@everystack/cli 0.4.44 → 0.4.46

package/src/cli/schema-introspect.ts

@@ -14,7 +14,7 @@
  */
 
 import { IGNORED_SCHEMAS, coerceBool, type QueryRunner } from './authz-contract.js';
-import { withCanonicalSearchPath } from './search-path.js';
+import { INTROSPECTION_SESSION, type SessionRunner } from './session.js';
 
 // ---------------------------------------------------------------------------
 // The data-layer snapshot — the structured shape both producers target.
@@ -281,6 +281,33 @@ export interface ColumnRow {
   position: unknown;
 }
 
+/**
+ * Drop a precision qualifier that only restates the default.
+ *
+ * `timestamp(6) without time zone` and `timestamp without time zone` are THE SAME TYPE:
+ * 6 is Postgres's default precision for the timestamp family, so a column declared either
+ * way stores identical values with identical semantics. `format_type` still spells the
+ * explicit one with its typmod, because the catalog records that somebody typed it.
+ *
+ * Everything downstream compares these strings — the renderer to pick a `field.*()`, the
+ * differ to decide an ALTER, the fingerprint to content-address the schema. With the two
+ * spellings distinct, a brownfield column declared `timestamp(6)` had NO field mapping, so
+ * db:pull rendered `field.text()` with a FIXME and the next plan proposed rewriting the
+ * column to text — destroying a column to reconcile a difference that does not exist. On a
+ * real adopter's schema that was 18 of 48 destructive statements.
+ *
+ * Normalized HERE, at the single funnel every consumer reads, rather than at each comparison:
+ * three surfaces answering one question separately is how they drift.
+ *
+ * ONLY precision 6, and only for the timestamp family. `timestamp(3)` genuinely truncates to
+ * milliseconds — a real difference that must keep saying so.
+ */
+// The one funnel — a type's canonical spelling is defined ONCE, in the model
+// package, so the field factory (`field.pgType` refusals), this introspection,
+// the renderer, the differ, and the fingerprint can never disagree about it.
+import { canonicalColumnType } from '@everystack/model';
+export { canonicalColumnType };
+
 export function columnRowToDescriptor(row: ColumnRow): { table: string; column: ColumnSchema; position: number } {
   const def = row.default == null ? null : String(row.default);
   return {
@@ -288,7 +315,7 @@ export function columnRowToDescriptor(row: ColumnRow): { table: string; column:
     position: Number(row.position),
     column: {
       name: row.column,
-      type: String(row.type),
+      type: canonicalColumnType(String(row.type)),
       notNull: coerceBool(row.not_null),
       default: def && def.length > 0 ? def : null,
     },
@@ -604,20 +631,20 @@ export function assembleSchema(rows: SchemaRows): SchemaSnapshot {
  * (the ops Lambda `db:query` in production, a fake in tests) and folds the rows with
  * `assembleSchema`. This is the `current` side `db:generate` diffs the compiled Models against.
  */
-export async function introspectSchema(run: QueryRunner): Promise<SchemaSnapshot> {
-  // Pin the canonical search_path: column defaults, CHECK constraints, and index
-  // expressions all deparse relative to it, so an ambient non-default path would
-  // read as false drift. See search-path.ts.
-  return withCanonicalSearchPath(run, async () => {
-    const [columns, constraints, enums, indexes, sequences] = await Promise.all([
-      run(COLUMNS_SQL), run(CONSTRAINTS_SQL), run(ENUMS_SQL), run(INDEXES_SQL), run(SEQUENCES_SQL),
-    ]);
-    return assembleSchema({
-      columns: columns as ColumnRow[],
-      constraints: constraints as ConstraintRow[],
-      enums: enums as EnumRow[],
-      indexes: indexes as IndexRow[],
-      sequences: sequences as SequenceRow[],
-    });
+export async function introspectSchema(session: SessionRunner): Promise<SchemaSnapshot> {
+  // ONE session, so all five queries see one database at one moment, under one pinned
+  // search_path. Column defaults, CHECK constraints and index expressions all deparse
+  // relative to that path — spread across separate connections these five rows can render
+  // the same schema two ways, and a fingerprint minted from the mix describes nothing.
+  const [columns, constraints, enums, indexes, sequences] = await session(
+    [COLUMNS_SQL, CONSTRAINTS_SQL, ENUMS_SQL, INDEXES_SQL, SEQUENCES_SQL],
+    INTROSPECTION_SESSION,
+  );
+  return assembleSchema({
+    columns: columns as ColumnRow[],
+    constraints: constraints as ConstraintRow[],
+    enums: enums as EnumRow[],
+    indexes: indexes as IndexRow[],
+    sequences: sequences as SequenceRow[],
   });
 }

package/src/cli/schema-source.ts

@@ -114,6 +114,15 @@ function baseColumnSource(columnName: string, spec: FieldSpec): { call: string;
       if (!spec.enumName) throw new Error('enum field is missing enumName');
       return { call: `${enumConstName(spec.enumName)}(${n})`, builder: enumConstName(spec.enumName) };
     }
+    case 'pgType': {
+      // A verbatim type: the generated schema carries the exact string via drizzle's
+      // customType — same as the runtime builder in @everystack/model.
+      if (!spec.pgTypeName) throw new Error('pgType field is missing pgTypeName');
+      return {
+        call: `customType<{ data: unknown }>({ dataType: () => ${strLiteral(spec.pgTypeName)} })(${n})`,
+        builder: 'customType',
+      };
+    }
     default: {
       const exhaustive: never = spec.type;
       throw new Error(`Unsupported field type: ${String(exhaustive)}`);

package/src/cli/session.ts

@@ -0,0 +1,184 @@
+/**
+ * SessionRunner — the type that can express "these statements describe ONE moment".
+ *
+ * `QueryRunner` (authz-contract.ts) runs one SQL string and returns rows. It cannot say
+ * that two statements shared a connection, because on the stage lane they do not: each
+ * one is its own ops-Lambda invoke, answered by whichever container is warm. An
+ * introspection built from five of those is a collage, and a fingerprint minted from a
+ * collage describes no database that ever existed.
+ *
+ * So this is a SECOND type, not a widening of the first. A function that takes a
+ * `SessionRunner` cannot be handed a session-less venue — the compiler refuses it. That
+ * is the whole point: the guarantee is in the type, not in a convention or a capability
+ * flag that degrades quietly when the backend cannot honor it.
+ *
+ * Both venues implement it. The stage lane sends the statements to the ops Lambda's
+ * `db:session` action (one invoke, one connection, one transaction); the direct lane runs
+ * them in one postgres.js transaction on its single connection. Same contract, same
+ * ordering, same `SET LOCAL` semantics.
+ */
+
+/** One statement. A bare string is shorthand for `{ sql, allowFailure: false }`. */
+export interface SessionStatement {
+  sql: string;
+  /**
+   * Survive a failure of THIS statement, leaving the other result slots intact — the
+   * venue wraps it in a savepoint. For "this catalog table may not exist yet"
+   * (`derived_provenance`, `backfill_log`, `schema_log`), which is otherwise a
+   * try/catch that can only be written by giving up the session.
+   */
+  allowFailure?: boolean;
+}
+
+export interface SessionOptions {
+  /** Run the transaction READ ONLY. The caller's policy — no venue assumes it. */
+  readOnly?: boolean;
+  /** Isolation level; 'repeatable read' gives every statement one snapshot. */
+  isolation?: 'read uncommitted' | 'read committed' | 'repeatable read' | 'serializable';
+  /**
+   * Pin `search_path` for the transaction. Emitted as `SET LOCAL` inside the session and
+   * CONSUMING NO RESULT SLOT — results stay indexed by statement. Never prepend the pin
+   * as a statement of your own; that shifts every index after it.
+   */
+  searchPath?: string;
+}
+
+/** A statement that failed under `allowFailure`. Occupies its slot; carries the cause. */
+export interface SessionStatementError {
+  everystackSessionError: true;
+  message: string;
+}
+
+/** One slot: the statement's rows, or the marker for an allowed failure. */
+export type SessionResult = any[] | SessionStatementError;
+
+/**
+ * Run N statements on ONE connection in ONE transaction; N result sets, in input order.
+ *
+ * Nothing about a `SessionRunner` is optional or best-effort. A venue that cannot make
+ * the guarantee does not implement the type.
+ */
+export type SessionRunner = (
+  statements: ReadonlyArray<SessionStatement | string>,
+  opts?: SessionOptions,
+) => Promise<SessionResult[]>;
+
+/** The canonical introspection search_path — explicit, override-proof, declared-matching.
+ *
+ * Every expression PostgreSQL deparses on introspection (column defaults, CHECK
+ * constraints, index expressions, generated columns, view bodies, function bodies)
+ * renders its schema qualification RELATIVE to the session `search_path`. The declared
+ * state is always canonical — public bare, non-public qualified — so capturing under
+ * `public` makes the live read comparable to it. It must be an EXPLICIT value: `RESET`
+ * and `SET … TO DEFAULT` inherit an `ALTER DATABASE … SET search_path` override, which
+ * is the very condition this exists to neutralize.
+ */
+export const CANONICAL_SEARCH_PATH = 'public';
+
+/**
+ * The options every catalog introspection reads under: one snapshot, no writes, and the
+ * canonical deparse baseline. One definition, so the three introspections cannot drift
+ * apart in what they mean by "the live state".
+ */
+export const INTROSPECTION_SESSION: SessionOptions = {
+  readOnly: true,
+  isolation: 'repeatable read',
+  searchPath: CANONICAL_SEARCH_PATH,
+};
+
+/**
+ * A `SessionRunner` over a transaction the CALLER already opened.
+ *
+ * Some venues are inside a transaction before they introspect, and must be: the reconcile
+ * apply re-reads the catalog inside its own DDL transaction so provenance records the def
+ * hashes of what the batch actually created, not what it hoped to. Handing those a runner
+ * that opens its own transaction would issue a nested `BEGIN` and — worse — COMMIT the
+ * caller's transaction when it finished.
+ *
+ * So this borrows the open transaction instead of opening one. The session guarantee still
+ * holds, and holds MORE strongly: the statements share the caller's connection and its
+ * transaction by construction, and they can see its uncommitted writes.
+ *
+ * Two consequences, stated rather than hidden:
+ *
+ * - `isolation` and `readOnly` are NOT applied, because `SET TRANSACTION` only takes effect
+ *   before a transaction's first statement. They are already fixed — by the caller, who
+ *   opened the transaction and chose them. This is not a guarantee that degraded; it is the
+ *   same guarantee supplied by the enclosing transaction.
+ * - The `searchPath` pin runs inside a SAVEPOINT that is ALWAYS rolled back. `SET LOCAL`
+ *   lasts to the end of its transaction, so pinning without unwinding would silently
+ *   re-point the rest of the caller's transaction — the reconcile apply deliberately runs
+ *   its creates under a WIDE path, and stealing it back would be a new bug of exactly the
+ *   shape this whole change removes. Rolling back to the savepoint undoes the SET LOCAL and
+ *   costs nothing: every statement here is a read, and its rows are already in hand.
+ */
+export function borrowedSessionRunner(run: (sql: string) => Promise<any[]>): SessionRunner {
+  return async (statements, opts) => {
+    const stmts = statements.map((s) => (typeof s === 'string' ? { sql: s } : s));
+    const results: SessionResult[] = [];
+    const pinned = opts?.searchPath !== undefined;
+    const outer = 'everystack_borrowed_session';
+
+    if (pinned) {
+      await run(`SAVEPOINT ${outer}`);
+      await run(buildSearchPathSql(String(opts!.searchPath)));
+    }
+    try {
+      for (let i = 0; i < stmts.length; i++) {
+        const stmt = stmts[i];
+        if (!stmt.allowFailure) {
+          results.push(await run(stmt.sql));
+          continue;
+        }
+        const inner = `everystack_borrowed_${i}`;
+        await run(`SAVEPOINT ${inner}`);
+        try {
+          results.push(await run(stmt.sql));
+          await run(`RELEASE SAVEPOINT ${inner}`);
+        } catch (err: any) {
+          await run(`ROLLBACK TO SAVEPOINT ${inner}`);
+          results.push({ everystackSessionError: true, message: err?.message || String(err) });
+        }
+      }
+    } finally {
+      // Unconditional: the pin must not outlive this read on ANY path, success or throw.
+      if (pinned) await run(`ROLLBACK TO SAVEPOINT ${outer}`);
+    }
+    return results;
+  };
+}
+
+/** A bare SQL identifier — the only shape a search_path element may take. */
+const PLAIN_IDENT = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+
+/**
+ * `SET LOCAL search_path` for a caller-supplied path, validated as plain identifiers. One
+ * definition for every venue — a path one venue pins and another rejects would be a
+ * difference in what "the live state" means. `$user` is deliberately not accepted: a
+ * role-dependent element would make a canonical capture depend on who read it.
+ */
+export function buildSearchPathSql(searchPath: string): string {
+  const parts = searchPath.split(',').map((p) => p.trim()).filter((p) => p.length > 0);
+  if (parts.length === 0) throw new Error('searchPath must name at least one schema');
+  for (const part of parts) {
+    if (!PLAIN_IDENT.test(part)) {
+      throw new Error(
+        `searchPath element ${JSON.stringify(part)} is not a plain identifier — a session pins only bare schema names`,
+      );
+    }
+  }
+  return `SET LOCAL search_path = ${parts.map((p) => `"${p}"`).join(', ')}`;
+}
+
+/** True when a slot carries an allowed statement's failure rather than its rows. */
+export function isSessionError(slot: SessionResult | undefined): slot is SessionStatementError {
+  return (
+    !!slot && !Array.isArray(slot) && (slot as SessionStatementError).everystackSessionError === true
+  );
+}
+
+/** A slot's rows — an allowed failure reads as no rows. Use where absence is the answer. */
+export function rowsOrEmpty(slot: SessionResult | undefined): any[] {
+  if (slot === undefined || isSessionError(slot)) return [];
+  return slot;
+}

package/src/cli/stage-read-consistency.ts

@@ -0,0 +1,128 @@
+/**
+ * The stage lane's read-consistency DETECTOR.
+ *
+ * WHAT CHANGED. Each introspection is now ONE `db:session` invoke — one container, one
+ * connection, one REPEATABLE READ transaction, one pinned `search_path`. The original
+ * defect (five catalog queries fanned across five ops-Lambda containers, assembling a
+ * snapshot out of two renderings of one schema) is gone at the source.
+ *
+ * WHAT REMAINS. A full read is TWO sessions: the state introspection, then the authz
+ * introspection. Each is internally consistent; the PAIR is not. Two sessions can be
+ * answered by two containers at two moments, so a schema that moves between them yields a
+ * fingerprint whose two halves describe different instants. Smaller than the defect it
+ * replaced — and still not a guarantee.
+ *
+ * So the stage lane reads TWICE and compares. What that buys, precisely:
+ *
+ * - Two DIFFERENT fingerprints prove the target moved under at least one read. That is a
+ *   refusal: the read is known bad, so nothing is minted and nothing is applied.
+ * - Two IDENTICAL fingerprints prove NOTHING. Both reads can be wrong the same way
+ *   whenever the thing that differs differs deterministically. The stage lane cannot
+ *   verify read consistency. It can only fail to detect its absence.
+ *
+ * The wording below is written to that distinction and must stay written to it.
+ * "fingerprint verified" is a claim this lane is not able to make.
+ *
+ * Refusals here are CLI-side and pre-dispatch — no ops-Lambda action runs, so
+ * there is no live connection to record them on. They match the other
+ * pre-dispatch refusals in db:apply (`--confirm` missing, `estimateOpsRuntimeFit`),
+ * which likewise print and exit; `everystack.schema_log` is written by the ops
+ * Lambda's db:apply action, for refusals that reach it.
+ */
+
+import type { AuthzContract } from './authz-contract.js';
+import type { SessionRunner } from './session.js';
+import { introspectContract } from './authz-contract.js';
+import { introspectSchema, type SchemaSnapshot } from './schema-introspect.js';
+import { FUNCTIONS_SQL, contractFunctionRow } from './security-catalog.js';
+import { fingerprintLive } from './schema-fingerprint.js';
+
+/** One complete read of a target's base state, with its content address. */
+export interface StageReadPair {
+  snapshot: SchemaSnapshot;
+  contract: AuthzContract;
+  /** sha256 of the canonical state — the same address db:plan / db:apply gate on. */
+  fingerprint: string;
+}
+
+export type StageReadResult =
+  /** The two reads agreed. `warning` is the honest caveat; print it. */
+  | { ok: true; state: StageReadPair; warning: string }
+  /** The two reads disagreed. `reason` is the refusal; print it and exit non-zero. */
+  | { ok: false; reason: string; first: string; second: string };
+
+/** One full read: state + authz, fingerprinted the way every gate fingerprints it. */
+async function readOnce(session: SessionRunner): Promise<StageReadPair> {
+  const snapshot = await introspectSchema(session);
+  const contract = await introspectContract(session, contractFunctionRow, FUNCTIONS_SQL);
+  return { snapshot, contract, fingerprint: fingerprintLive(snapshot, contract).hash };
+}
+
+/**
+ * The refusal: the two reads disagree, so at least one of them was assembled
+ * from more than one database. Names the cause, because "fingerprint mismatch"
+ * would send the operator hunting for schema drift that is not there.
+ */
+export function inconsistentContainersRefusal(first: string, second: string): string {
+  return [
+    `REFUSED (stage lane): the stage was read twice and the two reads disagree — ${first.slice(0, 12)} then ${second.slice(0, 12)}.`,
+    'Cause: on the stage lane the state read and the authz read are separate ops-Lambda invokes, so they can be answered by different containers at different moments. Either the target changed between the two reads, or inconsistent containers answered them, and the fingerprint computed from the pair describes no single real state.',
+    'Nothing was minted and nothing was applied. Re-run. If it repeats, the stage\'s ops Lambda is not serving one database — fix that before you plan or apply against it.',
+  ].join(' ');
+}
+
+/**
+ * The agreement case. NOT a pass — a non-detection. Every clause here is load
+ * bearing: this lane must never report that a fingerprint was verified, or that
+ * the read was consistent.
+ */
+export function inconsistentContainersNotDetected(): string {
+  return [
+    'stage lane: read twice, inconsistent containers not detected.',
+    'This is a DETECTOR, not a verification — the stage lane cannot verify read consistency.',
+    'Two agreeing reads can both be wrong: anything that differs deterministically between containers produces the same wrong answer both times.',
+    'Treat this fingerprint as UNVERIFIED; the direct lane (--database-url, one session) is the only lane that reads a single database.',
+  ].join(' ');
+}
+
+/**
+ * The refusal a DESTRUCTIVE plan gets on the stage lane, before anything runs.
+ * The double read cannot lift this: a detector that can miss is not a basis for
+ * dropping data. The destructive ceremony lives on the direct lane.
+ */
+export function stageDestructiveRefusal(
+  shape: string,
+  planPath: string,
+  stage: string | undefined,
+): string {
+  const takeIt = `everystack db:backup${stage ? ` --stage ${stage}` : ''}`;
+  return [
+    `REFUSED (stage lane, DESTRUCTIVE plan — ${shape}): the stage lane cannot guarantee read consistency.`,
+    'A full read is two ops-Lambda invokes (state, then authz), so the fingerprint the concurrency lock gates on can still be assembled from two containers at two moments. A plan that loses data may not ride a read that cannot be verified.',
+    `Run destructive applies over a direct connection with the full ceremony: ${takeIt}, then everystack db:apply --plan ${planPath} --database-url <url> --confirm --snapshot-ref <id>.`,
+  ].join(' ');
+}
+
+/**
+ * Read the target twice, sequentially, and compare the two fingerprints.
+ *
+ * Sequential on purpose — two reads issued concurrently would interleave their
+ * invokes across the same container pool and could land the SAME collage twice,
+ * which is the one outcome the detector must not manufacture for itself.
+ *
+ * Callers: the STAGE lane only. The direct lane reads once, over one session,
+ * and must not pay this.
+ */
+export async function readStageStateTwice(session: SessionRunner): Promise<StageReadResult> {
+  const first = await readOnce(session);
+  const second = await readOnce(session);
+  if (first.fingerprint !== second.fingerprint) {
+    return {
+      ok: false,
+      reason: inconsistentContainersRefusal(first.fingerprint, second.fingerprint),
+      first: first.fingerprint,
+      second: second.fingerprint,
+    };
+  }
+  return { ok: true, state: second, warning: inconsistentContainersNotDetected() };
+}

package/src/cli/state-apply.ts

@@ -20,6 +20,7 @@
 import { execSync } from 'node:child_process';
 import type { ModelDescriptor } from '@everystack/model';
 import { introspectContract, type AuthzContract, type QueryRunner } from './authz-contract.js';
+import type { SessionRunner } from './session.js';
 import { introspectSchema, type SchemaSnapshot } from './schema-introspect.js';
 import { FUNCTIONS_SQL, contractFunctionRow } from './security-catalog.js';
 import { generateMigrationSql, HELD_DROP_PREFIX } from './migration-generate.js';
@@ -377,6 +378,7 @@ export interface StateSyncOutcome {
  */
 export async function applyStateAndVerify(
   runner: QueryRunner,
+  session: SessionRunner,
   models: ModelDescriptor[],
   statements: string[],
   current: SchemaSnapshot,
@@ -396,8 +398,8 @@ export async function applyStateAndVerify(
 
   const result = await applyGeneratedStatements(runner, statements, { ...options, fromFingerprint });
 
-  const snapshot = await introspectSchema(runner);
-  const contract = await introspectContract(runner, contractFunctionRow, FUNCTIONS_SQL);
+  const snapshot = await introspectSchema(session);
+  const contract = await introspectContract(session, contractFunctionRow, FUNCTIONS_SQL);
   const toFingerprint = fingerprintLive(snapshot, contract).hash;
   if (result.logId !== undefined) {
     await runner(renderSchemaLogFingerprintUpdate(result.logId, toFingerprint));

package/src/cli/swap-execute.ts

@@ -21,6 +21,7 @@
 
 import type { ModelDescriptor } from '@everystack/model';
 import type { QueryRunner } from './authz-contract.js';
+import type { SessionRunner } from './session.js';
 import { renderSchemaSwap, dropRetiringSql } from './schema-swap.js';
 
 /** One validator's result. A `fatal` (default) failure rolls back; a `warn` failure is surfaced only. */
@@ -105,7 +106,7 @@ export interface ExecuteSwapOptions {
    * identities. Without it the next db:reconcile sees the whole layer as drift and rebuilds it —
    * an expensive, ACCESS EXCLUSIVE no-op that surfaces days later on an unrelated run.
    */
-  recordProvenance?: (runner: QueryRunner) => Promise<void>;
+  recordProvenance?: (runner: QueryRunner, session: SessionRunner) => Promise<void>;
 }
 
 /** One table's landed-vs-live count, the intrinsic post-swap assertion's unit. */
@@ -417,7 +418,7 @@ async function countRows(runner: QueryRunner, schema: string, table: string): Pr
   return Number(rows[0]?.n ?? 0);
 }
 
-export async function executeSwap(runner: QueryRunner, opts: ExecuteSwapOptions): Promise<SwapResult> {
+export async function executeSwap(runner: QueryRunner, session: SessionRunner, opts: ExecuteSwapOptions): Promise<SwapResult> {
   const log = opts.log ?? (() => {});
   // 1. Fingerprint gate — declared-vs-declared: does the artifact and the target agree on the shape.
   if (opts.artifactFingerprint !== opts.declaredFingerprint) {
@@ -639,7 +640,7 @@ export async function executeSwap(runner: QueryRunner, opts: ExecuteSwapOptions)
   //    prevents rather than something it can break.
   if (opts.recordProvenance) {
     try {
-      await opts.recordProvenance(runner);
+      await opts.recordProvenance(runner, session);
     } catch (err: any) {
       log(`WARNING: the swap succeeded but recording provenance failed: ${String(err?.message ?? err)}. `
         + `The derived layer is live and correct; the next db:reconcile will rebuild it needlessly. `

package/src/cli/search-path.ts

@@ -1,51 +0,0 @@
-/**
- * search-path — the canonical introspection baseline.
- *
- * Every expression PostgreSQL deparses on introspection — column defaults
- * (`pg_get_expr`), CHECK constraints, index expressions, generated columns,
- * view/matview bodies (`pg_get_viewdef`), function bodies — renders its schema
- * qualification RELATIVE to the session `search_path`. So the SAME schema reads
- * differently depending on the ambient path: with a non-public schema on the
- * path a reference to it renders BARE (`nextval('x_seq')`), off the path it
- * renders QUALIFIED (`nextval('stats.x_seq')`). The declared state is always
- * canonical (public bare, non-public qualified), so a non-default session or
- * DB-level `search_path` makes every deparsed expression read as false drift.
- *
- * The fix is to CAPTURE under a fixed canonical path, once, at the introspection
- * boundary — one guard for the whole class (defaults, checks, indexes, bodies),
- * present and future. The baseline is `public`: it renders public-bare and
- * non-public-qualified, matching the declared compile exactly (verified against
- * PostgreSQL 16). It must be an EXPLICIT value — `RESET` / `SET … TO DEFAULT`
- * inherit an `ALTER DATABASE/ROLE … SET search_path` override (the very thing
- * that triggers the bug), so they are NOT canonical baselines.
- */
-
-import type { QueryRunner } from './authz-contract.js';
-
-/** The canonical introspection search_path — explicit, override-proof, declared-matching. */
-export const CANONICAL_SEARCH_PATH_SQL = 'SET search_path = public';
-
-/**
- * Run `fn` with the connection's search_path pinned to the canonical baseline, so every
- * expression it deparses is captured in the declared-matching form regardless of the
- * ambient path, then RESET to the connection's default afterward. RESET restores the
- * database/role default — which for the case this fixes (an `ALTER DATABASE … SET
- * search_path` override) is exactly the override, so a fresh connection sees no change.
- * It deliberately does NOT preserve a caller's transient session/transaction-local SET:
- * restoring a captured `SET LOCAL` value session-wide would leak it (e.g. the reconcile
- * apply's create-time wide path), and no everystack caller relies on a hand-set path
- * surviving introspection.
- *
- * Effective on a persistent single connection (the direct `createUrlRunner`, `max: 1`);
- * over a per-call pooled runner the SET does not persist, but that path already renders
- * canonically unless the database itself carries a search_path override.
- */
-export async function withCanonicalSearchPath<T>(run: QueryRunner, fn: () => Promise<T>): Promise<T> {
-  await run(CANONICAL_SEARCH_PATH_SQL);
-  try {
-    return await fn();
-  } finally {
-    // Best-effort: a failure here must not mask fn's result.
-    try { await run('RESET search_path'); } catch { /* connection may be gone */ }
-  }
-}