@everystack/mcp 0.4.5 → 0.4.7

package/dist/core.md

@@ -104,7 +104,7 @@ const handler = createHandler(db, schema, {
   protectedFields: { profiles: ['role'] },      // Strip from writes
   rowOwnership: { posts: { column: 'authorId', userField: 'sub' } },
   hooks: { posts: { beforeCreate: async (body, user) => ({ ...body, authorId: user?.sub }) } },
-  softDelete: { column: 'deletedAt', tables: ['posts'] },
+  softDelete: { column: 'deletedAt', tables: ['posts'] },  // Models: derived, don't hand-write
   maxEmbedDepth: 3,
   maxLimit: 1000,
 });

package/dist/handler-options.md

@@ -100,6 +100,7 @@ maxLimit: 1000,        // Max ?limit= value (default: 10000)
 ### Other
 ```typescript
 softDelete: { column: 'deletedAt', tables: ['posts'] },  // DELETE -> UPDATE SET deletedAt
+// ^ With Models this is DERIVED from each model's `softDelete: true` — do not hand-write it.
 naming: 'snake_case',  // Response key format ('camelCase' default)
 ```
 

package/dist/index.cjs

@@ -22411,9 +22411,12 @@ function registerDesignSchemaPrompt(server) {
                 "Declare each table with `defineModel`, following these conventions:",
                 "- UUID primary keys: `id: field.uuid().primaryKey().defaultRandom()`",
                 "- Timestamps: `createdAt: field.timestamptz().defaultNow().notNull()`",
-                "- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` \u2014 the flag is what",
-                "  excludes soft-deleted rows from public reads and the data API. The field alone does nothing:",
-                "  visibility is declared, never inferred from a column name",
+                "- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` \u2014 the field alone",
+                "  does nothing. The flag decides DURABILITY (true makes DELETE mark deleted_at instead of",
+                "  destroying the row, and hides marked rows from the data API) and, where there is a public",
+                "  read, VISIBILITY (deleted_at IS NULL in the anon policy). defineModel REFUSES to guess on any",
+                "  model with deletedAt that has a public read or can be deleted from, so it throws at import if",
+                "  you omit it. Never hand-write the handler softDelete config \u2014 it is derived from this flag",
                 "- Foreign keys via relations: `field.uuid().references(() => Author)` / `belongsTo`/`hasMany`",
                 "- Sensitive columns: `.private()` (hidden from the API); write-guarded: `.readonly()`",
                 "- Named exports (PascalCase model var, e.g. `export const Post = defineModel('posts', \u2026)`)",
@@ -23521,11 +23524,37 @@ var secretInPublicEnv = {
   }
 };
 
+// src/gates/detectors/stage-name-as-trust-boundary.ts
+var STAGE_COMPARISON = /\b(?:ENVIRONMENT|environment|stage)\s*[=!]==\s*['"](?:dev|development|prod|production|staging|local)['"]/;
+var SECURITY_CONTEXT = /\b(?:details|error|stack|message|throw|drop|reset|seed|truncate|delete|secret|token|password|credential|auth|admin|bypass|skip|allow|disable|unsafe|insecure)/i;
+var stageNameAsTrustBoundary = {
+  id: "stage-name-as-trust-boundary",
+  tier: "framework",
+  severity: "deny",
+  guide: "A stage name is not a trust boundary \u2014 ENVIRONMENT comes from $app.stage, so this asks what someone named the stage, not whether the caller is trusted. Gate on an explicit option that defaults to the safe answer, and never return error text to a caller: return the requestId instead.",
+  conform: "an explicit opt-in on the handler/plugin options (see config.allowDevelopment in @everystack/security apple-attest); for error responses, return { error, requestId } and debug with everystack logs:query --traceId <id>",
+  verify: "pnpm --filter @everystack/server test \u2014 __tests__/error-response.test.ts fails on any stage-name gate",
+  async detect(ctx) {
+    if (ctx.tool !== "Write" && ctx.tool !== "Edit") return null;
+    const text = ctx.content;
+    if (!text || !/ENVIRONMENT|environment|stage/.test(text)) return null;
+    const lines = text.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      if (!STAGE_COMPARISON.test(lines[i])) continue;
+      const window = lines.slice(i, i + 3).join(" ");
+      if (!SECURITY_CONTEXT.test(window)) continue;
+      return `line ${i + 1} gates behaviour on the stage name (${lines[i].trim().slice(0, 80)}) \u2014 ENVIRONMENT comes from $app.stage, so this is a deployment label, not a trust decision`;
+    }
+    return null;
+  }
+};
+
 // src/gates/registry.ts
 var FRAMEWORK_GATES = [
   handWrittenMigration,
   embeddedDataBundle,
-  secretInPublicEnv
+  secretInPublicEnv,
+  stageNameAsTrustBoundary
 ];
 function gatesFor(_cwd) {
   return FRAMEWORK_GATES;
@@ -23735,7 +23764,7 @@ async function runGovernanceCli(argv) {
 }
 
 // src/index.ts
-var version2 = (true ? "0.4.5" : null) ?? "0.3.0-dev";
+var version2 = (true ? "0.4.7" : null) ?? "0.3.0-dev";
 var INSTRUCTIONS = [
   "You govern how any agent builds everystack \u2014 a self-hosted application stack for Expo apps on AWS.",
   "Your job is not only to advise but to keep the build on-script: the architecture the maintainer",

package/dist/schema-patterns.md

@@ -34,6 +34,9 @@ export const Post = defineModel('posts', {
     updatedAt: field.timestamptz().notNull().defaultNow(),
     deletedAt: field.timestamptz(),
   },
+  // Required here, not optional: this model has a `deletedAt` field AND grants DELETE, so
+  // `defineModel` refuses to guess. See Soft Delete below for what each value means.
+  softDelete: true,
   abilities: [can('read'), can('create'), can('update'), can('delete')],
 });
 ```
@@ -59,11 +62,34 @@ updatedAt: field.timestamptz().notNull().defaultNow(),
 ```
 
 ### Soft Delete
-Add `deletedAt` for soft-deletable tables:
+The field alone does nothing. Declare BOTH — the column and what it means:
 ```typescript
 deletedAt: field.timestamptz(),
+softDelete: true,   // on the model, beside `fields` — NOT in the handler
 ```
-Configure in handler: `softDelete: { column: 'deletedAt', tables: ['posts'] }`.
+
+**`defineModel` REFUSES to guess** when a model has `deletedAt` and either a public read or a
+way to DELETE (`can('delete')`, `can('manage')` — which is "all actions" — or a `privileges`
+DELETE grant). Omit the line on such a model and it throws at import.
+
+It is declared because it changes two different things, and neither default is safe:
+
+- **Durability, on every model** — `true` makes a `DELETE` mark `deleted_at` instead of
+  removing the row, and then hides marked rows from the data API's reads and updates. `false`
+  makes `DELETE` permanent.
+- **Visibility, only where there is a public read** — `true` AND-s `deleted_at IS NULL` into
+  the anon policy. On an owner-scoped or admin-only model the compiled SQL is identical either
+  way, so the durability half is the one that matters there.
+
+Pick `true` if the row is meant to survive its own deletion — anything with a cleanup or purge
+job, an audit trail, or rows other tables reference. Pick `false` if `deleted_at` here is
+audit-only and a `DELETE` really should remove the row. Getting this wrong is not cosmetic: a
+table whose S3 cleanup job finds work by `deleted_at IS NOT NULL` orphans every file it should
+have purged if the row is hard-deleted instead.
+
+**Do not hand-write the handler's `softDelete: { column, tables }`.** With Models, the handler
+config is DERIVED from this flag (`deriveHandlerConfig`), so writing both is how the two drift
+apart — and a hand-written list silently losing a table is exactly how this bug shipped.
 
 ### Foreign Keys
 ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/mcp",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Governance layer that governs how any agent builds everystack — grounding, cheat gates, and Model-aware tooling over MCP",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -40,9 +40,9 @@
     "tsx": "4.21.0",
     "typescript": "5.9.3",
     "zod": "3.25.67",
-    "@everystack/cli": "0.4.48",
-    "@everystack/server": "0.4.18",
-    "@everystack/model": "0.4.12"
+    "@everystack/cli": "0.4.57",
+    "@everystack/model": "0.4.16",
+    "@everystack/server": "0.4.20"
   },
   "scripts": {
     "test": "jest",

package/src/gates/detectors/stage-name-as-trust-boundary.ts

@@ -0,0 +1,70 @@
+/**
+ * Cheat: a stage name used as a trust boundary.
+ *
+ * `ENVIRONMENT` is set from `$app.stage` by the SST helper, so `ENVIRONMENT === 'dev'` does not
+ * ask "is this caller trusted" — it asks "what did someone call this stage". The two questions
+ * look identical in a diff and diverge the moment a stage named `dev` is publicly reachable.
+ *
+ * This shipped in the framework and reached two consumers, neither of whom chose anything but a
+ * stage name: a 500 returned raw PostgreSQL text — relation and column names — to unauthenticated
+ * callers. It survived its first fix because the condition had been COPIED into a second file and
+ * only one was found, which is why this is a gate and not a note in a review checklist.
+ *
+ * The correct shape is next door in `@everystack/security`: apple-attest reads the environment
+ * from the attestation CERTIFICATE (a fact about the client, not a deployment label) and still
+ * requires an explicit `config.allowDevelopment` to relax. Derive the fact from something
+ * trustworthy, then require an opt-in that fails closed.
+ */
+
+import type { CheatGate, ToolCallContext } from '../types.js';
+
+/**
+ * A stage/environment label compared against a deployment name. Covers the spellings that have
+ * actually appeared: `process.env.ENVIRONMENT === 'dev'`, `ctx.environment !== 'dev'`, and the
+ * inverted `!== 'production'` form that reads as "anywhere but prod".
+ */
+const STAGE_COMPARISON =
+  /\b(?:ENVIRONMENT|environment|stage)\s*[=!]==\s*['"](?:dev|development|prod|production|staging|local)['"]/;
+
+/**
+ * Security-relevant company on the same line or nearby: what makes a stage comparison a GATE
+ * rather than a label choice. Picking which docs string to print by stage is fine; deciding what
+ * a caller may see, or whether a destructive verb runs, is not.
+ */
+// No trailing \b: these appear camelCased far more often than bare — `skipAuth`, `allowInsecure`,
+// `disableRls`, `adminOnly`. Requiring a word boundary on the right made the detector miss
+// `if (ENVIRONMENT !== 'production') { skipAuth = true }`, which is the exact shape it exists for.
+const SECURITY_CONTEXT =
+  /\b(?:details|error|stack|message|throw|drop|reset|seed|truncate|delete|secret|token|password|credential|auth|admin|bypass|skip|allow|disable|unsafe|insecure)/i;
+
+export const stageNameAsTrustBoundary: CheatGate = {
+  id: 'stage-name-as-trust-boundary',
+  tier: 'framework',
+  severity: 'deny',
+  guide:
+    'A stage name is not a trust boundary — ENVIRONMENT comes from $app.stage, so this asks what someone named the stage, not whether the caller is trusted. Gate on an explicit option that defaults to the safe answer, and never return error text to a caller: return the requestId instead.',
+  conform:
+    'an explicit opt-in on the handler/plugin options (see config.allowDevelopment in @everystack/security apple-attest); for error responses, return { error, requestId } and debug with everystack logs:query --traceId <id>',
+  verify:
+    'pnpm --filter @everystack/server test — __tests__/error-response.test.ts fails on any stage-name gate',
+
+  async detect(ctx: ToolCallContext): Promise<string | null> {
+    if (ctx.tool !== 'Write' && ctx.tool !== 'Edit') return null;
+    const text = ctx.content;
+    // Cheap pre-filter: only content naming a stage label pays for the line scan.
+    if (!text || !/ENVIRONMENT|environment|stage/.test(text)) return null;
+
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (!STAGE_COMPARISON.test(lines[i])) continue;
+
+      // The comparison alone is not the cheat — `channel = ENVIRONMENT` is legitimate. Look at the
+      // line and the two after it, which is where the guarded body sits.
+      const window = lines.slice(i, i + 3).join(' ');
+      if (!SECURITY_CONTEXT.test(window)) continue;
+
+      return `line ${i + 1} gates behaviour on the stage name (${lines[i].trim().slice(0, 80)}) — ENVIRONMENT comes from $app.stage, so this is a deployment label, not a trust decision`;
+    }
+    return null;
+  },
+};

package/src/gates/registry.ts

@@ -11,12 +11,14 @@ import type { CheatGate } from './types.js';
 import { handWrittenMigration } from './detectors/hand-written-migration.js';
 import { embeddedDataBundle } from './detectors/embedded-data-bundle.js';
 import { secretInPublicEnv } from './detectors/secret-in-public-env.js';
+import { stageNameAsTrustBoundary } from './detectors/stage-name-as-trust-boundary.js';
 
 /** Framework-tier gates, on by default. */
 export const FRAMEWORK_GATES: CheatGate[] = [
   handWrittenMigration,
   embeddedDataBundle,
   secretInPublicEnv,
+  stageNameAsTrustBoundary,
 ];
 
 /** The gates that apply to a working directory. Project-tier composition is added later. */

package/src/prompts/design-schema.ts

@@ -41,9 +41,12 @@ export function registerDesignSchemaPrompt(server: McpServer): void {
                 'Declare each table with `defineModel`, following these conventions:',
                 '- UUID primary keys: `id: field.uuid().primaryKey().defaultRandom()`',
                 '- Timestamps: `createdAt: field.timestamptz().defaultNow().notNull()`',
-                '- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` — the flag is what',
-                '  excludes soft-deleted rows from public reads and the data API. The field alone does nothing:',
-                '  visibility is declared, never inferred from a column name',
+                '- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` — the field alone',
+                '  does nothing. The flag decides DURABILITY (true makes DELETE mark deleted_at instead of',
+                '  destroying the row, and hides marked rows from the data API) and, where there is a public',
+                '  read, VISIBILITY (deleted_at IS NULL in the anon policy). defineModel REFUSES to guess on any',
+                '  model with deletedAt that has a public read or can be deleted from, so it throws at import if',
+                '  you omit it. Never hand-write the handler softDelete config — it is derived from this flag',
                 '- Foreign keys via relations: `field.uuid().references(() => Author)` / `belongsTo`/`hasMany`',
                 '- Sensitive columns: `.private()` (hidden from the API); write-guarded: `.readonly()`',
                 '- Named exports (PascalCase model var, e.g. `export const Post = defineModel(\'posts\', …)`)',

package/src/resources/core.md

@@ -104,7 +104,7 @@ const handler = createHandler(db, schema, {
   protectedFields: { profiles: ['role'] },      // Strip from writes
   rowOwnership: { posts: { column: 'authorId', userField: 'sub' } },
   hooks: { posts: { beforeCreate: async (body, user) => ({ ...body, authorId: user?.sub }) } },
-  softDelete: { column: 'deletedAt', tables: ['posts'] },
+  softDelete: { column: 'deletedAt', tables: ['posts'] },  // Models: derived, don't hand-write
   maxEmbedDepth: 3,
   maxLimit: 1000,
 });

package/src/resources/handler-options.md

@@ -100,6 +100,7 @@ maxLimit: 1000,        // Max ?limit= value (default: 10000)
 ### Other
 ```typescript
 softDelete: { column: 'deletedAt', tables: ['posts'] },  // DELETE -> UPDATE SET deletedAt
+// ^ With Models this is DERIVED from each model's `softDelete: true` — do not hand-write it.
 naming: 'snake_case',  // Response key format ('camelCase' default)
 ```
 

package/src/resources/schema-patterns.md

@@ -34,6 +34,9 @@ export const Post = defineModel('posts', {
     updatedAt: field.timestamptz().notNull().defaultNow(),
     deletedAt: field.timestamptz(),
   },
+  // Required here, not optional: this model has a `deletedAt` field AND grants DELETE, so
+  // `defineModel` refuses to guess. See Soft Delete below for what each value means.
+  softDelete: true,
   abilities: [can('read'), can('create'), can('update'), can('delete')],
 });
 ```
@@ -59,11 +62,34 @@ updatedAt: field.timestamptz().notNull().defaultNow(),
 ```
 
 ### Soft Delete
-Add `deletedAt` for soft-deletable tables:
+The field alone does nothing. Declare BOTH — the column and what it means:
 ```typescript
 deletedAt: field.timestamptz(),
+softDelete: true,   // on the model, beside `fields` — NOT in the handler
 ```
-Configure in handler: `softDelete: { column: 'deletedAt', tables: ['posts'] }`.
+
+**`defineModel` REFUSES to guess** when a model has `deletedAt` and either a public read or a
+way to DELETE (`can('delete')`, `can('manage')` — which is "all actions" — or a `privileges`
+DELETE grant). Omit the line on such a model and it throws at import.
+
+It is declared because it changes two different things, and neither default is safe:
+
+- **Durability, on every model** — `true` makes a `DELETE` mark `deleted_at` instead of
+  removing the row, and then hides marked rows from the data API's reads and updates. `false`
+  makes `DELETE` permanent.
+- **Visibility, only where there is a public read** — `true` AND-s `deleted_at IS NULL` into
+  the anon policy. On an owner-scoped or admin-only model the compiled SQL is identical either
+  way, so the durability half is the one that matters there.
+
+Pick `true` if the row is meant to survive its own deletion — anything with a cleanup or purge
+job, an audit trail, or rows other tables reference. Pick `false` if `deleted_at` here is
+audit-only and a `DELETE` really should remove the row. Getting this wrong is not cosmetic: a
+table whose S3 cleanup job finds work by `deleted_at IS NOT NULL` orphans every file it should
+have purged if the row is hard-deleted instead.
+
+**Do not hand-write the handler's `softDelete: { column, tables }`.** With Models, the handler
+config is DERIVED from this flag (`deriveHandlerConfig`), so writing both is how the two drift
+apart — and a hand-written list silently losing a table is exactly how this bug shipped.
 
 ### Foreign Keys
 ```typescript