@crowdsource.you/core 1.2.0

package/src/outbox/postgres/reportColumns.ts

@@ -0,0 +1,281 @@
+import { getTableName, sql } from 'drizzle-orm';
+import {
+  boolean,
+  check,
+  index,
+  integer,
+  text,
+  varchar,
+  type PgColumn,
+  type PgTable,
+} from 'drizzle-orm/pg-core';
+import {
+  createdAt,
+  generatedId,
+  inList,
+  textArrayLiteral,
+  timestamptz,
+  updatedAt,
+} from '@oxy.so/db';
+import type { ModerationLocalStatus } from '../types.js';
+
+/**
+ * The moderation half of an application's report table.
+ *
+ * The Postgres twin of `moderationReportSchemaFields`, and the split is the same
+ * one: the application owns the table — its name, its own extra columns, whatever
+ * verdict field it already had — and this package owns the SHAPE of the columns
+ * it queries, plus the indexes those queries depend on.
+ *
+ * ```ts
+ * const REPORT_MODERATION = {
+ *   reportedTypes: ['listing', 'review'],
+ *   categories: ['spam', 'harassment'],
+ * } as const;
+ *
+ * export const reports = pgTable(
+ *   'reports',
+ *   {
+ *     ...moderationReportColumns(REPORT_MODERATION),
+ *     // …the application's own columns
+ *   },
+ *   moderationReportTableExtras(REPORT_MODERATION),
+ * );
+ * ```
+ *
+ * **`moderationReportTableExtras` takes the OPTIONS and returns the callback**,
+ * rather than taking the built columns directly. It has to: the CHECK on
+ * `reported_type` and the containment CHECK on `categories` are built from the
+ * same tuples that constrain the columns, and drizzle does not carry those
+ * tuples onto the built column (`enumValues` is `undefined` there — measured).
+ * Passing one options object to both calls is what keeps the column and its
+ * constraint from drifting apart.
+ */
+
+/**
+ * The local statuses, as the CHECK renders them.
+ *
+ * Spelled out beside the DDL so it cannot acquire an ORM dependency. `satisfies`
+ * refuses a value outside the union; `postgresSchema.test.ts` asserts this tuple
+ * and `MODERATION_LOCAL_STATUSES` still agree, which is what catches an OMISSION
+ * — the direction a type cannot see.
+ */
+const LOCAL_STATUSES = [
+  'received',
+  'queued',
+  'submitted',
+  'delivery_failed',
+  'closed',
+] as const satisfies readonly ModerationLocalStatus[];
+
+/** Mongo's `detailsMaxLength ?? 2_000`, for the same reason: it bounds free text. */
+const DEFAULT_DETAILS_MAX_LENGTH = 2_000;
+
+export interface ModerationReportColumnOptions {
+  /**
+   * The application's reportable types. Constrains the stored value.
+   *
+   * This is NOT the set of DELIVERABLE types — a type with no subject provider is
+   * still reportable and still stored, it simply never leaves. Registering a
+   * provider is what makes a type deliverable, and the two lists are allowed to
+   * differ.
+   *
+   * Omitted, no CHECK is created. Supplying it later is a migration.
+   */
+  readonly reportedTypes?: readonly string[];
+  /** The application's report categories. Omitted, no CHECK is created. */
+  readonly categories?: readonly string[];
+  /** Maximum length of the reporter's free text. */
+  readonly detailsMaxLength?: number;
+}
+
+/**
+ * The columns this package reads and writes, to spread into the application's
+ * own `pgTable`.
+ *
+ * Every SQL name is written out. Drizzle would derive one from the property, and
+ * its derivation mangles digit- and capital-adjacent names — `crowdSourceReportId`
+ * becomes `crowd_source_report_id`, which is a working column with a name nobody
+ * chose and which no gate would notice.
+ */
+export function moderationReportColumns(options: ModerationReportColumnOptions = {}) {
+  return {
+    /**
+     * `text`, not `uuid`, and generated in the application.
+     *
+     * `generatedId()` holds a uuid v7 for a row created here and a 24-character
+     * ObjectId hex for every row that existed before a Mongo cutover, so one id
+     * space serves both. The consequence that matters downstream: a malformed id
+     * matches no rows instead of raising `22P02`, which is exactly the Mongo
+     * behaviour the delivery path already handles.
+     */
+    id: generatedId(),
+
+    reportedType: text('reported_type').notNull(),
+    reportedId: text('reported_id').notNull(),
+    /**
+     * The reporting Oxy user id.
+     *
+     * The Oxy subject IS the identity binding proof, so there is no separate
+     * binding step for an application to implement — but it does mean this
+     * column must hold an Oxy user id and not an application-local one.
+     */
+    reporter: text('reporter').notNull(),
+    /**
+     * `text[]`, written and read WHOLE.
+     *
+     * This package sets it at intake and reads it at delivery; it never queries
+     * by element, so an array column is the port rather than a join table. A
+     * containment CHECK constrains the values when the application declares them.
+     */
+    categories: text('categories').array().notNull(),
+    details: varchar('details', {
+      length: options.detailsMaxLength ?? DEFAULT_DETAILS_MAX_LENGTH,
+    }),
+
+    localStatus: text('local_status').notNull().default('received'),
+    /**
+     * Why a report is not going anywhere, in words an operator can read.
+     *
+     * Stored rather than inferred from a missing outbox row. A missing row is
+     * also what a lost write looks like, and the two need to be distinguishable
+     * months later without re-deriving which types had providers at the time.
+     */
+    localStatusReason: varchar('local_status_reason', { length: 300 }),
+
+    crowdSourceReportId: text('crowdsource_report_id'),
+    crowdSourceCaseId: text('crowdsource_case_id'),
+    crowdSourceMerged: boolean('crowdsource_merged'),
+    /** SHA-256 of the exact representation that was reviewed. */
+    contentSnapshotHash: text('content_snapshot_hash'),
+    submittedAt: timestamptz(),
+    lastDeliveryError: varchar('last_delivery_error', { length: 2_000 }),
+
+    decisionId: text('decision_id'),
+    /**
+     * The revision guard.
+     *
+     * Compared in the update's WHERE clause, so it is the database that refuses a
+     * stale write rather than a read-then-write in the application process.
+     */
+    decisionRevision: integer('decision_revision'),
+    decisionOutcome: text('decision_outcome'),
+    decisionStatus: text('decision_status'),
+    decidedAt: timestamptz(),
+    enforcedAction: text('enforced_action'),
+    enforcedAt: timestamptz(),
+
+    createdAt: createdAt(),
+    updatedAt: updatedAt(),
+  };
+}
+
+/** The column map, as the adopter's table carries it once built. */
+export type ModerationReportColumns = ReturnType<typeof moderationReportColumns>;
+
+/** Every column name the report store queries by. */
+export type ModerationReportColumnName = keyof ModerationReportColumns;
+
+/**
+ * The built columns, as `pgTable`'s third argument receives them.
+ *
+ * Deliberately NOT `ModerationReportTable`: drizzle calls that callback with the
+ * column map alone, which is not a table, so a parameter typed as one would
+ * refuse to be a `pgTable` callback at all.
+ */
+export type ModerationReportBuiltColumns = Record<ModerationReportColumnName, PgColumn>;
+
+/**
+ * A table carrying at least the moderation report columns.
+ *
+ * Structural on purpose: the adopter's table has its own name and its own extra
+ * columns, and a type derived from a concrete `pgTable` would name one table and
+ * therefore accept no other. What this asserts is the part that matters — that
+ * every column the report store reaches for is present.
+ */
+export type ModerationReportTable = PgTable & Record<ModerationReportColumnName, PgColumn>;
+
+/** Postgres truncates an identifier at 63 bytes, silently, and then names collide. */
+const MAX_IDENTIFIER_BYTES = 63;
+
+function identifier(parts: readonly string[]): string {
+  const name = parts.join('_');
+  if (Buffer.byteLength(name, 'utf8') > MAX_IDENTIFIER_BYTES) {
+    throw new Error(
+      `The moderation report index name '${name}' is ${Buffer.byteLength(name, 'utf8')} bytes; ` +
+        `Postgres truncates identifiers at ${MAX_IDENTIFIER_BYTES} and two names that differ ` +
+        'only past the cut then collide. Give the report table a shorter name.',
+    );
+  }
+  return name;
+}
+
+/**
+ * The CHECKs and indexes the report table needs, as `pgTable`'s third argument.
+ *
+ * The three indexes are the same three `applyModerationReportIndexes` creates,
+ * and not optional: reconciliation scans `(local_status, created_at)` oldest-first
+ * on every sweep, and the decision worker looks a case up by
+ * `crowdsource_case_id` on every inbound decision. Without them both become
+ * sequential scans that grow with the table.
+ *
+ * The compound uniqueness of "one report per reporter per object" is the
+ * APPLICATION's to declare — some applications allow a reporter to file twice
+ * under different categories — so it is not created here. Intake's duplicate
+ * check reads `(reporter, reported_id, reported_type)`, so that one is indexed
+ * for it either way.
+ *
+ * Index names are derived from the adopter's own table name and length-checked,
+ * because two names that differ only past the 63rd byte are the same name to
+ * Postgres.
+ */
+export function moderationReportTableExtras(options: ModerationReportColumnOptions = {}) {
+  return (columns: ModerationReportBuiltColumns) => {
+    /**
+     * The adopter's table name, read off one of its own columns — `pgTable`
+     * calls this with the BUILT columns, each of which carries its table. That
+     * is what lets the index names belong to the adopter's table without being
+     * passed in a second time and drifting.
+     */
+    const prefix = getTableName(columns.localStatus.table);
+
+    return [
+      check(
+        identifier([prefix, 'local_status_check']),
+        sql`${columns.localStatus} in (${sql.raw(inList(LOCAL_STATUSES))})`,
+      ),
+      ...(options.reportedTypes === undefined
+        ? []
+        : [
+            check(
+              identifier([prefix, 'reported_type_check']),
+              sql`${columns.reportedType} in (${sql.raw(inList(options.reportedTypes))})`,
+            ),
+          ]),
+      ...(options.categories === undefined
+        ? []
+        : [
+            /**
+             * Containment, not equality: a report carries a SUBSET of the
+             * declared categories, and `<@` is trivially satisfied by an empty
+             * array — which the application's own validation refuses before this
+             * is ever reached.
+             */
+            check(
+              identifier([prefix, 'categories_check']),
+              sql`${columns.categories} <@ ${sql.raw(textArrayLiteral(options.categories))}`,
+            ),
+          ]),
+      index(identifier([prefix, 'local_status_created_at_idx'])).on(
+        columns.localStatus,
+        columns.createdAt,
+      ),
+      index(identifier([prefix, 'crowdsource_case_id_idx'])).on(columns.crowdSourceCaseId),
+      index(identifier([prefix, 'reporter_object_idx'])).on(
+        columns.reporter,
+        columns.reportedId,
+        columns.reportedType,
+      ),
+    ];
+  };
+}

package/src/outbox/postgres/store/enforcement.ts

@@ -0,0 +1,186 @@
+import { and, eq, inArray, sql } from 'drizzle-orm';
+import type {
+  ModerationEnforcementKey,
+  ModerationEnforcementStore,
+} from '../../store/types.js';
+import type { ModerationTables } from '../tables.js';
+import type { ModerationPgHandle } from './transaction.js';
+
+/**
+ * The enforcement ledger, in Postgres.
+ *
+ * Two operations carry everything: the CLAIM that makes an action happen at most
+ * once, and the reversal LOOKUP that decides what a correction puts back. Two of
+ * this package's eleven proven mutations attack the second one, which makes its
+ * predicate the most load-bearing SQL in the Postgres half.
+ *
+ * ## The idempotency key IS the primary key
+ *
+ * `decision_id + decision_revision + action`. Mongo needed a surrogate `_id` plus
+ * a unique index on that triple; here the triple is the key, so
+ * `onConflictDoNothing()` needs no explicit `target` — there is only one
+ * constraint it could mean — and there is no second object to keep in step.
+ *
+ * `decision_revision` being IN the key is what lets a correction act: a new
+ * revision is a different row, so the restore it asks for is allowed to happen
+ * while still being impossible to apply twice itself.
+ *
+ * ## Addressed by the key, never by a record id
+ *
+ * Every write after the claim addresses the row by the same three values the
+ * claim used. PostgreSQL reaches it through the composite primary key, so no
+ * opaque record id crosses the port.
+ */
+export function postgresEnforcementStore(input: {
+  db: ModerationPgHandle;
+  tables: ModerationTables;
+}): ModerationEnforcementStore {
+  const { db } = input;
+  const enforcements = input.tables.enforcements;
+
+  /** The primary key, as a predicate. Addresses at most one row, by construction. */
+  const keyFilter = (key: ModerationEnforcementKey) =>
+    and(
+      eq(enforcements.decisionId, key.decisionId),
+      eq(enforcements.decisionRevision, key.decisionRevision),
+      eq(enforcements.action, key.action),
+    );
+
+  return {
+    async claim(row) {
+      /**
+       * The insert IS the check, and a lost race is zero rows rather than an
+       * error — the same shape as the event store's claim, and for the same
+       * reason: there is no catch block whose predicate could be widened into
+       * swallowing a real fault as "another delivery already handled it".
+       *
+       * `created_at` and `updated_at` are written from the caller's `now`. The
+       * Mongo store lets Mongoose own them; here nothing does, and the reversal
+       * lookup ORDERS BY `created_at`, so the clock that decides which row is
+       * "most recent" is the caller's rather than two different defaults'.
+       */
+      const rows = await db
+        .insert(enforcements)
+        .values({
+          decisionId: row.decisionId,
+          decisionRevision: row.decisionRevision,
+          action: row.action,
+          caseId: row.caseId,
+          subjectType: row.subjectType,
+          subjectId: row.subjectId,
+          outcome: row.outcome,
+          ...(row.recommendedAction === undefined
+            ? {}
+            : { recommendedAction: row.recommendedAction }),
+          reason: row.reason,
+          mode: row.mode,
+          applied: false,
+          createdAt: row.now,
+          updatedAt: row.now,
+        })
+        .onConflictDoNothing()
+        .returning({ decisionId: enforcements.decisionId });
+
+      return rows.length === 1;
+    },
+
+    async markSkipped(key, { skippedReason, recordedAs, now }) {
+      await db
+        .update(enforcements)
+        .set({
+          skippedReason,
+          // Absent means leave it: `recorded_as` only carries a value when the
+          // effect said the planned action amounted to something else.
+          ...(recordedAs === undefined ? {} : { recordedAs }),
+          updatedAt: now,
+        })
+        .where(keyFilter(key));
+    },
+
+    async markApplied(key, { appliedAt, previousState, now }) {
+      await db
+        .update(enforcements)
+        .set({
+          applied: true,
+          appliedAt,
+          /**
+           * Written as `jsonb`, so it round-trips as the object it was rather
+           * than as its `JSON.stringify` — a `text` column would hand a reversal
+           * a string, and `previousState?.status` on a string is `undefined`,
+           * which reads as "moderation displaced nothing" and restores a guess.
+           *
+           * Absent means leave it NULL: an action that changed state records what
+           * it displaced, and one that did not must not claim it displaced
+           * nothing-in-particular.
+           */
+          ...(previousState === undefined ? {} : { previousState }),
+          updatedAt: now,
+        })
+        .where(keyFilter(key));
+    },
+
+    async releaseClaim(key) {
+      await db.delete(enforcements).where(keyFilter(key));
+    },
+
+    async latestApplied({ subjectType, subjectId, actions }) {
+      /**
+       * The reversal lookup, and every clause in it is load-bearing.
+       *
+       * `eq(applied, true)` — a row that was RECORDED and never carried out
+       * describes a state change that never happened, and it carries no
+       * `previous_state` at all. Reading it hands a reversal nothing and the
+       * application's fallback publishes a draft moderation only ever hid.
+       *
+       * `inArray(action, actions)` — one action may reverse several. The most
+       * recent APPLIED row across the whole declared set wins, so `apply`
+       * receives whatever actually happened last rather than whichever action
+       * happens to be first in the array. Note the membership is POSITIVE: a
+       * negated set (`not in (…)`) would render as `<> ALL (…)`, which no btree
+       * can serve, and the supporting index would quietly stop being used.
+       *
+       * `created_at desc NULLS LAST` with `limit(1)` — newest first, and the
+       * NULLS placement is written out because drizzle's two spellings of "desc"
+       * DISAGREE and the difference is a blocking sort.
+       *
+       * Measured on Postgres 17. `.desc()` inside a drizzle INDEX emits
+       * `DESC NULLS LAST`; `desc(column)` in an ORDER BY emits plain `DESC`,
+       * which in Postgres means NULLS FIRST. Those two orderings do not match, so
+       * no index can satisfy the sort and the plan gains a `Sort` node — even
+       * though `created_at` is NOT NULL and the two orderings can differ by
+       * nothing at all. With `nulls last` the plan is a plain index scan under
+       * the Limit:
+       *
+       *     desc            -> Limit → Sort (created_at DESC) → Index Scan …
+       *     desc nulls last -> Limit → Index Scan …
+       *
+       * Correct results either way, and a sort that grows with the number of
+       * enforcement rows for one subject. `postgresEnforcementStore.test.ts`
+       * asserts the absence of that `Sort` against the real planner.
+       */
+      const rows = await db
+        .select({
+          action: enforcements.action,
+          previousState: enforcements.previousState,
+        })
+        .from(enforcements)
+        .where(
+          and(
+            eq(enforcements.subjectType, subjectType),
+            eq(enforcements.subjectId, subjectId),
+            inArray(enforcements.action, [...actions]),
+            eq(enforcements.applied, true),
+          ),
+        )
+        .orderBy(sql`${enforcements.createdAt} desc nulls last`)
+        .limit(1);
+
+      const [row] = rows;
+      if (row === undefined) return null;
+      return {
+        action: row.action,
+        ...(row.previousState === null ? {} : { previousState: row.previousState }),
+      };
+    },
+  };
+}

package/src/outbox/postgres/store/events.ts

@@ -0,0 +1,112 @@
+import { eq } from 'drizzle-orm';
+import type { ModerationEventStore } from '../../store/types.js';
+import type { ModerationTables } from '../tables.js';
+import type { ModerationPgHandle } from './transaction.js';
+
+/**
+ * The inbound webhook event log, in Postgres.
+ *
+ * ## The one place this backend is structurally better rather than equivalent
+ *
+ * Everything else in this port aims for parity. This claim does not: it removes a
+ * failure mode instead of handling it, and the difference is worth being precise
+ * about, because "better" is otherwise just an adjective.
+ *
+ * **Mongo's claim throws and catches.** It inserts, and reads `code === 11000` to
+ * tell "somebody else has this event" from a real fault; everything that is not
+ * 11000 is rethrown, so a lost connection or a failover answers non-2xx and the
+ * event stays on the sender's retry schedule. That property is correct — and it
+ * lives in a PREDICATE. `catch { return false }` is one keystroke away, it
+ * type-checks, and it turns a connection failure into "already processed": the
+ * receiver answers 200 and a decision is retired that nobody ever handled. The
+ * only thing standing between those two behaviours is a conditional somebody
+ * could widen, and a test can only catch that by injecting a driver failure.
+ *
+ * **Postgres's claim does not throw at all.** `ON CONFLICT DO NOTHING` plus
+ * `RETURNING` makes a duplicate a ROW COUNT rather than an error: one row means
+ * this call took the claim, zero means somebody else holds it. So there is no
+ * catch block here — and therefore
+ *
+ *   - no predicate to widen,
+ *   - no code path that can convert a fault into a negative answer,
+ *   - and the "rethrow everything else" guarantee holds by the ABSENCE of code
+ *     rather than by the presence of correct code.
+ *
+ * That is the mechanism: the Mongo version is a property of code that exists and
+ * can be edited wrongly; this one is a property of code that does not exist. Only
+ * the second cannot be broken by a well-meaning change.
+ *
+ * The consequence for the mutation suite, stated because its absence would
+ * otherwise look like a gap: there is nothing to DELETE on the insert side, so no
+ * mutation can attack it. The one that exists attacks the READ — `rows.length === 1`
+ * collapsing to `true`, which would hand the same event to two handlers.
+ */
+export function postgresEventStore(input: {
+  db: ModerationPgHandle;
+  tables: ModerationTables;
+}): ModerationEventStore<ModerationPgHandle> {
+  const { db } = input;
+  const events = input.tables.events;
+
+  return {
+    async claim({ eventId, receivedAt, expiresAt }) {
+      /**
+       * The insert IS the claim, and a lost race is zero rows rather than an
+       * exception. `created_at`/`updated_at` are left to their column defaults:
+       * unlike the outbox, nothing here needs a repeated write to be provably a
+       * no-op, so the database's clock is the simpler authority.
+       */
+      const rows = await db
+        .insert(events)
+        .values({ id: eventId, state: 'claimed', receivedAt, expiresAt })
+        .onConflictDoNothing({ target: events.id })
+        .returning({ id: events.id });
+
+      return rows.length === 1;
+    },
+
+    /** Give the claim back so a redelivery can be processed. */
+    async release(eventId) {
+      await db.delete(events).where(eq(events.id, eventId));
+    },
+
+    async markQueued({ eventId, type, caseId, payload, now }, tx) {
+      /**
+       * On the CALLER's transaction, which is the whole point: this row's
+       * completion and the outbox row that carries the work commit together, or a
+       * crash between them leaves an event permanently deduplicated with no work
+       * queued — a decision silently lost, with a row saying it arrived.
+       */
+      await tx
+        .update(events)
+        .set({
+          type,
+          caseId,
+          payload,
+          state: 'queued',
+          queuedAt: now,
+          updatedAt: now,
+        })
+        .where(eq(events.id, eventId));
+    },
+
+    async markIgnored({ eventId, type, caseId, now }) {
+      await db
+        .update(events)
+        .set({
+          type,
+          /**
+           * Absent means LEAVE IT, not write something. An event type carrying no
+           * case id is ordinary — `case.created` before a case is linked — and
+           * `caseId: String(caseId)` would store the four characters `null` or
+           * the nine characters `undefined`, which then reads as a case id
+           * everywhere downstream. Postgres keeps the column NULL.
+           */
+          ...(caseId === undefined ? {} : { caseId }),
+          state: 'ignored',
+          updatedAt: now,
+        })
+        .where(eq(events.id, eventId));
+    },
+  };
+}

package/src/outbox/postgres/store/index.ts

@@ -0,0 +1,72 @@
+import { sql } from 'drizzle-orm';
+import type { PgTable } from 'drizzle-orm/pg-core';
+import type { ModerationStore } from '../../store/types.js';
+import type { ModerationReportFields } from '../../types.js';
+import type { ModerationReportTable } from '../reportColumns.js';
+import type { ModerationTables } from '../tables.js';
+import { postgresEnforcementStore } from './enforcement.js';
+import { postgresEventStore } from './events.js';
+import { postgresOutboxStore } from './outbox.js';
+import { postgresReportStore } from './reports.js';
+import { postgresTransactionRunner, type ModerationPgHandle } from './transaction.js';
+
+/**
+ * Everything this package writes, in Postgres.
+ *
+ * One factory rather than five, because the five members must share one handle: a
+ * report and its outbox row commit in the SAME transaction, and a store assembled
+ * from two handles would type-check perfectly and quietly lose that.
+ *
+ * Unlike the Mongo factory, this one CREATES NOTHING. There is no schema to
+ * register: the adopter's own migration created the tables, generated from the
+ * definitions this package exports, in the adopter's own journal. That asymmetry
+ * is deliberate and is the reason no migrations folder ships here — two journals
+ * against one `drizzle.__drizzle_migrations` table interleave, and the loser is
+ * skipped in silence with exit 0.
+ */
+export function postgresModerationStore<TReport extends ModerationReportFields>(input: {
+  db: ModerationPgHandle;
+  /** The application's own report table, built from `moderationReportColumns`. */
+  reportTable: ModerationReportTable;
+  /** The three tables this package owns, from `moderationTables`. */
+  tables: ModerationTables;
+}): ModerationStore<TReport, ModerationPgHandle> {
+  const { db, reportTable, tables } = input;
+
+  return {
+    transaction: postgresTransactionRunner(db),
+    outbox: postgresOutboxStore({ db, tables }),
+    events: postgresEventStore({ db, tables }),
+    enforcement: postgresEnforcementStore({ db, tables }),
+    reports: postgresReportStore<TReport>({ db, reportTable }),
+
+    /**
+     * ASSERTS the schema, rather than creating it.
+     *
+     * The Mongo half calls `init()` and builds indexes; there is nothing here to
+     * build, so what remains is worth doing for its own sake: confirming the four
+     * tables this package queries exist BEFORE the first report is filed rather
+     * than at the first delivery.
+     *
+     * A missing table raises `42P01 undefined_table` and names it. `limit(0)`
+     * means Postgres parses and plans each statement — which is what proves the
+     * relation resolves — without reading a row.
+     *
+     * It cannot check COLUMNS. An adopter whose migration is a version behind
+     * gets a compile error from `ModerationReportTable` for a missing column and
+     * a `42703` from the query for a stale migration; both are loud, and neither
+     * is this function's job.
+     */
+    async ensureSchema() {
+      const present: readonly PgTable[] = [
+        tables.outbox,
+        tables.events,
+        tables.enforcements,
+        reportTable,
+      ];
+      for (const table of present) {
+        await db.select({ resolves: sql`1` }).from(table).limit(0);
+      }
+    },
+  };
+}