feat: postgres hooks

package/db-tool/database.sh

@@ -942,15 +942,21 @@ subcommand_hydrate() {
   done
 
   if [ ! "${HYDRATE_NO_HOOK+x}" ]; then
-    log info "hectic secrets hook"
+    log info "hectic bundle hook"
     # shellcheck disable=SC2059
     printf "${BBLACK}"
-    sh "${LOCAL_DIR}/lib/hook/postgres-secrets.sh" "$PGURL" "$ENVIRONMENT"
+    dotenv_content=""
+    if [ -n "${HECTIC_DOTENV_FILE:-}" ] && [ -r "$HECTIC_DOTENV_FILE" ]; then
+      dotenv_content="$(cat "$HECTIC_DOTENV_FILE")"
+    elif [ -n "${ENVIRONMENT:-}" ] && [ -r "${LOCAL_DIR}/.env.${ENVIRONMENT}" ]; then
+      dotenv_content="$(cat "${LOCAL_DIR}/.env.${ENVIRONMENT}")"
+    fi
+    apply_hectic_bundle "$PGURL" "$dotenv_content"
 
     # shellcheck disable=SC2059
     printf "${NC}"
   else
-    log info "skipping hectic secrets hook"
+    log info "skipping hectic bundle hook"
   fi
 
   local mock_arg=""

package/db-tool/default.nix

@@ -1,4 +1,4 @@
-{ dash, hectic, postgresql_17, neovim, openssh, coreutils, gawk, lib, runCommand }:
+{ dash, hectic, postgresql_17, neovim, openssh, coreutils, gawk, lib, runCommand, self }:
 let
   shell = "${dash}/bin/dash";
 
@@ -9,6 +9,23 @@ let
     cp ${hecticInheritanceSqlPath} "$out/share/hectic/hectic-inheritance.sql"
   '';
 
+  # Materialize the templated version SQL into the Nix store as a real file
+  # so it can be passed by path to psql -f (alongside the static siblings).
+  hecticVersionSqlFile = pkgs-writeText "hectic-version.sql" self.lib.hectic.version.sql;
+  pkgs-writeText = name: text: runCommand name { inherit text; passAsFile = [ "text" ]; } ''
+    cp "$textPath" "$out"
+  '';
+
+  hecticEnv = ''
+    HECTIC_VERSION_SQL=${hecticVersionSqlFile}
+    HECTIC_SECRET_SQL=${self.lib.hectic.secret.path}
+    HECTIC_MIGRATION_SQL=${self.lib.hectic.migration.path}
+    HECTIC_INHERITANCE_SQL=${self.lib.hectic.inheritance.path}
+    export HECTIC_VERSION_SQL HECTIC_SECRET_SQL HECTIC_MIGRATION_SQL HECTIC_INHERITANCE_SQL
+  '';
+
+  applyBundle = builtins.readFile self.lib.hectic.applyBundleScript;
+
   mkDatabase =
     { postgresql ? postgresql_17 }:
     hectic.writeShellApplication {
@@ -17,7 +34,6 @@ let
         "errexit"
         "nounset"
       ];
-      # SC2209: false positive — PAGER_OR_CAT=cat stores the string "cat" intentionally
       excludeShellChecks = [ "SC2209" ];
       name = "database";
       runtimeInputs = [ hectic.migrator hectic.parse-uri postgresql neovim openssh coreutils gawk ];
@@ -27,6 +43,8 @@ let
         ${builtins.readFile hectic.helpers.posix-shell.change_namespace}
         ${builtins.readFile hectic.helpers.posix-shell.quote}
         ${builtins.readFile hectic.helpers.posix-shell.pager_or_cat}
+        ${hecticEnv}
+        ${applyBundle}
         ${builtins.readFile ./database.sh}
       '';
 
@@ -44,11 +62,7 @@ let
       name = "postgres-init";
       runtimeInputs = [ postgresql coreutils ];
 
-      text = ''
-        HECTIC_INHERITANCE_SQL_DEFAULT="${hecticInheritance}/share/hectic/hectic-inheritance.sql"
-        export HECTIC_INHERITANCE_SQL_DEFAULT
-        ${builtins.readFile ./postgres-init.sh}
-      '';
+      text = builtins.readFile ./postgres-init.sh;
 
       meta = {
         description = "Initialize local PostgreSQL instance";

package/db-tool/postgres-init.sh

@@ -48,16 +48,6 @@ postgres_init_main() {
   fi
   psql -h "$sockdir" -p "$PG_PORT" -d "$db" -v ON_ERROR_STOP=1 -c 'select 1;' || return 1
 
-  if [ "${PG_HECTIC_INHERITANCE:-1}" = "1" ]; then
-    sql_file="${HECTIC_INHERITANCE_SQL:-${HECTIC_INHERITANCE_SQL_DEFAULT:-}}"
-    if [ -z "$sql_file" ]; then
-      printf '%s\n' 'postgres-init: PG_HECTIC_INHERITANCE=1 but no SQL file resolved (set HECTIC_INHERITANCE_SQL)' >&2
-      return 3
-    fi
-    [ -r "$sql_file" ] || { printf '%s\n' "postgres-init: hectic-inheritance SQL not readable: $sql_file" >&2; return 1; }
-    psql -h "$sockdir" -p "$PG_PORT" -U "$user" -d "$db" -v ON_ERROR_STOP=1 -f "$sql_file" || return 1
-  fi
-
   export POSTGRESQL_HOST="$sockdir" POSTGRESQL_PORT="$PG_PORT" POSTGRESQL_USER="$user" POSTGRESQL_DATABASE="$db"
   _pg_url="postgresql://${POSTGRESQL_USER}@/${POSTGRESQL_DATABASE}?host=${POSTGRESQL_HOST}&port=${POSTGRESQL_PORT}"
   case $PG_URL_VAR in ''|*[!ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]* ) printf '%s\n' 'postgres-init: invalid PG_URL_VAR' >&2; return 1 ;; esac