@everystack/cli 0.4.68 → 0.4.70

package/src/cli/state-apply.ts

@@ -17,7 +17,7 @@
  * named state at both ends" — but nothing here needs a folder.
  */
 
-import { execSync } from 'node:child_process';
+import { execSync, execFileSync } from 'node:child_process';
 import type { ModelDescriptor } from '@everystack/model';
 import { introspectContract, type AuthzContract, type QueryRunner } from './authz-contract';
 import type { SessionRunner } from './session';
@@ -25,7 +25,7 @@ import { introspectSchema, type SchemaSnapshot } from './schema-introspect';
 import { FUNCTIONS_SQL, contractFunctionRow } from './security-catalog';
 import { generateMigrationSql, HELD_DROP_PREFIX } from './migration-generate';
 import type { SequenceDescriptor } from '@everystack/model';
-import { fingerprintLive } from './schema-fingerprint';
+import { fingerprintLive, FINGERPRINT_VERSION } from './schema-fingerprint';
 import { ENSURE_RECONCILER_SQL, renderSchemaLogInsert, renderSchemaLogFingerprintUpdate } from './derived-apply';
 
 const NOTICE_PREFIX = '-- NOTICE';
@@ -276,14 +276,49 @@ export function currentGitRef(): string | null {
   }
 }
 
+/**
+ * True when the models the apply ran against differ from HEAD — a dirty mint.
+ *
+ * schema_log records HEAD (`currentGitRef`) as the commit that declares the applied state. That
+ * pointer is only honest if HEAD's committed models ARE what was applied. If the operator
+ * applied from a worktree with uncommitted model changes, HEAD does not declare plan.to — so
+ * the fast-forward proof must ignore the row (it treats a dirty row like a null git_ref).
+ * Scoped to the models path, so an unrelated dirty file (a README) does not disqualify the row.
+ * Not a git checkout → not dirty (git_ref is null there anyway).
+ */
+export function worktreeDirty(modelsPath: string, cwd: string = process.cwd()): boolean {
+  try {
+    const out = execFileSync('git', ['status', '--porcelain', '--', modelsPath], {
+      cwd,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString();
+    return out.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+
 export interface StateApplyOptions {
   actor?: string | null;
   gitRef?: string | null;
   planRef?: string | null;
   /** The live base fingerprint before this apply (schema_log's from-side). */
   fromFingerprint?: string | null;
+  /** The canon the fingerprints were computed under. Defaults to the current FINGERPRINT_VERSION
+   *  — the hashes this writer records are always current-canon — so the descent witness carries
+   *  the version needed to recompute across a later bump. */
+  fpVersion?: number | null;
+  /** The apply ran from a dirty worktree (models differed from HEAD). The recorded git_ref then
+   *  does not declare what was applied, so descent ignores the row. */
+  dirty?: boolean;
   /** Injectable clock for tests. */
   now?: () => number;
+  /**
+   * When the fast-forward rule was waived by a `--attest-lineage-lost` attestation, a short note read
+   * at WRITE time (a getter, because the attestation is decided in the descent step that runs before
+   * this) and folded into the `applied` schema_log outcome — the durable audit of a deliberate waiver.
+   */
+  descentNote?: () => string | undefined;
 }
 
 export interface StateApplyResult {
@@ -327,16 +362,19 @@ export async function applyGeneratedStatements(
         outcome: `failed: ${String(err?.message ?? err).slice(0, 500)}`,
         actor: options.actor, gitRef: options.gitRef, planRef: options.planRef,
         fromFingerprint: options.fromFingerprint,
+        fpVersion: options.fpVersion ?? FINGERPRINT_VERSION, dirty: options.dirty ?? false,
         durationMs: now() - started,
       }));
     } catch { /* the memoir is best-effort on failure */ }
     throw err;
   }
 
+  const note = options.descentNote?.();
   const logRows = await runner(renderSchemaLogInsert({
-    kind: 'state apply', sql: batchSql, outcome: 'applied',
+    kind: 'state apply', sql: batchSql, outcome: note ? `applied — ${note}` : 'applied',
     actor: options.actor, gitRef: options.gitRef, planRef: options.planRef,
     fromFingerprint: options.fromFingerprint,
+    fpVersion: options.fpVersion ?? FINGERPRINT_VERSION, dirty: options.dirty ?? false,
     durationMs: now() - started,
   }));
   const logId = logRows?.[0]?.id !== undefined ? Number(logRows[0].id) : undefined;

package/src/cli/swap-snapshot.ts

@@ -33,6 +33,8 @@ export type SnapshotDecision =
   | { mode: 'logical' }
   /** The operator already took one and named it — nothing to do but record it. */
   | { mode: 'attested'; ref: string }
+  /** Take our OWN local `pg_dump -Fc` and verify it (bare --database-url, db:apply only). */
+  | { mode: 'local' }
   /** The operator explicitly accepted no rollback point. */
   | { mode: 'none' }
   /** Nothing safe is available and no consent was given — refuse before anything moves. */
@@ -51,6 +53,13 @@ export interface SnapshotDecisionInput {
   snapshotRef?: string;
   /** `--snapshot <physical|logical|none>`. */
   requested?: SnapshotModeRequest;
+  /**
+   * Bare-URL only: may the tool take its OWN local `pg_dump -Fc` as the rollback point? db:apply
+   * passes true (REVERSAL 1 — bare-URL apply takes+verifies a local dump); db:swap leaves it false, so
+   * a bare-URL swap still REFUSES without an attested ref (a multi-GB schema restore is not a local
+   * pg_dump's job). Default false keeps the shared decision unchanged for db:swap.
+   */
+  localDump?: boolean;
 }
 
 /** Is this instance id something we can actually snapshot, or an absent/placeholder output? */
@@ -73,7 +82,7 @@ function usableInstanceId(id?: string): id is string {
  * is optional in practice.
  */
 export function decideSnapshotMode(input: SnapshotDecisionInput): SnapshotDecision {
-  const { venue, instanceId, snapshotRef, requested } = input;
+  const { venue, instanceId, snapshotRef, requested, localDump } = input;
 
   if (requested !== undefined && !SNAPSHOT_MODES.includes(requested)) {
     return {
@@ -113,6 +122,11 @@ export function decideSnapshotMode(input: SnapshotDecisionInput): SnapshotDecisi
 
   if (requested === 'logical') {
     if (venue === 'url') {
+      // On the venue that CAN take its own local dump (db:apply), an explicit `--snapshot logical`
+      // means exactly that — a pg_dump rollback point — so honour it as the local dump. Where the
+      // local dump is not offered (db:swap), the stage's Task lane is the only logical backup and a
+      // bare URL has no stage, so refuse.
+      if (localDump) return { mode: 'local' };
       return {
         mode: 'refuse',
         reason: 'A logical snapshot runs in the stage\'s Task lane via the ops Lambda, and a bare --database-url has no stage behind it. '
@@ -127,6 +141,9 @@ export function decideSnapshotMode(input: SnapshotDecisionInput): SnapshotDecisi
   if (venue === 'stage') {
     return usableInstanceId(instanceId) ? { mode: 'physical', instanceId } : { mode: 'logical' };
   }
+  // Bare --database-url. Where the tool takes its own local dump (db:apply), that is the default; where
+  // it does not (db:swap), a destructive run over a bare URL still refuses without an attested ref.
+  if (localDump) return { mode: 'local' };
   return {
     mode: 'refuse',
     reason: 'db:swap over a bare --database-url does not take a snapshot for you, and it will not run destructively without one. '