-kit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle-kit.mjs","names":[],"sources":["../../src/db/drizzle-kit.ts"],"sourcesContent":["import { spawn } from \"node:child_process\";\nimport { existsSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { Context, Data, Effect, Layer } from \"effect\";\nimport { bindingEnv } from \"./binding\";\nimport type { DatabaseBinding } from \"./bindings\";\n\nexport class DrizzleKitError extends Data.TaggedError(\"DrizzleKitError\")<{\n  readonly command: string;\n  readonly message: string;\n  readonly exitCode: number | undefined;\n}> {}\n\nexport interface DrizzleKitService {\n  readonly studio: (binding: DatabaseBinding) => Effect.Effect<void, DrizzleKitError>;\n  readonly migrate: (binding: DatabaseBinding) => Effect.Effect<void, DrizzleKitError>;\n}\n\nexport class DrizzleKit extends Context.Service<DrizzleKit, DrizzleKitService>()(\n  \"everything-dev/DrizzleKit\",\n) {}\n\ninterface SpawnSpec {\n  readonly args: readonly string[];\n  readonly cwd: string;\n  readonly env: Record<string, string | undefined>;\n  readonly command: string;\n  readonly stdio: \"inherit\" | \"pipe\";\n}\n\n/**\n * The single choke point for invoking drizzle-kit. Every child receives the\n * composition root's materialized environment (`bindingEnv`) so the config it\n * evaluates never has to re-derive credentials from ambient state.\n */\nfunction spawnDrizzleKit(spec: SpawnSpec): Effect.Effect<void, DrizzleKitError> {\n  return Effect.callback((resume) => {\n    let stderr = \"\";\n    let settled = false;\n    const settle = (effect: Effect.Effect<void, DrizzleKitError>) => {\n      if (settled) return;\n      settled = true;\n      resume(effect);\n    };\n\n    const child = spawn(process.platform === \"win32\" ? \"npx.cmd\" : \"npx\", [...spec.args], {\n      cwd: spec.cwd,\n      env: spec.env,\n      stdio: spec.stdio,\n    });\n\n    if (spec.stdio === \"pipe\") {\n      child.stderr?.on(\"data\", (data: Buffer) => {\n        stderr += data.toString();\n      });\n    }\n\n    child.on(\"error\", (err) => {\n      const hint =\n        (err as NodeJS.ErrnoException).code === \"ENOENT\"\n          ? '\"npx\" not found. Ensure Node.js is installed.'\n          : err.message;\n      settle(\n        Effect.fail(\n          new DrizzleKitError({ command: spec.command, message: hint, exitCode: undefined }),\n        ),\n      );\n    });\n\n    child.on(\"exit\", (code) => {\n      if (code === 0 || code === null) {\n        settle(Effect.void);\n        return;\n      }\n      settle(\n        Effect.fail(\n          new DrizzleKitError({\n            command: spec.command,\n            message: `drizzle-kit ${spec.command} exited with code ${code}${\n              stderr.trim() ? `: ${stderr.trim()}` : \"\"\n            }`,\n            exitCode: code,\n          }),\n        ),\n      );\n    });\n\n    return Effect.sync(() => {\n      if (child.exitCode === null && !child.killed) child.kill();\n    });\n  });\n}\n\nfunction childEnv(binding: DatabaseBinding): Record<string, string | undefined> {\n  return {\n    ...process.env,\n    ...bindingEnv({ secretName: binding.identity.secretName, url: binding.url }),\n  };\n}\n\nfunction workspaceConfigPath(binding: DatabaseBinding): string | undefined {\n  const workspaceDir = binding.identity.workspaceDir;\n  if (!workspaceDir) return undefined;\n  const configPath = join(workspaceDir, \"drizzle.config.ts\");\n  return existsSync(configPath) ? configPath : undefined;\n}\n\nfunction writeGeneratedConfig(binding: DatabaseBinding, projectDir: string): string {\n  const dbDir = resolve(projectDir, \".bos\", \"db\", binding.key);\n  mkdirSync(dbDir, { recursive: true });\n\n  const configPath = join(dbDir, \"drizzle.config.ts\");\n  const configContent = `import { defineConfig } from \"drizzle-kit\";\n\nexport default defineConfig({\n  schema: \"./drizzle/schema.ts\",\n  out: \"./drizzle\",\n  dialect: \"postgresql\",\n  dbCredentials: {\n    url: \"${binding.url}\",\n  },\n  migrations: {\n    schema: \"${binding.identity.journal.schema}\",\n    table: \"${binding.identity.journal.table}\",\n  },\n  verbose: true,\n  strict: true,\n});\n`;\n\n  writeFileSync(configPath, configContent);\n  return dbDir;\n}\n\nexport interface DrizzleKitOptions {\n  readonly projectDir: string;\n  readonly onLog?: (message: string) => void;\n}\n\nexport const makeDrizzleKitLive = (options: DrizzleKitOptions): Layer.Layer<DrizzleKit> =>\n  Layer.succeed(DrizzleKit, {\n    studio: (binding) =>\n      Effect.gen(function* () {\n        const localConfig = workspaceConfigPath(binding);\n\n        if (localConfig && binding.identity.workspaceDir) {\n          options.onLog?.(`Starting Drizzle Studio for ${binding.key} (local)...`);\n          yield* spawnDrizzleKit({\n            args: [\"drizzle-kit\", \"studio\", \"--config\", localConfig],\n            cwd: binding.identity.workspaceDir,\n            env: childEnv(binding),\n            command: \"studio\",\n            stdio: \"inherit\",\n          });\n          return;\n        }\n\n        if (binding.source === \"local\") {\n          return yield* new DrizzleKitError({\n            command: \"studio\",\n            message:\n              `No drizzle.config.ts found in ${binding.identity.workspaceDir ?? binding.key}. ` +\n              `Run 'drizzle-kit init' first in the plugin workspace.`,\n            exitCode: undefined,\n          });\n        }\n\n        options.onLog?.(`Introspecting database schema for ${binding.key}...`);\n        const dbDir = writeGeneratedConfig(binding, options.projectDir);\n        yield* spawnDrizzleKit({\n          args: [\"drizzle-kit\", \"pull\", \"--config\", join(dbDir, \"drizzle.config.ts\")],\n          cwd: dbDir,\n          env: childEnv(binding),\n          command: \"pull\",\n          stdio: \"inherit\",\n        }).pipe(\n          Effect.mapError(\n            (error) =>\n              new DrizzleKitError({\n                command: \"pull\",\n                exitCode: error.exitCode,\n                message:\n                  `Failed to introspect database for \"${binding.key}\". ` +\n                  `Check that ${binding.identity.secretName} is correct and the database is reachable. ` +\n                  error.message,\n              }),\n          ),\n        );\n\n        options.onLog?.(`Starting Drizzle Studio for ${binding.key}...`);\n        yield* spawnDrizzleKit({\n          args: [\"drizzle-kit\", \"studio\", \"--config\", join(dbDir, \"drizzle.config.ts\")],\n          cwd: dbDir,\n          env: childEnv(binding),\n          command: \"studio\",\n          stdio: \"inherit\",\n        });\n      }),\n\n    migrate: (binding) => {\n      const configPath = workspaceConfigPath(binding);\n      if (!configPath || !binding.identity.workspaceDir) {\n        return Effect.fail(\n          new DrizzleKitError({\n            command: \"migrate\",\n            message: `No drizzle.config.ts found in ${binding.identity.workspaceDir ?? binding.key}.`,\n            exitCode: undefined,\n          }),\n        );\n      }\n      return spawnDrizzleKit({\n        args: [\"drizzle-kit\", \"migrate\", \"--config\", configPath],\n        cwd: binding.identity.workspaceDir,\n        env: childEnv(binding),\n        command: \"migrate\",\n        stdio: \"pipe\",\n      });\n    },\n  });\n"],"mappings":";;;;;;;AAOA,IAAa,kBAAb,cAAqC,KAAK,YAAY,iBAAiB,CAAC,CAIrE,CAAC;AAOJ,IAAa,aAAb,cAAgC,QAAQ,QAAuC,CAAC,CAC9E,2BACF,CAAC,CAAC,CAAC;;;;;;AAeH,SAAS,gBAAgB,MAAuD;CAC9E,OAAO,OAAO,UAAU,WAAW;EACjC,IAAI,SAAS;EACb,IAAI,UAAU;EACd,MAAM,UAAU,WAAiD;GAC/D,IAAI,SAAS;GACb,UAAU;GACV,OAAO,MAAM;EACf;EAEA,MAAM,QAAQ,MAAM,QAAQ,aAAa,UAAU,YAAY,OAAO,CAAC,GAAG,KAAK,IAAI,GAAG;GACpF,KAAK,KAAK;GACV,KAAK,KAAK;GACV,OAAO,KAAK;EACd,CAAC;EAED,IAAI,KAAK,UAAU,QACjB,MAAM,QAAQ,GAAG,SAAS,SAAiB;GACzC,UAAU,KAAK,SAAS;EAC1B,CAAC;EAGH,MAAM,GAAG,UAAU,QAAQ;GACzB,MAAM,OACH,IAA8B,SAAS,WACpC,oDACA,IAAI;GACV,OACE,OAAO,KACL,IAAI,gBAAgB;IAAE,SAAS,KAAK;IAAS,SAAS;IAAM,UAAU;GAAU,CAAC,CACnF,CACF;EACF,CAAC;EAED,MAAM,GAAG,SAAS,SAAS;GACzB,IAAI,SAAS,KAAK,SAAS,MAAM;IAC/B,OAAO,OAAO,IAAI;IAClB;GACF;GACA,OACE,OAAO,KACL,IAAI,gBAAgB;IAClB,SAAS,KAAK;IACd,SAAS,eAAe,KAAK,QAAQ,oBAAoB,OACvD,OAAO,KAAK,IAAI,KAAK,OAAO,KAAK,MAAM;IAEzC,UAAU;GACZ,CAAC,CACH,CACF;EACF,CAAC;EAED,OAAO,OAAO,WAAW;GACvB,IAAI,MAAM,aAAa,QAAQ,CAAC,MAAM,QAAQ,MAAM,KAAK;EAC3D,CAAC;CACH,CAAC;AACH;AAEA,SAAS,SAAS,SAA8D;CAC9E,OAAO;EACL,GAAG,QAAQ;EACX,GAAG,WAAW;GAAE,YAAY,QAAQ,SAAS;GAAY,KAAK,QAAQ;EAAI,CAAC;CAC7E;AACF;AAEA,SAAS,oBAAoB,SAA8C;CACzE,MAAM,eAAe,QAAQ,SAAS;CACtC,IAAI,CAAC,cAAc,OAAO;CAC1B,MAAM,aAAa,KAAK,cAAc,mBAAmB;CACzD,OAAO,WAAW,UAAU,IAAI,aAAa;AAC/C;AAEA,SAAS,qBAAqB,SAA0B,YAA4B;CAClF,MAAM,QAAQ,QAAQ,YAAY,QAAQ,MAAM,QAAQ,GAAG;CAC3D,UAAU,OAAO,EAAE,WAAW,KAAK,CAAC;CAEpC,MAAM,aAAa,KAAK,OAAO,mBAAmB;CAClD,MAAM,gBAAgB;;;;;;;YAOZ,QAAQ,IAAI;;;eAGT,QAAQ,SAAS,QAAQ,OAAO;cACjC,QAAQ,SAAS,QAAQ,MAAM;;;;;;CAO3C,cAAc,YAAY,aAAa;CACvC,OAAO;AACT;AAOA,MAAa,sBAAsB,YACjC,MAAM,QAAQ,YAAY;CACxB,SAAS,YACP,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,oBAAoB,OAAO;EAE/C,IAAI,eAAe,QAAQ,SAAS,cAAc;GAChD,QAAQ,QAAQ,+BAA+B,QAAQ,IAAI,YAAY;GACvE,OAAO,gBAAgB;IACrB,MAAM;KAAC;KAAe;KAAU;KAAY;IAAW;IACvD,KAAK,QAAQ,SAAS;IACtB,KAAK,SAAS,OAAO;IACrB,SAAS;IACT,OAAO;GACT,CAAC;GACD;EACF;EAEA,IAAI,QAAQ,WAAW,SACrB,OAAO,OAAO,IAAI,gBAAgB;GAChC,SAAS;GACT,SACE,iCAAiC,QAAQ,SAAS,gBAAgB,QAAQ,IAAI;GAEhF,UAAU;EACZ,CAAC;EAGH,QAAQ,QAAQ,qCAAqC,QAAQ,IAAI,IAAI;EACrE,MAAM,QAAQ,qBAAqB,SAAS,QAAQ,UAAU;EAC9D,OAAO,gBAAgB;GACrB,MAAM;IAAC;IAAe;IAAQ;IAAY,KAAK,OAAO,mBAAmB;GAAC;GAC1E,KAAK;GACL,KAAK,SAAS,OAAO;GACrB,SAAS;GACT,OAAO;EACT,CAAC,CAAC,CAAC,KACD,OAAO,UACJ,UACC,IAAI,gBAAgB;GAClB,SAAS;GACT,UAAU,MAAM;GAChB,SACE,sCAAsC,QAAQ,IAAI,gBACpC,QAAQ,SAAS,WAAW,+CAC1C,MAAM;EACV,CAAC,CACL,CACF;EAEA,QAAQ,QAAQ,+BAA+B,QAAQ,IAAI,IAAI;EAC/D,OAAO,gBAAgB;GACrB,MAAM;IAAC;IAAe;IAAU;IAAY,KAAK,OAAO,mBAAmB;GAAC;GAC5E,KAAK;GACL,KAAK,SAAS,OAAO;GACrB,SAAS;GACT,OAAO;EACT,CAAC;CACH,CAAC;CAEH,UAAU,YAAY;EACpB,MAAM,aAAa,oBAAoB,OAAO;EAC9C,IAAI,CAAC,cAAc,CAAC,QAAQ,SAAS,cACnC,OAAO,OAAO,KACZ,IAAI,gBAAgB;GAClB,SAAS;GACT,SAAS,iCAAiC,QAAQ,SAAS,gBAAgB,QAAQ,IAAI;GACvF,UAAU;EACZ,CAAC,CACH;EAEF,OAAO,gBAAgB;GACrB,MAAM;IAAC;IAAe;IAAW;IAAY;GAAU;GACvD,KAAK,QAAQ,SAAS;GACtB,KAAK,SAAS,OAAO;GACrB,SAAS;GACT,OAAO;EACT,CAAC;CACH;AACF,CAAC"}