@everystack/cli 0.4.8 → 0.4.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/commands/db-reconcile.ts

@@ -40,6 +40,8 @@ import {
   triggerDropSql,
   renderProvenanceDelete,
   renderSchemaLogInsert,
+  derivedSearchPath,
+  renderSetSearchPath,
   ENSURE_RECONCILER_SQL,
 } from '../derived-apply.js';
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
@@ -143,6 +145,12 @@ export async function executeReconcile(
   // (CONCURRENTLY index builds, VACUUM); those self-commit, so we fall back to the unwrapped path.
   const atomic = isTransactionalBatch(rendered.statements);
 
+  // Bare table refs in derived bodies (a db/pull deparse from the all-public era) resolve
+  // against the search_path at CREATE time — put every declared schema on it, or the build
+  // fails on the first non-public table. Null for an all-public app: the apply stays exactly
+  // as it was. See derivedSearchPath.
+  const setSearchPath = renderSetSearchPath(derivedSearchPath(parsed.objects), atomic);
+
   if (atomic) await runner('BEGIN');
   try {
     // The session guard: postgres-js `max: 1` is a pool of one, not a session lease — a
@@ -156,17 +164,28 @@ export async function executeReconcile(
 
     if (rendered.statements.length > 0) {
       if (atomic) {
-        await runner(rendered.statements.join(';\n'));
+        // The SET rides the same simple-query batch (and the same transaction) as the DDL,
+        // so bare body refs resolve to their real schema; SET LOCAL resets it at COMMIT.
+        await runner([setSearchPath, ...rendered.statements].filter(Boolean).join(';\n'));
       } else {
         // Self-committing statements (CONCURRENTLY, VACUUM) refuse ANY transaction block —
         // including the implicit one a joined multi-statement simple query runs in, so the
         // batch MUST go one statement per protocol message. A failure mid-way leaves the
         // earlier statements committed: the documented cost of the unwrapped path; the next
-        // plan re-converges from what actually landed.
+        // plan re-converges from what actually landed. The session SET precedes them so every
+        // create resolves its bare refs.
+        if (setSearchPath) await runner(setSearchPath);
         for (const statement of rendered.statements) await runner(statement);
       }
     }
 
+    // Reset the search_path before introspecting. pg_get_viewdef renders a ref BARE while its
+    // schema is in scope and QUALIFIED once it is off — so the defHash we record must be read
+    // under the SAME (default) path every future introspection uses, or the qualified live
+    // deparse reads as drift against a bare recorded hash on the very next run. Canonical
+    // capture, always: SET LOCAL resets within the transaction; the session path otherwise.
+    if (setSearchPath) await runner(atomic ? 'SET LOCAL search_path TO DEFAULT' : 'RESET search_path');
+
     // Re-read the catalog so provenance records the def hashes of what NOW exists, not what we hoped
     // would exist. Inside the transaction this reads the batch's own not-yet-committed writes.
     const after = await introspectDerived(runner);
@@ -196,7 +215,9 @@ export async function executeReconcile(
     for (const identity of rendered.remove) bookkeeping.push(renderProvenanceDelete(identity));
     bookkeeping.push(renderSchemaLogInsert({
       kind: 'compute reconcile',
-      sql: rendered.statements.join(';\n') || '-- provenance-only (baseline/rebaseline/prune)',
+      sql: rendered.statements.length > 0
+        ? [setSearchPath, ...rendered.statements].filter(Boolean).join(';\n')
+        : '-- provenance-only (baseline/rebaseline/prune)',
       outcome: 'applied',
       actor: options.actor, gitRef: options.gitRef, planRef: options.planRef,
       durationMs: now() - started,

package/src/cli/derived-apply.ts

@@ -13,9 +13,9 @@
  * the reconciler writes it and never reads it.
  */
 
-import { normalizeSql, type SourceObject } from './derived-source.js';
+import { normalizeSql, parseQualified, type SourceObject } from './derived-source.js';
 import type { ReconcilePlan } from './derived-plan.js';
-import { quoteQualified } from './pg-ident.js';
+import { quoteIdent, quoteQualified } from './pg-ident.js';
 
 /** SQL string literal with '' doubling (standard_conforming_strings). */
 export function escapeLiteral(value: string): string {
@@ -102,6 +102,40 @@ function objectSql(obj: SourceObject): string[] {
   return statements;
 }
 
+/**
+ * The schemas a from-scratch derived apply must put on the search_path before it
+ * creates anything. Derived bodies carry BARE table refs — db:pull deparsed them
+ * when every table lived in `public`, so a view over `stats.list_casts` still reads
+ * `FROM list_casts`. Postgres resolves and STORES those refs against the search_path
+ * AT CREATE TIME, so a build whose path is public-only cannot resolve them once the
+ * tables move to non-public schemas (the multi-schema split). The needed set is the
+ * union of every schema the declared objects and their declared dependencies live in
+ * — a deterministic function of the source, so the build stays hermetic. `public`
+ * always trails (tables/extensions still there; a db:pull-era bare ref was globally
+ * unique in public, so order never has to disambiguate).
+ */
+export function derivedSearchPath(objects: SourceObject[]): string[] {
+  const schemas = new Set<string>();
+  for (const o of objects) {
+    schemas.add(o.schema);
+    for (const dep of o.declaredDeps ?? []) schemas.add(parseQualified(dep).schema);
+  }
+  const nonPublic = [...schemas].filter((s) => s !== 'public').sort();
+  return [...nonPublic, 'public'];
+}
+
+/**
+ * The `SET search_path` that prefixes a derived apply — or `null` when every object
+ * and dependency lives in `public` (the default), so an all-public app's apply stays
+ * byte-identical and the override appears only when a schema split actually needs it.
+ * `LOCAL` scopes it to the apply transaction (the atomic batch); the non-atomic
+ * CONCURRENTLY path has no transaction, so it sets the session for the apply's life.
+ */
+export function renderSetSearchPath(schemas: string[], local: boolean): string | null {
+  if (schemas.length === 1 && schemas[0] === 'public') return null;
+  return `SET ${local ? 'LOCAL ' : ''}search_path = ${schemas.map(quoteIdent).join(', ')}`;
+}
+
 export function renderReconcileSql(plan: ReconcilePlan, source: SourceObject[]): RenderedReconcile {
   const srcById = new Map(source.map((o) => [o.identity, o]));
   const statements: string[] = [];