@everystack/cli 0.4.64 → 0.4.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.64",
+  "version": "0.4.66",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -126,7 +126,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.16"
+    "@everystack/model": "0.4.17"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",
@@ -177,7 +177,7 @@
     "jest": "29.7.0",
     "react": "19.2.0",
     "ts-jest": "29.4.9",
-    "@everystack/server": "0.4.25"
+    "@everystack/server": "0.4.26"
   },
   "scripts": {
     "test": "jest",

package/src/cli/authz-compile.ts

@@ -331,54 +331,53 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   const isRoleRead = (a: Ability): boolean =>
     a.action === 'read' && Boolean(a.condition.role) && !isColumnAbility(a);
 
-  // Author-supplied predicates, per action. `manage` carries no predicate of its own —
-  // it is the admin bypass — so only the specific verbs are consulted.
+  // `manage` + owner/via desugars into four verb abilities for policy emission.
+  // Role-scoped `manage` (the admin bypass) passes through — it matches `hasAdminManage`
+  // directly. Grants handle `manage` natively via `verbsFor`, so this expansion is
+  // policy-compiler-local: `compileGrants` still reads `model.abilities`.
+  const abilities: readonly Ability[] = model.abilities.flatMap((a) => {
+    if (a.action !== 'manage' || !rowScoped(a)) return [a];
+    const c = a.condition;
+    return [
+      { action: 'read' as const, condition: c },
+      { action: 'create' as const, condition: c },
+      { action: 'update' as const, condition: c },
+      { action: 'delete' as const, condition: c },
+    ];
+  });
+
   const predFor = (action: Ability['action']): string | null => {
-    for (const a of model.abilities) {
+    for (const a of abilities) {
       if (a.action !== action || isRoleRead(a) || isColumnAbility(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('${action}')`);
       if (p) return p;
     }
     return null;
   };
-  /**
-   * The predicate on the PUBLIC read — a read ability with neither a role nor a row scope.
-   *
-   * Read separately from {@link ownerReadPred} because the two are different BRANCHES of
-   * the same authenticated policy. Taking both from one ordered lookup made the anon
-   * policy depend on the order the abilities happened to be declared in: put the owner
-   * read first and `anon` inherited the owner branch's guard as its whole public rule.
-   */
   const publicReadPred = (): string | null => {
-    for (const a of model.abilities) {
+    for (const a of abilities) {
       if (a.action !== 'read' || a.condition.role || rowScoped(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('read')`);
       if (p) return p;
     }
     return null;
   };
-
-  /** The predicate the OWNER read narrows ITSELF by — `can('read', { owner, sql })`. */
   const ownerReadPred = (): string | null => {
-    for (const a of model.abilities) {
+    for (const a of abilities) {
       if (a.action !== 'read' || !rowScoped(a) || isColumnAbility(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('read', { owner })`);
       if (p) return p;
     }
     return null;
   };
-
-  /** The WRITE half, when the author declared one distinct from the read half. */
   const checkFor = (action: Ability['action']): string | null => {
-    for (const a of model.abilities) {
+    for (const a of abilities) {
       if (a.action !== action) continue;
       const p = rawPredicate(a.condition.check, `${table}: can('${action}', { check })`);
       if (p) return p;
     }
     return null;
   };
-
-  const abilities = model.abilities;
   const hasAdminManage = abilities.some((a) => a.action === 'manage' && a.condition.role === 'admin');
   const hasPublicRead = abilities.some((a) => a.action === 'read' && !a.condition.role && !rowScoped(a));
   // The audience is open when the public read says so. Read off the SAME abilities that make
@@ -569,8 +568,8 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     // key, and undefined must mean ENABLED — the pre-flag behavior — never a silent
     // security downgrade via version skew.
     rls: { enabled: model.rls !== false, forced: model.rls !== false && model.writtenBy === 'app' },
-    grants: compileGrants(abilities, model.privileges),
-    ...(compileColumnGrants(abilities) ? { columnGrants: compileColumnGrants(abilities) } : {}),
+    grants: compileGrants(model.abilities, model.privileges),
+    ...(compileColumnGrants(model.abilities) ? { columnGrants: compileColumnGrants(model.abilities) } : {}),
     policies,
   };
 }

package/src/cli/commands/db.ts

@@ -501,41 +501,27 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
     process.exit(1);
   }
 
-  // Resolve the direct connection (the rotate command always runs direct — it needs
-  // to query pg_roles and ALTER ROLE, which the ops action doesn't expose).
-  const adminUrl = stageSecrets.ADMIN_DATABASE_URL ?? stageSecrets.AdminDatabaseUrl;
-  if (!adminUrl) {
-    fail('No ADMIN_DATABASE_URL secret found. Run db:provision first to set up the credential split.');
-    process.exit(1);
-  }
-
-  // Step 0: preflight — verify the master credential works (break-glass path).
-  step('Preflight: verifying master connection...');
+  // Step 0: preflight — verify the operator connection works (break-glass path).
+  step('Preflight: verifying operator connection...');
+  const opsFn = opsFunction(config);
   try {
-    const result = await invokeAction(config.region, opsFunction(config), 'db:query', { sql: 'SELECT current_user' });
+    const result = await invokeAction(config.region, opsFn, 'db:query', { sql: 'SELECT current_user' });
     if ((result as any)?.error) throw new Error((result as any).error);
-    success('Master connection verified.');
+    success('Operator connection verified.');
   } catch (err: any) {
-    fail(`Master connection failed: ${err.message}`);
-    info('The master credential is the break-glass. Fix it before rotating.');
+    fail(`Operator connection failed: ${err.message}`);
+    info('Fix the operator connection before rotating.');
     process.exit(1);
   }
 
-  // Connect directly for role management.
-  const { createUrlRunner } = await import('../db-source');
-  const { runner, end } = await createUrlRunner(adminUrl);
-  const deps = {
-    query: async (sql: string) => runner(sql) as Promise<any[]>,
-    execute: async (sql: string) => { await runner(sql); },
+  // All DB operations run through the ops Lambda (inside the VPC).
+  const rotate = async (action: string, payload?: Record<string, unknown>) => {
+    const result = await invokeAction(config.region, opsFn, 'db:rotate', { action, ...payload });
+    if ((result as any)?.error) throw new Error((result as any).error);
+    return result as any;
   };
 
   try {
-    const {
-      detectActiveRole,
-      provisionInactiveRole,
-      retireRole,
-      drainRole,
-    } = await import('@everystack/server/rotate');
 
     // Detect which slots to rotate.
     const slotFlag = flags.slot || 'both';
@@ -552,8 +538,19 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
     }
 
     const { randomBytes } = await import('node:crypto');
-    const conn = parseUrlConnection(adminUrl);
-    const sourceUrl = adminUrl;
+
+    // Resolve host/port/database from the ops Lambda (same as db:provision does).
+    let conn: { host: string; port: string; database: string } | undefined;
+    try {
+      const psqlInfo = await invokeAction(config.region, opsFn, 'db:psql', {});
+      if ((psqlInfo as any)?.host) conn = psqlInfo as any;
+    } catch { /* handled below */ }
+    if (!conn?.host) {
+      fail('Could not resolve database host from the ops Lambda.');
+      process.exit(1);
+    }
+    const sourceUrl = stageSecrets.ADMIN_DATABASE_URL ?? stageSecrets.AdminDatabaseUrl
+      ?? stageSecrets.DATABASE_URL ?? stageSecrets.DatabaseUrl;
 
     // Track the old active role for each slot so retire uses the RIGHT role (F1 fix).
     const oldActiveRoles: Array<{ base: string; oldRole: string }> = [];
@@ -563,23 +560,22 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
     for (const { base, secretKeys } of slots) {
       step(`Rotating ${base}...`);
 
-      const detected = await detectActiveRole(base, deps);
-      if (!detected) {
+      const detected = await rotate('detect', { baseRole: base });
+      if (!detected || (!detected.activeRole && !detected.inactiveRole)) {
         fail(`No rotation pairs found for ${base}. Run db:provision --rotation-pairs first.`);
         process.exit(1);
       }
       info(`  Active: ${detected.activeRole}, inactive: ${detected.inactiveRole}`);
       oldActiveRoles.push({ base, oldRole: detected.activeRole });
-      const active = detected;
 
-      // Provision the inactive role.
+      // Provision the inactive role via the ops Lambda.
       const password = randomBytes(24).toString('hex');
-      await provisionInactiveRole(active, password, deps);
-      success(`  ${active.inactiveRole} provisioned with new password.`);
+      const provisioned = await rotate('provision', { baseRole: base, password });
+      success(`  ${detected.inactiveRole} provisioned with new password.`);
 
       // Build the new URL.
       const newUrl = preserveConnParams(
-        `postgresql://${active.inactiveRole}:${password}@${conn.host}:${conn.port}/${conn.database}`,
+        `postgresql://${detected.inactiveRole}:${password}@${conn.host}:${conn.port}/${conn.database}`,
         sourceUrl,
       );
 
@@ -658,29 +654,19 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
       process.exit(1);
     }
 
-    // Verify origin with a login probe — prove the new credential works
-    // before revoking the old one.
+    // Verify the new credential can log in — prove it works before revoking
+    // the old one. Runs inside the VPC via the ops Lambda.
     step('Verifying new credential...');
-    let verifyPassed = false;
-    try {
-      const { default: pg } = await import('postgres');
-      const newApiUrl = credEnvOverrides.EVERYSTACK_CRED_DatabaseUrl;
-      if (newApiUrl) {
-        const probe = pg(newApiUrl, { max: 1, connect_timeout: 5, ssl: 'prefer' });
-        try {
-          await probe`SELECT 1`;
-          verifyPassed = true;
-          success('New credential connects to the database.');
-        } finally {
-          await probe.end({ timeout: 1 });
-        }
-      } else {
-        verifyPassed = true;
+    const newApiUrl = credEnvOverrides.EVERYSTACK_CRED_DatabaseUrl;
+    if (newApiUrl) {
+      try {
+        await rotate('probe-login', { url: newApiUrl });
+        success('New credential connects to the database.');
+      } catch (err: any) {
+        fail(`New credential login failed: ${err.message}`);
+        info('Both roles keep LOGIN (safe state). Fix and re-run.');
+        process.exit(1);
       }
-    } catch (err: any) {
-      fail(`New credential login failed: ${err.message}`);
-      info('Both roles keep LOGIN (safe state). Fix and re-run.');
-      process.exit(1);
     }
 
     // Origin HTTP check (non-blocking — the login probe is the real gate).
@@ -700,34 +686,48 @@ async function rotateCredentials(flags: Record<string, string>): Promise<void> {
     // re-detection would pick the wrong one via the tiebreak).
     for (const { base, oldRole } of oldActiveRoles) {
       step(`Retiring ${oldRole}...`);
-      await retireRole(oldRole, deps);
+      await rotate('retire', { role: oldRole });
       success(`  ${oldRole} set to NOLOGIN.`);
 
-      // Also retire the base role if it still has LOGIN (F6 fix: a leaked
-      // pre-rotation credential must not survive rotation).
+      // Also retire the base role if it still has LOGIN (F6 fix).
       try {
-        const baseRows = await deps.query(
-          `SELECT rolcanlogin FROM pg_roles WHERE rolname = '${base}'`,
-        );
-        if (baseRows[0]?.rolcanlogin) {
-          await retireRole(base, deps);
-          success(`  ${base} (base role) set to NOLOGIN.`);
+        const baseDetect = await rotate('detect', { baseRole: base });
+        if (baseDetect === null) {
+          // Base role check — query directly via db:query
+          const baseResult = await invokeAction(config.region, opsFn, 'db:query', {
+            sql: `SELECT rolcanlogin FROM pg_roles WHERE rolname = '${base}'`,
+          });
+          const rows = (baseResult as any)?.rows ?? baseResult;
+          if (Array.isArray(rows) && rows[0]?.rolcanlogin) {
+            await rotate('retire', { role: base });
+            success(`  ${base} (base role) set to NOLOGIN.`);
+          }
         }
       } catch { /* best-effort */ }
 
       step(`Draining ${oldRole} sessions (grace: ${graceMs / 1000}s)...`);
-      const { drained, terminated } = await drainRole(oldRole, graceMs, deps);
-      if (drained && terminated === 0) {
-        success(`  ${oldRole} drained cleanly.`);
-      } else if (drained) {
+      const deadline = Date.now() + graceMs;
+      const POLL_MS = 2000;
+      while (Date.now() < deadline) {
+        const { count } = await rotate('count-sessions', { role: oldRole });
+        if (count === 0) { success(`  ${oldRole} drained cleanly.`); break; }
+        await new Promise((r) => setTimeout(r, POLL_MS));
+      }
+      const { count: remaining } = await rotate('count-sessions', { role: oldRole });
+      if (remaining > 0) {
+        const { terminated } = await rotate('terminate-sessions', { role: oldRole });
         success(`  ${oldRole} drained (${terminated} session(s) terminated after grace period).`);
       }
     }
 
     success('Credential rotation complete.');
 
-  } finally {
-    await end?.();
+  } catch (err: any) {
+    if (err && (err as any).code !== 'EEXIT') {
+      fail(`Rotation error: ${err.message}`);
+      process.exit(1);
+    }
+    throw err;
   }
 }
 

package/src/cli/derived-lint.ts

@@ -189,6 +189,7 @@ export function findSecdefExecuteGaps(derived: readonly DerivedDescriptor[]): De
   for (const d of derived) {
     if (d.kind !== 'function' || d.security !== 'definer' || d.abilities.length > 0) continue;
     if (d.returns === 'trigger') continue;
+    if (d.internal) continue;
     if (Object.keys(d.privileges ?? {}).length > 0) continue;
     const identity = identityOf(d);
     gaps.push({