@everystack/cli 0.4.7 → 0.4.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -82,7 +82,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.1"
+    "@everystack/model": "0.4.2"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.1.0",

package/src/cli/commands/db-apply.ts

@@ -35,6 +35,7 @@ import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '
 import { resolveConfig, opsFunction } from '../config.js';
 import { invokeAction, lambdaQueryRunner } from '../aws.js';
 import { executeApplyPlan, type ApplyPlanResult } from '../apply-execute.js';
+import { pgDumpPreflightError } from './db-backup.js';
 import { step, success, fail, info, warn } from '../output.js';
 
 // The apply core lives in apply-execute.ts (shared with the ops Lambda's
@@ -116,6 +117,19 @@ async function applyPlanViaStage(
 
   info(`plan ${planHash(plan).slice(0, 12)}: ${plan.fromFingerprint.slice(0, 12)} → ${plan.toFingerprint.slice(0, 12)} (${plan.executable} statement(s)${plan.destructive ? `, ${plan.destructive} destructive` : ''})`);
 
+  // A destructive staged apply snapshots via db:backup INSIDE the Lambda, before the DDL. Preflight
+  // that capability HERE so a missing/incompatible pg_dump layer fails fast with the install remedy —
+  // not deep in the ceremony after the authority check, the way it once surfaced mid-apply.
+  if (plan.destructive > 0) {
+    step('Preflighting the pg_dump layer (the destructive apply snapshots before the DDL)...');
+    const probe: any = await invokeAction(region, fn, 'db:backup:probe', {}).catch((err: any) => ({ error: err?.message ?? String(err) }));
+    const remedy = pgDumpPreflightError(probe);
+    if (remedy) {
+      fail(`Cannot take the pre-apply snapshot — the destructive plan was NOT applied.\n${remedy}`);
+      process.exit(1);
+    }
+  }
+
   try {
     // Descent — the fast-forward rule needs the git checkout, so the CLI
     // decides it (the Lambda has no checkout). Read the stage's state read-only

package/src/cli/commands/db-backup.ts

@@ -48,7 +48,7 @@ export async function dbBackupProbeCommand(flags: Record<string, string>): Promi
 
   if (result?.error) {
     fail(result.error);
-    info('Build + publish the layer with scripts/build-pgdump-layer.sh, export PGDUMP_LAYER_ARN, then redeploy.');
+    info('Install @everystack/pg-tools and redeploy — the layer attaches automatically. For a bring-your-own layer, pass pgDumpLayer(..., { layerArn }) in sst.config.ts.');
     process.exit(1);
   }
 
@@ -71,7 +71,7 @@ export async function dbBackupProbeCommand(flags: Record<string, string>): Promi
 export function pgDumpPreflightError(probe: any): string | null {
   if (!probe || probe.error) {
     const detail = probe?.error ?? 'the pg_dump layer probe returned no result';
-    return `${detail}\nBuild + publish the layer with scripts/build-pgdump-layer.sh, export PGDUMP_LAYER_ARN, then redeploy.`;
+    return `${detail}\nInstall @everystack/pg-tools and redeploy — the layer attaches automatically. For a bring-your-own layer, pass pgDumpLayer(..., { layerArn }) in sst.config.ts.`;
   }
   if (probe.compatible === false) {
     return `pg_dump ${probe.pgDump ?? '(unknown)'} (major ${probe.pgDumpMajor}) is older than the server (major ${probe.serverMajor}) — it will refuse to dump (no bypass exists). Rebuild the layer with pg_dump >= ${probe.serverMajor}.`;

package/src/cli/commands/db-reconcile.ts

@@ -40,6 +40,8 @@ import {
   triggerDropSql,
   renderProvenanceDelete,
   renderSchemaLogInsert,
+  derivedSearchPath,
+  renderSetSearchPath,
   ENSURE_RECONCILER_SQL,
 } from '../derived-apply.js';
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
@@ -143,6 +145,12 @@ export async function executeReconcile(
   // (CONCURRENTLY index builds, VACUUM); those self-commit, so we fall back to the unwrapped path.
   const atomic = isTransactionalBatch(rendered.statements);
 
+  // Bare table refs in derived bodies (a db/pull deparse from the all-public era) resolve
+  // against the search_path at CREATE time — put every declared schema on it, or the build
+  // fails on the first non-public table. Null for an all-public app: the apply stays exactly
+  // as it was. See derivedSearchPath.
+  const setSearchPath = renderSetSearchPath(derivedSearchPath(parsed.objects), atomic);
+
   if (atomic) await runner('BEGIN');
   try {
     // The session guard: postgres-js `max: 1` is a pool of one, not a session lease — a
@@ -156,17 +164,28 @@ export async function executeReconcile(
 
     if (rendered.statements.length > 0) {
       if (atomic) {
-        await runner(rendered.statements.join(';\n'));
+        // The SET rides the same simple-query batch (and the same transaction) as the DDL,
+        // so bare body refs resolve to their real schema; SET LOCAL resets it at COMMIT.
+        await runner([setSearchPath, ...rendered.statements].filter(Boolean).join(';\n'));
       } else {
         // Self-committing statements (CONCURRENTLY, VACUUM) refuse ANY transaction block —
         // including the implicit one a joined multi-statement simple query runs in, so the
         // batch MUST go one statement per protocol message. A failure mid-way leaves the
         // earlier statements committed: the documented cost of the unwrapped path; the next
-        // plan re-converges from what actually landed.
+        // plan re-converges from what actually landed. The session SET precedes them so every
+        // create resolves its bare refs.
+        if (setSearchPath) await runner(setSearchPath);
         for (const statement of rendered.statements) await runner(statement);
       }
     }
 
+    // Reset the search_path before introspecting. pg_get_viewdef renders a ref BARE while its
+    // schema is in scope and QUALIFIED once it is off — so the defHash we record must be read
+    // under the SAME (default) path every future introspection uses, or the qualified live
+    // deparse reads as drift against a bare recorded hash on the very next run. Canonical
+    // capture, always: SET LOCAL resets within the transaction; the session path otherwise.
+    if (setSearchPath) await runner(atomic ? 'SET LOCAL search_path TO DEFAULT' : 'RESET search_path');
+
     // Re-read the catalog so provenance records the def hashes of what NOW exists, not what we hoped
     // would exist. Inside the transaction this reads the batch's own not-yet-committed writes.
     const after = await introspectDerived(runner);
@@ -196,7 +215,9 @@ export async function executeReconcile(
     for (const identity of rendered.remove) bookkeeping.push(renderProvenanceDelete(identity));
     bookkeeping.push(renderSchemaLogInsert({
       kind: 'compute reconcile',
-      sql: rendered.statements.join(';\n') || '-- provenance-only (baseline/rebaseline/prune)',
+      sql: rendered.statements.length > 0
+        ? [setSearchPath, ...rendered.statements].filter(Boolean).join(';\n')
+        : '-- provenance-only (baseline/rebaseline/prune)',
       outcome: 'applied',
       actor: options.actor, gitRef: options.gitRef, planRef: options.planRef,
       durationMs: now() - started,

package/src/cli/commands/deploy.ts

@@ -11,7 +11,7 @@
  */
 
 import { spawn } from 'node:child_process';
-import { step, success, fail, info } from '../output.js';
+import { step, success, fail, info, warn } from '../output.js';
 import { invalidateCachedConfig } from '../discover.js';
 import { resolveConfig } from '../config.js';
 import { probeDeployedFunctions } from '../deploy-probe.js';
@@ -23,11 +23,11 @@ export function buildDeployArgs(flags: Record<string, string>): string[] {
 }
 
 /**
- * The environment the sst child receives: the FULL ambient environment plus color.
- * Pinned as an explicit, tested contract because a consumer observed PGDUMP_LAYER_ARN
- * reaching sst when invoked directly but not through this wrapper — sst.config.ts
- * conditionals like `process.env.PGDUMP_LAYER_ARN ? { layers: [...] } : {}` silently
- * collapse when a variable goes missing, and the deploy still exits green.
+ * The environment the sst child receives: the FULL ambient environment plus color. The wrapper
+ * forwards everything so a consumer's own sst.config.ts env reads behave the same run directly or
+ * through `everystack deploy`. (This contract was pinned when the pg_dump layer depended on
+ * PGDUMP_LAYER_ARN reaching sst — now deprecated: the layer ships via @everystack/pg-tools +
+ * pgDumpLayer() and reads no ambient env at deploy.)
  */
 export function deployEnv(base: Record<string, string | undefined>): Record<string, string | undefined> {
   return { ...base, FORCE_COLOR: '1' };
@@ -38,11 +38,11 @@ export async function deployCommand(flags: Record<string, string>): Promise<void
   const args = buildDeployArgs(flags);
 
   step(`Deploying stage "${stage}"...`);
-  // Say what the wrapper sees: an sst.config.ts conditional on an env var collapses
-  // SILENTLY when the var is missing, and the deploy still exits green — the operator
-  // must be able to tell "the wrapper never saw it" from "sst ignored it" at a glance.
+  // PGDUMP_LAYER_ARN is deprecated: the layer now ships via @everystack/pg-tools and pgDumpLayer()
+  // needs no env var. Still forwarded to sst for one more minor (pgDumpLayer honors it as an alias),
+  // then removed — surface it loudly so the operator migrates off it.
   if (process.env.PGDUMP_LAYER_ARN) {
-    info(`pg_dump layer: PGDUMP_LAYER_ARN is set → forwarded to sst (${process.env.PGDUMP_LAYER_ARN})`);
+    warn('PGDUMP_LAYER_ARN is DEPRECATED and will be removed next minor. The pg_dump layer now ships via @everystack/pg-tools + pgDumpLayer() with no env var. Drop it once your sst.config.ts uses pgDumpLayer().');
   }
   await new Promise<void>((resolve) => {
     // `npx` resolves the consumer's local sst (the same way the export step runs expo).

package/src/cli/derived-apply.ts

@@ -13,9 +13,9 @@
  * the reconciler writes it and never reads it.
  */
 
-import { normalizeSql, type SourceObject } from './derived-source.js';
+import { normalizeSql, parseQualified, type SourceObject } from './derived-source.js';
 import type { ReconcilePlan } from './derived-plan.js';
-import { quoteQualified } from './pg-ident.js';
+import { quoteIdent, quoteQualified } from './pg-ident.js';
 
 /** SQL string literal with '' doubling (standard_conforming_strings). */
 export function escapeLiteral(value: string): string {
@@ -102,6 +102,40 @@ function objectSql(obj: SourceObject): string[] {
   return statements;
 }
 
+/**
+ * The schemas a from-scratch derived apply must put on the search_path before it
+ * creates anything. Derived bodies carry BARE table refs — db:pull deparsed them
+ * when every table lived in `public`, so a view over `stats.list_casts` still reads
+ * `FROM list_casts`. Postgres resolves and STORES those refs against the search_path
+ * AT CREATE TIME, so a build whose path is public-only cannot resolve them once the
+ * tables move to non-public schemas (the multi-schema split). The needed set is the
+ * union of every schema the declared objects and their declared dependencies live in
+ * — a deterministic function of the source, so the build stays hermetic. `public`
+ * always trails (tables/extensions still there; a db:pull-era bare ref was globally
+ * unique in public, so order never has to disambiguate).
+ */
+export function derivedSearchPath(objects: SourceObject[]): string[] {
+  const schemas = new Set<string>();
+  for (const o of objects) {
+    schemas.add(o.schema);
+    for (const dep of o.declaredDeps ?? []) schemas.add(parseQualified(dep).schema);
+  }
+  const nonPublic = [...schemas].filter((s) => s !== 'public').sort();
+  return [...nonPublic, 'public'];
+}
+
+/**
+ * The `SET search_path` that prefixes a derived apply — or `null` when every object
+ * and dependency lives in `public` (the default), so an all-public app's apply stays
+ * byte-identical and the override appears only when a schema split actually needs it.
+ * `LOCAL` scopes it to the apply transaction (the atomic batch); the non-atomic
+ * CONCURRENTLY path has no transaction, so it sets the session for the apply's life.
+ */
+export function renderSetSearchPath(schemas: string[], local: boolean): string | null {
+  if (schemas.length === 1 && schemas[0] === 'public') return null;
+  return `SET ${local ? 'LOCAL ' : ''}search_path = ${schemas.map(quoteIdent).join(', ')}`;
+}
+
 export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[]): RenderedReconcile {
   const srcById = new Map(source.map((o) => [o.identity, o]));
   const statements: string[] = [];