@everystack/mcp 0.4.2 → 0.4.4

package/dist/cli.md

@@ -42,6 +42,25 @@ everystack db:fingerprint     # Content-address the live base schema vs the Mode
 everystack db:diff            # The state edge between two declared states — no DB, CI-pure
 ```
 
+**Authorization (the brownfield on-ramp + the red team)**
+```bash
+everystack db:authz:pull      # Introspect live authz (rls/grants/policies/secdef) → reviewable contract files
+everystack db:authz:diff      # Live DB vs the committed contract — the CI gate (exit 1 on drift)
+everystack db:authz:test      # Red-team enforcement: SET ROLE + attempt per role/table/command
+everystack db:authz:owner     # Red-team owner isolation: two identities per owner-scoped table (catches IDOR)
+everystack db:authz:report    # Render the committed contract as a human review — no database
+```
+All four DB-touching verbs take `--stage <name>` OR a direct venue: `--database-url <url>`,
+or an inherited `ADMIN_DATABASE_URL`/`DATABASE_URL`. Same SQL, same evaluation, same
+verdict — and every run names the venue it judged, because a security verdict against an
+unintended database is worse than no verdict.
+
+Use the direct venue to **rehearse an authz migration locally**. Translating hand-written
+RLS into Model abilities is the hardest part of adopting the Model system, and iterating
+against a deployed stage makes the loop minutes long instead of seconds. `db:authz:test`
+and `db:authz:owner` WRITE in order to prove a role cannot write; every probe runs inside
+a transaction that is always rolled back, on either venue.
+
 **Safe remote migration (protected stages)**
 ```bash
 everystack db:plan --stage X --out X.plan.json     # Mint a reviewable edge — read-only, ephemeral

package/dist/derived-objects.md

@@ -195,6 +195,11 @@ from which git commit), and rebuilds dependents automatically in dependency orde
   Fix the source to match, or rebuild from source with `--overwrite-drift`.
 - **Grant drift converges without ceremony** — a hand-run GRANT/REVOKE surfaces as an
   idempotent `regrant` back to the declared abilities. Declared authz is authoritative.
+- **An authz-only descriptor change is a regrant, not a rebuild** — changing only the grants
+  on a matview (`private` → `abilities: [can('read')]`, body unchanged) applies as a bare
+  GRANT, no recompute. Forward-looking: the first `--apply` after upgrade arms up-to-date
+  objects via a record-only `backfill`, so the *first* authz change on a pre-upgrade row still
+  rebuilds; later ones are cheap. Column-scoped grants still rebuild (attacl isn't drift-checked).
 - **Changing a function REFRESHes the matviews that call it** — their rows are stale the
   moment the function changes, and the reconciler knows it.
 - **Unmanaged objects are never touched** — live derived objects with no source and no

package/dist/expo-server-deploy.md

@@ -174,6 +174,9 @@ export default $config({
 
     // The CLI discovers resources through these outputs. The first five are required;
     // backupsBucket unlocks db:backup / db:swap / db:fork (also auto-discovered by bucket name).
+    // databaseInstanceId unlocks the PHYSICAL snapshot path (db:snapshot, and db:swap's default
+    // pre-swap rollback point). Without it db:swap falls back to a logical pg_dump against the same
+    // instance it is about to restore into, which contends with the restore for locks.
     return {
       routerUrl: router.url,
       apiFunctionName: api.name,
@@ -181,6 +184,7 @@ export default $config({
       updatesBucket: updates.name,
       clientBundlesBucket: clientBundles.name,
       backupsBucket: backups.name,
+      databaseInstanceId: database.id,
     };
   },
 });
@@ -207,6 +211,64 @@ everystack db:seed --stage dev               # dev only
 
 Subsequent app-code ships are `everystack update` alone — no `sst deploy`, no Lambda redeploy.
 
+## External / shared RDS (no app VPC)
+
+The minimal config above lets SST create the VPC and the RDS together, and `dbTask` reaches a
+**private** in-VPC database. Some apps are compute-only: VPC-less Lambdas and an **external,
+shared, manually-managed** RDS (often `PubliclyAccessible=true`, in the account's default VPC).
+`dbTask` still works — you just hand it a **bring-your-own VPC object** instead of an `sst.aws.Vpc`.
+
+`sst.aws.Cluster` accepts a plain VPC descriptor (raw AWS ids), so you never call
+`sst.aws.Vpc.get()` (which throws on an untagged default VPC). Requires `@everystack/jobs >= 0.4.2`
+for the `publicIp` option.
+
+```typescript
+const adminDatabaseUrl = new sst.Secret('ADMIN_DATABASE_URL');
+
+const { dbTask } = await import('@everystack/jobs/infra');
+const { task: dbTaskResource } = dbTask({ sst, aws }, 'DbTask', {
+  // BYO-VPC: the RDS's OWN VPC. Put the RDS's security group in `securityGroups` — the Task's SG
+  // then self-references the DB on 5432, so it connects PRIVATELY with no `0.0.0.0/0` opening.
+  vpc: {
+    securityGroups: ['sg-0fca...'],                 // the RDS's security group (self-reference)
+    containerSubnets: ['subnet-a', 'subnet-b'],     // the RDS's VPC subnets (public in a default VPC)
+    loadBalancerSubnets: ['subnet-a', 'subnet-b'],  // required by the type; same subnets are fine
+  },
+  // The default VPC has no NAT, so give the Task an egress public IP to pull its image via the IGW.
+  // It still reaches the RDS privately by SG (above). `publicIp` adds NO inbound security group.
+  publicIp: true,
+  adminDatabaseUrl,
+  pgMajor: 16,
+  link: [backups],
+});
+```
+
+Two requirements on the AWS side:
+
+- **RDS security group must admit the Task.** The clean path is a **self-reference**: the RDS SG
+  allows ingress on 5432 from itself, and the Task uses that same SG. No public-endpoint hop, no
+  `0.0.0.0/0`.
+- **`ADMIN_DATABASE_URL`** points at the RDS (`everystack secrets set ADMIN_DATABASE_URL <url>
+  --stage <stage>`). It is injected via ECS secrets, never linked (a link would leak the password
+  into the task definition).
+- **Deploy IAM (`>= 0.4.3`):** dbTask writes its operator-URL SecureString to
+  `/sst/<app>/<stage>/DbTaskOperatorUrl`, under the `parameter/sst/*` prefix an SST deploy role is
+  already scoped to. A least-privilege deploy principal also needs ECS (cluster + task-def),
+  ECR (auth + repo push), EC2 `Describe*` (subnets/SGs), and `logs:CreateLogGroup` for the task's
+  log group. Override the param path with `paramName` to fit a different scoped prefix.
+
+**Keep `publicIp`, never `public: true`.** SST marks `publicIp` `@deprecated` in favor of `public`,
+but do NOT swap it here: `public: true` attaches an inbound security group open to `0.0.0.0/0` on
+ALL protocols and demands `vpc.publicSubnets`. `publicIp: true` gives an egress IP with no inbound
+rule — exactly what an outbound-only pg-binary task needs. (One inert side effect either way: when
+the Task's SG is the RDS's own, the Task ENI inherits the RDS SG's inbound rules — often
+`5432 from 0.0.0.0/0` for a public RDS — but nothing in the container listens, so it is unreachable.)
+
+Fallback (no BYO-VPC change): stand up a minimal `new sst.aws.Vpc('DbVpc')` (no NAT) and let the
+Task reach the RDS over its **public endpoint** + TLS. This needs the RDS SG to admit the Task's
+*dynamic* Fargate public IP — practically `0.0.0.0/0:5432`, mitigated by TLS + the operator
+credential. Prefer the private SG-self-reference above; use the public endpoint only as an interim.
+
 ## Gotchas
 
 - **Nothing serves until the first `everystack update`** — the fallback has no bundle to download yet, so `/` returns 404 while `/api` (plugin-claimed) already works.

package/dist/index.cjs

@@ -22411,7 +22411,9 @@ function registerDesignSchemaPrompt(server) {
                 "Declare each table with `defineModel`, following these conventions:",
                 "- UUID primary keys: `id: field.uuid().primaryKey().defaultRandom()`",
                 "- Timestamps: `createdAt: field.timestamptz().defaultNow().notNull()`",
-                "- Soft delete: a `deletedAt: field.timestamptz()` field opts the table into soft-delete",
+                "- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` \u2014 the flag is what",
+                "  excludes soft-deleted rows from public reads and the data API. The field alone does nothing:",
+                "  visibility is declared, never inferred from a column name",
                 "- Foreign keys via relations: `field.uuid().references(() => Author)` / `belongsTo`/`hasMany`",
                 "- Sensitive columns: `.private()` (hidden from the API); write-guarded: `.readonly()`",
                 "- Named exports (PascalCase model var, e.g. `export const Post = defineModel('posts', \u2026)`)",
@@ -23733,7 +23735,7 @@ async function runGovernanceCli(argv) {
 }
 
 // src/index.ts
-var version2 = (true ? "0.4.2" : null) ?? "0.3.0-dev";
+var version2 = (true ? "0.4.4" : null) ?? "0.3.0-dev";
 var INSTRUCTIONS = [
   "You govern how any agent builds everystack \u2014 a self-hosted application stack for Expo apps on AWS.",
   "Your job is not only to advise but to keep the build on-script: the architecture the maintainer",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/mcp",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Governance layer that governs how any agent builds everystack — grounding, cheat gates, and Model-aware tooling over MCP",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -40,9 +40,9 @@
     "tsx": "4.21.0",
     "typescript": "5.9.3",
     "zod": "3.25.67",
-    "@everystack/cli": "0.4.32",
-    "@everystack/model": "0.4.5",
-    "@everystack/server": "0.4.14"
+    "@everystack/model": "0.4.8",
+    "@everystack/cli": "0.4.43",
+    "@everystack/server": "0.4.15"
   },
   "scripts": {
     "test": "jest",

package/src/prompts/design-schema.ts

@@ -41,7 +41,9 @@ export function registerDesignSchemaPrompt(server: McpServer): void {
                 'Declare each table with `defineModel`, following these conventions:',
                 '- UUID primary keys: `id: field.uuid().primaryKey().defaultRandom()`',
                 '- Timestamps: `createdAt: field.timestamptz().defaultNow().notNull()`',
-                '- Soft delete: a `deletedAt: field.timestamptz()` field opts the table into soft-delete',
+                '- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` — the flag is what',
+                '  excludes soft-deleted rows from public reads and the data API. The field alone does nothing:',
+                '  visibility is declared, never inferred from a column name',
                 '- Foreign keys via relations: `field.uuid().references(() => Author)` / `belongsTo`/`hasMany`',
                 '- Sensitive columns: `.private()` (hidden from the API); write-guarded: `.readonly()`',
                 '- Named exports (PascalCase model var, e.g. `export const Post = defineModel(\'posts\', …)`)',

package/src/resources/cli.md

@@ -42,6 +42,25 @@ everystack db:fingerprint     # Content-address the live base schema vs the Mode
 everystack db:diff            # The state edge between two declared states — no DB, CI-pure
 ```
 
+**Authorization (the brownfield on-ramp + the red team)**
+```bash
+everystack db:authz:pull      # Introspect live authz (rls/grants/policies/secdef) → reviewable contract files
+everystack db:authz:diff      # Live DB vs the committed contract — the CI gate (exit 1 on drift)
+everystack db:authz:test      # Red-team enforcement: SET ROLE + attempt per role/table/command
+everystack db:authz:owner     # Red-team owner isolation: two identities per owner-scoped table (catches IDOR)
+everystack db:authz:report    # Render the committed contract as a human review — no database
+```
+All four DB-touching verbs take `--stage <name>` OR a direct venue: `--database-url <url>`,
+or an inherited `ADMIN_DATABASE_URL`/`DATABASE_URL`. Same SQL, same evaluation, same
+verdict — and every run names the venue it judged, because a security verdict against an
+unintended database is worse than no verdict.
+
+Use the direct venue to **rehearse an authz migration locally**. Translating hand-written
+RLS into Model abilities is the hardest part of adopting the Model system, and iterating
+against a deployed stage makes the loop minutes long instead of seconds. `db:authz:test`
+and `db:authz:owner` WRITE in order to prove a role cannot write; every probe runs inside
+a transaction that is always rolled back, on either venue.
+
 **Safe remote migration (protected stages)**
 ```bash
 everystack db:plan --stage X --out X.plan.json     # Mint a reviewable edge — read-only, ephemeral

package/src/resources/derived-objects.md

@@ -195,6 +195,11 @@ from which git commit), and rebuilds dependents automatically in dependency orde
   Fix the source to match, or rebuild from source with `--overwrite-drift`.
 - **Grant drift converges without ceremony** — a hand-run GRANT/REVOKE surfaces as an
   idempotent `regrant` back to the declared abilities. Declared authz is authoritative.
+- **An authz-only descriptor change is a regrant, not a rebuild** — changing only the grants
+  on a matview (`private` → `abilities: [can('read')]`, body unchanged) applies as a bare
+  GRANT, no recompute. Forward-looking: the first `--apply` after upgrade arms up-to-date
+  objects via a record-only `backfill`, so the *first* authz change on a pre-upgrade row still
+  rebuilds; later ones are cheap. Column-scoped grants still rebuild (attacl isn't drift-checked).
 - **Changing a function REFRESHes the matviews that call it** — their rows are stale the
   moment the function changes, and the reconciler knows it.
 - **Unmanaged objects are never touched** — live derived objects with no source and no

package/src/resources/expo-server-deploy.md

@@ -174,6 +174,9 @@ export default $config({
 
     // The CLI discovers resources through these outputs. The first five are required;
     // backupsBucket unlocks db:backup / db:swap / db:fork (also auto-discovered by bucket name).
+    // databaseInstanceId unlocks the PHYSICAL snapshot path (db:snapshot, and db:swap's default
+    // pre-swap rollback point). Without it db:swap falls back to a logical pg_dump against the same
+    // instance it is about to restore into, which contends with the restore for locks.
     return {
       routerUrl: router.url,
       apiFunctionName: api.name,
@@ -181,6 +184,7 @@ export default $config({
       updatesBucket: updates.name,
       clientBundlesBucket: clientBundles.name,
       backupsBucket: backups.name,
+      databaseInstanceId: database.id,
     };
   },
 });
@@ -207,6 +211,64 @@ everystack db:seed --stage dev               # dev only
 
 Subsequent app-code ships are `everystack update` alone — no `sst deploy`, no Lambda redeploy.
 
+## External / shared RDS (no app VPC)
+
+The minimal config above lets SST create the VPC and the RDS together, and `dbTask` reaches a
+**private** in-VPC database. Some apps are compute-only: VPC-less Lambdas and an **external,
+shared, manually-managed** RDS (often `PubliclyAccessible=true`, in the account's default VPC).
+`dbTask` still works — you just hand it a **bring-your-own VPC object** instead of an `sst.aws.Vpc`.
+
+`sst.aws.Cluster` accepts a plain VPC descriptor (raw AWS ids), so you never call
+`sst.aws.Vpc.get()` (which throws on an untagged default VPC). Requires `@everystack/jobs >= 0.4.2`
+for the `publicIp` option.
+
+```typescript
+const adminDatabaseUrl = new sst.Secret('ADMIN_DATABASE_URL');
+
+const { dbTask } = await import('@everystack/jobs/infra');
+const { task: dbTaskResource } = dbTask({ sst, aws }, 'DbTask', {
+  // BYO-VPC: the RDS's OWN VPC. Put the RDS's security group in `securityGroups` — the Task's SG
+  // then self-references the DB on 5432, so it connects PRIVATELY with no `0.0.0.0/0` opening.
+  vpc: {
+    securityGroups: ['sg-0fca...'],                 // the RDS's security group (self-reference)
+    containerSubnets: ['subnet-a', 'subnet-b'],     // the RDS's VPC subnets (public in a default VPC)
+    loadBalancerSubnets: ['subnet-a', 'subnet-b'],  // required by the type; same subnets are fine
+  },
+  // The default VPC has no NAT, so give the Task an egress public IP to pull its image via the IGW.
+  // It still reaches the RDS privately by SG (above). `publicIp` adds NO inbound security group.
+  publicIp: true,
+  adminDatabaseUrl,
+  pgMajor: 16,
+  link: [backups],
+});
+```
+
+Two requirements on the AWS side:
+
+- **RDS security group must admit the Task.** The clean path is a **self-reference**: the RDS SG
+  allows ingress on 5432 from itself, and the Task uses that same SG. No public-endpoint hop, no
+  `0.0.0.0/0`.
+- **`ADMIN_DATABASE_URL`** points at the RDS (`everystack secrets set ADMIN_DATABASE_URL <url>
+  --stage <stage>`). It is injected via ECS secrets, never linked (a link would leak the password
+  into the task definition).
+- **Deploy IAM (`>= 0.4.3`):** dbTask writes its operator-URL SecureString to
+  `/sst/<app>/<stage>/DbTaskOperatorUrl`, under the `parameter/sst/*` prefix an SST deploy role is
+  already scoped to. A least-privilege deploy principal also needs ECS (cluster + task-def),
+  ECR (auth + repo push), EC2 `Describe*` (subnets/SGs), and `logs:CreateLogGroup` for the task's
+  log group. Override the param path with `paramName` to fit a different scoped prefix.
+
+**Keep `publicIp`, never `public: true`.** SST marks `publicIp` `@deprecated` in favor of `public`,
+but do NOT swap it here: `public: true` attaches an inbound security group open to `0.0.0.0/0` on
+ALL protocols and demands `vpc.publicSubnets`. `publicIp: true` gives an egress IP with no inbound
+rule — exactly what an outbound-only pg-binary task needs. (One inert side effect either way: when
+the Task's SG is the RDS's own, the Task ENI inherits the RDS SG's inbound rules — often
+`5432 from 0.0.0.0/0` for a public RDS — but nothing in the container listens, so it is unreachable.)
+
+Fallback (no BYO-VPC change): stand up a minimal `new sst.aws.Vpc('DbVpc')` (no NAT) and let the
+Task reach the RDS over its **public endpoint** + TLS. This needs the RDS SG to admit the Task's
+*dynamic* Fargate public IP — practically `0.0.0.0/0:5432`, mitigated by TLS + the operator
+credential. Prefer the private SG-self-reference above; use the public endpoint only as an interim.
+
 ## Gotchas
 
 - **Nothing serves until the first `everystack update`** — the fallback has no bundle to download yet, so `/` returns 404 while `/api` (plugin-claimed) already works.