@everystack/cli 0.4.30 → 0.4.32

package/src/cli/migration-generate.ts

@@ -18,7 +18,7 @@
 import type { ModelDescriptor, SequenceDescriptor } from '@everystack/model';
 import type { SchemaSnapshot } from './schema-introspect.js';
 import type { AuthzContract } from './authz-contract.js';
-import { compileTableSchema, compileRenames, compileTableRenames, compileCreateTable, compileEnums, compileSequences } from './schema-compile.js';
+import { compileTableSchema, compileRenames, compileTableRenames, compileTableMoves, compileCreateTable, compileEnums, compileSequences } from './schema-compile.js';
 import { compileTableContract } from './authz-compile.js';
 import { emitReconcileSql } from './authz-reconcile.js';
 import { diffSchema, emitSchemaSql, type SchemaChange } from './schema-diff.js';
@@ -84,11 +84,16 @@ function holdDrop(sql: string): string {
 export function unmodeledTables(models: ModelDescriptor[], current: SchemaSnapshot, opts: GenerateOptions = {}): string[] {
   const schema = opts.schema ?? 'public';
   const declared = new Set(models.map((m) => `${schema}.${m.table}`));
-  // A pending table rename's source is ours — declared under its new name.
+  // A pending table rename's OR move's source is ours — declared under its new (qualified)
+  // name; without this it reads as an undeclared orphan (F1) and the move/rename silently
+  // degrades to CREATE + leave-behind, the exact bug the markers exist to prevent.
   const currentNames = new Set(current.tables.map((t) => t.table));
   for (const [to, from] of Object.entries(compileTableRenames(models, { schema }))) {
     if (!currentNames.has(to)) declared.add(from);
   }
+  for (const [to, from] of Object.entries(compileTableMoves(models, { schema }))) {
+    if (!currentNames.has(to)) declared.add(from);
+  }
   return current.tables.map((t) => t.table).filter((t) => !declared.has(t)).sort();
 }
 
@@ -131,20 +136,28 @@ export function generateMigrationSql(models: ModelDescriptor[], current: SchemaS
     .map((s) => `CREATE SCHEMA IF NOT EXISTS "${s}"`);
 
   const tableRenames = compileTableRenames(models, { schema });
+  const tableMoves = compileTableMoves(models, { schema });
   const currentNames = new Set(current.tables.map((t) => t.table));
   const pendingRenameSources = new Set(
     Object.entries(tableRenames)
       .filter(([to, from]) => !currentNames.has(to) && currentNames.has(from))
       .map(([, from]) => from),
   );
+  // A move's source (old schema, same name) must survive the declared-scope filter too —
+  // else the diff's pre-pass never sees it and the move degrades to CREATE + orphan (F1).
+  const pendingMoveSources = new Set(
+    Object.entries(tableMoves)
+      .filter(([to, from]) => !currentNames.has(to) && currentNames.has(from))
+      .map(([, from]) => from),
+  );
   const scopedCurrent: SchemaSnapshot = opts.scope === 'full'
     ? { tables: current.tables, enums: current.enums ?? [] }
     : {
-        tables: current.tables.filter((t) => declaredTables.has(t.table) || pendingRenameSources.has(t.table)),
+        tables: current.tables.filter((t) => declaredTables.has(t.table) || pendingRenameSources.has(t.table) || pendingMoveSources.has(t.table)),
         enums: (current.enums ?? []).filter((e) => declaredEnums.has(e.name)),
       };
   const renames = compileRenames(models, { schema });
-  const changes = diffSchema(desired, scopedCurrent, renames, tableRenames);
+  const changes = diffSchema(desired, scopedCurrent, renames, tableRenames, tableMoves);
 
   const modelByTable = new Map(models.map((m) => [`${schemaOf(m)}.${m.table}`, m]));
   const emitted = emitSchemaSql(changes, {
@@ -174,11 +187,18 @@ export function generateMigrationSql(models: ModelDescriptor[], current: SchemaS
   // data DDL just created. Emitted only when the live contract is supplied; the Models'
   // `abilities` compile to the same contract shape introspection reads, so the two diff.
   // Authz changes are data-safe (no row touches), so they are never held by `allowDrops`.
-  const pendingByFrom = new Map(
-    Object.entries(tableRenames)
+  // A moved table carries its policies/grants with it through SET SCHEMA (OID-attached),
+  // so the live authz keyed under the OLD schema must be read under the NEW name — else
+  // emitReconcileSql finds no live entry and emits a bare CREATE POLICY that collides
+  // post-move and rolls back the whole apply (F2). Same rewrite the rename path relies on.
+  const pendingByFrom = new Map([
+    ...Object.entries(tableRenames)
       .filter(([, from]) => pendingRenameSources.has(from))
       .map(([to, from]) => [from, to] as const),
-  );
+    ...Object.entries(tableMoves)
+      .filter(([, from]) => pendingMoveSources.has(from))
+      .map(([to, from]) => [from, to] as const),
+  ]);
   const liveAuthzRenamed = opts.liveAuthz && pendingByFrom.size > 0
     ? {
         ...opts.liveAuthz,

package/src/cli/schema-compile.ts

@@ -575,3 +575,20 @@ export function compileTableRenames(models: ModelDescriptor[], opts: { schema?:
   }
   return map;
 }
+
+/**
+ * Table-level MOVE intent: qualified new name → qualified old name, SAME table name in a
+ * DIFFERENT schema (the cross-schema twin of `compileTableRenames`). Produced off the
+ * Models' `movedFrom` option, consumed by `diffSchema`'s pre-pass, which turns a
+ * create-in-new-schema + undeclared orphan into one `ALTER TABLE … SET SCHEMA …`.
+ */
+export function compileTableMoves(models: ModelDescriptor[], opts: { schema?: string } = {}): Record<string, string> {
+  const map: Record<string, string> = {};
+  for (const model of models) {
+    if (!model.movedFrom) continue;
+    const newSchema = model.schema ?? opts.schema ?? 'public';
+    // Same table name; only the schema changes. from = old schema, to = new schema.
+    map[`${newSchema}.${model.table}`] = `${model.movedFrom}.${model.table}`;
+  }
+  return map;
+}

package/src/cli/schema-diff.ts

@@ -72,6 +72,12 @@ export type SchemaChange =
   | { kind: 'renameTableSatisfied'; table: string; from: string }
   /** A table marker pointing at a table the database doesn't have — fell back to CREATE, a notice. */
   | { kind: 'renameTableSourceMissing'; table: string; from: string }
+  /** A table-level `movedFrom` satisfied: old-schema table present, new absent → one SET SCHEMA, data preserved. */
+  | { kind: 'moveTable'; from: string; to: string }
+  /** A move marker whose move is already applied (table already in the new schema) — inert, a notice. */
+  | { kind: 'moveTableSatisfied'; table: string; from: string }
+  /** A move marker pointing at a table absent in BOTH schemas — fell back to CREATE, a notice. */
+  | { kind: 'moveTableSourceMissing'; table: string; from: string }
   /** A new enum type → `CREATE TYPE … AS ENUM (…)`, emitted before the tables that use it. */
   | { kind: 'createType'; name: string; values: string[] }
   /** A value appended to an existing enum → `ALTER TYPE … ADD VALUE` (carries a -- WARNING). */
@@ -105,6 +111,15 @@ export type RenameMap = Record<string, Record<string, string>>;
  */
 export type TableRenameMap = Record<string, string>;
 
+/**
+ * Table-level MOVE intent: qualified new name → qualified old name (SAME table name, a
+ * DIFFERENT schema). Produced by `compileTableMoves` off the Models' `movedFrom` option;
+ * consumed by `diffSchema`'s pre-pass, which rewrites the current snapshot (old-schema
+ * table seen under its new qualified name, and every referencing FK re-pointed) so a
+ * create-in-new-schema + orphan collapses to one `ALTER TABLE … SET SCHEMA …`.
+ */
+export type TableMoveMap = Record<string, string>;
+
 // ---------------------------------------------------------------------------
 // Normalization — so semantically-equal expressions don't read as drift.
 // ---------------------------------------------------------------------------
@@ -290,8 +305,9 @@ export function normalizeCheck(expr: string): string {
  * replaced constraint never clashes with its old self and a column is never dropped out
  * from under a constraint that still references it.
  */
-export function diffSchema(desired: SchemaSnapshot, current: SchemaSnapshot, renames: RenameMap = {}, tableRenames: TableRenameMap = {}): SchemaChange[] {
+export function diffSchema(desired: SchemaSnapshot, current: SchemaSnapshot, renames: RenameMap = {}, tableRenames: TableRenameMap = {}, tableMoves: TableMoveMap = {}): SchemaChange[] {
   const creates: SchemaChange[] = [];
+  const moveTables: SchemaChange[] = [];
   const renameTables: SchemaChange[] = [];
   const renameColumns: SchemaChange[] = [];
   const addColumns: SchemaChange[] = [];
@@ -307,6 +323,55 @@ export function diffSchema(desired: SchemaSnapshot, current: SchemaSnapshot, ren
   const currentByName = new Map(current.tables.map((t) => [t.table, t]));
   const desiredNames = new Set(desired.tables.map((t) => t.table));
 
+  // Table-move pre-pass: honor the Models' cross-schema `movedFrom` before any matching
+  // (runs before the rename pre-pass; a table cannot carry both markers — defineModel
+  // forbids it). SET SCHEMA carries the table's data, indexes, constraints, policies,
+  // grants, triggers and owned sequences with it (OID-attached), so a satisfied move
+  // rewrites the current snapshot: the old-schema table is seen under its new qualified
+  // name (every downstream column/constraint/index diff lands on it, and the old name
+  // never reaches the dropTables sweep), AND every referencing FK is re-pointed old→new.
+  // new-name-present → inert notice; source absent in both schemas → CREATE path + notice.
+  for (const [to, from] of Object.entries(tableMoves)) {
+    if (!desiredNames.has(to)) continue; // the marker's model isn't in this diff
+    if (currentByName.has(to)) {
+      notices.push({ kind: 'moveTableSatisfied', table: to, from });
+      continue;
+    }
+    const source = currentByName.get(from);
+    if (!source) {
+      notices.push({ kind: 'moveTableSourceMissing', table: to, from });
+      continue;
+    }
+    moveTables.push({ kind: 'moveTable', from, to });
+    currentByName.delete(from);
+    // The table's OWNED sequences ride SET SCHEMA too, so a serial default that qualified
+    // the old schema (`nextval('stats.foo_id_seq')`) reads `nextval('curated.foo_id_seq')`
+    // after the move — rewrite it on the copied source so it does not churn as a spurious
+    // SET DEFAULT (F8). Only the moved table's OWN sequence-qualified defaults are touched.
+    const fromSchema = from.split('.')[0];
+    const toSchema = to.split('.')[0];
+    // Literal replace (split/join), not a RegExp — a schema name can be a quoted identifier
+    // carrying regex metacharacters, which `new RegExp` would misfire or throw on.
+    const requalifyDefault = (d: string | null): string | null =>
+      d == null ? d : d.split(`nextval('${fromSchema}.`).join(`nextval('${toSchema}.`);
+    currentByName.set(to, {
+      ...source,
+      table: to,
+      columns: source.columns.map((col) => (col.default != null ? { ...col, default: requalifyDefault(col.default) } : col)),
+    });
+    // F4: re-point every referencing FK (including the moved table's own self-FKs) from
+    // the old qualified name to the new, across the WHOLE current snapshot — so a
+    // referencing table's FK content-key matches the desired side and Postgres's
+    // carried-through FK is not needlessly dropped and re-added.
+    for (const [name, t] of currentByName) {
+      if (!t.foreignKeys.some((fk) => fk.refTable === from)) continue;
+      currentByName.set(name, {
+        ...t,
+        foreignKeys: t.foreignKeys.map((fk) => (fk.refTable === from ? { ...fk, refTable: to } : fk)),
+      });
+    }
+  }
+
   // Table-rename pre-pass: honor the Models' table-level `renamedFrom` before
   // any matching. A satisfied rename rewrites the current snapshot — the old
   // table is seen under its new name — so every downstream diff (columns,
@@ -404,6 +469,7 @@ export function diffSchema(desired: SchemaSnapshot, current: SchemaSnapshot, ren
   // the other removals; notices are comments — emitted last, after the DDL.
   return [
     ...e.creates, ...e.adds, ...sequenceCreates,
+    ...moveTables,
     ...renameTables,
     ...creates, ...renameColumns, ...addColumns, ...alters, ...trailingDefaults,
     ...dropConstraints, ...addConstraints, ...createIndexes,
@@ -753,6 +819,16 @@ function emitOne(change: SchemaChange, opts: EmitOptions): string {
     case 'renameTable':
       // RENAME TO takes a bare name — the table stays in its schema.
       return `ALTER TABLE ${change.from} RENAME TO ${quote(change.to.split('.').pop()!)};`;
+    case 'moveTable':
+      // SET SCHEMA takes a bare schema name; the table keeps its name and carries its data,
+      // indexes, constraints, policies, grants, triggers and owned sequences with it. The
+      // WARNING (not NOTICE — this statement is executable; NOTICE is the reserved pure-comment
+      // prefix) flags the consumer-breakage surface a move can't see (see F7).
+      return `-- WARNING: ${change.from} moves to schema ${change.to.split('.')[0]} — unqualified readers resolve by search_path (verify ordering), and qualified references (views, functions, app queries naming ${change.from}) must be updated + reconciled.\nALTER TABLE ${change.from} SET SCHEMA ${quote(change.to.split('.')[0])};`;
+    case 'moveTableSatisfied':
+      return `-- NOTICE: the movedFrom marker on table ${change.table} is satisfied — the table already exists in its declared schema, ASSUMED to be the completed move from "${change.from.split('.')[0]}" (a pre-existing unrelated table of the same name would read the same); the marker is now inert and can be removed.`;
+    case 'moveTableSourceMissing':
+      return `-- NOTICE: table ${change.table} declares movedFrom "${change.from.split('.')[0]}", but the database has it in neither schema — created fresh; remove the marker once every environment is past it.`;
     case 'renameTableSatisfied':
       return `-- NOTICE: the renamedFrom marker on table ${change.table} is satisfied — the rename from "${change.from}" is applied, the marker is now inert and can be removed.`;
     case 'renameTableSourceMissing':

package/src/cli/task-poll.ts

@@ -0,0 +1,67 @@
+/**
+ * task-poll — poll an ephemeral Task run (dispatched via the ops Lambda) until it stops.
+ *
+ * Shared by task:probe and the pg-binary verbs (db:backup / db:export, later restore/swap): they all
+ * dispatch a task, get back a run id + ARN, then poll `task:status` until STOPPED. The poll is
+ * BOUNDED — a Fargate task can sit in PROVISIONING/PENDING on capacity or ENI trouble, and a naked
+ * loop would hang the CLI. A few consecutive DescribeTasks blips are tolerated (a throttle shouldn't
+ * abort a live task); past that, or the deadline, the caller reconciles via the run id (the task_log
+ * row + ECS both carry it). This owns the loop; the caller owns the success/failure messaging.
+ */
+
+import { invokeAction } from './aws.js';
+import { info } from './output.js';
+
+const POLL_INTERVAL_MS = 5_000;
+/** Backup/export/restore can run minutes on large databases — far longer than the probe's handshake. */
+export const DEFAULT_DEADLINE_MS = 30 * 60_000;
+const MAX_CONSECUTIVE_ERRORS = 3;
+
+const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
+
+export interface TaskStatus {
+  lastStatus?: string;
+  stopped?: boolean;
+  exitCode?: number | null;
+  stoppedReason?: string | null;
+  /** The task's self-reported result row (db:backup/export write id/key/bytes/fingerprint). */
+  result?: Record<string, unknown> | null;
+  error?: string;
+}
+
+export type TaskPollResult =
+  | { outcome: 'stopped'; status: TaskStatus }
+  | { outcome: 'error'; status: TaskStatus }
+  | { outcome: 'timeout'; lastStatus: string };
+
+/**
+ * Poll until the task stops, printing each lifecycle transition. Returns `stopped` (read exitCode),
+ * `error` (task:status failed repeatedly — the task may still be running), or `timeout`.
+ */
+export async function pollTaskUntilStopped(
+  region: string,
+  fn: string,
+  ids: { runId: string; taskArn: string },
+  opts: { deadlineMs?: number } = {},
+): Promise<TaskPollResult> {
+  const deadline = Date.now() + (opts.deadlineMs ?? DEFAULT_DEADLINE_MS);
+  let last = '';
+  let consecutiveErrors = 0;
+  while (Date.now() < deadline) {
+    const status = (await invokeAction(region, fn, 'task:status', { runId: ids.runId, taskArn: ids.taskArn })) as TaskStatus;
+    if (status?.error) {
+      if (++consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) return { outcome: 'error', status };
+      info(`  (status check blipped: ${status.error} — retrying)`);
+      await sleep(POLL_INTERVAL_MS);
+      continue;
+    }
+    consecutiveErrors = 0;
+    if (status.lastStatus && status.lastStatus !== last) {
+      info(`  ${status.lastStatus}`);
+      last = status.lastStatus;
+    }
+    if (status.stopped) return { outcome: 'stopped', status };
+    await sleep(POLL_INTERVAL_MS);
+  }
+  return { outcome: 'timeout', lastStatus: last || 'unknown' };
+}

package/src/exec.ts

@@ -0,0 +1,20 @@
+/**
+ * @everystack/cli/exec — the db:exec core, for the ops-Lambda lane.
+ *
+ * db:exec applies credential-free write SQL as ONE transaction, DML-only by a semantic catalog
+ * digest (no role, no superuser, no regex), bracketed by a crash-truthful ledger. This barrel lets
+ * the ops `db:exec` action (in @everystack/server's dbPlugin) load the same core the CLI uses and
+ * run it on the operator connection db:seed already uses — so `db:exec --stage` needs no raw admin
+ * URL on the operator's machine.
+ */
+
+export { executeExec, assertNoTxnControl, execSha } from './cli/exec-execute.js';
+export type { ExecIntent, ExecOutcome, ExecuteExecOptions, ExecResult } from './cli/exec-execute.js';
+
+export { runExecInTx, SchemaChangedError, railStatements, EXEC_RAIL_DEFAULTS } from './cli/exec-run.js';
+export type { TxRunner, ExecStmtResult, ExecRails, RunExecInTxOptions } from './cli/exec-run.js';
+
+export { catalogDigestQuery } from './cli/exec-digest.js';
+
+export { ENSURE_EXEC_LOG_SQL, renderExecIntentInsert, renderExecOutcomeUpdate } from './cli/exec-log.js';
+export type { ExecIntentRow, ExecOutcomeRow } from './cli/exec-log.js';