@igstack/app-catalog-backend-core 0.4.0-alpha-20260814233321 → 0.4.0-alpha-20260817192135

package/dist/db/client.d.mts

@@ -1,6 +1,59 @@
 import { PrismaClient } from "../generated/prisma/client.mjs";
+import pg from "pg";
 
 //#region src/db/client.d.ts
+type PrismaLogOption = NonNullable<ConstructorParameters<typeof PrismaClient>[0]>['log'];
+/**
+ * The schema a deployment should be reading and writing.
+ *
+ * DB_SCHEMA is set per deployment, so it outranks a schema baked into the app
+ * config - otherwise a config that names `public` would pin a preview env back
+ * to the shared tables it was meant to be isolated from.
+ */
+declare function resolveDbSchema(configuredSchema?: string): string | undefined;
+/**
+ * `search_path` startup options for a schema-isolated deployment.
+ *
+ * node-postgres ignores Prisma's `?schema=` URL parameter, so a preview env's
+ * schema has to be injected as a connection option instead. This half covers
+ * raw SQL and the migrations; Prisma's own queries need the adapter half too,
+ * which is why every core connection goes through createCorePrismaClient.
+ */
+declare function buildPgSchemaOptions(configuredSchema?: string): {
+  options?: string;
+};
+/**
+ * The one way to open a connection to the core database.
+ *
+ * Schema isolation takes two halves and both live here:
+ * - the pool's `search_path`, which raw SQL and the migrations follow;
+ * - the adapter's `schema`, which is what Prisma qualifies its table names
+ *   with. A client built without it emits `"public"."DbResource"` however
+ *   correct the pool's `current_schema()` is, so a preview env silently reads
+ *   and overwrites the shared canonical tables.
+ *
+ * A pool built outside this factory gets neither half, so don't build one.
+ */
+declare function createCorePrismaClient(params: {
+  connectionString: string;
+  configuredSchema?: string;
+  log?: PrismaLogOption;
+}): {
+  client: PrismaClient;
+  pool: pg.Pool;
+  schema: string | undefined;
+};
+/**
+ * Fails a deployment that believes it is schema-isolated but is not.
+ *
+ * Speaks up whenever a schema was resolved at all - the same resolution feeds the
+ * pool's `search_path`, so the expectation and the connection can never disagree
+ * by construction, and a deployment that configures isolation without setting
+ * DB_SCHEMA is checked too. The case worth catching is a missing schema: Postgres
+ * silently skips a `search_path` entry that does not exist and falls through to
+ * `public`, which is the shared-catalog corruption this is here to prevent.
+ */
+declare function verifyDbSchema(poolToCheck: pg.Pool, configuredSchema?: string): Promise<void>;
 /**
  * Gets the internal Prisma client instance.
  * Creates one if it doesn't exist.
@@ -22,5 +75,5 @@ declare function connectDb(): Promise<void>;
  */
 declare function disconnectDb(): Promise<void>;
 //#endregion
-export { connectDb, disconnectDb, getDbClient, setDbClient };
+export { buildPgSchemaOptions, connectDb, createCorePrismaClient, disconnectDb, getDbClient, resolveDbSchema, setDbClient, verifyDbSchema };
 //# sourceMappingURL=client.d.mts.map

package/dist/db/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":[],"sources":["../../src/db/client.ts"],"mappings":";;;;AAuEA;;;iBAzCgB,WAAA,CAAA,GAAe,YAAA;;AAkD/B;;;iBAjBgB,WAAA,CAAY,MAAA,EAAQ,YAAA;;;;;iBAQd,SAAA,CAAA,GAAa,OAAA;;;;;iBASb,YAAA,CAAA,GAAgB,OAAA"}
+{"version":3,"file":"client.d.mts","names":[],"sources":["../../src/db/client.ts"],"mappings":";;;;KAQK,eAAA,GAAkB,WAAA,CACrB,qBAAA,QAA6B,YAAA;;AAPZ;;;;;;iBAiBH,eAAA,CAAgB,gBAAA;;;;;;;AAAhC;;iBAYgB,oBAAA,CAAqB,gBAAA;EACnC,OAAA;AAAA;AADF;;;;;AAmBA;;;;;;;AAnBA,iBAmBgB,sBAAA,CAAuB,MAAA;EACrC,gBAAA;EACA,gBAAA;EACA,GAAA,GAAM,eAAA;AAAA;EACF,MAAA,EAAQ,YAAA;EAAc,IAAA,EAAM,EAAA,CAAG,IAAA;EAAM,MAAA;AAAA;;;;;;AA8C3C;;;;;iBAAsB,cAAA,CACpB,WAAA,EAAa,EAAA,CAAG,IAAA,EAChB,gBAAA,YACC,OAAA;;;;;iBAuBa,WAAA,CAAA,GAAe,YAAA;AAA/B;;;;AAAA,iBAqBgB,WAAA,CAAY,MAAA,EAAQ,YAAA;AAApC;;;;AAAA,iBAQsB,SAAA,CAAA,GAAa,OAAA;AAAnC;;;;AAAA,iBAUsB,YAAA,CAAA,GAAgB,OAAA"}

package/dist/db/client.mjs

@@ -7,18 +7,89 @@ import pg from "pg";
 let prismaClient = null;
 let pool = null;
 /**
+* The schema a deployment should be reading and writing.
+*
+* DB_SCHEMA is set per deployment, so it outranks a schema baked into the app
+* config - otherwise a config that names `public` would pin a preview env back
+* to the shared tables it was meant to be isolated from.
+*/
+function resolveDbSchema(configuredSchema) {
+	return process.env.DB_SCHEMA || configuredSchema || void 0;
+}
+/**
 * `search_path` startup options for a schema-isolated deployment.
 *
 * node-postgres ignores Prisma's `?schema=` URL parameter, so a preview env's
-* schema has to be injected as a connection option instead. Every pool that
-* talks to the core database must go through here - one that skips it silently
-* lands in `public` and reads the shared canonical tables.
+* schema has to be injected as a connection option instead. This half covers
+* raw SQL and the migrations; Prisma's own queries need the adapter half too,
+* which is why every core connection goes through createCorePrismaClient.
 */
 function buildPgSchemaOptions(configuredSchema) {
-	const schema = process.env.DB_SCHEMA || configuredSchema;
+	const schema = resolveDbSchema(configuredSchema);
 	return schema ? { options: `-c search_path=${schema}` } : {};
 }
 /**
+* The one way to open a connection to the core database.
+*
+* Schema isolation takes two halves and both live here:
+* - the pool's `search_path`, which raw SQL and the migrations follow;
+* - the adapter's `schema`, which is what Prisma qualifies its table names
+*   with. A client built without it emits `"public"."DbResource"` however
+*   correct the pool's `current_schema()` is, so a preview env silently reads
+*   and overwrites the shared canonical tables.
+*
+* A pool built outside this factory gets neither half, so don't build one.
+*/
+function createCorePrismaClient(params) {
+	const schema = resolveDbSchema(params.configuredSchema);
+	const ssl = buildPgSslConfig();
+	const newPool = new pg.Pool({
+		connectionString: params.connectionString,
+		...ssl === void 0 ? {} : { ssl },
+		...buildPgSchemaOptions(params.configuredSchema)
+	});
+	return {
+		client: new PrismaClient({
+			adapter: new PrismaPg(newPool, { schema }),
+			...params.log === void 0 ? {} : { log: params.log }
+		}),
+		pool: newPool,
+		schema
+	};
+}
+/** Postgres NAMEDATALEN - 1: identifiers are truncated to this many bytes. */
+const PG_MAX_IDENTIFIER_BYTES = 63;
+/**
+* How Postgres will have stored an identifier this long.
+*
+* A schema name over the limit is truncated identically wherever it appears - at
+* CREATE SCHEMA and in `search_path` alike - so the isolation still holds and
+* current_schema() merely reports the shortened name. Comparing raw strings would
+* fail a correctly isolated deployment, so compare what Postgres kept.
+*/
+function truncateIdentifier(name) {
+	const bytes = Buffer.from(name, "utf8");
+	if (bytes.length <= PG_MAX_IDENTIFIER_BYTES) return name;
+	return bytes.subarray(0, PG_MAX_IDENTIFIER_BYTES).toString("utf8");
+}
+/**
+* Fails a deployment that believes it is schema-isolated but is not.
+*
+* Speaks up whenever a schema was resolved at all - the same resolution feeds the
+* pool's `search_path`, so the expectation and the connection can never disagree
+* by construction, and a deployment that configures isolation without setting
+* DB_SCHEMA is checked too. The case worth catching is a missing schema: Postgres
+* silently skips a `search_path` entry that does not exist and falls through to
+* `public`, which is the shared-catalog corruption this is here to prevent.
+*/
+async function verifyDbSchema(poolToCheck, configuredSchema) {
+	const resolved = resolveDbSchema(configuredSchema);
+	const actual = (await poolToCheck.query("SELECT current_schema() AS schema")).rows[0]?.schema ?? null;
+	console.log(`[db] core schema: resolved=${resolved ?? "(none)"} current_schema=${actual ?? "(none)"}`);
+	if (!resolved) return;
+	if (actual !== truncateIdentifier(resolved)) throw new Error(`The configured schema is "${resolved}" but the database resolved current_schema() to "${actual}". The schema is most likely missing, so every query would fall through to the shared catalog tables. Migrate this schema before starting the app.`);
+}
+/**
 * Gets the internal Prisma client instance.
 * Creates one if it doesn't exist.
 */
@@ -26,13 +97,9 @@ function getDbClient() {
 	if (!prismaClient) {
 		const databaseUrl = process.env.AC_CORE_DATABASE_URL;
 		if (!databaseUrl) throw new Error("PrismaClient not initialized. You must call createAcMiddleware() before using database functions, or set AC_CORE_DATABASE_URL environment variable for standalone usage.");
-		const ssl = buildPgSslConfig();
-		pool = new pg.Pool({
-			connectionString: databaseUrl,
-			...ssl === void 0 ? {} : { ssl },
-			...buildPgSchemaOptions()
-		});
-		prismaClient = new PrismaClient({ adapter: new PrismaPg(pool) });
+		const created = createCorePrismaClient({ connectionString: databaseUrl });
+		pool = created.pool;
+		prismaClient = created.client;
 	}
 	return prismaClient;
 }
@@ -49,6 +116,7 @@ function setDbClient(client) {
 */
 async function connectDb() {
 	await getDbClient().$connect();
+	if (pool) await verifyDbSchema(pool);
 }
 /**
 * Disconnects from the database.
@@ -66,5 +134,5 @@ async function disconnectDb() {
 }
 
 //#endregion
-export { buildPgSchemaOptions, connectDb, disconnectDb, getDbClient, setDbClient };
+export { buildPgSchemaOptions, connectDb, createCorePrismaClient, disconnectDb, getDbClient, resolveDbSchema, setDbClient, verifyDbSchema };
 //# sourceMappingURL=client.mjs.map

package/dist/db/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../../src/db/client.ts"],"sourcesContent":["import { PrismaClient } from '../generated/prisma/client'\nimport { PrismaPg } from '@prisma/adapter-pg'\nimport pg from 'pg'\nimport { buildPgSslConfig } from './sslConfig'\n\nlet prismaClient: PrismaClient | null = null\nlet pool: pg.Pool | null = null\n\n/**\n * `search_path` startup options for a schema-isolated deployment.\n *\n * node-postgres ignores Prisma's `?schema=` URL parameter, so a preview env's\n * schema has to be injected as a connection option instead. Every pool that\n * talks to the core database must go through here - one that skips it silently\n * lands in `public` and reads the shared canonical tables.\n */\nexport function buildPgSchemaOptions(configuredSchema?: string): {\n  options?: string\n} {\n  // DB_SCHEMA is set per deployment, so it outranks a schema baked into the app\n  // config - otherwise a config that names `public` would pin a preview env back\n  // to the shared tables it was meant to be isolated from.\n  const schema = process.env.DB_SCHEMA || configuredSchema\n  return schema ? { options: `-c search_path=${schema}` } : {}\n}\n\n/**\n * Gets the internal Prisma client instance.\n * Creates one if it doesn't exist.\n */\nexport function getDbClient(): PrismaClient {\n  if (!prismaClient) {\n    const databaseUrl = process.env.AC_CORE_DATABASE_URL\n    if (!databaseUrl) {\n      throw new Error(\n        'PrismaClient not initialized. You must call createAcMiddleware() before using database functions, ' +\n          'or set AC_CORE_DATABASE_URL environment variable for standalone usage.',\n      )\n    }\n\n    // Prisma 7 with adapter: Create pg pool and wrap with adapter.\n    // SSL comes from PGSSLMODE/PGSSLROOTCERT via our helper (node-postgres\n    // doesn't honor those correctly for a connection-string pool — see\n    // buildPgSslConfig).\n    //\n    // Schema isolation for preview envs (#44): see buildPgSchemaOptions.\n    const ssl = buildPgSslConfig()\n    pool = new pg.Pool({\n      connectionString: databaseUrl,\n      ...(ssl === undefined ? {} : { ssl }),\n      ...buildPgSchemaOptions(),\n    })\n    const adapter = new PrismaPg(pool)\n\n    prismaClient = new PrismaClient({ adapter })\n  }\n  return prismaClient\n}\n\n/**\n * Sets the internal Prisma client instance.\n * Used by middleware to bridge with existing getDbClient() usage.\n */\nexport function setDbClient(client: PrismaClient): void {\n  prismaClient = client\n}\n\n/**\n * Connects to the database.\n * Call this before performing database operations.\n */\nexport async function connectDb(): Promise<void> {\n  const client = getDbClient()\n  await client.$connect()\n}\n\n/**\n * Disconnects from the database.\n * Call this when done with database operations (e.g., in scripts).\n */\nexport async function disconnectDb(): Promise<void> {\n  if (prismaClient) {\n    await prismaClient.$disconnect()\n    prismaClient = null\n  }\n  if (pool) {\n    await pool.end()\n    pool = null\n  }\n}\n"],"mappings":";;;;;;AAKA,IAAI,eAAoC;AACxC,IAAI,OAAuB;;;;;;;;;AAU3B,SAAgB,qBAAqB,kBAEnC;CAIA,MAAM,SAAS,QAAQ,IAAI,aAAa;AACxC,QAAO,SAAS,EAAE,SAAS,kBAAkB,UAAU,GAAG,EAAE;;;;;;AAO9D,SAAgB,cAA4B;AAC1C,KAAI,CAAC,cAAc;EACjB,MAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,YACH,OAAM,IAAI,MACR,2KAED;EASH,MAAM,MAAM,kBAAkB;AAC9B,SAAO,IAAI,GAAG,KAAK;GACjB,kBAAkB;GAClB,GAAI,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK;GACpC,GAAG,sBAAsB;GAC1B,CAAC;AAGF,iBAAe,IAAI,aAAa,EAAE,SAFlB,IAAI,SAAS,KAAK,EAES,CAAC;;AAE9C,QAAO;;;;;;AAOT,SAAgB,YAAY,QAA4B;AACtD,gBAAe;;;;;;AAOjB,eAAsB,YAA2B;AAE/C,OADe,aAAa,CACf,UAAU;;;;;;AAOzB,eAAsB,eAA8B;AAClD,KAAI,cAAc;AAChB,QAAM,aAAa,aAAa;AAChC,iBAAe;;AAEjB,KAAI,MAAM;AACR,QAAM,KAAK,KAAK;AAChB,SAAO"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../../src/db/client.ts"],"sourcesContent":["import { PrismaClient } from '../generated/prisma/client'\nimport { PrismaPg } from '@prisma/adapter-pg'\nimport pg from 'pg'\nimport { buildPgSslConfig } from './sslConfig'\n\nlet prismaClient: PrismaClient | null = null\nlet pool: pg.Pool | null = null\n\ntype PrismaLogOption = NonNullable<\n  ConstructorParameters<typeof PrismaClient>[0]\n>['log']\n\n/**\n * The schema a deployment should be reading and writing.\n *\n * DB_SCHEMA is set per deployment, so it outranks a schema baked into the app\n * config - otherwise a config that names `public` would pin a preview env back\n * to the shared tables it was meant to be isolated from.\n */\nexport function resolveDbSchema(configuredSchema?: string): string | undefined {\n  return process.env.DB_SCHEMA || configuredSchema || undefined\n}\n\n/**\n * `search_path` startup options for a schema-isolated deployment.\n *\n * node-postgres ignores Prisma's `?schema=` URL parameter, so a preview env's\n * schema has to be injected as a connection option instead. This half covers\n * raw SQL and the migrations; Prisma's own queries need the adapter half too,\n * which is why every core connection goes through createCorePrismaClient.\n */\nexport function buildPgSchemaOptions(configuredSchema?: string): {\n  options?: string\n} {\n  const schema = resolveDbSchema(configuredSchema)\n  return schema ? { options: `-c search_path=${schema}` } : {}\n}\n\n/**\n * The one way to open a connection to the core database.\n *\n * Schema isolation takes two halves and both live here:\n * - the pool's `search_path`, which raw SQL and the migrations follow;\n * - the adapter's `schema`, which is what Prisma qualifies its table names\n *   with. A client built without it emits `\"public\".\"DbResource\"` however\n *   correct the pool's `current_schema()` is, so a preview env silently reads\n *   and overwrites the shared canonical tables.\n *\n * A pool built outside this factory gets neither half, so don't build one.\n */\nexport function createCorePrismaClient(params: {\n  connectionString: string\n  configuredSchema?: string\n  log?: PrismaLogOption\n}): { client: PrismaClient; pool: pg.Pool; schema: string | undefined } {\n  const schema = resolveDbSchema(params.configuredSchema)\n  // SSL comes from PGSSLMODE/PGSSLROOTCERT via our helper (node-postgres\n  // doesn't honor those correctly for a connection-string pool - see\n  // buildPgSslConfig).\n  const ssl = buildPgSslConfig()\n  const newPool = new pg.Pool({\n    connectionString: params.connectionString,\n    ...(ssl === undefined ? {} : { ssl }),\n    ...buildPgSchemaOptions(params.configuredSchema),\n  })\n  const adapter = new PrismaPg(newPool, { schema })\n  const client = new PrismaClient({\n    adapter,\n    ...(params.log === undefined ? {} : { log: params.log }),\n  })\n  return { client, pool: newPool, schema }\n}\n\n/** Postgres NAMEDATALEN - 1: identifiers are truncated to this many bytes. */\nconst PG_MAX_IDENTIFIER_BYTES = 63\n\n/**\n * How Postgres will have stored an identifier this long.\n *\n * A schema name over the limit is truncated identically wherever it appears - at\n * CREATE SCHEMA and in `search_path` alike - so the isolation still holds and\n * current_schema() merely reports the shortened name. Comparing raw strings would\n * fail a correctly isolated deployment, so compare what Postgres kept.\n */\nfunction truncateIdentifier(name: string): string {\n  const bytes = Buffer.from(name, 'utf8')\n  if (bytes.length <= PG_MAX_IDENTIFIER_BYTES) return name\n  return bytes.subarray(0, PG_MAX_IDENTIFIER_BYTES).toString('utf8')\n}\n\n/**\n * Fails a deployment that believes it is schema-isolated but is not.\n *\n * Speaks up whenever a schema was resolved at all - the same resolution feeds the\n * pool's `search_path`, so the expectation and the connection can never disagree\n * by construction, and a deployment that configures isolation without setting\n * DB_SCHEMA is checked too. The case worth catching is a missing schema: Postgres\n * silently skips a `search_path` entry that does not exist and falls through to\n * `public`, which is the shared-catalog corruption this is here to prevent.\n */\nexport async function verifyDbSchema(\n  poolToCheck: pg.Pool,\n  configuredSchema?: string,\n): Promise<void> {\n  const resolved = resolveDbSchema(configuredSchema)\n  const result = await poolToCheck.query<{ schema: string | null }>(\n    'SELECT current_schema() AS schema',\n  )\n  const actual = result.rows[0]?.schema ?? null\n  console.log(\n    `[db] core schema: resolved=${resolved ?? '(none)'} current_schema=${actual ?? '(none)'}`,\n  )\n  if (!resolved) return\n  if (actual !== truncateIdentifier(resolved)) {\n    throw new Error(\n      `The configured schema is \"${resolved}\" but the database resolved current_schema() to ` +\n        `\"${actual}\". The schema is most likely missing, so every query would fall through to ` +\n        `the shared catalog tables. Migrate this schema before starting the app.`,\n    )\n  }\n}\n\n/**\n * Gets the internal Prisma client instance.\n * Creates one if it doesn't exist.\n */\nexport function getDbClient(): PrismaClient {\n  if (!prismaClient) {\n    const databaseUrl = process.env.AC_CORE_DATABASE_URL\n    if (!databaseUrl) {\n      throw new Error(\n        'PrismaClient not initialized. You must call createAcMiddleware() before using database functions, ' +\n          'or set AC_CORE_DATABASE_URL environment variable for standalone usage.',\n      )\n    }\n\n    const created = createCorePrismaClient({ connectionString: databaseUrl })\n    pool = created.pool\n    prismaClient = created.client\n  }\n  return prismaClient\n}\n\n/**\n * Sets the internal Prisma client instance.\n * Used by middleware to bridge with existing getDbClient() usage.\n */\nexport function setDbClient(client: PrismaClient): void {\n  prismaClient = client\n}\n\n/**\n * Connects to the database.\n * Call this before performing database operations.\n */\nexport async function connectDb(): Promise<void> {\n  const client = getDbClient()\n  await client.$connect()\n  if (pool) await verifyDbSchema(pool)\n}\n\n/**\n * Disconnects from the database.\n * Call this when done with database operations (e.g., in scripts).\n */\nexport async function disconnectDb(): Promise<void> {\n  if (prismaClient) {\n    await prismaClient.$disconnect()\n    prismaClient = null\n  }\n  if (pool) {\n    await pool.end()\n    pool = null\n  }\n}\n"],"mappings":";;;;;;AAKA,IAAI,eAAoC;AACxC,IAAI,OAAuB;;;;;;;;AAa3B,SAAgB,gBAAgB,kBAA+C;AAC7E,QAAO,QAAQ,IAAI,aAAa,oBAAoB;;;;;;;;;;AAWtD,SAAgB,qBAAqB,kBAEnC;CACA,MAAM,SAAS,gBAAgB,iBAAiB;AAChD,QAAO,SAAS,EAAE,SAAS,kBAAkB,UAAU,GAAG,EAAE;;;;;;;;;;;;;;AAe9D,SAAgB,uBAAuB,QAIiC;CACtE,MAAM,SAAS,gBAAgB,OAAO,iBAAiB;CAIvD,MAAM,MAAM,kBAAkB;CAC9B,MAAM,UAAU,IAAI,GAAG,KAAK;EAC1B,kBAAkB,OAAO;EACzB,GAAI,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK;EACpC,GAAG,qBAAqB,OAAO,iBAAiB;EACjD,CAAC;AAMF,QAAO;EAAE,QAJM,IAAI,aAAa;GAC9B,SAFc,IAAI,SAAS,SAAS,EAAE,QAAQ,CAAC;GAG/C,GAAI,OAAO,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK,OAAO,KAAK;GACxD,CAAC;EACe,MAAM;EAAS;EAAQ;;;AAI1C,MAAM,0BAA0B;;;;;;;;;AAUhC,SAAS,mBAAmB,MAAsB;CAChD,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;AACvC,KAAI,MAAM,UAAU,wBAAyB,QAAO;AACpD,QAAO,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,OAAO;;;;;;;;;;;;AAapE,eAAsB,eACpB,aACA,kBACe;CACf,MAAM,WAAW,gBAAgB,iBAAiB;CAIlD,MAAM,UAHS,MAAM,YAAY,MAC/B,oCACD,EACqB,KAAK,IAAI,UAAU;AACzC,SAAQ,IACN,8BAA8B,YAAY,SAAS,kBAAkB,UAAU,WAChF;AACD,KAAI,CAAC,SAAU;AACf,KAAI,WAAW,mBAAmB,SAAS,CACzC,OAAM,IAAI,MACR,6BAA6B,SAAS,mDAChC,OAAO,oJAEd;;;;;;AAQL,SAAgB,cAA4B;AAC1C,KAAI,CAAC,cAAc;EACjB,MAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,YACH,OAAM,IAAI,MACR,2KAED;EAGH,MAAM,UAAU,uBAAuB,EAAE,kBAAkB,aAAa,CAAC;AACzE,SAAO,QAAQ;AACf,iBAAe,QAAQ;;AAEzB,QAAO;;;;;;AAOT,SAAgB,YAAY,QAA4B;AACtD,gBAAe;;;;;;AAOjB,eAAsB,YAA2B;AAE/C,OADe,aAAa,CACf,UAAU;AACvB,KAAI,KAAM,OAAM,eAAe,KAAK;;;;;;AAOtC,eAAsB,eAA8B;AAClD,KAAI,cAAc;AAChB,QAAM,aAAa,aAAa;AAChC,iBAAe;;AAEjB,KAAI,MAAM;AACR,QAAM,KAAK,KAAK;AAChB,SAAO"}

package/dist/db/index.d.mts

@@ -1,4 +1,4 @@
-import { connectDb, disconnectDb, getDbClient, setDbClient } from "./client.mjs";
+import { buildPgSchemaOptions, connectDb, createCorePrismaClient, disconnectDb, getDbClient, resolveDbSchema, setDbClient, verifyDbSchema } from "./client.mjs";
 import { buildPgSslConfig } from "./sslConfig.mjs";
 import { MakeTFromPrismaModel, ObjectKeys, ScalarFilter, ScalarKeys, TableSyncParamsPrisma, tableSyncPrisma } from "./tableSyncPrismaAdapter.mjs";
 import { TABLE_SYNC_MAGAZINE, TableSyncMagazine, TableSyncMagazineModelNameKey } from "./tableSyncMagazine.mjs";

package/dist/index.d.mts

@@ -24,7 +24,7 @@ import { AssetRestControllerConfig, registerAssetRestController } from "./module
 import { ScreenshotRestControllerConfig, registerScreenshotRestController } from "./modules/assets/screenshotRestController.mjs";
 import { SyncAssetsConfig, syncAssets } from "./modules/assets/syncAssets.mjs";
 import { checkAllLinks, printLinkCheckReport } from "./modules/appCatalog/checkLinks.mjs";
-import { connectDb, disconnectDb, getDbClient, setDbClient } from "./db/client.mjs";
+import { buildPgSchemaOptions, connectDb, createCorePrismaClient, disconnectDb, getDbClient, resolveDbSchema, setDbClient, verifyDbSchema } from "./db/client.mjs";
 import { buildPgSslConfig } from "./db/sslConfig.mjs";
 import { MakeTFromPrismaModel, ObjectKeys, ScalarFilter, ScalarKeys, TableSyncParamsPrisma, tableSyncPrisma } from "./db/tableSyncPrismaAdapter.mjs";
 import { TABLE_SYNC_MAGAZINE, TableSyncMagazine, TableSyncMagazineModelNameKey } from "./db/tableSyncMagazine.mjs";
@@ -36,4 +36,4 @@ import { injectCustomScripts } from "./middleware/htmlInjection.mjs";
 import { runLighthouseKeeperDemo } from "./modules/lighthouseKeeper/demo.mjs";
 import { APP_CATALOG_AI_SYSTEM_PROMPT, createAppCatalogAITools } from "./modules/lighthouseKeeper/tools.mjs";
 import { getBuildPipelineId, getFrontendPackageVersion, getVersionInfo } from "./utils/versionUtils.mjs";
-export { APP_CATALOG_AI_SYSTEM_PROMPT, AcAppIndexed, AcAppPageIndexed, AcAppUiIndexed, AcAppsMeta, type AcAuthConfig, AcBackendAppDto, AcBackendAppInput, AcBackendAppUIBaseInput, AcBackendAppUIInput, AcBackendCredentialInput, AcBackendDataFreshness, AcBackendDataSourceInput, AcBackendDataSourceInputCommon, AcBackendDataSourceInputDb, AcBackendDataSourceInputKafka, AcBackendDataVersion, AcBackendDeployableInput, AcBackendDeployment, AcBackendDeploymentInput, AcBackendEnvironmentInput, AcBackendPageInput, type AcBackendProvider, AcBackendTagDescriptionDataIndexed, AcBackendTagFixedTagValue, AcBackendTagsDescriptionDataIndexed, AcBackendUiDefaultsInput, AcBackendVersionsRequestParams, AcBackendVersionsReturn, AcContextIndexed, type AcDatabaseConfig, AcDatabaseManager, AcEnvIndexed, type AcFeatureToggles, type AcLifecycleHooks, type AcLighthouseKeeperConfig, type AcMcpServerConfig, AcMetaDictionary, type AcMiddlewareOptions, type AcMiddlewareResult, AcResourceIndexed, type AcStaticControllerContract, type AcTrpcContext, type AcTrpcContextOptions, AccessRequest, AppAccessRequest, AppApprovalMethod, AppCatalogCompanySpecificBackend, AppCatalogData, AppCategory, AppRole, AppVersionInfo, ApprovalMethod, ApprovalMethodConfig, ApprovalMethodType, ApprovalUrl, type AssetRestControllerConfig, type AuthRouter, type BetterAuth, CustomConfig, Freshness, Group, GroupingTagDefinition, GroupingTagValue, type IconRestControllerConfig, type MakeTFromPrismaModel, type MiddlewareContext, type ObjectKeys, Person, PersonTeamConfig, type Resource, Role, type ScalarFilter, type ScalarKeys, type ScreenshotRestControllerConfig, ServiceConfig, SourceReference, type SyncAppCatalogResult, type SyncAssetsConfig, TABLE_SYNC_MAGAZINE, type TRPCRouter, type TableSyncMagazine, type TableSyncMagazineModelNameKey, type TableSyncParamsPrisma, Tag, TierVariant, type UpsertIconInput, VersionInfo, buildPgSslConfig, checkAllLinks, connectDb, createAcMiddleware, createAcTrpcContext, createAppCatalogAITools, createAuth, createAuthRouter, createTrpcRouter, disconnectDb, getAssetByName, getBuildPipelineId, getDbClient, getFrontendPackageVersion, getResourcesFromPrisma, getVersionInfo, injectCustomScripts, printLinkCheckReport, registerAssetRestController, registerAuthRoutes, registerIconRestController, registerScreenshotRestController, runLighthouseKeeperDemo, setDbClient, staticControllerContract, syncAppCatalog, syncAssets, tableSyncPrisma, upsertIcon, upsertIcons };
+export { APP_CATALOG_AI_SYSTEM_PROMPT, AcAppIndexed, AcAppPageIndexed, AcAppUiIndexed, AcAppsMeta, type AcAuthConfig, AcBackendAppDto, AcBackendAppInput, AcBackendAppUIBaseInput, AcBackendAppUIInput, AcBackendCredentialInput, AcBackendDataFreshness, AcBackendDataSourceInput, AcBackendDataSourceInputCommon, AcBackendDataSourceInputDb, AcBackendDataSourceInputKafka, AcBackendDataVersion, AcBackendDeployableInput, AcBackendDeployment, AcBackendDeploymentInput, AcBackendEnvironmentInput, AcBackendPageInput, type AcBackendProvider, AcBackendTagDescriptionDataIndexed, AcBackendTagFixedTagValue, AcBackendTagsDescriptionDataIndexed, AcBackendUiDefaultsInput, AcBackendVersionsRequestParams, AcBackendVersionsReturn, AcContextIndexed, type AcDatabaseConfig, AcDatabaseManager, AcEnvIndexed, type AcFeatureToggles, type AcLifecycleHooks, type AcLighthouseKeeperConfig, type AcMcpServerConfig, AcMetaDictionary, type AcMiddlewareOptions, type AcMiddlewareResult, AcResourceIndexed, type AcStaticControllerContract, type AcTrpcContext, type AcTrpcContextOptions, AccessRequest, AppAccessRequest, AppApprovalMethod, AppCatalogCompanySpecificBackend, AppCatalogData, AppCategory, AppRole, AppVersionInfo, ApprovalMethod, ApprovalMethodConfig, ApprovalMethodType, ApprovalUrl, type AssetRestControllerConfig, type AuthRouter, type BetterAuth, CustomConfig, Freshness, Group, GroupingTagDefinition, GroupingTagValue, type IconRestControllerConfig, type MakeTFromPrismaModel, type MiddlewareContext, type ObjectKeys, Person, PersonTeamConfig, type Resource, Role, type ScalarFilter, type ScalarKeys, type ScreenshotRestControllerConfig, ServiceConfig, SourceReference, type SyncAppCatalogResult, type SyncAssetsConfig, TABLE_SYNC_MAGAZINE, type TRPCRouter, type TableSyncMagazine, type TableSyncMagazineModelNameKey, type TableSyncParamsPrisma, Tag, TierVariant, type UpsertIconInput, VersionInfo, buildPgSchemaOptions, buildPgSslConfig, checkAllLinks, connectDb, createAcMiddleware, createAcTrpcContext, createAppCatalogAITools, createAuth, createAuthRouter, createCorePrismaClient, createTrpcRouter, disconnectDb, getAssetByName, getBuildPipelineId, getDbClient, getFrontendPackageVersion, getResourcesFromPrisma, getVersionInfo, injectCustomScripts, printLinkCheckReport, registerAssetRestController, registerAuthRoutes, registerIconRestController, registerScreenshotRestController, resolveDbSchema, runLighthouseKeeperDemo, setDbClient, staticControllerContract, syncAppCatalog, syncAssets, tableSyncPrisma, upsertIcon, upsertIcons, verifyDbSchema };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { buildPgSslConfig } from "./db/sslConfig.mjs";
-import { connectDb, disconnectDb, getDbClient, setDbClient } from "./db/client.mjs";
+import { buildPgSchemaOptions, connectDb, createCorePrismaClient, disconnectDb, getDbClient, resolveDbSchema, setDbClient, verifyDbSchema } from "./db/client.mjs";
 import { getResourcesFromPrisma } from "./modules/appCatalog/service.mjs";
 import { createAuthRouter } from "./modules/auth/authRouter.mjs";
 import { createTrpcRouter } from "./server/controller.mjs";
@@ -23,4 +23,4 @@ import { APP_CATALOG_AI_SYSTEM_PROMPT, createAppCatalogAITools } from "./modules
 import { runLighthouseKeeperDemo } from "./modules/lighthouseKeeper/demo.mjs";
 import { getBuildPipelineId, getFrontendPackageVersion, getVersionInfo } from "./utils/versionUtils.mjs";
 
-export { APP_CATALOG_AI_SYSTEM_PROMPT, AcDatabaseManager, TABLE_SYNC_MAGAZINE, buildPgSslConfig, checkAllLinks, connectDb, createAcMiddleware, createAcTrpcContext, createAppCatalogAITools, createAuth, createAuthRouter, createTrpcRouter, disconnectDb, getAssetByName, getBuildPipelineId, getDbClient, getFrontendPackageVersion, getResourcesFromPrisma, getVersionInfo, injectCustomScripts, printLinkCheckReport, registerAssetRestController, registerAuthRoutes, registerIconRestController, registerScreenshotRestController, runLighthouseKeeperDemo, setDbClient, staticControllerContract, syncAppCatalog, syncAssets, tableSyncPrisma, upsertIcon, upsertIcons };
+export { APP_CATALOG_AI_SYSTEM_PROMPT, AcDatabaseManager, TABLE_SYNC_MAGAZINE, buildPgSchemaOptions, buildPgSslConfig, checkAllLinks, connectDb, createAcMiddleware, createAcTrpcContext, createAppCatalogAITools, createAuth, createAuthRouter, createCorePrismaClient, createTrpcRouter, disconnectDb, getAssetByName, getBuildPipelineId, getDbClient, getFrontendPackageVersion, getResourcesFromPrisma, getVersionInfo, injectCustomScripts, printLinkCheckReport, registerAssetRestController, registerAuthRoutes, registerIconRestController, registerScreenshotRestController, resolveDbSchema, runLighthouseKeeperDemo, setDbClient, staticControllerContract, syncAppCatalog, syncAssets, tableSyncPrisma, upsertIcon, upsertIcons, verifyDbSchema };

package/dist/middleware/database.d.mts

@@ -18,6 +18,7 @@ declare class AcDatabaseManager {
   getClient(): PrismaClient;
   connect(): Promise<void>;
   disconnect(): Promise<void>;
+  private configuredSchema;
 }
 //#endregion
 export { AcDatabaseManager };

package/dist/middleware/database.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.mts","names":[],"sources":["../../src/middleware/database.ts"],"mappings":";;;;;;AAuBA;;cAAa,iBAAA;EAAA,QACH,MAAA;EAAA,QACA,IAAA;EAAA,QACA,MAAA;cAEI,MAAA,EAAQ,gBAAA;EA+CO;;;;EAvC3B,SAAA,CAAA,GAAa,YAAA;EAkCP,OAAA,CAAA,GAAW,OAAA;EAKX,UAAA,CAAA,GAAc,OAAA;AAAA"}
+{"version":3,"file":"database.d.mts","names":[],"sources":["../../src/middleware/database.ts"],"mappings":";;;;;;AAyBA;;cAAa,iBAAA;EAAA,QACH,MAAA;EAAA,QACA,IAAA;EAAA,QACA,MAAA;cAEI,MAAA,EAAQ,gBAAA;EAoCO;;;;EA5B3B,SAAA,CAAA,GAAa,YAAA;EAsBP,OAAA,CAAA,GAAW,OAAA;EAMX,UAAA,CAAA,GAAc,OAAA;EAAA,QAWZ,gBAAA;AAAA"}

package/dist/middleware/database.mjs

@@ -1,8 +1,4 @@
-import { PrismaClient } from "../generated/prisma/client.mjs";
-import { buildPgSslConfig } from "../db/sslConfig.mjs";
-import { buildPgSchemaOptions, setDbClient } from "../db/client.mjs";
-import { PrismaPg } from "@prisma/adapter-pg";
-import pg from "pg";
+import { createCorePrismaClient, setDbClient, verifyDbSchema } from "../db/client.mjs";
 
 //#region src/middleware/database.ts
 /**
@@ -29,23 +25,20 @@ var AcDatabaseManager = class {
 	*/
 	getClient() {
 		if (!this.client) {
-			const datasourceUrl = formatConnectionUrl(this.config);
-			const ssl = buildPgSslConfig();
-			this.pool = new pg.Pool({
-				connectionString: datasourceUrl,
-				...ssl === void 0 ? {} : { ssl },
-				...buildPgSchemaOptions("url" in this.config ? void 0 : this.config.schema)
-			});
-			this.client = new PrismaClient({
-				adapter: new PrismaPg(this.pool),
+			const created = createCorePrismaClient({
+				connectionString: formatConnectionUrl(this.config),
+				configuredSchema: this.configuredSchema(),
 				log: process.env.NODE_ENV === "development" ? ["warn", "error"] : ["warn", "error"]
 			});
+			this.pool = created.pool;
+			this.client = created.client;
 			setDbClient(this.client);
 		}
 		return this.client;
 	}
 	async connect() {
 		await this.getClient().$connect();
+		if (this.pool) await verifyDbSchema(this.pool, this.configuredSchema());
 	}
 	async disconnect() {
 		if (this.client) {
@@ -57,6 +50,9 @@ var AcDatabaseManager = class {
 			this.pool = null;
 		}
 	}
+	configuredSchema() {
+		return "url" in this.config ? void 0 : this.config.schema;
+	}
 };
 
 //#endregion

package/dist/middleware/database.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"database.mjs","names":[],"sources":["../../src/middleware/database.ts"],"sourcesContent":["import { PrismaClient } from '../generated/prisma/client'\nimport { PrismaPg } from '@prisma/adapter-pg'\nimport pg from 'pg'\nimport type { AcDatabaseConfig } from './types'\nimport { buildPgSchemaOptions, setDbClient } from '../db/client'\nimport { buildPgSslConfig } from '../db/sslConfig'\n\n/**\n * Formats a database connection URL from structured config.\n */\nfunction formatConnectionUrl(config: AcDatabaseConfig): string {\n  if ('url' in config) {\n    return config.url\n  }\n\n  const { host, port, database, username, password, schema = 'public' } = config\n  return `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=${schema}`\n}\n\n/**\n * Internal database manager used by the middleware.\n * Handles connection URL formatting and lifecycle.\n */\nexport class AcDatabaseManager {\n  private client: PrismaClient | null = null\n  private pool: pg.Pool | null = null\n  private config: AcDatabaseConfig\n\n  constructor(config: AcDatabaseConfig) {\n    this.config = config\n  }\n\n  /**\n   * Get or create the Prisma client instance.\n   * Uses lazy initialization for flexibility.\n   */\n  getClient(): PrismaClient {\n    if (!this.client) {\n      const datasourceUrl = formatConnectionUrl(this.config)\n\n      // Prisma 7 with adapter: Create pg pool and wrap with adapter.\n      // SSL from PGSSLMODE/PGSSLROOTCERT via buildPgSslConfig (node-postgres\n      // doesn't apply those correctly to a connection-string pool).\n      // This pool - not getDbClient()'s - is the one the app ends up using, so\n      // the preview-env schema has to be applied here as well. The `?schema=`\n      // in datasourceUrl is inert: node-postgres drops unknown URL params.\n      const ssl = buildPgSslConfig()\n      this.pool = new pg.Pool({\n        connectionString: datasourceUrl,\n        ...(ssl === undefined ? {} : { ssl }),\n        ...buildPgSchemaOptions(\n          'url' in this.config ? undefined : this.config.schema,\n        ),\n      })\n      const adapter = new PrismaPg(this.pool)\n\n      this.client = new PrismaClient({\n        adapter,\n        log:\n          process.env.NODE_ENV === 'development'\n            ? ['warn', 'error']\n            : ['warn', 'error'],\n      })\n\n      // Bridge with existing backend-core getDbClient() usage\n      setDbClient(this.client)\n    }\n    return this.client\n  }\n\n  async connect(): Promise<void> {\n    const client = this.getClient()\n    await client.$connect()\n  }\n\n  async disconnect(): Promise<void> {\n    if (this.client) {\n      await this.client.$disconnect()\n      this.client = null\n    }\n    if (this.pool) {\n      await this.pool.end()\n      this.pool = null\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;AAUA,SAAS,oBAAoB,QAAkC;AAC7D,KAAI,SAAS,OACX,QAAO,OAAO;CAGhB,MAAM,EAAE,MAAM,MAAM,UAAU,UAAU,UAAU,SAAS,aAAa;AACxE,QAAO,gBAAgB,SAAS,GAAG,mBAAmB,SAAS,CAAC,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,UAAU;;;;;;AAOxG,IAAa,oBAAb,MAA+B;CAK7B,YAAY,QAA0B;gBAJA;cACP;AAI7B,OAAK,SAAS;;;;;;CAOhB,YAA0B;AACxB,MAAI,CAAC,KAAK,QAAQ;GAChB,MAAM,gBAAgB,oBAAoB,KAAK,OAAO;GAQtD,MAAM,MAAM,kBAAkB;AAC9B,QAAK,OAAO,IAAI,GAAG,KAAK;IACtB,kBAAkB;IAClB,GAAI,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK;IACpC,GAAG,qBACD,SAAS,KAAK,SAAS,SAAY,KAAK,OAAO,OAChD;IACF,CAAC;AAGF,QAAK,SAAS,IAAI,aAAa;IAC7B,SAHc,IAAI,SAAS,KAAK,KAAK;IAIrC,KACE,QAAQ,IAAI,aAAa,gBACrB,CAAC,QAAQ,QAAQ,GACjB,CAAC,QAAQ,QAAQ;IACxB,CAAC;AAGF,eAAY,KAAK,OAAO;;AAE1B,SAAO,KAAK;;CAGd,MAAM,UAAyB;AAE7B,QADe,KAAK,WAAW,CAClB,UAAU;;CAGzB,MAAM,aAA4B;AAChC,MAAI,KAAK,QAAQ;AACf,SAAM,KAAK,OAAO,aAAa;AAC/B,QAAK,SAAS;;AAEhB,MAAI,KAAK,MAAM;AACb,SAAM,KAAK,KAAK,KAAK;AACrB,QAAK,OAAO"}
+{"version":3,"file":"database.mjs","names":[],"sources":["../../src/middleware/database.ts"],"sourcesContent":["import type { PrismaClient } from '../generated/prisma/client'\nimport type pg from 'pg'\nimport type { AcDatabaseConfig } from './types'\nimport {\n  createCorePrismaClient,\n  setDbClient,\n  verifyDbSchema,\n} from '../db/client'\n\n/**\n * Formats a database connection URL from structured config.\n */\nfunction formatConnectionUrl(config: AcDatabaseConfig): string {\n  if ('url' in config) {\n    return config.url\n  }\n\n  const { host, port, database, username, password, schema = 'public' } = config\n  return `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=${schema}`\n}\n\n/**\n * Internal database manager used by the middleware.\n * Handles connection URL formatting and lifecycle.\n */\nexport class AcDatabaseManager {\n  private client: PrismaClient | null = null\n  private pool: pg.Pool | null = null\n  private config: AcDatabaseConfig\n\n  constructor(config: AcDatabaseConfig) {\n    this.config = config\n  }\n\n  /**\n   * Get or create the Prisma client instance.\n   * Uses lazy initialization for flexibility.\n   */\n  getClient(): PrismaClient {\n    if (!this.client) {\n      // This client - not getDbClient()'s - is the one the app ends up using.\n      // The `?schema=` in the url is inert (node-postgres drops unknown URL\n      // params), so the schema has to travel via createCorePrismaClient.\n      const created = createCorePrismaClient({\n        connectionString: formatConnectionUrl(this.config),\n        configuredSchema: this.configuredSchema(),\n        log:\n          process.env.NODE_ENV === 'development'\n            ? ['warn', 'error']\n            : ['warn', 'error'],\n      })\n      this.pool = created.pool\n      this.client = created.client\n\n      // Bridge with existing backend-core getDbClient() usage\n      setDbClient(this.client)\n    }\n    return this.client\n  }\n\n  async connect(): Promise<void> {\n    const client = this.getClient()\n    await client.$connect()\n    if (this.pool) await verifyDbSchema(this.pool, this.configuredSchema())\n  }\n\n  async disconnect(): Promise<void> {\n    if (this.client) {\n      await this.client.$disconnect()\n      this.client = null\n    }\n    if (this.pool) {\n      await this.pool.end()\n      this.pool = null\n    }\n  }\n\n  private configuredSchema(): string | undefined {\n    return 'url' in this.config ? undefined : this.config.schema\n  }\n}\n"],"mappings":";;;;;;AAYA,SAAS,oBAAoB,QAAkC;AAC7D,KAAI,SAAS,OACX,QAAO,OAAO;CAGhB,MAAM,EAAE,MAAM,MAAM,UAAU,UAAU,UAAU,SAAS,aAAa;AACxE,QAAO,gBAAgB,SAAS,GAAG,mBAAmB,SAAS,CAAC,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,UAAU;;;;;;AAOxG,IAAa,oBAAb,MAA+B;CAK7B,YAAY,QAA0B;gBAJA;cACP;AAI7B,OAAK,SAAS;;;;;;CAOhB,YAA0B;AACxB,MAAI,CAAC,KAAK,QAAQ;GAIhB,MAAM,UAAU,uBAAuB;IACrC,kBAAkB,oBAAoB,KAAK,OAAO;IAClD,kBAAkB,KAAK,kBAAkB;IACzC,KACE,QAAQ,IAAI,aAAa,gBACrB,CAAC,QAAQ,QAAQ,GACjB,CAAC,QAAQ,QAAQ;IACxB,CAAC;AACF,QAAK,OAAO,QAAQ;AACpB,QAAK,SAAS,QAAQ;AAGtB,eAAY,KAAK,OAAO;;AAE1B,SAAO,KAAK;;CAGd,MAAM,UAAyB;AAE7B,QADe,KAAK,WAAW,CAClB,UAAU;AACvB,MAAI,KAAK,KAAM,OAAM,eAAe,KAAK,MAAM,KAAK,kBAAkB,CAAC;;CAGzE,MAAM,aAA4B;AAChC,MAAI,KAAK,QAAQ;AACf,SAAM,KAAK,OAAO,aAAa;AAC/B,QAAK,SAAS;;AAEhB,MAAI,KAAK,MAAM;AACb,SAAM,KAAK,KAAK,KAAK;AACrB,QAAK,OAAO;;;CAIhB,AAAQ,mBAAuC;AAC7C,SAAO,SAAS,KAAK,SAAS,SAAY,KAAK,OAAO"}

package/dist/modules/lighthouseKeeper/tools.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.mts","names":[],"sources":["../../../src/modules/lighthouseKeeper/tools.ts"],"mappings":";;;;;;AA0BA;;iBAAgB,uBAAA,CACd,cAAA,EAAgB,gBAAA,GACf,MAAA,SAAe,IAAA;;;;;cAuEL,4BAAA"}
+{"version":3,"file":"tools.d.mts","names":[],"sources":["../../../src/modules/lighthouseKeeper/tools.ts"],"mappings":";;;;;;AAwBA;;iBAAgB,uBAAA,CACd,cAAA,EAAgB,gBAAA,GACf,MAAA,SAAe,IAAA;;;;;cAwEL,4BAAA"}

package/dist/modules/lighthouseKeeper/tools.mjs

@@ -1,6 +1,4 @@
-import { PrismaClient } from "../../generated/prisma/client.mjs";
-import { PrismaPg } from "@prisma/adapter-pg";
-import pg from "pg";
+import { createCorePrismaClient } from "../../db/client.mjs";
 import { z } from "zod";
 
 //#region src/modules/lighthouseKeeper/tools.ts
@@ -14,8 +12,10 @@ function getDatabaseUrl(config) {
 * These tools allow the AI to fetch and inspect app information.
 */
 function createAppCatalogAITools(databaseConfig) {
-	const databaseUrl = getDatabaseUrl(databaseConfig);
-	const prisma = new PrismaClient({ adapter: new PrismaPg(new pg.Pool({ connectionString: databaseUrl })) });
+	const { client: prisma } = createCorePrismaClient({
+		connectionString: getDatabaseUrl(databaseConfig),
+		configuredSchema: "url" in databaseConfig ? void 0 : databaseConfig.schema
+	});
 	return { getAppCard: {
 		description: "Fetch complete app catalog card information by ID. Returns title, description, tags, access request details, links, and all other app metadata.",
 		inputSchema: z.object({ slug: z.string().describe("The app slug to fetch") }),

package/dist/modules/lighthouseKeeper/tools.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"tools.mjs","names":[],"sources":["../../../src/modules/lighthouseKeeper/tools.ts"],"sourcesContent":["import type { Tool } from 'ai'\nimport { z } from 'zod'\nimport { PrismaClient } from '../../generated/prisma/client'\nimport { PrismaPg } from '@prisma/adapter-pg'\nimport pg from 'pg'\nimport type { AcDatabaseConfig } from '../../middleware/types.js'\n\n// ============================================================================\n// Database URL Helper\n// ============================================================================\n\nfunction getDatabaseUrl(config: AcDatabaseConfig): string {\n  if ('url' in config) return config.url\n  const { host, port, database, username, password, schema } = config\n  const schemaParam = schema ? `?schema=${schema}` : ''\n  return `postgresql://${username}:${password}@${host}:${port}/${database}${schemaParam}`\n}\n\n// ============================================================================\n// AI Tools for App Catalog\n// ============================================================================\n\n/**\n * Create AI tools for working with app catalog cards.\n * These tools allow the AI to fetch and inspect app information.\n */\nexport function createAppCatalogAITools(\n  databaseConfig: AcDatabaseConfig,\n): Record<string, Tool> {\n  const databaseUrl = getDatabaseUrl(databaseConfig)\n  const pool = new pg.Pool({ connectionString: databaseUrl })\n  const adapter = new PrismaPg(pool)\n  const prisma = new PrismaClient({ adapter })\n\n  const getAppCardSchema = z.object({\n    slug: z.string().describe('The app slug to fetch'),\n  })\n\n  type GetAppCardInput = z.infer<typeof getAppCardSchema>\n\n  const getAppCard: Tool<GetAppCardInput, unknown> = {\n    description:\n      'Fetch complete app catalog card information by ID. Returns title, description, tags, access request details, links, and all other app metadata.',\n    inputSchema: getAppCardSchema,\n    execute: async ({ slug }: { slug: string }) => {\n      try {\n        const app = await prisma.dbResource.findUnique({\n          where: { slug },\n          include: {\n            sourceRefs: true,\n          },\n        })\n\n        if (!app) {\n          return { error: `App not found with slug: ${slug}` }\n        }\n\n        // Return structured card data\n        return {\n          success: true,\n          card: {\n            id: app.id,\n            slug: app.slug,\n            displayName: app.displayName,\n            description: app.description,\n            teams: app.teams,\n            tags: app.tags,\n            appUrl: app.appUrl,\n            links: app.links,\n            iconName: app.iconName,\n            sources: app.sourceRefs.map((ref) => ref.url),\n            notes: app.notes,\n            accessRequest: app.accessRequest,\n            deprecated: app.deprecated,\n            createdAt: app.createdAt,\n            updatedAt: app.updatedAt,\n          },\n        }\n      } catch (error) {\n        return {\n          error: error instanceof Error ? error.message : 'Failed to fetch app',\n        }\n      }\n    },\n  }\n\n  return {\n    getAppCard,\n  }\n}\n\n// ============================================================================\n// System Prompt\n// ============================================================================\n\n/**\n * Default system prompt for AI working with app catalog cards.\n * Use this when configuring lighthouseKeeper for card updates.\n */\nexport const APP_CATALOG_AI_SYSTEM_PROMPT = `You are an assistant that helps update app catalog cards based on information from provided links.\n\nWhen given a link and an app ID:\n1. Use getAppCard to fetch the current card information\n2. Analyze the provided link for relevant information\n3. Output a new card structure with updated information based on the link\n\nReturn the updated card as a structured JSON object matching the card format:\n- displayName: App title\n- description: Full description\n- tags: Array of tags\n- teams: Array of team names\n- appUrl: Main application URL\n- links: Array of {url, title} objects for related links\n- sources: Array of source URLs (documentation, Confluence pages, etc.)\n- accessRequest: Object with approvalMethodSlug, comments, requestPrompt, postApprovalInstructions, roles, approverPersonSlugs, urls\n- notes: Additional notes\n- deprecated: Optional deprecation info with type, replacementSlug, comment\n\nDo NOT save the card to the database. Only output the updated structure.`\n"],"mappings":";;;;;;AAWA,SAAS,eAAe,QAAkC;AACxD,KAAI,SAAS,OAAQ,QAAO,OAAO;CACnC,MAAM,EAAE,MAAM,MAAM,UAAU,UAAU,UAAU,WAAW;AAE7D,QAAO,gBAAgB,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,WAD3C,SAAS,WAAW,WAAW;;;;;;AAYrD,SAAgB,wBACd,gBACsB;CACtB,MAAM,cAAc,eAAe,eAAe;CAGlD,MAAM,SAAS,IAAI,aAAa,EAAE,SADlB,IAAI,SADP,IAAI,GAAG,KAAK,EAAE,kBAAkB,aAAa,CAAC,CACzB,EACS,CAAC;AAsD5C,QAAO,EACL,YA/CiD;EACjD,aACE;EACF,aATuB,EAAE,OAAO,EAChC,MAAM,EAAE,QAAQ,CAAC,SAAS,wBAAwB,EACnD,CAAC;EAQA,SAAS,OAAO,EAAE,WAA6B;AAC7C,OAAI;IACF,MAAM,MAAM,MAAM,OAAO,WAAW,WAAW;KAC7C,OAAO,EAAE,MAAM;KACf,SAAS,EACP,YAAY,MACb;KACF,CAAC;AAEF,QAAI,CAAC,IACH,QAAO,EAAE,OAAO,4BAA4B,QAAQ;AAItD,WAAO;KACL,SAAS;KACT,MAAM;MACJ,IAAI,IAAI;MACR,MAAM,IAAI;MACV,aAAa,IAAI;MACjB,aAAa,IAAI;MACjB,OAAO,IAAI;MACX,MAAM,IAAI;MACV,QAAQ,IAAI;MACZ,OAAO,IAAI;MACX,UAAU,IAAI;MACd,SAAS,IAAI,WAAW,KAAK,QAAQ,IAAI,IAAI;MAC7C,OAAO,IAAI;MACX,eAAe,IAAI;MACnB,YAAY,IAAI;MAChB,WAAW,IAAI;MACf,WAAW,IAAI;MAChB;KACF;YACM,OAAO;AACd,WAAO,EACL,OAAO,iBAAiB,QAAQ,MAAM,UAAU,uBACjD;;;EAGN,EAIA;;;;;;AAWH,MAAa,+BAA+B"}
+{"version":3,"file":"tools.mjs","names":[],"sources":["../../../src/modules/lighthouseKeeper/tools.ts"],"sourcesContent":["import type { Tool } from 'ai'\nimport { z } from 'zod'\nimport { createCorePrismaClient } from '../../db/client'\nimport type { AcDatabaseConfig } from '../../middleware/types.js'\n\n// ============================================================================\n// Database URL Helper\n// ============================================================================\n\nfunction getDatabaseUrl(config: AcDatabaseConfig): string {\n  if ('url' in config) return config.url\n  const { host, port, database, username, password, schema } = config\n  const schemaParam = schema ? `?schema=${schema}` : ''\n  return `postgresql://${username}:${password}@${host}:${port}/${database}${schemaParam}`\n}\n\n// ============================================================================\n// AI Tools for App Catalog\n// ============================================================================\n\n/**\n * Create AI tools for working with app catalog cards.\n * These tools allow the AI to fetch and inspect app information.\n */\nexport function createAppCatalogAITools(\n  databaseConfig: AcDatabaseConfig,\n): Record<string, Tool> {\n  const { client: prisma } = createCorePrismaClient({\n    connectionString: getDatabaseUrl(databaseConfig),\n    configuredSchema:\n      'url' in databaseConfig ? undefined : databaseConfig.schema,\n  })\n\n  const getAppCardSchema = z.object({\n    slug: z.string().describe('The app slug to fetch'),\n  })\n\n  type GetAppCardInput = z.infer<typeof getAppCardSchema>\n\n  const getAppCard: Tool<GetAppCardInput, unknown> = {\n    description:\n      'Fetch complete app catalog card information by ID. Returns title, description, tags, access request details, links, and all other app metadata.',\n    inputSchema: getAppCardSchema,\n    execute: async ({ slug }: { slug: string }) => {\n      try {\n        const app = await prisma.dbResource.findUnique({\n          where: { slug },\n          include: {\n            sourceRefs: true,\n          },\n        })\n\n        if (!app) {\n          return { error: `App not found with slug: ${slug}` }\n        }\n\n        // Return structured card data\n        return {\n          success: true,\n          card: {\n            id: app.id,\n            slug: app.slug,\n            displayName: app.displayName,\n            description: app.description,\n            teams: app.teams,\n            tags: app.tags,\n            appUrl: app.appUrl,\n            links: app.links,\n            iconName: app.iconName,\n            sources: app.sourceRefs.map((ref) => ref.url),\n            notes: app.notes,\n            accessRequest: app.accessRequest,\n            deprecated: app.deprecated,\n            createdAt: app.createdAt,\n            updatedAt: app.updatedAt,\n          },\n        }\n      } catch (error) {\n        return {\n          error: error instanceof Error ? error.message : 'Failed to fetch app',\n        }\n      }\n    },\n  }\n\n  return {\n    getAppCard,\n  }\n}\n\n// ============================================================================\n// System Prompt\n// ============================================================================\n\n/**\n * Default system prompt for AI working with app catalog cards.\n * Use this when configuring lighthouseKeeper for card updates.\n */\nexport const APP_CATALOG_AI_SYSTEM_PROMPT = `You are an assistant that helps update app catalog cards based on information from provided links.\n\nWhen given a link and an app ID:\n1. Use getAppCard to fetch the current card information\n2. Analyze the provided link for relevant information\n3. Output a new card structure with updated information based on the link\n\nReturn the updated card as a structured JSON object matching the card format:\n- displayName: App title\n- description: Full description\n- tags: Array of tags\n- teams: Array of team names\n- appUrl: Main application URL\n- links: Array of {url, title} objects for related links\n- sources: Array of source URLs (documentation, Confluence pages, etc.)\n- accessRequest: Object with approvalMethodSlug, comments, requestPrompt, postApprovalInstructions, roles, approverPersonSlugs, urls\n- notes: Additional notes\n- deprecated: Optional deprecation info with type, replacementSlug, comment\n\nDo NOT save the card to the database. Only output the updated structure.`\n"],"mappings":";;;;AASA,SAAS,eAAe,QAAkC;AACxD,KAAI,SAAS,OAAQ,QAAO,OAAO;CACnC,MAAM,EAAE,MAAM,MAAM,UAAU,UAAU,UAAU,WAAW;AAE7D,QAAO,gBAAgB,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,WAD3C,SAAS,WAAW,WAAW;;;;;;AAYrD,SAAgB,wBACd,gBACsB;CACtB,MAAM,EAAE,QAAQ,WAAW,uBAAuB;EAChD,kBAAkB,eAAe,eAAe;EAChD,kBACE,SAAS,iBAAiB,SAAY,eAAe;EACxD,CAAC;AAsDF,QAAO,EACL,YA/CiD;EACjD,aACE;EACF,aATuB,EAAE,OAAO,EAChC,MAAM,EAAE,QAAQ,CAAC,SAAS,wBAAwB,EACnD,CAAC;EAQA,SAAS,OAAO,EAAE,WAA6B;AAC7C,OAAI;IACF,MAAM,MAAM,MAAM,OAAO,WAAW,WAAW;KAC7C,OAAO,EAAE,MAAM;KACf,SAAS,EACP,YAAY,MACb;KACF,CAAC;AAEF,QAAI,CAAC,IACH,QAAO,EAAE,OAAO,4BAA4B,QAAQ;AAItD,WAAO;KACL,SAAS;KACT,MAAM;MACJ,IAAI,IAAI;MACR,MAAM,IAAI;MACV,aAAa,IAAI;MACjB,aAAa,IAAI;MACjB,OAAO,IAAI;MACX,MAAM,IAAI;MACV,QAAQ,IAAI;MACZ,OAAO,IAAI;MACX,UAAU,IAAI;MACd,SAAS,IAAI,WAAW,KAAK,QAAQ,IAAI,IAAI;MAC7C,OAAO,IAAI;MACX,eAAe,IAAI;MACnB,YAAY,IAAI;MAChB,WAAW,IAAI;MACf,WAAW,IAAI;MAChB;KACF;YACM,OAAO;AACd,WAAO,EACL,OAAO,iBAAiB,QAAQ,MAAM,UAAU,uBACjD;;;EAGN,EAIA;;;;;;AAWH,MAAa,+BAA+B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@igstack/app-catalog-backend-core",
-  "version": "0.4.0-alpha-20260814233321",
+  "version": "0.4.0-alpha-20260817192135",
   "description": "Backend core library for App Catalog",
   "homepage": "https://github.com/lislon/app-catalog",
   "repository": {
@@ -45,8 +45,8 @@
     "tsyringe": "^4.10.0",
     "yaml": "^2.8.0",
     "zod": "^4.3.5",
-    "@igstack/app-catalog-shared-core": "0.4.0-alpha-20260814233321",
-    "@igstack/app-catalog-table-sync": "0.4.0-alpha-20260814233321"
+    "@igstack/app-catalog-shared-core": "0.4.0-alpha-20260817192135",
+    "@igstack/app-catalog-table-sync": "0.4.0-alpha-20260817192135"
   },
   "devDependencies": {
     "@tanstack/vite-config": "^0.4.3",
@@ -73,7 +73,7 @@
   "engines": {
     "node": ">=24"
   },
-  "gitHead": "0b1eefe32dd6b9d0d6a995120c3f26ace4e28ebe",
+  "gitHead": "3f60ebcfbc1820e1bf80298a7956fe6c432ca274",
   "scripts": {
     "build": "tsdown",
     "build:lenient": "tsdown",

package/src/__tests__/dbSchema.test.ts

@@ -3,7 +3,11 @@
  * Tests the logic that maps DB_SCHEMA env → pg pool options.
  */
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { buildPgSchemaOptions } from '../db/client'
+import {
+  buildPgSchemaOptions,
+  resolveDbSchema,
+  verifyDbSchema,
+} from '../db/client'
 
 const original = process.env.DB_SCHEMA
 
@@ -62,3 +66,64 @@ describe('DB_SCHEMA schema-per-branch isolation (#44)', () => {
     })
   })
 })
+
+describe('resolveDbSchema', () => {
+  it('is undefined when nothing configures a schema', () => {
+    expect(resolveDbSchema()).toBeUndefined()
+    expect(resolveDbSchema('')).toBeUndefined()
+  })
+
+  it('prefers DB_SCHEMA over the configured schema', () => {
+    process.env.DB_SCHEMA = 'preview_from-env'
+    expect(resolveDbSchema('public')).toBe('preview_from-env')
+  })
+
+  it('falls back to the configured schema', () => {
+    expect(resolveDbSchema('public')).toBe('public')
+  })
+})
+
+describe('verifyDbSchema fail-fast (#82)', () => {
+  const poolReturning = (schema: string | null) =>
+    ({
+      query: async () => ({ rows: [{ schema }] }),
+    }) as unknown as Parameters<typeof verifyDbSchema>[0]
+
+  it('stays quiet for a deployment with no isolation to verify', async () => {
+    await expect(
+      verifyDbSchema(poolReturning('public')),
+    ).resolves.toBeUndefined()
+  })
+
+  it('passes when the database resolves the expected schema', async () => {
+    process.env.DB_SCHEMA = 'preview_feat-my-branch'
+    await expect(
+      verifyDbSchema(poolReturning('preview_feat-my-branch')),
+    ).resolves.toBeUndefined()
+  })
+
+  it('checks a deployment isolated by config alone, without DB_SCHEMA', async () => {
+    await expect(
+      verifyDbSchema(poolReturning('public'), 'preview_feat-my-branch'),
+    ).rejects.toThrow(/current_schema\(\) to "public"/)
+  })
+
+  it('accepts the name Postgres kept when the schema is over 63 bytes', async () => {
+    // CREATE SCHEMA and search_path truncate identically, so a long branch slug
+    // is still isolated - failing it here would crash-loop a healthy preview env.
+    const long = 'preview_' + 'b'.repeat(70)
+    process.env.DB_SCHEMA = long
+    await expect(
+      verifyDbSchema(poolReturning(long.slice(0, 63))),
+    ).resolves.toBeUndefined()
+  })
+
+  it('throws when a missing schema falls the connection through to public', async () => {
+    // Postgres skips a search_path entry that does not exist, which would let a
+    // preview env quietly read and overwrite the shared catalog.
+    process.env.DB_SCHEMA = 'preview_feat-my-branch'
+    await expect(verifyDbSchema(poolReturning('public'))).rejects.toThrow(
+      /current_schema\(\) to "public"/,
+    )
+  })
+})

package/src/__tests__/dbSchemaAdapter.test.ts

@@ -0,0 +1,118 @@
+/**
+ * Regression tests for preview-env schema isolation (#82).
+ *
+ * A `search_path` on the pool is not enough: Prisma 7 driver adapters qualify
+ * every table name with the schema the adapter reports, so a preview env whose
+ * adapter reports nothing reads and writes `public` no matter what the pool's
+ * `current_schema()` says. These tests pin the schema all the way to the
+ * `PrismaPg` constructor for every core call site.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const poolCtor = vi.fn()
+const adapterCtor = vi.fn()
+
+vi.mock('pg', () => ({
+  default: {
+    Pool: class {
+      constructor(config: unknown) {
+        poolCtor(config)
+      }
+    },
+  },
+}))
+
+vi.mock('@prisma/adapter-pg', () => ({
+  PrismaPg: class {
+    constructor(pool: unknown, options: unknown) {
+      adapterCtor(pool, options)
+    }
+  },
+}))
+
+vi.mock('../generated/prisma/client', () => ({
+  PrismaClient: class {
+    $connect = vi.fn()
+    $disconnect = vi.fn()
+  },
+}))
+
+const original = process.env.DB_SCHEMA
+const originalUrl = process.env.AC_CORE_DATABASE_URL
+
+beforeEach(() => {
+  vi.resetModules()
+  poolCtor.mockClear()
+  adapterCtor.mockClear()
+  process.env.DB_SCHEMA = 'preview_feat-my-branch'
+})
+
+afterEach(() => {
+  if (original === undefined) delete process.env.DB_SCHEMA
+  else process.env.DB_SCHEMA = original
+  if (originalUrl === undefined) delete process.env.AC_CORE_DATABASE_URL
+  else process.env.AC_CORE_DATABASE_URL = originalUrl
+})
+
+const adapterSchema = () => adapterCtor.mock.calls[0]?.[1]
+const poolOptions = () =>
+  (poolCtor.mock.calls[0]?.[0] as { options?: string } | undefined)?.options
+
+describe('preview-env schema reaches the Prisma adapter (#82)', () => {
+  it('getDbClient() passes DB_SCHEMA to the adapter, not just the pool', async () => {
+    process.env.AC_CORE_DATABASE_URL = 'postgresql://u:p@h:5432/db'
+    const { getDbClient } = await import('../db/client')
+
+    getDbClient()
+
+    expect(poolOptions()).toBe('-c search_path=preview_feat-my-branch')
+    expect(adapterSchema()).toEqual({ schema: 'preview_feat-my-branch' })
+  })
+
+  it('the middleware pool - the one the app uses - carries the schema too', async () => {
+    const { AcDatabaseManager } = await import('../middleware/database')
+
+    new AcDatabaseManager({
+      host: 'h',
+      port: 5432,
+      database: 'db',
+      username: 'u',
+      password: 'p',
+      schema: 'public',
+    }).getClient()
+
+    expect(poolOptions()).toBe('-c search_path=preview_feat-my-branch')
+    expect(adapterSchema()).toEqual({ schema: 'preview_feat-my-branch' })
+  })
+
+  it('the AI tools client reads the preview schema, not the shared catalog', async () => {
+    const { createAppCatalogAITools } =
+      await import('../modules/lighthouseKeeper/tools')
+
+    createAppCatalogAITools({
+      host: 'h',
+      port: 5432,
+      database: 'db',
+      username: 'u',
+      password: 'p',
+      schema: 'public',
+    })
+
+    expect(poolOptions()).toBe('-c search_path=preview_feat-my-branch')
+    expect(adapterSchema()).toEqual({ schema: 'preview_feat-my-branch' })
+  })
+
+  it('leaves the adapter schema unset when DB_SCHEMA is not configured', async () => {
+    delete process.env.DB_SCHEMA
+    process.env.AC_CORE_DATABASE_URL = 'postgresql://u:p@h:5432/db'
+    const { getDbClient } = await import('../db/client')
+
+    getDbClient()
+
+    expect(poolOptions()).toBeUndefined()
+    // Not toEqual({ schema: undefined }) - that also passes for {}, and an
+    // explicit undefined is what keeps the adapter on its own default.
+    expect(adapterSchema()).toHaveProperty('schema', undefined)
+    expect(adapterSchema()?.schema).toBeUndefined()
+  })
+})

package/src/db/client.ts

@@ -6,24 +6,120 @@ import { buildPgSslConfig } from './sslConfig'
 let prismaClient: PrismaClient | null = null
 let pool: pg.Pool | null = null
 
+type PrismaLogOption = NonNullable<
+  ConstructorParameters<typeof PrismaClient>[0]
+>['log']
+
+/**
+ * The schema a deployment should be reading and writing.
+ *
+ * DB_SCHEMA is set per deployment, so it outranks a schema baked into the app
+ * config - otherwise a config that names `public` would pin a preview env back
+ * to the shared tables it was meant to be isolated from.
+ */
+export function resolveDbSchema(configuredSchema?: string): string | undefined {
+  return process.env.DB_SCHEMA || configuredSchema || undefined
+}
+
 /**
  * `search_path` startup options for a schema-isolated deployment.
  *
  * node-postgres ignores Prisma's `?schema=` URL parameter, so a preview env's
- * schema has to be injected as a connection option instead. Every pool that
- * talks to the core database must go through here - one that skips it silently
- * lands in `public` and reads the shared canonical tables.
+ * schema has to be injected as a connection option instead. This half covers
+ * raw SQL and the migrations; Prisma's own queries need the adapter half too,
+ * which is why every core connection goes through createCorePrismaClient.
  */
 export function buildPgSchemaOptions(configuredSchema?: string): {
   options?: string
 } {
-  // DB_SCHEMA is set per deployment, so it outranks a schema baked into the app
-  // config - otherwise a config that names `public` would pin a preview env back
-  // to the shared tables it was meant to be isolated from.
-  const schema = process.env.DB_SCHEMA || configuredSchema
+  const schema = resolveDbSchema(configuredSchema)
   return schema ? { options: `-c search_path=${schema}` } : {}
 }
 
+/**
+ * The one way to open a connection to the core database.
+ *
+ * Schema isolation takes two halves and both live here:
+ * - the pool's `search_path`, which raw SQL and the migrations follow;
+ * - the adapter's `schema`, which is what Prisma qualifies its table names
+ *   with. A client built without it emits `"public"."DbResource"` however
+ *   correct the pool's `current_schema()` is, so a preview env silently reads
+ *   and overwrites the shared canonical tables.
+ *
+ * A pool built outside this factory gets neither half, so don't build one.
+ */
+export function createCorePrismaClient(params: {
+  connectionString: string
+  configuredSchema?: string
+  log?: PrismaLogOption
+}): { client: PrismaClient; pool: pg.Pool; schema: string | undefined } {
+  const schema = resolveDbSchema(params.configuredSchema)
+  // SSL comes from PGSSLMODE/PGSSLROOTCERT via our helper (node-postgres
+  // doesn't honor those correctly for a connection-string pool - see
+  // buildPgSslConfig).
+  const ssl = buildPgSslConfig()
+  const newPool = new pg.Pool({
+    connectionString: params.connectionString,
+    ...(ssl === undefined ? {} : { ssl }),
+    ...buildPgSchemaOptions(params.configuredSchema),
+  })
+  const adapter = new PrismaPg(newPool, { schema })
+  const client = new PrismaClient({
+    adapter,
+    ...(params.log === undefined ? {} : { log: params.log }),
+  })
+  return { client, pool: newPool, schema }
+}
+
+/** Postgres NAMEDATALEN - 1: identifiers are truncated to this many bytes. */
+const PG_MAX_IDENTIFIER_BYTES = 63
+
+/**
+ * How Postgres will have stored an identifier this long.
+ *
+ * A schema name over the limit is truncated identically wherever it appears - at
+ * CREATE SCHEMA and in `search_path` alike - so the isolation still holds and
+ * current_schema() merely reports the shortened name. Comparing raw strings would
+ * fail a correctly isolated deployment, so compare what Postgres kept.
+ */
+function truncateIdentifier(name: string): string {
+  const bytes = Buffer.from(name, 'utf8')
+  if (bytes.length <= PG_MAX_IDENTIFIER_BYTES) return name
+  return bytes.subarray(0, PG_MAX_IDENTIFIER_BYTES).toString('utf8')
+}
+
+/**
+ * Fails a deployment that believes it is schema-isolated but is not.
+ *
+ * Speaks up whenever a schema was resolved at all - the same resolution feeds the
+ * pool's `search_path`, so the expectation and the connection can never disagree
+ * by construction, and a deployment that configures isolation without setting
+ * DB_SCHEMA is checked too. The case worth catching is a missing schema: Postgres
+ * silently skips a `search_path` entry that does not exist and falls through to
+ * `public`, which is the shared-catalog corruption this is here to prevent.
+ */
+export async function verifyDbSchema(
+  poolToCheck: pg.Pool,
+  configuredSchema?: string,
+): Promise<void> {
+  const resolved = resolveDbSchema(configuredSchema)
+  const result = await poolToCheck.query<{ schema: string | null }>(
+    'SELECT current_schema() AS schema',
+  )
+  const actual = result.rows[0]?.schema ?? null
+  console.log(
+    `[db] core schema: resolved=${resolved ?? '(none)'} current_schema=${actual ?? '(none)'}`,
+  )
+  if (!resolved) return
+  if (actual !== truncateIdentifier(resolved)) {
+    throw new Error(
+      `The configured schema is "${resolved}" but the database resolved current_schema() to ` +
+        `"${actual}". The schema is most likely missing, so every query would fall through to ` +
+        `the shared catalog tables. Migrate this schema before starting the app.`,
+    )
+  }
+}
+
 /**
  * Gets the internal Prisma client instance.
  * Creates one if it doesn't exist.
@@ -38,21 +134,9 @@ export function getDbClient(): PrismaClient {
       )
     }
 
-    // Prisma 7 with adapter: Create pg pool and wrap with adapter.
-    // SSL comes from PGSSLMODE/PGSSLROOTCERT via our helper (node-postgres
-    // doesn't honor those correctly for a connection-string pool — see
-    // buildPgSslConfig).
-    //
-    // Schema isolation for preview envs (#44): see buildPgSchemaOptions.
-    const ssl = buildPgSslConfig()
-    pool = new pg.Pool({
-      connectionString: databaseUrl,
-      ...(ssl === undefined ? {} : { ssl }),
-      ...buildPgSchemaOptions(),
-    })
-    const adapter = new PrismaPg(pool)
-
-    prismaClient = new PrismaClient({ adapter })
+    const created = createCorePrismaClient({ connectionString: databaseUrl })
+    pool = created.pool
+    prismaClient = created.client
   }
   return prismaClient
 }
@@ -72,6 +156,7 @@ export function setDbClient(client: PrismaClient): void {
 export async function connectDb(): Promise<void> {
   const client = getDbClient()
   await client.$connect()
+  if (pool) await verifyDbSchema(pool)
 }
 
 /**

package/src/db/index.ts

@@ -1,5 +1,14 @@
 // Database connection
-export { connectDb, disconnectDb, getDbClient, setDbClient } from './client'
+export {
+  buildPgSchemaOptions,
+  connectDb,
+  createCorePrismaClient,
+  disconnectDb,
+  getDbClient,
+  resolveDbSchema,
+  setDbClient,
+  verifyDbSchema,
+} from './client'
 export { buildPgSslConfig } from './sslConfig'
 
 // Table sync utilities

package/src/index.ts

@@ -60,14 +60,18 @@ export {
 
 // Database utilities
 export {
+  buildPgSchemaOptions,
   buildPgSslConfig,
   connectDb,
+  createCorePrismaClient,
   disconnectDb,
   getDbClient,
+  resolveDbSchema,
   setDbClient,
   syncAppCatalog,
   TABLE_SYNC_MAGAZINE,
   tableSyncPrisma,
+  verifyDbSchema,
   type MakeTFromPrismaModel,
   type ObjectKeys,
   type ScalarFilter,

package/src/middleware/database.ts

@@ -1,9 +1,11 @@
-import { PrismaClient } from '../generated/prisma/client'
-import { PrismaPg } from '@prisma/adapter-pg'
-import pg from 'pg'
+import type { PrismaClient } from '../generated/prisma/client'
+import type pg from 'pg'
 import type { AcDatabaseConfig } from './types'
-import { buildPgSchemaOptions, setDbClient } from '../db/client'
-import { buildPgSslConfig } from '../db/sslConfig'
+import {
+  createCorePrismaClient,
+  setDbClient,
+  verifyDbSchema,
+} from '../db/client'
 
 /**
  * Formats a database connection URL from structured config.
@@ -36,31 +38,19 @@ export class AcDatabaseManager {
    */
   getClient(): PrismaClient {
     if (!this.client) {
-      const datasourceUrl = formatConnectionUrl(this.config)
-
-      // Prisma 7 with adapter: Create pg pool and wrap with adapter.
-      // SSL from PGSSLMODE/PGSSLROOTCERT via buildPgSslConfig (node-postgres
-      // doesn't apply those correctly to a connection-string pool).
-      // This pool - not getDbClient()'s - is the one the app ends up using, so
-      // the preview-env schema has to be applied here as well. The `?schema=`
-      // in datasourceUrl is inert: node-postgres drops unknown URL params.
-      const ssl = buildPgSslConfig()
-      this.pool = new pg.Pool({
-        connectionString: datasourceUrl,
-        ...(ssl === undefined ? {} : { ssl }),
-        ...buildPgSchemaOptions(
-          'url' in this.config ? undefined : this.config.schema,
-        ),
-      })
-      const adapter = new PrismaPg(this.pool)
-
-      this.client = new PrismaClient({
-        adapter,
+      // This client - not getDbClient()'s - is the one the app ends up using.
+      // The `?schema=` in the url is inert (node-postgres drops unknown URL
+      // params), so the schema has to travel via createCorePrismaClient.
+      const created = createCorePrismaClient({
+        connectionString: formatConnectionUrl(this.config),
+        configuredSchema: this.configuredSchema(),
         log:
           process.env.NODE_ENV === 'development'
             ? ['warn', 'error']
             : ['warn', 'error'],
       })
+      this.pool = created.pool
+      this.client = created.client
 
       // Bridge with existing backend-core getDbClient() usage
       setDbClient(this.client)
@@ -71,6 +61,7 @@ export class AcDatabaseManager {
   async connect(): Promise<void> {
     const client = this.getClient()
     await client.$connect()
+    if (this.pool) await verifyDbSchema(this.pool, this.configuredSchema())
   }
 
   async disconnect(): Promise<void> {
@@ -83,4 +74,8 @@ export class AcDatabaseManager {
       this.pool = null
     }
   }
+
+  private configuredSchema(): string | undefined {
+    return 'url' in this.config ? undefined : this.config.schema
+  }
 }

package/src/modules/admin/chat/createDatabaseTools.ts

@@ -37,7 +37,11 @@ export function createPrismaDatabaseClient(prisma: {
     },
     getTables: async () => {
       const tables = await prisma.$queryRawUnsafe<{ tablename: string }[]>(
-        `SELECT tablename FROM pg_tables WHERE schemaname = 'public'`,
+        // current_schema() - not a hardcoded 'public' - because the DML these
+        // tools go on to run is unqualified and therefore resolves through
+        // search_path. A schema-isolated deployment would otherwise be told
+        // about tables it cannot see.
+        `SELECT tablename FROM pg_tables WHERE schemaname = current_schema()`,
       )
       return tables.map((t) => t.tablename)
     },
@@ -51,7 +55,7 @@ export function createPrismaDatabaseClient(prisma: {
       >(
         `SELECT column_name, data_type, is_nullable
          FROM information_schema.columns
-         WHERE table_name = '${tableName}' AND table_schema = 'public'`,
+         WHERE table_name = '${tableName}' AND table_schema = current_schema()`,
       )
       return columns.map((c) => ({
         name: c.column_name,

package/src/modules/lighthouseKeeper/tools.ts

@@ -1,8 +1,6 @@
 import type { Tool } from 'ai'
 import { z } from 'zod'
-import { PrismaClient } from '../../generated/prisma/client'
-import { PrismaPg } from '@prisma/adapter-pg'
-import pg from 'pg'
+import { createCorePrismaClient } from '../../db/client'
 import type { AcDatabaseConfig } from '../../middleware/types.js'
 
 // ============================================================================
@@ -27,10 +25,11 @@ function getDatabaseUrl(config: AcDatabaseConfig): string {
 export function createAppCatalogAITools(
   databaseConfig: AcDatabaseConfig,
 ): Record<string, Tool> {
-  const databaseUrl = getDatabaseUrl(databaseConfig)
-  const pool = new pg.Pool({ connectionString: databaseUrl })
-  const adapter = new PrismaPg(pool)
-  const prisma = new PrismaClient({ adapter })
+  const { client: prisma } = createCorePrismaClient({
+    connectionString: getDatabaseUrl(databaseConfig),
+    configuredSchema:
+      'url' in databaseConfig ? undefined : databaseConfig.schema,
+  })
 
   const getAppCardSchema = z.object({
     slug: z.string().describe('The app slug to fetch'),