chore(drizzle): alias _query to query and enforce via lint

Prep for drizzle v1, which renames the RQB namespace from `query` to
`_query`. Adds a runtime alias so both names work, rewrites every
`.query` drizzle receiver to `._query`, and enforces the new name with
an oxlint rule plus a type-aware CI check.

- New `@kilocode/drizzle-shims` package patches PgDatabase and
  BaseSQLiteDatabase prototypes with a `_query` getter; transaction
  subclasses (`tx._query`) are covered automatically.
- Side-effect imports added at every `drizzle(...)` construction site
  (packages/db client plus 12 DO service files).
- `oxlint-plugin-drizzle.js` gains `prefer-underscore-query` (autofix,
  name-gated: db / ctx.db / this.db / tx / trx).
- `scripts/drizzle-query-rename.ts` is a ts-morph codemod/verifier that
  walks every workspace tsconfig plus dev/ and scripts/ orphans and
  checks the drizzle `query` property by declaration location. Exposed
  as `pnpm drizzle:query-rename` and `pnpm drizzle:query-check`; the
  check runs as part of `pnpm validate`.
- 372 call sites across 76 files rewritten.

Author: RSO

.oxlintrc.json

@@ -119,7 +119,11 @@
     "@next/next/no-head-import-in-document": "error",
     "@next/next/no-script-component-in-head": "error",
     "drizzle/enforce-delete-with-where": ["error", { "drizzleObjectName": ["db", "ctx.db"] }],
-    "drizzle/enforce-update-with-where": ["error", { "drizzleObjectName": ["db", "ctx.db"] }]
+    "drizzle/enforce-update-with-where": ["error", { "drizzleObjectName": ["db", "ctx.db"] }],
+    "drizzle/prefer-underscore-query": [
+      "error",
+      { "drizzleObjectName": ["db", "ctx.db", "this.db", "tx", "trx"] }
+    ]
   },
   "overrides": [
     {

apps/web/src/app/admin/api/users/add-credit/route.ts

@@ -24,7 +24,7 @@ export async function POST(
     return warnAndCreateErrorResponse('Invalid email parameter');
   }
 
-  const user = await db.query.kilocode_users.findFirst({
+  const user = await db._query.kilocode_users.findFirst({
     where: eq(kilocode_users.google_user_email, email),
   });
 

apps/web/src/app/admin/api/users/credit-transactions/route.ts

@@ -20,7 +20,7 @@ export async function GET(
 
   if (!kilo_user_id) throw new Error('kilo_user_id is required');
 
-  const transactions = await db.query.credit_transactions.findMany({
+  const transactions = await db._query.credit_transactions.findMany({
     where: and(
       eq(credit_transactions.kilo_user_id, kilo_user_id),
       isNull(credit_transactions.organization_id)

apps/web/src/app/admin/api/users/payment-methods/route.ts

@@ -18,7 +18,7 @@ export async function GET(
 
   if (!kilo_user_id) throw new Error('kilo_user_id is required');
 
-  const methods = await db.query.payment_methods.findMany({
+  const methods = await db._query.payment_methods.findMany({
     where: eq(payment_methods.user_id, kilo_user_id),
     orderBy: desc(payment_methods.created_at),
   });

apps/web/src/app/admin/api/users/route.ts

@@ -176,7 +176,7 @@ export async function GET(
     const orderFunction = sortOrder === 'asc' ? asc : desc;
     const orderCondition = orderFunction(kilocode_users[sortField]);
 
-    const users = await db.query.kilocode_users.findMany({
+    const users = await db._query.kilocode_users.findMany({
       where: whereCondition,
       orderBy: orderCondition,
       limit: limit,
@@ -196,7 +196,7 @@ export async function GET(
     const notes =
       userIds.length <= 0
         ? []
-        : await db.query.user_admin_notes.findMany({
+        : await db._query.user_admin_notes.findMany({
             where: inArray(user_admin_notes.kilo_user_id, userIds),
             orderBy: desc(user_admin_notes.created_at),
           });

apps/web/src/app/admin/organizations/[id]/webhooks/page.tsx

@@ -18,7 +18,7 @@ export default async function AdminOrganizationWebhooksPage({
   const { id } = await params;
   const organizationId = decodeURIComponent(id);
 
-  const organization = await db.query.organizations.findFirst({
+  const organization = await db._query.organizations.findFirst({
     columns: {
       id: true,
       name: true,

apps/web/src/app/admin/users/[id]/page.tsx

@@ -27,7 +27,7 @@ async function getUserData(userId: string): Promise<UserDetailProps | null> {
     return null;
   }
 
-  const notes = await db.query.user_admin_notes.findMany({
+  const notes = await db._query.user_admin_notes.findMany({
     where: eq(user_admin_notes.kilo_user_id, userId),
     orderBy: desc(user_admin_notes.created_at),
   });
@@ -36,7 +36,7 @@ async function getUserData(userId: string): Promise<UserDetailProps | null> {
 
   const admins =
     adminIds.length > 0
-      ? await db.query.kilocode_users.findMany({
+      ? await db._query.kilocode_users.findMany({
           where: inArray(kilocode_users.id, adminIds),
           limit: 50,
         })
@@ -68,7 +68,7 @@ async function getUserData(userId: string): Promise<UserDetailProps | null> {
 
   // Fetch auto-top-up config
   const autoTopUpConfig =
-    (await db.query.auto_top_up_configs.findFirst({
+    (await db._query.auto_top_up_configs.findFirst({
       where: eq(auto_top_up_configs.owned_by_user_id, userId),
     })) ?? null;
 

apps/web/src/app/admin/users/[id]/webhooks/page.tsx

@@ -18,7 +18,7 @@ export default async function AdminUserWebhooksPage({
   const { id } = await params;
   const userId = decodeURIComponent(id);
 
-  const user = await db.query.kilocode_users.findFirst({
+  const user = await db._query.kilocode_users.findFirst({
     columns: {
       id: true,
       google_user_email: true,

apps/web/src/app/api/cron/deployment-threat-scan/route.ts

@@ -38,7 +38,7 @@ export async function GET(request: Request) {
 
   // Get deployments pending scan, oldest first (by last_deployed_at)
   // Uses partial index idx_deployments_threat_status_pending for efficient queries
-  const pendingDeployments = await db.query.deployments.findMany({
+  const pendingDeployments = await db._query.deployments.findMany({
     where: eq(deployments.threat_status, 'pending_scan'),
     orderBy: asc(deployments.last_deployed_at),
     limit: 25,

apps/web/src/app/api/dev/create-kilocode-org/route.ts

@@ -115,7 +115,7 @@ export async function POST(_request: NextRequest): Promise<NextResponse> {
     console.log('[DEV CREATE KILOCODE ORG] Stripe customer ID created');
 
     // Verify membership was created
-    const newMembership = await db.query.organization_memberships.findFirst({
+    const newMembership = await db._query.organization_memberships.findFirst({
       where: and(
         eq(organization_memberships.organization_id, DEV_ORG_ID),
         eq(organization_memberships.kilo_user_id, user.id)