@agentic-kit/db-tools 0.8.2 → 0.9.0

package/context.js

@@ -155,14 +155,11 @@ async function resolveProjectContext(input, options = {}) {
     const dataEndpoint = databaseName
         ? deriveSubdomainEndpoint(apiEndpoint, `api-${databaseName}`)
         : '';
-    const schemaId = await resolveSchemaId(apiClient, databaseId);
-    if (!schemaId) {
-        return {
-            context: null,
-            reason: 'Could not resolve a schema (app_public/public) for this database. The database may not be fully provisioned yet.',
-            code: 'schema-unresolved',
-        };
+    const schema = await resolveSchemaId(apiClient, databaseId);
+    if ('reason' in schema) {
+        return { context: null, reason: schema.reason, code: 'schema-unresolved' };
     }
+    const schemaId = schema.id;
     return {
         context: {
             api: apiClient,
@@ -262,21 +259,24 @@ async function resolveOrgName(ownerId) {
         return undefined;
     }
 }
+// `name` is the logical schema name, identical on every backend; the physical
+// (possibly hashed) name is `schemaName`.
 async function resolveSchemaId(apiClient, databaseId) {
     const result = await apiClient.schema
         .findMany({
         select: { id: true, name: true },
-        where: { databaseId: { equalTo: databaseId } },
+        where: { databaseId: { equalTo: databaseId }, name: { equalTo: 'app_public' } },
     })
         .execute();
-    if (!result.ok)
-        return undefined;
-    const nodes = (result.data.schemas?.nodes ?? []).filter((s) => Boolean(s && s.id));
-    const appPublic = nodes.find((s) => s.name === 'app_public');
-    if (appPublic)
-        return appPublic.id;
-    const pub = nodes.find((s) => s.name === 'public');
-    if (pub)
-        return pub.id;
-    return nodes[0]?.id;
+    if (!result.ok) {
+        const detail = result.errors?.[0]?.message ?? 'unknown error';
+        return { reason: `Could not query the app_public schema for database ${databaseId}: ${detail}` };
+    }
+    const appPublic = (result.data.schemas?.nodes ?? []).find((s) => s?.name === 'app_public');
+    if (!appPublic?.id) {
+        return {
+            reason: `Database ${databaseId} has no app_public schema. The database may not be fully provisioned yet.`,
+        };
+    }
+    return { id: appPublic.id };
 }

package/esm/context.js

@@ -143,14 +143,11 @@ export async function resolveProjectContext(input, options = {}) {
     const dataEndpoint = databaseName
         ? deriveSubdomainEndpoint(apiEndpoint, `api-${databaseName}`)
         : '';
-    const schemaId = await resolveSchemaId(apiClient, databaseId);
-    if (!schemaId) {
-        return {
-            context: null,
-            reason: 'Could not resolve a schema (app_public/public) for this database. The database may not be fully provisioned yet.',
-            code: 'schema-unresolved',
-        };
+    const schema = await resolveSchemaId(apiClient, databaseId);
+    if ('reason' in schema) {
+        return { context: null, reason: schema.reason, code: 'schema-unresolved' };
     }
+    const schemaId = schema.id;
     return {
         context: {
             api: apiClient,
@@ -250,21 +247,24 @@ export async function resolveOrgName(ownerId) {
         return undefined;
     }
 }
+// `name` is the logical schema name, identical on every backend; the physical
+// (possibly hashed) name is `schemaName`.
 async function resolveSchemaId(apiClient, databaseId) {
     const result = await apiClient.schema
         .findMany({
         select: { id: true, name: true },
-        where: { databaseId: { equalTo: databaseId } },
+        where: { databaseId: { equalTo: databaseId }, name: { equalTo: 'app_public' } },
     })
         .execute();
-    if (!result.ok)
-        return undefined;
-    const nodes = (result.data.schemas?.nodes ?? []).filter((s) => Boolean(s && s.id));
-    const appPublic = nodes.find((s) => s.name === 'app_public');
-    if (appPublic)
-        return appPublic.id;
-    const pub = nodes.find((s) => s.name === 'public');
-    if (pub)
-        return pub.id;
-    return nodes[0]?.id;
+    if (!result.ok) {
+        const detail = result.errors?.[0]?.message ?? 'unknown error';
+        return { reason: `Could not query the app_public schema for database ${databaseId}: ${detail}` };
+    }
+    const appPublic = (result.data.schemas?.nodes ?? []).find((s) => s?.name === 'app_public');
+    if (!appPublic?.id) {
+        return {
+            reason: `Database ${databaseId} has no app_public schema. The database may not be fully provisioned yet.`,
+        };
+    }
+    return { id: appPublic.id };
 }

package/esm/tools/provision-database.d.ts

@@ -10,7 +10,6 @@ export type ProvisionDatabaseDetails = {
     databaseId?: string;
     databaseName?: string;
     ownerId?: string;
-    fixupNote?: string;
     /** True when an existing live binding was kept — nothing changed. */
     skipped?: boolean;
 };

package/esm/tools/provision-database.js

@@ -8,7 +8,6 @@ import { getHost } from '../host';
 import { selectProvisionCredential } from '../provision-database/credential';
 import { archiveBindingKeys, ARCHIVED_BINDING_KEYS, mergeEnv, provisionEnvVars, } from '../provision-database/env-file';
 import { loadProvisionManifest } from '../provision-database/manifest';
-import { applySqlFixups } from '../provision-database/pg-fixups';
 import { selectProvisionRequest } from '../provision-database/preset-match';
 import { requestDatabaseProvision } from '../provision-database/request-database';
 import { resolveProvisionModules } from '../provision-database/resolve';
@@ -60,7 +59,7 @@ function parseEnvKeys(source) {
 export const provisionDatabaseTool = {
     name: 'provision_database',
     label: 'Provision database',
-    description: 'Bootstrap a new Constructive database for the project under your account: provision the standard module set, enable membership defaults, and write credentials (DATABASE_ID, ACCESS_TOKEN, etc.) to the project .env. Run this ONCE before any schema/record tools. If the project is already bound to a live database under the signed-in account it skips; if the bound database no longer exists on this backend (refreshed/deleted) or belongs to a different account, pass reprovision: true to mint a fresh one (old keys archived in .env, old database kept; rebuild the schema afterwards).',
+    description: 'Bootstrap a new Constructive database for the project under your account: provision the standard module set and write credentials (DATABASE_ID, ACCESS_TOKEN, etc.) to the project .env. Run this ONCE before any schema/record tools. If the project is already bound to a live database under the signed-in account it skips; if the bound database no longer exists on this backend (refreshed/deleted) or belongs to a different account, pass reprovision: true to mint a fresh one (old keys archived in .env, old database kept; rebuild the schema afterwards).',
     promptSnippet: 'provision_database: one-time bootstrap of the project database (owner + modules + .env). Run before describe_schema/provision_blueprint. Skips when the existing binding is live under the signed-in account; reprovision: true replaces a dead or foreign-account binding (archives old keys, never deletes the old db). Gated.',
     parameters: ProvisionDatabaseZod,
     async execute(params, ctx) {
@@ -191,7 +190,6 @@ export const provisionDatabaseTool = {
         catch (err) {
             return fail(`Cannot resolve provision modules: ${err instanceof Error ? err.message : String(err)}`);
         }
-        const physicalDb = process.env.CONSTRUCTIVE_DB || 'constructive';
         // Provision on the API endpoint: requestDatabase claims a warm-pool
         // database when the resolved module set matches a cataloged preset
         // (near-instant) and cold-provisions asynchronously otherwise; the ticket
@@ -219,9 +217,6 @@ export const provisionDatabaseTool = {
                 : '';
             return fail(`Database provisioning failed: ${detail}.${nameTakenHint}`);
         }
-        // Enable membership defaults + naming settings at the SQL level. Best-effort:
-        // provisioning already succeeded, so a fixup failure is a warning, not an error.
-        const fixup = await applySqlFixups({ databaseName, physicalDb });
         // Persist the binding to the project .env (upsert, preserving other keys).
         const merged = mergeEnv(existing, provisionEnvVars({
             databaseId,
@@ -244,7 +239,7 @@ export const provisionDatabaseTool = {
         const reprovisionNote = hasBinding && params.reprovision
             ? ' Previous binding archived in .env (old database kept); rebuild the schema with provision_blueprint + run_codegen.'
             : '';
-        const message = `Provisioned database "${databaseName}" (ID: ${databaseId}). Credentials written to .env. ${fixup.note}${prewarmNote}${reprovisionNote}`;
+        const message = `Provisioned database "${databaseName}" (ID: ${databaseId}). Credentials written to .env.${prewarmNote}${reprovisionNote}`;
         return {
             content: [{ type: 'text', text: message }],
             details: {
@@ -253,7 +248,6 @@ export const provisionDatabaseTool = {
                 databaseId,
                 databaseName,
                 ownerId,
-                fixupNote: fixup.note,
             },
         };
     },

package/esm/tools/templates.d.ts

@@ -58,8 +58,8 @@ declare const UpdateTemplateZod: z.ZodObject<{
         categories: z.ZodOptional<z.ZodArray<z.ZodString>>;
         tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
         visibility: z.ZodOptional<z.ZodEnum<{
-            public: "public";
             private: "private";
+            public: "public";
         }>>;
     }, z.core.$strip>;
 }, z.core.$strip>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentic-kit/db-tools",
-  "version": "0.8.2",
+  "version": "0.9.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "harness-neutral Constructive database tools — provisioning, schema, policies, records, templates and codegen as HarnessTools any adapter can bind",
   "main": "index.js",
@@ -31,9 +31,9 @@
   "dependencies": {
     "12factor-env": "^1.33.0",
     "@agentic-kit/harness": "^0.16.0",
-    "@constructive-io/graphql-query": "^4.20.2",
-    "@constructive-io/sdk": "^1.19.2",
-    "node-type-registry": "^1.19.0",
+    "@constructive-io/graphql-query": "^4.20.4",
+    "@constructive-io/sdk": "^1.19.4",
+    "node-type-registry": "^1.19.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
@@ -45,5 +45,5 @@
     "database",
     "constructive"
   ],
-  "gitHead": "e05686fb94c5e22c954436f18c25aa4439b9e83e"
+  "gitHead": "ee458dba426522b0d06e315f6ef010938ed71e0e"
 }

package/tools/provision-database.d.ts

@@ -10,7 +10,6 @@ export type ProvisionDatabaseDetails = {
     databaseId?: string;
     databaseName?: string;
     ownerId?: string;
-    fixupNote?: string;
     /** True when an existing live binding was kept — nothing changed. */
     skipped?: boolean;
 };

package/tools/provision-database.js

@@ -14,7 +14,6 @@ const host_1 = require("../host");
 const credential_1 = require("../provision-database/credential");
 const env_file_1 = require("../provision-database/env-file");
 const manifest_1 = require("../provision-database/manifest");
-const pg_fixups_1 = require("../provision-database/pg-fixups");
 const preset_match_1 = require("../provision-database/preset-match");
 const request_database_1 = require("../provision-database/request-database");
 const resolve_1 = require("../provision-database/resolve");
@@ -66,7 +65,7 @@ function parseEnvKeys(source) {
 exports.provisionDatabaseTool = {
     name: 'provision_database',
     label: 'Provision database',
-    description: 'Bootstrap a new Constructive database for the project under your account: provision the standard module set, enable membership defaults, and write credentials (DATABASE_ID, ACCESS_TOKEN, etc.) to the project .env. Run this ONCE before any schema/record tools. If the project is already bound to a live database under the signed-in account it skips; if the bound database no longer exists on this backend (refreshed/deleted) or belongs to a different account, pass reprovision: true to mint a fresh one (old keys archived in .env, old database kept; rebuild the schema afterwards).',
+    description: 'Bootstrap a new Constructive database for the project under your account: provision the standard module set and write credentials (DATABASE_ID, ACCESS_TOKEN, etc.) to the project .env. Run this ONCE before any schema/record tools. If the project is already bound to a live database under the signed-in account it skips; if the bound database no longer exists on this backend (refreshed/deleted) or belongs to a different account, pass reprovision: true to mint a fresh one (old keys archived in .env, old database kept; rebuild the schema afterwards).',
     promptSnippet: 'provision_database: one-time bootstrap of the project database (owner + modules + .env). Run before describe_schema/provision_blueprint. Skips when the existing binding is live under the signed-in account; reprovision: true replaces a dead or foreign-account binding (archives old keys, never deletes the old db). Gated.',
     parameters: ProvisionDatabaseZod,
     async execute(params, ctx) {
@@ -197,7 +196,6 @@ exports.provisionDatabaseTool = {
         catch (err) {
             return fail(`Cannot resolve provision modules: ${err instanceof Error ? err.message : String(err)}`);
         }
-        const physicalDb = process.env.CONSTRUCTIVE_DB || 'constructive';
         // Provision on the API endpoint: requestDatabase claims a warm-pool
         // database when the resolved module set matches a cataloged preset
         // (near-instant) and cold-provisions asynchronously otherwise; the ticket
@@ -225,9 +223,6 @@ exports.provisionDatabaseTool = {
                 : '';
             return fail(`Database provisioning failed: ${detail}.${nameTakenHint}`);
         }
-        // Enable membership defaults + naming settings at the SQL level. Best-effort:
-        // provisioning already succeeded, so a fixup failure is a warning, not an error.
-        const fixup = await (0, pg_fixups_1.applySqlFixups)({ databaseName, physicalDb });
         // Persist the binding to the project .env (upsert, preserving other keys).
         const merged = (0, env_file_1.mergeEnv)(existing, (0, env_file_1.provisionEnvVars)({
             databaseId,
@@ -250,7 +245,7 @@ exports.provisionDatabaseTool = {
         const reprovisionNote = hasBinding && params.reprovision
             ? ' Previous binding archived in .env (old database kept); rebuild the schema with provision_blueprint + run_codegen.'
             : '';
-        const message = `Provisioned database "${databaseName}" (ID: ${databaseId}). Credentials written to .env. ${fixup.note}${prewarmNote}${reprovisionNote}`;
+        const message = `Provisioned database "${databaseName}" (ID: ${databaseId}). Credentials written to .env.${prewarmNote}${reprovisionNote}`;
         return {
             content: [{ type: 'text', text: message }],
             details: {
@@ -259,7 +254,6 @@ exports.provisionDatabaseTool = {
                 databaseId,
                 databaseName,
                 ownerId,
-                fixupNote: fixup.note,
             },
         };
     },

package/tools/templates.d.ts

@@ -58,8 +58,8 @@ declare const UpdateTemplateZod: z.ZodObject<{
         categories: z.ZodOptional<z.ZodArray<z.ZodString>>;
         tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
         visibility: z.ZodOptional<z.ZodEnum<{
-            public: "public";
             private: "private";
+            public: "public";
         }>>;
     }, z.core.$strip>;
 }, z.core.$strip>;

package/esm/provision-database/pg-fixups.d.ts

@@ -1,16 +0,0 @@
-export type FixupResult = {
-    applied: boolean;
-    note: string;
-};
-export type PgEnv = {
-    host?: string;
-    port?: string;
-    user?: string;
-    password?: string;
-};
-export declare function parsePgpmEnv(stdout: string): PgEnv;
-export declare function resolvePgEnv(): Promise<PgEnv | null>;
-export declare function applySqlFixups(args: {
-    databaseName: string;
-    physicalDb: string;
-}): Promise<FixupResult>;

package/esm/provision-database/pg-fixups.js

@@ -1,132 +0,0 @@
-// Post-provision SQL fixups for a freshly provisioned database.
-//
-// Two things must happen at the Postgres level that the provisioning GraphQL API
-// does not do for us:
-//
-//  1. Naming settings — `constructive.simple_schema_names` and
-//     `schema_use_underscores` make later `provision_blueprint` calls create an
-//     `app_public` schema (which resolveSchemaId looks for) instead of a
-//     hyphenated `<db>-<hex>-app-public` one. These ALTER DATABASE settings
-//     PERSIST, so we set them once here, before any blueprint construction.
-//
-//  2. Membership defaults — new sign-ups otherwise land with
-//     is_approved=false/is_verified=false, the AuthzEntityMembership policy then
-//     denies every insert/select, and CRUD rows silently never persist
-//     (BLUEPRINT-PENDING-001). We flip the defaults (future sign-ups) AND any
-//     memberships already created during provisioning.
-//
-// All SQL targets the PHYSICAL control-plane database (`constructive`), NOT the
-// app's database name — that name is only a schema prefix (MEMBERSHIP-DB-001).
-//
-// Connection creds come from the ambient PG* env vars, falling back to sourcing
-// `pgpm env` (the same mechanism the old `eval "$(pgpm env)"` shell step used).
-// If neither yields a connection, provisioning still succeeded — we return a
-// note so the tool can warn the user that sign-in/CRUD may need a manual fixup.
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFile);
-// Parse `pgpm env` output. It prints shell assignments (optionally `export`-
-// prefixed), one per line: `export PGHOST=localhost`. Quotes are stripped.
-export function parsePgpmEnv(stdout) {
-    const env = {};
-    for (const rawLine of stdout.split('\n')) {
-        const line = rawLine.trim().replace(/^export\s+/, '');
-        const eq = line.indexOf('=');
-        if (eq === -1)
-            continue;
-        const key = line.slice(0, eq).trim();
-        let value = line.slice(eq + 1).trim();
-        if ((value.startsWith('"') && value.endsWith('"')) ||
-            (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        env[key] = value;
-    }
-    return {
-        host: env.PGHOST,
-        port: env.PGPORT,
-        user: env.PGUSER,
-        password: env.PGPASSWORD,
-    };
-}
-export async function resolvePgEnv() {
-    if (process.env.PGHOST) {
-        return {
-            host: process.env.PGHOST,
-            port: process.env.PGPORT,
-            user: process.env.PGUSER,
-            password: process.env.PGPASSWORD,
-        };
-    }
-    try {
-        const { stdout } = await execFileAsync('pgpm', ['env'], { timeout: 15_000 });
-        const parsed = parsePgpmEnv(stdout);
-        return parsed.host ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
-// Find the memberships schema for this app. Schema names use hyphens locally
-// (`<db>-<hex>-memberships-public`) but may use underscores when the naming
-// settings are active — match both, scoped to this app's name prefix.
-const MEMBERSHIPS_SCHEMA_QUERY = `
-  SELECT schema_name FROM information_schema.schemata
-   WHERE (schema_name LIKE '%memberships-public' OR schema_name LIKE '%memberships_public')
-         AND (schema_name LIKE $1 OR schema_name LIKE $2)
-   ORDER BY schema_name DESC LIMIT 1`;
-export async function applySqlFixups(args) {
-    const pgEnv = await resolvePgEnv();
-    if (!pgEnv) {
-        return {
-            applied: false,
-            note: 'Could not reach Postgres (no PGHOST and `pgpm env` unavailable). Database provisioned, but membership defaults were not enabled — sign-in/CRUD may fail until the constructive DB is fixed up manually.',
-        };
-    }
-    // pg is dynamically imported so the main bundle never loads it unless a
-    // provision actually runs with Postgres access. The import lives inside the
-    // try: fixups are best-effort, so even a broken pg module must degrade to a
-    // note instead of failing the tool after the database is already provisioned.
-    let pool;
-    try {
-        const { Pool } = await import('pg');
-        pool = new Pool({
-            host: pgEnv.host,
-            port: pgEnv.port ? Number(pgEnv.port) : undefined,
-            user: pgEnv.user,
-            password: pgEnv.password,
-            database: args.physicalDb,
-        });
-        const db = args.physicalDb;
-        // Persistent naming settings — so future provision_blueprint calls land an
-        // `app_public` schema resolveSchemaId can find.
-        await pool.query(`ALTER DATABASE "${db}" SET constructive.simple_schema_names = 'true'`);
-        await pool.query(`ALTER DATABASE "${db}" SET constructive.schema_use_underscores = 'true'`);
-        const schemaResult = await pool.query(MEMBERSHIPS_SCHEMA_QUERY, [
-            `${args.databaseName}-%`,
-            `${args.databaseName}\\_%`,
-        ]);
-        if (schemaResult.rows.length === 0) {
-            return {
-                applied: true,
-                note: `Naming settings applied, but no memberships schema was found for "${args.databaseName}" — sign-in may need a manual membership fixup.`,
-            };
-        }
-        const membershipsSchema = schemaResult.rows[0].schema_name;
-        await pool.query(`UPDATE "${membershipsSchema}".app_membership_defaults SET is_approved = TRUE, is_verified = TRUE`);
-        await pool.query(`UPDATE "${membershipsSchema}".app_memberships
-         SET is_approved = TRUE, is_verified = TRUE
-       WHERE is_approved = FALSE OR is_verified = FALSE`);
-        return { applied: true, note: `Membership defaults enabled (schema: ${membershipsSchema}).` };
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        return {
-            applied: false,
-            note: `Database provisioned, but SQL fixups failed (${message}). Sign-in/CRUD may fail until membership defaults are enabled manually.`,
-        };
-    }
-    finally {
-        await pool?.end().catch(() => { });
-    }
-}

package/provision-database/pg-fixups.d.ts

@@ -1,16 +0,0 @@
-export type FixupResult = {
-    applied: boolean;
-    note: string;
-};
-export type PgEnv = {
-    host?: string;
-    port?: string;
-    user?: string;
-    password?: string;
-};
-export declare function parsePgpmEnv(stdout: string): PgEnv;
-export declare function resolvePgEnv(): Promise<PgEnv | null>;
-export declare function applySqlFixups(args: {
-    databaseName: string;
-    physicalDb: string;
-}): Promise<FixupResult>;

package/provision-database/pg-fixups.js

@@ -1,137 +0,0 @@
-"use strict";
-// Post-provision SQL fixups for a freshly provisioned database.
-//
-// Two things must happen at the Postgres level that the provisioning GraphQL API
-// does not do for us:
-//
-//  1. Naming settings — `constructive.simple_schema_names` and
-//     `schema_use_underscores` make later `provision_blueprint` calls create an
-//     `app_public` schema (which resolveSchemaId looks for) instead of a
-//     hyphenated `<db>-<hex>-app-public` one. These ALTER DATABASE settings
-//     PERSIST, so we set them once here, before any blueprint construction.
-//
-//  2. Membership defaults — new sign-ups otherwise land with
-//     is_approved=false/is_verified=false, the AuthzEntityMembership policy then
-//     denies every insert/select, and CRUD rows silently never persist
-//     (BLUEPRINT-PENDING-001). We flip the defaults (future sign-ups) AND any
-//     memberships already created during provisioning.
-//
-// All SQL targets the PHYSICAL control-plane database (`constructive`), NOT the
-// app's database name — that name is only a schema prefix (MEMBERSHIP-DB-001).
-//
-// Connection creds come from the ambient PG* env vars, falling back to sourcing
-// `pgpm env` (the same mechanism the old `eval "$(pgpm env)"` shell step used).
-// If neither yields a connection, provisioning still succeeded — we return a
-// note so the tool can warn the user that sign-in/CRUD may need a manual fixup.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.parsePgpmEnv = parsePgpmEnv;
-exports.resolvePgEnv = resolvePgEnv;
-exports.applySqlFixups = applySqlFixups;
-const node_child_process_1 = require("node:child_process");
-const node_util_1 = require("node:util");
-const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
-// Parse `pgpm env` output. It prints shell assignments (optionally `export`-
-// prefixed), one per line: `export PGHOST=localhost`. Quotes are stripped.
-function parsePgpmEnv(stdout) {
-    const env = {};
-    for (const rawLine of stdout.split('\n')) {
-        const line = rawLine.trim().replace(/^export\s+/, '');
-        const eq = line.indexOf('=');
-        if (eq === -1)
-            continue;
-        const key = line.slice(0, eq).trim();
-        let value = line.slice(eq + 1).trim();
-        if ((value.startsWith('"') && value.endsWith('"')) ||
-            (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        env[key] = value;
-    }
-    return {
-        host: env.PGHOST,
-        port: env.PGPORT,
-        user: env.PGUSER,
-        password: env.PGPASSWORD,
-    };
-}
-async function resolvePgEnv() {
-    if (process.env.PGHOST) {
-        return {
-            host: process.env.PGHOST,
-            port: process.env.PGPORT,
-            user: process.env.PGUSER,
-            password: process.env.PGPASSWORD,
-        };
-    }
-    try {
-        const { stdout } = await execFileAsync('pgpm', ['env'], { timeout: 15_000 });
-        const parsed = parsePgpmEnv(stdout);
-        return parsed.host ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
-// Find the memberships schema for this app. Schema names use hyphens locally
-// (`<db>-<hex>-memberships-public`) but may use underscores when the naming
-// settings are active — match both, scoped to this app's name prefix.
-const MEMBERSHIPS_SCHEMA_QUERY = `
-  SELECT schema_name FROM information_schema.schemata
-   WHERE (schema_name LIKE '%memberships-public' OR schema_name LIKE '%memberships_public')
-         AND (schema_name LIKE $1 OR schema_name LIKE $2)
-   ORDER BY schema_name DESC LIMIT 1`;
-async function applySqlFixups(args) {
-    const pgEnv = await resolvePgEnv();
-    if (!pgEnv) {
-        return {
-            applied: false,
-            note: 'Could not reach Postgres (no PGHOST and `pgpm env` unavailable). Database provisioned, but membership defaults were not enabled — sign-in/CRUD may fail until the constructive DB is fixed up manually.',
-        };
-    }
-    // pg is dynamically imported so the main bundle never loads it unless a
-    // provision actually runs with Postgres access. The import lives inside the
-    // try: fixups are best-effort, so even a broken pg module must degrade to a
-    // note instead of failing the tool after the database is already provisioned.
-    let pool;
-    try {
-        const { Pool } = await import('pg');
-        pool = new Pool({
-            host: pgEnv.host,
-            port: pgEnv.port ? Number(pgEnv.port) : undefined,
-            user: pgEnv.user,
-            password: pgEnv.password,
-            database: args.physicalDb,
-        });
-        const db = args.physicalDb;
-        // Persistent naming settings — so future provision_blueprint calls land an
-        // `app_public` schema resolveSchemaId can find.
-        await pool.query(`ALTER DATABASE "${db}" SET constructive.simple_schema_names = 'true'`);
-        await pool.query(`ALTER DATABASE "${db}" SET constructive.schema_use_underscores = 'true'`);
-        const schemaResult = await pool.query(MEMBERSHIPS_SCHEMA_QUERY, [
-            `${args.databaseName}-%`,
-            `${args.databaseName}\\_%`,
-        ]);
-        if (schemaResult.rows.length === 0) {
-            return {
-                applied: true,
-                note: `Naming settings applied, but no memberships schema was found for "${args.databaseName}" — sign-in may need a manual membership fixup.`,
-            };
-        }
-        const membershipsSchema = schemaResult.rows[0].schema_name;
-        await pool.query(`UPDATE "${membershipsSchema}".app_membership_defaults SET is_approved = TRUE, is_verified = TRUE`);
-        await pool.query(`UPDATE "${membershipsSchema}".app_memberships
-         SET is_approved = TRUE, is_verified = TRUE
-       WHERE is_approved = FALSE OR is_verified = FALSE`);
-        return { applied: true, note: `Membership defaults enabled (schema: ${membershipsSchema}).` };
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        return {
-            applied: false,
-            note: `Database provisioned, but SQL fixups failed (${message}). Sign-in/CRUD may fail until membership defaults are enabled manually.`,
-        };
-    }
-    finally {
-        await pool?.end().catch(() => { });
-    }
-}