fix: exports resolve dist only

The source condition pointed consumers at TypeScript sources; it only made sense inside the crudy monorepo.
feat: @crudy/pgmorbac-fastify, MIT, its own repository
2026-10-03 10:00:58 +02:00 · 2026-10-03 09:58:18 +02:00
9 changed files with 82 additions and 3179 deletions
@@ -1,56 +0,0 @@
-# Per-repo Drone pipeline template for an extracted @crudy/* package or module (RFC 0006).
-# Copy this to .drone.yml in the standalone repo. It consumes dependencies from Verdaccio and
-# publishes the package on a tag. Set the `verdaccio_url` and `npm_token` Drone secrets.
---
-kind: pipeline
-type: docker
-name: default
-
-trigger:
-  event:
-    - push
-    - pull_request
-    - tag
-
-steps:
-  - name: install
-    image: node:24
-    environment:
-      VERDACCIO:
-        from_secret: verdaccio_url
-    commands:
-      - npm ci --registry "$VERDACCIO"
-
-  - name: lint
-    image: node:24
-    commands:
-      - npm run --if-present lint -- --max-warnings=0
-
-  - name: typecheck
-    image: node:24
-    commands:
-      - npx tsc --noEmit
-
-  - name: test
-    image: node:24
-    commands:
-      - npm test --if-present
-
-  - name: build
-    image: node:24
-    commands:
-      - npm run --if-present build
-
-  - name: publish
-    image: node:24
-    environment:
-      VERDACCIO:
-        from_secret: verdaccio_url
-      NPM_TOKEN:
-        from_secret: npm_token
-    commands:
-      - echo "//${VERDACCIO#*://}:_authToken=$NPM_TOKEN" > .npmrc
-      - npm publish --registry "$VERDACCIO"
-    when:
-      event:
-        - tag
@@ -0,0 +1,3 @@
+node_modules/
+dist/
+package-lock.json
@@ -1,201 +1,21 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+MIT License

-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+Copyright (c) 2025-2026 Marc Villain

-   1. Definitions.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:

-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.

-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2025-2026 Marc Villain
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -1,4 +0,0 @@
-@crudy/pgmorbac
-Copyright 2025-2026 Marc Villain
-
-This product includes software developed as part of the Crudy project.
@@ -1,18 +1,18 @@
-# @crudy/pgmorbac
+# @crudy/pgmorbac-fastify

 **Multi-OrBAC permission helpers for Fastify and PostgreSQL.**

-[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/Node-%3E%3D18-brightgreen.svg)](https://nodejs.org/)

-This is the Node.js companion to the [`pgmorbac` PostgreSQL extension](https://github.com/crudylabs/pgmorbac). The extension implements the Multi-OrBAC access control model in the database (`morbac` schema); this package wires it into a Fastify backend: permission checks, RLS session context, management routes, a PostgREST data proxy, and the migration loader that ships the extension SQL.
+This is the Node.js companion to the [`pgmorbac` PostgreSQL extension](https://github.com/crudylabs/pgmorbac). The extension implements the Multi-OrBAC access control model in the database (`morbac` schema); this package wires it into a Fastify backend: permission checks, RLS session context, management routes, a PostgREST data proxy, and the migration loader for the extension SQL from [`@crudy/pgmorbac`](https://www.npmjs.com/package/@crudy/pgmorbac).

-> The SQL extension is a separate project under the MIT license. This helper package is Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+> MIT, like the pgmorbac SQL extension it builds on. See [LICENSE](LICENSE).

 ## Install

 ```bash
-npm install @crudy/pgmorbac
+npm install @crudy/pgmorbac-fastify
 ```

 Peer dependencies (both optional, install the ones you use): `fastify >=5`, `pg >=8`.
@@ -23,14 +23,14 @@ The package is split into focused entry points so you only pull in what you need

 | Import | Purpose |
 |--------|---------|
-| `@crudy/pgmorbac` | RLS session context and shared domain types |
-| `@crudy/pgmorbac/permissions` | `hasPermission`, org-scope resolution, admin checks |
-| `@crudy/pgmorbac/proxy` | PostgREST data proxy with per-route permissions |
-| `@crudy/pgmorbac/plugin` | Fastify management routes (orgs, roles, rules, users, delegations) |
-| `@crudy/pgmorbac/list-query` | PostgREST-style sort/filter/pagination parsing |
-| `@crudy/pgmorbac/schemas` | JSON schema response fragments |
-| `@crudy/pgmorbac/migrations` | Loads the bundled `morbac` extension SQL as migrations |
-| `@crudy/pgmorbac/api` | Domain type definitions (`Org`, `Role`, `Rule`, ...) |
+| `@crudy/pgmorbac-fastify` | RLS session context and shared domain types |
+| `@crudy/pgmorbac-fastify/permissions` | `hasPermission`, org-scope resolution, admin checks |
+| `@crudy/pgmorbac-fastify/proxy` | PostgREST data proxy with per-route permissions |
+| `@crudy/pgmorbac-fastify/plugin` | Fastify management routes (orgs, roles, rules, users, delegations) |
+| `@crudy/pgmorbac-fastify/list-query` | PostgREST-style sort/filter/pagination parsing |
+| `@crudy/pgmorbac-fastify/schemas` | JSON schema response fragments |
+| `@crudy/pgmorbac-fastify/migrations` | Loads the bundled `morbac` extension SQL as migrations |
+| `@crudy/pgmorbac-fastify/api` | Domain type definitions (`Org`, `Role`, `Rule`, ...) |

 ## Usage

@@ -39,7 +39,7 @@ The package is split into focused entry points so you only pull in what you need
 Every org-scoped route authorizes with `hasPermission`. Authentication is necessary but not sufficient; the check calls `morbac.is_allowed` and requires an `X-Org-Id` header.

 ```ts
-import { hasPermission } from '@crudy/pgmorbac/permissions';
+import { hasPermission } from '@crudy/pgmorbac-fastify/permissions';

 app.get('/documents', async (req, reply) => {
  const orgId = req.headers['x-org-id'] as string;
@@ -53,7 +53,7 @@ app.get('/documents', async (req, reply) => {
 Run queries under the acting user so `morbac` row-level security policies apply as a second gate behind `hasPermission`. Required for non-`BYPASSRLS` runtime roles.

 ```ts
-import { withMorbacContext } from '@crudy/pgmorbac';
+import { withMorbacContext } from '@crudy/pgmorbac-fastify';

 const rows = await withMorbacContext(pool, { userId, orgId }, async (client) => {
  const { rows } = await client.query('SELECT * FROM app.orgs');
@@ -66,7 +66,7 @@ const rows = await withMorbacContext(pool, { userId, orgId }, async (client) =>
 Expose an `app`-schema table through the backend with an explicit permission. A path that is never registered does not exist (fail closed).

 ```ts
-import { createProxyRegistry } from '@crudy/pgmorbac/proxy';
+import { createProxyRegistry } from '@crudy/pgmorbac-fastify/proxy';

 const proxy = createProxyRegistry(pool, process.env.POSTGREST_URL!);
 proxy.proxyDataRoute(app, 'GET', '/data/documents', 'documents', { activity: 'read', view: 'documents' });
@@ -76,10 +76,10 @@ Pass `null` as the permission for any-authenticated-user access with no org chec

 ### Migrations

-The extension SQL ships inside this package (`sql/pgmorbac--<version>.sql`, plus `sql/upgrades/`). Feed it to your migration runner before your own DDL.
+`morbacMigrations()` returns the extension SQL from `@crudy/pgmorbac` (install script plus upgrade scripts) ready for your migration runner. Feed it before your own DDL.

 ```ts
-import { morbacMigrations } from '@crudy/pgmorbac/migrations';
+import { morbacMigrations } from '@crudy/pgmorbac-fastify/migrations';

 for (const { filename, sql } of morbacMigrations()) {
  await runMigration(filename, sql);
@@ -93,7 +93,7 @@ The base script keeps the historical filename `0001_morbac.sql` so `schema_migra
 Register CRUD routes for orgs, roles, rules, users, global rules, activities, and delegations. Supply optional hooks for license-limit enforcement and event emission.

 ```ts
-import { createMgmtRoutes } from '@crudy/pgmorbac/plugin';
+import { createMgmtRoutes } from '@crudy/pgmorbac-fastify/plugin';

 createMgmtRoutes({
  db: pool,
@@ -116,4 +116,4 @@ createMgmtRoutes({

 ## License

-Apache-2.0 (c) 2025-2026 Marc Villain. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+MIT (c) 2025-2026 Marc Villain. See [LICENSE](LICENSE).
@@ -1,72 +1,65 @@
 {
-  "name": "@crudy/pgmorbac",
+  "name": "@crudy/pgmorbac-fastify",
  "version": "1.0.0",
  "type": "module",
-  "description": "Crudy pgmorbac - Multi-OrBAC permission helpers for Fastify and PostgreSQL",
+  "description": "Fastify layer over pgmorbac: permission checks, RLS session context, management routes, PostgREST data proxy, migration loader",
  "keywords": [
-    "morbac",
-    "orbac",
-    "rbac",
-    "authorization",
    "access-control",
-    "postgresql",
+    "authorization",
    "fastify",
-    "rls",
-    "multi-tenant"
+    "morbac",
+    "multi-tenant",
+    "orbac",
+    "pgmorbac",
+    "postgresql",
+    "rbac",
+    "rls"
  ],
  "author": "Marc Villain",
  "homepage": "https://pgmorbac.crudy.fr",
  "repository": {
    "type": "git",
-    "url": "https://github.com/crudylabs/pgmorbac-node.git"
+    "url": "git+https://github.com/crudylabs/pgmorbac-fastify.git"
  },
  "bugs": {
-    "url": "https://github.com/crudylabs/pgmorbac-node/issues"
+    "url": "https://github.com/crudylabs/pgmorbac-fastify/issues"
  },
+  "license": "MIT",
  "exports": {
    ".": {
      "types": "./dist/index.d.ts",
-      "source": "./src/index.ts",
      "default": "./dist/index.js"
    },
    "./permissions": {
      "types": "./dist/permissions.d.ts",
-      "source": "./src/permissions.ts",
      "default": "./dist/permissions.js"
    },
    "./proxy": {
      "types": "./dist/proxy.d.ts",
-      "source": "./src/proxy.ts",
      "default": "./dist/proxy.js"
    },
    "./list-query": {
      "types": "./dist/list-query.d.ts",
-      "source": "./src/list-query.ts",
      "default": "./dist/list-query.js"
    },
    "./rls-context": {
      "types": "./dist/rls-context.d.ts",
-      "source": "./src/rls-context.ts",
      "default": "./dist/rls-context.js"
    },
    "./plugin": {
      "types": "./dist/plugin.d.ts",
-      "source": "./src/plugin.ts",
      "default": "./dist/plugin.js"
    },
    "./schemas": {
      "types": "./dist/schemas.d.ts",
-      "source": "./src/schemas.ts",
      "default": "./dist/schemas.js"
    },
    "./api": {
      "types": "./dist/api.d.ts",
-      "source": "./src/api.ts",
      "default": "./dist/api.js"
    },
    "./migrations": {
      "types": "./dist/migrations.d.ts",
-      "source": "./src/migrations.ts",
      "default": "./dist/migrations.js"
    }
  },
@@ -74,13 +67,11 @@
  "types": "./dist/index.d.ts",
  "files": [
    "dist",
-    "sql",
    "package.json",
    "src",
    "README.md",
    "CHANGELOG.md",
-    "LICENSE",
-    "NOTICE"
+    "LICENSE"
  ],
  "scripts": {
    "build": "tsc",
@@ -88,10 +79,10 @@
    "check": "tsc --noEmit"
  },
  "publishConfig": {
-    "registry": "http://localhost:4873",
    "access": "public"
  },
  "dependencies": {
+    "@crudy/pgmorbac": "^1.0.0",
    "bcryptjs": "^2"
  },
  "peerDependencies": {
@@ -112,6 +103,5 @@
    "fastify": "^5",
    "pg": "^8",
    "typescript": "^5"
-  },
-  "license": "Apache-2.0"
+  }
 }
@@ -243,7 +243,10 @@ export interface MorbacApi {
    revokeDelegation(token: string, orgIds: string[], id: string): Promise<null>;
 }

-export function createMorbacApi(apiUrl: string): MorbacApi {
+// apiUrl may be a function so a browser caller resolves the origin per request
+// rather than when its module loads.
+export function createMorbacApi(apiUrl: string | (() => string)): MorbacApi {
+    const base = typeof apiUrl === 'function' ? apiUrl : () => apiUrl;
    async function api(method: string, path: string, token: string, orgIds: string[], body?: unknown): Promise<unknown> {
        const headers: Record<string, string> = {
            Authorization: `Bearer ${token}`,
@@ -254,7 +257,7 @@ export function createMorbacApi(apiUrl: string): MorbacApi {
            headers['X-Org-Ids'] = orgIds.join(',');
        }
        if (body !== undefined) headers['Content-Type'] = 'application/json';
-        const res = await fetch(`${apiUrl}${path}`, {
+        const res = await fetch(`${base()}${path}`, {
            method,
            headers,
            credentials: 'include',
@@ -279,7 +282,7 @@ export function createMorbacApi(apiUrl: string): MorbacApi {
    const PERM_TTL_MS = 30_000;

    async function fetchPermission(token: string, orgId: string, activity: string, view: string): Promise<boolean> {
-        const res = await fetch(`${apiUrl}/me/permissions/check`, {
+        const res = await fetch(`${base()}/me/permissions/check`, {
            method: 'POST',
            headers: {
                Authorization: `Bearer ${token}`,
@@ -1,40 +1,28 @@
-import { readFileSync, readdirSync, existsSync } from 'fs';
-import { fileURLToPath } from 'url';
-import { dirname, join } from 'path';
-
-const sqlDir = join(dirname(fileURLToPath(import.meta.url)), '..', 'sql');
+import { extensionSql, upgradeScripts, version } from '@crudy/pgmorbac';

 export interface MorbacMigration {
    filename: string;
    sql: string;
 }

-// The morbac schema ships with this package as a PGXN-style extension script
-// (sql/pgmorbac--<version>.sql) plus upgrade scripts (sql/upgrades/). For the
-// crudy migration runner they are exposed as plain migrations: the base script
-// keeps the historical filename 0001_morbac.sql so schema_migrations rows on
-// existing databases stay valid, and upgrade scripts follow in version order
-// as 0001_morbac--<old>--<new>.sql.
+// The pgmorbac install and upgrade scripts (from @crudy/pgmorbac) as plain
+// migrations for a migration runner. Without CREATE EXTENSION the morbac schema is
+// created up front, and the installed version is recorded. The base keeps the
+// historical filename 0001_morbac.sql so schema_migrations rows on existing
+// databases stay valid; its bytes must not change for an unchanged extension
+// version, or boot re-runs it. Upgrades follow as 0001_morbac--<old>--<new>.sql.
 export function morbacMigrations(): MorbacMigration[] {
-    const base = readdirSync(sqlDir)
-        .filter(f => /^pgmorbac--\d+\.\d+\.\d+\.sql$/.test(f))
-        .sort();
-    if (base.length !== 1) {
-        throw new Error(`[pgmorbac] Expected exactly one base script in ${sqlDir}, found ${base.length}`);
-    }
-    const migrations: MorbacMigration[] = [{
-        filename: '0001_morbac.sql',
-        sql: readFileSync(join(sqlDir, base[0]), 'utf8'),
-    }];
-
-    const upgradesDir = join(sqlDir, 'upgrades');
-    if (existsSync(upgradesDir)) {
-        for (const f of readdirSync(upgradesDir).filter(n => n.endsWith('.sql')).sort()) {
-            migrations.push({
-                filename: `0001_morbac${f.replace(/^pgmorbac/, '').replace(/\.sql$/, '')}.sql`,
-                sql: readFileSync(join(upgradesDir, f), 'utf8'),
-            });
-        }
-    }
-    return migrations;
+    const lines = extensionSql().split('\n');
+    lines.splice(lines.indexOf('') + 1, 0, 'CREATE SCHEMA IF NOT EXISTS morbac;');
+    const sql = lines.join('\n') + `
+-- Record the installed schema version (readable via
+-- morbac.get_config('schema_version'); upgrade scripts bump it).
+INSERT INTO morbac.config (key, value, description)
+VALUES ('schema_version', '${version}', 'Installed pgmorbac schema version')
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = CURRENT_TIMESTAMP;
+`;
+    return [
+        { filename: '0001_morbac.sql', sql },
+        ...upgradeScripts().map(u => ({ filename: `0001_morbac--${u.from}--${u.to}.sql`, sql: u.sql })),
+    ];
 }