everything-dev 1.53.2 → 2.0.0-rc.1

package/dist/db/binding.mjs

@@ -0,0 +1,78 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { parse } from "dotenv";
+
+//#region src/db/binding.ts
+/**
+* drizzle-kit subcommands that open a database connection. For everything
+* else (generate, check) the connection string is parsed but never used, so a
+* placeholder is safe.
+*/
+const DB_REQUIRING_COMMANDS = /* @__PURE__ */ new Set([
+	"push",
+	"pull",
+	"migrate",
+	"studio",
+	"up"
+]);
+/**
+* Whether the current process is a drizzle-kit invocation whose command needs
+* a live database. Mirrors drizzle-kit's CLI layout: `drizzle-kit <command> …`.
+*/
+function requiresDatabaseConnection(argv = process.argv) {
+	if (!(typeof argv[1] === "string" && argv[1].includes("drizzle-kit"))) return false;
+	const command = argv[2];
+	return typeof command === "string" && DB_REQUIRING_COMMANDS.has(command);
+}
+/**
+* Materialize the environment a spawned tool needs to reach the binding's
+* database: the canonical secret name mapped to the resolved URL. The process
+* that resolves bindings (the CLI composition root) pushes this into spawned
+* children so they never re-derive secrets from ambient state.
+*/
+function bindingEnv(binding) {
+	return { [binding.secretName]: binding.url };
+}
+function findEnvFile(startDir) {
+	if (!startDir) return void 0;
+	let current = startDir;
+	for (let i = 0; i < 15; i++) {
+		const candidate = join(current, ".env");
+		if (existsSync(candidate)) return candidate;
+		const parent = dirname(current);
+		if (parent === current) return void 0;
+		current = parent;
+	}
+}
+/**
+* Resolve the connection URL for a workspace identity.
+*
+* Resolution order:
+*   1. the canonical secret in the provided environment
+*   2. the canonical secret in the nearest `.env` walked up from the
+*      workspace directory (existing environment wins — values are not
+*      overridden, matching dotenv semantics)
+*   3. loud failure when the drizzle-kit command needs a database
+*   4. an in-memory pglite placeholder for commands that never connect
+*      (generate, check) and for non-drizzle-kit consumers
+*
+* This replaces the previous silent `pglite:` fallback that masked missing
+* configuration as cryptic driver errors downstream.
+*/
+function resolveDatabaseUrl(identity, options = {}) {
+	const env = options.env ?? process.env;
+	const argv = options.argv ?? process.argv;
+	const direct = env[identity.secretName];
+	if (direct) return direct;
+	const envFile = findEnvFile(identity.workspaceDir);
+	if (envFile) try {
+		const fromFile = parse(readFileSync(envFile, "utf-8"))[identity.secretName];
+		if (fromFile) return fromFile;
+	} catch {}
+	if (requiresDatabaseConnection(argv)) throw new Error(`Missing ${identity.secretName} for workspace "${identity.slug}" — required for "drizzle-kit ${argv[2]}". Add ${identity.secretName} to your .env (see .env.example) or run via \`bos db\`.`);
+	return `pglite:.bos/${identity.slug}/:memory:`;
+}
+
+//#endregion
+export { bindingEnv, requiresDatabaseConnection, resolveDatabaseUrl };
+//# sourceMappingURL=binding.mjs.map

package/dist/db/binding.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.mjs","names":["parseDotenv"],"sources":["../../src/db/binding.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { parse as parseDotenv } from \"dotenv\";\nimport type { WorkspaceIdentity } from \"./identity\";\n\n/**\n * drizzle-kit subcommands that open a database connection. For everything\n * else (generate, check) the connection string is parsed but never used, so a\n * placeholder is safe.\n */\nconst DB_REQUIRING_COMMANDS: ReadonlySet<string> = new Set([\n  \"push\",\n  \"pull\",\n  \"migrate\",\n  \"studio\",\n  \"up\",\n]);\n\n/**\n * Whether the current process is a drizzle-kit invocation whose command needs\n * a live database. Mirrors drizzle-kit's CLI layout: `drizzle-kit <command> …`.\n */\nexport function requiresDatabaseConnection(argv: readonly string[] = process.argv): boolean {\n  const isDrizzleKit = typeof argv[1] === \"string\" && argv[1].includes(\"drizzle-kit\");\n  if (!isDrizzleKit) return false;\n  const command = argv[2];\n  return typeof command === \"string\" && DB_REQUIRING_COMMANDS.has(command);\n}\n\n/**\n * Materialize the environment a spawned tool needs to reach the binding's\n * database: the canonical secret name mapped to the resolved URL. The process\n * that resolves bindings (the CLI composition root) pushes this into spawned\n * children so they never re-derive secrets from ambient state.\n */\nexport function bindingEnv(binding: { secretName: string; url: string }): Record<string, string> {\n  return { [binding.secretName]: binding.url };\n}\n\nfunction findEnvFile(startDir: string | undefined): string | undefined {\n  if (!startDir) return undefined;\n  let current = startDir;\n  for (let i = 0; i < 15; i++) {\n    const candidate = join(current, \".env\");\n    if (existsSync(candidate)) return candidate;\n    const parent = dirname(current);\n    if (parent === current) return undefined;\n    current = parent;\n  }\n  return undefined;\n}\n\n/**\n * Resolve the connection URL for a workspace identity.\n *\n * Resolution order:\n *   1. the canonical secret in the provided environment\n *   2. the canonical secret in the nearest `.env` walked up from the\n *      workspace directory (existing environment wins — values are not\n *      overridden, matching dotenv semantics)\n *   3. loud failure when the drizzle-kit command needs a database\n *   4. an in-memory pglite placeholder for commands that never connect\n *      (generate, check) and for non-drizzle-kit consumers\n *\n * This replaces the previous silent `pglite:` fallback that masked missing\n * configuration as cryptic driver errors downstream.\n */\nexport function resolveDatabaseUrl(\n  identity: WorkspaceIdentity,\n  options: {\n    env?: Record<string, string | undefined>;\n    argv?: readonly string[];\n  } = {},\n): string {\n  const env = options.env ?? process.env;\n  const argv = options.argv ?? process.argv;\n\n  const direct = env[identity.secretName];\n  if (direct) return direct;\n\n  const envFile = findEnvFile(identity.workspaceDir);\n  if (envFile) {\n    try {\n      const parsed = parseDotenv(readFileSync(envFile, \"utf-8\"));\n      const fromFile = parsed[identity.secretName];\n      if (fromFile) return fromFile;\n    } catch {\n      // unreadable .env — fall through to loud failure / placeholder\n    }\n  }\n\n  if (requiresDatabaseConnection(argv)) {\n    throw new Error(\n      `Missing ${identity.secretName} for workspace \"${identity.slug}\" — ` +\n        `required for \"drizzle-kit ${argv[2]}\". ` +\n        `Add ${identity.secretName} to your .env (see .env.example) or run via \\`bos db\\`.`,\n    );\n  }\n\n  return `pglite:.bos/${identity.slug}/:memory:`;\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,SAAgB,2BAA2B,OAA0B,QAAQ,MAAe;CAE1F,IAAI,EADiB,OAAO,KAAK,OAAO,YAAY,KAAK,EAAE,CAAC,SAAS,aAAa,IAC/D,OAAO;CAC1B,MAAM,UAAU,KAAK;CACrB,OAAO,OAAO,YAAY,YAAY,sBAAsB,IAAI,OAAO;AACzE;;;;;;;AAQA,SAAgB,WAAW,SAAsE;CAC/F,OAAO,GAAG,QAAQ,aAAa,QAAQ,IAAI;AAC7C;AAEA,SAAS,YAAY,UAAkD;CACrE,IAAI,CAAC,UAAU,OAAO;CACtB,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;EAC3B,MAAM,YAAY,KAAK,SAAS,MAAM;EACtC,IAAI,WAAW,SAAS,GAAG,OAAO;EAClC,MAAM,SAAS,QAAQ,OAAO;EAC9B,IAAI,WAAW,SAAS,OAAO;EAC/B,UAAU;CACZ;AAEF;;;;;;;;;;;;;;;;AAiBA,SAAgB,mBACd,UACA,UAGI,CAAC,GACG;CACR,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,OAAO,QAAQ,QAAQ,QAAQ;CAErC,MAAM,SAAS,IAAI,SAAS;CAC5B,IAAI,QAAQ,OAAO;CAEnB,MAAM,UAAU,YAAY,SAAS,YAAY;CACjD,IAAI,SACF,IAAI;EAEF,MAAM,WADSA,MAAY,aAAa,SAAS,OAAO,CAClC,CAAC,CAAC,SAAS;EACjC,IAAI,UAAU,OAAO;CACvB,QAAQ,CAER;CAGF,IAAI,2BAA2B,IAAI,GACjC,MAAM,IAAI,MACR,WAAW,SAAS,WAAW,kBAAkB,SAAS,KAAK,gCAChC,KAAK,GAAG,SAC9B,SAAS,WAAW,wDAC/B;CAGF,OAAO,eAAe,SAAS,KAAK;AACtC"}

package/dist/db/bindings.cjs

@@ -0,0 +1,78 @@
+const require_core = require('./core.cjs');
+const require_identity = require('./identity.cjs');
+let node_path = require("node:path");
+let effect = require("effect");
+
+//#region src/db/bindings.ts
+var DatabaseBindingError = class extends effect.Data.TaggedError("DatabaseBindingError") {};
+var DatabaseBindings = class extends effect.Context.Service()("everything-dev/DatabaseBindings") {};
+function resolvePluginBinding(pluginKey, runtimeConfig, projectDir, env) {
+	if (!runtimeConfig) throw new Error("Runtime config not loaded — cannot resolve plugin database binding");
+	let source;
+	let section;
+	let secrets;
+	let localPath;
+	let key;
+	if (pluginKey === "api" && runtimeConfig.api) {
+		source = runtimeConfig.api.source;
+		section = "app.api";
+		secrets = runtimeConfig.api.secrets;
+		localPath = runtimeConfig.api.localPath;
+		key = "api";
+	} else if (pluginKey === "auth" && runtimeConfig.auth) {
+		source = runtimeConfig.auth.source;
+		section = "app.auth";
+		secrets = runtimeConfig.auth.secrets;
+		localPath = runtimeConfig.auth.localPath;
+		key = "auth";
+	} else if (runtimeConfig.plugins?.[pluginKey]) {
+		const plugin = runtimeConfig.plugins[pluginKey];
+		source = plugin.source;
+		section = "plugins";
+		secrets = plugin.secrets;
+		localPath = plugin.localPath;
+		key = pluginKey;
+	} else {
+		const available = [
+			"api",
+			...runtimeConfig.auth ? ["auth"] : [],
+			...Object.keys(runtimeConfig.plugins ?? {})
+		].join(", ");
+		throw new Error(`Plugin "${pluginKey}" not found in app.api, app.auth, or plugins. Available: ${available}`);
+	}
+	const identity = localPath ? require_identity.workspaceIdentityFromWorkspaceDir((0, node_path.resolve)(projectDir, localPath)) : {
+		slug: require_core.pluginMigrationSlug(key),
+		secretName: require_core.getDatabaseUrlSecretName(require_core.pluginMigrationSlug(key)),
+		journal: require_core.getMigrationStorage(require_core.pluginMigrationSlug(key)),
+		workspaceDir: void 0
+	};
+	const url = env[identity.secretName];
+	if (!url) {
+		const declaredDatabaseSecrets = (secrets ?? []).filter((s) => s.endsWith("_DATABASE_URL"));
+		const mismatch = declaredDatabaseSecrets.length > 0 && !declaredDatabaseSecrets.includes(identity.secretName) ? ` Config declares ${declaredDatabaseSecrets.join(", ")} — the workspace package name and the declared secret disagree.` : "";
+		throw new Error(`.env missing ${identity.secretName} for plugin "${key}".` + mismatch + ` Add it to your .env file (see .env.example).`);
+	}
+	return {
+		key,
+		source: source ?? "remote",
+		section,
+		identity,
+		url
+	};
+}
+const makeDatabaseBindings = (options) => effect.Layer.succeed(DatabaseBindings, { forPluginKey: (pluginKey) => effect.Effect.tryPromise({
+	try: async () => {
+		await options.loadEnv?.();
+		return resolvePluginBinding(pluginKey, await options.loadRuntimeConfig(), options.projectDir, options.env ?? process.env);
+	},
+	catch: (error) => new DatabaseBindingError({
+		pluginKey,
+		message: error instanceof Error ? error.message : String(error)
+	})
+}) });
+
+//#endregion
+exports.DatabaseBindingError = DatabaseBindingError;
+exports.DatabaseBindings = DatabaseBindings;
+exports.makeDatabaseBindings = makeDatabaseBindings;
+//# sourceMappingURL=bindings.cjs.map

package/dist/db/bindings.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.cjs","names":["Data","Context","workspaceIdentityFromWorkspaceDir","resolve","pluginMigrationSlug","getDatabaseUrlSecretName","getMigrationStorage","Layer","Effect"],"sources":["../../src/db/bindings.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { Context, Data, Effect, Layer } from \"effect\";\nimport type { RuntimeConfig } from \"../types\";\nimport { getDatabaseUrlSecretName, getMigrationStorage, pluginMigrationSlug } from \"./core\";\nimport { type WorkspaceIdentity, workspaceIdentityFromWorkspaceDir } from \"./identity\";\n\nexport interface DatabaseBinding {\n  readonly key: string;\n  readonly source: \"local\" | \"remote\";\n  readonly section: \"app.api\" | \"app.auth\" | \"plugins\";\n  readonly identity: WorkspaceIdentity;\n  readonly url: string;\n}\n\nexport class DatabaseBindingError extends Data.TaggedError(\"DatabaseBindingError\")<{\n  readonly pluginKey: string;\n  readonly message: string;\n}> {}\n\nexport interface DatabaseBindingsService {\n  readonly forPluginKey: (\n    pluginKey: string,\n  ) => Effect.Effect<DatabaseBinding, DatabaseBindingError>;\n}\n\nexport class DatabaseBindings extends Context.Service<DatabaseBindings, DatabaseBindingsService>()(\n  \"everything-dev/DatabaseBindings\",\n) {}\n\ninterface RuntimePluginEntry {\n  readonly source?: string;\n  readonly secrets?: string[];\n  readonly localPath?: string;\n}\n\nfunction resolvePluginBinding(\n  pluginKey: string,\n  runtimeConfig: RuntimeConfig | null,\n  projectDir: string,\n  env: Record<string, string | undefined>,\n): DatabaseBinding {\n  if (!runtimeConfig) {\n    throw new Error(\"Runtime config not loaded — cannot resolve plugin database binding\");\n  }\n\n  let source: \"local\" | \"remote\" | undefined;\n  let section: DatabaseBinding[\"section\"];\n  let secrets: string[] | undefined;\n  let localPath: string | undefined;\n  let key: string;\n\n  if (pluginKey === \"api\" && runtimeConfig.api) {\n    source = runtimeConfig.api.source as \"local\" | \"remote\";\n    section = \"app.api\";\n    secrets = runtimeConfig.api.secrets;\n    localPath = runtimeConfig.api.localPath;\n    key = \"api\";\n  } else if (pluginKey === \"auth\" && runtimeConfig.auth) {\n    source = runtimeConfig.auth.source as \"local\" | \"remote\";\n    section = \"app.auth\";\n    secrets = runtimeConfig.auth.secrets;\n    localPath = runtimeConfig.auth.localPath;\n    key = \"auth\";\n  } else if (runtimeConfig.plugins?.[pluginKey]) {\n    const plugin = runtimeConfig.plugins[pluginKey] as RuntimePluginEntry;\n    source = plugin.source as \"local\" | \"remote\";\n    section = \"plugins\";\n    secrets = plugin.secrets;\n    localPath = plugin.localPath;\n    key = pluginKey;\n  } else {\n    const available = [\n      \"api\",\n      ...(runtimeConfig.auth ? [\"auth\"] : []),\n      ...Object.keys(runtimeConfig.plugins ?? {}),\n    ].join(\", \");\n    throw new Error(\n      `Plugin \"${pluginKey}\" not found in app.api, app.auth, or plugins. Available: ${available}`,\n    );\n  }\n\n  const identity: WorkspaceIdentity = localPath\n    ? workspaceIdentityFromWorkspaceDir(resolve(projectDir, localPath))\n    : {\n        slug: pluginMigrationSlug(key),\n        secretName: getDatabaseUrlSecretName(pluginMigrationSlug(key)),\n        journal: getMigrationStorage(pluginMigrationSlug(key)),\n        workspaceDir: undefined,\n      };\n\n  const url = env[identity.secretName];\n  if (!url) {\n    const declaredDatabaseSecrets = (secrets ?? []).filter((s) => s.endsWith(\"_DATABASE_URL\"));\n    const mismatch =\n      declaredDatabaseSecrets.length > 0 && !declaredDatabaseSecrets.includes(identity.secretName)\n        ? ` Config declares ${declaredDatabaseSecrets.join(\", \")} — the workspace package name and the declared secret disagree.`\n        : \"\";\n    throw new Error(\n      `.env missing ${identity.secretName} for plugin \"${key}\".` +\n        mismatch +\n        ` Add it to your .env file (see .env.example).`,\n    );\n  }\n\n  return {\n    key,\n    source: source ?? \"remote\",\n    section,\n    identity,\n    url,\n  };\n}\n\nexport interface DatabaseBindingsOptions {\n  readonly projectDir: string;\n  readonly loadRuntimeConfig: () => Promise<RuntimeConfig | null>;\n  /** May return a promise — a rejection propagates into the binding error instead of silently proceeding with an unloaded .env. */\n  readonly loadEnv?: () => void | Promise<void>;\n  readonly env?: Record<string, string | undefined>;\n}\n\nexport const makeDatabaseBindings = (\n  options: DatabaseBindingsOptions,\n): Layer.Layer<DatabaseBindings> =>\n  Layer.succeed(DatabaseBindings, {\n    forPluginKey: (pluginKey) =>\n      Effect.tryPromise({\n        try: async () => {\n          await options.loadEnv?.();\n          const runtimeConfig = await options.loadRuntimeConfig();\n          return resolvePluginBinding(\n            pluginKey,\n            runtimeConfig,\n            options.projectDir,\n            options.env ?? process.env,\n          );\n        },\n        catch: (error) =>\n          new DatabaseBindingError({\n            pluginKey,\n            message: error instanceof Error ? error.message : String(error),\n          }),\n      }),\n  });\n"],"mappings":";;;;;;AAcA,IAAa,uBAAb,cAA0CA,YAAK,YAAY,sBAAsB,CAAC,CAG/E,CAAC;AAQJ,IAAa,mBAAb,cAAsCC,eAAQ,QAAmD,CAAC,CAChG,iCACF,CAAC,CAAC,CAAC;AAQH,SAAS,qBACP,WACA,eACA,YACA,KACiB;CACjB,IAAI,CAAC,eACH,MAAM,IAAI,MAAM,oEAAoE;CAGtF,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,IAAI,cAAc,SAAS,cAAc,KAAK;EAC5C,SAAS,cAAc,IAAI;EAC3B,UAAU;EACV,UAAU,cAAc,IAAI;EAC5B,YAAY,cAAc,IAAI;EAC9B,MAAM;CACR,OAAO,IAAI,cAAc,UAAU,cAAc,MAAM;EACrD,SAAS,cAAc,KAAK;EAC5B,UAAU;EACV,UAAU,cAAc,KAAK;EAC7B,YAAY,cAAc,KAAK;EAC/B,MAAM;CACR,OAAO,IAAI,cAAc,UAAU,YAAY;EAC7C,MAAM,SAAS,cAAc,QAAQ;EACrC,SAAS,OAAO;EAChB,UAAU;EACV,UAAU,OAAO;EACjB,YAAY,OAAO;EACnB,MAAM;CACR,OAAO;EACL,MAAM,YAAY;GAChB;GACA,GAAI,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC;GACrC,GAAG,OAAO,KAAK,cAAc,WAAW,CAAC,CAAC;EAC5C,CAAC,CAAC,KAAK,IAAI;EACX,MAAM,IAAI,MACR,WAAW,UAAU,2DAA2D,WAClF;CACF;CAEA,MAAM,WAA8B,YAChCC,uDAAkCC,mBAAQ,YAAY,SAAS,CAAC,IAChE;EACE,MAAMC,iCAAoB,GAAG;EAC7B,YAAYC,sCAAyBD,iCAAoB,GAAG,CAAC;EAC7D,SAASE,iCAAoBF,iCAAoB,GAAG,CAAC;EACrD,cAAc;CAChB;CAEJ,MAAM,MAAM,IAAI,SAAS;CACzB,IAAI,CAAC,KAAK;EACR,MAAM,2BAA2B,WAAW,CAAC,EAAC,CAAE,QAAQ,MAAM,EAAE,SAAS,eAAe,CAAC;EACzF,MAAM,WACJ,wBAAwB,SAAS,KAAK,CAAC,wBAAwB,SAAS,SAAS,UAAU,IACvF,oBAAoB,wBAAwB,KAAK,IAAI,EAAE,mEACvD;EACN,MAAM,IAAI,MACR,gBAAgB,SAAS,WAAW,eAAe,IAAI,MACrD,WACA,+CACJ;CACF;CAEA,OAAO;EACL;EACA,QAAQ,UAAU;EAClB;EACA;EACA;CACF;AACF;AAUA,MAAa,wBACX,YAEAG,aAAM,QAAQ,kBAAkB,EAC9B,eAAe,cACbC,cAAO,WAAW;CAChB,KAAK,YAAY;EACf,MAAM,QAAQ,UAAU;EAExB,OAAO,qBACL,WACA,MAH0B,QAAQ,kBAAkB,GAIpD,QAAQ,YACR,QAAQ,OAAO,QAAQ,GACzB;CACF;CACA,QAAQ,UACN,IAAI,qBAAqB;EACvB;EACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CAChE,CAAC;AACL,CAAC,EACL,CAAC"}

package/dist/db/bindings.d.cts

@@ -0,0 +1,34 @@
+import { RuntimeConfig } from "../types.cjs";
+import { WorkspaceIdentity } from "./identity.cjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/db/bindings.d.ts
+interface DatabaseBinding {
+  readonly key: string;
+  readonly source: "local" | "remote";
+  readonly section: "app.api" | "app.auth" | "plugins";
+  readonly identity: WorkspaceIdentity;
+  readonly url: string;
+}
+declare const DatabaseBindingError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "DatabaseBindingError";
+} & Readonly<A>;
+declare class DatabaseBindingError extends DatabaseBindingError_base<{
+  readonly pluginKey: string;
+  readonly message: string;
+}> {}
+interface DatabaseBindingsService {
+  readonly forPluginKey: (pluginKey: string) => Effect.Effect<DatabaseBinding, DatabaseBindingError>;
+}
+declare const DatabaseBindings_base: Context.ServiceClass<DatabaseBindings, "everything-dev/DatabaseBindings", DatabaseBindingsService>;
+declare class DatabaseBindings extends DatabaseBindings_base {}
+interface DatabaseBindingsOptions {
+  readonly projectDir: string;
+  readonly loadRuntimeConfig: () => Promise<RuntimeConfig | null>;
+  /** May return a promise — a rejection propagates into the binding error instead of silently proceeding with an unloaded .env. */
+  readonly loadEnv?: () => void | Promise<void>;
+  readonly env?: Record<string, string | undefined>;
+}
+declare const makeDatabaseBindings: (options: DatabaseBindingsOptions) => Layer.Layer<DatabaseBindings>;
+//#endregion
+export { DatabaseBinding, DatabaseBindingError, DatabaseBindings, DatabaseBindingsOptions, DatabaseBindingsService, makeDatabaseBindings };
+//# sourceMappingURL=bindings.d.cts.map

package/dist/db/bindings.d.mts

@@ -0,0 +1,34 @@
+import { RuntimeConfig } from "../types.mjs";
+import { WorkspaceIdentity } from "./identity.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/db/bindings.d.ts
+interface DatabaseBinding {
+  readonly key: string;
+  readonly source: "local" | "remote";
+  readonly section: "app.api" | "app.auth" | "plugins";
+  readonly identity: WorkspaceIdentity;
+  readonly url: string;
+}
+declare const DatabaseBindingError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "DatabaseBindingError";
+} & Readonly<A>;
+declare class DatabaseBindingError extends DatabaseBindingError_base<{
+  readonly pluginKey: string;
+  readonly message: string;
+}> {}
+interface DatabaseBindingsService {
+  readonly forPluginKey: (pluginKey: string) => Effect.Effect<DatabaseBinding, DatabaseBindingError>;
+}
+declare const DatabaseBindings_base: Context.ServiceClass<DatabaseBindings, "everything-dev/DatabaseBindings", DatabaseBindingsService>;
+declare class DatabaseBindings extends DatabaseBindings_base {}
+interface DatabaseBindingsOptions {
+  readonly projectDir: string;
+  readonly loadRuntimeConfig: () => Promise<RuntimeConfig | null>;
+  /** May return a promise — a rejection propagates into the binding error instead of silently proceeding with an unloaded .env. */
+  readonly loadEnv?: () => void | Promise<void>;
+  readonly env?: Record<string, string | undefined>;
+}
+declare const makeDatabaseBindings: (options: DatabaseBindingsOptions) => Layer.Layer<DatabaseBindings>;
+//#endregion
+export { DatabaseBinding, DatabaseBindingError, DatabaseBindings, DatabaseBindingsOptions, DatabaseBindingsService, makeDatabaseBindings };
+//# sourceMappingURL=bindings.d.mts.map

package/dist/db/bindings.mjs

@@ -0,0 +1,76 @@
+import { getDatabaseUrlSecretName, getMigrationStorage, pluginMigrationSlug } from "./core.mjs";
+import { workspaceIdentityFromWorkspaceDir } from "./identity.mjs";
+import { resolve } from "node:path";
+import { Context, Data, Effect, Layer } from "effect";
+
+//#region src/db/bindings.ts
+var DatabaseBindingError = class extends Data.TaggedError("DatabaseBindingError") {};
+var DatabaseBindings = class extends Context.Service()("everything-dev/DatabaseBindings") {};
+function resolvePluginBinding(pluginKey, runtimeConfig, projectDir, env) {
+	if (!runtimeConfig) throw new Error("Runtime config not loaded — cannot resolve plugin database binding");
+	let source;
+	let section;
+	let secrets;
+	let localPath;
+	let key;
+	if (pluginKey === "api" && runtimeConfig.api) {
+		source = runtimeConfig.api.source;
+		section = "app.api";
+		secrets = runtimeConfig.api.secrets;
+		localPath = runtimeConfig.api.localPath;
+		key = "api";
+	} else if (pluginKey === "auth" && runtimeConfig.auth) {
+		source = runtimeConfig.auth.source;
+		section = "app.auth";
+		secrets = runtimeConfig.auth.secrets;
+		localPath = runtimeConfig.auth.localPath;
+		key = "auth";
+	} else if (runtimeConfig.plugins?.[pluginKey]) {
+		const plugin = runtimeConfig.plugins[pluginKey];
+		source = plugin.source;
+		section = "plugins";
+		secrets = plugin.secrets;
+		localPath = plugin.localPath;
+		key = pluginKey;
+	} else {
+		const available = [
+			"api",
+			...runtimeConfig.auth ? ["auth"] : [],
+			...Object.keys(runtimeConfig.plugins ?? {})
+		].join(", ");
+		throw new Error(`Plugin "${pluginKey}" not found in app.api, app.auth, or plugins. Available: ${available}`);
+	}
+	const identity = localPath ? workspaceIdentityFromWorkspaceDir(resolve(projectDir, localPath)) : {
+		slug: pluginMigrationSlug(key),
+		secretName: getDatabaseUrlSecretName(pluginMigrationSlug(key)),
+		journal: getMigrationStorage(pluginMigrationSlug(key)),
+		workspaceDir: void 0
+	};
+	const url = env[identity.secretName];
+	if (!url) {
+		const declaredDatabaseSecrets = (secrets ?? []).filter((s) => s.endsWith("_DATABASE_URL"));
+		const mismatch = declaredDatabaseSecrets.length > 0 && !declaredDatabaseSecrets.includes(identity.secretName) ? ` Config declares ${declaredDatabaseSecrets.join(", ")} — the workspace package name and the declared secret disagree.` : "";
+		throw new Error(`.env missing ${identity.secretName} for plugin "${key}".` + mismatch + ` Add it to your .env file (see .env.example).`);
+	}
+	return {
+		key,
+		source: source ?? "remote",
+		section,
+		identity,
+		url
+	};
+}
+const makeDatabaseBindings = (options) => Layer.succeed(DatabaseBindings, { forPluginKey: (pluginKey) => Effect.tryPromise({
+	try: async () => {
+		await options.loadEnv?.();
+		return resolvePluginBinding(pluginKey, await options.loadRuntimeConfig(), options.projectDir, options.env ?? process.env);
+	},
+	catch: (error) => new DatabaseBindingError({
+		pluginKey,
+		message: error instanceof Error ? error.message : String(error)
+	})
+}) });
+
+//#endregion
+export { DatabaseBindingError, DatabaseBindings, makeDatabaseBindings };
+//# sourceMappingURL=bindings.mjs.map

package/dist/db/bindings.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.mjs","names":[],"sources":["../../src/db/bindings.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { Context, Data, Effect, Layer } from \"effect\";\nimport type { RuntimeConfig } from \"../types\";\nimport { getDatabaseUrlSecretName, getMigrationStorage, pluginMigrationSlug } from \"./core\";\nimport { type WorkspaceIdentity, workspaceIdentityFromWorkspaceDir } from \"./identity\";\n\nexport interface DatabaseBinding {\n  readonly key: string;\n  readonly source: \"local\" | \"remote\";\n  readonly section: \"app.api\" | \"app.auth\" | \"plugins\";\n  readonly identity: WorkspaceIdentity;\n  readonly url: string;\n}\n\nexport class DatabaseBindingError extends Data.TaggedError(\"DatabaseBindingError\")<{\n  readonly pluginKey: string;\n  readonly message: string;\n}> {}\n\nexport interface DatabaseBindingsService {\n  readonly forPluginKey: (\n    pluginKey: string,\n  ) => Effect.Effect<DatabaseBinding, DatabaseBindingError>;\n}\n\nexport class DatabaseBindings extends Context.Service<DatabaseBindings, DatabaseBindingsService>()(\n  \"everything-dev/DatabaseBindings\",\n) {}\n\ninterface RuntimePluginEntry {\n  readonly source?: string;\n  readonly secrets?: string[];\n  readonly localPath?: string;\n}\n\nfunction resolvePluginBinding(\n  pluginKey: string,\n  runtimeConfig: RuntimeConfig | null,\n  projectDir: string,\n  env: Record<string, string | undefined>,\n): DatabaseBinding {\n  if (!runtimeConfig) {\n    throw new Error(\"Runtime config not loaded — cannot resolve plugin database binding\");\n  }\n\n  let source: \"local\" | \"remote\" | undefined;\n  let section: DatabaseBinding[\"section\"];\n  let secrets: string[] | undefined;\n  let localPath: string | undefined;\n  let key: string;\n\n  if (pluginKey === \"api\" && runtimeConfig.api) {\n    source = runtimeConfig.api.source as \"local\" | \"remote\";\n    section = \"app.api\";\n    secrets = runtimeConfig.api.secrets;\n    localPath = runtimeConfig.api.localPath;\n    key = \"api\";\n  } else if (pluginKey === \"auth\" && runtimeConfig.auth) {\n    source = runtimeConfig.auth.source as \"local\" | \"remote\";\n    section = \"app.auth\";\n    secrets = runtimeConfig.auth.secrets;\n    localPath = runtimeConfig.auth.localPath;\n    key = \"auth\";\n  } else if (runtimeConfig.plugins?.[pluginKey]) {\n    const plugin = runtimeConfig.plugins[pluginKey] as RuntimePluginEntry;\n    source = plugin.source as \"local\" | \"remote\";\n    section = \"plugins\";\n    secrets = plugin.secrets;\n    localPath = plugin.localPath;\n    key = pluginKey;\n  } else {\n    const available = [\n      \"api\",\n      ...(runtimeConfig.auth ? [\"auth\"] : []),\n      ...Object.keys(runtimeConfig.plugins ?? {}),\n    ].join(\", \");\n    throw new Error(\n      `Plugin \"${pluginKey}\" not found in app.api, app.auth, or plugins. Available: ${available}`,\n    );\n  }\n\n  const identity: WorkspaceIdentity = localPath\n    ? workspaceIdentityFromWorkspaceDir(resolve(projectDir, localPath))\n    : {\n        slug: pluginMigrationSlug(key),\n        secretName: getDatabaseUrlSecretName(pluginMigrationSlug(key)),\n        journal: getMigrationStorage(pluginMigrationSlug(key)),\n        workspaceDir: undefined,\n      };\n\n  const url = env[identity.secretName];\n  if (!url) {\n    const declaredDatabaseSecrets = (secrets ?? []).filter((s) => s.endsWith(\"_DATABASE_URL\"));\n    const mismatch =\n      declaredDatabaseSecrets.length > 0 && !declaredDatabaseSecrets.includes(identity.secretName)\n        ? ` Config declares ${declaredDatabaseSecrets.join(\", \")} — the workspace package name and the declared secret disagree.`\n        : \"\";\n    throw new Error(\n      `.env missing ${identity.secretName} for plugin \"${key}\".` +\n        mismatch +\n        ` Add it to your .env file (see .env.example).`,\n    );\n  }\n\n  return {\n    key,\n    source: source ?? \"remote\",\n    section,\n    identity,\n    url,\n  };\n}\n\nexport interface DatabaseBindingsOptions {\n  readonly projectDir: string;\n  readonly loadRuntimeConfig: () => Promise<RuntimeConfig | null>;\n  /** May return a promise — a rejection propagates into the binding error instead of silently proceeding with an unloaded .env. */\n  readonly loadEnv?: () => void | Promise<void>;\n  readonly env?: Record<string, string | undefined>;\n}\n\nexport const makeDatabaseBindings = (\n  options: DatabaseBindingsOptions,\n): Layer.Layer<DatabaseBindings> =>\n  Layer.succeed(DatabaseBindings, {\n    forPluginKey: (pluginKey) =>\n      Effect.tryPromise({\n        try: async () => {\n          await options.loadEnv?.();\n          const runtimeConfig = await options.loadRuntimeConfig();\n          return resolvePluginBinding(\n            pluginKey,\n            runtimeConfig,\n            options.projectDir,\n            options.env ?? process.env,\n          );\n        },\n        catch: (error) =>\n          new DatabaseBindingError({\n            pluginKey,\n            message: error instanceof Error ? error.message : String(error),\n          }),\n      }),\n  });\n"],"mappings":";;;;;;AAcA,IAAa,uBAAb,cAA0C,KAAK,YAAY,sBAAsB,CAAC,CAG/E,CAAC;AAQJ,IAAa,mBAAb,cAAsC,QAAQ,QAAmD,CAAC,CAChG,iCACF,CAAC,CAAC,CAAC;AAQH,SAAS,qBACP,WACA,eACA,YACA,KACiB;CACjB,IAAI,CAAC,eACH,MAAM,IAAI,MAAM,oEAAoE;CAGtF,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,IAAI,cAAc,SAAS,cAAc,KAAK;EAC5C,SAAS,cAAc,IAAI;EAC3B,UAAU;EACV,UAAU,cAAc,IAAI;EAC5B,YAAY,cAAc,IAAI;EAC9B,MAAM;CACR,OAAO,IAAI,cAAc,UAAU,cAAc,MAAM;EACrD,SAAS,cAAc,KAAK;EAC5B,UAAU;EACV,UAAU,cAAc,KAAK;EAC7B,YAAY,cAAc,KAAK;EAC/B,MAAM;CACR,OAAO,IAAI,cAAc,UAAU,YAAY;EAC7C,MAAM,SAAS,cAAc,QAAQ;EACrC,SAAS,OAAO;EAChB,UAAU;EACV,UAAU,OAAO;EACjB,YAAY,OAAO;EACnB,MAAM;CACR,OAAO;EACL,MAAM,YAAY;GAChB;GACA,GAAI,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC;GACrC,GAAG,OAAO,KAAK,cAAc,WAAW,CAAC,CAAC;EAC5C,CAAC,CAAC,KAAK,IAAI;EACX,MAAM,IAAI,MACR,WAAW,UAAU,2DAA2D,WAClF;CACF;CAEA,MAAM,WAA8B,YAChC,kCAAkC,QAAQ,YAAY,SAAS,CAAC,IAChE;EACE,MAAM,oBAAoB,GAAG;EAC7B,YAAY,yBAAyB,oBAAoB,GAAG,CAAC;EAC7D,SAAS,oBAAoB,oBAAoB,GAAG,CAAC;EACrD,cAAc;CAChB;CAEJ,MAAM,MAAM,IAAI,SAAS;CACzB,IAAI,CAAC,KAAK;EACR,MAAM,2BAA2B,WAAW,CAAC,EAAC,CAAE,QAAQ,MAAM,EAAE,SAAS,eAAe,CAAC;EACzF,MAAM,WACJ,wBAAwB,SAAS,KAAK,CAAC,wBAAwB,SAAS,SAAS,UAAU,IACvF,oBAAoB,wBAAwB,KAAK,IAAI,EAAE,mEACvD;EACN,MAAM,IAAI,MACR,gBAAgB,SAAS,WAAW,eAAe,IAAI,MACrD,WACA,+CACJ;CACF;CAEA,OAAO;EACL;EACA,QAAQ,UAAU;EAClB;EACA;EACA;CACF;AACF;AAUA,MAAa,wBACX,YAEA,MAAM,QAAQ,kBAAkB,EAC9B,eAAe,cACb,OAAO,WAAW;CAChB,KAAK,YAAY;EACf,MAAM,QAAQ,UAAU;EAExB,OAAO,qBACL,WACA,MAH0B,QAAQ,kBAAkB,GAIpD,QAAQ,YACR,QAAQ,OAAO,QAAQ,GACzB;CACF;CACA,QAAQ,UACN,IAAI,qBAAqB;EACvB;EACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CAChE,CAAC;AACL,CAAC,EACL,CAAC"}

package/dist/db/core.cjs

@@ -0,0 +1,204 @@
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+
+//#region src/db/core.ts
+const DEFAULT_MIGRATION_JOURNAL = {
+	schema: "drizzle",
+	table: "__drizzle_migrations"
+};
+const PER_PLUGIN_ISOLATION = false;
+function normalizeSlug(name) {
+	return (name.split("/").pop() ?? name).replace(/^@/, "").replace(/[^a-zA-Z0-9_-]/g, "_").replace(/-plugin$/i, "").replace(/-/g, "_").toLowerCase();
+}
+function getMigrationSlug(dir) {
+	if (!dir) return normalizeSlug(process.env.npm_package_name ?? "unknown");
+	let current = dir;
+	for (let i = 0; i < 10; i++) {
+		const pkgPath = (0, node_path.join)(current, "package.json");
+		if ((0, node_fs.existsSync)(pkgPath)) try {
+			return normalizeSlug(JSON.parse((0, node_fs.readFileSync)(pkgPath, "utf-8")).name ?? current);
+		} catch {
+			return normalizeSlug(current);
+		}
+		const parent = (0, node_path.dirname)(current);
+		if (parent === current) break;
+		current = parent;
+	}
+	return normalizeSlug(dir);
+}
+function getMigrationStorage(slug, options) {
+	const s = normalizeSlug(slug ?? getMigrationSlug());
+	if (options?.isolated ?? PER_PLUGIN_ISOLATION) return {
+		schema: DEFAULT_MIGRATION_JOURNAL.schema,
+		table: `__drizzle_migrations_${s}`,
+		slug: s
+	};
+	return {
+		schema: DEFAULT_MIGRATION_JOURNAL.schema,
+		table: DEFAULT_MIGRATION_JOURNAL.table,
+		slug: s
+	};
+}
+/**
+* Format a JavaScript string array as a PostgreSQL text array literal for use
+* with Drizzle's `sql` tag. Example return:
+*   `'{"h1","h2"}'::text[]`
+*
+* Usage: sql`WHERE col = ANY(${toSqlArray(values)})`
+*
+* Drizzle's default parameter binding does not handle array types correctly
+* with the pg driver (it emits `ANY(($1))` with a single string, which
+* Postgres rejects as a malformed array literal).
+*/
+function toSqlArray(arr) {
+	if (arr.length === 0) return `'{}'::text[]`;
+	return `'{${arr.map((v) => v.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")).map((v) => `"${v}"`).join(",")}}'::text[]`;
+}
+function pluginMigrationSlug(key) {
+	return normalizeSlug(key);
+}
+function getDatabaseUrlSecretName(slug) {
+	return `${slug.toUpperCase().replace(/-/g, "_")}_DATABASE_URL`;
+}
+const DUPLICATE_OBJECT_SQLSTATES = [
+	"42710",
+	"42701",
+	"42P07"
+];
+/**
+* Walk `error` and its `cause` chain (bounded), invoking `visit` on each link.
+* Postgres driver errors arrive wrapped by drizzle/Effect at varying depths,
+* so every error-shape predicate below shares this traversal.
+*/
+function visitCauses(error, depth, visit) {
+	let current = error;
+	for (let i = 0; i < depth && current; i++) {
+		if (typeof current === "object" && current !== null && visit(current)) return true;
+		current = current?.cause;
+	}
+	return false;
+}
+/**
+* pg_catalog unique indexes that can surface a concurrent-DDL race as SQLSTATE
+* 23505 instead of a duplicate-object class. When two connections run
+* `CREATE TABLE <name>` at the same time, the loser fails its insert into
+* `pg_type` ("duplicate key value violates unique constraint
+* `pg_type_typname_nsp_index`") rather than seeing 42P07, because the winner's
+* table is not yet committed. The same shape exists for schemas and other
+* relations.
+*/
+const CONCURRENT_DDL_CONSTRAINTS = /* @__PURE__ */ new Set([
+	"pg_type_typname_nsp_index",
+	"pg_namespace_nspname_index",
+	"pg_class_relname_nsp_index"
+]);
+/**
+* Whether a SQLSTATE 23505 unique violation is the concurrent-DDL catalog
+* collision signature rather than a data-level constraint on a user table.
+* Data-level violations must keep failing loudly; only the pg_catalog indexes
+* above are treated as duplicate-DDL tolerance candidates.
+*/
+function isConcurrentDdlUniqueViolation(error) {
+	return visitCauses(error, 6, (link) => {
+		const { code, constraint, message } = link;
+		if (code !== "23505") return false;
+		if (typeof constraint === "string" && CONCURRENT_DDL_CONSTRAINTS.has(constraint)) return true;
+		if (typeof message !== "string") return false;
+		for (const name of CONCURRENT_DDL_CONSTRAINTS) if (message.includes(name)) return true;
+		return false;
+	});
+}
+const RETRYABLE_SQLSTATES = /* @__PURE__ */ new Set([
+	"42P06",
+	"42710",
+	"42701",
+	"42P07",
+	"23505",
+	"40001",
+	"40P01",
+	"55P03"
+]);
+const RETRYABLE_DRIVER_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"EPIPE",
+	"ETIMEDOUT",
+	"ENOTFOUND",
+	"EAI_AGAIN"
+]);
+function matchesRetryableStates(error, states) {
+	return visitCauses(error, 6, (link) => {
+		const code = link.code;
+		if (typeof code !== "string") return false;
+		return states.has(code) || code.startsWith("08") || RETRYABLE_DRIVER_CODES.has(code);
+	});
+}
+/**
+* Decide whether a failed migration-init statement (schema/journal creation)
+* is worth retrying. Covers the concurrent `CREATE SCHEMA IF NOT EXISTS`
+* race (unique violation on `pg_namespace`, duplicate-object errors),
+* serialization/deadlock errors, and transient connection failures.
+*/
+function isRetryableMigrationError(error) {
+	return matchesRetryableStates(error, RETRYABLE_SQLSTATES);
+}
+const RETRYABLE_STATEMENT_SQLSTATES = /* @__PURE__ */ new Set([
+	"40001",
+	"40P01",
+	"55P03"
+]);
+/**
+* Decide whether a failed migration *statement* (inside its transaction) is
+* worth retrying. Deliberately narrower than `isRetryableMigrationError`:
+* duplicate-object classes are tolerated at the SAVEPOINT level, and a 23505
+* is either the concurrent-DDL catalog collision (also tolerated) or a
+* deterministic data-level violation (retrying is pointless) — so only
+* lock/serialization/transient-connection states justify re-running the
+* transaction.
+*/
+function isRetryableMigrationExecutionError(error) {
+	return matchesRetryableStates(error, RETRYABLE_STATEMENT_SQLSTATES);
+}
+const PG_QUERY_QUEUE_DEPRECATION = "client.query() when the client is already executing a query";
+let pgWarningFilterInstalled = false;
+/**
+* Silence pg's query-queue deprecation warning (fires once per process from
+* pg-pool's internal dispatch under concurrent boot load — node-postgres#3612,
+* #3617). Node's default warning handler prints even when user listeners are
+* attached, so it is removed first; every other warning is re-printed here.
+*/
+function suppressPgQueryQueueDeprecation() {
+	if (pgWarningFilterInstalled) return;
+	if (typeof process === "undefined" || typeof process.on !== "function") return;
+	pgWarningFilterInstalled = true;
+	process.removeAllListeners("warning");
+	process.on("warning", (warning) => {
+		if (warning.name === "DeprecationWarning" && warning.message.includes(PG_QUERY_QUEUE_DEPRECATION)) return;
+		console.error(warning.stack || `${warning.name}: ${warning.message}`);
+	});
+}
+function extractExpectedTables(migrations) {
+	const tables = /* @__PURE__ */ new Set();
+	const re = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"\.)?"([^"]+)"/gi;
+	for (const migration of migrations) for (const stmt of migration.sql) for (const match of stmt.matchAll(re)) {
+		const tableName = match[2];
+		if (tableName) tables.add(tableName);
+	}
+	return [...tables];
+}
+
+//#endregion
+exports.DUPLICATE_OBJECT_SQLSTATES = DUPLICATE_OBJECT_SQLSTATES;
+exports.extractExpectedTables = extractExpectedTables;
+exports.getDatabaseUrlSecretName = getDatabaseUrlSecretName;
+exports.getMigrationSlug = getMigrationSlug;
+exports.getMigrationStorage = getMigrationStorage;
+exports.isConcurrentDdlUniqueViolation = isConcurrentDdlUniqueViolation;
+exports.isRetryableMigrationError = isRetryableMigrationError;
+exports.isRetryableMigrationExecutionError = isRetryableMigrationExecutionError;
+exports.normalizeSlug = normalizeSlug;
+exports.pluginMigrationSlug = pluginMigrationSlug;
+exports.suppressPgQueryQueueDeprecation = suppressPgQueryQueueDeprecation;
+exports.toSqlArray = toSqlArray;
+exports.visitCauses = visitCauses;
+//# sourceMappingURL=core.cjs.map

package/dist/db/core.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.cjs","names":["join","existsSync","readFileSync","dirname"],"sources":["../../src/db/core.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\nexport interface MigrationStorage {\n  schema: string;\n  table: string;\n  slug: string;\n}\n\nconst DEFAULT_MIGRATION_JOURNAL = {\n  schema: \"drizzle\",\n  table: \"__drizzle_migrations\",\n} as const;\n\nconst PER_PLUGIN_ISOLATION = false;\n\nexport function normalizeSlug(name: string): string {\n  const basename = name.split(\"/\").pop() ?? name;\n  return basename\n    .replace(/^@/, \"\")\n    .replace(/[^a-zA-Z0-9_-]/g, \"_\")\n    .replace(/-plugin$/i, \"\")\n    .replace(/-/g, \"_\")\n    .toLowerCase();\n}\n\nexport function getMigrationSlug(dir?: string): string {\n  if (!dir) return normalizeSlug(process.env.npm_package_name ?? \"unknown\");\n  let current = dir;\n  for (let i = 0; i < 10; i++) {\n    const pkgPath = join(current, \"package.json\");\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, \"utf-8\")) as { name?: string };\n        return normalizeSlug(pkg.name ?? current);\n      } catch {\n        return normalizeSlug(current);\n      }\n    }\n    const parent = dirname(current);\n    if (parent === current) break;\n    current = parent;\n  }\n  return normalizeSlug(dir);\n}\n\nexport function getMigrationStorage(\n  slug?: string,\n  options?: { isolated?: boolean },\n): MigrationStorage {\n  const s = normalizeSlug(slug ?? getMigrationSlug());\n  const isolated = options?.isolated ?? PER_PLUGIN_ISOLATION;\n  if (isolated) {\n    return {\n      schema: DEFAULT_MIGRATION_JOURNAL.schema,\n      table: `__drizzle_migrations_${s}`,\n      slug: s,\n    };\n  }\n  return {\n    schema: DEFAULT_MIGRATION_JOURNAL.schema,\n    table: DEFAULT_MIGRATION_JOURNAL.table,\n    slug: s,\n  };\n}\n\n/**\n * Format a JavaScript string array as a PostgreSQL text array literal for use\n * with Drizzle's `sql` tag. Example return:\n *   `'{\"h1\",\"h2\"}'::text[]`\n *\n * Usage: sql`WHERE col = ANY(${toSqlArray(values)})`\n *\n * Drizzle's default parameter binding does not handle array types correctly\n * with the pg driver (it emits `ANY(($1))` with a single string, which\n * Postgres rejects as a malformed array literal).\n */\nexport function toSqlArray(arr: string[]): string {\n  if (arr.length === 0) return `'{}'::text[]`;\n  const escaped = arr.map((v) => v.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"'));\n  return `'{${escaped.map((v) => `\"${v}\"`).join(\",\")}}'::text[]`;\n}\n\nexport function pluginMigrationSlug(key: string): string {\n  return normalizeSlug(key);\n}\n\nexport function getDatabaseUrlSecretName(slug: string): string {\n  return `${slug.toUpperCase().replace(/-/g, \"_\")}_DATABASE_URL`;\n}\n\nexport const DUPLICATE_OBJECT_SQLSTATES: readonly string[] = [\"42710\", \"42701\", \"42P07\"];\n\n/**\n * Walk `error` and its `cause` chain (bounded), invoking `visit` on each link.\n * Postgres driver errors arrive wrapped by drizzle/Effect at varying depths,\n * so every error-shape predicate below shares this traversal.\n */\nexport function visitCauses(\n  error: unknown,\n  depth: number,\n  visit: (link: object) => boolean,\n): boolean {\n  let current: unknown = error;\n  for (let i = 0; i < depth && current; i++) {\n    if (typeof current === \"object\" && current !== null && visit(current)) return true;\n    current = (current as { cause?: unknown })?.cause;\n  }\n  return false;\n}\n\n/**\n * pg_catalog unique indexes that can surface a concurrent-DDL race as SQLSTATE\n * 23505 instead of a duplicate-object class. When two connections run\n * `CREATE TABLE <name>` at the same time, the loser fails its insert into\n * `pg_type` (\"duplicate key value violates unique constraint\n * `pg_type_typname_nsp_index`\") rather than seeing 42P07, because the winner's\n * table is not yet committed. The same shape exists for schemas and other\n * relations.\n */\nconst CONCURRENT_DDL_CONSTRAINTS: ReadonlySet<string> = new Set([\n  \"pg_type_typname_nsp_index\",\n  \"pg_namespace_nspname_index\",\n  \"pg_class_relname_nsp_index\",\n]);\n\n/**\n * Whether a SQLSTATE 23505 unique violation is the concurrent-DDL catalog\n * collision signature rather than a data-level constraint on a user table.\n * Data-level violations must keep failing loudly; only the pg_catalog indexes\n * above are treated as duplicate-DDL tolerance candidates.\n */\nexport function isConcurrentDdlUniqueViolation(error: unknown): boolean {\n  return visitCauses(error, 6, (link) => {\n    const { code, constraint, message } = link as {\n      code?: unknown;\n      constraint?: unknown;\n      message?: unknown;\n    };\n    if (code !== \"23505\") return false;\n    if (typeof constraint === \"string\" && CONCURRENT_DDL_CONSTRAINTS.has(constraint)) return true;\n    if (typeof message !== \"string\") return false;\n    for (const name of CONCURRENT_DDL_CONSTRAINTS) {\n      if (message.includes(name)) return true;\n    }\n    return false;\n  });\n}\n\nconst RETRYABLE_SQLSTATES: ReadonlySet<string> = new Set([\n  \"42P06\",\n  \"42710\",\n  \"42701\",\n  \"42P07\",\n  \"23505\",\n  \"40001\",\n  \"40P01\",\n  \"55P03\",\n]);\n\nconst RETRYABLE_DRIVER_CODES: ReadonlySet<string> = new Set([\n  \"ECONNREFUSED\",\n  \"ECONNRESET\",\n  \"EPIPE\",\n  \"ETIMEDOUT\",\n  \"ENOTFOUND\",\n  \"EAI_AGAIN\",\n]);\n\nfunction matchesRetryableStates(error: unknown, states: ReadonlySet<string>): boolean {\n  return visitCauses(error, 6, (link) => {\n    const code = (link as { code?: unknown }).code;\n    if (typeof code !== \"string\") return false;\n    return states.has(code) || code.startsWith(\"08\") || RETRYABLE_DRIVER_CODES.has(code);\n  });\n}\n\n/**\n * Decide whether a failed migration-init statement (schema/journal creation)\n * is worth retrying. Covers the concurrent `CREATE SCHEMA IF NOT EXISTS`\n * race (unique violation on `pg_namespace`, duplicate-object errors),\n * serialization/deadlock errors, and transient connection failures.\n */\nexport function isRetryableMigrationError(error: unknown): boolean {\n  return matchesRetryableStates(error, RETRYABLE_SQLSTATES);\n}\n\nconst RETRYABLE_STATEMENT_SQLSTATES: ReadonlySet<string> = new Set([\n  \"40001\", // serialization_failure\n  \"40P01\", // deadlock_detected\n  \"55P03\", // lock_not_available\n]);\n\n/**\n * Decide whether a failed migration *statement* (inside its transaction) is\n * worth retrying. Deliberately narrower than `isRetryableMigrationError`:\n * duplicate-object classes are tolerated at the SAVEPOINT level, and a 23505\n * is either the concurrent-DDL catalog collision (also tolerated) or a\n * deterministic data-level violation (retrying is pointless) — so only\n * lock/serialization/transient-connection states justify re-running the\n * transaction.\n */\nexport function isRetryableMigrationExecutionError(error: unknown): boolean {\n  return matchesRetryableStates(error, RETRYABLE_STATEMENT_SQLSTATES);\n}\n\nconst PG_QUERY_QUEUE_DEPRECATION = \"client.query() when the client is already executing a query\";\n\nlet pgWarningFilterInstalled = false;\n\n/**\n * Silence pg's query-queue deprecation warning (fires once per process from\n * pg-pool's internal dispatch under concurrent boot load — node-postgres#3612,\n * #3617). Node's default warning handler prints even when user listeners are\n * attached, so it is removed first; every other warning is re-printed here.\n */\nexport function suppressPgQueryQueueDeprecation(): void {\n  if (pgWarningFilterInstalled) return;\n  if (typeof process === \"undefined\" || typeof process.on !== \"function\") return;\n  pgWarningFilterInstalled = true;\n  process.removeAllListeners(\"warning\");\n  process.on(\"warning\", (warning) => {\n    if (\n      warning.name === \"DeprecationWarning\" &&\n      warning.message.includes(PG_QUERY_QUEUE_DEPRECATION)\n    ) {\n      return;\n    }\n    console.error(warning.stack || `${warning.name}: ${warning.message}`);\n  });\n}\n\nexport function extractExpectedTables(migrations: { sql: string[] }[]): string[] {\n  const tables = new Set<string>();\n  const re = /CREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(?:\"([^\"]+)\"\\.)?\"([^\"]+)\"/gi;\n  for (const migration of migrations) {\n    for (const stmt of migration.sql) {\n      for (const match of stmt.matchAll(re)) {\n        const tableName = match[2];\n        if (tableName) {\n          tables.add(tableName);\n        }\n      }\n    }\n  }\n  return [...tables];\n}\n"],"mappings":";;;;AASA,MAAM,4BAA4B;CAChC,QAAQ;CACR,OAAO;AACT;AAEA,MAAM,uBAAuB;AAE7B,SAAgB,cAAc,MAAsB;CAElD,QADiB,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,KAC3B,CACZ,QAAQ,MAAM,EAAE,CAAC,CACjB,QAAQ,mBAAmB,GAAG,CAAC,CAC/B,QAAQ,aAAa,EAAE,CAAC,CACxB,QAAQ,MAAM,GAAG,CAAC,CAClB,YAAY;AACjB;AAEA,SAAgB,iBAAiB,KAAsB;CACrD,IAAI,CAAC,KAAK,OAAO,cAAc,QAAQ,IAAI,oBAAoB,SAAS;CACxE,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;EAC3B,MAAM,cAAUA,gBAAK,SAAS,cAAc;EAC5C,QAAIC,oBAAW,OAAO,GACpB,IAAI;GAEF,OAAO,cADK,KAAK,UAAMC,sBAAa,SAAS,OAAO,CAC7B,CAAC,CAAC,QAAQ,OAAO;EAC1C,QAAQ;GACN,OAAO,cAAc,OAAO;EAC9B;EAEF,MAAM,aAASC,mBAAQ,OAAO;EAC9B,IAAI,WAAW,SAAS;EACxB,UAAU;CACZ;CACA,OAAO,cAAc,GAAG;AAC1B;AAEA,SAAgB,oBACd,MACA,SACkB;CAClB,MAAM,IAAI,cAAc,QAAQ,iBAAiB,CAAC;CAElD,IADiB,SAAS,YAAY,sBAEpC,OAAO;EACL,QAAQ,0BAA0B;EAClC,OAAO,wBAAwB;EAC/B,MAAM;CACR;CAEF,OAAO;EACL,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;EACjC,MAAM;CACR;AACF;;;;;;;;;;;;AAaA,SAAgB,WAAW,KAAuB;CAChD,IAAI,IAAI,WAAW,GAAG,OAAO;CAE7B,OAAO,KADS,IAAI,KAAK,MAAM,EAAE,QAAQ,OAAO,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAK,CACzD,CAAC,CAAC,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;AACrD;AAEA,SAAgB,oBAAoB,KAAqB;CACvD,OAAO,cAAc,GAAG;AAC1B;AAEA,SAAgB,yBAAyB,MAAsB;CAC7D,OAAO,GAAG,KAAK,YAAY,CAAC,CAAC,QAAQ,MAAM,GAAG,EAAE;AAClD;AAEA,MAAa,6BAAgD;CAAC;CAAS;CAAS;AAAO;;;;;;AAOvF,SAAgB,YACd,OACA,OACA,OACS;CACT,IAAI,UAAmB;CACvB,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,SAAS,KAAK;EACzC,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,OAAO,GAAG,OAAO;EAC9E,UAAW,SAAiC;CAC9C;CACA,OAAO;AACT;;;;;;;;;;AAWA,MAAM,6CAAkD,IAAI,IAAI;CAC9D;CACA;CACA;AACF,CAAC;;;;;;;AAQD,SAAgB,+BAA+B,OAAyB;CACtE,OAAO,YAAY,OAAO,IAAI,SAAS;EACrC,MAAM,EAAE,MAAM,YAAY,YAAY;EAKtC,IAAI,SAAS,SAAS,OAAO;EAC7B,IAAI,OAAO,eAAe,YAAY,2BAA2B,IAAI,UAAU,GAAG,OAAO;EACzF,IAAI,OAAO,YAAY,UAAU,OAAO;EACxC,KAAK,MAAM,QAAQ,4BACjB,IAAI,QAAQ,SAAS,IAAI,GAAG,OAAO;EAErC,OAAO;CACT,CAAC;AACH;AAEA,MAAM,sCAA2C,IAAI,IAAI;CACvD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,yCAA8C,IAAI,IAAI;CAC1D;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,uBAAuB,OAAgB,QAAsC;CACpF,OAAO,YAAY,OAAO,IAAI,SAAS;EACrC,MAAM,OAAQ,KAA4B;EAC1C,IAAI,OAAO,SAAS,UAAU,OAAO;EACrC,OAAO,OAAO,IAAI,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,uBAAuB,IAAI,IAAI;CACrF,CAAC;AACH;;;;;;;AAQA,SAAgB,0BAA0B,OAAyB;CACjE,OAAO,uBAAuB,OAAO,mBAAmB;AAC1D;AAEA,MAAM,gDAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;;;;;;;;;;AAWD,SAAgB,mCAAmC,OAAyB;CAC1E,OAAO,uBAAuB,OAAO,6BAA6B;AACpE;AAEA,MAAM,6BAA6B;AAEnC,IAAI,2BAA2B;;;;;;;AAQ/B,SAAgB,kCAAwC;CACtD,IAAI,0BAA0B;CAC9B,IAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,OAAO,YAAY;CACxE,2BAA2B;CAC3B,QAAQ,mBAAmB,SAAS;CACpC,QAAQ,GAAG,YAAY,YAAY;EACjC,IACE,QAAQ,SAAS,wBACjB,QAAQ,QAAQ,SAAS,0BAA0B,GAEnD;EAEF,QAAQ,MAAM,QAAQ,SAAS,GAAG,QAAQ,KAAK,IAAI,QAAQ,SAAS;CACtE,CAAC;AACH;AAEA,SAAgB,sBAAsB,YAA2C;CAC/E,MAAM,yBAAS,IAAI,IAAY;CAC/B,MAAM,KAAK;CACX,KAAK,MAAM,aAAa,YACtB,KAAK,MAAM,QAAQ,UAAU,KAC3B,KAAK,MAAM,SAAS,KAAK,SAAS,EAAE,GAAG;EACrC,MAAM,YAAY,MAAM;EACxB,IAAI,WACF,OAAO,IAAI,SAAS;CAExB;CAGJ,OAAO,CAAC,GAAG,MAAM;AACnB"}

package/dist/db/core.d.cts

@@ -0,0 +1,69 @@
+//#region src/db/core.d.ts
+interface MigrationStorage {
+  schema: string;
+  table: string;
+  slug: string;
+}
+declare function normalizeSlug(name: string): string;
+declare function getMigrationSlug(dir?: string): string;
+declare function getMigrationStorage(slug?: string, options?: {
+  isolated?: boolean;
+}): MigrationStorage;
+/**
+ * Format a JavaScript string array as a PostgreSQL text array literal for use
+ * with Drizzle's `sql` tag. Example return:
+ *   `'{"h1","h2"}'::text[]`
+ *
+ * Usage: sql`WHERE col = ANY(${toSqlArray(values)})`
+ *
+ * Drizzle's default parameter binding does not handle array types correctly
+ * with the pg driver (it emits `ANY(($1))` with a single string, which
+ * Postgres rejects as a malformed array literal).
+ */
+declare function toSqlArray(arr: string[]): string;
+declare function pluginMigrationSlug(key: string): string;
+declare function getDatabaseUrlSecretName(slug: string): string;
+declare const DUPLICATE_OBJECT_SQLSTATES: readonly string[];
+/**
+ * Walk `error` and its `cause` chain (bounded), invoking `visit` on each link.
+ * Postgres driver errors arrive wrapped by drizzle/Effect at varying depths,
+ * so every error-shape predicate below shares this traversal.
+ */
+declare function visitCauses(error: unknown, depth: number, visit: (link: object) => boolean): boolean;
+/**
+ * Whether a SQLSTATE 23505 unique violation is the concurrent-DDL catalog
+ * collision signature rather than a data-level constraint on a user table.
+ * Data-level violations must keep failing loudly; only the pg_catalog indexes
+ * above are treated as duplicate-DDL tolerance candidates.
+ */
+declare function isConcurrentDdlUniqueViolation(error: unknown): boolean;
+/**
+ * Decide whether a failed migration-init statement (schema/journal creation)
+ * is worth retrying. Covers the concurrent `CREATE SCHEMA IF NOT EXISTS`
+ * race (unique violation on `pg_namespace`, duplicate-object errors),
+ * serialization/deadlock errors, and transient connection failures.
+ */
+declare function isRetryableMigrationError(error: unknown): boolean;
+/**
+ * Decide whether a failed migration *statement* (inside its transaction) is
+ * worth retrying. Deliberately narrower than `isRetryableMigrationError`:
+ * duplicate-object classes are tolerated at the SAVEPOINT level, and a 23505
+ * is either the concurrent-DDL catalog collision (also tolerated) or a
+ * deterministic data-level violation (retrying is pointless) — so only
+ * lock/serialization/transient-connection states justify re-running the
+ * transaction.
+ */
+declare function isRetryableMigrationExecutionError(error: unknown): boolean;
+/**
+ * Silence pg's query-queue deprecation warning (fires once per process from
+ * pg-pool's internal dispatch under concurrent boot load — node-postgres#3612,
+ * #3617). Node's default warning handler prints even when user listeners are
+ * attached, so it is removed first; every other warning is re-printed here.
+ */
+declare function suppressPgQueryQueueDeprecation(): void;
+declare function extractExpectedTables(migrations: {
+  sql: string[];
+}[]): string[];
+//#endregion
+export { DUPLICATE_OBJECT_SQLSTATES, MigrationStorage, extractExpectedTables, getDatabaseUrlSecretName, getMigrationSlug, getMigrationStorage, isConcurrentDdlUniqueViolation, isRetryableMigrationError, isRetryableMigrationExecutionError, normalizeSlug, pluginMigrationSlug, suppressPgQueryQueueDeprecation, toSqlArray, visitCauses };
+//# sourceMappingURL=core.d.cts.map