feat: db-tool: +secrets load

lib/default.nix

@@ -103,7 +103,7 @@ in {
 
   # Consolidated SQL bundles for the `hectic` schema. Single source of truth
   # for everything that creates objects in the `hectic` namespace, used by
-  # migrator (init-time) and db-tool (postgres-init + hydrate). Consumers apply
+  # migrator (init-time), db-dev/database hydrate, and db-ops secrets loading. Consumers apply
   # the full bundle via lib/hook/apply-hectic-bundle.sh.
   #
   # The whole hectic system shares one `versionString`; `hectic-version.sql`

lib/hook/apply-hectic-bundle.sh

@@ -10,8 +10,8 @@
 # Usage:
 #   apply_hectic_bundle <PGURL> [<DOTENV_CONTENT>]
 #
-# If DOTENV_CONTENT is non-empty, it is loaded into hectic.secret via
-# hectic.load_secrets_from_env() after the bundle is applied.
+# If DOTENV_CONTENT is non-empty, it is base64-encoded and then loaded into
+# hectic.secret via hectic.load_secrets_from_env() after the bundle is applied.
 # SQL file paths are substituted by Nix evaluation time.
 
 apply_hectic_bundle() {
@@ -41,11 +41,9 @@ apply_hectic_bundle() {
   done
 
   if [ -n "$env_content" ]; then
-    # Dollar-quote with $ps_env$ tag to preserve all content verbatim.
+    env_content_b64="$(printf '%s' "$env_content" | base64 | tr -d '\n')" || return 1
     psql "$pgurl" -v ON_ERROR_STOP=1 <<SQL || return 1
-SELECT hectic.load_secrets_from_env(\$ps_env\$
-$env_content
-\$ps_env\$);
+SELECT hectic.load_secrets_from_env(convert_from(decode('$env_content_b64', 'base64'), 'UTF8'));
 SQL
   fi
 

lib/hook/sql/README.md

@@ -4,8 +4,8 @@ Single source of truth for every object created in the `hectic` PostgreSQL
 schema. Consumed by:
 
 - `package/migrator` — applies the bundle on `migrator init` (mandatory).
-- `package/db-tool` — applies the bundle in `database hydrate` (default; opt
-  out with `--no-hook`).
+- `package/db-tool` — applies the bundle in `db-dev` / `database hydrate`
+  (default; opt out with `--no-hook`) and in `db-ops secrets load`.
 - External consumers (e.g. `proxydoe`) — invoke `psql -f` directly against the
   paths exposed via `self.lib.hectic.*.path`.
 
@@ -60,7 +60,7 @@ verbatim source files in the store.
 
 `lib/hook/apply-hectic-bundle.sh` is a dash-compatible helper template.
 `self.lib.hectic.applyBundleScript` is the generated shell source with concrete
-SQL paths embedded at Nix evaluation time. `migrator` and `db-tool` splice that
+SQL paths embedded at Nix evaluation time. `migrator`, `db-dev`, and `db-ops` splice that
 shell source directly into their generated scripts. Public entry point:
 
 ```sh
@@ -87,8 +87,9 @@ External consumers that do not want to source the helper can still invoke
 4. Add a matching placeholder/replacement in `lib.hectic.applyBundleScript` and
    update `lib/hook/apply-hectic-bundle.sh` to apply the file.
 5. Bump `HECTIC_VERSION` if the new content changes existing semantics.
-6. Update tests in `test/package/migrator/test/postgresql/init-hectic-bundle/`
-   and `test/package/db-tool/test/postgresql/hydrate-hook/`.
+6. Update tests in `test/package/migrator/test/postgresql/init-hectic-bundle/`,
+   `test/package/db-tool/test/postgresql/hydrate-hook/`, and any `db-ops`
+   bundle-loading coverage.
 
 ## Versioning