@everystack/cli 0.3.14 → 0.3.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.3.14",
+  "version": "0.3.15",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/commands/db-authz.ts

@@ -44,6 +44,7 @@ import { writeContract, loadContract } from '../authz-contract-io.js';
 import { renderContractMarkdown } from '../authz-render.js';
 import { FUNCTIONS_SQL, catalogFunctionToDescriptor } from '../security-catalog.js';
 import { resolveConfig, opsFunction } from '../config.js';
+import { resolveModelsPath } from '../models-path.js';
 import { invokeAction } from '../aws.js';
 import { step, success, fail, info, warn } from '../output.js';
 
@@ -239,7 +240,7 @@ async function loadModels(modelsPath: string): Promise<ModelDescriptor[]> {
  * exit on any leak or vacuous policy; an `unprobed` table (one identity) is a warning, not a fail.
  */
 export async function dbAuthzOwnerCommand(flags: Record<string, string>): Promise<void> {
-  const modelsPath = flags.models || 'models/index.ts';
+  const modelsPath = resolveModelsPath(flags.models);
   const schema = flags.schema || 'public';
 
   let probes: OwnerProbe[];

package/src/cli/commands/db-generate.ts

@@ -28,11 +28,11 @@ import { generateMigrationSql, unmodeledTables, formatMigrationFile, planMigrati
 import { introspectContract, type QueryRunner } from '../authz-contract.js';
 import { FUNCTIONS_SQL, catalogFunctionToDescriptor } from '../security-catalog.js';
 import { resolveDbSource, createUrlRunner, type DbSource } from '../db-source.js';
+import { resolveModelsPath } from '../models-path.js';
 import { resolveConfig, opsFunction } from '../config.js';
 import { invokeAction } from '../aws.js';
 import { step, success, fail, info, warn } from '../output.js';
 
-const DEFAULT_MODELS = 'models/index.ts';
 const DEFAULT_MIGRATIONS = 'drizzle';
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';
 
@@ -123,7 +123,7 @@ async function dbGenerateInit(modelsPath: string, migrationsDir: string, schemaO
 }
 
 export async function dbGenerateCommand(flags: Record<string, string>): Promise<void> {
-  const modelsPath = flags.models || DEFAULT_MODELS;
+  const modelsPath = resolveModelsPath(flags.models);
   const migrationsDir = path.resolve(flags.dir || DEFAULT_MIGRATIONS);
   const schemaOut = path.resolve(flags['schema-out'] || DEFAULT_SCHEMA_OUT);
   const name = flags.name || 'generated';

package/src/cli/derived-apply.ts

@@ -13,7 +13,7 @@
  * the reconciler writes it and never reads it.
  */
 
-import type { SourceObject } from './derived-source.js';
+import { normalizeSql, type SourceObject } from './derived-source.js';
 import type { ReconcilePlan } from './derived-plan.js';
 import { quoteQualified } from './pg-ident.js';
 
@@ -69,9 +69,22 @@ export function ensureOrReplace(sql: string): string {
   return sql.replace(/^(\s*)CREATE\s+FUNCTION/i, '$1CREATE OR REPLACE FUNCTION');
 }
 
-/** An object's full creation SQL: the CREATE statement plus its attachments, in source order. */
+const WITH_NO_DATA_RE = /WITH\s+NO\s+DATA\s*$/i;
+
+/**
+ * An object's full creation SQL: the CREATE statement plus its attachments, in
+ * source order. A matview whose source says `WITH NO DATA` gets a trailing
+ * REFRESH: the reconciler dropped a populated matview to rebuild it, and
+ * executing the source verbatim would leave it unpopulated — matching the
+ * text but regressing the database. (Found by a consumer whose extracted
+ * sources carry pg_dump's WITH NO DATA ordering.)
+ */
 function objectSql(obj: SourceObject): string[] {
-  return [obj.sql, ...obj.attachments.map((a) => a.sql)];
+  const statements = [obj.sql, ...obj.attachments.map((a) => a.sql)];
+  if (obj.kind === 'materialized view' && WITH_NO_DATA_RE.test(normalizeSql(obj.sql))) {
+    statements.push(`REFRESH MATERIALIZED VIEW ${quoteQualified(obj.identity)}`);
+  }
+  return statements;
 }
 
 export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[]): RenderedReconcile {

package/src/cli/index.ts

@@ -295,14 +295,14 @@ Usage:
   everystack db:backups        [--stage <name>]  List logical backups (id, size, created)
   everystack db:restore        --from <id> [--stage <name>] --confirm  Restore a backup INTO the stage's DB (DESTRUCTIVE)
   everystack db:backup:download <id> [--stage <name>]  Presigned URL to download a backup's dump (valid 1h)
-  everystack db:generate       [--stage <name> | --database-url <url>] [--name <label>] [--models models/index.ts] [--allow-drops]  Diff models vs the live DB → write the next migration (never touches the DB; DROPs held back unless --allow-drops)
+  everystack db:generate       [--stage <name> | --database-url <url>] [--name <label>] [--models db/models/index.ts] [--allow-drops]  Diff models vs the live DB → write the next migration (never touches the DB; DROPs held back unless --allow-drops)
   everystack db:pull           [--stage <name> | --database-url <url>] [--schema public] [--out <dir | file.ts>]  Introspect the live DB → render field() Models (the brownfield on-ramp). --out <dir> writes one file per model + index.ts (the default shape); --out <file.ts> writes a single module; stdout otherwise
                                Both introspect via the deployed ops Lambda by default; --database-url (or an inherited DATABASE_URL) connects directly — for a schema that exists only on a local Postgres.
   everystack db:reconcile      [--sql-dir db/sql] [--stage <name> | --database-url <url>] [--apply] [--check] [--baseline] [--overwrite-drift] [--json]  Reconcile the derived layer (functions/views/matviews) against db/sql sources: plan with rebuild-cost estimates by default; --check is the CI gate; --apply executes (direct connection only) and records provenance + schema_log. Hand-edits are drift (never overwritten silently); first contact with existing objects wants --baseline, once.
   everystack db:authz:pull     [--stage <name>] [--dir authz]  Introspect live authz (rls/grants/policies/secdef) → reviewable contract files
   everystack db:authz:diff     [--stage <name>] [--dir authz]  Validate the live DB against the committed contract (non-zero exit on drift)
   everystack db:authz:test     [--stage <name>] [--dir authz]  Red-team enforcement: SET ROLE + attempt per role/table/command (non-zero exit on a hole)
-  everystack db:authz:owner    [--stage <name>] [--models models/index.ts]  Red-team owner isolation: two JWT identities per owner-scoped table — catches IDOR (non-zero exit on a leak)
+  everystack db:authz:owner    [--stage <name>] [--models db/models/index.ts]  Red-team owner isolation: two JWT identities per owner-scoped table — catches IDOR (non-zero exit on a leak)
   everystack db:authz:report   [--dir authz]  Render the committed contract as a human-readable authorization review (no DB)
   everystack console           --stage <name> [--sandbox]  Interactive REPL on deployed Lambda
   everystack status            [--stage <name>] [--hours <n>]  Platform health: CDN, Lambda, rollup summary

package/src/cli/models-path.ts

@@ -0,0 +1,25 @@
+/**
+ * models-path — where the Models barrel lives.
+ *
+ * One home for schema: `db/models/` (state) beside `db/sql/` (compute). The
+ * CLI looks there first, falling back to the legacy top-level `models/` so
+ * existing consumers keep working without a flag. An explicit `--models`
+ * always wins. When neither home exists, the NEW home is returned so error
+ * messages point people at the current convention, not the legacy one.
+ */
+
+import { existsSync } from 'node:fs';
+
+/** Candidate barrels, in preference order. */
+export const MODELS_HOMES = ['db/models/index.ts', 'models/index.ts'] as const;
+
+export function resolveModelsPath(
+  flag?: string,
+  exists: (p: string) => boolean = existsSync,
+): string {
+  if (flag) return flag;
+  for (const home of MODELS_HOMES) {
+    if (exists(home)) return home;
+  }
+  return MODELS_HOMES[0];
+}

package/src/cli/runbook/detect.ts

@@ -102,10 +102,12 @@ export function detectProjectReality(root: string): ProjectReality {
       ? 'V2'
       : 'V1';
 
-  const modelsDir = path.join(abs, 'models');
+  // One home for schema: db/models is the current convention, top-level models the legacy one.
+  const modelsHome = isDir(path.join(abs, 'db', 'models')) ? 'db/models' : 'models';
+  const modelsDir = path.join(abs, modelsHome);
   const modelFiles = listTs(modelsDir).filter((f) => f !== 'index.ts');
   const models = {
-    dir: isDir(modelsDir) ? 'models' : null,
+    dir: isDir(modelsDir) ? modelsHome : null,
     files: modelFiles,
     hasIndex: isFile(path.join(modelsDir, 'index.ts')),
   };