@agentic-kit/db-tools 0.2.0

package/policy/add-policies-to-table.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnsupportedPolicyCategoryError = void 0;
+exports.addPoliciesToExistingTable = addPoliciesToExistingTable;
+const harness_1 = require("@agentic-kit/harness");
+const provision_helpers_1 = require("./provision-helpers");
+const SUPPORTED_CATEGORIES = new Set([
+    'has-module',
+    'no-fields',
+    'needs-table',
+]);
+class UnsupportedPolicyCategoryError extends Error {
+    policyType;
+    category;
+    constructor(policyType, category) {
+        super(`Policy type "${policyType}" has category "${category}" which requires column creation or composite handling — use the policies UI instead.`);
+        this.policyType = policyType;
+        this.category = category;
+        this.name = 'UnsupportedPolicyCategoryError';
+    }
+}
+exports.UnsupportedPolicyCategoryError = UnsupportedPolicyCategoryError;
+async function addPoliciesToExistingTable(input) {
+    const { client } = input;
+    for (const entry of input.policies) {
+        const category = (0, harness_1.getPolicyCategory)(entry.policyType);
+        if (!SUPPORTED_CATEGORIES.has(category)) {
+            throw new UnsupportedPolicyCategoryError(entry.policyType, category);
+        }
+    }
+    const policiesArray = [];
+    const nodesByType = new Map();
+    for (const entry of input.policies) {
+        const groups = (0, provision_helpers_1.groupOperationsByConfig)(entry.enabledOperations ?? provision_helpers_1.CRUD_OPERATIONS, entry.operations);
+        for (const group of groups) {
+            const ops = group.privileges.join('_');
+            const rand = Math.random().toString(36).slice(2, 8);
+            policiesArray.push((0, provision_helpers_1.buildPolicyEntry)(entry.policyType, {
+                privileges: group.privileges,
+                policy_role: group.roleName,
+                permissive: group.isPermissive,
+                data: entry.sharedPolicyData,
+                policy_name: `${ops}_${rand}`,
+            }));
+        }
+        if (entry.dataNodeType && !nodesByType.has(entry.dataNodeType)) {
+            const nodeData = entry.nodeData ?? {};
+            nodesByType.set(entry.dataNodeType, {
+                $type: entry.dataNodeType,
+                ...(Object.keys(nodeData).length > 0 ? { data: nodeData } : {}),
+            });
+        }
+    }
+    const provisionInput = {
+        databaseId: input.databaseId,
+        schemaId: input.schemaId,
+        tableId: input.tableId,
+        grants: (0, provision_helpers_1.buildGrants)(),
+        policies: policiesArray,
+    };
+    if (nodesByType.size > 0) {
+        provisionInput.nodes = [...nodesByType.values()];
+    }
+    await client.secureTableProvision
+        .create({
+        data: provisionInput,
+        select: { id: true, tableId: true, tableName: true },
+    })
+        .unwrap();
+    return { success: true };
+}

package/policy/provision-helpers.d.ts

@@ -0,0 +1,38 @@
+export type CrudOperation = 'create' | 'read' | 'update' | 'delete';
+export interface OperationPolicyConfig {
+    roleName: string;
+    isPermissive: boolean;
+    policyData: Record<string, unknown>;
+    isCustomized: boolean;
+}
+export interface CrudPolicyConfigs {
+    create: OperationPolicyConfig;
+    read: OperationPolicyConfig;
+    update: OperationPolicyConfig;
+    delete: OperationPolicyConfig;
+}
+export declare const CRUD_OPERATIONS: CrudOperation[];
+export type GrantPrivilege = [string, string | string[]];
+export interface GrantEntry {
+    roles: string[];
+    privileges: GrantPrivilege[];
+}
+export interface PolicyEntry {
+    $type: string;
+    data?: Record<string, unknown>;
+    privileges?: string[];
+    policy_role?: string;
+    permissive?: boolean;
+    policy_name?: string;
+}
+export declare const ALL_CRUD_PRIVILEGES: GrantPrivilege[];
+export declare function crudOpToPrivilege(op: CrudOperation): string;
+export declare function crudOpsToPrivileges(ops: readonly CrudOperation[]): string[];
+export declare function buildGrants(roles?: string[], privileges?: GrantPrivilege[]): GrantEntry[];
+export declare function buildPolicyEntry(type: string, opts?: Partial<Omit<PolicyEntry, '$type'>>): PolicyEntry;
+export interface OperationGroup {
+    roleName: string;
+    isPermissive: boolean;
+    privileges: string[];
+}
+export declare function groupOperationsByConfig(enabledOperations: readonly CrudOperation[], operations: CrudPolicyConfigs): OperationGroup[];

package/policy/provision-helpers.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_CRUD_PRIVILEGES = exports.CRUD_OPERATIONS = void 0;
+exports.crudOpToPrivilege = crudOpToPrivilege;
+exports.crudOpsToPrivileges = crudOpsToPrivileges;
+exports.buildGrants = buildGrants;
+exports.buildPolicyEntry = buildPolicyEntry;
+exports.groupOperationsByConfig = groupOperationsByConfig;
+exports.CRUD_OPERATIONS = ['create', 'read', 'update', 'delete'];
+exports.ALL_CRUD_PRIVILEGES = [
+    ['select', '*'],
+    ['insert', '*'],
+    ['update', '*'],
+    ['delete', '*'],
+];
+const CRUD_OP_TO_LOWER_PRIVILEGE = {
+    create: 'insert',
+    read: 'select',
+    update: 'update',
+    delete: 'delete',
+};
+function crudOpToPrivilege(op) {
+    return CRUD_OP_TO_LOWER_PRIVILEGE[op];
+}
+function crudOpsToPrivileges(ops) {
+    return ops.map(crudOpToPrivilege);
+}
+function buildGrants(roles = ['authenticated'], privileges = exports.ALL_CRUD_PRIVILEGES) {
+    return [{ roles, privileges }];
+}
+function buildPolicyEntry(type, opts = {}) {
+    const entry = { $type: type };
+    if (opts.data && Object.keys(opts.data).length > 0)
+        entry.data = opts.data;
+    if (opts.privileges && opts.privileges.length > 0)
+        entry.privileges = opts.privileges;
+    if (opts.policy_role)
+        entry.policy_role = opts.policy_role;
+    if (opts.permissive !== undefined)
+        entry.permissive = opts.permissive;
+    if (opts.policy_name)
+        entry.policy_name = opts.policy_name;
+    return entry;
+}
+function groupOperationsByConfig(enabledOperations, operations) {
+    const groupMap = new Map();
+    for (const op of enabledOperations) {
+        const config = operations[op];
+        const key = `${config.roleName}:${config.isPermissive}`;
+        let group = groupMap.get(key);
+        if (!group) {
+            group = { roleName: config.roleName, isPermissive: config.isPermissive, privileges: [] };
+            groupMap.set(key, group);
+        }
+        group.privileges.push(...crudOpsToPrivileges([op]));
+    }
+    return [...groupMap.values()];
+}

package/provision-database/credential.d.ts

@@ -0,0 +1,14 @@
+export type AccountCredential = {
+    userId: string;
+    accessToken: string;
+    apiKey?: string;
+};
+export type ProvisionCredential = {
+    mode: 'account';
+    ownerId: string;
+    bearer: string;
+} | {
+    mode: 'error';
+    reason: string;
+};
+export declare function selectProvisionCredential(account: AccountCredential | null | undefined, signInHint?: string): ProvisionCredential;

package/provision-database/credential.js

@@ -0,0 +1,22 @@
+"use strict";
+// Pure: decide which credential authenticates a project's provisioning. Under the
+// account gate a signed-in session is guaranteed, so every new project provisions
+// UNDER the account (account-owned + enumerable): the database's owner_id is the
+// account's own userId, and the account's API key (falling back to its session
+// token) is the bearer that authenticates the provision mutation and lands in the
+// project .env as ACCESS_TOKEN (refreshed on every provision run, including the
+// skip path). A signed-in session with no usable bearer (keychain locked) is an
+// explicit error, never a silent throwaway owner.
+// Side-effect-free so the branch is unit-testable without runtime/network.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectProvisionCredential = selectProvisionCredential;
+function selectProvisionCredential(account, signInHint) {
+    const bearer = account?.apiKey ?? account?.accessToken;
+    if (account?.userId && bearer) {
+        return { mode: 'account', ownerId: account.userId, bearer };
+    }
+    return {
+        mode: 'error',
+        reason: `No usable account credential. ${signInHint ?? 'Sign in (or unlock your session) before provisioning a database.'}`,
+    };
+}

package/provision-database/env-file.d.ts

@@ -0,0 +1,37 @@
+export type EnvVars = Record<string, string>;
+/**
+ * Upsert `vars` into the existing `.env` `content`. Existing keys are replaced
+ * in place (preserving surrounding lines/comments); new keys are appended.
+ * Returns the new file body, trailing-newline-terminated.
+ */
+export declare function mergeEnv(content: string, vars: EnvVars): string;
+/** The credential keys provision_database owns in a project's .env. */
+export declare const PROVISION_ENV_KEYS: readonly ["DATABASE_ID", "DATABASE_NAME", "OWNER_ID", "ACCESS_TOKEN", "PGDATABASE", "API_ENDPOINT", "MODULES_ENDPOINT"];
+/**
+ * Keys archived as comments on reprovision — the binding identity: which
+ * database, under whom, on which backend. ACCESS_TOKEN is the account login
+ * token, identical across bindings, so it is overwritten in place rather than
+ * archived.
+ */
+export declare const ARCHIVED_BINDING_KEYS: readonly ["DATABASE_ID", "DATABASE_NAME", "OWNER_ID", "PGDATABASE", "API_ENDPOINT", "MODULES_ENDPOINT"];
+/**
+ * Build the provisioning credential block written to a project's .env. The
+ * endpoint pins record which backend owns this binding — outside-app consumers
+ * (verify-feature.sh, skill scripts, dev-server shells) resolve them instead of
+ * falling back to localhost defaults when the app targets a hosted backend.
+ */
+export declare function provisionEnvVars(args: {
+    databaseId: string;
+    databaseName: string;
+    ownerId: string;
+    accessToken: string;
+    apiEndpoint: string;
+    modulesEndpoint: string;
+}): EnvVars;
+/**
+ * Comment out the given keys in place (`# archived <date>: KEY=value`) so a
+ * reprovision keeps the previous binding readable in the file instead of
+ * silently overwriting it. Every other line — including existing comments and
+ * already-archived entries — passes through untouched.
+ */
+export declare function archiveBindingKeys(content: string, keys: readonly string[], archivedOn: string): string;

package/provision-database/env-file.js

@@ -0,0 +1,91 @@
+"use strict";
+// Pure .env merge — used by provision_database to persist provisioning
+// credentials without clobbering existing keys: replace a key in place if
+// present, else append.
+// Kept side-effect-free so it is unit-testable (the tool does the fs write).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ARCHIVED_BINDING_KEYS = exports.PROVISION_ENV_KEYS = void 0;
+exports.mergeEnv = mergeEnv;
+exports.provisionEnvVars = provisionEnvVars;
+exports.archiveBindingKeys = archiveBindingKeys;
+/**
+ * Upsert `vars` into the existing `.env` `content`. Existing keys are replaced
+ * in place (preserving surrounding lines/comments); new keys are appended.
+ * Returns the new file body, trailing-newline-terminated.
+ */
+function mergeEnv(content, vars) {
+    let out = content;
+    for (const [key, val] of Object.entries(vars)) {
+        // Escape the key for the regex, and use a replacement function so `$`
+        // sequences in the value are never treated as replacement specials.
+        const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const regex = new RegExp(`^${escapedKey}=.*`, 'm');
+        if (regex.test(out))
+            out = out.replace(regex, () => `${key}=${val}`);
+        else
+            out += `\n${key}=${val}`;
+    }
+    return out.trim() + '\n';
+}
+/** The credential keys provision_database owns in a project's .env. */
+exports.PROVISION_ENV_KEYS = [
+    'DATABASE_ID',
+    'DATABASE_NAME',
+    'OWNER_ID',
+    'ACCESS_TOKEN',
+    'PGDATABASE',
+    'API_ENDPOINT',
+    'MODULES_ENDPOINT',
+];
+/**
+ * Keys archived as comments on reprovision — the binding identity: which
+ * database, under whom, on which backend. ACCESS_TOKEN is the account login
+ * token, identical across bindings, so it is overwritten in place rather than
+ * archived.
+ */
+exports.ARCHIVED_BINDING_KEYS = [
+    'DATABASE_ID',
+    'DATABASE_NAME',
+    'OWNER_ID',
+    'PGDATABASE',
+    'API_ENDPOINT',
+    'MODULES_ENDPOINT',
+];
+/**
+ * Build the provisioning credential block written to a project's .env. The
+ * endpoint pins record which backend owns this binding — outside-app consumers
+ * (verify-feature.sh, skill scripts, dev-server shells) resolve them instead of
+ * falling back to localhost defaults when the app targets a hosted backend.
+ */
+function provisionEnvVars(args) {
+    return {
+        DATABASE_ID: args.databaseId,
+        DATABASE_NAME: args.databaseName,
+        OWNER_ID: args.ownerId,
+        ACCESS_TOKEN: args.accessToken,
+        PGDATABASE: args.databaseName,
+        API_ENDPOINT: args.apiEndpoint,
+        MODULES_ENDPOINT: args.modulesEndpoint,
+    };
+}
+/**
+ * Comment out the given keys in place (`# archived <date>: KEY=value`) so a
+ * reprovision keeps the previous binding readable in the file instead of
+ * silently overwriting it. Every other line — including existing comments and
+ * already-archived entries — passes through untouched.
+ */
+function archiveBindingKeys(content, keys, archivedOn) {
+    const keySet = new Set(keys);
+    return content
+        .split('\n')
+        .map((line) => {
+        if (line.trimStart().startsWith('#'))
+            return line;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            return line;
+        const key = line.slice(0, eq).trim();
+        return keySet.has(key) ? `# archived ${archivedOn}: ${line.trim()}` : line;
+    })
+        .join('\n');
+}

package/provision-database/manifest.d.ts

@@ -0,0 +1,10 @@
+import type { ProvisionOverlay } from './resolve';
+export declare const PROVISION_MANIFEST_FILE = "provision.json";
+export type ProvisionManifest = ProvisionOverlay;
+/** Validate an untrusted value as a provision manifest, throwing on bad shape. */
+export declare function parseProvisionManifest(value: unknown): ProvisionManifest;
+/**
+ * Load `<dir>/provision.json` as an overlay, or `null` when absent. A malformed
+ * file throws so a broken overlay is surfaced rather than silently ignored.
+ */
+export declare function loadProvisionManifest(dir: string): Promise<ProvisionManifest | null>;

package/provision-database/manifest.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVISION_MANIFEST_FILE = void 0;
+exports.parseProvisionManifest = parseProvisionManifest;
+exports.loadProvisionManifest = loadProvisionManifest;
+// `provision.json` overlay manifest.
+//
+// A pure-data overlay, distributed the same way skills are: written into a
+// config/app directory (locally, or materialized there from appstash / a pinned
+// git ref) and read at provision time. It NEVER installs or executes a package
+// — the base preset is a pinned build-time dependency; this file only selects a
+// preset and layers add/remove on top.
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const zod_1 = require("zod");
+exports.PROVISION_MANIFEST_FILE = 'provision.json';
+const ModuleSchema = zod_1.z.union([
+    zod_1.z.string(),
+    zod_1.z.tuple([zod_1.z.string(), zod_1.z.record(zod_1.z.string(), zod_1.z.unknown())]),
+]);
+const ProvisionManifestSchema = zod_1.z
+    .object({
+    preset: zod_1.z.string().optional(),
+    add: zod_1.z.array(ModuleSchema).optional(),
+    remove: zod_1.z.array(zod_1.z.string()).optional(),
+})
+    .strict();
+/** Validate an untrusted value as a provision manifest, throwing on bad shape. */
+function parseProvisionManifest(value) {
+    return ProvisionManifestSchema.parse(value);
+}
+/**
+ * Load `<dir>/provision.json` as an overlay, or `null` when absent. A malformed
+ * file throws so a broken overlay is surfaced rather than silently ignored.
+ */
+async function loadProvisionManifest(dir) {
+    const file = node_path_1.default.join(dir, exports.PROVISION_MANIFEST_FILE);
+    let raw;
+    try {
+        raw = await (0, promises_1.readFile)(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Invalid ${exports.PROVISION_MANIFEST_FILE} at ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return parseProvisionManifest(parsed);
+}

package/provision-database/pg-fixups.d.ts

@@ -0,0 +1,16 @@
+export type FixupResult = {
+    applied: boolean;
+    note: string;
+};
+export type PgEnv = {
+    host?: string;
+    port?: string;
+    user?: string;
+    password?: string;
+};
+export declare function parsePgpmEnv(stdout: string): PgEnv;
+export declare function resolvePgEnv(): Promise<PgEnv | null>;
+export declare function applySqlFixups(args: {
+    databaseName: string;
+    physicalDb: string;
+}): Promise<FixupResult>;

package/provision-database/pg-fixups.js

@@ -0,0 +1,170 @@
+"use strict";
+// Post-provision SQL fixups for a freshly provisioned database.
+//
+// Two things must happen at the Postgres level that the provisioning GraphQL API
+// does not do for us:
+//
+//  1. Naming settings — `constructive.simple_schema_names` and
+//     `schema_use_underscores` make later `provision_blueprint` calls create an
+//     `app_public` schema (which resolveSchemaId looks for) instead of a
+//     hyphenated `<db>-<hex>-app-public` one. These ALTER DATABASE settings
+//     PERSIST, so we set them once here, before any blueprint construction.
+//
+//  2. Membership defaults — new sign-ups otherwise land with
+//     is_approved=false/is_verified=false, the AuthzEntityMembership policy then
+//     denies every insert/select, and CRUD rows silently never persist
+//     (BLUEPRINT-PENDING-001). We flip the defaults (future sign-ups) AND any
+//     memberships already created during provisioning.
+//
+// All SQL targets the PHYSICAL control-plane database (`constructive`), NOT the
+// app's database name — that name is only a schema prefix (MEMBERSHIP-DB-001).
+//
+// Connection creds come from the ambient PG* env vars, falling back to sourcing
+// `pgpm env` (the same mechanism the old `eval "$(pgpm env)"` shell step used).
+// If neither yields a connection, provisioning still succeeded — we return a
+// note so the tool can warn the user that sign-in/CRUD may need a manual fixup.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePgpmEnv = parsePgpmEnv;
+exports.resolvePgEnv = resolvePgEnv;
+exports.applySqlFixups = applySqlFixups;
+const node_child_process_1 = require("node:child_process");
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+// Parse `pgpm env` output. It prints shell assignments (optionally `export`-
+// prefixed), one per line: `export PGHOST=localhost`. Quotes are stripped.
+function parsePgpmEnv(stdout) {
+    const env = {};
+    for (const rawLine of stdout.split('\n')) {
+        const line = rawLine.trim().replace(/^export\s+/, '');
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        let value = line.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        env[key] = value;
+    }
+    return {
+        host: env.PGHOST,
+        port: env.PGPORT,
+        user: env.PGUSER,
+        password: env.PGPASSWORD,
+    };
+}
+async function resolvePgEnv() {
+    if (process.env.PGHOST) {
+        return {
+            host: process.env.PGHOST,
+            port: process.env.PGPORT,
+            user: process.env.PGUSER,
+            password: process.env.PGPASSWORD,
+        };
+    }
+    try {
+        const { stdout } = await execFileAsync('pgpm', ['env'], { timeout: 15_000 });
+        const parsed = parsePgpmEnv(stdout);
+        return parsed.host ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Find the memberships schema for this app. Schema names use hyphens locally
+// (`<db>-<hex>-memberships-public`) but may use underscores when the naming
+// settings are active — match both, scoped to this app's name prefix.
+const MEMBERSHIPS_SCHEMA_QUERY = `
+  SELECT schema_name FROM information_schema.schemata
+   WHERE (schema_name LIKE '%memberships-public' OR schema_name LIKE '%memberships_public')
+         AND (schema_name LIKE $1 OR schema_name LIKE $2)
+   ORDER BY schema_name DESC LIMIT 1`;
+async function applySqlFixups(args) {
+    const pgEnv = await resolvePgEnv();
+    if (!pgEnv) {
+        return {
+            applied: false,
+            note: 'Could not reach Postgres (no PGHOST and `pgpm env` unavailable). Database provisioned, but membership defaults were not enabled — sign-in/CRUD may fail until the constructive DB is fixed up manually.',
+        };
+    }
+    // pg is dynamically imported so the main bundle never loads it unless a
+    // provision actually runs with Postgres access. The import lives inside the
+    // try: fixups are best-effort, so even a broken pg module must degrade to a
+    // note instead of failing the tool after the database is already provisioned.
+    let pool;
+    try {
+        const { Pool } = await Promise.resolve().then(() => __importStar(require('pg')));
+        pool = new Pool({
+            host: pgEnv.host,
+            port: pgEnv.port ? Number(pgEnv.port) : undefined,
+            user: pgEnv.user,
+            password: pgEnv.password,
+            database: args.physicalDb,
+        });
+        const db = args.physicalDb;
+        // Persistent naming settings — so future provision_blueprint calls land an
+        // `app_public` schema resolveSchemaId can find.
+        await pool.query(`ALTER DATABASE "${db}" SET constructive.simple_schema_names = 'true'`);
+        await pool.query(`ALTER DATABASE "${db}" SET constructive.schema_use_underscores = 'true'`);
+        const schemaResult = await pool.query(MEMBERSHIPS_SCHEMA_QUERY, [
+            `${args.databaseName}-%`,
+            `${args.databaseName}\\_%`,
+        ]);
+        if (schemaResult.rows.length === 0) {
+            return {
+                applied: true,
+                note: `Naming settings applied, but no memberships schema was found for "${args.databaseName}" — sign-in may need a manual membership fixup.`,
+            };
+        }
+        const membershipsSchema = schemaResult.rows[0].schema_name;
+        await pool.query(`UPDATE "${membershipsSchema}".app_membership_defaults SET is_approved = TRUE, is_verified = TRUE`);
+        await pool.query(`UPDATE "${membershipsSchema}".app_memberships
+         SET is_approved = TRUE, is_verified = TRUE
+       WHERE is_approved = FALSE OR is_verified = FALSE`);
+        return { applied: true, note: `Membership defaults enabled (schema: ${membershipsSchema}).` };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            applied: false,
+            note: `Database provisioned, but SQL fixups failed (${message}). Sign-in/CRUD may fail until membership defaults are enabled manually.`,
+        };
+    }
+    finally {
+        await pool?.end().catch(() => { });
+    }
+}

package/provision-database/preset-match.d.ts

@@ -0,0 +1,13 @@
+import { type ProvisionModule } from './presets';
+import type { ProvisionRequest } from './request-database';
+/**
+ * The slug of the registry preset whose module set equals `resolved` under
+ * the backend's hash semantics, or undefined when no preset matches.
+ */
+export declare function matchPresetSlug(resolved: ProvisionModule[]): string | undefined;
+/**
+ * Build the requestDatabase input branch: presetSlug when the resolved set
+ * equals a registry preset (warm-pool eligible), else the explicit modules
+ * array — never both.
+ */
+export declare function selectProvisionRequest(resolved: ProvisionModule[]): ProvisionRequest;