@everystack/cli 0.4.17 → 0.4.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.17",
+  "version": "0.4.18",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/commands/db-reconcile.ts

@@ -42,6 +42,7 @@ import {
   renderSchemaLogInsert,
   derivedSearchPath,
   renderSetSearchPath,
+  renderEnsureObjectSchemas,
   ENSURE_RECONCILER_SQL,
 } from '../derived-apply.js';
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
@@ -151,6 +152,12 @@ export async function executeReconcile(
   // as it was. See derivedSearchPath.
   const setSearchPath = renderSetSearchPath(derivedSearchPath(parsed.objects), atomic);
 
+  // A schema populated only by derived objects has no model in it, so the state layer never
+  // CREATE SCHEMAs it — the derived apply ensures its own object schemas (+ their USAGE
+  // grants) before anything is created in them. Empty for all-public apps. See
+  // renderEnsureObjectSchemas.
+  const ensureSchemas = renderEnsureObjectSchemas(parsed.objects);
+
   if (atomic) await runner('BEGIN');
   try {
     // The session guard: postgres-js `max: 1` is a pool of one, not a session lease — a
@@ -166,7 +173,7 @@ export async function executeReconcile(
       if (atomic) {
         // The SET rides the same simple-query batch (and the same transaction) as the DDL,
         // so bare body refs resolve to their real schema; SET LOCAL resets it at COMMIT.
-        await runner([setSearchPath, ...rendered.statements].filter(Boolean).join(';\n'));
+        await runner([...ensureSchemas, setSearchPath, ...rendered.statements].filter(Boolean).join(';\n'));
       } else {
         // Self-committing statements (CONCURRENTLY, VACUUM) refuse ANY transaction block —
         // including the implicit one a joined multi-statement simple query runs in, so the
@@ -174,6 +181,7 @@ export async function executeReconcile(
         // earlier statements committed: the documented cost of the unwrapped path; the next
         // plan re-converges from what actually landed. The session SET precedes them so every
         // create resolves its bare refs.
+        for (const statement of ensureSchemas) await runner(statement);
         if (setSearchPath) await runner(setSearchPath);
         for (const statement of rendered.statements) await runner(statement);
       }
@@ -211,7 +219,7 @@ export async function executeReconcile(
     bookkeeping.push(renderSchemaLogInsert({
       kind: 'compute reconcile',
       sql: rendered.statements.length > 0
-        ? [setSearchPath, ...rendered.statements].filter(Boolean).join(';\n')
+        ? [...ensureSchemas, setSearchPath, ...rendered.statements].filter(Boolean).join(';\n')
         : '-- provenance-only (baseline/rebaseline/prune)',
       outcome: 'applied',
       actor: options.actor, gitRef: options.gitRef, planRef: options.planRef,

package/src/cli/derived-apply.ts

@@ -15,6 +15,7 @@
 
 import { normalizeSql, parseQualified, type SourceObject } from './derived-source.js';
 import type { ReconcilePlan } from './derived-plan.js';
+import { parseGrantAttachments } from './derived-grants.js';
 import { quoteIdent, quoteQualified } from './pg-ident.js';
 
 /** SQL string literal with '' doubling (standard_conforming_strings). */
@@ -136,6 +137,43 @@ export function renderSetSearchPath(schemas: string[], local: boolean): string |
   return `SET ${local ? 'LOCAL ' : ''}search_path = ${schemas.map(quoteIdent).join(', ')}`;
 }
 
+/**
+ * `CREATE SCHEMA IF NOT EXISTS` for each non-public schema the declared objects LIVE
+ * in — migration-compile's rule 0a mirrored into the derived layer. Rule 0a only
+ * creates schemas a MODEL lives in, so a schema populated purely by derived objects
+ * (the derivation half of a stats/stat_views split) was never created and a
+ * from-scratch apply died on its first CREATE. Object schemas only, never
+ * declaredDeps schemas: a dependency's schema belongs to the models that own it, and
+ * a missing one must still fail at CREATE instead of being silently minted empty.
+ *
+ * `GRANT USAGE` rides along per schema (0a-bis mirrored), derived from the objects'
+ * own grant attachments: a role granted SELECT on a matview in a non-public schema
+ * cannot reach it without USAGE, so the object grant is dead without this. A PUBLIC
+ * that appears only as explicitly-revoked gets nothing. Empty for all-public apps —
+ * their apply stays byte-identical. Idempotent when the state layer already created
+ * the schema (a model schema also carrying derived objects).
+ */
+export function renderEnsureObjectSchemas(objects: SourceObject[]): string[] {
+  const statements: string[] = [];
+  const schemas = [...new Set(objects.map((o) => o.schema))].filter((s) => s !== 'public').sort();
+  for (const schema of schemas) {
+    statements.push(`CREATE SCHEMA IF NOT EXISTS ${quoteIdent(schema)}`);
+    const roles = new Set<string>();
+    for (const o of objects) {
+      if (o.schema !== schema) continue;
+      const { grants } = parseGrantAttachments(o.attachments);
+      for (const [role, privileges] of Object.entries(grants)) {
+        if (privileges.length > 0) roles.add(role);
+      }
+    }
+    if (roles.size > 0) {
+      const targets = [...roles].sort().map((r) => (r.toUpperCase() === 'PUBLIC' ? 'PUBLIC' : r)).join(', ');
+      statements.push(`GRANT USAGE ON SCHEMA ${quoteIdent(schema)} TO ${targets}`);
+    }
+  }
+  return statements;
+}
+
 export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[]): RenderedReconcile {
   const srcById = new Map(source.map((o) => [o.identity, o]));
   const statements: string[] = [];

package/src/cli/swap-execute.ts

@@ -107,7 +107,7 @@ export async function executeSwap(runner: QueryRunner, opts: ExecuteSwapOptions)
     try { await runner(`DROP SCHEMA IF EXISTS "${plan.incoming}" CASCADE`); } catch { /* best effort */ }
     return {
       status: 'refused-integrity',
-      reason: `the swap transaction failed — usually the cross-schema FK re-validation (an app row references a ${opts.schema} key the artifact dropped): ${String(err?.message ?? err)}`,
+      reason: `the swap transaction failed and rolled back whole: ${String(err?.message ?? err)}. Candidate causes: a cross-schema FK re-validating against the new data (an app row references a ${opts.schema} key the artifact dropped), or an authz statement colliding with authz the artifact already carries — the message above names the actual failing statement.`,
     };
   }