@everystack/cli 0.4.82 → 0.4.84

package/CHANGELOG.md

@@ -4,6 +4,50 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [Unreleased]
+
+### Added
+
+- automate the version-drift check — a manual note is not a gate
+
+## [0.4.84] - 2026-09-16
+
+_Internal changes only._
+
+## [0.4.83] - 2026-09-16
+
+### Added
+
+- db:pull --derived-out takes a directory, split by kind and schema
+- a real SELECT-only role for db:query's read connection
+- version-guard the Model-derived wire payloads (provision, converge-ownership, reconcile)
+- two symbols and plain words — the default output for db:plan/db:apply/db:check
+- db:apply does the whole job — the plan, then the functions and views
+
+### Fixed
+
+- derive USAGE only on serial sequences (least privilege) (#11)
+- close the closing-gate findings on --derived-out <dir>
+- owner-adoption fast-follows — identity guard, self-grant revoke, ENACT transaction
+- mirror the reader fields in ServerProvision, and pin that no credential prints
+- an E-string prefix only counts when it stands alone
+- throw a private sentinel instead of calling tx.rollback() — closes a console-sandbox swallow/neutralize hole
+- the shape-pin also covers enum value domains, not just field names
+- symmetric v-prefix in the mismatch message, restore db:provision's --direct detail
+- ADD CONSTRAINT/PRIMARY KEY are not additive — they can fail against existing data
+- the lease covers the catch-up, the receipt marks a strip, the preflight never exits mid-chain
+- the catch-up's refusal mode belongs to the caller, and the failure line says why
+- the catch-up failure names two subjects, quotes its cause once, and nobody inherits 'exit'
+- db:apply refuses a malformed plan `statements` instead of throwing
+- what a statement IS gets read once, and a comment can neither hide a revoke nor invent a drop
+- the declared side rides on the plan, so a strip reads the same before and after
+- one statement, one bucket — the summary's two halves read the same declared side
+- the plan's optional grantee set is refused at load, not dereferenced after the write
+
+### Documentation
+
+- the workflow is three commands — db:plan, db:apply, db:check
+
 ## [0.4.82] - 2026-09-08
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.82",
+  "version": "0.4.84",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -48,6 +48,11 @@
       "types": "./src/cli/db-source.ts",
       "default": "./src/cli/db-source.ts"
     },
+    "./wire": {
+      "source": "./src/wire.ts",
+      "types": "./src/wire.ts",
+      "default": "./src/wire.ts"
+    },
     "./reconcile": {
       "source": "./src/reconcile.ts",
       "types": "./src/reconcile.ts",
@@ -120,15 +125,17 @@
     "@aws-sdk/client-rds": "3.1053.0",
     "@aws-sdk/client-s3": "3.1053.0",
     "@aws-sdk/client-ssm": "3.1053.0",
+    "@aws-sdk/credential-provider-node": "3.972.44",
     "@aws-sdk/lib-storage": "3.1053.0",
     "@aws-sdk/client-sts": "3.1053.0",
     "@aws-sdk/signature-v4a": "3.1048.0",
     "glob": "13.0.6",
+    "minimatch": "10.2.5",
     "node-forge": "1.4.0",
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.17"
+    "@everystack/model": "0.4.18"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",
@@ -174,6 +181,7 @@
     "jest": "29.7.0",
     "react": "19.2.0",
     "ts-jest": "29.4.9",
+    "zod": "3.25.67",
     "@everystack/server": "0.4.30"
   },
   "scripts": {

package/src/cli/authz-contract.ts

@@ -385,9 +385,11 @@ export interface SequenceGrantContract {
   /**
    * The owning column is `GENERATED … AS IDENTITY`, not `serial` — and that changes who needs
    * what. A serial column's value comes from a DEFAULT `nextval(...)` evaluated with the
-   * CALLER's privileges, so an INSERTing role must hold USAGE/SELECT/UPDATE on the sequence or
-   * every insert fails `permission denied for sequence`. An identity column's value is supplied
-   * by the system as part of the column definition; no caller privilege is consulted at all.
+   * CALLER's privileges, so an INSERTing role must hold USAGE on the sequence (all `nextval`
+   * needs) or every insert fails `permission denied for sequence`. `SELECT`/`UPDATE` are NOT
+   * required for an INSERT — they are administrative (see SEQUENCE_PRIVILEGES_FOR_INSERT). An
+   * identity column's value is supplied by the system as part of the column definition; no
+   * caller privilege is consulted at all.
    *
    * Measured, not assumed: a role with INSERT on the table and NOTHING on the sequence inserts
    * successfully into an identity table and fails on a serial one. So the A6 inheritance rule

package/src/cli/authz-reconcile.ts

@@ -277,20 +277,23 @@ function tableMap(c: AuthzContract): Map<string, TableContract> {
  * Measured on a consumer's database: every INSERT into a serial-PK table failed
  * `permission denied for sequence`, and two of their 563 tests were exactly that.
  *
- * The rule is INSERT on the table → USAGE + SELECT + UPDATE on its sequence, and all three
- * matter. USAGE alone permits `nextval`, but `setval` needs UPDATE and reading `last_value`
- * needs SELECT, so the common `rU` shape breaks the moment anything reseeds the counter.
+ * The rule is INSERT on the table → USAGE on its sequence, and ONLY USAGE. A serial column's
+ * value comes from a DEFAULT `nextval(...)`; USAGE is exactly the privilege `nextval` (and
+ * `currval`) requires. `setval` (reseed the counter) needs UPDATE and reading `last_value`
+ * directly needs SELECT — but neither is part of an INSERT. They are administrative operations,
+ * so an INSERT-holder must not inherit them.
  *
- * Signed off after measurement, not assumed: the consumer checked every role against every
- * serial/identity sequence and found zero cases of INSERT-without-sequence-USAGE and zero of
- * USAGE-without-UPDATE, so this under-grants nobody. Their one divergence — `authenticated`
- * holding USAGE on all 27 sequences while able to INSERT into none — was a vestigial 2023
- * blanket grant they are revoking, so their database converges to this rule rather than the
- * reverse. The pull ADVISORY names that shape wherever it appears.
+ * Least privilege, corrected after a regression: an earlier form derived SELECT + UPDATE + USAGE
+ * and handed every INSERT-holder `setval` control of a surrogate key. It widened a consumer's
+ * governed prod migrator by 28 UPDATE grants nobody asked for — governance ADDED privileges the
+ * role had worked fine without. The fix returns to the minimum INSERT needs: USAGE. A role that
+ * genuinely reseeds a counter is administrative and is either ungoverned (the reconciler leaves
+ * it alone) or must declare the grant deliberately; it is never inferred from INSERT.
  *
- * Derived, never declared: there is no `sequence:` key in the model and nobody wants one.
+ * Derived, never declared: there is no `sequence:` key in the model. Declaring sequence UPDATE
+ * for a governed role is a deliberately deferred feature — added when a real need names it.
  */
-export const SEQUENCE_PRIVILEGES_FOR_INSERT = ['SELECT', 'UPDATE', 'USAGE'] as const;
+export const SEQUENCE_PRIVILEGES_FOR_INSERT = ['USAGE'] as const;
 
 export function inheritedSequenceGrants(table: TableContract): Record<string, string[]> {
   const out: Record<string, string[]> = {};
@@ -332,10 +335,10 @@ function reconcileSequenceGrants(
     // NOTHING on the sequence inserts fine into an identity table and fails on a serial one.
     //
     // Applying the rule here was a real WIDENING, caught by the round-trip oracle the day
-    // identity columns became declarable: the rebuild handed an INSERTing role SELECT + UPDATE
-    // + USAGE — direct `setval` control of a surrogate key — that the original database never
-    // granted and never needed. Nothing is revoked either: a grant somebody made deliberately
-    // is not ours to remove, and no declaration says it should not be there.
+    // identity columns became declarable: the rebuild handed an INSERTing role USAGE on the
+    // identity sequence that the original database never granted and never needed. Nothing is
+    // revoked either: a grant somebody made deliberately is not ours to remove, and no
+    // declaration says it should not be there.
     if (seq.identity) continue;
     const target = quoteQualified(seq.sequence);
     const grantees = new Set([...Object.keys(declared), ...Object.keys(seq.grants)]);

package/src/cli/aws.ts

@@ -290,7 +290,23 @@ export async function resolveFunctionName(
  * credential-free introspection path. Every deployed-stage read verb
  * (db:plan, db:apply --stage's descent probe, …) shares it: catalog SQL runs
  * inside AWS on the operator connection, and the row set comes back over IAM.
- * `db:query` refuses writes, so this can only read.
+ *
+ * WHAT MAKES THIS READ-ONLY: not this file, and no longer a keyword blocklist in the
+ * action. `db:query` runs its single statement inside an explicit PostgreSQL `READ ONLY`
+ * transaction that always rolls back, so the ENGINE refuses a write — after parsing,
+ * where no leading comment, quoted identifier, writable CTE, `SELECT ... INTO`,
+ * `EXPLAIN ANALYZE <write>`, `COPY`, `MERGE`, `CALL` or `DO` block reaches. (A red team
+ * against a real PostgreSQL 16 defeated the blocklist that stood here before; see the
+ * comment on the `db:query` action in `@everystack/server`'s plugin.ts.)
+ *
+ * WHAT IT DOES NOT COVER: a read-only transaction stops DATA writes, not every effect.
+ * Still reachable by anyone who may invoke this action — `CLUSTER`, `REINDEX`,
+ * `LOCK TABLE ... ACCESS EXCLUSIVE`, `pg_sleep`, `NOTIFY`, and session advisory locks:
+ * availability and side-channel effects, not data change. An out-of-transaction escape
+ * exists via `dblink_exec` / `pg_background` IF those extensions are installed AND
+ * executable by the operator role. Closing those needs a real SELECT-only role wired in
+ * as the query connection (`readDatabaseUrl`) — a separate, already-filed follow-up, and
+ * an infrastructure decision rather than a code change here.
  */
 export function lambdaQueryRunner(
   region: string,