@everystack/cli 0.4.100 → 0.4.102

package/src/cli/schema-swap.ts

@@ -30,7 +30,7 @@
  * so the swap is a pointer flip, never a recompute.
  */
 
-import type { ModelDescriptor } from '@everystack/model';
+import { relationDeleteActions, type ModelDescriptor } from '@everystack/model';
 import { modelForeignKeys, qualifiedTable } from './schema-compile';
 import { compileTableContract } from './authz-compile';
 import { emitSwapAuthzSql } from './authz-reconcile';
@@ -73,10 +73,11 @@ export interface CrossSchemaFk {
  */
 export function crossSchemaForeignKeys(models: ModelDescriptor[], targetSchema: string): CrossSchemaFk[] {
   const out: CrossSchemaFk[] = [];
+  const dependents = relationDeleteActions(models);
   for (const model of models) {
     if ((model.schema || 'public') === targetSchema) continue; // internal edge, not external
     const from = qualifiedTable(model);
-    for (const fk of modelForeignKeys(model)) {
+    for (const fk of modelForeignKeys(model, dependents)) {
       if (schemaOf(fk.refTable) !== targetSchema) continue; // not pointing into the swapped schema
       const cols = fk.columns.map((c) => `"${c}"`).join(', ');
       const refCols = fk.refColumns.map((c) => `"${c}"`).join(', ');

package/src/cli/state-apply.ts

@@ -20,7 +20,7 @@
 import { execSync, execFileSync } from 'node:child_process';
 import type { ModelDescriptor } from '@everystack/model';
 import { introspectContract, type AuthzContract, type QueryRunner } from './authz-contract';
-import { borrowedSessionRunner, type SessionRunner } from './session';
+import { borrowedSessionRunner, CANONICAL_SEARCH_PATH, type SessionRunner } from './session';
 import { introspectSchema, type SchemaSnapshot } from './schema-introspect';
 import { FUNCTIONS_SQL, contractFunctionRow } from './security-catalog';
 import { generateMigrationSql, HELD_DROP_PREFIX } from './migration-generate';
@@ -572,9 +572,14 @@ export async function applyGeneratedStatements(
   // point; they join the row on the amendment, where their outcome is known.
   const prerequisiteSql = prerequisites
     .flatMap((prerequisite) => [renderStatePrerequisiteGuard(prerequisite), prerequisite.sql]);
+  // The plan is rendered against the canonical path — public bare, non-public qualified — so it
+  // must RUN under it. Under an operator path like `analytics, public`, a bare
+  // `CREATE TYPE "post_status"` would land in analytics. Transaction-local and inside the
+  // batch's own string, so it can neither be skipped nor outlive the batch.
+  const stateBatch = batch.length > 0 ? [renderLocalSearchPath(CANONICAL_SEARCH_PATH), ...batch] : [];
   // A SQL-language prerequisite may read a table this same state edge creates. PostgreSQL
   // validates such bodies at CREATE time unless this transaction-local setting defers it.
-  let batchSql = [...(prerequisites.length > 0 ? ['SET LOCAL check_function_bodies = off'] : []), ...prerequisiteSql, ...batch].join('\n;\n');
+  let batchSql = [...(prerequisites.length > 0 ? ['SET LOCAL check_function_bodies = off'] : []), ...prerequisiteSql, ...stateBatch].join('\n;\n');
   const validationSql = validations.join('\n;\n');
   const started = now();
   try {
@@ -587,13 +592,14 @@ export async function applyGeneratedStatements(
         const originalPath = settings?.search_path;
         if (typeof originalPath !== 'string') throw new Error('could not capture prerequisite search_path; no state was applied.');
         // Defaults and SQL-standard bodies bind names at CREATE time. Use the full declared
-        // path recorded at mint, then restore the exact connection setting before state DDL.
+        // path recorded at mint, then restore the exact connection setting; the state DDL
+        // that follows pins the canonical path itself.
         batchSql = ['SET LOCAL check_function_bodies = off', ...prerequisites.flatMap((prerequisite) => [
           renderStatePrerequisiteGuard(prerequisite),
           ...(prerequisite.searchPath === null ? [] : [renderLocalSearchPath(prerequisite.searchPath)]),
           prerequisite.sql,
           ...(prerequisite.searchPath === null ? [] : [renderLocalSearchPath(originalPath)]),
-        ]), ...batch].join('\n;\n');
+        ]), ...stateBatch].join('\n;\n');
         await transactionRunner(batchSql);
         // `defHash` is PostgreSQL's canonical deparse, so source text cannot predict it. Read it
         // after the CREATE through the OPEN transaction, then write provenance before COMMIT.

package/src/cli/ts-template.ts

@@ -0,0 +1,52 @@
+/**
+ * Escape live text for the body of a template literal in generated source, so the template
+ * evaluates back to EXACTLY that text: backslash first, then backtick, then `${`. Live database
+ * text is data. Unescaped, `${…}` in it ran when the generated file was imported, and a
+ * backslash before a backtick closed the template. Every renderer that puts live text inside
+ * sql`…` uses this one rule.
+ */
+export function templateBody(text: string): string {
+  return text.replace(/\\/g, '\\\\').replace(/`/g, '\\`').replace(/\$\{/g, '\\${');
+}
+
+/**
+ * Live text as a single-quoted string literal in generated source, evaluating back to EXACTLY
+ * that text. Backslash first, then the quote, then every line terminator: a raw newline or
+ * carriage return ends a string literal, so a live name holding one broke the generated file.
+ * U+2028 and U+2029 are legal inside a string since ES2019 but not in every older parser, so
+ * they are escaped too. Ordinary text comes out unchanged.
+ */
+export function tsString(text: string): string {
+  const body = text
+    .replace(/\\/g, '\\\\')
+    .replace(/'/g, "\\'")
+    .replace(/\n/g, '\\n')
+    .replace(/\r/g, '\\r')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+  return `'${body}'`;
+}
+
+/**
+ * Live text bound for a `//` line comment in generated source. JavaScript ends a line comment
+ * at ANY line terminator (LF, CR, U+2028, U+2029), so a live name holding one ended the comment
+ * and the rest of the name ran as code. Each terminator becomes its visible escape sequence
+ * (`\n`, `\r`, `\u2028`, `\u2029`): the comment stays one line, and a reader still sees that
+ * the live name held a line break. Ordinary text comes out unchanged.
+ */
+export function commentText(text: string): string {
+  return text
+    .replace(/\n/g, '\\n')
+    .replace(/\r/g, '\\r')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+}
+
+/**
+ * Live text that is MEANT to span several comment lines (a deparsed predicate in a note): split
+ * on every line terminator, so each piece gets its own `//`. Splitting on `\n` alone left a CR,
+ * U+2028 or U+2029 inside one line, which still ended the comment.
+ */
+export function commentLines(text: string): string[] {
+  return text.split(/\r\n|[\n\r\u2028\u2029]/);
+}