# @leumas/db

Leumas database runtime — libSQL/SQLite client + Drizzle instance + migrations + seed + the generic universal-CRUD repository (ownership + history).


The Leumas **database runtime** — the one place that opens the DB and runs CRUD.

- **libSQL/SQLite client + Drizzle instance** (`src/client.js`), typed by [`@leumas/schemas`](../schemas).
- **Migrations** (`src/migrate.js`) + `drizzle.config.js` — generate SQL with drizzle-kit, apply with the libSQL migrator.
- **Seed** (`src/seed.js`) — roles, permissions, role→permission grants, and an admin user.
- **Repository** (`src/repository.js`) — the DB-agnostic universal CRUD (create/read/update/delete/filter/search/clone + `record_history`), harvested from leumas-api's Mongo-locked UniversalCrud.
- **Ownership** (`src/ownership.js`) — `isOwner`/`canRead`/`canWrite`/`canClone` guards.

```js
import { getDb, createRepository, runMigrations, seed } from '@leumas/db';
await runMigrations();          // apply ./drizzle SQL
await seed();                   // roles + admin
const repo = createRepository();
const post = await repo.create('posts', { authorId, text: 'hi' }, { actor: authorId });
```

## Local & scale

Default: `file:./data/leumas.db` (embedded, zero-config). Scale with **no app change**:

| Goal | Env |
|---|---|
| Turso / libSQL server | `LEUMAS_DB_URL=libsql://…` + `LEUMAS_DB_AUTH_TOKEN=…` |
| Encryption at rest | `LEUMAS_DB_KEY=…` |
| Seed admin | `SEED_ADMIN_EMAIL`, `SEED_ADMIN_PASSWORD` |

## Scripts

```bash
pnpm --filter @leumas/db db:generate   # emit ./drizzle SQL from @leumas/schemas
pnpm --filter @leumas/db db:migrate    # apply migrations
pnpm --filter @leumas/db db:seed       # seed roles + admin
```

Dynamic, app-defined collections (schema-less) are served by the connector in
`shared/engines/middleware` against the **same** libSQL file — see that package.


---
Source: shared/packages/db/README.md
Canonical: https://docs.leumas.tech/p/packages/db