@everystack/cli 0.4.93 → 0.4.96

package/src/cli/exec-digest.ts

@@ -1,7 +1,9 @@
 /**
  * exec-digest — the catalog content-address that makes db:exec DML-only WITHOUT a role, a
  * superuser, or a regex. A self-contained SQL query that md5s the schema-relevant catalog
- * (pg_class / pg_attribute / pg_constraint / pg_index / pg_proc / pg_type) for the given app
+ * (pg_class / pg_attribute / pg_constraint / pg_index / pg_proc / pg_type, plus the behaviour
+ * attached to relations — pg_rewrite / pg_trigger / pg_attrdef — and the database-wide
+ * pg_event_trigger / pg_extension) for the given app
  * schemas. db:exec takes this digest before and after the file inside one transaction; any
  * difference is a schema change — however it was caused (a CREATE/ALTER/DROP, a function, a DO
  * block, dynamic SQL) — and rolls the whole transaction back.
@@ -66,7 +68,7 @@ FROM (
   -- but CAN change who may read it is not a DML-only lane. None of the three move under DML.
   SELECT format('rel:%s.%s:%s:%s:%s:%s:%s', n.nspname, c.relname, c.relkind, c.relpersistence,
                 coalesce(c.relacl::text, ''), c.relrowsecurity, c.relforcerowsecurity) AS line
-    FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+    FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
     WHERE ${NS} AND c.relkind IN ('r', 'p', 'v', 'm', 'S', 'f')
   UNION ALL
   -- Row policies: a CREATE/ALTER/DROP POLICY rewrites who sees which rows and touches no other
@@ -74,32 +76,32 @@ FROM (
   SELECT format('pol:%s.%s.%s:%s:%s:%s:%s:%s', n.nspname, c.relname, pol.polname, pol.polcmd,
                 pol.polpermissive,
                 coalesce((SELECT string_agg(r.rolname, ',' ORDER BY r.rolname)
-                          FROM pg_roles r WHERE r.oid = ANY(pol.polroles)), 'PUBLIC'),
+                          FROM pg_catalog.pg_roles r WHERE r.oid = ANY(pol.polroles)), 'PUBLIC'),
                 coalesce(pg_get_expr(pol.polqual, pol.polrelid), ''),
                 coalesce(pg_get_expr(pol.polwithcheck, pol.polrelid), ''))
-    FROM pg_policy pol
-    JOIN pg_class c ON c.oid = pol.polrelid
-    JOIN pg_namespace n ON n.oid = c.relnamespace
+    FROM pg_catalog.pg_policy pol
+    JOIN pg_catalog.pg_class c ON c.oid = pol.polrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
     WHERE ${NS}
   UNION ALL
   -- Columns: number, type, typmod, not-null — the shape ALTER TABLE moves, DML never.
   SELECT format('att:%s.%s.%s:%s:%s:%s:%s',
                 n.nspname, c.relname, a.attname, a.attnum, a.atttypid, a.atttypmod, a.attnotnull)
-    FROM pg_attribute a
-    JOIN pg_class c ON c.oid = a.attrelid
-    JOIN pg_namespace n ON n.oid = c.relnamespace
+    FROM pg_catalog.pg_attribute a
+    JOIN pg_catalog.pg_class c ON c.oid = a.attrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
     WHERE ${NS} AND a.attnum > 0 AND NOT a.attisdropped
   UNION ALL
   -- Constraints: the full textual definition (PK/FK/unique/check predicate).
   SELECT format('con:%s.%s:%s', n.nspname, con.conname, pg_get_constraintdef(con.oid))
-    FROM pg_constraint con JOIN pg_namespace n ON n.oid = con.connamespace
+    FROM pg_catalog.pg_constraint con JOIN pg_catalog.pg_namespace n ON n.oid = con.connamespace
     WHERE ${NS}
   UNION ALL
   -- Indexes: the full textual definition (columns, uniqueness, partial WHERE).
   SELECT format('idx:%s.%s:%s', n.nspname, ic.relname, pg_get_indexdef(i.indexrelid))
-    FROM pg_index i
-    JOIN pg_class ic ON ic.oid = i.indexrelid
-    JOIN pg_namespace n ON n.oid = ic.relnamespace
+    FROM pg_catalog.pg_index i
+    JOIN pg_catalog.pg_class ic ON ic.oid = i.indexrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = ic.relnamespace
     WHERE ${NS}
   UNION ALL
   -- Routines: name + arg types + a hash of the body, PLUS proacl (the EXECUTE grants) and
@@ -107,14 +109,57 @@ FROM (
   -- that opens one, is a privilege change and must trip the guard like any other.
   SELECT format('proc:%s.%s:%s:%s:%s:%s', n.nspname, p.proname, p.proargtypes::text,
                 md5(coalesce(p.prosrc, '')), coalesce(p.proacl::text, ''), p.prosecdef)
-    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+    FROM pg_catalog.pg_proc p JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
     WHERE ${NS}
   UNION ALL
+  -- Behaviour ATTACHED to a relation — no column, constraint or index moves, so each of these
+  -- passed the guard until the closing-gate review (2026-09-24) proved it: a RULE on the ledger
+  -- could retire every future restore witness at birth. Rules (view bodies included: a view
+  -- redefinition is DDL too), user triggers, and column defaults, by their full definitions.
+  SELECT format('rule:%s.%s.%s:%s', n.nspname, c.relname, r.rulename, md5(pg_get_ruledef(r.oid)))
+    FROM pg_catalog.pg_rewrite r
+    JOIN pg_catalog.pg_class c ON c.oid = r.ev_class
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE ${NS}
+  UNION ALL
+  SELECT format('trg:%s.%s.%s:%s:%s', n.nspname, c.relname, t.tgname, t.tgenabled, md5(pg_get_triggerdef(t.oid)))
+    FROM pg_catalog.pg_trigger t
+    JOIN pg_catalog.pg_class c ON c.oid = t.tgrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE ${NS} AND NOT t.tgisinternal
+  UNION ALL
+  SELECT format('def:%s.%s.%s:%s', n.nspname, c.relname, a.attname, pg_get_expr(d.adbin, d.adrelid))
+    FROM pg_catalog.pg_attrdef d
+    JOIN pg_catalog.pg_attribute a ON a.attrelid = d.adrelid AND a.attnum = d.adnum
+    JOIN pg_catalog.pg_class c ON c.oid = d.adrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE ${NS}
+  UNION ALL
+  -- Database-wide behaviour: event triggers fire on every DDL, extensions install whole schemas.
+  SELECT format('evt:%s:%s:%s:%s', e.evtname, e.evtevent, e.evtenabled, e.evtfoid::regproc::text)
+    FROM pg_catalog.pg_event_trigger e
+  UNION ALL
+  SELECT format('ext:%s:%s', x.extname, x.extversion)
+    FROM pg_catalog.pg_extension x
+  UNION ALL
+  -- TEMP triggers and functions. Temp TABLES stay out (ordinary scripts stage data in them), but a
+  -- DML file never needs a trigger or a function of its own — and one on a temp relation is how a
+  -- file runs code at COMMIT, after the checks (closing-gate review round 3).
+  SELECT format('ttrg:%s.%s:%s', c.relname, t.tgname, md5(pg_get_triggerdef(t.oid)))
+    FROM pg_catalog.pg_trigger t
+    JOIN pg_catalog.pg_class c ON c.oid = t.tgrelid
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname LIKE 'pg_temp%' AND NOT t.tgisinternal
+  UNION ALL
+  SELECT format('tproc:%s:%s', p.proname, md5(coalesce(p.prosrc, '')))
+    FROM pg_catalog.pg_proc p JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname LIKE 'pg_temp%'
+  UNION ALL
   -- Types: kind + ordered enum labels. CREATE TYPE / ALTER TYPE ADD VALUE move it.
   SELECT format('type:%s.%s:%s:%s', n.nspname, t.typname, t.typtype,
                 coalesce((SELECT string_agg(e.enumlabel, ',' ORDER BY e.enumsortorder)
-                          FROM pg_enum e WHERE e.enumtypid = t.oid), ''))
-    FROM pg_type t JOIN pg_namespace n ON n.oid = t.typnamespace
+                          FROM pg_catalog.pg_enum e WHERE e.enumtypid = t.oid), ''))
+    FROM pg_catalog.pg_type t JOIN pg_catalog.pg_namespace n ON n.oid = t.typnamespace
     WHERE ${NS}
 ) s
 `.trim();

package/src/cli/exec-run.ts

@@ -46,6 +46,74 @@ export class SchemaChangedError extends Error {
   }
 }
 
+/**
+ * The ledger violation: the file wrote to the `everystack` schema. Those tables are what every
+ * safety decision reads — schema_log is the descent anchor and a restore's witness, derived_provenance
+ * decides what the reconciler trusts, exec_log is this lane's own audit. A DML lane that can write
+ * them can forge any of it, so the whole transaction was rolled back.
+ */
+export class LedgerWriteError extends Error {
+  constructor(detail: string) {
+    super(
+      `db:exec cannot write the everystack schema (${detail}) — its tables are the ledgers every safety check reads, ` +
+        'and a write here could forge one. The whole transaction was rolled back; nothing was applied.',
+    );
+    this.name = 'LedgerWriteError';
+  }
+}
+
+/**
+ * Rows written to everystack.* by THIS transaction (pg_stat_xact_* counts the open transaction), and
+ * each table's relfilenode — TRUNCATE touches no row counter but always gives the table a new file.
+ * Semantic, like the catalog digest: it reads what happened, not what the SQL text looks like.
+ */
+export const LEDGER_GUARD_SQL = `
+SELECT coalesce(sum(s.n_tup_ins + s.n_tup_upd + s.n_tup_del), 0)::bigint AS writes,
+       coalesce(string_agg(c.relname || ':' || c.relfilenode::text, ',' ORDER BY c.relname), '') AS files,
+       -- A table that INHERITS from a ledger table (a temp one is enough) makes its rows read as
+       -- ledger rows, and its writes count against the child. Ledger tables never have children.
+       (SELECT count(*) FROM pg_catalog.pg_inherits i JOIN pg_catalog.pg_class p ON p.oid = i.inhparent
+          JOIN pg_catalog.pg_namespace pn ON pn.oid = p.relnamespace WHERE pn.nspname = 'everystack')::int AS children,
+       pg_catalog.current_setting('track_counts') AS track_counts
+FROM pg_catalog.pg_class c
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+LEFT JOIN pg_catalog.pg_stat_xact_user_tables s ON s.relid = c.oid
+WHERE n.nspname = 'everystack' AND c.relkind IN ('r', 'p')`.trim();
+
+/**
+ * Fire every DEFERRED constraint trigger NOW. A deferred trigger runs at COMMIT — after both
+ * checks — so a file could hide DDL or a ledger write inside one (closing-gate review round 2).
+ * Made immediate here, it fires inside the window the checks read.
+ */
+export const FIRE_DEFERRED_SQL = 'SET CONSTRAINTS ALL IMMEDIATE';
+
+/**
+ * The digest reads `pg_get_*def` / `pg_get_expr` text, which qualifies names relative to the
+ * search_path: a file that sets its own path would move the digest with no schema change (a
+ * serial default prints `nextval('t_id_seq')` or `nextval('public.t_id_seq')`). Pin the path for
+ * the read, then give the file its own back.
+ */
+// pg_temp named LAST: unnamed, PostgreSQL searches it FIRST for relations, and a file's temp view
+// called pg_class would answer the check (closing-gate review round 3). Every catalog the checks
+// read is also written pg_catalog.x; this pin is the second lock.
+const PATH_SAVE_SQL = `SELECT pg_catalog.current_setting('search_path') AS path`;
+const PATH_PIN_SQL = `SELECT pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true)`;
+const pathRestoreSql = (path: string): string => `SELECT pg_catalog.set_config('search_path', '${path.replace(/'/g, "''")}', true)`;
+
+/** Run a check query under the pinned path, then give the file its own path back. */
+async function pinned(run: TxRunner, query: string): Promise<ExecStmtResult> {
+  const saved = (await run(PATH_SAVE_SQL)).rows?.[0]?.path;
+  await run(PATH_PIN_SQL);
+  const res = await run(query); // a failure aborts the transaction: nothing to restore, keep its error
+  if (typeof saved === 'string') await run(pathRestoreSql(saved));
+  return res;
+}
+
+const pinnedDigest = async (run: TxRunner, digestQuery: string): Promise<string> => readDigest(await pinned(run, digestQuery));
+
+/** A WITH HOLD cursor finishes its query at COMMIT — after the checks. Close them all first. */
+export const CLOSE_CURSORS_SQL = 'CLOSE ALL';
+
 /** Transaction rails — a file can't hang the plane or block behind a lock forever. */
 export interface ExecRails {
   statementTimeoutMs?: number;
@@ -87,7 +155,8 @@ export async function runExecInTx(
   for (const rail of railStatements(opts.rails)) await run(rail);
 
   const digestQuery = catalogDigestQuery(opts.schemas);
-  const before = readDigest(await run(digestQuery));
+  const before = await pinnedDigest(run, digestQuery);
+  const ledgerBefore = (await pinned(run, LEDGER_GUARD_SQL)).rows?.[0] ?? {};
 
   const rowsAffected: number[] = [];
   for (const stmt of splitSqlStatements(fileSql)) {
@@ -95,8 +164,18 @@ export async function runExecInTx(
     rowsAffected.push(res.count);
   }
 
-  const after = readDigest(await run(digestQuery));
+  await run(FIRE_DEFERRED_SQL);
+  await run(CLOSE_CURSORS_SQL);
+  const after = await pinnedDigest(run, digestQuery);
   if (before !== after) throw new SchemaChangedError(before, after);
+  const ledgerAfter = (await pinned(run, LEDGER_GUARD_SQL)).rows?.[0] ?? {};
+  if (String(ledgerAfter.track_counts ?? 'on') === 'off') {
+    throw new LedgerWriteError('track_counts was turned off, so ledger writes could not be counted');
+  }
+  if (Number(ledgerAfter.children ?? 0) > 0) throw new LedgerWriteError('a table inherits from a ledger table');
+  const wrote = Number(ledgerAfter.writes ?? 0) - Number(ledgerBefore.writes ?? 0);
+  if (wrote > 0) throw new LedgerWriteError(`${wrote} row(s) written`);
+  if (String(ledgerAfter.files ?? '') !== String(ledgerBefore.files ?? '')) throw new LedgerWriteError('a table was truncated or rewritten');
   return rowsAffected;
 }