@everystack/server 0.4.29 → 0.4.30

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `@everystack/server` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.30] - 2026-09-04
+
+### Fixed
+
+- ADOPT resolves its master from ADMIN_DATABASE_URL on a BYO/external RDS
+
 ## [0.4.29] - 2026-09-04
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.29",
+  "version": "0.4.30",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -187,8 +187,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/cli": "0.4.71",
-    "@everystack/auth": "0.4.4"
+    "@everystack/auth": "0.4.4",
+    "@everystack/cli": "0.4.71"
   },
   "scripts": {
     "test": "jest",

package/src/db.ts

@@ -150,6 +150,26 @@ export function getOperatorDatabaseUrl(): { url: string; source: 'admin' | 'mast
   return null;
 }
 
+/**
+ * The connection ADOPT (ownership reassignment) runs on: the linked SST Postgres master when one is
+ * present, else the `ADMIN_DATABASE_URL` operator secret.
+ *
+ * A brownfield / external-RDS app — the exact `db:pull --abilities live` audience — has NO linked
+ * `sst.aws.Postgres` component. It wires the database as secrets, and its `ADMIN_DATABASE_URL` is a
+ * privileged operator (commonly BYPASSRLS and a member of `postgres`, i.e. master-capable) that the
+ * ops Lambda already carries. Resolving ADOPT's master ONLY through the component dead-ended those
+ * apps on the missing component. This falls back to the admin secret so ADOPT has a connection to
+ * try. Whether that connection can ACTUALLY reassign is NOT decided here — ADOPT's live
+ * `master_can_act` probe decides it: a least-privilege admin resolves but the probe then refuses
+ * precisely (naming the grant to run), while a master-capable admin proceeds.
+ *
+ * `master` (linked component) is preferred because its presence guarantees master capability; the
+ * admin fallback is probe-gated. Never the least-privilege `DATABASE_URL`.
+ */
+export function getAdoptMasterUrl(): string | null {
+  return getMasterDatabaseUrl() ?? getAdminDatabaseUrl();
+}
+
 export function getJwtSecret(): Uint8Array {
   // PascalCase Secret (SST_RESOURCE_JwtSecret → { value })
   const pascal = sstLink('JwtSecret')?.value as string | undefined;

package/src/plugin.ts

@@ -882,7 +882,7 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
     actions['db:converge-ownership'] = async (payload, _ctx) => {
       const { sql } = await import('drizzle-orm');
       const { convergeOwnership } = await import('./provision');
-      const { getMasterDatabaseUrl } = await import('./db');
+      const { getAdoptMasterUrl } = await import('./db');
 
       const queryRows = async (statement: string): Promise<any[]> => {
         const res: any = await opsDb.execute(sql.raw(statement));
@@ -891,10 +891,12 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
         return [];
       };
 
-      // The MASTER connection (linked RDS master), when linked — ENACT routes to it the grants the
-      // operator cannot make, and ADOPT requires it outright. Absent on a BYO-database app: master
-      // stays null and ADOPT refuses with the fix SQL. Opened for this invoke, closed in the finally.
-      const masterUrl = getMasterDatabaseUrl();
+      // The MASTER connection ADOPT reassigns through: the linked SST Postgres master, else the
+      // ADMIN_DATABASE_URL operator secret (a brownfield/external-RDS app has no component but wires
+      // a master-capable admin — see getAdoptMasterUrl). ENACT also routes hard grants here. Null
+      // only when NEITHER exists; then ADOPT refuses. Whether the resolved connection can actually
+      // reassign is decided by ADOPT's live probe, not by which source won. Closed in the finally.
+      const masterUrl = getAdoptMasterUrl();
       let masterClient: any = null;
       let master: { execute: (s: string) => Promise<unknown>; query: (s: string) => Promise<any[]> } | null = null;
       if (masterUrl) {

package/src/provision.ts

@@ -418,13 +418,15 @@ async function adoptOwners(
   const vRefusal = pgVersionRefusal(Number(vRow?.v ?? 0));
   if (vRefusal) return { ...EMPTY_ADOPTION, refusals: [vRefusal] };
 
-  // ADOPT cannot run as the least-privilege operator (it would need INHERIT membership in the
-  // current owner `postgres`, which is the master). No master → a precise refusal, never an attempt.
+  // ADOPT reassigns on a master-capable connection (the linked SST Postgres master, else the
+  // ADMIN_DATABASE_URL operator secret — see getAdoptMasterUrl). A connection is present unless the
+  // app configures NEITHER. Its actual capability is probed below; this refusal is only the
+  // no-connection-at-all case.
   if (!deps.master) {
     return { ...EMPTY_ADOPTION, refusals: [
-      'ADOPT requires the master connection — the least-privilege operator cannot reassign a ' +
-      'postgres-owned object. Link an sst.aws.Postgres component (the master fallback), or run the ' +
-      'ALTER … OWNER TO statements as the master by hand.',
+      'ADOPT has no master-capable connection to reassign through. Provide an ADMIN_DATABASE_URL ' +
+      'secret for the stage (a privileged operator that owns/administers the objects), or link an ' +
+      'sst.aws.Postgres component. The least-privilege DATABASE_URL cannot reassign a postgres-owned object.',
     ] };
   }