@everystack/cli 0.4.70 → 0.4.71

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.71] - 2026-09-04
+
+### Added
+
+- wire declared ownership into db:provision (B6, CLI half)
+- reconcile refusals point at db:provision, not hand-SQL (B8)
+
+### Fixed
+
+- BLOCKER A — reorder ownership convergence AFTER the secret write
+- round-2 BLOCKER-1 — run ownership convergence on the credentials no-op path too
+- align diag header assertion with the current source
+
+### Documentation
+
+- brownfield ownership convergence — db:provision ENACT + ADOPT (B10)
+
 ## [0.4.70] - 2026-09-02
 
 ### Added
@@ -38,12 +55,33 @@ Format based on [Keep a Changelog](https://keepachangelog.com/).
 - the two-class refusal doctrine for db:apply (p3-doctrine)
 - the db:apply version-skew refusal and read-disagreement escalation
 
-## [Unreleased]
+## [0.4.69] - 2026-08-24
+
+### Fixed
+
+- explain paren-only predicate churn instead of leaving it a mystery
+- hedge the paren-only note — it cannot prove "not a change"
+
+## [0.4.68] - 2026-08-24
+
+### Fixed
+
+- round-trip a text_col = 'literal' predicate — strip the implicit ::text cast
+- harden the ::text strip — whitespace-tolerant array guard, stacked-cast fixpoint
+
+## [0.4.67] - 2026-08-22
+
+### Added
+
+- auto-generated changelogs from conventional commits
 
 ### Fixed
 
 - secrets test expected .js extension stripped by Metro compat
 - async RSA key generation — unblocks the event loop in parallel test runs
+- db:provision is additive-only — never reset an existing role's password
+- address closing-gate review — pin ordering, guard half-done recovery
+- address Fable red-team — rotated-stage guard, safe polarity
 
 ## [0.4.66] - 2026-08-15
 

package/README.md

@@ -230,7 +230,8 @@ everystack db:fork                      # fork a deployed stage's DB into a feat
 
 # Security
 everystack db:doctor                    # is the DB least-privilege + RLS-subject?
-everystack db:provision                 # create the least-privilege role chain (idempotent)
+everystack db:provision                 # role chain + converge declared ownership (ENACT grants, ADOPT plain objects)
+everystack db:provision --confirm       # + ADOPT SECURITY DEFINER functions / views / matviews (runtime change)
 everystack db:authz:pull|diff|test|owner|report   # the authorization contract + red-team
 
 # Backups (see docs/backups.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.70",
+  "version": "0.4.71",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -178,7 +178,7 @@
     "jest": "29.7.0",
     "react": "19.2.0",
     "ts-jest": "29.4.9",
-    "@everystack/server": "0.4.28"
+    "@everystack/server": "0.4.29"
   },
   "scripts": {
     "test": "jest",

package/src/cli/commands/db-reconcile.ts

@@ -647,6 +647,8 @@ export async function dbReconcileCommand(flags: Record<string, string>): Promise
           info('The deployed handler predates the db:reconcile ops action (needs @everystack/server >= 0.4.8). Upgrade the server, or apply credential-free over the direct lane: db:reconcile --apply --stage ' + (flags.stage ?? '<stage>') + ' --direct. (--database-url <url> is the local venue — against a deployed stage it puts a privileged connection string on argv.)');
         } else if (/timed out|timeout|task timed out/i.test(String(result.error))) {
           info('A large derived rebuild (dozens of objects) can exceed the ops-Lambda 900-second clock. Re-run credential-free with an unbounded clock: db:reconcile --apply --stage ' + (flags.stage ?? '<stage>') + ' --direct.');
+        } else if (/must be owner of/i.test(String(result.error))) {
+          info('This is a brownfield object owned by the master (the old tool created it), which the least-privilege operator cannot replace. Run `everystack db:provision --stage ' + (flags.stage ?? '<stage>') + '` first: it ADOPTS pre-existing objects to their declared owners (--confirm for SECURITY DEFINER), so the operator can then manage them. No hand-written ALTER … OWNER.');
         }
         process.exit(1);
       }

package/src/cli/commands/db.ts

@@ -304,14 +304,35 @@ export function provisionPreservedIsRecoverable(args: {
  *  same seam as pipeline-loader). */
 export interface ServerProvision {
   runProvision(
-    payload: { authPassword?: string; adminPassword?: string; searchPath?: string[]; rotationPairs?: boolean },
+    payload: {
+      authPassword?: string; adminPassword?: string; searchPath?: string[]; rotationPairs?: boolean;
+      declaredOwners?: Array<{ owner: string; schema: string }>;
+      declaredObjects?: Array<{ identity: string; schema: string; name: string; kind: 'function' | 'view' | 'materialized view'; secdef: boolean; currentOwner: string; declaredOwner: string }>;
+      confirm?: boolean;
+    },
     deps: {
       execute: (sql: string) => Promise<unknown>;
       connection?: { host: string; port?: number | string; database: string } | null;
       connectProbe?: (url: string) => Promise<void>;
       roleHasLogin?: (role: string) => Promise<boolean>;
+      query?: (sql: string) => Promise<any[]>;
+      master?: { execute: (sql: string) => Promise<unknown>; query: (sql: string) => Promise<any[]> } | null;
     },
   ): Promise<any>;
+  /** ENACT + ADOPT, run SEPARATELY and AFTER the secret is written (the lockout-safe ordering). */
+  convergeOwnership(
+    payload: {
+      declaredOwners?: Array<{ owner: string; schema: string }>;
+      declaredObjects?: Array<{ identity: string; schema: string; name: string; kind: 'function' | 'view' | 'materialized view'; secdef: boolean; currentOwner: string; declaredOwner: string }>;
+      confirm?: boolean;
+      adminRole?: string;
+    },
+    deps: {
+      execute: (sql: string) => Promise<unknown>;
+      query?: (sql: string) => Promise<any[]>;
+      master?: { execute: (sql: string) => Promise<unknown>; query: (sql: string) => Promise<any[]> } | null;
+    },
+  ): Promise<{ ownerEnactment?: { enacted: number; refusals: string[] }; ownerAdoption?: { reassigned: number; manifest: Array<{ identity: string; kind: string; secdef: boolean; from: string; to: string }>; findings: Array<{ severity: string; identity: string; detail: string }>; refusals: string[] } }>;
 }
 
 /**
@@ -450,6 +471,39 @@ export function declaredSearchPath(schemas: string[]): string[] {
   return nonPublic.length ? [...nonPublic, 'public'] : [];
 }
 
+/** Kinds ADOPT can reassign — triggers have no owner, 'sql' escape-hatch objects are opaque. */
+const ADOPTABLE_KINDS = new Set(['function', 'view', 'materialized view']);
+
+/**
+ * Read the declared ownership out of the compiled derived source: the unique (owner, schema) pairs
+ * to ENACT, and the function/view/matview objects to ADOPT. `secdef` is read from the object's own
+ * CREATE (the descriptor compiler emits SECURITY DEFINER into it), so the confirm gate sees which
+ * reassignments change runs-as. Objects without a declared owner are left alone (reconcile creates
+ * them owned by the operator, no convergence needed).
+ */
+export function extractDeclaredOwnership(objects: Array<{ kind: string; schema: string; name: string; identity: string; sql: string; owner?: string }>): {
+  declaredOwners: Array<{ owner: string; schema: string }>;
+  declaredObjects: Array<{ identity: string; schema: string; name: string; kind: 'function' | 'view' | 'materialized view'; secdef: boolean; currentOwner: string; declaredOwner: string }>;
+} {
+  const seen = new Set<string>();
+  const declaredOwners: Array<{ owner: string; schema: string }> = [];
+  const declaredObjects: Array<{ identity: string; schema: string; name: string; kind: 'function' | 'view' | 'materialized view'; secdef: boolean; currentOwner: string; declaredOwner: string }> = [];
+  for (const o of objects) {
+    if (!o.owner) continue;
+    const key = `${o.owner}\t${o.schema}`;
+    if (!seen.has(key)) { seen.add(key); declaredOwners.push({ owner: o.owner, schema: o.schema }); }
+    if (ADOPTABLE_KINDS.has(o.kind)) {
+      declaredObjects.push({
+        identity: o.identity, schema: o.schema, name: o.name,
+        kind: o.kind as 'function' | 'view' | 'materialized view',
+        secdef: /SECURITY\s+DEFINER/i.test(o.sql),
+        currentOwner: '', declaredOwner: o.owner,
+      });
+    }
+  }
+  return { declaredOwners, declaredObjects };
+}
+
 /**
  * Every schema the API connection must reach — the union of the TABLE schemas (the models
  * barrel) and the DERIVED-object schemas (views/matviews declared via
@@ -838,6 +892,10 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   // authenticator flip doesn't go dark on bare-ref matview reads. Best-effort: a modelless or
   // all-public app sets no path (unchanged behavior).
   let declaredSchemas: string[] = [];
+  // Declared ownership (brownfield convergence) — the (owner, schema) pairs to ENACT and the
+  // function/view/matview objects to ADOPT, read from the same barrel as the schema set.
+  let declaredOwners: Array<{ owner: string; schema: string }> = [];
+  let declaredObjects: Array<{ identity: string; schema: string; name: string; kind: 'function' | 'view' | 'materialized view'; secdef: boolean; currentOwner: string; declaredOwner: string }> = [];
   try {
     const { resolveModelsPath } = await import('../models-path');
     const { loadModels } = await import('./db-generate');
@@ -846,7 +904,10 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     try {
       const { loadDeclaredDerived } = await import('../declared-derived');
       const declared = await loadDeclaredDerived(flags.models);
-      if (declared) derivedObjects = declared.objects;
+      if (declared) {
+        derivedObjects = declared.objects;
+        ({ declaredOwners, declaredObjects } = extractDeclaredOwnership(declared.objects));
+      }
     } catch {
       // No derived layer resolvable — the table schemas still resolve correctly.
     }
@@ -856,6 +917,8 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   }
   const searchPath = declaredSearchPath(declaredSchemas);
   if (searchPath.length) info(`  Declared search_path (set as the role default via ALTER ROLE): ${searchPath.join(', ')}`);
+  const confirm = !!flags.confirm;
+  const ownershipPayload = { declaredOwners, declaredObjects, confirm };
 
   // Generate BOTH login passwords and keep them in memory only — they are written straight
   // into the secret store and are NEVER printed, logged, or returned to a human.
@@ -870,6 +933,7 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     const { createUrlRunner } = await import('../db-source');
     const { runner, end } = await createUrlRunner(url);
     try {
+      // Credentials ONLY — ownership convergence runs separately, AFTER the secret is written.
       return await runProvision({ authPassword, adminPassword, searchPath, rotationPairs: !!flags['rotation-pairs'] }, {
         execute: async (statement) => runner(statement),
         connection: parseUrlConnection(url),
@@ -950,6 +1014,61 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     success(`Operator login ready: ${result.adminRole} (LOGIN, INHERIT owner) — ${adminMsg}`);
   }
 
+  // Ownership convergence runs AFTER the secret write (below) — never before. Declared here so the
+  // final exit status can see it.
+  let ownershipIncomplete = false;
+
+  // ENACT + ADOPT, factored out because it must run on BOTH exit paths: the normal one (after the
+  // secret write) AND the additive-only NO-OP path (credentials unchanged, so no secret is written —
+  // but the owners in the model may have changed and still need converging). Running it only on the
+  // normal path made the whole feature a no-op on a re-provision, the common brownfield case: the
+  // stage is already provisioned, the operator adds `owner:` declarations (or re-runs the
+  // review-then-`--confirm` flow), and nothing converged. Credentials are already saved on both
+  // paths by the time this runs, so it can strand nothing.
+  const runConvergence = async (): Promise<void> => {
+    if (!declaredOwners.length && !declaredObjects.length) return;
+    const ownerPayload = { ...ownershipPayload, adminRole: result.adminRole };
+    let owned: any = {};
+    try {
+      if (directUrl) {
+        // The direct venue is ONE privileged connection = operator read AND master; ADOPT's live
+        // master_can_act probe gates it (an under-privileged direct connection refuses precisely).
+        const { convergeOwnership } = await loadServerProvision();
+        const { createUrlRunner } = await import('../db-source');
+        const { runner, end } = await createUrlRunner(directUrl);
+        try {
+          owned = await convergeOwnership(ownerPayload, {
+            execute: async (s) => runner(s),
+            query: async (s) => (await runner(s)) as any[],
+            master: { execute: async (s) => runner(s), query: async (s) => (await runner(s)) as any[] },
+          });
+        } finally {
+          await end?.();
+        }
+      } else {
+        owned = await invokeAction(config.region, opsFunction(config), 'db:converge-ownership', ownerPayload);
+      }
+    } catch (err: any) {
+      warn(`Ownership convergence failed (credentials are already saved — nothing stranded): ${err.message}`);
+      ownershipIncomplete = true;
+    }
+    const enact = owned.ownerEnactment;
+    if (enact) {
+      if (enact.enacted) success(`Owner enactment: ${enact.enacted} grant(s) applied.`);
+      for (const r of enact.refusals) { warn(`Owner enactment: ${r}`); ownershipIncomplete = true; }
+    }
+    const adopt = owned.ownerAdoption;
+    if (adopt) {
+      if (adopt.manifest?.length) {
+        info('Ownership adoption — objects reassigned:');
+        for (const m of adopt.manifest) info(`  ${m.identity} [${m.kind}${m.secdef ? ', SECURITY DEFINER' : ''}]  ${m.from} → ${m.to}`);
+      }
+      for (const f of adopt.findings ?? []) warn(`  audit (${f.severity}): ${f.identity} — ${f.detail}`);
+      if (adopt.reassigned) success(`Ownership adoption: ${adopt.reassigned} object(s) reassigned (one transaction).`);
+      for (const r of adopt.refusals ?? []) { warn(`Ownership adoption: ${r}`); ownershipIncomplete = true; }
+    }
+  };
+
   // Additive-only: if the login roles already existed as live logins, provision changed no
   // credential — so there is nothing to write and no host to resolve. Never touch the secret
   // store on a no-op re-provision (the footgun that reset a live password then locked the stage out).
@@ -966,6 +1085,13 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     });
     if (recoverable.ok) {
       success(`Roles already provisioned — passwords and secrets left unchanged. Verify the live credential with \`everystack db:doctor --stage ${flags.stage}\`; run \`everystack db:provision --rotate\` to change credentials.`);
+      // Credentials are a no-op, but declared ownership may still need converging — this is the
+      // re-provision path (add owners, or the review-then---confirm retry). Run it, then exit.
+      await runConvergence();
+      if (ownershipIncomplete) {
+        warn('Ownership was not fully converged — see the refusals above. db:reconcile will refuse until they are resolved.');
+        process.exit(1);
+      }
       return;
     }
     fail(recoverable.reason);
@@ -1028,6 +1154,12 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   success(`Secrets written for stage "${flags.stage}". No credential was displayed.`);
   for (const note of plan.notes) info(`  ${note}`);
   for (const warning of plan.warnings) info(`  ⚠ ${warning}`);
+
+  // OWNERSHIP CONVERGENCE — strictly AFTER the secret write. The credential is now safely in the
+  // store, so a stall or a hard kill in ENACT/ADOPT can strand nothing: the worst case is an
+  // un-converged owner, exactly the state db:reconcile refuses on (and we exit non-zero for it).
+  await runConvergence();
+
   console.log('');
   info('Finish the wiring in sst.config.ts (one-time):');
   info('  API — PRECONDITION: your handler must escalate per request (pgSettings + SET ROLE /');
@@ -1044,6 +1176,14 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     info(`        operator tasks then run as ${result.adminRole}, not the Postgres master.`);
   }
   info(`Verify:  everystack db:doctor --stage ${flags.stage}`);
+
+  // Credentials are done; ownership was left un-converged. Exit non-zero so CI and the operator act
+  // on the refusals above (run the named SQL as master, or re-run with --confirm). db:reconcile
+  // would refuse on exactly this state, so this is a real, actionable failure — not a warning to skip.
+  if (ownershipIncomplete) {
+    warn('Ownership was not fully converged — see the refusals above. db:reconcile will refuse until they are resolved.');
+    process.exit(1);
+  }
 }
 
 /** Render a doctor report — identical output whichever venue produced it. */

package/src/cli/derived-apply.ts

@@ -408,7 +408,10 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
   if (!missing.size && !unassumable.size && !noCreate.length) return null;
 
   const lines: string[] = [
-    `declared function owner(s) cannot be enacted by '${builderName}' — refused before any DDL, so nothing is half-applied:`,
+    `declared function owner(s) cannot be enacted by '${builderName}' — refused before any DDL, so nothing is half-applied.`,
+    `The one-command fix is \`everystack db:provision\`: it ENACTS these grants (and ADOPTS any`,
+    `pre-existing objects owned by the master) from the declared model, so you never hand-write them.`,
+    `The exact statements, if you must run them by hand:`,
   ];
   for (const owner of [...missing].sort()) {
     lines.push(