@everystack/server 0.4.12 → 0.4.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -159,9 +159,9 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/pg-tools": "0.4.1",
     "@everystack/auth": "0.4.0",
-    "@everystack/cli": "0.4.28"
+    "@everystack/pg-tools": "0.4.1",
+    "@everystack/cli": "0.4.29"
   },
   "scripts": {
     "test": "jest",

package/src/provision.ts

@@ -20,7 +20,7 @@
  * without a database; plugin.ts wires the real deps.
  */
 
-import { generateRoleChainSQL, generateAdminRoleSQL } from './role-chain';
+import { generateRoleChainSQL, generateAdminRoleSQL, generateSearchPathSQL } from './role-chain';
 
 export interface ProvisionPayload {
   /** Password for the least-privilege API login. Alphanumeric only. */
@@ -30,6 +30,13 @@ export interface ProvisionPayload {
   loginRole?: string;
   adminRole?: string;
   appRoles?: string[];
+  /**
+   * The declared schema set (ordered, deduped, ending in 'public' — declaredSearchPath). When
+   * present, provision sets it as the ROLE default (ALTER ROLE … SET search_path) on both login
+   * roles, so bare refs resolve without a URL param (the search-path-ownership design). Absent or
+   * empty = all-public app, no path set (byte-identical to the pre-search-path-ownership behavior).
+   */
+  searchPath?: string[];
 }
 
 export interface ProvisionDeps {
@@ -59,7 +66,7 @@ export async function runProvision(
   payload: ProvisionPayload,
   deps: ProvisionDeps,
 ): Promise<ProvisionResult> {
-  const { authPassword, adminPassword, loginRole, adminRole, appRoles } = payload;
+  const { authPassword, adminPassword, loginRole, adminRole, appRoles, searchPath } = payload;
 
   // Passwords are generated (RandomPassword special:false / hex) — reject anything else
   // BEFORE any DDL runs, so nothing untrusted is interpolated into an ALTER ROLE literal.
@@ -89,11 +96,21 @@ export async function runProvision(
     passwordSet: false,
   };
 
+  // The role-default search_path (search-path-ownership): set it on the login role now that it
+  // exists. The right layer — a clean connection secret, bare refs resolved for every direct
+  // connection, and it persists through the API's SET ROLE. No-op for an all-public app.
+  const searchPathSql = searchPath ? generateSearchPathSQL(login, searchPath) : null;
+  if (searchPathSql) await deps.execute(searchPathSql);
+
   // Admin side FIRST — created and verified before the authenticator swap can happen.
   if (adminPassword && adminSql) {
     const admin = adminRole ?? 'migrator';
     await deps.execute(adminSql);
     await deps.execute(`ALTER ROLE ${admin} WITH LOGIN PASSWORD '${adminPassword}';`);
+    // The operator role gets the same role-default search_path — this is the role db:swap/apply/
+    // reconcile --direct connect as, so a clean URL (no ?search_path=) still resolves bare refs.
+    const adminSearchPathSql = searchPath ? generateSearchPathSQL(admin, searchPath) : null;
+    if (adminSearchPathSql) await deps.execute(adminSearchPathSql);
     result.adminRole = admin;
     result.adminPasswordSet = true;
 

package/src/role-chain.ts

@@ -74,6 +74,27 @@ export function generateRoleChainSQL(options: RoleChainOptions = {}): string {
   return lines.join('\n') + '\n';
 }
 
+/**
+ * `ALTER ROLE <role> SET search_path = <schemas>` — the role-default search_path
+ * (docs/plans/search-path-ownership.md). This is the RIGHT layer for a multi-schema app's
+ * bare-reference resolution: it lives on the ROLE, not baked into the connection secret. Every
+ * direct connection (psql, pg_restore, local scripts, the `--direct` write lanes) then resolves
+ * bare refs with a CLEAN connection URL — no `?search_path=` query param, which libpq rejects as
+ * an unknown keyword (the db:swap --direct break). Persists through `SET ROLE` (proven: search_path
+ * is a session GUC, SET ROLE does not reset it), so the API's authenticator login carries it to the
+ * app roles it switches to. Schema tooling resets to canonical per session (withCanonicalSearchPath),
+ * so regclass defaults still render qualified and the role default never causes false drift.
+ *
+ * Idempotent (ALTER ROLE SET is last-writer-wins). Returns null for an all-public app (no path
+ * needed) — byte-identical to today. `searchPath` is the ORDERED, deduped list (declaredSearchPath).
+ */
+export function generateSearchPathSQL(role: string, searchPath: string[]): string | null {
+  assertIdent(role, 'role');
+  if (!searchPath.length) return null;
+  searchPath.forEach((s) => assertIdent(s, 'schema'));
+  return `ALTER ROLE ${role} SET search_path = ${searchPath.join(', ')};\n`;
+}
+
 export interface AdminRoleOptions {
   /**
    * The LOGIN role operator tasks (migrate/seed/DDL/console) connect as — the OTHER half