@porulle/core 0.64.0 → 0.65.0

package/src/modules/webhooks/service.ts

@@ -5,48 +5,7 @@ import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/err
 import { Err, Ok, type Result } from "../../kernel/result.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
 import type { WebhooksRepository, WebhookEndpoint } from "./repository/index.js";
-
-/**
- * Checks whether a URL points to a private/internal IP address.
- * Blocks: loopback (127.x), link-local (169.254.x), private (10.x, 172.16-31.x, 192.168.x),
- * cloud metadata (169.254.169.254, metadata.google.internal), and localhost.
- */
-function isPrivateUrl(urlStr: string): boolean {
-  try {
-    const parsed = new URL(urlStr);
-    // Strip IPv6 brackets: URL.hostname returns "[::1]" not "::1"
-    const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
-
-    // Loopback (IPv4 + IPv6)
-    if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1") return true;
-    if (hostname.endsWith(".localhost")) return true;
-
-    // IPv6 loopback and link-local patterns
-    if (hostname.startsWith("::ffff:")) return true; // IPv6-mapped IPv4 (e.g., ::ffff:127.0.0.1)
-    if (hostname.startsWith("fe80:")) return true;   // IPv6 link-local
-    if (hostname === "::") return true;               // Unspecified address
-
-    // Cloud metadata endpoints
-    if (hostname === "169.254.169.254") return true;
-    if (hostname === "metadata.google.internal") return true;
-
-    // Private IP ranges (RFC 1918 + link-local)
-    const parts = hostname.split(".").map(Number);
-    if (parts.length === 4 && parts.every((n) => !isNaN(n))) {
-      const [a, b] = parts;
-      if (a === 10) return true;
-      if (a === 172 && b !== undefined && b >= 16 && b <= 31) return true;
-      if (a === 192 && b === 168) return true;
-      if (a === 169 && b === 254) return true;
-      if (a === 127) return true;   // Full 127.0.0.0/8 range
-      if (a === 0) return true;
-    }
-
-    return false;
-  } catch {
-    return true; // Invalid URLs are blocked
-  }
-}
+import { isPrivateUrl } from "./ssrf-guard.js";
 
 interface WebhookServiceDeps {
   repository: WebhooksRepository;

package/src/runtime/commerce.ts

@@ -3,8 +3,7 @@ import type { CommerceConfig } from "../config/types.js";
 import type { Kernel } from "./kernel.js";
 import { createKernel } from "./kernel.js";
 import { pushSchema } from "../kernel/database/migrate.js";
-import { ensureDefaultOrg, setBootDefaultOrgId } from "../auth/org.js";
-import { setBootStrictOrgResolution } from "../auth/strict-org-resolution.js";
+import { ensureDefaultOrg } from "../auth/org.js";
 import { createAuth, type AuthInstance } from "../auth/setup.js";
 import { createLogger, type Logger } from "./logger.js";
 import { createLocalAPI, type CommerceLocalAPI, type LocalAPIOptions } from "../kernel/local-api.js";
@@ -132,15 +131,9 @@ export async function createCommerce(
     await pushSchema(kernel.database.db, config);
   }
 
-  setBootStrictOrgResolution(config.auth?.strictOrgResolution === true);
-
-  // Register the config-driven org ID so resolveOrgId() can use it
-  // without requiring every service to have config access.
-  if (config.auth?.defaultOrganizationId) {
-    setBootDefaultOrgId(config.auth.defaultOrganizationId);
-  } else {
-    // Legacy fallback: auto-create org_default for deployments
-    // that haven't migrated to seed-based org creation yet.
+  // createKernel registered a configured default organization; without one,
+  // create org_default for deployments that have not seeded their own.
+  if (!config.auth?.defaultOrganizationId) {
     await ensureDefaultOrg(kernel.database.db, config.storeName);
   }
 

package/src/runtime/kernel-modules.ts

@@ -1,70 +1,194 @@
-import type { AppModule } from "../kernel/module/index.js";
-import { topoSortModules } from "../kernel/module/index.js";
-import { auditModule } from "../modules/audit/index.js";
-import { analyticsModule } from "../modules/analytics/module.js";
-import { cartModule } from "../modules/cart/module.js";
-import { catalogModule } from "../modules/catalog/module.js";
-import { customersModule } from "../modules/customers/index.js";
-import { documentsModule } from "../modules/documents/module.js";
-import { fulfillmentModule } from "../modules/fulfillment/module.js";
-import { inventoryModule } from "../modules/inventory/module.js";
-import { mediaModule } from "../modules/media/index.js";
-import { ordersModule } from "../modules/orders/module.js";
-import { organizationModule } from "../modules/organization/index.js";
-import { paymentsModule } from "../modules/payments/module.js";
-import { pricingModule } from "../modules/pricing/index.js";
-import { promotionsModule } from "../modules/promotions/module.js";
-import { searchModule } from "../modules/search/module.js";
-import { settingsModule } from "../modules/settings/module.js";
-import { shippingModule } from "../modules/shipping/module.js";
-import { taxModule } from "../modules/tax/module.js";
-import { webhooksModule } from "../modules/webhooks/index.js";
+import type { CommerceConfig } from "../config/types.js";
+import type { DatabaseAdapter } from "../kernel/database/adapter.js";
+import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
+import type { PluginDb } from "../kernel/database/plugin-types.js";
+import type { HookRegistry } from "../kernel/hooks/registry.js";
+import { extendOrderStateMachine } from "../kernel/state-machine/machine.js";
+import { DrizzleAnalyticsAdapter } from "../modules/analytics/drizzle-adapter.js";
+import { BUILTIN_ANALYTICS_MODELS } from "../modules/analytics/models.js";
+import { RetailReportsEngine } from "../modules/analytics/reports.js";
+import { AnalyticsService } from "../modules/analytics/service.js";
+import { createAuditService } from "../modules/audit/service.js";
+import { CartRepository } from "../modules/cart/repository/index.js";
+import { CartService } from "../modules/cart/service.js";
+import { CatalogRepository } from "../modules/catalog/repository/index.js";
+import { CatalogServiceImpl } from "../modules/catalog/service.js";
+import { CustomersRepository } from "../modules/customers/repository/index.js";
+import { CustomerService } from "../modules/customers/service.js";
+import { DocumentsRepository } from "../modules/documents/repository/index.js";
+import { DocumentsService } from "../modules/documents/service.js";
+import { FulfillmentRepository } from "../modules/fulfillment/repository/index.js";
+import { FulfillmentService } from "../modules/fulfillment/service.js";
+import { InventoryRepository } from "../modules/inventory/repository/index.js";
+import { InventoryService } from "../modules/inventory/service.js";
+import { MediaRepository } from "../modules/media/repository/index.js";
+import { MediaService } from "../modules/media/service.js";
+import { OrdersRepository } from "../modules/orders/repository/index.js";
+import { OrderService } from "../modules/orders/service.js";
+import { OrganizationService } from "../modules/organization/service.js";
+import { PaymentsService } from "../modules/payments/service.js";
+import { PricingRepository } from "../modules/pricing/repository/index.js";
+import { PricingService } from "../modules/pricing/service.js";
+import { PromotionsRepository } from "../modules/promotions/repository/index.js";
+import { PromotionService } from "../modules/promotions/service.js";
+import { SearchService } from "../modules/search/service.js";
+import { SettingsRepository } from "../modules/settings/repository/index.js";
+import { SettingsService } from "../modules/settings/service.js";
+import { ShippingConfigRepository } from "../modules/shipping/repository/index.js";
+import { ShippingService } from "../modules/shipping/service.js";
+import { TaxRatesRepository } from "../modules/tax/repository/index.js";
+import { TaxService } from "../modules/tax/service.js";
+import { WebhooksRepository } from "../modules/webhooks/repository/index.js";
+import { WebhookService } from "../modules/webhooks/service.js";
 
-export const KERNEL_ALL_MODULES = {
-  audit: auditModule,
-  settings: settingsModule,
-  documents: documentsModule,
-  webhooks: webhooksModule,
-  media: mediaModule,
-  organization: organizationModule,
-  customers: customersModule,
-  pricing: pricingModule,
-  catalog: catalogModule,
-  inventory: inventoryModule,
-  cart: cartModule,
-  orders: ordersModule,
-  fulfillment: fulfillmentModule,
-  promotions: promotionsModule,
-  search: searchModule,
-  shipping: shippingModule,
-  tax: taxModule,
-  payments: paymentsModule,
-  analytics: analyticsModule,
-} as const;
-
-/** Strip symmetric/lazy manifest edges so topo sort reflects constructor-safe ordering. */
-export function kernelModulesForTopoSort(): Record<string, AppModule> {
-  return {
-    ...KERNEL_ALL_MODULES,
-    catalog: { ...catalogModule, dependencies: [] },
-    promotions: {
-      ...promotionsModule,
-      dependencies: ["catalog"],
-    },
-    orders: {
-      ...ordersModule,
-      dependencies: [
-        "cart",
-        "inventory",
-        "payments",
-        "pricing",
-        "fulfillment",
-        "tax",
-      ],
-    },
-  } as unknown as Record<string, AppModule>;
+/** What every core service factory is built from. */
+export interface ServiceFactoryDeps {
+  database: DatabaseAdapter;
+  db: DrizzleDatabase;
+  hooks: HookRegistry;
+  config: CommerceConfig;
+  /** The services built so far, in the order below. A factory may read only those above it. */
+  services: Record<string, unknown>;
 }
 
-export function kernelModuleInstantiationOrder(): readonly string[] {
-  return topoSortModules(kernelModulesForTopoSort());
-}
+type Built = {
+  catalog: CatalogServiceImpl;
+  inventory: InventoryService;
+  settings: SettingsService;
+};
+
+const built = (deps: ServiceFactoryDeps) => deps.services as Built;
+
+/**
+ * The core services, in the order the kernel constructs them. A factory that
+ * reads another service at construction (catalog's repository, the inventory
+ * service) must come after it; services reached only at call time through
+ * `deps.services` may sit anywhere.
+ */
+export const KERNEL_SERVICE_FACTORIES = [
+  ["audit", (d: ServiceFactoryDeps) => createAuditService(d.db)],
+  ["settings", (d: ServiceFactoryDeps) =>
+    new SettingsService({ repository: new SettingsRepository(d.db), config: d.config })],
+  ["documents", (d: ServiceFactoryDeps) =>
+    new DocumentsService({ repository: new DocumentsRepository(d.db), services: d.services, config: d.config })],
+  ["webhooks", (d: ServiceFactoryDeps) =>
+    new WebhookService({ repository: new WebhooksRepository(d.db), config: d.config })],
+  ["media", (d: ServiceFactoryDeps) => {
+    if (d.config.storage == null) throw new Error("Media module requires config.storage");
+    return new MediaService({
+      repository: new MediaRepository(d.db),
+      catalogRepository: new CatalogRepository(d.db),
+      storage: d.config.storage,
+      config: d.config,
+      database: d.database,
+      services: d.services,
+    });
+  }],
+  ["organization", (d: ServiceFactoryDeps) => new OrganizationService(d.db)],
+  ["customers", (d: ServiceFactoryDeps) =>
+    new CustomerService({
+      repository: new CustomersRepository(d.db),
+      hooks: d.hooks,
+      config: d.config,
+      services: d.services,
+      database: d.database,
+    })],
+  ["catalog", (d: ServiceFactoryDeps) =>
+    new CatalogServiceImpl({
+      repository: new CatalogRepository(d.db),
+      hooks: d.hooks,
+      config: d.config,
+      services: d.services,
+      database: d.database,
+    })],
+  ["tax", (d: ServiceFactoryDeps) =>
+    new TaxService({
+      adapter: d.config.tax?.adapter,
+      repository: new TaxRatesRepository(d.db),
+      config: d.config,
+    })],
+  ["payments", (d: ServiceFactoryDeps) => new PaymentsService(d.config.payments)],
+  ["analytics", (d: ServiceFactoryDeps) => {
+    const adapter = new DrizzleAnalyticsAdapter(d.db);
+    for (const model of BUILTIN_ANALYTICS_MODELS) adapter.registerModel(model);
+    // Settings is read at call time, not construction.
+    const reports = new RetailReportsEngine(d.db, (orgId, group) => built(d).settings.read(orgId, group));
+    return new AnalyticsService({ adapter, config: d.config, reports });
+  }],
+  ["pricing", (d: ServiceFactoryDeps) =>
+    new PricingService({
+      repository: new PricingRepository(d.db),
+      catalogRepository: built(d).catalog.repository,
+      hooks: d.hooks,
+      config: d.config,
+      services: d.services,
+      database: d.database,
+    })],
+  ["inventory", (d: ServiceFactoryDeps) =>
+    new InventoryService({
+      repository: new InventoryRepository(d.db),
+      hooks: d.hooks,
+      config: d.config,
+      services: d.services,
+      database: d.database,
+    })],
+  ["promotions", (d: ServiceFactoryDeps) =>
+    new PromotionService({
+      repository: new PromotionsRepository(d.db),
+      catalogRepository: built(d).catalog.repository,
+      ordersRepository: new OrdersRepository(d.db),
+      hooks: d.hooks,
+      config: d.config,
+      services: d.services,
+      database: d.database,
+    })],
+  ["search", (d: ServiceFactoryDeps) => {
+    const adapter = d.config.search?.adapter;
+    adapter?.init?.({ db: d.db as PluginDb });
+    const catalog = built(d).catalog;
+    return new SearchService({
+      catalogRepository: catalog.repository,
+      resolveEntityFieldDefinitions: catalog.resolveEntityFieldDefinitions.bind(catalog),
+      config: d.config,
+      ...(d.config.entities ? { entities: d.config.entities } : {}),
+      ...(adapter ? { adapter } : {}),
+      ...(d.config.search?.defaultFacets ? { defaultFacets: d.config.search.defaultFacets } : {}),
+    });
+  }],
+  ["shipping", (d: ServiceFactoryDeps) =>
+    new ShippingService({
+      config: d.config,
+      catalogRepository: built(d).catalog.repository,
+      repository: new ShippingConfigRepository(d.db),
+    })],
+  ["cart", (d: ServiceFactoryDeps) =>
+    new CartService({
+      repository: new CartRepository(d.db),
+      catalogRepository: built(d).catalog.repository,
+      hooks: d.hooks,
+      config: d.config,
+      services: d.services,
+      database: d.database,
+    })],
+  ["fulfillment", (d: ServiceFactoryDeps) =>
+    new FulfillmentService({
+      repository: new FulfillmentRepository(d.db),
+      ordersRepository: new OrdersRepository(d.db),
+      inventoryService: built(d).inventory,
+      hooks: d.hooks,
+      config: d.config,
+      services: d.services,
+      database: d.database,
+    })],
+  ["orders", (d: ServiceFactoryDeps) =>
+    new OrderService({
+      repository: new OrdersRepository(d.db),
+      hooks: d.hooks,
+      config: d.config,
+      services: d.services,
+      database: d.database,
+      ...(d.config.orders?.customTransitions
+        ? { stateMachine: extendOrderStateMachine(d.config.orders.customTransitions) }
+        : {}),
+    })],
+] as const;

package/src/runtime/kernel-types.ts

@@ -24,14 +24,9 @@ import { SettingsService } from "../modules/settings/service.js";
 import { DocumentsService } from "../modules/documents/service.js";
 import type { AuditService } from "../modules/audit/service.js";
 import { OrganizationService } from "../modules/organization/service.js";
-import { createLogger } from "../utils/logger.js";
+import { createConsoleLogger } from "../utils/logger.js";
 import { CompensationFailuresRepository } from "../kernel/compensation/repository.js";
 
-export interface WebhookDeliveryPayload {
-  endpoint: { id: string; url: string; secret: string };
-  eventName: string;
-  payload: unknown;
-}
 
 export interface Kernel {
   config: CommerceConfig;
@@ -46,9 +41,7 @@ export interface Kernel {
     payments: PaymentsService;
     fulfillment: FulfillmentService;
     customers: CustomerService;
-    webhooks: WebhookService & {
-      enqueueDelivery(payload: WebhookDeliveryPayload): Promise<void>;
-    };
+    webhooks: WebhookService;
     analytics: AnalyticsService;
     pricing: PricingService;
     promotions: PromotionService;
@@ -63,7 +56,7 @@ export interface Kernel {
     organization: OrganizationService;
   };
   pluginPermissions: PluginPermission[];
-  logger: ReturnType<typeof createLogger>;
+  logger: ReturnType<typeof createConsoleLogger>;
 }
 
 export interface ConfigRouteDatabase extends DatabaseAdapter {
@@ -106,19 +99,3 @@ export function assertKernelServicesReady(
   }
 }
 
-export function assertSortedBefore(
-  topo: readonly string[],
-  a: string,
-  b: string,
-): void {
-  const ia = topo.indexOf(a);
-  const ib = topo.indexOf(b);
-  if (ia < 0 || ib < 0) {
-    throw new Error(`kernelModuleInstantiationOrder missing key: ${a} or ${b}`);
-  }
-  if (ia >= ib) {
-    throw new Error(
-      `Invalid kernel topo order: expected "${a}" before "${b}" (indices ${ia}, ${ib})`,
-    );
-  }
-}

package/src/runtime/kernel.ts

@@ -2,47 +2,30 @@ import type { CommerceConfig } from "../config/types.js";
 import { HookRegistry, isHookMarkedInTransaction, type HookHandler } from "../kernel/hooks/registry.js";
 import { createDatabaseConnection } from "../kernel/database/adapter.js";
 import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
-import type { AppModule } from "../kernel/module/index.js";
-import { topoSortModules } from "../kernel/module/index.js";
-import { WebhookDeliveryWorker } from "../modules/webhooks/worker.js";
-import { WebhooksRepository } from "../modules/webhooks/repository/index.js";
-import { createLogger } from "../utils/logger.js";
+import { createConsoleLogger } from "../utils/logger.js";
 import { withTiming } from "../kernel/service-timing.js";
 import { setBootDefaultOrgId } from "../auth/org.js";
-import { setBootStrictOrgResolution } from "../auth/strict-org-resolution.js";
 import { DrizzleJobsAdapter } from "../kernel/jobs/drizzle-adapter.js";
 import type { ExecutionEngine } from "../kernel/jobs/adapter.js";
 import { CompensationFailuresRepository } from "../kernel/compensation/repository.js";
 
-import {
-  KERNEL_ALL_MODULES,
-  kernelModulesForTopoSort,
-} from "./kernel-modules.js";
+import { KERNEL_SERVICE_FACTORIES } from "./kernel-modules.js";
 import { registerConfiguredKernelHooks } from "./kernel-register-hooks.js";
 import {
   assertKernelServicesReady,
-  assertSortedBefore,
   type Kernel,
-  type WebhookDeliveryPayload,
 } from "./kernel-types.js";
 
-export type { Kernel, WebhookDeliveryPayload };
+export type { Kernel };
 export type { ConfigRouteKernel, ConfigRouteDatabase } from "./kernel-types.js";
-export {
-  KERNEL_ALL_MODULES,
-  kernelModuleInstantiationOrder,
-} from "./kernel-modules.js";
 
 export function createKernel(config: CommerceConfig): Kernel {
   const hooks = new HookRegistry();
-  const logger = createLogger("kernel");
-  hooks.setLogger({ error: (obj, msg) => logger.error(msg, obj) });
-
-  // Apply boot-time org resolution settings from config. Previously only
-  // createCommerce did this, which meant tests calling createKernel directly
-  // had services fall back to DEFAULT_ORG_ID with a deprecation warning even
-  // when config.auth.defaultOrganizationId was set.
-  setBootStrictOrgResolution(config.auth?.strictOrgResolution === true);
+  const logger = createConsoleLogger("kernel");
+
+  // Register the configured default organization for resolveOrgId(). Done here
+  // rather than only in createCommerce so tests calling createKernel directly
+  // see it too.
   if (config.auth?.defaultOrganizationId) {
     setBootDefaultOrgId(config.auth.defaultOrganizationId);
   }
@@ -76,57 +59,19 @@ export function createKernel(config: CommerceConfig): Kernel {
   );
   const jobsEngine: ExecutionEngine =
     config.jobs?.adapter ?? new DrizzleJobsAdapter(db);
-  const jobLogger = {
-    info: (message: string, data?: unknown) => logger.info(message, data),
-    warn: (message: string, data?: unknown) => logger.warn(message, data),
-    error: (message: string, data?: unknown) => logger.error(message, data),
-  };
   jobsEngine.register({
     tasks: jobsTaskMap,
-    context: { logger: jobLogger, db, services: serviceContainer },
+    context: { logger, db, services: serviceContainer },
     ...(config.jobs?.processingOrder !== undefined
       ? { processingOrder: config.jobs.processingOrder }
       : {}),
   });
   serviceContainer.jobs = jobsEngine;
 
-  const topoGraph = kernelModulesForTopoSort();
-  const order = topoSortModules(topoGraph);
-  const moduleKeys = Object.keys(KERNEL_ALL_MODULES);
-  if (order.length !== moduleKeys.length) {
-    throw new Error(
-      `topoSortModules length mismatch: got ${order.length}, expected ${moduleKeys.length}`,
-    );
-  }
-  assertSortedBefore(order, "catalog", "inventory");
-  assertSortedBefore(order, "catalog", "pricing");
-
-  const moduleDeps = {
-    db: database,
-    hooks,
-    config,
-    logger,
-  };
-
-  for (const id of order) {
-    const mod = KERNEL_ALL_MODULES[id as keyof typeof KERNEL_ALL_MODULES];
-    const svc = (mod as AppModule<unknown, unknown, Record<string, unknown>>).service({
-      ...moduleDeps,
-      services: services as Record<string, unknown>,
-    });
-    (services as Record<string, unknown>)[id] = svc;
+  for (const [id, create] of KERNEL_SERVICE_FACTORIES) {
+    serviceContainer[id] = create({ database, db, hooks, config, services: serviceContainer });
   }
 
-  const baseWebhooks = services.webhooks!;
-  const webhookWorker = new WebhookDeliveryWorker({
-    repository: new WebhooksRepository(db),
-  });
-  services.webhooks = Object.assign(baseWebhooks, {
-    async enqueueDelivery(payload: WebhookDeliveryPayload) {
-      await webhookWorker.deliver(payload);
-    },
-  });
-
   services.compensationFailures = new CompensationFailuresRepository(db);
 
   assertKernelServicesReady(services);

package/src/runtime/server.ts

@@ -17,9 +17,7 @@ import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
 import { CommerceCsrfError } from "../kernel/errors.js";
 import { createRestRoutes } from "../interfaces/rest/index.js";
 import { createCustomerPortalRoutes } from "../interfaces/rest/customer-portal.js";
-import { createKernel } from "./kernel.js";
-import { ensureDefaultOrg } from "../auth/org.js";
-import { createLogger, type Logger } from "./logger.js";
+import type { Logger } from "./logger.js";
 import { createCommerce, type CommerceInstance } from "./commerce.js";
 import { rewriteCommerceAliasRequest } from "./url-alias-rewrite.js";
 import { mapErrorToResponse } from "../kernel/error-mapper.js";

package/src/test-utils/create-pglite-adapter.ts

@@ -15,9 +15,9 @@
 import { PGlite } from "@electric-sql/pglite";
 import { drizzle } from "drizzle-orm/pglite";
 import { sql } from "drizzle-orm";
-import { createRequire } from "node:module";
 import type { DatabaseAdapter } from "../kernel/database/adapter.js";
-import { getSchema } from "../kernel/database/migrate.js";
+import { createPGliteTransaction } from "../kernel/database/pglite-transaction.js";
+import { pushSchema } from "../kernel/database/migrate.js";
 import { ensureDefaultOrg } from "../auth/org.js";
 
 // Single barrel import --- includes all core modules + auth tables
@@ -39,29 +39,6 @@ export interface QueryLog {
   stop(): string[];
 }
 
-// drizzle-kit/api uses CJS internally; createRequire provides ESM compat.
-const require = createRequire(import.meta.url);
-
-/**
- * Pushes the core Drizzle schema to the database using drizzle-kit/api.
- *
- * drizzle-kit introspects the live database via information_schema, diffs
- * against the pgTable definitions, and generates the minimal DDL needed.
- * Typed as DrizzleDatabase (our concrete schema type) to avoid the
- * PGlite → PgDatabase<HKT> invariance cast — drizzle-kit accepts any
- * Drizzle instance at runtime regardless of the schema generic.
- */
-async function pushCoreSchema(db: DrizzleDatabase): Promise<void> {
-  const coreSchema = getSchema();
-  const drizzleKit = require("drizzle-kit/api") as {
-    pushSchema(
-      imports: Record<string, unknown>,
-      drizzleInstance: DrizzleDatabase,
-    ): Promise<{ apply: () => Promise<void> }>;
-  };
-  const { apply } = await drizzleKit.pushSchema(coreSchema, db);
-  await apply();
-}
 
 /**
  * Creates a PGlite-backed database adapter for testing.
@@ -117,51 +94,12 @@ export async function createPGliteTestAdapter(): Promise<{
   // PgliteDatabase<Schema> and DrizzleDatabase share the same Schema type;
   // the HKT parameter differs (PgliteQueryResultHKT vs PgQueryResultHKT)
   // but drizzle-kit's pushSchema doesn't use it at runtime.
-  await pushCoreSchema(db as DrizzleDatabase);
+  await pushSchema(db);
 
   // Ensure the default organization exists for all tests
   await ensureDefaultOrg(db);
 
-  /**
-   * PGlite-compatible transaction wrapper.
-   *
-   * Drizzle's transaction() method can hang with PGlite due to how the adapter
-   * manages transaction state, so this drives BEGIN/COMMIT manually.
-   *
-   * PGlite is a single connection, so two transaction bodies awaiting
-   * concurrently would otherwise interleave their statements between one
-   * BEGIN and one COMMIT — the second BEGIN is a no-op Postgres only warns
-   * about. Merged that way, two callers share a snapshot and hold each other's
-   * row locks, so an isolation bug reads as if the guard failed. Bodies are
-   * queued instead, which is what a connection pool would do to two
-   * transactions competing for the same rows.
-   *
-   * A nested call joins the transaction already open rather than deadlocking
-   * on the queue; without savepoints that is the only sound reading.
-   */
-  let transactionQueue: Promise<unknown> = Promise.resolve();
-  let inTransaction = false;
-
-  async function transaction<T>(fn: (tx: unknown) => Promise<T>): Promise<T> {
-    if (inTransaction) return fn(db);
-
-    const run = transactionQueue.then(async () => {
-      inTransaction = true;
-      await pg.exec("BEGIN");
-      try {
-        const result = await fn(db);
-        await pg.exec("COMMIT");
-        return result;
-      } catch (error) {
-        await pg.exec("ROLLBACK");
-        throw error;
-      } finally {
-        inTransaction = false;
-      }
-    });
-    transactionQueue = run.catch(() => undefined);
-    return run as Promise<T>;
-  }
+  const { transaction, inTransaction } = createPGliteTransaction(pg, db);
 
   const adapter: DatabaseAdapter & { inTransaction(): boolean } = {
     provider: "postgresql",
@@ -181,7 +119,7 @@ export async function createPGliteTestAdapter(): Promise<{
      * Test-utils only. Production adapters do not carry it, and nothing outside a test may branch
      * on it — a behaviour that depends on this flag would be a behaviour no production adapter has.
      */
-    inTransaction: () => inTransaction,
+    inTransaction,
   };
 
   /**