@everystack/cli 0.4.41 → 0.4.44

package/src/cli/schema-diff.ts

@@ -220,6 +220,20 @@ function argsWiden(from: number[], to: number[]): boolean {
   return to.every((v, i) => from[i] == null || v >= from[i]);
 }
 
+/**
+ * Types whose entire meaning survives a trip through `text` — scalars and strings whose
+ * printed form IS their value. Everything else (postgis geometry, tsvector, hstore, ltree,
+ * arrays, composites, ranges, and any extension type) carries structure the cast discards,
+ * so it is deliberately NOT listed: the default for an unknown base is "not free".
+ */
+const TEXT_ROUND_TRIPS = new Set([
+  'text', 'character varying', 'character', 'citext', 'name', 'uuid', 'boolean',
+  'smallint', 'integer', 'bigint', 'numeric', 'decimal', 'real', 'double precision',
+  'date', 'time', 'time without time zone', 'time with time zone',
+  'timestamp', 'timestamp without time zone', 'timestamp with time zone',
+  'json', 'jsonb', 'inet', 'cidr', 'macaddr', 'bytea', 'interval',
+]);
+
 /**
  * Classify a column type change. Conservative by construction — anything not provably safe
  * or merely lossy falls through to `risky`, so a dangerous conversion is never mistaken for
@@ -230,7 +244,18 @@ export function classifyTypeChange(from: string, to: string): TypeChangeRisk {
   const f = parseType(from);
   const t = parseType(to);
 
-  if (t.base === 'text') return 'safe'; // text is the universal sink: every type assignment-casts to it losslessly
+  // `→ text` is only free from a type text can round-trip. It IS the universal sink for the
+  // printable VALUE — but a structured type loses its meaning, not its characters: postgis
+  // `geometry` → text takes every spatial index and `ST_*` call with it, `tsvector` → text
+  // kills the full-text index, `hstore` → text destroys the key/value structure. None of that
+  // is recoverable by casting back.
+  //
+  // This mattered far past taxonomy. A `safe` verdict emits a BARE `SET DATA TYPE` with no
+  // WARNING, and the plan classifier only counts a narrowing when it sees the `USING` cast a
+  // non-safe verdict adds — so 48 postgis/tsvector/hstore/`timestamp(6)` rewrites in a real
+  // adoption plan were reported as additive with `destructive: 0`, which is also the number
+  // that gates `--confirm` + snapshot. Calling these lossy is what arms the gate.
+  if (t.base === 'text') return TEXT_ROUND_TRIPS.has(f.base) ? 'safe' : 'lossy';
 
   const fr = NUMERIC_RANK[f.base];
   const tr = NUMERIC_RANK[t.base];

package/src/cli/state-apply.ts

@@ -89,6 +89,94 @@ export interface DestructiveBreakdown {
   strips: string[];
 }
 
+/**
+ * Statements that positively ADD — the only ones a plan may call additive.
+ *
+ * `additive` used to be computed as `executable.length - destructive`, which made it the
+ * DEFAULT rather than a finding: any statement the classifier did not recognize was reported
+ * as safe. A real adoption plan carrying 38 DROP POLICY, 43 REVOKE and 48 column rewrites
+ * described itself as `additive: 158, destructive: 0`, and since `destructive > 0` is what
+ * gates `--confirm` + snapshot + the approver set, the false zero did not merely mislabel the
+ * plan — it disarmed the gate.
+ *
+ * So the default is inverted. A statement is additive only when it matches one of these; a
+ * statement nobody recognized is `unclassified`, and `unclassified` is never additive. This is
+ * the same rule the reconciler already applies to grants: absence of knowledge means LEAVE IT
+ * ALONE and say so, never "assume it is fine".
+ */
+const ADDITIVE_MATCHERS: RegExp[] = [
+  /^CREATE\s+(TABLE|POLICY|INDEX|UNIQUE\s+INDEX|SEQUENCE|EXTENSION|TYPE|SCHEMA)\b/,
+  /^GRANT\b/,
+  /^COMMENT\s+ON\b/,
+  /^ALTER\s+TABLE\s+[\s\S]+?\sADD\s+(COLUMN|CONSTRAINT|PRIMARY\s+KEY)\b/,
+  // Enabling/forcing RLS only ever RESTRICTS; it cannot widen access or lose a row.
+  /^ALTER\s+TABLE\s+[\s\S]+?\s(ENABLE|FORCE)\s+ROW\s+LEVEL\s+SECURITY\b/,
+  // Relaxing nullability and setting a default add capability; they remove nothing.
+  /^ALTER\s+TABLE\s+[\s\S]+?\sALTER\s+COLUMN\s+[\s\S]+?\sDROP\s+NOT\s+NULL\b/,
+  /^ALTER\s+TABLE\s+[\s\S]+?\sALTER\s+COLUMN\s+[\s\S]+?\sSET\s+DEFAULT\b/,
+];
+
+/**
+ * Statements that REMOVE an authorization without losing a row.
+ *
+ * Deliberately NOT folded into `destructive`, which means data loss and whose taxonomy is
+ * defended above — a dropped policy or grant re-declares from the models without touching a
+ * row. But it is emphatically not ADDITIVE either, and that was the lie: a `DROP POLICY` that
+ * removes a table's only read policy leaves the table returning zero rows, which is the single
+ * highest-consequence thing an adoption plan can carry and it was reported as an addition.
+ */
+const AUTHZ_REMOVAL_MATCHERS: RegExp[] = [
+  /^DROP\s+POLICY\b/,
+  /^REVOKE\b/,
+  /^ALTER\s+TABLE\s+[\s\S]+?\s(DISABLE|NO\s+FORCE)\s+ROW\s+LEVEL\s+SECURITY\b/,
+];
+
+/** The full partition of an executable stream. Every statement lands in exactly one bucket. */
+export interface StatementPartition {
+  additive: string[];
+  drops: string[];
+  narrowings: string[];
+  strips: string[];
+  /** Authorization removed, no data lost — visible, never additive. */
+  authzRemovals: string[];
+  /** Not positively recognized. NEVER additive; needs a human before this plan is applied. */
+  unclassified: string[];
+}
+
+/** The first non-comment line, upper-cased — WARNING prologues must not hide the verb. */
+function statementHead(statement: string): string {
+  return (statement.split('\n').find((l) => l.trim() !== '' && !l.trim().startsWith('--')) ?? '')
+    .trim()
+    .toUpperCase();
+}
+
+/**
+ * Partition an executable stream into exactly one bucket per statement.
+ *
+ * Order matters: the data-loss buckets are consulted FIRST so a statement that both drops and
+ * revokes is counted at its most severe reading, and `unclassified` is the fallthrough rather
+ * than `additive`.
+ */
+export function partitionStatements(
+  executable: string[],
+  opts: { declaredGrantees?: ReadonlySet<string> } = {},
+): StatementPartition {
+  const { drops, narrowings, strips } = classifyDestructive(executable, opts);
+  const destructive = new Set([...drops, ...narrowings, ...strips]);
+  const additive: string[] = [];
+  const authzRemovals: string[] = [];
+  const unclassified: string[] = [];
+
+  for (const statement of executable) {
+    if (destructive.has(statement)) continue;
+    const head = statementHead(statement);
+    if (AUTHZ_REMOVAL_MATCHERS.some((re) => re.test(head))) authzRemovals.push(statement);
+    else if (ADDITIVE_MATCHERS.some((re) => re.test(head))) additive.push(statement);
+    else unclassified.push(statement);
+  }
+  return { additive, drops, narrowings, strips, authzRemovals, unclassified };
+}
+
 /** `REVOKE … ON <table> FROM <grantee>;` → the grantee, or null when it is not a revoke. */
 export function revokeTarget(statement: string): string | null {
   // A quoted identifier can hold anything (`"Odd-Role"`, a reserved word, mixed case), and