@pgpmjs/portability 0.1.0

package/LICENSE

@@ -0,0 +1,23 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 Dan Lynch <pyramation@gmail.com>
+Copyright (c) 2025 Constructive <developers@constructive.io>
+Copyright (c) 2020-present, Interweb, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,125 @@
+# @pgpmjs/portability
+
+Vendor portability for pgpm: move packages between vendor-managed PostgreSQL
+environments (Supabase, InsForge, ...) and plain PostgreSQL/pgpm — and test the
+result with `pgsql-test`.
+
+## Seed adapter
+
+Deploy a workspace target (typically an apply proxy carrying `pgpm.apply.json`)
+into a test database, through the same engine path as `pgpm deploy`:
+
+```ts
+import { getConnections } from 'pgsql-test';
+import { seed } from '@pgpmjs/portability';
+
+const { pg, teardown } = await getConnections({}, [
+  seed.apply('vendor-app-ported')
+]);
+```
+
+The workspace is discovered from the test's cwd; dependencies resolve from the
+workspace module map; proxy modules transpile and materialize through the
+apply path.
+
+## Vendor shapes
+
+A `VendorShape` describes a vendor's managed subsystems (auth schemas, roles,
+extensions schema, users table, accessor functions). Build routing profiles in
+either direction from a shape plus a provider binding:
+
+```ts
+import { fromVendorProfile, supabase, toVendorProfile } from '@pgpmjs/portability';
+
+const provider = {
+  schema: 'app_auth',
+  users: 'users',
+  accessors: { uid: 'current_user_id' },
+  roles: { authenticated: 'app_authenticated' }
+};
+
+// vendor → pgpm: exclude the vendor auth subsystem, rebind onto the provider,
+// de-qualify extension symbols, translate roles
+const off = fromVendorProfile(supabase, provider);
+
+// pgpm → vendor: the inverse — rebind onto the native subsystem, qualify
+// extension symbols, translate roles back
+const on = toVendorProfile(supabase, provider);
+```
+
+The resulting `PgpmRoutingProfile` drops into a workspace `portability` block
+or a proxy module's `pgpm.apply.json`.
+
+---
+
+## Education and Tutorials
+
+ 1. 🚀 [Quickstart: Getting Up and Running](https://constructive.io/learn/quickstart)
+Get started with modular databases in minutes. Install prerequisites and deploy your first module.
+
+ 2. 📦 [Modular PostgreSQL Development with Database Packages](https://constructive.io/learn/modular-postgres)
+Learn to organize PostgreSQL projects with pgpm workspaces and reusable database modules.
+
+ 3. ✏️ [Authoring Database Changes](https://constructive.io/learn/authoring-database-changes)
+Master the workflow for adding, organizing, and managing database changes with pgpm.
+
+ 4. 🧪 [End-to-End PostgreSQL Testing with TypeScript](https://constructive.io/learn/e2e-postgres-testing)
+Master end-to-end PostgreSQL testing with ephemeral databases, RLS testing, and CI/CD automation.
+
+ 5. ⚡ [Supabase Testing](https://constructive.io/learn/supabase)
+Use TypeScript-first tools to test Supabase projects with realistic RLS, policies, and auth contexts.
+
+ 6. 💧 [Drizzle ORM Testing](https://constructive.io/learn/drizzle-testing)
+Run full-stack tests with Drizzle ORM, including database setup, teardown, and RLS enforcement.
+
+ 7. 🔧 [Troubleshooting](https://constructive.io/learn/troubleshooting)
+Common issues and solutions for pgpm, PostgreSQL, and testing.
+
+## Related Constructive Tooling
+
+### 📦 Package Management
+
+* [pgpm](https://github.com/constructive-io/constructive/tree/main/pgpm/pgpm): **🖥️ PostgreSQL Package Manager** for modular Postgres development. Works with database workspaces, scaffolding, migrations, seeding, and installing database packages.
+
+### 🧪 Testing
+
+* [pgsql-test](https://github.com/constructive-io/constructive/tree/main/postgres/pgsql-test): **📊 Isolated testing environments** with per-test transaction rollbacks—ideal for integration tests, complex migrations, and RLS simulation.
+* [pglite-test](https://github.com/constructive-io/constructive/tree/main/postgres/pglite-test): **🪶 Drop-in pgsql-test replacement backed by PGlite** — in-process Postgres, no server required, instance-per-suite isolation.
+* [pgsql-seed](https://github.com/constructive-io/constructive/tree/main/postgres/pgsql-seed): **🌱 PostgreSQL seeding utilities** for CSV, JSON, SQL data loading, and pgpm deployment.
+* [supabase-test](https://github.com/constructive-io/constructive/tree/main/postgres/supabase-test): **🧪 Supabase-native test harness** preconfigured for the local Supabase stack—per-test rollbacks, JWT/role context helpers, and CI/GitHub Actions ready.
+* [graphile-test](https://github.com/constructive-io/constructive/tree/main/graphile/graphile-test): **🔐 Authentication mocking** for Graphile-focused test helpers and emulating row-level security contexts.
+* [pg-query-context](https://github.com/constructive-io/constructive/tree/main/postgres/pg-query-context): **🔒 Session context injection** to add session-local context (e.g., `SET LOCAL`) into queries—ideal for setting `role`, `jwt.claims`, and other session settings.
+
+### 🧠 Parsing & AST
+
+* [pgsql-parser](https://www.npmjs.com/package/pgsql-parser): **🔄 SQL conversion engine** that interprets and converts PostgreSQL syntax.
+* [libpg-query-node](https://www.npmjs.com/package/libpg-query): **🌉 Node.js bindings** for `libpg_query`, converting SQL into parse trees.
+* [pg-proto-parser](https://www.npmjs.com/package/pg-proto-parser): **📦 Protobuf parser** for parsing PostgreSQL Protocol Buffers definitions to generate TypeScript interfaces, utility functions, and JSON mappings for enums.
+* [@pgsql/enums](https://www.npmjs.com/package/@pgsql/enums): **🏷️ TypeScript enums** for PostgreSQL AST for safe and ergonomic parsing logic.
+* [@pgsql/types](https://www.npmjs.com/package/@pgsql/types): **📝 Type definitions** for PostgreSQL AST nodes in TypeScript.
+* [@pgsql/utils](https://www.npmjs.com/package/@pgsql/utils): **🛠️ AST utilities** for constructing and transforming PostgreSQL syntax trees.
+
+### 📚 Documentation & Skills
+
+* [constructive-skills](https://github.com/constructive-io/constructive-skills): **📖 Platform documentation and AI agent skills** — feature catalog, blueprint reference, SDK guides (i18n, billing, limits, events, uploads, security, entities, search, AI), and deployment guides.
+
+Install skills for AI coding agents:
+
+```bash
+# All platform skills (security, blueprints, codegen, billing, etc.)
+npx skills add constructive-io/constructive-skills
+
+# Individual repo skills (pgpm, testing, CLI, search, etc.)
+npx skills add https://github.com/constructive-io/constructive --skill pgpm
+npx skills add https://github.com/constructive-io/constructive --skill constructive-testing
+```
+
+## Credits
+
+**🛠 Built by the [Constructive](https://constructive.io) team — creators of modular Postgres tooling for secure, composable backends. If you like our work, contribute on [GitHub](https://github.com/constructive-io).**
+
+## Disclaimer
+
+AS DESCRIBED IN THE LICENSES, THE SOFTWARE IS PROVIDED "AS IS", AT YOUR OWN RISK, AND WITHOUT WARRANTIES OF ANY KIND.
+
+No developer or entity involved in creating this software will be liable for any claims or damages whatsoever associated with your use, inability to use, or your interaction with other users of the code, including any direct, indirect, incidental, special, exemplary, punitive or consequential damages, or loss of profits, cryptocurrencies, tokens, or anything else of value.

package/esm/index.js

@@ -0,0 +1,2 @@
+export { apply, seed } from './seed';
+export { fromVendorProfile, insforge, supabase, toVendorProfile } from './shapes';

package/esm/seed.js

@@ -0,0 +1,29 @@
+import { PgpmPackage } from '@pgpmjs/core';
+import { getEnvOptions } from '@pgpmjs/env';
+/**
+ * Deploy a named workspace target — typically an apply proxy (a directory
+ * carrying `pgpm.apply.json`) — into the test database, exactly as a
+ * production `pgpm deploy <target>` would: the workspace is discovered from
+ * the test's cwd, dependencies resolve from the workspace module map, and
+ * proxy modules transpile/materialize through the engine's apply path.
+ *
+ * ```ts
+ * getConnections({}, [seed.apply('vendor-app-ported')]);
+ * ```
+ */
+export function apply(target, options = {}) {
+    return {
+        async seed(ctx) {
+            const workspace = new PgpmPackage(options.cwd ?? ctx.connect.cwd ?? process.cwd());
+            await workspace.deploy(getEnvOptions({
+                pg: ctx.config,
+                deployment: {
+                    fast: true,
+                    usePlan: true,
+                    cache: options.cache ?? false
+                }
+            }), target);
+        }
+    };
+}
+export const seed = { apply };

package/esm/shapes.js

@@ -0,0 +1,102 @@
+/** Supabase: `auth` subsystem, `extensions` schema, `auth.uid()`/`auth.role()`. */
+export const supabase = {
+    vendor: 'supabase',
+    authSchemas: ['auth'],
+    extensionsSchema: 'extensions',
+    roles: ['anon', 'authenticated', 'service_role'],
+    users: { schema: 'auth', kind: 'table', name: 'users' },
+    accessors: [
+        { schema: 'auth', kind: 'function', name: 'uid' },
+        { schema: 'auth', kind: 'function', name: 'role' }
+    ]
+};
+/** InsForge: `auth` subsystem with `auth.users`, roles on the default search path. */
+export const insforge = {
+    vendor: 'insforge',
+    authSchemas: ['auth'],
+    extensionsSchema: null,
+    roles: ['anon', 'authenticated', 'project_admin'],
+    users: { schema: 'auth', kind: 'table', name: 'users' },
+    accessors: []
+};
+function routesFor(shape, provider, invert) {
+    const routes = [];
+    if (invert && provider.schema === null && (provider.users || provider.accessors)) {
+        throw new Error(`toVendorProfile(${shape.vendor}): provider objects must live in a named schema ` +
+            `to be routed back onto the vendor (provider.schema is null)`);
+    }
+    if (shape.users && provider.users) {
+        routes.push(invert
+            ? {
+                fromSchema: provider.schema,
+                kind: shape.users.kind,
+                name: provider.users,
+                toSchema: shape.users.schema,
+                ...(provider.users !== shape.users.name ? { toName: shape.users.name } : {})
+            }
+            : {
+                fromSchema: shape.users.schema,
+                kind: shape.users.kind,
+                name: shape.users.name,
+                toSchema: provider.schema,
+                ...(provider.users !== shape.users.name ? { toName: provider.users } : {})
+            });
+    }
+    for (const accessor of shape.accessors) {
+        const target = provider.accessors?.[accessor.name];
+        if (!target)
+            continue;
+        routes.push(invert
+            ? {
+                fromSchema: provider.schema,
+                kind: accessor.kind,
+                name: target,
+                toSchema: accessor.schema,
+                ...(target !== accessor.name ? { toName: accessor.name } : {})
+            }
+            : {
+                fromSchema: accessor.schema,
+                kind: accessor.kind,
+                name: accessor.name,
+                toSchema: provider.schema,
+                ...(target !== accessor.name ? { toName: target } : {})
+            });
+    }
+    return routes;
+}
+function invertRoles(roles) {
+    if (!roles)
+        return undefined;
+    return Object.fromEntries(Object.entries(roles).map(([from, to]) => [to, from]));
+}
+/**
+ * Routing profile for moving a package *off* a vendor onto plain
+ * PostgreSQL/pgpm: exclude the vendor's auth subsystem, rebind the users FK
+ * and accessor calls onto the substitute provider, de-qualify (or re-route)
+ * extension symbols, and translate role names.
+ */
+export function fromVendorProfile(shape, provider) {
+    return {
+        exclude: { schemas: [...shape.authSchemas] },
+        route: routesFor(shape, provider, false),
+        ...(shape.extensionsSchema
+            ? { extensions: { toSchema: null, from: [shape.extensionsSchema] } }
+            : {}),
+        ...(provider.roles ? { roles: { ...provider.roles } } : {})
+    };
+}
+/**
+ * The inverse of {@link fromVendorProfile}: move a pgpm-shaped package *onto*
+ * the vendor's native subsystem — rebind the provider's objects back onto the
+ * vendor's, qualify extension symbols into the vendor's extensions schema,
+ * and translate roles back to the vendor's names.
+ */
+export function toVendorProfile(shape, provider) {
+    return {
+        route: routesFor(shape, provider, true),
+        ...(shape.extensionsSchema
+            ? { extensions: { toSchema: shape.extensionsSchema, from: [null] } }
+            : {}),
+        ...(provider.roles ? { roles: invertRoles(provider.roles) } : {})
+    };
+}

package/index.d.ts

@@ -0,0 +1,4 @@
+export type { ApplySeedAdapter, ApplySeedContext, ApplySeedOptions } from './seed';
+export { apply, seed } from './seed';
+export type { ProviderBinding, VendorObjectRef, VendorShape } from './shapes';
+export { fromVendorProfile, insforge, supabase, toVendorProfile } from './shapes';

package/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toVendorProfile = exports.supabase = exports.insforge = exports.fromVendorProfile = exports.seed = exports.apply = void 0;
+var seed_1 = require("./seed");
+Object.defineProperty(exports, "apply", { enumerable: true, get: function () { return seed_1.apply; } });
+Object.defineProperty(exports, "seed", { enumerable: true, get: function () { return seed_1.seed; } });
+var shapes_1 = require("./shapes");
+Object.defineProperty(exports, "fromVendorProfile", { enumerable: true, get: function () { return shapes_1.fromVendorProfile; } });
+Object.defineProperty(exports, "insforge", { enumerable: true, get: function () { return shapes_1.insforge; } });
+Object.defineProperty(exports, "supabase", { enumerable: true, get: function () { return shapes_1.supabase; } });
+Object.defineProperty(exports, "toVendorProfile", { enumerable: true, get: function () { return shapes_1.toVendorProfile; } });

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@pgpmjs/portability",
+  "version": "0.1.0",
+  "author": "Constructive <developers@constructive.io>",
+  "description": "Vendor portability for pgpm — vendor shape profiles (supabase, insforge, ...) and pgsql-test seed adapters for deploying apply/transpile targets",
+  "main": "index.js",
+  "module": "esm/index.js",
+  "types": "index.d.ts",
+  "homepage": "https://github.com/constructive-io/constructive",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "directory": "dist"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/constructive-io/constructive"
+  },
+  "bugs": {
+    "url": "https://github.com/constructive-io/constructive/issues"
+  },
+  "scripts": {
+    "clean": "makage clean",
+    "prepack": "npm run build",
+    "build": "makage build",
+    "build:dev": "makage build --dev",
+    "lint": "eslint . --fix",
+    "test": "jest",
+    "test:watch": "jest --watch"
+  },
+  "keywords": [
+    "sql",
+    "postgres",
+    "postgresql",
+    "pgpm",
+    "pgpmjs",
+    "portability",
+    "supabase",
+    "insforge",
+    "migration",
+    "transpile"
+  ],
+  "devDependencies": {
+    "makage": "^0.3.0",
+    "pgsql-test": "^5.8.7"
+  },
+  "dependencies": {
+    "@pgpmjs/core": "^7.18.0",
+    "@pgpmjs/env": "^2.39.2",
+    "@pgpmjs/types": "^2.48.1",
+    "pg-env": "^1.26.1"
+  },
+  "gitHead": "04b34ce4b5efcebfd8e49d64d196e651288d97f3"
+}

package/seed.d.ts

@@ -0,0 +1,40 @@
+import type { PgConfig } from 'pg-env';
+/**
+ * The slice of pgsql-test's `SeedContext` the portability adapters need.
+ * Structural, so the adapters plug into `getConnections(_, [seed.apply(...)])`
+ * without this package depending on pgsql-test.
+ */
+export interface ApplySeedContext {
+    config: PgConfig;
+    connect: {
+        cwd?: string;
+    };
+}
+/** Structurally compatible with pgsql-test's `SeedAdapter`. */
+export interface ApplySeedAdapter {
+    seed(ctx: ApplySeedContext): Promise<void>;
+}
+export interface ApplySeedOptions {
+    /** Enable pgpm's deployment cache. */
+    cache?: boolean;
+    /**
+     * Directory to discover the workspace from. Defaults to the test's cwd —
+     * the workspace root is found automatically by walking up from it.
+     */
+    cwd?: string;
+}
+/**
+ * Deploy a named workspace target — typically an apply proxy (a directory
+ * carrying `pgpm.apply.json`) — into the test database, exactly as a
+ * production `pgpm deploy <target>` would: the workspace is discovered from
+ * the test's cwd, dependencies resolve from the workspace module map, and
+ * proxy modules transpile/materialize through the engine's apply path.
+ *
+ * ```ts
+ * getConnections({}, [seed.apply('vendor-app-ported')]);
+ * ```
+ */
+export declare function apply(target: string, options?: ApplySeedOptions): ApplySeedAdapter;
+export declare const seed: {
+    apply: typeof apply;
+};

package/seed.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.seed = void 0;
+exports.apply = apply;
+const core_1 = require("@pgpmjs/core");
+const env_1 = require("@pgpmjs/env");
+/**
+ * Deploy a named workspace target — typically an apply proxy (a directory
+ * carrying `pgpm.apply.json`) — into the test database, exactly as a
+ * production `pgpm deploy <target>` would: the workspace is discovered from
+ * the test's cwd, dependencies resolve from the workspace module map, and
+ * proxy modules transpile/materialize through the engine's apply path.
+ *
+ * ```ts
+ * getConnections({}, [seed.apply('vendor-app-ported')]);
+ * ```
+ */
+function apply(target, options = {}) {
+    return {
+        async seed(ctx) {
+            const workspace = new core_1.PgpmPackage(options.cwd ?? ctx.connect.cwd ?? process.cwd());
+            await workspace.deploy((0, env_1.getEnvOptions)({
+                pg: ctx.config,
+                deployment: {
+                    fast: true,
+                    usePlan: true,
+                    cache: options.cache ?? false
+                }
+            }), target);
+        }
+    };
+}
+exports.seed = { apply };

package/shapes.d.ts

@@ -0,0 +1,69 @@
+import { PgpmRouteKind, PgpmRoutingProfile } from '@pgpmjs/types';
+/** A vendor-owned object that portable SQL may reference. */
+export interface VendorObjectRef {
+    schema: string;
+    kind: PgpmRouteKind;
+    name: string;
+}
+/**
+ * A vendor's database shape: the schemas, roles, and objects its managed
+ * subsystems own — the "weirdnesses" a package must be translated across when
+ * it moves between the vendor and a plain-PostgreSQL/pgpm environment.
+ */
+export interface VendorShape {
+    /** Vendor identifier (e.g. `supabase`). */
+    vendor: string;
+    /**
+     * Schemas owned by the vendor's managed auth subsystem. Moving *off* the
+     * vendor excludes these and substitutes a provider; moving *onto* the
+     * vendor rebinds onto the native subsystem.
+     */
+    authSchemas: string[];
+    /**
+     * Schema the vendor installs extensions into (`null`: extensions live on
+     * the default `search_path`, no qualification).
+     */
+    extensionsSchema: string | null;
+    /** The vendor's application-facing role names. */
+    roles: string[];
+    /** The vendor's canonical users table, the usual FK target. */
+    users?: VendorObjectRef;
+    /**
+     * Auth accessor functions application SQL calls (e.g. `auth.uid()`),
+     * which must be rebound onto the substitute provider's equivalents.
+     */
+    accessors: VendorObjectRef[];
+}
+/** Supabase: `auth` subsystem, `extensions` schema, `auth.uid()`/`auth.role()`. */
+export declare const supabase: VendorShape;
+/** InsForge: `auth` subsystem with `auth.users`, roles on the default search path. */
+export declare const insforge: VendorShape;
+/**
+ * How a substitute provider binds a vendor's auth surface: where the
+ * provider's objects live and which of its objects replace each vendor
+ * object. Used in both directions — the inverse binding round-trips.
+ */
+export interface ProviderBinding {
+    /** Schema the provider's objects live in (`null`: unqualified). */
+    schema: string | null;
+    /** Provider's users-table name replacing the vendor users table. */
+    users?: string;
+    /** Vendor accessor name → provider function name (e.g. `uid` → `current_user_id`). */
+    accessors?: Record<string, string>;
+    /** Vendor role name → target role name. */
+    roles?: Record<string, string>;
+}
+/**
+ * Routing profile for moving a package *off* a vendor onto plain
+ * PostgreSQL/pgpm: exclude the vendor's auth subsystem, rebind the users FK
+ * and accessor calls onto the substitute provider, de-qualify (or re-route)
+ * extension symbols, and translate role names.
+ */
+export declare function fromVendorProfile(shape: VendorShape, provider: ProviderBinding): PgpmRoutingProfile;
+/**
+ * The inverse of {@link fromVendorProfile}: move a pgpm-shaped package *onto*
+ * the vendor's native subsystem — rebind the provider's objects back onto the
+ * vendor's, qualify extension symbols into the vendor's extensions schema,
+ * and translate roles back to the vendor's names.
+ */
+export declare function toVendorProfile(shape: VendorShape, provider: ProviderBinding): PgpmRoutingProfile;

package/shapes.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.insforge = exports.supabase = void 0;
+exports.fromVendorProfile = fromVendorProfile;
+exports.toVendorProfile = toVendorProfile;
+/** Supabase: `auth` subsystem, `extensions` schema, `auth.uid()`/`auth.role()`. */
+exports.supabase = {
+    vendor: 'supabase',
+    authSchemas: ['auth'],
+    extensionsSchema: 'extensions',
+    roles: ['anon', 'authenticated', 'service_role'],
+    users: { schema: 'auth', kind: 'table', name: 'users' },
+    accessors: [
+        { schema: 'auth', kind: 'function', name: 'uid' },
+        { schema: 'auth', kind: 'function', name: 'role' }
+    ]
+};
+/** InsForge: `auth` subsystem with `auth.users`, roles on the default search path. */
+exports.insforge = {
+    vendor: 'insforge',
+    authSchemas: ['auth'],
+    extensionsSchema: null,
+    roles: ['anon', 'authenticated', 'project_admin'],
+    users: { schema: 'auth', kind: 'table', name: 'users' },
+    accessors: []
+};
+function routesFor(shape, provider, invert) {
+    const routes = [];
+    if (invert && provider.schema === null && (provider.users || provider.accessors)) {
+        throw new Error(`toVendorProfile(${shape.vendor}): provider objects must live in a named schema ` +
+            `to be routed back onto the vendor (provider.schema is null)`);
+    }
+    if (shape.users && provider.users) {
+        routes.push(invert
+            ? {
+                fromSchema: provider.schema,
+                kind: shape.users.kind,
+                name: provider.users,
+                toSchema: shape.users.schema,
+                ...(provider.users !== shape.users.name ? { toName: shape.users.name } : {})
+            }
+            : {
+                fromSchema: shape.users.schema,
+                kind: shape.users.kind,
+                name: shape.users.name,
+                toSchema: provider.schema,
+                ...(provider.users !== shape.users.name ? { toName: provider.users } : {})
+            });
+    }
+    for (const accessor of shape.accessors) {
+        const target = provider.accessors?.[accessor.name];
+        if (!target)
+            continue;
+        routes.push(invert
+            ? {
+                fromSchema: provider.schema,
+                kind: accessor.kind,
+                name: target,
+                toSchema: accessor.schema,
+                ...(target !== accessor.name ? { toName: accessor.name } : {})
+            }
+            : {
+                fromSchema: accessor.schema,
+                kind: accessor.kind,
+                name: accessor.name,
+                toSchema: provider.schema,
+                ...(target !== accessor.name ? { toName: target } : {})
+            });
+    }
+    return routes;
+}
+function invertRoles(roles) {
+    if (!roles)
+        return undefined;
+    return Object.fromEntries(Object.entries(roles).map(([from, to]) => [to, from]));
+}
+/**
+ * Routing profile for moving a package *off* a vendor onto plain
+ * PostgreSQL/pgpm: exclude the vendor's auth subsystem, rebind the users FK
+ * and accessor calls onto the substitute provider, de-qualify (or re-route)
+ * extension symbols, and translate role names.
+ */
+function fromVendorProfile(shape, provider) {
+    return {
+        exclude: { schemas: [...shape.authSchemas] },
+        route: routesFor(shape, provider, false),
+        ...(shape.extensionsSchema
+            ? { extensions: { toSchema: null, from: [shape.extensionsSchema] } }
+            : {}),
+        ...(provider.roles ? { roles: { ...provider.roles } } : {})
+    };
+}
+/**
+ * The inverse of {@link fromVendorProfile}: move a pgpm-shaped package *onto*
+ * the vendor's native subsystem — rebind the provider's objects back onto the
+ * vendor's, qualify extension symbols into the vendor's extensions schema,
+ * and translate roles back to the vendor's names.
+ */
+function toVendorProfile(shape, provider) {
+    return {
+        route: routesFor(shape, provider, true),
+        ...(shape.extensionsSchema
+            ? { extensions: { toSchema: shape.extensionsSchema, from: [null] } }
+            : {}),
+        ...(provider.roles ? { roles: invertRoles(provider.roles) } : {})
+    };
+}