@everystack/cli 0.4.86 → 0.4.87

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.87] - 2026-09-21
+
+### BREAKING CHANGES
+
+- cache:purge --stage works without CDN_URL on the API Lambda; update --stage now refuses when no HOST_URL is found, export HOST_URL to override
+
+### Fixed
+
+- the FK-orphan advisory doubled its own '!' on top of warn()'s
+- db:provision detects PUBLIC's CREATE on schema public, revokes it under --confirm
+- the db:provision pointer swallowed every other grantee's revoke line
+
 ## [0.4.86] - 2026-09-16
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.86",
+  "version": "0.4.87",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -182,7 +182,7 @@
     "react": "19.2.0",
     "ts-jest": "29.4.9",
     "zod": "3.25.67",
-    "@everystack/server": "0.4.31"
+    "@everystack/server": "0.4.32"
   },
   "scripts": {
     "test": "jest",

package/src/cli/commands/audit.ts

@@ -8,7 +8,7 @@
  * the heavier `audit:lighthouse` stay separate commands (run them explicitly).
  */
 
-import { resolveConfig, opsFunction } from '../config';
+import { resolveConfig, opsFunction, probeUrl } from '../config';
 import { runBundleAudit, runBundleWeightAudit, reportBundleAudit } from './bundle';
 import { runUiAudit, reportUiAudit } from './ui-audit';
 import { checkRunbook } from './runbook';
@@ -28,7 +28,7 @@ export async function auditCommand(flags: Record<string, string>): Promise<void>
     fail(err.message);
     process.exit(1);
   }
-  const base = (flags.host || config.baseUrl || '').replace(/\/+$/, '');
+  const base = (flags.host || probeUrl(config)).replace(/\/+$/, '');
   if (!base) {
     fail('No router URL to audit. Pass --host or ensure the stage has a deployed URL.');
     process.exit(1);

package/src/cli/commands/bundle.ts

@@ -48,7 +48,7 @@ import {
   DEFAULT_UI_BLOAT_BUDGET,
   type UiBloatBudget,
 } from '../ui-bloat';
-import { resolveConfig } from '../config';
+import { resolveConfig, probeUrl } from '../config';
 import { fail, info, step, success, warn } from '../output';
 
 // Expo Router web export puts client chunks under client/_expo/...; a plain
@@ -430,7 +430,7 @@ export async function bundleAuditCommand(
   let target = positional || flags.url;
   if (!target) {
     try {
-      target = (await resolveConfig(flags.stage)).baseUrl;
+      target = probeUrl(await resolveConfig(flags.stage));
     } catch (err: any) {
       fail(err.message);
       info('Pass a URL positionally or use --stage <name>.');

package/src/cli/commands/cache.ts

@@ -9,7 +9,7 @@
  * Writes directly to CloudFront KVS — no Lambda invoke.
  */
 
-import { resolveConfig } from '../config';
+import { resolveConfig, probeUrl } from '../config';
 import { putKvsKey, createInvalidation, getDistributionStatus, getFromS3 } from '../aws';
 import { step, success, warn, fail, info } from '../output';
 
@@ -37,7 +37,7 @@ export async function cachePurgeCommand(flags: Record<string, string>): Promise<
   // Safety gate: verify the origin is serving the expected release and the distribution is stable.
   if (!force) {
     const channel = flags.channel || flags.stage || 'production';
-    const blocked = await preflight(config.region, config.baseUrl, config.updatesBucket, channel, config.distributionId);
+    const blocked = await preflight(config.region, probeUrl(config), config.updatesBucket, channel, config.distributionId);
     if (blocked) {
       fail(blocked);
       info('Pass --force to override this check.');
@@ -111,7 +111,7 @@ export async function cachePurgeCommand(flags: Record<string, string>): Promise<
  */
 export async function preflight(
   region: string,
-  baseUrl: string,
+  siteUrl: string,
   updatesBucket: string,
   channel: string,
   distributionId?: string,
@@ -134,19 +134,26 @@ export async function preflight(
   }
 
   // 2. Probe the origin for the serving release.
+  if (!siteUrl) {
+    return (
+      'No site URL for this stage, so the origin cannot be probed. ' +
+      'Set CDN_URL on the API function and redeploy, or tag the distribution sst:app/sst:stage; ' +
+      'then re-run with --refresh to discover the stage again. Or pass --force to skip this check.'
+    );
+  }
   try {
-    const probe = `${baseUrl}?_probe=${Date.now()}`;
+    const probe = `${siteUrl}?_probe=${Date.now()}`;
     const res = await fetch(probe, { redirect: 'follow' });
     const serving = res.headers.get('x-everystack-release');
     if (serving !== expectedUpdateId) {
       return (
         `Origin is serving release ${serving ? serving.slice(0, 12) + '...' : '(none)'} ` +
-        `but the channel pointer is ${expectedUpdateId.slice(0, 12)}.... ` +
+        `but the channel pointer is ${expectedUpdateId.slice(0, 12)}.... Probed ${siteUrl}. ` +
         `Purging now would expose stale containers to uncached traffic.`
       );
     }
   } catch (err: any) {
-    return `Could not reach origin at ${baseUrl}: ${err.message}`;
+    return `Could not reach origin at ${siteUrl}: ${err.message}`;
   }
 
   // 3. Check distribution status (if discoverable).

package/src/cli/commands/db-snapshot.ts

@@ -26,6 +26,8 @@ function resolveInstanceId(config: CliConfig, flags: Record<string, string>): st
       '  - If your DB is RDS: add `databaseInstanceId: database.id` to the outputs return block in\n' +
       '    sst.config.ts and redeploy (run db:snapshot from the app directory so .sst/outputs.json is\n' +
       '    readable), or pass --instance <id>.\n' +
+      '  - .sst/outputs.json is used only when it is THIS stage\'s deploy (its apiFunctionName names the\n' +
+      '    stage). If the last `sst deploy` was another stage, redeploy this one, or pass --instance <id>.\n' +
       '  - If your DB is not RDS (Aurora, a container, self-hosted): use `everystack db:backup` for a portable logical backup.',
     );
     process.exit(1);

package/src/cli/commands/db.ts

@@ -1117,7 +1117,10 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     // The reader's read grants ride this same step, for the same reason ADOPT does: they can stall
     // on a lock, and nothing that can stall may sit between the password swap and the secret write.
     const readerRole = result.readerRole as string | undefined;
-    if (!declaredOwners.length && !declaredObjects.length && !readerRole) return;
+    // NO early return on "nothing declared". Convergence also carries the schema "public" posture
+    // check — a property of the DATABASE, not of the Models — and the brownfield app that declares
+    // no owners is exactly the one most likely to carry the pre-PG15 PUBLIC CREATE grant. Gating
+    // this on the declarations made the check unreachable for it.
     const ownerPayload = { ...ownershipPayload, adminRole: result.adminRole, ...(readerRole ? { readerRole, searchPath } : {}) };
     let owned: any = {};
     try {
@@ -1177,6 +1180,24 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
       // then fail on every table. Same non-zero exit as an un-converged owner.
       for (const r of reader.refusals) { warn(`Read-only grants: ${r}`); ownershipIncomplete = true; }
     }
+    // The schema "public" posture. Reported only when there IS a gap: a PG15+ database (or one
+    // already hardened) is the expected state and says nothing, exactly like a converged owner.
+    // Absent entirely on a server that predates this check — also silent, never narrated as clean.
+    const posture = owned.publicSchemaPosture;
+    if (posture?.publicCanCreate) {
+      if (posture.revoked) {
+        // The SQL is spelled out rather than imported from @everystack/server: that package is a
+        // lazily-loaded peer here (the ops-Lambda venue never loads it), so a static import for a
+        // display string would be a new hard dependency for a sentence.
+        success('Schema posture: REVOKE CREATE ON SCHEMA public FROM PUBLIC — the pre-PG15 default, which PG15 removed, is gone. Verified by re-reading the catalog.');
+      } else {
+        // NOT counted as ownershipIncomplete, deliberately. This is an advisory hardening on a live
+        // database, and `--confirm` is a shared gate (an operator passes it for ADOPT). Failing a
+        // provisioning run whose credentials succeeded, over a posture the operator has not been
+        // asked about yet, would break every existing pre-PG15 deploy pipeline on upgrade.
+        for (const r of posture.refusals) warn(`Schema posture: ${r}`);
+      }
+    }
   };
 
   // Additive-only: if the login roles already existed as live logins, provision changed no

package/src/cli/commands/diag.ts

@@ -13,7 +13,7 @@
  *   everystack diag [url] --hydration  # Analyze SSR hydration issues
  */
 
-import { resolveConfig } from '../config';
+import { resolveConfig, probeUrl } from '../config';
 import { getFromS3 } from '../aws';
 import { step, success, fail, info, warn } from '../output';
 import { analyzeHtml, generateHydrationReport } from '../hydration-analyzer';
@@ -53,11 +53,11 @@ export async function diagCommand(
   // Build the URL: positional arg > baseUrl + --path
   let url = positionalUrl;
   if (!url) {
-    if (!config.baseUrl) {
-      fail('No URL provided and no baseUrl in config. Pass a URL or use --stage.');
+    url = probeUrl(config);
+    if (!url) {
+      fail('No URL provided and no site URL for this stage. Pass a URL, set CDN_URL on the API function, or use --stage on a deployed stage.');
       process.exit(1);
     }
-    url = config.baseUrl;
   }
   // Strip trailing slash from base URL before appending path
   url = url.replace(/\/+$/, '');

package/src/cli/commands/lighthouse.ts

@@ -21,7 +21,7 @@ import {
   type ExtractedRun,
   type LhReport,
 } from '../lighthouse';
-import { resolveConfig } from '../config';
+import { resolveConfig, probeUrl } from '../config';
 import { step, info, fail, warn } from '../output';
 
 function runLighthouse(url: string, outPath: string): LhReport {
@@ -69,7 +69,7 @@ export async function auditLighthouseCommand(flags: Record<string, string>): Pro
   if (!host) {
     try {
       const config = await resolveConfig(flags.stage);
-      host = config.baseUrl;
+      host = probeUrl(config);
     } catch (err: any) {
       fail(err.message);
       info('Pass --host <url> to audit a specific URL without resolving a stage.');

package/src/cli/commands/security-probe.ts

@@ -26,7 +26,7 @@ import {
   type CatalogGrant,
   type ProbeResult,
 } from '../security-probe';
-import { resolveConfig, opsFunction } from '../config';
+import { resolveConfig, opsFunction, probeUrl } from '../config';
 import { invokeAction } from '../aws';
 import { step, info, fail, success, warn } from '../output';
 
@@ -188,7 +188,7 @@ export async function securityProbeCommand(flags: Record<string, string>): Promi
     fail(err.message);
     process.exit(1);
   }
-  const base = (flags.host || config.baseUrl || '').replace(/\/+$/, '');
+  const base = (flags.host || probeUrl(config)).replace(/\/+$/, '');
   if (!base) {
     fail('No router URL to probe. Pass --host or ensure the stage has a deployed URL.');
     process.exit(1);

package/src/cli/commands/update.ts

@@ -5,7 +5,8 @@ import zlib from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import { spawn } from 'node:child_process';
-import { resolveConfig, type CliConfig } from '../config';
+import { resolveConfig, probeUrl, type CliConfig } from '../config';
+import { missingHostUrlError } from '../host-url';
 import { uploadToS3, headS3, invokeAction, rollingRestart } from '../aws';
 import { step, success, warn, fail, info } from '../output';
 import { opsAdviceLines, IAM_ADVICE } from '../ops-advice';
@@ -128,6 +129,13 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
       warn(`Could not load SST secrets: ${err.message}`);
       info('Secrets may be unavailable during export. Provide env vars from the caller if needed.');
     }
+
+    // After the secrets step: a secret may supply HOST_URL.
+    const noHostUrl = await missingHostUrlError(flags.stage, { siteUrl: resolvedConfig?.siteUrl });
+    if (noHostUrl) {
+      fail(noHostUrl);
+      process.exit(1);
+    }
   }
 
   const branch = flags.branch;
@@ -639,13 +647,17 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
 
       // 7. Verify the origin is serving the new release.
       step('Verifying origin serves new release...');
-      const verified = await verifyOriginRelease(config.baseUrl, updateId);
+      const siteUrl = probeUrl(config);
+      const verified = await verifyOriginRelease(siteUrl, updateId);
       if (verified) {
         success(`Origin confirmed: ${updateId.slice(0, 12)}...`);
+      } else if (!siteUrl) {
+        warn('No site URL for this stage, so the origin was not checked.');
+        info('Set CDN_URL on the API function, or check the site by hand for the x-everystack-release header.');
       } else {
         warn('Origin did not confirm the new release within the timeout.');
         info('The release may still be propagating. Check manually:');
-        info(`  curl -sI ${config.baseUrl} | grep x-everystack-release`);
+        info(`  curl -sI ${siteUrl} | grep x-everystack-release`);
       }
 
       // Clean up archive
@@ -822,6 +834,8 @@ export async function verifyOriginRelease(
   baseUrl: string,
   expectedUpdateId: string,
 ): Promise<boolean> {
+  // No site URL: every probe would throw and be swallowed, burning the whole timeout.
+  if (!baseUrl) return false;
   const deadline = Date.now() + VERIFY_TIMEOUT_MS;
   let consecutive = 0;
 

package/src/cli/config.ts

@@ -12,7 +12,10 @@ import path from 'node:path';
 import { step } from './output';
 
 export interface CliConfig {
+  /** CDN_URL / routerUrl as deployed. update pins it into OTA bundles: never derived. */
   baseUrl: string;
+  /** What cache:purge and update's release check probe. Falls back to baseUrl when absent. */
+  siteUrl?: string;
   region: string;
   apiFunctionName: string;
   /** Dedicated operator function (db/console actions). Falls back to apiFunctionName. */
@@ -30,6 +33,14 @@ export interface CliConfig {
   backupsBucket?: string;
 }
 
+/**
+ * The URL commands PROBE (release checks, audits, lighthouse): siteUrl, else baseUrl, else ''.
+ * Never use it to write a URL into anything shipped; that is baseUrl's job (HOST_URL).
+ */
+export function probeUrl(config: Pick<CliConfig, 'baseUrl' | 'siteUrl'>): string {
+  return config.siteUrl || config.baseUrl || '';
+}
+
 /** Operator invoke target — dedicated ops function when deployed, else the API function. */
 export function opsFunction(config: CliConfig): string {
   return config.opsFunctionName ?? config.apiFunctionName;
@@ -81,6 +92,22 @@ async function readLocalOutputs(): Promise<Partial<SstOutputs> | null> {
   }
 }
 
+/**
+ * The local outputs.json, only if its deploy WAS this stage. It is the last deploy on ANY stage,
+ * and databaseInstanceId picks db:apply/db:swap's confirmed rollback snapshot, so another
+ * stage's file must never reach a stage's config. Unknown means no.
+ */
+async function readOutputsFor(stage: string): Promise<Partial<SstOutputs> | null> {
+  const outputs = await readLocalOutputs();
+  if (!outputs) return null;
+  try {
+    const { parseAppName, outputsDescribeStage } = await import('./discover');
+    return outputsDescribeStage(outputs, await parseAppName(), stage) ? outputs : null;
+  } catch {
+    return null;
+  }
+}
+
 export async function resolveConfig(stage?: string): Promise<CliConfig> {
   const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
 
@@ -95,7 +122,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
 
     // Check cache first
     const cached = await getCachedConfig(stage);
-    if (cached) return enrichConfigFromOutputs(cached, await readLocalOutputs());
+    if (cached) return enrichConfigFromOutputs(cached, await readOutputsFor(stage));
 
     step(`Discovering resources for stage "${stage}"...`);
     const appName = await parseAppName();
@@ -103,7 +130,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
 
     // Cache for future fast lookups
     await setCachedConfig(stage, config);
-    return enrichConfigFromOutputs(config, await readLocalOutputs());
+    return enrichConfigFromOutputs(config, await readOutputsFor(stage));
   }
 
   // Default: read .sst/outputs.json (unchanged behavior)
@@ -140,6 +167,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
 
   return {
     baseUrl: outputs.routerUrl,
+    siteUrl: outputs.routerUrl,
     region,
     apiFunctionName: outputs.apiFunctionName,
     opsFunctionName: outputs.opsFunctionName,

package/src/cli/discover-distribution.ts

@@ -7,8 +7,8 @@
  * SST Routers do not put the app/stage in the distribution Comment, so
  * matching runs in order of reliability:
  *   1. DomainName / Aliases match the discovered router URL host
- *   2. Comment contains the {app}-{stage}- prefix (legacy setups)
- *   3. sst:app + sst:stage tags (authoritative, but one API call per candidate)
+ *   2. sst:app + sst:stage tags (authoritative, but one API call per candidate)
+ *   3. Comment contains the {app}-{stage}- prefix (legacy setups; a substring, so a last resort)
  */
 
 export interface DistributionHints {
@@ -26,35 +26,69 @@ interface DistributionSummaryLite {
   Aliases?: { Items?: string[] };
 }
 
-/** Pure matcher for the cheap passes (domain, alias, legacy comment). Exported for tests. */
-export function matchDistribution(
-  items: readonly DistributionSummaryLite[],
-  prefix: string,
-  routerHost?: string,
-): string | undefined {
+/**
+ * A distribution and how it was found. `host` and `tag` are confirmed matches; `comment` is a
+ * substring guess (prefix `app-dev-` also matches the Comment of `my-app`'s dev stage), good
+ * enough for --invalidate but not to name the site a purge probes.
+ */
+export interface DistributionMatch {
+  id: string;
+  /** cloudfront.net domain, no scheme — the host this distribution always answers on. */
+  domain?: string;
+  by: 'host' | 'comment' | 'tag';
+}
+
+function toMatch(dist: DistributionSummaryLite, by: DistributionMatch['by']): DistributionMatch | undefined {
+  return dist.Id ? { id: dist.Id, domain: dist.DomainName, by } : undefined;
+}
+
+function matchByHost(items: readonly DistributionSummaryLite[], routerHost?: string): DistributionMatch | undefined {
   const host = routerHost?.toLowerCase();
-  if (host) {
-    for (const dist of items) {
-      if (dist.DomainName?.toLowerCase() === host) return dist.Id;
-      if (dist.Aliases?.Items?.some((alias) => alias.toLowerCase() === host)) return dist.Id;
-    }
+  if (!host) return undefined;
+  for (const dist of items) {
+    const hit =
+      dist.DomainName?.toLowerCase() === host ||
+      dist.Aliases?.Items?.some((alias) => alias.toLowerCase() === host);
+    if (hit) return toMatch(dist, 'host');
   }
+  return undefined;
+}
+
+function matchByComment(items: readonly DistributionSummaryLite[], prefix: string): DistributionMatch | undefined {
   const needle = prefix.toLowerCase();
   for (const dist of items) {
-    if ((dist.Comment || '').toLowerCase().includes(needle)) return dist.Id;
+    if ((dist.Comment || '').toLowerCase().includes(needle)) return toMatch(dist, 'comment');
   }
   return undefined;
 }
 
+/** Pure matcher for the non-tag passes (domain, alias, legacy comment). Exported for tests. */
+export function matchDistributionBy(
+  items: readonly DistributionSummaryLite[],
+  prefix: string,
+  routerHost?: string,
+): DistributionMatch | undefined {
+  return matchByHost(items, routerHost) ?? matchByComment(items, prefix);
+}
+
+/** The distribution id only. Exported for tests. */
+export function matchDistribution(
+  items: readonly DistributionSummaryLite[],
+  prefix: string,
+  routerHost?: string,
+): string | undefined {
+  return matchDistributionBy(items, prefix, routerHost)?.id;
+}
+
 /**
- * Find the CloudFront distribution for a stage.
+ * Find the CloudFront distribution for a stage, and how it was matched.
  * Best-effort: returns undefined if not found.
  */
-export async function discoverDistribution(
+export async function discoverDistributionMatch(
   region: string,
   prefix: string,
   hints: DistributionHints = {},
-): Promise<string | undefined> {
+): Promise<DistributionMatch | undefined> {
   const { CloudFrontClient, ListDistributionsCommand, ListTagsForResourceCommand } =
     await import('@aws-sdk/client-cloudfront');
   const client = new CloudFrontClient({ region });
@@ -69,10 +103,11 @@ export async function discoverDistribution(
     marker = res.DistributionList?.IsTruncated ? res.DistributionList.NextMarker : undefined;
   } while (marker);
 
-  const cheap = matchDistribution(items, prefix, hints.routerHost);
-  if (cheap) return cheap;
+  const byHost = matchByHost(items, hints.routerHost);
+  if (byHost) return byHost;
 
-  // Tag pass — authoritative but one call per distribution, so it runs last.
+  // Tag pass — authoritative, so it runs before the Comment guess (a Comment substring can name
+  // another app's stage). One call per distribution; SST tags every distribution it makes.
   if (hints.appName && hints.stage) {
     for (const dist of items) {
       if (!dist.ARN) continue;
@@ -82,7 +117,7 @@ export async function discoverDistribution(
           (res.Tags?.Items || []).map((t) => [t.Key, t.Value]),
         );
         if (tags.get('sst:app') === hints.appName && tags.get('sst:stage') === hints.stage) {
-          return dist.Id;
+          return toMatch(dist, 'tag');
         }
       } catch {
         // Tag read denied or transient — keep scanning
@@ -90,5 +125,6 @@ export async function discoverDistribution(
     }
   }
 
-  return undefined;
+  // Legacy setups whose distribution carries the {app}-{stage}- prefix in its Comment.
+  return matchByComment(items, prefix);
 }

package/src/cli/discover.ts

@@ -17,7 +17,16 @@ import { importOptionalAws } from './aws';
 
 /** Mirrors CliConfig from config.ts — defined locally to avoid circular imports. */
 interface DiscoveredConfig {
+  /**
+   * CDN_URL from the API Lambda, or ''. update pins this into shipped OTA bundles (HOST_URL),
+   * so it is NEVER derived from anything else.
+   */
   baseUrl: string;
+  /**
+   * The URL cache:purge and update's release check probe: baseUrl, else the domain of the stage's
+   * tag-confirmed CloudFront distribution, else ''. Probe-only; never shipped.
+   */
+  siteUrl: string;
   region: string;
   apiFunctionName: string;
   opsFunctionName?: string;
@@ -62,6 +71,22 @@ export async function parseAppName(configPath?: string): Promise<string> {
   return match[1];
 }
 
+/**
+ * Does a deploy-written .sst/outputs.json describe this stage? The file is the last deploy on ANY
+ * stage and has no stage field, but its apiFunctionName is `<app>-<stage>-ApiFunction-<hash>`
+ * (the convention discovery matches on). `.sst/stage` is NOT evidence: it is SST's personal-stage
+ * marker and can name a different stage than the last deploy. Unknown means no.
+ */
+export function outputsDescribeStage(
+  outputs: { apiFunctionName?: string } | null | undefined,
+  appName: string,
+  stage: string,
+): boolean {
+  const fn = outputs?.apiFunctionName;
+  if (!fn) return false;
+  return fn.toLowerCase().startsWith(`${appName}-${stage}-ApiFunction-`.toLowerCase());
+}
+
 // ---------------------------------------------------------------------------
 // CloudFront function discovery (→ KVS ARN)
 // ---------------------------------------------------------------------------
@@ -284,20 +309,30 @@ export async function discoverConfig(
 
   // Distribution discovery is best-effort (status CDN section, cache:purge --invalidate)
   let distributionId: string | undefined;
+  let distributionDomain: string | undefined;
   try {
-    const { discoverDistribution } = await import('./discover-distribution');
+    const { discoverDistributionMatch } = await import('./discover-distribution');
     const routerHost = lambdaResult.routerUrl
       ? new URL(lambdaResult.routerUrl).host
       : undefined;
-    distributionId = await discoverDistribution(region, prefix, {
+    const match = await discoverDistributionMatch(region, prefix, {
       routerHost,
       appName,
       stage,
     });
+    distributionId = match?.id;
+    // A Comment-substring match can name another app's stage; only a confirmed one may say
+    // which site a purge probes.
+    if (match && match.by !== 'comment') distributionDomain = match.domain;
   } catch {
     // Non-fatal
   }
 
+  // CDN_URL is optional on the API Lambda. Without it the stage's own distribution supplies the
+  // probe URL — and only that: baseUrl stays as deployed (see DiscoveredConfig).
+  const baseUrl = lambdaResult.routerUrl || '';
+  const siteUrl = baseUrl || (distributionDomain ? `https://${distributionDomain}` : '');
+
   if (!bucketsResult.updatesBucket) {
     throw new Error(
       `Could not find S3 bucket "${prefix}updatesbucket-*". ` +
@@ -320,15 +355,19 @@ export async function discoverConfig(
     try {
       const raw = await fs.readFile(path.resolve('.sst', 'outputs.json'), 'utf8');
       const outputs = JSON.parse(raw);
-      if (!mediaBucket && outputs.mediaBucket) mediaBucket = outputs.mediaBucket;
-      if (!backupsBucket && outputs.backupsBucket) backupsBucket = outputs.backupsBucket;
+      // outputs.json is the last deploy on ANY stage: adopt its buckets only if it was this one.
+      if (outputsDescribeStage(outputs, appName, stage)) {
+        if (!mediaBucket && outputs.mediaBucket) mediaBucket = outputs.mediaBucket;
+        if (!backupsBucket && outputs.backupsBucket) backupsBucket = outputs.backupsBucket;
+      }
     } catch {
       // outputs.json not available — non-fatal
     }
   }
 
   return {
-    baseUrl: lambdaResult.routerUrl || '',
+    baseUrl,
+    siteUrl,
     region,
     apiFunctionName: lambdaResult.functionName,
     opsFunctionName: opsFn,
@@ -348,12 +387,13 @@ export async function discoverConfig(
 // ---------------------------------------------------------------------------
 
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
-const CACHE_VERSION = 5; // Bump when CachedOutputs schema changes to invalidate stale caches (5: +backupsBucket)
+const CACHE_VERSION = 6; // Bump when CachedOutputs schema changes to invalidate stale caches (5: +backupsBucket, 6: +siteUrl; getCachedConfig drops v5 files, an empty siteUrl is cached as a fact)
 
 interface CachedOutputs {
   _cachedAt: number;
   _version?: number;
   routerUrl?: string;
+  siteUrl?: string;
   apiFunctionName?: string;
   opsFunctionName?: string;
   imageFunctionName?: string;
@@ -381,6 +421,7 @@ export async function getCachedConfig(stage: string): Promise<DiscoveredConfig |
     }
     return {
       baseUrl: cached.routerUrl || '',
+      siteUrl: cached.siteUrl ?? cached.routerUrl ?? '',
       region: process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1',
       apiFunctionName: cached.apiFunctionName,
       opsFunctionName: cached.opsFunctionName,
@@ -458,6 +499,7 @@ export async function setCachedConfig(stage: string, config: DiscoveredConfig):
     _cachedAt: Date.now(),
     _version: CACHE_VERSION,
     routerUrl: config.baseUrl,
+    siteUrl: config.siteUrl,
     apiFunctionName: config.apiFunctionName,
     opsFunctionName: config.opsFunctionName,
     imageFunctionName: config.imageFunctionName,

package/src/cli/fk-orphan-advisory.ts

@@ -116,11 +116,13 @@ export interface FkOrphanAdvisoryOptions {
 /**
  * The advisory, as lines. Empty when nothing is unproven.
  *
- * Every HEADLINE it returns is a problem line — it starts with `!`, the same mark and the same
- * severity tier the ownership report's findings use — so the caller prints whatever comes back
- * without having to classify it: at the default verbosity that is headlines only, and `verbose`
- * adds the indented detail under each one. The headline states the CONSEQUENCE — enforced
- * forward, N rows unchecked — because a bare count reads as an error nobody can size.
+ * Every HEADLINE it returns is a problem line, the same severity tier the ownership report's
+ * findings use — so the caller `warn()`s whatever comes back without having to classify it: at
+ * the default verbosity that is headlines only, and `verbose` adds the indented detail under
+ * each one. `warn()` (output.ts) already prepends the `!` mark, so these strings carry none of
+ * their own — a caller that printed one with `line()`/`info()` instead of `warn()` would be the
+ * bug, not this module doubling the mark on top of it. The headline states the CONSEQUENCE —
+ * enforced forward, N rows unchecked — because a bare count reads as an error nobody can size.
  *
  * Findings whose column also decides row access get their OWN headline. Same severity, same
  * non-blocking behaviour: what changes is that the reader is told this is not only a data
@@ -144,7 +146,7 @@ export function renderFkOrphanAdvisory(
   if (plain.length > 0) {
     const rows = plain.reduce((sum, f) => sum + f.orphans, 0);
     lines.push(
-      `! ${plain.length} foreign ${plural(plain.length, 'key stays', 'keys stay')} NOT VALID: new writes enforced, `
+      `${plain.length} foreign ${plural(plain.length, 'key stays', 'keys stay')} NOT VALID: new writes enforced, `
       + `${count(rows)} existing ${plural(rows, 'row', 'rows')} unchecked `
       + `(--verbose for detail; ${declareIt}).`,
     );
@@ -157,7 +159,7 @@ export function renderFkOrphanAdvisory(
       .map((f) => `${f.table}.${gatingColumns(f, ownership).join('/')}`)
       .join(', ');
     lines.push(
-      `! ROW SECURITY — ${gating.length} unproven foreign ${plural(gating.length, 'key also decides', 'keys also decide')} `
+      `ROW SECURITY — ${gating.length} unproven foreign ${plural(gating.length, 'key also decides', 'keys also decide')} `
       + `who may read or write the row (${where}): `
       + `${count(rows)} existing ${plural(rows, 'row', 'rows')} point at a parent that is gone, so the owner check `
       + `on ${plural(gating.length, 'it', 'them')} matches nobody `

package/src/cli/host-url.ts

@@ -0,0 +1,127 @@
+/**
+ * Auto-detect HOST_URL from SST outputs.
+ * SST writes .sst/outputs.json after every deploy with { routerUrl, apiUrl, ... }.
+ * If HOST_URL isn't already set, use the routerUrl from the last deploy.
+ *
+ * When a stage is specified, checks the stage-specific cached config first.
+ * .sst/outputs.json reflects the last deploy (any stage), so with --stage it is used only when
+ * its apiFunctionName says that deploy WAS this stage (outputsDescribeStage). Otherwise HOST_URL
+ * stays unset: a wrong-stage URL would be baked into the OTA bundle by `update`.
+ */
+
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+export async function loadSstOutputs(stage?: string): Promise<void> {
+  if (process.env.HOST_URL) return;
+
+  // When --stage is provided, try stage-specific cache first
+  if (stage) {
+    const stagePath = path.resolve('.sst', `outputs.${stage}.json`);
+    try {
+      const raw = await fs.readFile(stagePath, 'utf8');
+      const cached = JSON.parse(raw);
+      if (cached.routerUrl) {
+        process.env.HOST_URL = cached.routerUrl;
+        return;
+      }
+    } catch {
+      // No cached config for this stage — fall through to default
+    }
+  }
+
+  const outputsPath = path.resolve('.sst', 'outputs.json');
+  try {
+    const raw = await fs.readFile(outputsPath, 'utf8');
+    const outputs = JSON.parse(raw);
+    if (stage && !(await outputsBelongToStage(outputs, stage))) return;
+    if (outputs.routerUrl) {
+      process.env.HOST_URL = outputs.routerUrl;
+    }
+  } catch {
+    // No .sst/outputs.json — user must set HOST_URL manually or use app.config.js defaults
+  }
+}
+
+/** Provenance gate for the --stage fall-through; an unreadable app name means unknown, so no. */
+async function outputsBelongToStage(outputs: { apiFunctionName?: string }, stage: string): Promise<boolean> {
+  try {
+    const { parseAppName, outputsDescribeStage } = await import('./discover');
+    return outputsDescribeStage(outputs, await parseAppName(), stage);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The @expo/env `expo export` will load, found the way it finds it: expo -> @expo/cli -> @expo/env
+ * from the project (a package manager that does not hoist still resolves it), else a direct
+ * @expo/env. Undefined when the project has no Expo.
+ */
+function resolveExpoEnv(from: string): string | undefined {
+  const at = (dir: string, id: string) => createRequire(path.join(dir, 'noop.js')).resolve(id);
+  try {
+    const cli = at(path.dirname(at(from, 'expo/package.json')), '@expo/cli/package.json');
+    return at(path.dirname(cli), '@expo/env');
+  } catch {
+    // fall through
+  }
+  try {
+    return at(from, '@expo/env');
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Does the dotenv loading `expo export` will run set a non-empty HOST_URL? It runs Expo's own
+ * loader (@expo/env parseProjectEnv), not a copy of it: file set, precedence,
+ * EXPO_NO_DOTENV and variable expansion are Expo's (the mode is fixed to production, as in export), so this sees what the bundle will bake.
+ * Non-mutating. Only a boolean escapes; no value is kept or printed. Fails closed: no Expo, or
+ * a loader that throws, means no.
+ */
+async function dotenvSetsHostUrl(
+  cwd: string,
+  env: Record<string, string | undefined>,
+  resolveFrom: string,
+): Promise<boolean> {
+  const resolved = resolveExpoEnv(resolveFrom);
+  if (!resolved) return false;
+  try {
+    const expoEnv = createRequire(resolved)(resolved) as {
+      parseProjectEnv(
+        root: string,
+        options: { mode?: string; silent?: boolean; systemEnv?: Record<string, string | undefined> },
+      ): { env: Record<string, string | undefined> };
+    };
+    // Upstream behaviour, re-verify on every Expo upgrade: @expo/cli build/src/export/exportApp.js
+    // exportAppAsync sets `process.env.NODE_ENV = dev ? 'development' : 'production'`
+    // unconditionally, and everystack never passes --dev. So the mode is production, not env.NODE_ENV.
+    const parsed = expoEnv.parseProjectEnv(cwd, { mode: 'production', silent: true, systemEnv: env });
+    return Boolean(parsed.env.HOST_URL);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Why `update --stage` must stop: nothing supplied a HOST_URL, so the OTA bundle would bake the
+ * app's default (often localhost) as updates.url. Devices could then never fetch the recovery
+ * publish. Undefined when HOST_URL is set (env or dotenv) or no stage was given. The message
+ * names the ways out, including the stage's own site URL when discovery found one.
+ */
+export async function missingHostUrlError(
+  stage: string | undefined,
+  opts: { env?: Record<string, string | undefined>; cwd?: string; siteUrl?: string; resolveFrom?: string } = {},
+): Promise<string | undefined> {
+  const { env = process.env, cwd = process.cwd(), siteUrl, resolveFrom = cwd } = opts;
+  if (!stage || env.HOST_URL || (await dotenvSetsHostUrl(cwd, env, resolveFrom))) return undefined;
+  const offer = siteUrl ? ` This stage's site URL is ${siteUrl}; export it as HOST_URL if that is its public URL.` : '';
+  return (
+    `No HOST_URL for stage "${stage}", so the bundle would ship the app's default URL as updates.url.${offer} ` +
+    'Otherwise export HOST_URL=<the stage\'s public URL>, or set CDN_URL on the API function and re-run with --refresh. ' +
+    '(A HOST_URL in a dotenv file counts only when the project\'s Expo can be found to read it the way `expo export` does.) ' +
+    `(.sst/outputs.json is used only when its apiFunctionName is "<app>-${stage}-ApiFunction-...".)`
+  );
+}

package/src/cli/index.ts

@@ -1,7 +1,6 @@
 #!/usr/bin/env tsx
 
-import fs from 'node:fs/promises';
-import path from 'node:path';
+import { loadSstOutputs } from './host-url';
 import { updateCommand } from './commands/update';
 import { deployCommand } from './commands/deploy';
 import { certsCommand } from './commands/certs';
@@ -51,45 +50,6 @@ import { parseFlags } from './parse-flags';
 const args = process.argv.slice(2);
 const command = args[0];
 
-/**
- * Auto-detect HOST_URL from SST outputs.
- * SST writes .sst/outputs.json after every deploy with { routerUrl, apiUrl, ... }.
- * If HOST_URL isn't already set, use the routerUrl from the last deploy.
- *
- * When a stage is specified, checks the stage-specific cached config first.
- * .sst/outputs.json reflects the last deploy (any stage) and may be wrong
- * when publishing to a different stage.
- */
-async function loadSstOutputs(stage?: string): Promise<void> {
-  if (process.env.HOST_URL) return;
-
-  // When --stage is provided, try stage-specific cache first
-  if (stage) {
-    const stagePath = path.resolve('.sst', `outputs.${stage}.json`);
-    try {
-      const raw = await fs.readFile(stagePath, 'utf8');
-      const cached = JSON.parse(raw);
-      if (cached.routerUrl) {
-        process.env.HOST_URL = cached.routerUrl;
-        return;
-      }
-    } catch {
-      // No cached config for this stage — fall through to default
-    }
-  }
-
-  const outputsPath = path.resolve('.sst', 'outputs.json');
-  try {
-    const raw = await fs.readFile(outputsPath, 'utf8');
-    const outputs = JSON.parse(raw);
-    if (outputs.routerUrl) {
-      process.env.HOST_URL = outputs.routerUrl;
-    }
-  } catch {
-    // No .sst/outputs.json — user must set HOST_URL manually or use app.config.js defaults
-  }
-}
-
 async function main() {
   if (!command || command === '--help' || command === '-h') {
     printHelp();

package/src/cli/security-audit.ts

@@ -248,18 +248,30 @@ export function classifySchema(schema: SchemaDescriptor, waivers: Waivers = {}):
 
   if (broad.length > 0) {
     const who = broad.join(', ');
+    // The fix is PER GRANTEE, and the grantees are PARTITIONED — never collapsed into one line.
+    //
+    // `db:provision --confirm` revokes exactly ONE thing: PUBLIC's CREATE on schema `public`
+    // (reviewably — it reports the gap without the flag). Every other (grantee, schema) pair is hand
+    // SQL. So the pointer stands in for PUBLIC's own revoke and for nothing else: a schema where BOTH
+    // PUBLIC and `authenticated` hold CREATE must still name the second revoke, or an operator runs
+    // the one command offered, re-audits, and is still writable with nothing saying why.
+    const isPublicPseudoRole = (g: string) => key === 'public' && g.toLowerCase() === 'public';
+    const fixes = broad.map((g) => (isPublicPseudoRole(g)
+      ? 'REVOKE CREATE ON SCHEMA public FROM PUBLIC — run `everystack db:provision --stage <stage> --confirm`, which does exactly this revoke and verifies it'
+      : `REVOKE CREATE ON SCHEMA ${key} FROM ${g}`));
+    const fix = `${fixes.join('. ')}.`;
     if (schema.unpinnedDefinerFunctions > 0) {
       reasons.push(
         `${who} can CREATE in schema "${key}", which holds ${schema.unpinnedDefinerFunctions} unpinned SECURITY DEFINER function(s) — `
         + `that is a complete search_path hijack chain: plant a shadow object, the unpinned function resolves through it and runs it with the owner's rights. `
-        + `REVOKE CREATE ON SCHEMA ${key} FROM ${who}, and pin those functions.`,
+        + `${fix.replace(/\.$/, '')}, and pin those functions.`,
       );
       severity = 'red';
     } else {
       reasons.push(
         `${who} can CREATE in schema "${key}" — the pre-PG15 default, which PG15 removed. No unpinned SECURITY DEFINER function is here, `
         + `but a writable schema on a search path threatens every privileged session that resolves through it, including the build credential `
-        + `running DDL. REVOKE CREATE ON SCHEMA ${key} FROM ${who}.`,
+        + `running DDL. ${fix}`,
       );
       severity = raise(severity, 'warn');
     }

package/src/cli/swap-snapshot.ts

@@ -113,7 +113,8 @@ export function decideSnapshotMode(input: SnapshotDecisionInput): SnapshotDecisi
         mode: 'refuse',
         reason: 'A physical snapshot needs the RDS instance id, and this stage does not expose one. '
           + 'Add `databaseInstanceId: database.id` to the outputs return block in sst.config.ts and redeploy '
-          + '(run db:swap from the app directory so .sst/outputs.json is readable), or pass --snapshot logical '
+          + '(run db:swap from the app directory so .sst/outputs.json is readable; it counts only when the last '
+          + '`sst deploy` was THIS stage, otherwise redeploy this stage), or pass --snapshot logical '
           + 'for a pg_dump rollback point instead.',
       };
     }