@everystack/cli 0.4.29 → 0.4.31

package/src/cli/schema-swap.ts

@@ -19,9 +19,12 @@
  *      ADD CONSTRAINT, the whole transaction rolls back, and the swap is refused — the
  *      cross-schema integrity gate, for free.
  *   4. RE-APPLY the schema's authz (RLS, policies, grants) from the declared descriptors. The
- *      incoming schema was restored `--no-owner --no-privileges`, so it carries no grants;
+ *      incoming schema was restored `--no-owner --no-privileges`, so it carries no grants — but
+ *      pg_dump does NOT strip RLS policies, so the declared policies arrive already present.
+ *      The re-apply drops-then-creates each declared policy (idempotent — a bare CREATE POLICY
+ *      would collide and roll the swap back) so declared stays the single source of truth.
  *      GRANT/POLICY are transactional, so they ride the same transaction — there is no
- *      committed instant where the new schema serves with absent or stale grants.
+ *      committed instant where the new schema serves with absent or stale authz.
  *
  * No REFRESH anywhere: the artifact ships computed rows as tables (defineMaterializedTable),
  * so the swap is a pointer flip, never a recompute.
@@ -30,7 +33,7 @@
 import type { ModelDescriptor } from '@everystack/model';
 import { modelForeignKeys, qualifiedTable } from './schema-compile.js';
 import { compileTableContract } from './authz-compile.js';
-import { emitReconcileSql } from './authz-reconcile.js';
+import { emitSwapAuthzSql } from './authz-reconcile.js';
 import { schemaOf } from './schema-fingerprint.js';
 
 const SAFE_SCHEMA = /^[a-z_][a-z0-9_$]*$/;
@@ -122,12 +125,15 @@ export function renderSchemaSwap(models: ModelDescriptor[], opts: SwapOptions):
   assertSafeSchema(retiring);
 
   const fks = crossSchemaForeignKeys(models, schema);
-  // Full authz for the swapped-in schema, from scratch (live side empty = every declared grant
-  // is a create) — the incoming schema was restored with privileges stripped.
+  // Re-apply the swapped-in schema's authz from the declared descriptors. The incoming schema
+  // was restored `--no-privileges` (no grants), but pg_dump does NOT strip RLS policies — the
+  // restore leaves the declared policies already present — so this drops-then-creates each
+  // declared policy to stay idempotent against them (a bare CREATE POLICY would collide and roll
+  // the swap back). Declared stays the single source of truth. See emitSwapAuthzSql.
   const statsContracts = models
     .filter((m) => (m.schema || 'public') === schema)
     .map((m) => compileTableContract(m));
-  const authz = emitReconcileSql({ tables: statsContracts, functions: [] }, { tables: [], functions: [] });
+  const authz = emitSwapAuthzSql({ tables: statsContracts, functions: [] });
 
   const statements = [
     ...fks.map((f) => f.dropSql),

package/src/cli/task-poll.ts

@@ -0,0 +1,67 @@
+/**
+ * task-poll — poll an ephemeral Task run (dispatched via the ops Lambda) until it stops.
+ *
+ * Shared by task:probe and the pg-binary verbs (db:backup / db:export, later restore/swap): they all
+ * dispatch a task, get back a run id + ARN, then poll `task:status` until STOPPED. The poll is
+ * BOUNDED — a Fargate task can sit in PROVISIONING/PENDING on capacity or ENI trouble, and a naked
+ * loop would hang the CLI. A few consecutive DescribeTasks blips are tolerated (a throttle shouldn't
+ * abort a live task); past that, or the deadline, the caller reconciles via the run id (the task_log
+ * row + ECS both carry it). This owns the loop; the caller owns the success/failure messaging.
+ */
+
+import { invokeAction } from './aws.js';
+import { info } from './output.js';
+
+const POLL_INTERVAL_MS = 5_000;
+/** Backup/export/restore can run minutes on large databases — far longer than the probe's handshake. */
+export const DEFAULT_DEADLINE_MS = 30 * 60_000;
+const MAX_CONSECUTIVE_ERRORS = 3;
+
+const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
+
+export interface TaskStatus {
+  lastStatus?: string;
+  stopped?: boolean;
+  exitCode?: number | null;
+  stoppedReason?: string | null;
+  /** The task's self-reported result row (db:backup/export write id/key/bytes/fingerprint). */
+  result?: Record<string, unknown> | null;
+  error?: string;
+}
+
+export type TaskPollResult =
+  | { outcome: 'stopped'; status: TaskStatus }
+  | { outcome: 'error'; status: TaskStatus }
+  | { outcome: 'timeout'; lastStatus: string };
+
+/**
+ * Poll until the task stops, printing each lifecycle transition. Returns `stopped` (read exitCode),
+ * `error` (task:status failed repeatedly — the task may still be running), or `timeout`.
+ */
+export async function pollTaskUntilStopped(
+  region: string,
+  fn: string,
+  ids: { runId: string; taskArn: string },
+  opts: { deadlineMs?: number } = {},
+): Promise<TaskPollResult> {
+  const deadline = Date.now() + (opts.deadlineMs ?? DEFAULT_DEADLINE_MS);
+  let last = '';
+  let consecutiveErrors = 0;
+  while (Date.now() < deadline) {
+    const status = (await invokeAction(region, fn, 'task:status', { runId: ids.runId, taskArn: ids.taskArn })) as TaskStatus;
+    if (status?.error) {
+      if (++consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) return { outcome: 'error', status };
+      info(`  (status check blipped: ${status.error} — retrying)`);
+      await sleep(POLL_INTERVAL_MS);
+      continue;
+    }
+    consecutiveErrors = 0;
+    if (status.lastStatus && status.lastStatus !== last) {
+      info(`  ${status.lastStatus}`);
+      last = status.lastStatus;
+    }
+    if (status.stopped) return { outcome: 'stopped', status };
+    await sleep(POLL_INTERVAL_MS);
+  }
+  return { outcome: 'timeout', lastStatus: last || 'unknown' };
+}

package/src/exec.ts

@@ -0,0 +1,20 @@
+/**
+ * @everystack/cli/exec — the db:exec core, for the ops-Lambda lane.
+ *
+ * db:exec applies credential-free write SQL as ONE transaction, DML-only by a semantic catalog
+ * digest (no role, no superuser, no regex), bracketed by a crash-truthful ledger. This barrel lets
+ * the ops `db:exec` action (in @everystack/server's dbPlugin) load the same core the CLI uses and
+ * run it on the operator connection db:seed already uses — so `db:exec --stage` needs no raw admin
+ * URL on the operator's machine.
+ */
+
+export { executeExec, assertNoTxnControl, execSha } from './cli/exec-execute.js';
+export type { ExecIntent, ExecOutcome, ExecuteExecOptions, ExecResult } from './cli/exec-execute.js';
+
+export { runExecInTx, SchemaChangedError, railStatements, EXEC_RAIL_DEFAULTS } from './cli/exec-run.js';
+export type { TxRunner, ExecStmtResult, ExecRails, RunExecInTxOptions } from './cli/exec-run.js';
+
+export { catalogDigestQuery } from './cli/exec-digest.js';
+
+export { ENSURE_EXEC_LOG_SQL, renderExecIntentInsert, renderExecOutcomeUpdate } from './cli/exec-log.js';
+export type { ExecIntentRow, ExecOutcomeRow } from './cli/exec-log.js';