@everystack/cli 0.4.92 → 0.4.93

package/CHANGELOG.md

@@ -4,6 +4,57 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.93] - 2026-09-24
+
+### BREAKING CHANGES
+
+- a declared owner needs USAGE on its schema; db:apply refuses without it, db:provision (server 0.4.33) grants it
+
+### Fixed
+
+- name USAGE with CREATE for a missing schema; review follow-ups
+
+## [0.4.92] - 2026-09-24
+
+### Fixed
+
+- grant drift on an owned object runs as its owner
+- an apply fails unless the grants it set really converged
+- settle a built object's grants before checking convergence
+- settle statements are recorded and named; pin settle-as-owner
+
+### Documentation
+
+- a declared owner needs USAGE on its schema to grant there
+
+## [0.4.91] - 2026-09-24
+
+### Fixed
+
+- one apply revokes a grantee dropped from a replaced function
+- a lowercase public grant is PUBLIC in the function grant diff
+
+## [0.4.90] - 2026-09-23
+
+### Added
+
+- db:plan warns when the derived layer is out of sync
+
+### Fixed
+
+- db:apply reports skipped brownfield derived objects by default
+
+## [0.4.89] - 2026-09-22
+
+### Fixed
+
+- outputsDescribeStage matches SST's truncated app-name prefix
+- discoverFunction/discoverCfFunction/discoverBuckets match SST's truncated app-name prefix
+- warn once when cloudfront:ListTagsForResource is denied during distribution discovery
+- db:provision --rotate probes siteUrl on a no-CDN_URL stage
+- update refuses a missing HOST_URL with or without --stage
+- db:reconcile/db:refresh --only respects parens in function identities
+
 ## [0.4.88] - 2026-09-21
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.92",
+  "version": "0.4.93",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -182,7 +182,7 @@
     "react": "19.2.0",
     "ts-jest": "29.4.9",
     "zod": "3.25.67",
-    "@everystack/server": "0.4.32"
+    "@everystack/server": "0.4.33"
   },
   "scripts": {
     "test": "jest",

package/src/cli/derived-apply.ts

@@ -273,12 +273,13 @@ export function renderEnsureObjectSchemas(objects: SourceObject[]): string[] {
 // Declared-owner preflight — the refusal that beats a raw Postgres error.
 // ---------------------------------------------------------------------------
 
-/** One declared owner and every schema the batch will create an object of theirs in. Empty
- *  `schemas` means the batch only GRANTs/REVOKEs as that owner: it must exist and be assumable,
- *  but it creates nothing, so it needs CREATE nowhere. */
+/** One declared owner, every schema the batch will create an object of theirs in (`schemas`: the
+ *  owner needs CREATE and USAGE there), and every other schema it only GRANTs/REVOKEs in
+ *  (`grantSchemas`: USAGE alone — a GRANT names `schema.object`, and that lookup needs USAGE). */
 export interface OwnerRequirement {
   owner: string;
   schemas: string[];
+  grantSchemas?: string[];
 }
 
 /**
@@ -298,12 +299,18 @@ export function ownerRequirements(plan: ReconcilePlan, source: SourceObject[]):
     if (!obj?.owner) continue;
     (byOwner.get(obj.owner) ?? byOwner.set(obj.owner, new Set()).get(obj.owner)!).add(obj.schema);
   }
+  const grantOnly = new Map<string, Set<string>>();
   for (const r of plan.regrants) {
-    if (r.owner && !byOwner.has(r.owner)) byOwner.set(r.owner, new Set());
+    const schema = srcById.get(r.identity)?.schema;
+    if (!r.owner || !schema) continue;
+    (grantOnly.get(r.owner) ?? grantOnly.set(r.owner, new Set()).get(r.owner)!).add(schema);
   }
-  return [...byOwner.entries()]
-    .map(([owner, schemas]) => ({ owner, schemas: [...schemas].sort() }))
-    .sort((a, b) => a.owner.localeCompare(b.owner));
+  const owners = new Set([...byOwner.keys(), ...grantOnly.keys()]);
+  return [...owners].sort().map((owner) => {
+    const schemas = [...(byOwner.get(owner) ?? [])].sort();
+    const grantSchemas = [...(grantOnly.get(owner) ?? [])].filter((s) => !schemas.includes(s)).sort();
+    return { owner, schemas, ...(grantSchemas.length ? { grantSchemas } : {}) };
+  });
 }
 
 /**
@@ -315,11 +322,13 @@ export function ownerRequirements(plan: ReconcilePlan, source: SourceObject[]):
  * and the privilege only evaluated when it is really there.
  */
 export function ownerPreflightSql(requirements: OwnerRequirement[]): string {
-  // A grant-only owner still needs its row (does it exist, can we assume it): one with no schema.
-  const pairs = requirements.flatMap((r) => (r.schemas.length ? r.schemas : [null])
-    .map((s) => `(${escapeLiteral(r.owner)}, ${s === null ? 'NULL::text' : escapeLiteral(s)})`));
+  const rowsFor = (r: OwnerRequirement) => [
+    ...r.schemas.map((s) => `(${escapeLiteral(r.owner)}, ${escapeLiteral(s)}, true)`),
+    ...(r.grantSchemas ?? []).map((s) => `(${escapeLiteral(r.owner)}, ${escapeLiteral(s)}, false)`),
+  ];
+  const triples = requirements.flatMap(rowsFor);
   return `
-WITH declared(owner_name, schema_name) AS (VALUES ${pairs.join(', ')})
+WITH declared(owner_name, schema_name, needs_create) AS (VALUES ${triples.join(', ')})
 SELECT
   CURRENT_USER AS builder,
   -- Which mechanism the applier may use. A SUPERUSER (RDS: an rds_superuser member) can hand an
@@ -335,12 +344,15 @@ SELECT
   ) AS builder_is_superuser,
   d.owner_name,
   d.schema_name,
+  d.needs_create,
   (r.oid IS NOT NULL) AS role_exists,
   (n.oid IS NOT NULL) AS schema_exists,
   r.rolsuper AS owner_is_superuser,
   CASE WHEN r.oid IS NULL THEN NULL ELSE pg_has_role(CURRENT_USER, r.oid, 'SET') END AS can_set_role,
   CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN NULL
-       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create
+       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create,
+  CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN NULL
+       ELSE has_schema_privilege(r.oid, n.oid, 'USAGE') END AS owner_can_use
 FROM declared d
 LEFT JOIN pg_roles r ON r.rolname = d.owner_name
 LEFT JOIN pg_namespace n ON n.nspname = d.schema_name
@@ -352,13 +364,15 @@ export interface OwnerPreflightRow {
   builder?: unknown;
   builder_is_superuser?: unknown;
   owner_name: string;
-  /** Null for a grant-only owner — nothing is created, so there is no schema to check. */
-  schema_name: string | null;
+  schema_name: string;
+  /** False for a schema the owner only GRANTs/REVOKEs in — USAGE is checked, CREATE is not. */
+  needs_create?: unknown;
   role_exists?: unknown;
   schema_exists?: unknown;
   owner_is_superuser?: unknown;
   can_set_role?: unknown;
   owner_can_create?: unknown;
+  owner_can_use?: unknown;
 }
 
 const truthy = (v: unknown): boolean => v === true || v === 't' || v === 'true';
@@ -377,7 +391,7 @@ export function builderOwnerMode(rows: OwnerPreflightRow[]): OwnerApplyMode {
 /**
  * The refusal text, or null when every declared owner is usable.
  *
- * Three ways a declared owner fails, all named at once with the exact statement that fixes each:
+ * Four ways a declared owner fails, all named at once with the exact statement that fixes each:
  *
  *   1. THE ROLE DOES NOT EXIST. The build refuses and does NOT create it. A role is
  *      cluster-scoped and a security principal, and a principal invented by a tool cannot know
@@ -389,6 +403,9 @@ export function builderOwnerMode(rows: OwnerPreflightRow[]): OwnerApplyMode {
  *   3. THE OWNER CANNOT CREATE IN THE SCHEMA. Same mechanism — the CREATE happens AS the owner,
  *      so the owner needs CREATE on the schema the object lives in. A schema that does not exist
  *      yet counts: this build creates it as the BUILDER, and the owner will not hold CREATE on it.
+ *   4. THE OWNER CANNOT USE THE SCHEMA. Every GRANT/REVOKE it runs on its objects (attachments,
+ *      a replace's revokes, regrants, the settle pass) names `schema.object`, and resolving that
+ *      needs USAGE — checked for schemas it creates in AND schemas it only grants in.
  */
 export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null {
   const builder = rows.find((r) => r.builder != null)?.builder;
@@ -396,6 +413,7 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
   const missing = new Set<string>();
   const unassumable = new Set<string>();
   const noCreate: Array<{ owner: string; schema: string; exists: boolean }> = [];
+  const noUsage: Array<{ owner: string; schema: string }> = [];
 
   // A superuser builder creates as itself and ALTERs the owner, so it needs neither membership in
   // the owner nor CREATE on the owner's behalf. Refusing on either would be a false refusal that
@@ -411,16 +429,28 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
     // A superuser owner holds CREATE everywhere, including in a schema this build is about to
     // make — there is nothing to refuse.
     if (truthy(row.owner_is_superuser)) continue;
-    if (row.schema_name == null) continue;
-    if (!truthy(row.schema_exists)) noCreate.push({ owner, schema: String(row.schema_name), exists: false });
-    else if (!truthy(row.owner_can_create)) noCreate.push({ owner, schema: String(row.schema_name), exists: true });
+    const schema = String(row.schema_name);
+    const needsCreate = truthy(row.needs_create);
+    if (!truthy(row.schema_exists)) {
+      // Named whole, in one round: the owner will need both once the builder creates the schema.
+      if (needsCreate) {
+        noCreate.push({ owner, schema, exists: false });
+        noUsage.push({ owner, schema });
+      }
+      continue;
+    }
+    if (needsCreate && !truthy(row.owner_can_create)) noCreate.push({ owner, schema, exists: true });
+    // Every GRANT/REVOKE the owner runs names `schema.object`, and resolving it needs USAGE. An
+    // owned function always has one (its REVOKE ALL … FROM PUBLIC), so this was a mid-batch
+    // `permission denied for schema` before it was a refusal.
+    if (!truthy(row.owner_can_use)) noUsage.push({ owner, schema });
   }
 
-  if (!missing.size && !unassumable.size && !noCreate.length) return null;
+  if (!missing.size && !unassumable.size && !noCreate.length && !noUsage.length) return null;
 
   const lines: string[] = [
     `declared owner(s) cannot be enacted by '${builderName}' — refused before any DDL, so nothing is half-applied.`,
-    `The one-command fix is \`everystack db:provision\`: it ENACTS these grants (and ADOPTS any`,
+    `The one-command fix is \`everystack db:provision\` (USAGE needs @everystack/server >= 0.4.33 on the stage): it ENACTS these grants (and ADOPTS any`,
     `pre-existing objects owned by the master) from the declared model, so you never hand-write them.`,
     `The exact statements, if you must run them by hand:`,
   ];
@@ -443,6 +473,12 @@ export function ownerPreflightRefusal(rows: OwnerPreflightRow[]): string | null
       `      GRANT CREATE ON SCHEMA ${schema} TO ${owner};`,
     );
   }
+  for (const { owner, schema } of noUsage) {
+    lines.push(
+      `  NO USAGE ON SCHEMA  '${owner}' cannot use schema "${schema}" — its GRANT/REVOKE on the objects there name the schema:`,
+      `      GRANT USAGE ON SCHEMA ${schema} TO ${owner};`,
+    );
+  }
   return lines.join('\n');
 }