everything-dev 1.53.2 → 2.0.0-rc.1

package/dist/db/core.d.mts

@@ -0,0 +1,69 @@
+//#region src/db/core.d.ts
+interface MigrationStorage {
+  schema: string;
+  table: string;
+  slug: string;
+}
+declare function normalizeSlug(name: string): string;
+declare function getMigrationSlug(dir?: string): string;
+declare function getMigrationStorage(slug?: string, options?: {
+  isolated?: boolean;
+}): MigrationStorage;
+/**
+ * Format a JavaScript string array as a PostgreSQL text array literal for use
+ * with Drizzle's `sql` tag. Example return:
+ *   `'{"h1","h2"}'::text[]`
+ *
+ * Usage: sql`WHERE col = ANY(${toSqlArray(values)})`
+ *
+ * Drizzle's default parameter binding does not handle array types correctly
+ * with the pg driver (it emits `ANY(($1))` with a single string, which
+ * Postgres rejects as a malformed array literal).
+ */
+declare function toSqlArray(arr: string[]): string;
+declare function pluginMigrationSlug(key: string): string;
+declare function getDatabaseUrlSecretName(slug: string): string;
+declare const DUPLICATE_OBJECT_SQLSTATES: readonly string[];
+/**
+ * Walk `error` and its `cause` chain (bounded), invoking `visit` on each link.
+ * Postgres driver errors arrive wrapped by drizzle/Effect at varying depths,
+ * so every error-shape predicate below shares this traversal.
+ */
+declare function visitCauses(error: unknown, depth: number, visit: (link: object) => boolean): boolean;
+/**
+ * Whether a SQLSTATE 23505 unique violation is the concurrent-DDL catalog
+ * collision signature rather than a data-level constraint on a user table.
+ * Data-level violations must keep failing loudly; only the pg_catalog indexes
+ * above are treated as duplicate-DDL tolerance candidates.
+ */
+declare function isConcurrentDdlUniqueViolation(error: unknown): boolean;
+/**
+ * Decide whether a failed migration-init statement (schema/journal creation)
+ * is worth retrying. Covers the concurrent `CREATE SCHEMA IF NOT EXISTS`
+ * race (unique violation on `pg_namespace`, duplicate-object errors),
+ * serialization/deadlock errors, and transient connection failures.
+ */
+declare function isRetryableMigrationError(error: unknown): boolean;
+/**
+ * Decide whether a failed migration *statement* (inside its transaction) is
+ * worth retrying. Deliberately narrower than `isRetryableMigrationError`:
+ * duplicate-object classes are tolerated at the SAVEPOINT level, and a 23505
+ * is either the concurrent-DDL catalog collision (also tolerated) or a
+ * deterministic data-level violation (retrying is pointless) — so only
+ * lock/serialization/transient-connection states justify re-running the
+ * transaction.
+ */
+declare function isRetryableMigrationExecutionError(error: unknown): boolean;
+/**
+ * Silence pg's query-queue deprecation warning (fires once per process from
+ * pg-pool's internal dispatch under concurrent boot load — node-postgres#3612,
+ * #3617). Node's default warning handler prints even when user listeners are
+ * attached, so it is removed first; every other warning is re-printed here.
+ */
+declare function suppressPgQueryQueueDeprecation(): void;
+declare function extractExpectedTables(migrations: {
+  sql: string[];
+}[]): string[];
+//#endregion
+export { DUPLICATE_OBJECT_SQLSTATES, MigrationStorage, extractExpectedTables, getDatabaseUrlSecretName, getMigrationSlug, getMigrationStorage, isConcurrentDdlUniqueViolation, isRetryableMigrationError, isRetryableMigrationExecutionError, normalizeSlug, pluginMigrationSlug, suppressPgQueryQueueDeprecation, toSqlArray, visitCauses };
+//# sourceMappingURL=core.d.mts.map

package/dist/db/core.mjs

@@ -0,0 +1,192 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+//#region src/db/core.ts
+const DEFAULT_MIGRATION_JOURNAL = {
+	schema: "drizzle",
+	table: "__drizzle_migrations"
+};
+const PER_PLUGIN_ISOLATION = false;
+function normalizeSlug(name) {
+	return (name.split("/").pop() ?? name).replace(/^@/, "").replace(/[^a-zA-Z0-9_-]/g, "_").replace(/-plugin$/i, "").replace(/-/g, "_").toLowerCase();
+}
+function getMigrationSlug(dir) {
+	if (!dir) return normalizeSlug(process.env.npm_package_name ?? "unknown");
+	let current = dir;
+	for (let i = 0; i < 10; i++) {
+		const pkgPath = join(current, "package.json");
+		if (existsSync(pkgPath)) try {
+			return normalizeSlug(JSON.parse(readFileSync(pkgPath, "utf-8")).name ?? current);
+		} catch {
+			return normalizeSlug(current);
+		}
+		const parent = dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+	return normalizeSlug(dir);
+}
+function getMigrationStorage(slug, options) {
+	const s = normalizeSlug(slug ?? getMigrationSlug());
+	if (options?.isolated ?? PER_PLUGIN_ISOLATION) return {
+		schema: DEFAULT_MIGRATION_JOURNAL.schema,
+		table: `__drizzle_migrations_${s}`,
+		slug: s
+	};
+	return {
+		schema: DEFAULT_MIGRATION_JOURNAL.schema,
+		table: DEFAULT_MIGRATION_JOURNAL.table,
+		slug: s
+	};
+}
+/**
+* Format a JavaScript string array as a PostgreSQL text array literal for use
+* with Drizzle's `sql` tag. Example return:
+*   `'{"h1","h2"}'::text[]`
+*
+* Usage: sql`WHERE col = ANY(${toSqlArray(values)})`
+*
+* Drizzle's default parameter binding does not handle array types correctly
+* with the pg driver (it emits `ANY(($1))` with a single string, which
+* Postgres rejects as a malformed array literal).
+*/
+function toSqlArray(arr) {
+	if (arr.length === 0) return `'{}'::text[]`;
+	return `'{${arr.map((v) => v.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")).map((v) => `"${v}"`).join(",")}}'::text[]`;
+}
+function pluginMigrationSlug(key) {
+	return normalizeSlug(key);
+}
+function getDatabaseUrlSecretName(slug) {
+	return `${slug.toUpperCase().replace(/-/g, "_")}_DATABASE_URL`;
+}
+const DUPLICATE_OBJECT_SQLSTATES = [
+	"42710",
+	"42701",
+	"42P07"
+];
+/**
+* Walk `error` and its `cause` chain (bounded), invoking `visit` on each link.
+* Postgres driver errors arrive wrapped by drizzle/Effect at varying depths,
+* so every error-shape predicate below shares this traversal.
+*/
+function visitCauses(error, depth, visit) {
+	let current = error;
+	for (let i = 0; i < depth && current; i++) {
+		if (typeof current === "object" && current !== null && visit(current)) return true;
+		current = current?.cause;
+	}
+	return false;
+}
+/**
+* pg_catalog unique indexes that can surface a concurrent-DDL race as SQLSTATE
+* 23505 instead of a duplicate-object class. When two connections run
+* `CREATE TABLE <name>` at the same time, the loser fails its insert into
+* `pg_type` ("duplicate key value violates unique constraint
+* `pg_type_typname_nsp_index`") rather than seeing 42P07, because the winner's
+* table is not yet committed. The same shape exists for schemas and other
+* relations.
+*/
+const CONCURRENT_DDL_CONSTRAINTS = /* @__PURE__ */ new Set([
+	"pg_type_typname_nsp_index",
+	"pg_namespace_nspname_index",
+	"pg_class_relname_nsp_index"
+]);
+/**
+* Whether a SQLSTATE 23505 unique violation is the concurrent-DDL catalog
+* collision signature rather than a data-level constraint on a user table.
+* Data-level violations must keep failing loudly; only the pg_catalog indexes
+* above are treated as duplicate-DDL tolerance candidates.
+*/
+function isConcurrentDdlUniqueViolation(error) {
+	return visitCauses(error, 6, (link) => {
+		const { code, constraint, message } = link;
+		if (code !== "23505") return false;
+		if (typeof constraint === "string" && CONCURRENT_DDL_CONSTRAINTS.has(constraint)) return true;
+		if (typeof message !== "string") return false;
+		for (const name of CONCURRENT_DDL_CONSTRAINTS) if (message.includes(name)) return true;
+		return false;
+	});
+}
+const RETRYABLE_SQLSTATES = /* @__PURE__ */ new Set([
+	"42P06",
+	"42710",
+	"42701",
+	"42P07",
+	"23505",
+	"40001",
+	"40P01",
+	"55P03"
+]);
+const RETRYABLE_DRIVER_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"EPIPE",
+	"ETIMEDOUT",
+	"ENOTFOUND",
+	"EAI_AGAIN"
+]);
+function matchesRetryableStates(error, states) {
+	return visitCauses(error, 6, (link) => {
+		const code = link.code;
+		if (typeof code !== "string") return false;
+		return states.has(code) || code.startsWith("08") || RETRYABLE_DRIVER_CODES.has(code);
+	});
+}
+/**
+* Decide whether a failed migration-init statement (schema/journal creation)
+* is worth retrying. Covers the concurrent `CREATE SCHEMA IF NOT EXISTS`
+* race (unique violation on `pg_namespace`, duplicate-object errors),
+* serialization/deadlock errors, and transient connection failures.
+*/
+function isRetryableMigrationError(error) {
+	return matchesRetryableStates(error, RETRYABLE_SQLSTATES);
+}
+const RETRYABLE_STATEMENT_SQLSTATES = /* @__PURE__ */ new Set([
+	"40001",
+	"40P01",
+	"55P03"
+]);
+/**
+* Decide whether a failed migration *statement* (inside its transaction) is
+* worth retrying. Deliberately narrower than `isRetryableMigrationError`:
+* duplicate-object classes are tolerated at the SAVEPOINT level, and a 23505
+* is either the concurrent-DDL catalog collision (also tolerated) or a
+* deterministic data-level violation (retrying is pointless) — so only
+* lock/serialization/transient-connection states justify re-running the
+* transaction.
+*/
+function isRetryableMigrationExecutionError(error) {
+	return matchesRetryableStates(error, RETRYABLE_STATEMENT_SQLSTATES);
+}
+const PG_QUERY_QUEUE_DEPRECATION = "client.query() when the client is already executing a query";
+let pgWarningFilterInstalled = false;
+/**
+* Silence pg's query-queue deprecation warning (fires once per process from
+* pg-pool's internal dispatch under concurrent boot load — node-postgres#3612,
+* #3617). Node's default warning handler prints even when user listeners are
+* attached, so it is removed first; every other warning is re-printed here.
+*/
+function suppressPgQueryQueueDeprecation() {
+	if (pgWarningFilterInstalled) return;
+	if (typeof process === "undefined" || typeof process.on !== "function") return;
+	pgWarningFilterInstalled = true;
+	process.removeAllListeners("warning");
+	process.on("warning", (warning) => {
+		if (warning.name === "DeprecationWarning" && warning.message.includes(PG_QUERY_QUEUE_DEPRECATION)) return;
+		console.error(warning.stack || `${warning.name}: ${warning.message}`);
+	});
+}
+function extractExpectedTables(migrations) {
+	const tables = /* @__PURE__ */ new Set();
+	const re = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"\.)?"([^"]+)"/gi;
+	for (const migration of migrations) for (const stmt of migration.sql) for (const match of stmt.matchAll(re)) {
+		const tableName = match[2];
+		if (tableName) tables.add(tableName);
+	}
+	return [...tables];
+}
+
+//#endregion
+export { DUPLICATE_OBJECT_SQLSTATES, extractExpectedTables, getDatabaseUrlSecretName, getMigrationSlug, getMigrationStorage, isConcurrentDdlUniqueViolation, isRetryableMigrationError, isRetryableMigrationExecutionError, normalizeSlug, pluginMigrationSlug, suppressPgQueryQueueDeprecation, toSqlArray, visitCauses };
+//# sourceMappingURL=core.mjs.map

package/dist/db/core.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.mjs","names":[],"sources":["../../src/db/core.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\nexport interface MigrationStorage {\n  schema: string;\n  table: string;\n  slug: string;\n}\n\nconst DEFAULT_MIGRATION_JOURNAL = {\n  schema: \"drizzle\",\n  table: \"__drizzle_migrations\",\n} as const;\n\nconst PER_PLUGIN_ISOLATION = false;\n\nexport function normalizeSlug(name: string): string {\n  const basename = name.split(\"/\").pop() ?? name;\n  return basename\n    .replace(/^@/, \"\")\n    .replace(/[^a-zA-Z0-9_-]/g, \"_\")\n    .replace(/-plugin$/i, \"\")\n    .replace(/-/g, \"_\")\n    .toLowerCase();\n}\n\nexport function getMigrationSlug(dir?: string): string {\n  if (!dir) return normalizeSlug(process.env.npm_package_name ?? \"unknown\");\n  let current = dir;\n  for (let i = 0; i < 10; i++) {\n    const pkgPath = join(current, \"package.json\");\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, \"utf-8\")) as { name?: string };\n        return normalizeSlug(pkg.name ?? current);\n      } catch {\n        return normalizeSlug(current);\n      }\n    }\n    const parent = dirname(current);\n    if (parent === current) break;\n    current = parent;\n  }\n  return normalizeSlug(dir);\n}\n\nexport function getMigrationStorage(\n  slug?: string,\n  options?: { isolated?: boolean },\n): MigrationStorage {\n  const s = normalizeSlug(slug ?? getMigrationSlug());\n  const isolated = options?.isolated ?? PER_PLUGIN_ISOLATION;\n  if (isolated) {\n    return {\n      schema: DEFAULT_MIGRATION_JOURNAL.schema,\n      table: `__drizzle_migrations_${s}`,\n      slug: s,\n    };\n  }\n  return {\n    schema: DEFAULT_MIGRATION_JOURNAL.schema,\n    table: DEFAULT_MIGRATION_JOURNAL.table,\n    slug: s,\n  };\n}\n\n/**\n * Format a JavaScript string array as a PostgreSQL text array literal for use\n * with Drizzle's `sql` tag. Example return:\n *   `'{\"h1\",\"h2\"}'::text[]`\n *\n * Usage: sql`WHERE col = ANY(${toSqlArray(values)})`\n *\n * Drizzle's default parameter binding does not handle array types correctly\n * with the pg driver (it emits `ANY(($1))` with a single string, which\n * Postgres rejects as a malformed array literal).\n */\nexport function toSqlArray(arr: string[]): string {\n  if (arr.length === 0) return `'{}'::text[]`;\n  const escaped = arr.map((v) => v.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"'));\n  return `'{${escaped.map((v) => `\"${v}\"`).join(\",\")}}'::text[]`;\n}\n\nexport function pluginMigrationSlug(key: string): string {\n  return normalizeSlug(key);\n}\n\nexport function getDatabaseUrlSecretName(slug: string): string {\n  return `${slug.toUpperCase().replace(/-/g, \"_\")}_DATABASE_URL`;\n}\n\nexport const DUPLICATE_OBJECT_SQLSTATES: readonly string[] = [\"42710\", \"42701\", \"42P07\"];\n\n/**\n * Walk `error` and its `cause` chain (bounded), invoking `visit` on each link.\n * Postgres driver errors arrive wrapped by drizzle/Effect at varying depths,\n * so every error-shape predicate below shares this traversal.\n */\nexport function visitCauses(\n  error: unknown,\n  depth: number,\n  visit: (link: object) => boolean,\n): boolean {\n  let current: unknown = error;\n  for (let i = 0; i < depth && current; i++) {\n    if (typeof current === \"object\" && current !== null && visit(current)) return true;\n    current = (current as { cause?: unknown })?.cause;\n  }\n  return false;\n}\n\n/**\n * pg_catalog unique indexes that can surface a concurrent-DDL race as SQLSTATE\n * 23505 instead of a duplicate-object class. When two connections run\n * `CREATE TABLE <name>` at the same time, the loser fails its insert into\n * `pg_type` (\"duplicate key value violates unique constraint\n * `pg_type_typname_nsp_index`\") rather than seeing 42P07, because the winner's\n * table is not yet committed. The same shape exists for schemas and other\n * relations.\n */\nconst CONCURRENT_DDL_CONSTRAINTS: ReadonlySet<string> = new Set([\n  \"pg_type_typname_nsp_index\",\n  \"pg_namespace_nspname_index\",\n  \"pg_class_relname_nsp_index\",\n]);\n\n/**\n * Whether a SQLSTATE 23505 unique violation is the concurrent-DDL catalog\n * collision signature rather than a data-level constraint on a user table.\n * Data-level violations must keep failing loudly; only the pg_catalog indexes\n * above are treated as duplicate-DDL tolerance candidates.\n */\nexport function isConcurrentDdlUniqueViolation(error: unknown): boolean {\n  return visitCauses(error, 6, (link) => {\n    const { code, constraint, message } = link as {\n      code?: unknown;\n      constraint?: unknown;\n      message?: unknown;\n    };\n    if (code !== \"23505\") return false;\n    if (typeof constraint === \"string\" && CONCURRENT_DDL_CONSTRAINTS.has(constraint)) return true;\n    if (typeof message !== \"string\") return false;\n    for (const name of CONCURRENT_DDL_CONSTRAINTS) {\n      if (message.includes(name)) return true;\n    }\n    return false;\n  });\n}\n\nconst RETRYABLE_SQLSTATES: ReadonlySet<string> = new Set([\n  \"42P06\",\n  \"42710\",\n  \"42701\",\n  \"42P07\",\n  \"23505\",\n  \"40001\",\n  \"40P01\",\n  \"55P03\",\n]);\n\nconst RETRYABLE_DRIVER_CODES: ReadonlySet<string> = new Set([\n  \"ECONNREFUSED\",\n  \"ECONNRESET\",\n  \"EPIPE\",\n  \"ETIMEDOUT\",\n  \"ENOTFOUND\",\n  \"EAI_AGAIN\",\n]);\n\nfunction matchesRetryableStates(error: unknown, states: ReadonlySet<string>): boolean {\n  return visitCauses(error, 6, (link) => {\n    const code = (link as { code?: unknown }).code;\n    if (typeof code !== \"string\") return false;\n    return states.has(code) || code.startsWith(\"08\") || RETRYABLE_DRIVER_CODES.has(code);\n  });\n}\n\n/**\n * Decide whether a failed migration-init statement (schema/journal creation)\n * is worth retrying. Covers the concurrent `CREATE SCHEMA IF NOT EXISTS`\n * race (unique violation on `pg_namespace`, duplicate-object errors),\n * serialization/deadlock errors, and transient connection failures.\n */\nexport function isRetryableMigrationError(error: unknown): boolean {\n  return matchesRetryableStates(error, RETRYABLE_SQLSTATES);\n}\n\nconst RETRYABLE_STATEMENT_SQLSTATES: ReadonlySet<string> = new Set([\n  \"40001\", // serialization_failure\n  \"40P01\", // deadlock_detected\n  \"55P03\", // lock_not_available\n]);\n\n/**\n * Decide whether a failed migration *statement* (inside its transaction) is\n * worth retrying. Deliberately narrower than `isRetryableMigrationError`:\n * duplicate-object classes are tolerated at the SAVEPOINT level, and a 23505\n * is either the concurrent-DDL catalog collision (also tolerated) or a\n * deterministic data-level violation (retrying is pointless) — so only\n * lock/serialization/transient-connection states justify re-running the\n * transaction.\n */\nexport function isRetryableMigrationExecutionError(error: unknown): boolean {\n  return matchesRetryableStates(error, RETRYABLE_STATEMENT_SQLSTATES);\n}\n\nconst PG_QUERY_QUEUE_DEPRECATION = \"client.query() when the client is already executing a query\";\n\nlet pgWarningFilterInstalled = false;\n\n/**\n * Silence pg's query-queue deprecation warning (fires once per process from\n * pg-pool's internal dispatch under concurrent boot load — node-postgres#3612,\n * #3617). Node's default warning handler prints even when user listeners are\n * attached, so it is removed first; every other warning is re-printed here.\n */\nexport function suppressPgQueryQueueDeprecation(): void {\n  if (pgWarningFilterInstalled) return;\n  if (typeof process === \"undefined\" || typeof process.on !== \"function\") return;\n  pgWarningFilterInstalled = true;\n  process.removeAllListeners(\"warning\");\n  process.on(\"warning\", (warning) => {\n    if (\n      warning.name === \"DeprecationWarning\" &&\n      warning.message.includes(PG_QUERY_QUEUE_DEPRECATION)\n    ) {\n      return;\n    }\n    console.error(warning.stack || `${warning.name}: ${warning.message}`);\n  });\n}\n\nexport function extractExpectedTables(migrations: { sql: string[] }[]): string[] {\n  const tables = new Set<string>();\n  const re = /CREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(?:\"([^\"]+)\"\\.)?\"([^\"]+)\"/gi;\n  for (const migration of migrations) {\n    for (const stmt of migration.sql) {\n      for (const match of stmt.matchAll(re)) {\n        const tableName = match[2];\n        if (tableName) {\n          tables.add(tableName);\n        }\n      }\n    }\n  }\n  return [...tables];\n}\n"],"mappings":";;;;AASA,MAAM,4BAA4B;CAChC,QAAQ;CACR,OAAO;AACT;AAEA,MAAM,uBAAuB;AAE7B,SAAgB,cAAc,MAAsB;CAElD,QADiB,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,KAC3B,CACZ,QAAQ,MAAM,EAAE,CAAC,CACjB,QAAQ,mBAAmB,GAAG,CAAC,CAC/B,QAAQ,aAAa,EAAE,CAAC,CACxB,QAAQ,MAAM,GAAG,CAAC,CAClB,YAAY;AACjB;AAEA,SAAgB,iBAAiB,KAAsB;CACrD,IAAI,CAAC,KAAK,OAAO,cAAc,QAAQ,IAAI,oBAAoB,SAAS;CACxE,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;EAC3B,MAAM,UAAU,KAAK,SAAS,cAAc;EAC5C,IAAI,WAAW,OAAO,GACpB,IAAI;GAEF,OAAO,cADK,KAAK,MAAM,aAAa,SAAS,OAAO,CAC7B,CAAC,CAAC,QAAQ,OAAO;EAC1C,QAAQ;GACN,OAAO,cAAc,OAAO;EAC9B;EAEF,MAAM,SAAS,QAAQ,OAAO;EAC9B,IAAI,WAAW,SAAS;EACxB,UAAU;CACZ;CACA,OAAO,cAAc,GAAG;AAC1B;AAEA,SAAgB,oBACd,MACA,SACkB;CAClB,MAAM,IAAI,cAAc,QAAQ,iBAAiB,CAAC;CAElD,IADiB,SAAS,YAAY,sBAEpC,OAAO;EACL,QAAQ,0BAA0B;EAClC,OAAO,wBAAwB;EAC/B,MAAM;CACR;CAEF,OAAO;EACL,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;EACjC,MAAM;CACR;AACF;;;;;;;;;;;;AAaA,SAAgB,WAAW,KAAuB;CAChD,IAAI,IAAI,WAAW,GAAG,OAAO;CAE7B,OAAO,KADS,IAAI,KAAK,MAAM,EAAE,QAAQ,OAAO,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAK,CACzD,CAAC,CAAC,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE;AACrD;AAEA,SAAgB,oBAAoB,KAAqB;CACvD,OAAO,cAAc,GAAG;AAC1B;AAEA,SAAgB,yBAAyB,MAAsB;CAC7D,OAAO,GAAG,KAAK,YAAY,CAAC,CAAC,QAAQ,MAAM,GAAG,EAAE;AAClD;AAEA,MAAa,6BAAgD;CAAC;CAAS;CAAS;AAAO;;;;;;AAOvF,SAAgB,YACd,OACA,OACA,OACS;CACT,IAAI,UAAmB;CACvB,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,SAAS,KAAK;EACzC,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,OAAO,GAAG,OAAO;EAC9E,UAAW,SAAiC;CAC9C;CACA,OAAO;AACT;;;;;;;;;;AAWA,MAAM,6CAAkD,IAAI,IAAI;CAC9D;CACA;CACA;AACF,CAAC;;;;;;;AAQD,SAAgB,+BAA+B,OAAyB;CACtE,OAAO,YAAY,OAAO,IAAI,SAAS;EACrC,MAAM,EAAE,MAAM,YAAY,YAAY;EAKtC,IAAI,SAAS,SAAS,OAAO;EAC7B,IAAI,OAAO,eAAe,YAAY,2BAA2B,IAAI,UAAU,GAAG,OAAO;EACzF,IAAI,OAAO,YAAY,UAAU,OAAO;EACxC,KAAK,MAAM,QAAQ,4BACjB,IAAI,QAAQ,SAAS,IAAI,GAAG,OAAO;EAErC,OAAO;CACT,CAAC;AACH;AAEA,MAAM,sCAA2C,IAAI,IAAI;CACvD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,yCAA8C,IAAI,IAAI;CAC1D;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,uBAAuB,OAAgB,QAAsC;CACpF,OAAO,YAAY,OAAO,IAAI,SAAS;EACrC,MAAM,OAAQ,KAA4B;EAC1C,IAAI,OAAO,SAAS,UAAU,OAAO;EACrC,OAAO,OAAO,IAAI,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,uBAAuB,IAAI,IAAI;CACrF,CAAC;AACH;;;;;;;AAQA,SAAgB,0BAA0B,OAAyB;CACjE,OAAO,uBAAuB,OAAO,mBAAmB;AAC1D;AAEA,MAAM,gDAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;;;;;;;;;;AAWD,SAAgB,mCAAmC,OAAyB;CAC1E,OAAO,uBAAuB,OAAO,6BAA6B;AACpE;AAEA,MAAM,6BAA6B;AAEnC,IAAI,2BAA2B;;;;;;;AAQ/B,SAAgB,kCAAwC;CACtD,IAAI,0BAA0B;CAC9B,IAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,OAAO,YAAY;CACxE,2BAA2B;CAC3B,QAAQ,mBAAmB,SAAS;CACpC,QAAQ,GAAG,YAAY,YAAY;EACjC,IACE,QAAQ,SAAS,wBACjB,QAAQ,QAAQ,SAAS,0BAA0B,GAEnD;EAEF,QAAQ,MAAM,QAAQ,SAAS,GAAG,QAAQ,KAAK,IAAI,QAAQ,SAAS;CACtE,CAAC;AACH;AAEA,SAAgB,sBAAsB,YAA2C;CAC/E,MAAM,yBAAS,IAAI,IAAY;CAC/B,MAAM,KAAK;CACX,KAAK,MAAM,aAAa,YACtB,KAAK,MAAM,QAAQ,UAAU,KAC3B,KAAK,MAAM,SAAS,KAAK,SAAS,EAAE,GAAG;EACrC,MAAM,YAAY,MAAM;EACxB,IAAI,WACF,OAAO,IAAI,SAAS;CAExB;CAGJ,OAAO,CAAC,GAAG,MAAM;AACnB"}

package/dist/db/driver.cjs

@@ -0,0 +1,167 @@
+const require_core = require('./core.cjs');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+
+//#region src/db/driver.ts
+/**
+* Resolve a plugin id to its data-schema name on a shared database.
+*
+* Schema names are unconditional `plugin_<slug>` for every workspace on the
+* shared API database. The `pluginId === "api" ? undefined` special case found
+* in older plugin copies is dead code (a plugin is never `api`); api's own
+* tables already live in `plugin_api`.
+*/
+function pluginSchemaName(pluginId) {
+	return `plugin_${require_core.pluginMigrationSlug(pluginId)}`;
+}
+/**
+* Connection-level guardrails. `ALTER DATABASE ... SET` only reaches sessions
+* opened after it runs — pooled connections that already exist never inherit
+* it, so any bound must ride on every connection's startup options. Defaults:
+* a lock wait fails after 10s (unbounded waits wedge the whole pool silently),
+* a session idle inside a transaction is reaped after 30s, and statement
+* timeout stays off unless DB_STATEMENT_TIMEOUT_MS is set (long migrations and
+* analytical queries must not break).
+*/
+/**
+* Parses a millisecond env value for a Postgres `-c` timeout setting.
+* A explicit `0` disables the timeout (Postgres semantics); garbage throws —
+* a typo must fail the boot loudly, never silently become the default.
+*/
+function timeoutMsEnv(name, fallbackMs) {
+	const raw = process.env[name];
+	if (raw === void 0 || raw.trim() === "") return fallbackMs;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed < 0) throw new Error(`[db] Invalid ${name}="${raw}" — must be a non-negative number of milliseconds (0 disables the timeout).`);
+	return parsed;
+}
+function connectionOptions(namespace) {
+	return [
+		...namespace ? [`-c search_path="${namespace}",public`] : [],
+		`-c lock_timeout=${timeoutMsEnv("DB_LOCK_TIMEOUT_MS", 1e4)}`,
+		`-c idle_in_transaction_session_timeout=${timeoutMsEnv("DB_IDLE_TX_TIMEOUT_MS", 3e4)}`,
+		...process.env.DB_STATEMENT_TIMEOUT_MS ? [`-c statement_timeout=${timeoutMsEnv("DB_STATEMENT_TIMEOUT_MS", 0)}`] : []
+	].join(" ");
+}
+const isLocalDbUrl = (url) => url.includes("localhost") || url.includes("127.0.0.1") || url.includes("host.docker.internal") || url.includes(".railway.internal");
+/**
+* TLS behavior for a non-local Postgres URL, following libpq `sslmode`
+* semantics from the connection string itself:
+*
+* - `disable`            → no TLS
+* - `prefer`/`allow`/`require` → TLS, but the server's certificate is NOT
+*   verified (libpq: `require` encrypts, it does not trust). Managed
+*   providers (Railway, Neon, Supabase poolers…) hand out `sslmode=require`
+*   URLs backed by certificates no client CA bundle can verify.
+* - `verify-ca`/`verify-full` → TLS + certificate verification.
+* - absent → verification ON (secure default for bare URLs).
+*
+* `DB_SSL_REJECT_UNAUTHORIZED` stays as an explicit operator override: it
+* wins over whatever the URL says (`"false"` disables verification, `"true"`
+* forces it).
+*/
+function resolvePoolSsl(url) {
+	if (isLocalDbUrl(url)) return false;
+	let mode = null;
+	try {
+		mode = new URL(url).searchParams.get("sslmode");
+	} catch {
+		mode = null;
+	}
+	if (process.env.DB_SSL_REJECT_UNAUTHORIZED === "false") return { rejectUnauthorized: false };
+	if (process.env.DB_SSL_REJECT_UNAUTHORIZED === "true") return { rejectUnauthorized: true };
+	switch (mode) {
+		case "disable": return false;
+		case "verify-ca":
+		case "verify-full": return { rejectUnauthorized: true };
+		case "prefer":
+		case "allow":
+		case "require": return { rejectUnauthorized: false };
+		default: return { rejectUnauthorized: true };
+	}
+}
+function buildPoolConfig(url, namespace) {
+	return {
+		connectionString: url,
+		ssl: resolvePoolSsl(url),
+		max: Number(process.env.DB_POOL_MAX) || 10,
+		connectionTimeoutMillis: Number(process.env.DB_CONNECTION_TIMEOUT_MS) || 3e4,
+		idleTimeoutMillis: Number(process.env.DB_IDLE_TIMEOUT_MS) || 3e4,
+		options: connectionOptions(namespace)
+	};
+}
+async function ensureNamespaceExists(pool, namespace) {
+	const client = await pool.connect();
+	try {
+		await client.query("BEGIN");
+		try {
+			await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", ["drizzle.__drizzle_migrations"]);
+			await client.query(`CREATE SCHEMA IF NOT EXISTS "${namespace}"`);
+			await client.query("COMMIT");
+		} catch (error) {
+			await client.query("ROLLBACK");
+			throw error;
+		}
+	} finally {
+		client.release();
+	}
+}
+function createCloseHandler(pool) {
+	let closed = false;
+	return async () => {
+		if (closed) return;
+		closed = true;
+		pool.removeAllListeners("error");
+		pool.removeAllListeners("connect");
+		await pool.end();
+	};
+}
+/**
+* Create a drizzle database driver for a plugin, choosing the engine by URL
+* scheme: `pglite:` / `:memory:` → embedded PGlite, anything else → postgres
+* (`pg.Pool`).
+*
+* Drivers stay externalized (never statically imported, never in the Module
+* Federation singleton share set) — they are loaded here via dynamic `import()`
+* only, and `drizzle-orm` appears as a runtime import for the `drizzle` entry
+* points. The `namespace` option expresses every topology the platform needs:
+* `plugin_<slug>` on a shared database, undefined for public-schema (api) or
+* dedicated-database (auth) workloads.
+*/
+async function createDatabaseDriver(url, schema, namespace) {
+	if (url.startsWith("pglite:") || url === ":memory:") {
+		const { drizzle } = await import("drizzle-orm/pglite");
+		const { PGlite } = await import("@electric-sql/pglite");
+		const rawDir = url === ":memory:" ? ":memory:" : url.replace("pglite:", "");
+		const dataDir = rawDir.endsWith("/:memory:") || rawDir === ":memory:" ? "memory://" : rawDir;
+		if (dataDir !== "memory://") (0, node_fs.mkdirSync)((0, node_path.dirname)(dataDir), { recursive: true });
+		const pglite = new PGlite(dataDir);
+		if (namespace) {
+			await pglite.exec(`CREATE SCHEMA IF NOT EXISTS "${namespace}"`);
+			await pglite.exec(`SET search_path TO "${namespace}", public`);
+		}
+		return {
+			db: drizzle(pglite, { schema }),
+			close: async () => {
+				await pglite.close();
+			}
+		};
+	}
+	const { Pool } = await import("pg");
+	const { drizzle } = await import("drizzle-orm/node-postgres");
+	const pool = new Pool(buildPoolConfig(url, namespace));
+	pool.on("error", (err) => {
+		console.error("[Database] Unexpected pool error:", err.message);
+	});
+	if (namespace) await ensureNamespaceExists(pool, namespace);
+	return {
+		db: drizzle(pool, { schema }),
+		close: createCloseHandler(pool)
+	};
+}
+
+//#endregion
+exports.createDatabaseDriver = createDatabaseDriver;
+exports.pluginSchemaName = pluginSchemaName;
+exports.resolvePoolSsl = resolvePoolSsl;
+//# sourceMappingURL=driver.cjs.map

package/dist/db/driver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.cjs","names":["pluginMigrationSlug","dirname"],"sources":["../../src/db/driver.ts"],"sourcesContent":["import { mkdirSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport type { PgDatabase, PgQueryResultHKT } from \"drizzle-orm/pg-core\";\nimport { pluginMigrationSlug } from \"./core\";\n\nexport interface DatabaseDriver<TSchema extends Record<string, unknown>> {\n  readonly db: PgDatabase<PgQueryResultHKT, TSchema>;\n  close(): Promise<void>;\n}\n\n/**\n * Resolve a plugin id to its data-schema name on a shared database.\n *\n * Schema names are unconditional `plugin_<slug>` for every workspace on the\n * shared API database. The `pluginId === \"api\" ? undefined` special case found\n * in older plugin copies is dead code (a plugin is never `api`); api's own\n * tables already live in `plugin_api`.\n */\nexport function pluginSchemaName(pluginId: string): string {\n  return `plugin_${pluginMigrationSlug(pluginId)}`;\n}\n\ninterface PoolLike {\n  on(event: \"error\", listener: (err: Error) => void): unknown;\n  connect(): Promise<{\n    query: (sql: string, params?: unknown[]) => Promise<unknown>;\n    release: () => void;\n  }>;\n  removeAllListeners(event?: string | symbol): unknown;\n  end(): Promise<void>;\n}\n\n/**\n * Connection-level guardrails. `ALTER DATABASE ... SET` only reaches sessions\n * opened after it runs — pooled connections that already exist never inherit\n * it, so any bound must ride on every connection's startup options. Defaults:\n * a lock wait fails after 10s (unbounded waits wedge the whole pool silently),\n * a session idle inside a transaction is reaped after 30s, and statement\n * timeout stays off unless DB_STATEMENT_TIMEOUT_MS is set (long migrations and\n * analytical queries must not break).\n */\n/**\n * Parses a millisecond env value for a Postgres `-c` timeout setting.\n * A explicit `0` disables the timeout (Postgres semantics); garbage throws —\n * a typo must fail the boot loudly, never silently become the default.\n */\nfunction timeoutMsEnv(name: string, fallbackMs: number): number {\n  const raw = process.env[name];\n  if (raw === undefined || raw.trim() === \"\") return fallbackMs;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed < 0) {\n    throw new Error(\n      `[db] Invalid ${name}=\"${raw}\" — must be a non-negative number of milliseconds (0 disables the timeout).`,\n    );\n  }\n  return parsed;\n}\n\nfunction connectionOptions(namespace: string | undefined): string {\n  const settings = [\n    ...(namespace ? [`-c search_path=\"${namespace}\",public`] : []),\n    `-c lock_timeout=${timeoutMsEnv(\"DB_LOCK_TIMEOUT_MS\", 10_000)}`,\n    `-c idle_in_transaction_session_timeout=${timeoutMsEnv(\"DB_IDLE_TX_TIMEOUT_MS\", 30_000)}`,\n    ...(process.env.DB_STATEMENT_TIMEOUT_MS\n      ? [`-c statement_timeout=${timeoutMsEnv(\"DB_STATEMENT_TIMEOUT_MS\", 0)}`]\n      : []),\n  ];\n  return settings.join(\" \");\n}\n\n// host.docker.internal is docker-local development networking — the test\n// databases a container reaches through the host gateway, which do not\n// terminate TLS. `*.railway.internal` is Railway private-network traffic\n// (VPC-scoped, no public egress) whose Postgres presents a self-signed\n// certificate chain no client CA bundle can verify.\nconst isLocalDbUrl = (url: string): boolean =>\n  url.includes(\"localhost\") ||\n  url.includes(\"127.0.0.1\") ||\n  url.includes(\"host.docker.internal\") ||\n  url.includes(\".railway.internal\");\n\n/**\n * TLS behavior for a non-local Postgres URL, following libpq `sslmode`\n * semantics from the connection string itself:\n *\n * - `disable`            → no TLS\n * - `prefer`/`allow`/`require` → TLS, but the server's certificate is NOT\n *   verified (libpq: `require` encrypts, it does not trust). Managed\n *   providers (Railway, Neon, Supabase poolers…) hand out `sslmode=require`\n *   URLs backed by certificates no client CA bundle can verify.\n * - `verify-ca`/`verify-full` → TLS + certificate verification.\n * - absent → verification ON (secure default for bare URLs).\n *\n * `DB_SSL_REJECT_UNAUTHORIZED` stays as an explicit operator override: it\n * wins over whatever the URL says (`\"false\"` disables verification, `\"true\"`\n * forces it).\n */\nexport function resolvePoolSsl(url: string): false | { rejectUnauthorized: boolean } {\n  if (isLocalDbUrl(url)) return false;\n\n  let mode: string | null = null;\n  try {\n    mode = new URL(url).searchParams.get(\"sslmode\");\n  } catch {\n    mode = null;\n  }\n\n  if (process.env.DB_SSL_REJECT_UNAUTHORIZED === \"false\") return { rejectUnauthorized: false };\n  if (process.env.DB_SSL_REJECT_UNAUTHORIZED === \"true\") return { rejectUnauthorized: true };\n\n  switch (mode) {\n    case \"disable\":\n      return false;\n    case \"verify-ca\":\n    case \"verify-full\":\n      return { rejectUnauthorized: true };\n    case \"prefer\":\n    case \"allow\":\n    case \"require\":\n      return { rejectUnauthorized: false };\n    default:\n      return { rejectUnauthorized: true };\n  }\n}\n\nfunction buildPoolConfig(url: string, namespace: string | undefined) {\n  return {\n    connectionString: url,\n    ssl: resolvePoolSsl(url),\n    max: Number(process.env.DB_POOL_MAX) || 10,\n    connectionTimeoutMillis: Number(process.env.DB_CONNECTION_TIMEOUT_MS) || 30_000,\n    idleTimeoutMillis: Number(process.env.DB_IDLE_TIMEOUT_MS) || 30_000,\n    options: connectionOptions(namespace),\n  };\n}\n\nasync function ensureNamespaceExists(pool: PoolLike, namespace: string): Promise<void> {\n  const client = await pool.connect();\n  try {\n    await client.query(\"BEGIN\");\n    try {\n      // Same journal-scoped advisory lock the migration runner holds, so this\n      // CREATE SCHEMA cannot race a concurrent migration run (the runner also\n      // creates the schema inside its locked transaction). Xact-scoped: the\n      // lock releases at COMMIT/ROLLBACK or on connection death.\n      await client.query(\"SELECT pg_advisory_xact_lock(hashtextextended($1, 0))\", [\n        \"drizzle.__drizzle_migrations\",\n      ]);\n      await client.query(`CREATE SCHEMA IF NOT EXISTS \"${namespace}\"`);\n      await client.query(\"COMMIT\");\n    } catch (error) {\n      await client.query(\"ROLLBACK\");\n      throw error;\n    }\n  } finally {\n    client.release();\n  }\n}\n\nfunction createCloseHandler(pool: PoolLike): () => Promise<void> {\n  let closed = false;\n  return async () => {\n    if (closed) return;\n    closed = true;\n    pool.removeAllListeners(\"error\");\n    pool.removeAllListeners(\"connect\");\n    await pool.end();\n  };\n}\n\n/**\n * Create a drizzle database driver for a plugin, choosing the engine by URL\n * scheme: `pglite:` / `:memory:` → embedded PGlite, anything else → postgres\n * (`pg.Pool`).\n *\n * Drivers stay externalized (never statically imported, never in the Module\n * Federation singleton share set) — they are loaded here via dynamic `import()`\n * only, and `drizzle-orm` appears as a runtime import for the `drizzle` entry\n * points. The `namespace` option expresses every topology the platform needs:\n * `plugin_<slug>` on a shared database, undefined for public-schema (api) or\n * dedicated-database (auth) workloads.\n */\nexport async function createDatabaseDriver<TSchema extends Record<string, unknown>>(\n  url: string,\n  schema: TSchema,\n  namespace?: string,\n): Promise<DatabaseDriver<TSchema>> {\n  if (url.startsWith(\"pglite:\") || url === \":memory:\") {\n    const { drizzle } = await import(\"drizzle-orm/pglite\");\n    const { PGlite } = await import(\"@electric-sql/pglite\");\n    const rawDir = url === \":memory:\" ? \":memory:\" : url.replace(\"pglite:\", \"\");\n    const dataDir = rawDir.endsWith(\"/:memory:\") || rawDir === \":memory:\" ? \"memory://\" : rawDir;\n    if (dataDir !== \"memory://\") {\n      mkdirSync(dirname(dataDir), { recursive: true });\n    }\n    const pglite = new PGlite(dataDir);\n    if (namespace) {\n      await pglite.exec(`CREATE SCHEMA IF NOT EXISTS \"${namespace}\"`);\n      await pglite.exec(`SET search_path TO \"${namespace}\", public`);\n    }\n    const db = drizzle(pglite, { schema: schema as never }) as unknown as PgDatabase<\n      PgQueryResultHKT,\n      TSchema\n    >;\n    return {\n      db,\n      close: async () => {\n        await pglite.close();\n      },\n    };\n  }\n\n  const { Pool } = await import(\"pg\");\n  const { drizzle } = await import(\"drizzle-orm/node-postgres\");\n  const pool = new Pool(buildPoolConfig(url, namespace) as never) as unknown as PoolLike;\n  pool.on(\"error\", (err: Error) => {\n    console.error(\"[Database] Unexpected pool error:\", err.message);\n  });\n\n  if (namespace) {\n    await ensureNamespaceExists(pool, namespace);\n  }\n\n  const db = drizzle(pool as never, { schema: schema as never }) as unknown as PgDatabase<\n    PgQueryResultHKT,\n    TSchema\n  >;\n\n  return {\n    db,\n    close: createCloseHandler(pool),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,SAAgB,iBAAiB,UAA0B;CACzD,OAAO,UAAUA,iCAAoB,QAAQ;AAC/C;;;;;;;;;;;;;;;AA0BA,SAAS,aAAa,MAAc,YAA4B;CAC9D,MAAM,MAAM,QAAQ,IAAI;CACxB,IAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,IAAI,OAAO;CACnD,MAAM,SAAS,OAAO,GAAG;CACzB,IAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,GACvC,MAAM,IAAI,MACR,gBAAgB,KAAK,IAAI,IAAI,4EAC/B;CAEF,OAAO;AACT;AAEA,SAAS,kBAAkB,WAAuC;CAShE,OAAO;EAPL,GAAI,YAAY,CAAC,mBAAmB,UAAU,SAAS,IAAI,CAAC;EAC5D,mBAAmB,aAAa,sBAAsB,GAAM;EAC5D,0CAA0C,aAAa,yBAAyB,GAAM;EACtF,GAAI,QAAQ,IAAI,0BACZ,CAAC,wBAAwB,aAAa,2BAA2B,CAAC,GAAG,IACrE,CAAC;CAEO,CAAC,CAAC,KAAK,GAAG;AAC1B;AAOA,MAAM,gBAAgB,QACpB,IAAI,SAAS,WAAW,KACxB,IAAI,SAAS,WAAW,KACxB,IAAI,SAAS,sBAAsB,KACnC,IAAI,SAAS,mBAAmB;;;;;;;;;;;;;;;;;AAkBlC,SAAgB,eAAe,KAAsD;CACnF,IAAI,aAAa,GAAG,GAAG,OAAO;CAE9B,IAAI,OAAsB;CAC1B,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,aAAa,IAAI,SAAS;CAChD,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,QAAQ,IAAI,+BAA+B,SAAS,OAAO,EAAE,oBAAoB,MAAM;CAC3F,IAAI,QAAQ,IAAI,+BAA+B,QAAQ,OAAO,EAAE,oBAAoB,KAAK;CAEzF,QAAQ,MAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK;EACL,KAAK,eACH,OAAO,EAAE,oBAAoB,KAAK;EACpC,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO,EAAE,oBAAoB,MAAM;EACrC,SACE,OAAO,EAAE,oBAAoB,KAAK;CACtC;AACF;AAEA,SAAS,gBAAgB,KAAa,WAA+B;CACnE,OAAO;EACL,kBAAkB;EAClB,KAAK,eAAe,GAAG;EACvB,KAAK,OAAO,QAAQ,IAAI,WAAW,KAAK;EACxC,yBAAyB,OAAO,QAAQ,IAAI,wBAAwB,KAAK;EACzE,mBAAmB,OAAO,QAAQ,IAAI,kBAAkB,KAAK;EAC7D,SAAS,kBAAkB,SAAS;CACtC;AACF;AAEA,eAAe,sBAAsB,MAAgB,WAAkC;CACrF,MAAM,SAAS,MAAM,KAAK,QAAQ;CAClC,IAAI;EACF,MAAM,OAAO,MAAM,OAAO;EAC1B,IAAI;GAKF,MAAM,OAAO,MAAM,yDAAyD,CAC1E,8BACF,CAAC;GACD,MAAM,OAAO,MAAM,gCAAgC,UAAU,EAAE;GAC/D,MAAM,OAAO,MAAM,QAAQ;EAC7B,SAAS,OAAO;GACd,MAAM,OAAO,MAAM,UAAU;GAC7B,MAAM;EACR;CACF,UAAU;EACR,OAAO,QAAQ;CACjB;AACF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,IAAI,SAAS;CACb,OAAO,YAAY;EACjB,IAAI,QAAQ;EACZ,SAAS;EACT,KAAK,mBAAmB,OAAO;EAC/B,KAAK,mBAAmB,SAAS;EACjC,MAAM,KAAK,IAAI;CACjB;AACF;;;;;;;;;;;;;AAcA,eAAsB,qBACpB,KACA,QACA,WACkC;CAClC,IAAI,IAAI,WAAW,SAAS,KAAK,QAAQ,YAAY;EACnD,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,QAAQ,aAAa,aAAa,IAAI,QAAQ,WAAW,EAAE;EAC1E,MAAM,UAAU,OAAO,SAAS,WAAW,KAAK,WAAW,aAAa,cAAc;EACtF,IAAI,YAAY,aACd,2BAAUC,mBAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;EAEjD,MAAM,SAAS,IAAI,OAAO,OAAO;EACjC,IAAI,WAAW;GACb,MAAM,OAAO,KAAK,gCAAgC,UAAU,EAAE;GAC9D,MAAM,OAAO,KAAK,uBAAuB,UAAU,UAAU;EAC/D;EAKA,OAAO;GACL,IALS,QAAQ,QAAQ,EAAU,OAAgB,CAKlD;GACD,OAAO,YAAY;IACjB,MAAM,OAAO,MAAM;GACrB;EACF;CACF;CAEA,MAAM,EAAE,SAAS,MAAM,OAAO;CAC9B,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,MAAM,OAAO,IAAI,KAAK,gBAAgB,KAAK,SAAS,CAAU;CAC9D,KAAK,GAAG,UAAU,QAAe;EAC/B,QAAQ,MAAM,qCAAqC,IAAI,OAAO;CAChE,CAAC;CAED,IAAI,WACF,MAAM,sBAAsB,MAAM,SAAS;CAQ7C,OAAO;EACL,IANS,QAAQ,MAAe,EAAU,OAAgB,CAMzD;EACD,OAAO,mBAAmB,IAAI;CAChC;AACF"}

package/dist/db/driver.d.cts

@@ -0,0 +1,50 @@
+import { PgDatabase, PgQueryResultHKT } from "drizzle-orm/pg-core";
+//#region src/db/driver.d.ts
+interface DatabaseDriver<TSchema extends Record<string, unknown>> {
+  readonly db: PgDatabase<PgQueryResultHKT, TSchema>;
+  close(): Promise<void>;
+}
+/**
+ * Resolve a plugin id to its data-schema name on a shared database.
+ *
+ * Schema names are unconditional `plugin_<slug>` for every workspace on the
+ * shared API database. The `pluginId === "api" ? undefined` special case found
+ * in older plugin copies is dead code (a plugin is never `api`); api's own
+ * tables already live in `plugin_api`.
+ */
+declare function pluginSchemaName(pluginId: string): string;
+/**
+ * TLS behavior for a non-local Postgres URL, following libpq `sslmode`
+ * semantics from the connection string itself:
+ *
+ * - `disable`            → no TLS
+ * - `prefer`/`allow`/`require` → TLS, but the server's certificate is NOT
+ *   verified (libpq: `require` encrypts, it does not trust). Managed
+ *   providers (Railway, Neon, Supabase poolers…) hand out `sslmode=require`
+ *   URLs backed by certificates no client CA bundle can verify.
+ * - `verify-ca`/`verify-full` → TLS + certificate verification.
+ * - absent → verification ON (secure default for bare URLs).
+ *
+ * `DB_SSL_REJECT_UNAUTHORIZED` stays as an explicit operator override: it
+ * wins over whatever the URL says (`"false"` disables verification, `"true"`
+ * forces it).
+ */
+declare function resolvePoolSsl(url: string): false | {
+  rejectUnauthorized: boolean;
+};
+/**
+ * Create a drizzle database driver for a plugin, choosing the engine by URL
+ * scheme: `pglite:` / `:memory:` → embedded PGlite, anything else → postgres
+ * (`pg.Pool`).
+ *
+ * Drivers stay externalized (never statically imported, never in the Module
+ * Federation singleton share set) — they are loaded here via dynamic `import()`
+ * only, and `drizzle-orm` appears as a runtime import for the `drizzle` entry
+ * points. The `namespace` option expresses every topology the platform needs:
+ * `plugin_<slug>` on a shared database, undefined for public-schema (api) or
+ * dedicated-database (auth) workloads.
+ */
+declare function createDatabaseDriver<TSchema extends Record<string, unknown>>(url: string, schema: TSchema, namespace?: string): Promise<DatabaseDriver<TSchema>>;
+//#endregion
+export { DatabaseDriver, createDatabaseDriver, pluginSchemaName, resolvePoolSsl };
+//# sourceMappingURL=driver.d.cts.map

package/dist/db/driver.d.mts

@@ -0,0 +1,50 @@
+import { PgDatabase, PgQueryResultHKT } from "drizzle-orm/pg-core";
+//#region src/db/driver.d.ts
+interface DatabaseDriver<TSchema extends Record<string, unknown>> {
+  readonly db: PgDatabase<PgQueryResultHKT, TSchema>;
+  close(): Promise<void>;
+}
+/**
+ * Resolve a plugin id to its data-schema name on a shared database.
+ *
+ * Schema names are unconditional `plugin_<slug>` for every workspace on the
+ * shared API database. The `pluginId === "api" ? undefined` special case found
+ * in older plugin copies is dead code (a plugin is never `api`); api's own
+ * tables already live in `plugin_api`.
+ */
+declare function pluginSchemaName(pluginId: string): string;
+/**
+ * TLS behavior for a non-local Postgres URL, following libpq `sslmode`
+ * semantics from the connection string itself:
+ *
+ * - `disable`            → no TLS
+ * - `prefer`/`allow`/`require` → TLS, but the server's certificate is NOT
+ *   verified (libpq: `require` encrypts, it does not trust). Managed
+ *   providers (Railway, Neon, Supabase poolers…) hand out `sslmode=require`
+ *   URLs backed by certificates no client CA bundle can verify.
+ * - `verify-ca`/`verify-full` → TLS + certificate verification.
+ * - absent → verification ON (secure default for bare URLs).
+ *
+ * `DB_SSL_REJECT_UNAUTHORIZED` stays as an explicit operator override: it
+ * wins over whatever the URL says (`"false"` disables verification, `"true"`
+ * forces it).
+ */
+declare function resolvePoolSsl(url: string): false | {
+  rejectUnauthorized: boolean;
+};
+/**
+ * Create a drizzle database driver for a plugin, choosing the engine by URL
+ * scheme: `pglite:` / `:memory:` → embedded PGlite, anything else → postgres
+ * (`pg.Pool`).
+ *
+ * Drivers stay externalized (never statically imported, never in the Module
+ * Federation singleton share set) — they are loaded here via dynamic `import()`
+ * only, and `drizzle-orm` appears as a runtime import for the `drizzle` entry
+ * points. The `namespace` option expresses every topology the platform needs:
+ * `plugin_<slug>` on a shared database, undefined for public-schema (api) or
+ * dedicated-database (auth) workloads.
+ */
+declare function createDatabaseDriver<TSchema extends Record<string, unknown>>(url: string, schema: TSchema, namespace?: string): Promise<DatabaseDriver<TSchema>>;
+//#endregion
+export { DatabaseDriver, createDatabaseDriver, pluginSchemaName, resolvePoolSsl };
+//# sourceMappingURL=driver.d.mts.map