@everystack/cli 0.4.8 → 0.4.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.8",
+  "version": "0.4.11",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/authz-contract.ts

@@ -22,6 +22,7 @@
  */
 
 import { parsePgArray } from './security-catalog.js';
+import { withCanonicalSearchPath } from './search-path.js';
 
 // ---------------------------------------------------------------------------
 // The contract format — the frozen, reviewable, version-controlled shape.
@@ -437,19 +438,23 @@ export async function introspectContract(
   mapFunctionRow: (row: any) => { schema: string; name: string; securityDefiner: boolean; hasSearchPath: boolean },
   functionsSql: string,
 ): Promise<AuthzContract> {
-  const [rls, policies, grants, columnGrants, fnRows] = await Promise.all([
-    run(RLS_SQL),
-    run(POLICIES_SQL),
-    run(GRANTS_SQL),
-    run(COLUMN_GRANTS_SQL),
-    run(functionsSql),
-  ]);
-  return assembleContract({
-    rls: rls as RlsRow[],
-    policies: policies as PolicyRow[],
-    grants: grants as GrantRow[],
-    columnGrants: columnGrants as ColumnGrantRow[],
-    functions: (fnRows as any[]).map(mapFunctionRow),
+  // Policy USING/WITH CHECK expressions deparse relative to the search_path — pin the
+  // canonical baseline so an ambient non-default path never reads as false authz drift.
+  return withCanonicalSearchPath(run, async () => {
+    const [rls, policies, grants, columnGrants, fnRows] = await Promise.all([
+      run(RLS_SQL),
+      run(POLICIES_SQL),
+      run(GRANTS_SQL),
+      run(COLUMN_GRANTS_SQL),
+      run(functionsSql),
+    ]);
+    return assembleContract({
+      rls: rls as RlsRow[],
+      policies: policies as PolicyRow[],
+      grants: grants as GrantRow[],
+      columnGrants: columnGrants as ColumnGrantRow[],
+      functions: (fnRows as any[]).map(mapFunctionRow),
+    });
   });
 }
 

package/src/cli/commands/db-reconcile.ts

@@ -40,6 +40,8 @@ import {
   triggerDropSql,
   renderProvenanceDelete,
   renderSchemaLogInsert,
+  derivedSearchPath,
+  renderSetSearchPath,
   ENSURE_RECONCILER_SQL,
 } from '../derived-apply.js';
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
@@ -143,6 +145,12 @@ export async function executeReconcile(
   // (CONCURRENTLY index builds, VACUUM); those self-commit, so we fall back to the unwrapped path.
   const atomic = isTransactionalBatch(rendered.statements);
 
+  // Bare table refs in derived bodies (a db/pull deparse from the all-public era) resolve
+  // against the search_path at CREATE time — put every declared schema on it, or the build
+  // fails on the first non-public table. Null for an all-public app: the apply stays exactly
+  // as it was. See derivedSearchPath.
+  const setSearchPath = renderSetSearchPath(derivedSearchPath(parsed.objects), atomic);
+
   if (atomic) await runner('BEGIN');
   try {
     // The session guard: postgres-js `max: 1` is a pool of one, not a session lease — a
@@ -156,19 +164,25 @@ export async function executeReconcile(
 
     if (rendered.statements.length > 0) {
       if (atomic) {
-        await runner(rendered.statements.join(';\n'));
+        // The SET rides the same simple-query batch (and the same transaction) as the DDL,
+        // so bare body refs resolve to their real schema; SET LOCAL resets it at COMMIT.
+        await runner([setSearchPath, ...rendered.statements].filter(Boolean).join(';\n'));
       } else {
         // Self-committing statements (CONCURRENTLY, VACUUM) refuse ANY transaction block —
         // including the implicit one a joined multi-statement simple query runs in, so the
         // batch MUST go one statement per protocol message. A failure mid-way leaves the
         // earlier statements committed: the documented cost of the unwrapped path; the next
-        // plan re-converges from what actually landed.
+        // plan re-converges from what actually landed. The session SET precedes them so every
+        // create resolves its bare refs.
+        if (setSearchPath) await runner(setSearchPath);
         for (const statement of rendered.statements) await runner(statement);
       }
     }
 
     // Re-read the catalog so provenance records the def hashes of what NOW exists, not what we hoped
     // would exist. Inside the transaction this reads the batch's own not-yet-committed writes.
+    // introspectDerived pins the canonical search_path itself, so the defHash it records is stable
+    // regardless of the create-time wide path above (or any ambient override) — no manual reset here.
     const after = await introspectDerived(runner);
     const liveById = new Map(after.objects.map((o) => [o.identity, o]));
     const srcById = new Map(parsed.objects.map((o) => [o.identity, o]));
@@ -196,7 +210,9 @@ export async function executeReconcile(
     for (const identity of rendered.remove) bookkeeping.push(renderProvenanceDelete(identity));
     bookkeeping.push(renderSchemaLogInsert({
       kind: 'compute reconcile',
-      sql: rendered.statements.join(';\n') || '-- provenance-only (baseline/rebaseline/prune)',
+      sql: rendered.statements.length > 0
+        ? [setSearchPath, ...rendered.statements].filter(Boolean).join(';\n')
+        : '-- provenance-only (baseline/rebaseline/prune)',
       outcome: 'applied',
       actor: options.actor, gitRef: options.gitRef, planRef: options.planRef,
       durationMs: now() - started,

package/src/cli/derived-apply.ts

@@ -13,9 +13,9 @@
  * the reconciler writes it and never reads it.
  */
 
-import { normalizeSql, type SourceObject } from './derived-source.js';
+import { normalizeSql, parseQualified, type SourceObject } from './derived-source.js';
 import type { ReconcilePlan } from './derived-plan.js';
-import { quoteQualified } from './pg-ident.js';
+import { quoteIdent, quoteQualified } from './pg-ident.js';
 
 /** SQL string literal with '' doubling (standard_conforming_strings). */
 export function escapeLiteral(value: string): string {
@@ -102,6 +102,40 @@ function objectSql(obj: SourceObject): string[] {
   return statements;
 }
 
+/**
+ * The schemas a from-scratch derived apply must put on the search_path before it
+ * creates anything. Derived bodies carry BARE table refs — db:pull deparsed them
+ * when every table lived in `public`, so a view over `stats.list_casts` still reads
+ * `FROM list_casts`. Postgres resolves and STORES those refs against the search_path
+ * AT CREATE TIME, so a build whose path is public-only cannot resolve them once the
+ * tables move to non-public schemas (the multi-schema split). The needed set is the
+ * union of every schema the declared objects and their declared dependencies live in
+ * — a deterministic function of the source, so the build stays hermetic. `public`
+ * always trails (tables/extensions still there; a db:pull-era bare ref was globally
+ * unique in public, so order never has to disambiguate).
+ */
+export function derivedSearchPath(objects: SourceObject[]): string[] {
+  const schemas = new Set<string>();
+  for (const o of objects) {
+    schemas.add(o.schema);
+    for (const dep of o.declaredDeps ?? []) schemas.add(parseQualified(dep).schema);
+  }
+  const nonPublic = [...schemas].filter((s) => s !== 'public').sort();
+  return [...nonPublic, 'public'];
+}
+
+/**
+ * The `SET search_path` that prefixes a derived apply — or `null` when every object
+ * and dependency lives in `public` (the default), so an all-public app's apply stays
+ * byte-identical and the override appears only when a schema split actually needs it.
+ * `LOCAL` scopes it to the apply transaction (the atomic batch); the non-atomic
+ * CONCURRENTLY path has no transaction, so it sets the session for the apply's life.
+ */
+export function renderSetSearchPath(schemas: string[], local: boolean): string | null {
+  if (schemas.length === 1 && schemas[0] === 'public') return null;
+  return `SET ${local ? 'LOCAL ' : ''}search_path = ${schemas.map(quoteIdent).join(', ')}`;
+}
+
 export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[]): RenderedReconcile {
   const srcById = new Map(source.map((o) => [o.identity, o]));
   const statements: string[] = [];

package/src/cli/derived-introspect.ts

@@ -20,6 +20,7 @@
 import { createHash } from 'node:crypto';
 import { IGNORED_SCHEMAS, type QueryRunner } from './authz-contract.js';
 import { normalizeSql, type DerivedKind } from './derived-source.js';
+import { withCanonicalSearchPath } from './search-path.js';
 
 export interface LiveObject {
   kind: DerivedKind;
@@ -529,23 +530,29 @@ export function assembleDerivedCatalog(rows: DerivedRows): DerivedCatalog {
  * the reconciler has never touched) folds to an empty claims list.
  */
 export async function introspectDerived(run: QueryRunner): Promise<DerivedCatalog> {
-  const [relations, functions, indexes, depends, triggers, grants] = await Promise.all([
-    run(DERIVED_RELATIONS_SQL), run(DERIVED_FUNCTIONS_SQL), run(MATVIEW_INDEXES_SQL), run(DERIVED_DEPENDS_SQL),
-    run(DERIVED_TRIGGERS_SQL), run(DERIVED_GRANTS_SQL),
-  ]);
-  let provenance: ProvenanceRawRow[] = [];
-  try {
-    provenance = (await run(PROVENANCE_SQL)) as ProvenanceRawRow[];
-  } catch {
-    // everystack.derived_provenance does not exist yet — nothing has been reconciled.
-  }
-  return assembleDerivedCatalog({
-    relations: relations as RelationRow[],
-    functions: functions as FunctionRow[],
-    indexes: indexes as IndexDefRow[],
-    depends: depends as DependsRow[],
-    triggers: triggers as TriggerRow[],
-    grants: grants as GrantAclRow[],
-    provenance,
+  // View/matview/function bodies deparse relative to the search_path (`pg_get_viewdef`
+  // renders a ref bare while its schema is in scope, qualified once off). Pin the
+  // canonical baseline so the recorded def hash is stable across runs and paths — this
+  // also subsumes the reconcile apply's pre-introspection reset. See search-path.ts.
+  return withCanonicalSearchPath(run, async () => {
+    const [relations, functions, indexes, depends, triggers, grants] = await Promise.all([
+      run(DERIVED_RELATIONS_SQL), run(DERIVED_FUNCTIONS_SQL), run(MATVIEW_INDEXES_SQL), run(DERIVED_DEPENDS_SQL),
+      run(DERIVED_TRIGGERS_SQL), run(DERIVED_GRANTS_SQL),
+    ]);
+    let provenance: ProvenanceRawRow[] = [];
+    try {
+      provenance = (await run(PROVENANCE_SQL)) as ProvenanceRawRow[];
+    } catch {
+      // everystack.derived_provenance does not exist yet — nothing has been reconciled.
+    }
+    return assembleDerivedCatalog({
+      relations: relations as RelationRow[],
+      functions: functions as FunctionRow[],
+      indexes: indexes as IndexDefRow[],
+      depends: depends as DependsRow[],
+      triggers: triggers as TriggerRow[],
+      grants: grants as GrantAclRow[],
+      provenance,
+    });
   });
 }

package/src/cli/model-render.ts

@@ -208,6 +208,77 @@ function renderDefault(expr: string): string | null {
   return null;
 }
 
+const NUMERIC_ARRAY_BASE = /^(smallint|integer|bigint|numeric|decimal|real|double precision)\b/;
+
+/**
+ * The `.default([...])` modifier for an ARRAY column — the spelling the array-default
+ * guard requires (a string default on an array field throws; `.default("{}")` was the
+ * old, now-rejected pull output). Parses the Postgres array literal back into the JS
+ * array the compiler round-trips from: `'{}'` → `[]`, `'{"a","b"}'` → `['a', 'b']`,
+ * `'{1,2}'` → `[1, 2]`. Returns null for anything it can't confidently invert (nested
+ * arrays, NULL elements, an `ARRAY[...]`/function expression) — the caller falls back to
+ * `.defaultSql()`, which round-trips via the raw SQL (the diff normalizes both sides).
+ */
+function renderArrayDefault(expr: string, arrayType: string): string | null {
+  const n = normalizeDefault(expr);
+  if (n == null) return null;
+  const lit = n.match(/^'(\{[\s\S]*\})'$/);
+  if (!lit) return null; // not a `'{…}'` literal (e.g. an ARRAY[…] expression) → defaultSql
+  const elems = parsePgArrayElements(lit[1]);
+  if (elems == null) return null;
+  const base = arrayType.slice(0, -2);
+  const numeric = NUMERIC_ARRAY_BASE.test(base);
+  const boolean = base === 'boolean';
+  const rendered = elems.map((e) => {
+    // A bare NULL is a real NULL element (a quoted "NULL" is the string) — we don't model it.
+    if (!e.quoted && e.raw.toUpperCase() === 'NULL') return null;
+    if (boolean) return e.raw === 'true' || e.raw === 'false' ? e.raw : null;
+    if (numeric) return /^-?\d+(\.\d+)?$/.test(e.raw) ? e.raw : null;
+    return tsLiteral(e.raw);
+  });
+  if (rendered.some((r) => r == null)) return null;
+  return `.default([${rendered.join(', ')}])`;
+}
+
+/**
+ * Split the body of a Postgres array literal (`{…}`, braces included) into its top-level
+ * elements, each tagged quoted-or-bare with backslash escapes resolved. Returns `[]` for
+ * `{}`, or null for a nested array or a malformed literal (the caller then falls back).
+ */
+function parsePgArrayElements(literal: string): Array<{ raw: string; quoted: boolean }> | null {
+  const body = literal.slice(1, -1);
+  if (body === '') return [];
+  const out: Array<{ raw: string; quoted: boolean }> = [];
+  let i = 0;
+  while (i < body.length) {
+    let raw = '';
+    let quoted = false;
+    if (body[i] === '{') return null; // nested array — not modeled
+    if (body[i] === '"') {
+      quoted = true;
+      i++;
+      while (i < body.length && body[i] !== '"') {
+        if (body[i] === '\\') { raw += body[i + 1] ?? ''; i += 2; continue; }
+        raw += body[i]; i++;
+      }
+      if (body[i] !== '"') return null; // unterminated quote
+      i++;
+    } else {
+      while (i < body.length && body[i] !== ',') {
+        if (body[i] === '{' || body[i] === '"') return null;
+        raw += body[i]; i++;
+      }
+      raw = raw.trim();
+    }
+    out.push({ raw, quoted });
+    if (i < body.length) {
+      if (body[i] !== ',') return null; // trailing junk after a quoted element
+      i++;
+    }
+  }
+  return out;
+}
+
 /** A single-quoted TS string literal (the model idiom), escaping embedded quotes. */
 function tsLiteral(value: string): string {
   return `'${value.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
@@ -260,7 +331,7 @@ function renderField(table: TableSchema, col: ColumnSchema, known: Set<string>,
   }
 
   if (col.default != null && !serial) {
-    const d = renderDefault(col.default);
+    const d = col.type.endsWith('[]') ? renderArrayDefault(col.default, col.type) : renderDefault(col.default);
     // No builder maps it → declare it verbatim with the escape hatch. RAW, not the
     // normalized form — stripping a trailing cast here could change semantics
     // (`'7 days'::interval`); the diff normalizes both sides for comparison instead.

package/src/cli/schema-introspect.ts

@@ -14,6 +14,7 @@
  */
 
 import { IGNORED_SCHEMAS, coerceBool, type QueryRunner } from './authz-contract.js';
+import { withCanonicalSearchPath } from './search-path.js';
 
 // ---------------------------------------------------------------------------
 // The data-layer snapshot — the structured shape both producers target.
@@ -579,14 +580,19 @@ export function assembleSchema(rows: SchemaRows): SchemaSnapshot {
  * `assembleSchema`. This is the `current` side `db:generate` diffs the compiled Models against.
  */
 export async function introspectSchema(run: QueryRunner): Promise<SchemaSnapshot> {
-  const [columns, constraints, enums, indexes, sequences] = await Promise.all([
-    run(COLUMNS_SQL), run(CONSTRAINTS_SQL), run(ENUMS_SQL), run(INDEXES_SQL), run(SEQUENCES_SQL),
-  ]);
-  return assembleSchema({
-    columns: columns as ColumnRow[],
-    constraints: constraints as ConstraintRow[],
-    enums: enums as EnumRow[],
-    indexes: indexes as IndexRow[],
-    sequences: sequences as SequenceRow[],
+  // Pin the canonical search_path: column defaults, CHECK constraints, and index
+  // expressions all deparse relative to it, so an ambient non-default path would
+  // read as false drift. See search-path.ts.
+  return withCanonicalSearchPath(run, async () => {
+    const [columns, constraints, enums, indexes, sequences] = await Promise.all([
+      run(COLUMNS_SQL), run(CONSTRAINTS_SQL), run(ENUMS_SQL), run(INDEXES_SQL), run(SEQUENCES_SQL),
+    ]);
+    return assembleSchema({
+      columns: columns as ColumnRow[],
+      constraints: constraints as ConstraintRow[],
+      enums: enums as EnumRow[],
+      indexes: indexes as IndexRow[],
+      sequences: sequences as SequenceRow[],
+    });
   });
 }

package/src/cli/search-path.ts

@@ -0,0 +1,51 @@
+/**
+ * search-path — the canonical introspection baseline.
+ *
+ * Every expression PostgreSQL deparses on introspection — column defaults
+ * (`pg_get_expr`), CHECK constraints, index expressions, generated columns,
+ * view/matview bodies (`pg_get_viewdef`), function bodies — renders its schema
+ * qualification RELATIVE to the session `search_path`. So the SAME schema reads
+ * differently depending on the ambient path: with a non-public schema on the
+ * path a reference to it renders BARE (`nextval('x_seq')`), off the path it
+ * renders QUALIFIED (`nextval('stats.x_seq')`). The declared state is always
+ * canonical (public bare, non-public qualified), so a non-default session or
+ * DB-level `search_path` makes every deparsed expression read as false drift.
+ *
+ * The fix is to CAPTURE under a fixed canonical path, once, at the introspection
+ * boundary — one guard for the whole class (defaults, checks, indexes, bodies),
+ * present and future. The baseline is `public`: it renders public-bare and
+ * non-public-qualified, matching the declared compile exactly (verified against
+ * PostgreSQL 16). It must be an EXPLICIT value — `RESET` / `SET … TO DEFAULT`
+ * inherit an `ALTER DATABASE/ROLE … SET search_path` override (the very thing
+ * that triggers the bug), so they are NOT canonical baselines.
+ */
+
+import type { QueryRunner } from './authz-contract.js';
+
+/** The canonical introspection search_path — explicit, override-proof, declared-matching. */
+export const CANONICAL_SEARCH_PATH_SQL = 'SET search_path = public';
+
+/**
+ * Run `fn` with the connection's search_path pinned to the canonical baseline, so every
+ * expression it deparses is captured in the declared-matching form regardless of the
+ * ambient path, then RESET to the connection's default afterward. RESET restores the
+ * database/role default — which for the case this fixes (an `ALTER DATABASE … SET
+ * search_path` override) is exactly the override, so a fresh connection sees no change.
+ * It deliberately does NOT preserve a caller's transient session/transaction-local SET:
+ * restoring a captured `SET LOCAL` value session-wide would leak it (e.g. the reconcile
+ * apply's create-time wide path), and no everystack caller relies on a hand-set path
+ * surviving introspection.
+ *
+ * Effective on a persistent single connection (the direct `createUrlRunner`, `max: 1`);
+ * over a per-call pooled runner the SET does not persist, but that path already renders
+ * canonically unless the database itself carries a search_path override.
+ */
+export async function withCanonicalSearchPath<T>(run: QueryRunner, fn: () => Promise<T>): Promise<T> {
+  await run(CANONICAL_SEARCH_PATH_SQL);
+  try {
+    return await fn();
+  } finally {
+    // Best-effort: a failure here must not mask fn's result.
+    try { await run('RESET search_path'); } catch { /* connection may be gone */ }
+  }
+}