@everystack/server 0.4.32 → 0.4.34

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to `@everystack/server` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.34] - 2026-09-27
+
+### Added
+
+- apply state prerequisites atomically
+
+### Fixed
+
+- govern state prerequisites
+
+## [0.4.33] - 2026-09-24
+
+### BREAKING CHANGES
+
+- a declared owner needs USAGE on its schema; db:apply refuses without it, db:provision (server 0.4.33) grants it
+
+### Fixed
+
+- name USAGE with CREATE for a missing schema; review follow-ups
+- reject offset-less datetime strings (ambiguous: server-local, not UTC)
+
 ## [0.4.32] - 2026-09-21
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.32",
+  "version": "0.4.34",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -187,8 +187,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/auth": "0.4.5",
-    "@everystack/cli": "0.4.87"
+    "@everystack/cli": "0.4.98",
+    "@everystack/auth": "0.4.8"
   },
   "scripts": {
     "test": "jest",

package/src/owner-enactment.ts

@@ -11,6 +11,9 @@
  *      explicit SET ROLE, never inheriting the owner's privileges ambiently.
  *   2. `GRANT CREATE ON SCHEMA <schema> TO <owner>` — so the CREATE, which runs AS the owner,
  *      can place the object.
+ *   3. `GRANT USAGE ON SCHEMA <schema> TO <owner>` — so the owner's GRANT/REVOKE on that object,
+ *      which name it as `schema.object`, can resolve it. CREATE alone let the CREATE through and
+ *      then failed the object's own `REVOKE ALL … FROM PUBLIC` with `permission denied for schema`.
  *
  * These are privileged, idempotent SETUP — the same category as the role chain — so they belong
  * in db:provision, not in the least-privilege reconcile lane (which structurally cannot run them).
@@ -75,6 +78,8 @@ export interface OwnerFactRow {
   canSetRole: boolean;
   /** The owner already holds `CREATE` on the schema — no create grant needed. */
   ownerCanCreate: boolean;
+  /** The owner already holds `USAGE` on the schema — no usage grant needed. */
+  ownerCanUse: boolean;
 }
 
 /**
@@ -88,6 +93,8 @@ export interface GranterCapabilityRow {
   schema: string;
   canGrantMembership: boolean;
   canGrantCreate: boolean;
+  /** Can `GRANT USAGE ON SCHEMA` — owns the schema, holds USAGE WITH GRANT OPTION, or is a superuser. */
+  canGrantUsage: boolean;
 }
 
 /** Which connection runs a unit's statements. */
@@ -175,7 +182,8 @@ function assertIdent(name: string, what: string): void {
 
 /**
  * The connection-independent probe: for each (owner, schema), does the owner exist, does the
- * schema exist, can `operator` already SET ROLE the owner, and does the owner already hold CREATE.
+ * schema exist, can `operator` already SET ROLE the owner, and does the owner already hold CREATE
+ * and USAGE.
  * `has_schema_privilege` throws on an absent schema, so the schema is LEFT JOINed and the privilege
  * is evaluated only when the schema is really there. Run once, on either connection.
  */
@@ -195,7 +203,9 @@ SELECT
   (n.oid IS NOT NULL) AS schema_exists,
   CASE WHEN r.oid IS NULL THEN false ELSE pg_has_role('${operator}', r.oid, 'SET') END AS can_set_role,
   CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN false
-       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create
+       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create,
+  CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN false
+       ELSE has_schema_privilege(r.oid, n.oid, 'USAGE') END AS owner_can_use
 FROM declared d
 LEFT JOIN pg_roles r ON r.rolname = d.owner_name
 LEFT JOIN pg_namespace n ON n.nspname = d.schema_name
@@ -207,7 +217,8 @@ ORDER BY d.owner_name, d.schema_name
  * The connection-DEPENDENT probe: run on a connection to learn what CURRENT_USER can grant.
  * Can it `GRANT <owner> TO <operator>` — it holds ADMIN OPTION on the owner, directly or through a
  * group. Can it `GRANT CREATE ON SCHEMA <schema>` — it owns the schema or holds CREATE WITH GRANT
- * OPTION. A REAL superuser can do both unconditionally. Run on the operator's connection and, when
+ * OPTION, and `GRANT USAGE ON SCHEMA` — it owns the schema or holds USAGE WITH GRANT OPTION. A REAL
+ * superuser can do all three unconditionally. Run on the operator's connection and, when
  * present, on the master's; the router merges the two.
  *
  * MEMBERSHIP IN `rds_superuser` IS NOT SUPERUSER, and this probe no longer pretends it is. RDS's
@@ -238,7 +249,9 @@ SELECT
   d.schema_name AS schema,
   COALESCE(me.is_super OR pg_has_role(me.oid, r.oid, 'MEMBER WITH ADMIN OPTION'), false) AS can_grant_membership,
   COALESCE(me.is_super OR n.nspowner = me.oid
-     OR has_schema_privilege(me.oid, n.oid, 'CREATE WITH GRANT OPTION'), false) AS can_grant_create
+     OR has_schema_privilege(me.oid, n.oid, 'CREATE WITH GRANT OPTION'), false) AS can_grant_create,
+  COALESCE(me.is_super OR n.nspowner = me.oid
+     OR has_schema_privilege(me.oid, n.oid, 'USAGE WITH GRANT OPTION'), false) AS can_grant_usage
 FROM declared d
 CROSS JOIN me
 LEFT JOIN pg_roles r ON r.rolname = d.owner_name
@@ -250,7 +263,8 @@ ORDER BY d.owner_name, d.schema_name
 const keyOf = (owner: string, schema: string) => `${owner}\u0000${schema}`;
 
 /**
- * Route the two grants each (owner, schema) may need onto the connection that can run them.
+ * Route the three grants each (owner, schema) may need — membership, CREATE, USAGE — onto the
+ * connection that can run them.
  *
  * `operator` is the least-privilege role (`migrator`). `masterCaps` is null when no master
  * connection is available — then anything the operator cannot do is a refusal, never an
@@ -305,6 +319,16 @@ export function planOwnerEnactment(
         `Run as the schema owner:  ${stmt};`,
       );
     }
+    // 3. Usage: the owner's GRANT/REVOKE on the object name `schema.object` — resolving it needs USAGE.
+    if (f.schemaExists && !f.ownerCanUse) {
+      const stmt = `GRANT USAGE ON SCHEMA ${f.schema} TO ${f.owner}`;
+      if (op?.canGrantUsage) addUnit(b, subject, 'operator', [stmt]);
+      else if (master?.canGrantUsage) addUnit(b, subject, 'master', [stmt]);
+      else plan.refusals.push(
+        `cannot GRANT USAGE ON SCHEMA ${f.schema} TO ${f.owner}: neither connection owns the schema or holds USAGE WITH GRANT OPTION. ` +
+        `Run as the schema owner:  ${stmt};`,
+      );
+    }
     // An absent schema is not enacted here — it is created by the reconcile builder, whose own
     // preflight then names the owner's missing CREATE. Enactment acts only on what exists.
   }

package/src/plugin.ts

@@ -1242,7 +1242,7 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
     // direct --database-url path runs, only here the connection never leaves the
     // Lambda. A destructive plan snapshots first (db:backup), in order.
     actions['db:apply'] = async (payload, ctx) => {
-      const { plan, contractVersion, actor, gitRef, dirty, descentVerdict, descentAttested, authorityVerdict, stage, snapshotRef } =
+      const { plan, contractVersion, actor, gitRef, dirty, stateOnly, descentVerdict, descentAttested, authorityVerdict, stage, snapshotRef } =
         (payload ?? {}) as {
           plan?: any;
           /** The CLI's db:apply wire-contract version. Checked for EXACT equality against this
@@ -1253,11 +1253,12 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
           /** The CLI applied from a dirty worktree — recorded on the schema_log witness so a
            *  later descent ignores this row's git_ref. */
           dirty?: boolean;
+          stateOnly?: boolean;
           descentVerdict?: { ok: boolean; reason?: string };
           /** What the CLI's descent step decided, to record in the schema_log outcome
-           *  (`applied — <note>`): a honoured --attest-lineage-lost waiver, or a PROVEN DRIFT
-           *  origin (`descent: drift-origin proven (never-declared | hand-edited since … | applied
-           *  from a DIRTY worktree at …)`) — the
+           *  (`applied — <note>`): a honoured --attest-lineage-lost waiver, or a DRIFT
+           *  origin (`descent: drift-origin never-declared (…) | hand-edited since … | applied
+           *  from a DIRTY worktree at …`) — the
            *  record that makes this row the origin every later apply descends from. */
           descentAttested?: string;
           authorityVerdict?: { ok: boolean; reason?: string };
@@ -1297,6 +1298,11 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
         const result: any = await opsDb.execute(sql.raw(query));
         return Array.isArray(result) ? result : result?.rows ?? [];
       };
+      const transaction = async <T>(work: (transactionRunner: (query: string) => Promise<any[]>) => Promise<T>): Promise<T> =>
+        opsDb.transaction(async (tx: any) => work(async (query: string) => {
+          const result: any = await tx.execute(sql.raw(query));
+          return Array.isArray(result) ? result : result?.rows ?? [];
+        }));
       // The fingerprint endpoints this apply gates on are multi-statement reads, so they
       // run as ONE session on this container's operator connection. Server-side that was
       // always one connection; saying so in the type is what stops a future caller from
@@ -1315,9 +1321,11 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
         // in order, atomic with the lock. Authority/snapshot stay conditional (destructive-only, and
         // the stage lane refuses destructive outright, so they never light up on this lane).
         const applyOptions: StageApplyOptions = {
+          transaction,
           actor: actor ?? null,
           gitRef: gitRef ?? null,
           dirty: dirty === true,
+          stateOnly: stateOnly === true,
           checkDescent: async () => (descentVerdict.ok ? { ok: true as const } : { ok: false as const, reason: descentVerdict.reason ?? 'descent refused' }),
           // The CLI's descent record (a honoured waiver, or a proven-drift origin) lands in the
           // schema_log outcome; the witness query matches `applied%`, so the row stays a witness.

package/src/provision.ts

@@ -606,6 +606,7 @@ function toFacts(rows: any[]): OwnerFactRow[] {
     schemaExists: truthy(r.schema_exists),
     canSetRole: truthy(r.can_set_role),
     ownerCanCreate: truthy(r.owner_can_create),
+    ownerCanUse: truthy(r.owner_can_use),
   }));
 }
 
@@ -615,6 +616,7 @@ function toCaps(rows: any[]): GranterCapabilityRow[] {
     schema: String(r.schema),
     canGrantMembership: truthy(r.can_grant_membership),
     canGrantCreate: truthy(r.can_grant_create),
+    canGrantUsage: truthy(r.can_grant_usage),
   }));
 }