@everystack/cli 0.4.25 → 0.4.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.25",
+  "version": "0.4.27",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/commands/db-refresh.ts

@@ -10,7 +10,7 @@
  * (the `db:refresh` action), so a least-privileged operator never holds a URL. `--database-url`
  * / `--direct` refresh over a direct connection (dev). `--list` previews the topo-ordered
  * matviews without connecting. Plain REFRESH (ACCESS EXCLUSIVE) — CONCURRENTLY is a follow-on.
- * (GridironDB 2026-07-19.)
+ * (consumer field report 2026-07-19.)
  */
 
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';

package/src/cli/commands/db.ts

@@ -363,7 +363,7 @@ export function declaredSearchPath(schemas: string[]): string[] {
  * descriptors, NOT the barrel, so a table-only scan structurally misses it — and the
  * authenticator flip then goes dark on every bare-ref matview read ("relation does not
  * exist"). Baking the union into DATABASE_URL's search_path keeps those reads resolving.
- * (GridironDB 2026-07-19: 54 matviews in `stats_view`, absent from the table-only bake.)
+ * (consumer field report 2026-07-19: 54 matviews in `stats_view`, absent from the table-only bake.)
  */
 export function collectDeclaredSchemas(args: {
   models: Array<{ schema?: string }>;
@@ -379,7 +379,7 @@ export function collectDeclaredSchemas(args: {
  * defaults to `"$user",public`, so every bare-ref query 404s until a hand ALTER ROLE pin
  * (recorded nowhere, repeated every stage) — writing it into the minted DATABASE_URL is
  * declarative and survives redeploys. postgres.js forwards unknown URL params as connection
- * startup params (GridironDB proved search_path this way). No-op for an all-public app.
+ * startup params (a consumer proved search_path this way). No-op for an all-public app.
  */
 export function withSearchPath(url: string, schemas: string[]): string {
   const path = declaredSearchPath(schemas);
@@ -389,6 +389,31 @@ export function withSearchPath(url: string, schemas: string[]): string {
   return u.toString();
 }
 
+/**
+ * Carry the CONNECTION params (sslmode, connect_timeout, …) from the URL the app already connects
+ * with onto a freshly minted one. provision mints the new URL from host/port/database components,
+ * which silently drops any `?sslmode=require` on the source — on an `rds.force_ssl=1` instance the
+ * new authenticator/migrator roles then can't connect. `search_path` is provision's OWN concern
+ * (withSearchPath owns it), so it is never copied; existing params on the minted URL win. No-op
+ * when there is no source or it doesn't parse.
+ */
+export function preserveConnParams(mintedUrl: string, sourceUrl?: string): string {
+  if (!sourceUrl) return mintedUrl;
+  let src: URL;
+  let out: URL;
+  try {
+    src = new URL(sourceUrl);
+    out = new URL(mintedUrl);
+  } catch {
+    return mintedUrl;
+  }
+  for (const [key, value] of src.searchParams) {
+    if (key === 'search_path') continue; // provision derives search_path from the declared schemas
+    if (!out.searchParams.has(key)) out.searchParams.set(key, value);
+  }
+  return out.toString();
+}
+
 /** host/port/database from a postgres URL — the direct venue's connection info. */
 export function parseUrlConnection(url: string): { host: string; port: string; database: string } {
   const u = new URL(url);
@@ -575,16 +600,22 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   const searchPath = declaredSearchPath(declaredSchemas);
   if (searchPath.length) info(`  search_path baked into DATABASE_URL: ${searchPath.join(', ')}`);
 
-  const authUrl = withSearchPath(
-    `postgresql://${result.loginRole}:${authPassword}@${conn.host}:${conn.port ?? 5432}/${conn.database}`,
-    declaredSchemas,
-  );
-  const adminUrl = result.adminRole
-    ? withSearchPath(
-        `postgresql://${result.adminRole}:${adminPassword}@${conn.host}:${conn.port ?? 5432}/${conn.database}`,
-        declaredSchemas,
-      )
-    : undefined;
+  // Preserve the connection params (sslmode, …) from the URL the app already connects with — the
+  // minted URL is built from bare host/port/db components, so without this a `?sslmode=require`
+  // would be dropped and the new roles could fail to connect on an SSL-forced RDS. Prefer the
+  // venue URL provision connected through, else the existing DATABASE_URL secret (either spelling).
+  const sourceUrl = directUrl
+    ?? stageSecrets.ADMIN_DATABASE_URL ?? stageSecrets.AdminDatabaseUrl
+    ?? stageSecrets.DATABASE_URL ?? stageSecrets.DatabaseUrl;
+
+  const mint = (role: string, password: string): string =>
+    withSearchPath(
+      preserveConnParams(`postgresql://${role}:${password}@${conn.host}:${conn.port ?? 5432}/${conn.database}`, sourceUrl),
+      declaredSchemas,
+    );
+
+  const authUrl = mint(result.loginRole, authPassword);
+  const adminUrl = result.adminRole ? mint(result.adminRole, adminPassword) : undefined;
 
   // Write the secrets directly to the SST secret store — never display them. One blob
   // write updates every key together, so there is no window where the API side is the

package/src/cli/discover.ts

@@ -26,6 +26,7 @@ interface DiscoveredConfig {
   updatesBucket: string;
   clientBundlesBucket: string;
   mediaBucket?: string;
+  backupsBucket?: string;
   kvsArn?: string;
   distributionId?: string;
 }
@@ -209,6 +210,7 @@ interface BucketsResult {
   updatesBucket?: string;
   clientBundlesBucket?: string;
   mediaBucket?: string;
+  backupsBucket?: string;
 }
 
 /**
@@ -231,10 +233,15 @@ export async function discoverBuckets(
   // Media bucket resource is named 'Media' (not 'MediaBucket'), so match both patterns
   const mediaNeedle = `${prefix}media-`.toLowerCase();
   const mediaBucketNeedle = `${prefix}mediabucket-`.toLowerCase();
+  // Backups bucket (db:backup/restore/backup:download). Discovered like every other bucket, so the
+  // --stage path carries it — db:backup:download presigns CLIENT-side and needs the name locally
+  // (db:backup/backups run server-side in the ops Lambda, which is why only download failed).
+  const backupsNeedle = `${prefix}backupsbucket-`.toLowerCase();
 
   let updatesBucket: string | undefined;
   let clientBundlesBucket: string | undefined;
   let mediaBucket: string | undefined;
+  let backupsBucket: string | undefined;
 
   for (const b of buckets) {
     if (!b.Name) continue;
@@ -242,10 +249,11 @@ export async function discoverBuckets(
     if (lower.startsWith(updatesNeedle)) updatesBucket = b.Name;
     if (lower.startsWith(clientNeedle)) clientBundlesBucket = b.Name;
     if (!mediaBucket && (lower.startsWith(mediaNeedle) || lower.startsWith(mediaBucketNeedle))) mediaBucket = b.Name;
-    if (updatesBucket && clientBundlesBucket && mediaBucket) break;
+    if (lower.startsWith(backupsNeedle)) backupsBucket = b.Name;
+    if (updatesBucket && clientBundlesBucket && mediaBucket && backupsBucket) break;
   }
 
-  return { updatesBucket, clientBundlesBucket, mediaBucket };
+  return { updatesBucket, clientBundlesBucket, mediaBucket, backupsBucket };
 }
 
 // ---------------------------------------------------------------------------
@@ -304,14 +312,16 @@ export async function discoverConfig(
     );
   }
 
-  // Media bucket fallback: if not found via naming convention (custom/pre-existing bucket),
-  // try reading from .sst/outputs.json where sst.config.ts return values land.
+  // Media/backups bucket fallback: if not found via naming convention (custom/pre-existing
+  // bucket), try reading from .sst/outputs.json where sst.config.ts return values land.
   let mediaBucket = bucketsResult.mediaBucket;
-  if (!mediaBucket) {
+  let backupsBucket = bucketsResult.backupsBucket;
+  if (!mediaBucket || !backupsBucket) {
     try {
       const raw = await fs.readFile(path.resolve('.sst', 'outputs.json'), 'utf8');
       const outputs = JSON.parse(raw);
-      if (outputs.mediaBucket) mediaBucket = outputs.mediaBucket;
+      if (!mediaBucket && outputs.mediaBucket) mediaBucket = outputs.mediaBucket;
+      if (!backupsBucket && outputs.backupsBucket) backupsBucket = outputs.backupsBucket;
     } catch {
       // outputs.json not available — non-fatal
     }
@@ -327,6 +337,7 @@ export async function discoverConfig(
     updatesBucket: bucketsResult.updatesBucket,
     clientBundlesBucket: bucketsResult.clientBundlesBucket,
     mediaBucket,
+    backupsBucket,
     kvsArn: cfResult.kvsArn,
     distributionId,
   };
@@ -337,7 +348,7 @@ export async function discoverConfig(
 // ---------------------------------------------------------------------------
 
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
-const CACHE_VERSION = 4; // Bump when CachedOutputs schema changes to invalidate stale caches
+const CACHE_VERSION = 5; // Bump when CachedOutputs schema changes to invalidate stale caches (5: +backupsBucket)
 
 interface CachedOutputs {
   _cachedAt: number;
@@ -350,6 +361,7 @@ interface CachedOutputs {
   updatesBucket?: string;
   clientBundlesBucket?: string;
   mediaBucket?: string;
+  backupsBucket?: string;
   kvsArn?: string;
   distributionId?: string;
 }
@@ -377,6 +389,7 @@ export async function getCachedConfig(stage: string): Promise<DiscoveredConfig |
       updatesBucket: cached.updatesBucket,
       clientBundlesBucket: cached.clientBundlesBucket,
       mediaBucket: cached.mediaBucket,
+      backupsBucket: cached.backupsBucket,
       kvsArn: cached.kvsArn,
       distributionId: cached.distributionId,
     };
@@ -452,6 +465,7 @@ export async function setCachedConfig(stage: string, config: DiscoveredConfig):
     updatesBucket: config.updatesBucket,
     clientBundlesBucket: config.clientBundlesBucket,
     mediaBucket: config.mediaBucket,
+    backupsBucket: config.backupsBucket,
     kvsArn: config.kvsArn,
     distributionId: config.distributionId,
   };

package/src/cli/refresh-execute.ts

@@ -6,7 +6,7 @@
  * path. This is that verb: refresh the declared matviews in dependency order, over whatever
  * runner the venue supplies. The ops `db:refresh` action loads executeRefresh here and runs it
  * on the operator connection, so `db:refresh --stage` needs no raw URL on the operator's machine
- * (GridironDB 2026-07-19, the data-lane twin of the reconcile lane).
+ * (consumer field report 2026-07-19, the data-lane twin of the reconcile lane).
  *
  * Plain `REFRESH MATERIALIZED VIEW` (ACCESS EXCLUSIVE) — the faithful twin of the direct-connect
  * data script it replaces. CONCURRENTLY (needs a unique index; doesn't block reads) is a