@everystack/cli 0.4.28 → 0.4.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.28",
+  "version": "0.4.29",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/commands/db-swap.ts

@@ -34,6 +34,7 @@ import { withMutationLease, MutationLeaseError } from '../mutation-lease.js';
 import { resolveConfig, opsFunction } from '../config.js';
 import { invokeAction, presignGet } from '../aws.js';
 import { keyForArtifactId, metaKey } from '../backup.js';
+import { pgEnvFromUrl } from './db.js';
 import { step, success, fail, warn, info } from '../output.js';
 
 /** A COPY-aware line transform that rewrites the schema token on statement lines only. */
@@ -73,10 +74,17 @@ function schemaRewriteStream(from: string, to: string): Transform {
  * rewrite → psql. The archive names `<schema>`; the rewrite lands it as `<incoming>`, COPY-data-safe.
  */
 async function restoreIntoIncoming(url: string, artifactPath: string, schema: string, incoming: string): Promise<void> {
-  // psql takes the connection URL directly (credential parsed by libpq, not on the process table
-  // beyond argv-as-URL); pg_restore -f - just reads the archive file to SQL on stdout.
+  // Connect via PG* env, not `-d <url>`. libpq VALIDATES URI query params against its keyword
+  // list and REJECTS non-keywords like `search_path` ("invalid URI query parameter") — and the
+  // operator URL db:operator-url mints bakes search_path in (fine for postgres.js, fatal for a
+  // libpq client). pgEnvFromUrl extracts only libpq keywords (dropping search_path, routing
+  // sslmode→PGSSLMODE) and puts the password in PGPASSWORD, off the process argv. pg_restore -f -
+  // just reads the archive file to SQL on stdout (no connection).
   const restore = spawn('pg_restore', ['-f', '-', artifactPath], { stdio: ['ignore', 'pipe', 'pipe'] });
-  const psql = spawn('psql', ['-v', 'ON_ERROR_STOP=1', '-d', url], { stdio: ['pipe', 'ignore', 'pipe'] });
+  const psql = spawn('psql', ['-v', 'ON_ERROR_STOP=1'], {
+    stdio: ['pipe', 'ignore', 'pipe'],
+    env: { ...process.env, ...pgEnvFromUrl(url) },
+  });
   let rErr = '', pErr = '';
   restore.stderr.on('data', (d) => { rErr += d.toString(); });
   psql.stderr.on('data', (d) => { pErr += d.toString(); });

package/src/cli/commands/db.ts

@@ -211,7 +211,7 @@ export function buildProvisionSecretPlan(args: {
  *  same seam as pipeline-loader). */
 export interface ServerProvision {
   runProvision(
-    payload: { authPassword?: string; adminPassword?: string },
+    payload: { authPassword?: string; adminPassword?: string; searchPath?: string[] },
     deps: {
       execute: (sql: string) => Promise<unknown>;
       connection?: { host: string; port?: number | string; database: string } | null;
@@ -473,6 +473,31 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   info('Creating the least-privilege role chain on your EXISTING database (no database is created).');
   step('Provisioning roles...');
 
+  // The declared schema set — resolved BEFORE provisioning so it can be set as the ROLE default
+  // (ALTER ROLE … SET search_path), the right layer for bare-ref resolution (search-path-ownership).
+  // Union the DERIVED-object schemas (matviews/views live in schemas the barrel never names) so the
+  // authenticator flip doesn't go dark on bare-ref matview reads. Best-effort: a modelless or
+  // all-public app sets no path (unchanged behavior).
+  let declaredSchemas: string[] = [];
+  try {
+    const { resolveModelsPath } = await import('../models-path.js');
+    const { loadModels } = await import('./db-generate.js');
+    const models = await loadModels(resolveModelsPath(flags.models));
+    let derivedObjects: Array<{ schema: string }> = [];
+    try {
+      const { loadDeclaredDerived } = await import('../declared-derived.js');
+      const declared = await loadDeclaredDerived(flags.models);
+      if (declared) derivedObjects = declared.objects;
+    } catch {
+      // No derived layer resolvable — the table schemas still resolve correctly.
+    }
+    declaredSchemas = collectDeclaredSchemas({ models, derivedObjects });
+  } catch {
+    // No models resolvable here — leave the roles schema-agnostic.
+  }
+  const searchPath = declaredSearchPath(declaredSchemas);
+  if (searchPath.length) info(`  Declared search_path (set as the role default via ALTER ROLE): ${searchPath.join(', ')}`);
+
   // Generate BOTH login passwords and keep them in memory only — they are written straight
   // into the secret store and are NEVER printed, logged, or returned to a human.
   const { randomBytes } = await import('node:crypto');
@@ -486,7 +511,7 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     const { createUrlRunner } = await import('../db-source.js');
     const { runner, end } = await createUrlRunner(url);
     try {
-      return await runProvision({ authPassword, adminPassword }, {
+      return await runProvision({ authPassword, adminPassword, searchPath }, {
         execute: async (statement) => runner(statement),
         connection: parseUrlConnection(url),
         // Same probe as the ops-Lambda venue: a real login as the new role, DDL-capable.
@@ -519,7 +544,7 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     conn = parseUrlConnection(directUrl);
   } else {
     try {
-      result = await invokeAction(config.region, opsFunction(config), 'db:provision', { authPassword, adminPassword });
+      result = await invokeAction(config.region, opsFunction(config), 'db:provision', { authPassword, adminPassword, searchPath });
     } catch (err: any) {
       // Auto-fallback: no Ops Lambda (Unknown action), but an ADMIN_DATABASE_URL secret exists —
       // provision directly over it. Master never crosses the CLI; the operator sets nothing new.
@@ -575,31 +600,6 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   // wrong-database scare, and that check meant re-handling the master credential).
   success(`Target database: ${conn.database} @ ${conn.host}:${conn.port ?? 5432} — secrets for stage "${flags.stage}" will point here.`);
 
-  // Bake the app's declared schemas into the minted URLs, so a multi-schema API connects with
-  // the right search_path instead of going dark on bare refs (best-effort: a modelless app or
-  // an all-public one changes nothing).
-  let declaredSchemas: string[] = [];
-  try {
-    const { resolveModelsPath } = await import('../models-path.js');
-    const { loadModels } = await import('./db-generate.js');
-    const models = await loadModels(resolveModelsPath(flags.models));
-    // Union the DERIVED-object schemas (matviews/views live in schemas the barrel never
-    // names) so the authenticator flip doesn't go dark on bare-ref matview reads.
-    let derivedObjects: Array<{ schema: string }> = [];
-    try {
-      const { loadDeclaredDerived } = await import('../declared-derived.js');
-      const declared = await loadDeclaredDerived(flags.models);
-      if (declared) derivedObjects = declared.objects;
-    } catch {
-      // No derived layer resolvable — the table schemas still bake correctly.
-    }
-    declaredSchemas = collectDeclaredSchemas({ models, derivedObjects });
-  } catch {
-    // No models resolvable here — leave the URLs schema-agnostic.
-  }
-  const searchPath = declaredSearchPath(declaredSchemas);
-  if (searchPath.length) info(`  search_path baked into DATABASE_URL: ${searchPath.join(', ')}`);
-
   // Preserve the connection params (sslmode, …) from the URL the app already connects with — the
   // minted URL is built from bare host/port/db components, so without this a `?sslmode=require`
   // would be dropped and the new roles could fail to connect on an SSL-forced RDS. Prefer the
@@ -608,11 +608,12 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     ?? stageSecrets.ADMIN_DATABASE_URL ?? stageSecrets.AdminDatabaseUrl
     ?? stageSecrets.DATABASE_URL ?? stageSecrets.DatabaseUrl;
 
+  // The minted secret is credentials-only: search_path now lives on the ROLE (ALTER ROLE, above),
+  // not baked into the URL. This keeps the secret a pure credential and — critically — yields a
+  // libpq-clean URL (no ?search_path=, which psql/pg_restore reject as an unknown keyword). Real
+  // connection params (sslmode, …) are still carried from the source URL.
   const mint = (role: string, password: string): string =>
-    withSearchPath(
-      preserveConnParams(`postgresql://${role}:${password}@${conn.host}:${conn.port ?? 5432}/${conn.database}`, sourceUrl),
-      declaredSchemas,
-    );
+    preserveConnParams(`postgresql://${role}:${password}@${conn.host}:${conn.port ?? 5432}/${conn.database}`, sourceUrl);
 
   const authUrl = mint(result.loginRole, authPassword);
   const adminUrl = result.adminRole ? mint(result.adminRole, adminPassword) : undefined;

package/src/cli/index.ts

@@ -357,7 +357,7 @@ Usage:
   everystack db:psql           --stage <name>  Interactive ADMIN psql (IAM-gated; resolves the admin URL in-process)
   everystack db:psql           [--stage <name>] -c <command>  Run one query via Lambda (works for private RDS)
   everystack db:doctor         [--stage <name>] [--direct | --database-url <api> [--admin-database-url <ops>]]  Check the DB is least-privilege + RLS-subject (api vs operator connection). No flag = ops-Lambda venue (auto-falls to direct via the stage secrets if the handler has no dbPlugin). --direct = probe both connections from the stage's DATABASE_URL + ADMIN_DATABASE_URL secrets; --database-url = explicit local venue (a lone URL is probed as both)
-  everystack db:provision      --stage <name> [--direct | --database-url <url>]  Create the least-privilege role chain on an EXISTING database (idempotent; creates no DB). No flag = ops-Lambda venue (auto-falls to direct via the ADMIN_DATABASE_URL secret if the handler has no dbPlugin). --direct = direct connection reading that secret (master never on argv); --database-url = explicit URL. Declared schemas are baked into the minted DATABASE_URL as search_path
+  everystack db:provision      --stage <name> [--direct | --database-url <url>]  Create the least-privilege role chain on an EXISTING database (idempotent; creates no DB). No flag = ops-Lambda venue (auto-falls to direct via the ADMIN_DATABASE_URL secret if the handler has no dbPlugin). --direct = direct connection reading that secret (master never on argv); --database-url = explicit URL. Declared schemas are set as the ROLE default (ALTER ROLE … SET search_path) — the secret stays credentials-only, and the URL is libpq-clean
   everystack db:snapshot       [--stage <name>] [--instance <id>]  Take a physical RDS snapshot (instant DR point; RDS only — use db:backup for portable logical backups)
   everystack db:snapshots      [--stage <name>] [--instance <id>]  List manual RDS snapshots for the instance
   everystack db:backup:probe   [--stage <name>]  Verify the pg_dump layer is attached + version-compatible with the server