@everystack/cli 0.4.9 → 0.4.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/authz-contract.ts

@@ -22,6 +22,7 @@
  */
 
 import { parsePgArray } from './security-catalog.js';
+import { withCanonicalSearchPath } from './search-path.js';
 
 // ---------------------------------------------------------------------------
 // The contract format — the frozen, reviewable, version-controlled shape.
@@ -437,19 +438,23 @@ export async function introspectContract(
   mapFunctionRow: (row: any) => { schema: string; name: string; securityDefiner: boolean; hasSearchPath: boolean },
   functionsSql: string,
 ): Promise<AuthzContract> {
-  const [rls, policies, grants, columnGrants, fnRows] = await Promise.all([
-    run(RLS_SQL),
-    run(POLICIES_SQL),
-    run(GRANTS_SQL),
-    run(COLUMN_GRANTS_SQL),
-    run(functionsSql),
-  ]);
-  return assembleContract({
-    rls: rls as RlsRow[],
-    policies: policies as PolicyRow[],
-    grants: grants as GrantRow[],
-    columnGrants: columnGrants as ColumnGrantRow[],
-    functions: (fnRows as any[]).map(mapFunctionRow),
+  // Policy USING/WITH CHECK expressions deparse relative to the search_path — pin the
+  // canonical baseline so an ambient non-default path never reads as false authz drift.
+  return withCanonicalSearchPath(run, async () => {
+    const [rls, policies, grants, columnGrants, fnRows] = await Promise.all([
+      run(RLS_SQL),
+      run(POLICIES_SQL),
+      run(GRANTS_SQL),
+      run(COLUMN_GRANTS_SQL),
+      run(functionsSql),
+    ]);
+    return assembleContract({
+      rls: rls as RlsRow[],
+      policies: policies as PolicyRow[],
+      grants: grants as GrantRow[],
+      columnGrants: columnGrants as ColumnGrantRow[],
+      functions: (fnRows as any[]).map(mapFunctionRow),
+    });
   });
 }
 

package/src/cli/commands/db-reconcile.ts

@@ -179,15 +179,10 @@ export async function executeReconcile(
       }
     }
 
-    // Reset the search_path before introspecting. pg_get_viewdef renders a ref BARE while its
-    // schema is in scope and QUALIFIED once it is off — so the defHash we record must be read
-    // under the SAME (default) path every future introspection uses, or the qualified live
-    // deparse reads as drift against a bare recorded hash on the very next run. Canonical
-    // capture, always: SET LOCAL resets within the transaction; the session path otherwise.
-    if (setSearchPath) await runner(atomic ? 'SET LOCAL search_path TO DEFAULT' : 'RESET search_path');
-
     // Re-read the catalog so provenance records the def hashes of what NOW exists, not what we hoped
     // would exist. Inside the transaction this reads the batch's own not-yet-committed writes.
+    // introspectDerived pins the canonical search_path itself, so the defHash it records is stable
+    // regardless of the create-time wide path above (or any ambient override) — no manual reset here.
     const after = await introspectDerived(runner);
     const liveById = new Map(after.objects.map((o) => [o.identity, o]));
     const srcById = new Map(parsed.objects.map((o) => [o.identity, o]));

package/src/cli/derived-introspect.ts

@@ -20,6 +20,7 @@
 import { createHash } from 'node:crypto';
 import { IGNORED_SCHEMAS, type QueryRunner } from './authz-contract.js';
 import { normalizeSql, type DerivedKind } from './derived-source.js';
+import { withCanonicalSearchPath } from './search-path.js';
 
 export interface LiveObject {
   kind: DerivedKind;
@@ -529,23 +530,29 @@ export function assembleDerivedCatalog(rows: DerivedRows): DerivedCatalog {
  * the reconciler has never touched) folds to an empty claims list.
  */
 export async function introspectDerived(run: QueryRunner): Promise<DerivedCatalog> {
-  const [relations, functions, indexes, depends, triggers, grants] = await Promise.all([
-    run(DERIVED_RELATIONS_SQL), run(DERIVED_FUNCTIONS_SQL), run(MATVIEW_INDEXES_SQL), run(DERIVED_DEPENDS_SQL),
-    run(DERIVED_TRIGGERS_SQL), run(DERIVED_GRANTS_SQL),
-  ]);
-  let provenance: ProvenanceRawRow[] = [];
-  try {
-    provenance = (await run(PROVENANCE_SQL)) as ProvenanceRawRow[];
-  } catch {
-    // everystack.derived_provenance does not exist yet — nothing has been reconciled.
-  }
-  return assembleDerivedCatalog({
-    relations: relations as RelationRow[],
-    functions: functions as FunctionRow[],
-    indexes: indexes as IndexDefRow[],
-    depends: depends as DependsRow[],
-    triggers: triggers as TriggerRow[],
-    grants: grants as GrantAclRow[],
-    provenance,
+  // View/matview/function bodies deparse relative to the search_path (`pg_get_viewdef`
+  // renders a ref bare while its schema is in scope, qualified once off). Pin the
+  // canonical baseline so the recorded def hash is stable across runs and paths — this
+  // also subsumes the reconcile apply's pre-introspection reset. See search-path.ts.
+  return withCanonicalSearchPath(run, async () => {
+    const [relations, functions, indexes, depends, triggers, grants] = await Promise.all([
+      run(DERIVED_RELATIONS_SQL), run(DERIVED_FUNCTIONS_SQL), run(MATVIEW_INDEXES_SQL), run(DERIVED_DEPENDS_SQL),
+      run(DERIVED_TRIGGERS_SQL), run(DERIVED_GRANTS_SQL),
+    ]);
+    let provenance: ProvenanceRawRow[] = [];
+    try {
+      provenance = (await run(PROVENANCE_SQL)) as ProvenanceRawRow[];
+    } catch {
+      // everystack.derived_provenance does not exist yet — nothing has been reconciled.
+    }
+    return assembleDerivedCatalog({
+      relations: relations as RelationRow[],
+      functions: functions as FunctionRow[],
+      indexes: indexes as IndexDefRow[],
+      depends: depends as DependsRow[],
+      triggers: triggers as TriggerRow[],
+      grants: grants as GrantAclRow[],
+      provenance,
+    });
   });
 }

package/src/cli/model-render.ts

@@ -208,6 +208,77 @@ function renderDefault(expr: string): string | null {
   return null;
 }
 
+const NUMERIC_ARRAY_BASE = /^(smallint|integer|bigint|numeric|decimal|real|double precision)\b/;
+
+/**
+ * The `.default([...])` modifier for an ARRAY column — the spelling the array-default
+ * guard requires (a string default on an array field throws; `.default("{}")` was the
+ * old, now-rejected pull output). Parses the Postgres array literal back into the JS
+ * array the compiler round-trips from: `'{}'` → `[]`, `'{"a","b"}'` → `['a', 'b']`,
+ * `'{1,2}'` → `[1, 2]`. Returns null for anything it can't confidently invert (nested
+ * arrays, NULL elements, an `ARRAY[...]`/function expression) — the caller falls back to
+ * `.defaultSql()`, which round-trips via the raw SQL (the diff normalizes both sides).
+ */
+function renderArrayDefault(expr: string, arrayType: string): string | null {
+  const n = normalizeDefault(expr);
+  if (n == null) return null;
+  const lit = n.match(/^'(\{[\s\S]*\})'$/);
+  if (!lit) return null; // not a `'{…}'` literal (e.g. an ARRAY[…] expression) → defaultSql
+  const elems = parsePgArrayElements(lit[1]);
+  if (elems == null) return null;
+  const base = arrayType.slice(0, -2);
+  const numeric = NUMERIC_ARRAY_BASE.test(base);
+  const boolean = base === 'boolean';
+  const rendered = elems.map((e) => {
+    // A bare NULL is a real NULL element (a quoted "NULL" is the string) — we don't model it.
+    if (!e.quoted && e.raw.toUpperCase() === 'NULL') return null;
+    if (boolean) return e.raw === 'true' || e.raw === 'false' ? e.raw : null;
+    if (numeric) return /^-?\d+(\.\d+)?$/.test(e.raw) ? e.raw : null;
+    return tsLiteral(e.raw);
+  });
+  if (rendered.some((r) => r == null)) return null;
+  return `.default([${rendered.join(', ')}])`;
+}
+
+/**
+ * Split the body of a Postgres array literal (`{…}`, braces included) into its top-level
+ * elements, each tagged quoted-or-bare with backslash escapes resolved. Returns `[]` for
+ * `{}`, or null for a nested array or a malformed literal (the caller then falls back).
+ */
+function parsePgArrayElements(literal: string): Array<{ raw: string; quoted: boolean }> | null {
+  const body = literal.slice(1, -1);
+  if (body === '') return [];
+  const out: Array<{ raw: string; quoted: boolean }> = [];
+  let i = 0;
+  while (i < body.length) {
+    let raw = '';
+    let quoted = false;
+    if (body[i] === '{') return null; // nested array — not modeled
+    if (body[i] === '"') {
+      quoted = true;
+      i++;
+      while (i < body.length && body[i] !== '"') {
+        if (body[i] === '\\') { raw += body[i + 1] ?? ''; i += 2; continue; }
+        raw += body[i]; i++;
+      }
+      if (body[i] !== '"') return null; // unterminated quote
+      i++;
+    } else {
+      while (i < body.length && body[i] !== ',') {
+        if (body[i] === '{' || body[i] === '"') return null;
+        raw += body[i]; i++;
+      }
+      raw = raw.trim();
+    }
+    out.push({ raw, quoted });
+    if (i < body.length) {
+      if (body[i] !== ',') return null; // trailing junk after a quoted element
+      i++;
+    }
+  }
+  return out;
+}
+
 /** A single-quoted TS string literal (the model idiom), escaping embedded quotes. */
 function tsLiteral(value: string): string {
   return `'${value.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
@@ -260,7 +331,7 @@ function renderField(table: TableSchema, col: ColumnSchema, known: Set<string>,
   }
 
   if (col.default != null && !serial) {
-    const d = renderDefault(col.default);
+    const d = col.type.endsWith('[]') ? renderArrayDefault(col.default, col.type) : renderDefault(col.default);
     // No builder maps it → declare it verbatim with the escape hatch. RAW, not the
     // normalized form — stripping a trailing cast here could change semantics
     // (`'7 days'::interval`); the diff normalizes both sides for comparison instead.

package/src/cli/schema-introspect.ts

@@ -14,6 +14,7 @@
  */
 
 import { IGNORED_SCHEMAS, coerceBool, type QueryRunner } from './authz-contract.js';
+import { withCanonicalSearchPath } from './search-path.js';
 
 // ---------------------------------------------------------------------------
 // The data-layer snapshot — the structured shape both producers target.
@@ -579,14 +580,19 @@ export function assembleSchema(rows: SchemaRows): SchemaSnapshot {
  * `assembleSchema`. This is the `current` side `db:generate` diffs the compiled Models against.
  */
 export async function introspectSchema(run: QueryRunner): Promise<SchemaSnapshot> {
-  const [columns, constraints, enums, indexes, sequences] = await Promise.all([
-    run(COLUMNS_SQL), run(CONSTRAINTS_SQL), run(ENUMS_SQL), run(INDEXES_SQL), run(SEQUENCES_SQL),
-  ]);
-  return assembleSchema({
-    columns: columns as ColumnRow[],
-    constraints: constraints as ConstraintRow[],
-    enums: enums as EnumRow[],
-    indexes: indexes as IndexRow[],
-    sequences: sequences as SequenceRow[],
+  // Pin the canonical search_path: column defaults, CHECK constraints, and index
+  // expressions all deparse relative to it, so an ambient non-default path would
+  // read as false drift. See search-path.ts.
+  return withCanonicalSearchPath(run, async () => {
+    const [columns, constraints, enums, indexes, sequences] = await Promise.all([
+      run(COLUMNS_SQL), run(CONSTRAINTS_SQL), run(ENUMS_SQL), run(INDEXES_SQL), run(SEQUENCES_SQL),
+    ]);
+    return assembleSchema({
+      columns: columns as ColumnRow[],
+      constraints: constraints as ConstraintRow[],
+      enums: enums as EnumRow[],
+      indexes: indexes as IndexRow[],
+      sequences: sequences as SequenceRow[],
+    });
   });
 }

package/src/cli/search-path.ts

@@ -0,0 +1,51 @@
+/**
+ * search-path — the canonical introspection baseline.
+ *
+ * Every expression PostgreSQL deparses on introspection — column defaults
+ * (`pg_get_expr`), CHECK constraints, index expressions, generated columns,
+ * view/matview bodies (`pg_get_viewdef`), function bodies — renders its schema
+ * qualification RELATIVE to the session `search_path`. So the SAME schema reads
+ * differently depending on the ambient path: with a non-public schema on the
+ * path a reference to it renders BARE (`nextval('x_seq')`), off the path it
+ * renders QUALIFIED (`nextval('stats.x_seq')`). The declared state is always
+ * canonical (public bare, non-public qualified), so a non-default session or
+ * DB-level `search_path` makes every deparsed expression read as false drift.
+ *
+ * The fix is to CAPTURE under a fixed canonical path, once, at the introspection
+ * boundary — one guard for the whole class (defaults, checks, indexes, bodies),
+ * present and future. The baseline is `public`: it renders public-bare and
+ * non-public-qualified, matching the declared compile exactly (verified against
+ * PostgreSQL 16). It must be an EXPLICIT value — `RESET` / `SET … TO DEFAULT`
+ * inherit an `ALTER DATABASE/ROLE … SET search_path` override (the very thing
+ * that triggers the bug), so they are NOT canonical baselines.
+ */
+
+import type { QueryRunner } from './authz-contract.js';
+
+/** The canonical introspection search_path — explicit, override-proof, declared-matching. */
+export const CANONICAL_SEARCH_PATH_SQL = 'SET search_path = public';
+
+/**
+ * Run `fn` with the connection's search_path pinned to the canonical baseline, so every
+ * expression it deparses is captured in the declared-matching form regardless of the
+ * ambient path, then RESET to the connection's default afterward. RESET restores the
+ * database/role default — which for the case this fixes (an `ALTER DATABASE … SET
+ * search_path` override) is exactly the override, so a fresh connection sees no change.
+ * It deliberately does NOT preserve a caller's transient session/transaction-local SET:
+ * restoring a captured `SET LOCAL` value session-wide would leak it (e.g. the reconcile
+ * apply's create-time wide path), and no everystack caller relies on a hand-set path
+ * surviving introspection.
+ *
+ * Effective on a persistent single connection (the direct `createUrlRunner`, `max: 1`);
+ * over a per-call pooled runner the SET does not persist, but that path already renders
+ * canonically unless the database itself carries a search_path override.
+ */
+export async function withCanonicalSearchPath<T>(run: QueryRunner, fn: () => Promise<T>): Promise<T> {
+  await run(CANONICAL_SEARCH_PATH_SQL);
+  try {
+    return await fn();
+  } finally {
+    // Best-effort: a failure here must not mask fn's result.
+    try { await run('RESET search_path'); } catch { /* connection may be gone */ }
+  }
+}