@everystack/model 0.4.11 → 0.4.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/model",
-  "version": "0.4.11",
+  "version": "0.4.12",
   "description": "Declare a table's schema, validation, and authorization once — compiled to migrations, RLS, and handler config",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/index.ts

@@ -12,6 +12,8 @@ export type { FieldSpec, FieldType, DefaultKind, ReferentialAction } from './fie
 
 export { canonicalColumnType, fieldFactoryCall, pgTypeRefusal } from './pg-type';
 
+export { parseQualified } from './qualified';
+
 export { unique, check, index, foreignKey, IndexBuilder } from './constraints';
 export type { TableConstraint } from './constraints';
 

package/src/module.ts

@@ -22,6 +22,8 @@
 import type { ModelDescriptor } from './model';
 import type { DerivedDescriptor, SequenceDescriptor } from './derived';
 import { rejectHoles, functionArgSignature } from './derived';
+import { deriveFunctionSchemas } from './derive';
+import { parseQualified } from './qualified';
 
 export interface ModuleDefinition {
   /** The package's Models (schema + authz). */
@@ -114,6 +116,7 @@ export function defineModule(def: ModuleDefinition): Module {
     }
     seen.add(identity);
   }
+  assertFunctionsAreDeclared(def);
   return {
     models: def.models ?? [],
     extensions: def.extensions ?? [],
@@ -124,6 +127,75 @@ export function defineModule(def: ModuleDefinition): Module {
   };
 }
 
+/**
+ * `writtenBy: 'functions'` is a PROMISE that functions do the writing. This is where the
+ * promise gets checked.
+ *
+ * The defect it closes, found 2026-08-04: `@everystack/auth` declared seven models
+ * `writtenBy: 'functions'` and shipped 21 SECURITY DEFINER functions — through the deprecated
+ * `functions` thunk, which exactly ONE command reads (`db:generate --init`). `db:reconcile`
+ * reads `derived`, and `derived` was empty. So a brownfield adopter installed the tables, got
+ * ENABLE-not-FORCE RLS on the strength of `writtenBy: 'functions'`, installed none of the
+ * functions that were supposed to be the only writers, and every gate reported clean. The
+ * declaration and the thing it depends on were checked by nobody.
+ *
+ * The check is per-MODULE, not across the composed set: a module that owns a
+ * functions-written model owns the functions that write it, and firing here can name the
+ * module at fault. Across modules the error arrives after everything is flattened and can
+ * only say that something, somewhere, is missing.
+ *
+ * A thunk downgrades the error to a warning rather than satisfying the check — the thunk lane
+ * does install, just on one command, so a consumer still on it is degraded and not broken.
+ */
+function assertFunctionsAreDeclared(def: ModuleDefinition): void {
+  const models = def.models ?? [];
+  const owed = deriveFunctionSchemas(models);
+  const declared = new Set(
+    (def.derived ?? [])
+      .filter((d) => (d.kind === 'sql' ? d.objectKind : d.kind) === 'function')
+      .map((d) => parseQualified(d.name).schema),
+  );
+  const missing = owed.filter((schema) => !declared.has(schema));
+
+  if (missing.length === 0) {
+    if (def.functions) {
+      console.warn(
+        'defineModule: the `functions` thunk is deprecated and only `db:generate --init` reads it — '
+        + '`db:reconcile` reads `derived`, so anything declared there alone never reaches a brownfield '
+        + 'database. Move it to `derived: [defineFunction(…)]`.',
+      );
+    }
+    return;
+  }
+
+  const blame = missing
+    .map((schema) => {
+      const tables = models
+        .filter((m) => m.writtenBy === 'functions' && m.schema === schema)
+        .map((m) => `${m.schema}.${m.table}`)
+        .sort();
+      return `schema '${schema}' (${tables.join(', ')})`;
+    })
+    .join('; ');
+
+  if (def.functions) {
+    console.warn(
+      `defineModule: ${blame} declares writtenBy: 'functions' but every function is in the deprecated `
+      + '`functions` thunk, which only `db:generate --init` reads. `db:reconcile` reads `derived`, so a '
+      + 'brownfield database gets the tables and none of their writers. Move them to '
+      + '`derived: [defineFunction(…)]`.',
+    );
+    return;
+  }
+
+  throw new Error(
+    `defineModule: ${blame} declares writtenBy: 'functions' but the module declares no function in `
+    + `that schema. writtenBy: 'functions' is what turns RLS FORCE off, so the tables ship writable `
+    + `only by functions that do not exist. Declare them as \`derived: [defineFunction('${missing[0]}.…', …)]\`, `
+    + `or change writtenBy if functions are not the writer.`,
+  );
+}
+
 /** The flattened model list across modules — for everything that still takes a model array
  *  (handler-config derivation, FORCE carveouts, the drift guard). */
 export function moduleModels(modules: Module[]): ModelDescriptor[] {

package/src/qualified.ts

@@ -0,0 +1,34 @@
+/**
+ * Splitting a declared name into `{ schema, name }`.
+ *
+ * This lives in `@everystack/model` because the names it parses are MODEL vocabulary: a
+ * descriptor declares `defineFunction('auth.sign_in_session', …)` and a model declares its
+ * `schema` separately, so anything that has to line those two up — the composition guard here,
+ * every emitter and the reconciler in `@everystack/cli` — must agree on where the dot is. The
+ * cli re-exports this from `derived-source.ts`, so there is ONE definition and its callers
+ * cannot drift apart. (Same reasoning as `fieldFactoryCall`: the parser belongs with the
+ * vocabulary it parses, not with the first consumer that needed it.)
+ *
+ * `public` is the unqualified default because that is what PostgreSQL resolves a bare name to
+ * under the default `search_path` — the parse must match the server, not a convention.
+ */
+
+/** Strip quotes from an identifier and split an optionally schema-qualified name. */
+export function parseQualified(raw: string): { schema: string; name: string } {
+  const parts: string[] = [];
+  let current = '';
+  let quoted = false;
+  for (let i = 0; i < raw.length; i++) {
+    const ch = raw[i];
+    if (ch === '"') {
+      if (quoted && raw[i + 1] === '"') { current += '"'; i++; continue; }
+      quoted = !quoted;
+      continue;
+    }
+    if (ch === '.' && !quoted) { parts.push(current); current = ''; continue; }
+    current += ch;
+  }
+  parts.push(current);
+  if (parts.length >= 2) return { schema: parts[0], name: parts.slice(1).join('.') };
+  return { schema: 'public', name: parts[0] };
+}