@everystack/cli 0.4.45 → 0.4.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.45",
+  "version": "0.4.47",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -109,7 +109,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.10"
+    "@everystack/model": "0.4.11"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",

package/src/cli/alter-type-dependents.ts

@@ -0,0 +1,96 @@
+/**
+ * alter-type-dependents — the mint-time gate for a hard PostgreSQL rule:
+ * `ALTER COLUMN … SET DATA TYPE` fails when a view, materialized view, or
+ * rewrite rule references the column ("cannot alter type of a column used by
+ * a view or rule"), and it fails MID-TRANSACTION, at apply time.
+ *
+ * The plan lane's contract is "what it mints, it can apply" — so the mint
+ * refuses the plan up front, with the dependents NAMED, instead of letting the
+ * operator discover them from a rolled-back apply. (Proven live: the first-ever
+ * Z1a apply of a brownfield adoption plan failed exactly this way.) The route
+ * for a real type migration under dependents is deliberate: rebuild through
+ * `db:swap`, or drop and re-create the derived objects around the change.
+ */
+
+import type { QueryRunner } from './authz-contract.js';
+
+export interface AlterTypeTarget {
+  table: string;
+  column: string;
+}
+
+export interface BlockedAlterType extends AlterTypeTarget {
+  /** Qualified names of the views / matviews / rules that bind the column. */
+  dependents: string[];
+}
+
+/**
+ * The (table, column) pairs a plan's `SET DATA TYPE` statements touch — read
+ * from the emitted artifact itself, the same way the destructive classifier
+ * reads it: the statement is what gets applied, so it is what gets checked.
+ */
+export function alterTypeStatementTargets(statements: readonly string[]): AlterTypeTarget[] {
+  const targets: AlterTypeTarget[] = [];
+  for (const s of statements) {
+    const m = s.match(/ALTER TABLE\s+(\S+)\s+ALTER COLUMN\s+"([^"]+)"\s+SET DATA TYPE\s/);
+    if (m) targets.push({ table: m[1], column: m[2] });
+  }
+  return targets;
+}
+
+const quoteLiteral = (s: string): string => `'${s.replace(/'/g, "''")}'`;
+
+/**
+ * The dependents PostgreSQL itself would refuse over: rewrite-rule entries
+ * (views, matviews, rules) that depend on the specific column. Whole-table
+ * dependencies (refobjsubid 0 — every view's FROM clause) are deliberately
+ * excluded: a view that never touches the column does not block the change.
+ */
+export function dependentsSql(target: AlterTypeTarget): string {
+  const rel = quoteLiteral(target.table);
+  return `
+SELECT DISTINCT
+  CASE cl.relkind WHEN 'v' THEN 'view' WHEN 'm' THEN 'materialized view' ELSE 'rule' END AS kind,
+  n.nspname || '.' || cl.relname AS name
+FROM pg_depend d
+JOIN pg_rewrite r ON r.oid = d.objid
+JOIN pg_class cl ON cl.oid = r.ev_class
+JOIN pg_namespace n ON n.oid = cl.relnamespace
+WHERE d.classid = 'pg_rewrite'::regclass
+  AND d.refclassid = 'pg_class'::regclass
+  AND d.refobjid = ${rel}::regclass
+  AND d.refobjsubid = (
+    SELECT attnum FROM pg_attribute
+    WHERE attrelid = ${rel}::regclass AND attname = ${quoteLiteral(target.column)}
+  )
+  AND cl.oid <> ${rel}::regclass
+ORDER BY name;
+`.trim();
+}
+
+/** Query the live catalog for each target; return only the blocked ones. */
+export async function findAlterTypeDependents(
+  runner: QueryRunner,
+  targets: readonly AlterTypeTarget[],
+): Promise<BlockedAlterType[]> {
+  const blocked: BlockedAlterType[] = [];
+  for (const t of targets) {
+    const rows = await runner(dependentsSql(t));
+    if (rows.length > 0) {
+      blocked.push({ ...t, dependents: rows.map((r: any) => `${r.kind} ${r.name}`) });
+    }
+  }
+  return blocked;
+}
+
+/** The refusal, with every dependent named — actionable, not archaeological. */
+export function renderAlterTypeRefusal(blocked: readonly BlockedAlterType[]): string {
+  const lines = blocked.map(
+    (b) => `  ${b.table}."${b.column}" is bound by: ${b.dependents.join(', ')}`,
+  );
+  return [
+    `This plan changes the type of ${blocked.length} column(s) that a view or rule depends on — PostgreSQL would refuse the ALTER mid-transaction ("cannot alter type of a column used by a view or rule"), so the mint refuses it now:`,
+    ...lines,
+    `Route the type change through db:swap (rebuild + atomic rename), or drop and re-create the dependent derived objects around it (db:reconcile) — deliberately, not as an apply-time surprise.`,
+  ].join('\n');
+}

package/src/cli/apply-execute.ts

@@ -30,9 +30,11 @@
  */
 
 import { introspectContract, type QueryRunner, type AuthzContract } from './authz-contract.js';
+import type { SessionRunner } from './session.js';
 import { introspectSchema, type SchemaSnapshot } from './schema-introspect.js';
 import { FUNCTIONS_SQL, contractFunctionRow } from './security-catalog.js';
 import { fingerprintLive } from './schema-fingerprint.js';
+import { governedLiveFingerprint } from './edge-plan.js';
 import { applyGeneratedStatements } from './state-apply.js';
 import { ENSURE_RECONCILER_SQL, renderSchemaLogInsert, renderSchemaLogFingerprintUpdate } from './derived-apply.js';
 import { checkPlanPrecondition, planHash, type EdgePlan } from './edge-plan.js';
@@ -134,21 +136,30 @@ export interface LiveBaseFingerprint {
  * destructive-apply safety gate (backup.fp == plan.from). A second copy would silently drift the
  * fingerprint chain — the whole point of the gate.
  */
-export async function liveBaseFingerprint(runner: QueryRunner): Promise<LiveBaseFingerprint> {
-  const snapshot = await introspectSchema(runner);
-  const contract = await introspectContract(runner, contractFunctionRow, FUNCTIONS_SQL);
+export async function liveBaseFingerprint(session: SessionRunner): Promise<LiveBaseFingerprint> {
+  const snapshot = await introspectSchema(session);
+  const contract = await introspectContract(session, contractFunctionRow, FUNCTIONS_SQL);
   return { hash: fingerprintLive(snapshot, contract).hash, snapshot, contract };
 }
 
 /** Verify → apply → verify. Pure orchestration over an injected QueryRunner. */
 export async function executeApplyPlan(
   runner: QueryRunner,
+  session: SessionRunner,
   plan: EdgePlan,
   options: ApplyPlanOptions = {},
 ): Promise<ApplyPlanResult> {
-  const { hash: live, snapshot: before, contract: beforeAuthz } = await liveBaseFingerprint(runner);
+  const { hash: live, snapshot: before, contract: beforeAuthz } = await liveBaseFingerprint(session);
 
-  if (live === plan.toFingerprint) {
+  // Two flavors, matched to what each check compares (see EdgePlan): the RAW
+  // hash for live-vs-live (the lock, the backup chain), the GOVERNED hash for
+  // declared-vs-live (already-applied here, verify-after below) — computed with
+  // the exact set the mint stamped on the plan. A plan minted before the field
+  // existed verifies raw, as it was minted.
+  const governed = plan.governedRoles ? new Set(plan.governedRoles) : undefined;
+  const governedLive = governed ? governedLiveFingerprint(before, beforeAuthz, governed) : live;
+
+  if (governedLive === plan.toFingerprint) {
     return { status: 'already-applied', liveFingerprint: live };
   }
   const pre = checkPlanPrecondition(plan, live);
@@ -200,16 +211,19 @@ export async function executeApplyPlan(
     now: options.now,
   });
 
-  const { hash: landed } = await liveBaseFingerprint(runner);
+  const { hash: landed, snapshot: after, contract: afterAuthz } = await liveBaseFingerprint(session);
   if (result.logId !== undefined) {
+    // The log stamps the RAW landed hash — the same flavor as `from`, so the
+    // schema_log chain reads as one consistent series of live states.
     await runner(renderSchemaLogFingerprintUpdate(result.logId, landed));
   }
 
-  if (landed !== plan.toFingerprint) {
+  const governedLanded = governed ? governedLiveFingerprint(after, afterAuthz, governed) : landed;
+  if (governedLanded !== plan.toFingerprint) {
     return {
       status: 'verify-failed',
       liveFingerprint: landed,
-      reason: `applied, but the target landed on ${landed.slice(0, 12)} — the plan predicted ${plan.toFingerprint.slice(0, 12)}. Investigate before touching this database again (db:fingerprint, db:generate).`,
+      reason: `applied, but the target landed on ${governedLanded.slice(0, 12)} — the plan predicted ${plan.toFingerprint.slice(0, 12)}. Investigate before touching this database again (db:fingerprint, db:generate).`,
       ...(result.logId !== undefined ? { logId: result.logId } : {}),
     };
   }

package/src/cli/authz-adoption-class.ts

@@ -30,7 +30,7 @@
 
 import { matchPolicies, roleSetEqual } from './authz-identity.js';
 import { governedRoleSet } from './authz-reconcile.js';
-import { effectivePolicyCheck, holdsPrivilege } from './authz-contract.js';
+import { effectivePolicyCheck, holdsPrivilege, isPolicyDead, policyCommands } from './authz-contract.js';
 import type { AuthzContract, PolicyContract, TableContract } from './authz-contract.js';
 
 export type AdoptionClass = 'convention' | 'capability' | 'narrowing' | 'dead' | 'unclassified';
@@ -86,30 +86,28 @@ function sameRule(a: PolicyContract, b: PolicyContract): boolean {
     && (effectivePolicyCheck(a) ?? '') === (effectivePolicyCheck(b) ?? '');
 }
 
-/** Every command a policy governs — `ALL` fans out, so a live `FOR ALL` is compared per command. */
-function commandsOf(p: PolicyContract): string[] {
-  return p.command === 'ALL' ? [...CRUD] : [p.command];
-}
-
 /**
- * A policy is DEAD when no role it applies to holds the privilege it polices. Postgres checks
- * the GRANT before the policy, so such a policy authorizes nothing — removing it takes away
- * access that was never there. A PUBLIC policy applies to every grantee, so it is dead only if
- * NO grantee holds the privilege at all.
+ * A policy's predicate, collapsed to one line for the report.
+ *
+ * Live predicates arrive from `pg_get_expr` with real newlines and indentation (an EXISTS
+ * subquery spans several lines), and the adoption report is one line per statement. Collapsing
+ * keeps the rule READABLE in place rather than referring the operator elsewhere to find it.
  */
-function isDead(t: TableContract, p: PolicyContract): boolean {
-  const roles = p.roles.includes('public') ? Object.keys(t.grants) : p.roles;
-  if (!roles.length) return true;
-  // `holdsPrivilege`, not the table-level one: a column-scoped grant is real access, and
-  // "dead" tells an operator the drop takes away nothing. Shared with db:pull so the two can
-  // never answer this differently about one database.
-  return !commandsOf(p).some((cmd) => roles.some((r) => holdsPrivilege(t, r, cmd)));
+function pred(p: PolicyContract): string {
+  const using = (p.using ?? 'true').replace(/\s+/g, ' ').trim();
+  return using === 'true' ? 'true (unfiltered)' : using;
 }
 
+// `commandsOf` and the dead-policy test live in authz-contract — ONE definition, shared with
+// the reconciler, the canonical form, and db:pull.
+const commandsOf = policyCommands;
+const isDead = isPolicyDead;
+
 /** Classify the policy statements one table would emit. */
-function classifyPolicies(d: TableContract, l: TableContract, out: ClassifiedStatement[]): void {
+function classifyPolicies(d: TableContract, l: TableContract, out: ClassifiedStatement[], governed: ReadonlySet<string>): void {
   const table = d.table;
   const m = matchPolicies(d.policies, l.policies);
+  const liveByName = new Map(l.policies.map((p) => [p.name, p]));
 
   // Adopted shapes — a rule-identical policy under another name, or a live multi-role policy
   // covering the declared per-role group — emit NOTHING, so there is nothing here to classify.
@@ -122,10 +120,16 @@ function classifyPolicies(d: TableContract, l: TableContract, out: ClassifiedSta
   for (const name of m.toDrop) {
     const live = l.policies.find((p) => p.name === name)!;
 
-    if (isDead(l, live)) {
-      out.push({ table, subject: name, cls: 'dead', why: `policed but never granted — it authorizes nothing today` });
-      continue;
-    }
+    // The reconciler LEAVES a policy scoped entirely to ungoverned roles alone, so no statement
+    // is emitted for it and there is nothing here to classify. Counting one would describe a
+    // plan nobody is going to apply — the same reason classifyGrants skips those grantees.
+    if (live.roles.length > 0 && live.roles.every((r) => !isGovernedGrantee(governed, r))) continue;
+
+    // A DEAD policy is left alone by the reconciler now (it authorizes nothing, so dropping it
+    // changes no access), which means no statement exists to classify — same as the ungoverned
+    // case above, and counting one would describe a plan nobody is going to apply. The adopter
+    // still hears about it: db:pull writes the finding into the model file, where it persists.
+    if (isDead(l, live)) continue;
 
     // A replacement exists when some declared policy governs the same command. If those
     // replacements together cover FEWER roles than the live policy did, the plan is reducing
@@ -165,6 +169,37 @@ function classifyPolicies(d: TableContract, l: TableContract, out: ClassifiedSta
       continue;
     }
 
+    // The PREDICATE axis. Everything above this line decides on ROLE SETS alone, and that was
+    // the blind spot: a replacement holding the SAME roles with a different USING is a real
+    // access change that no role comparison can see. It fell to `unclassified` — a bucket with
+    // a count and, until E3, no detail — so the most dangerous shape this tool can emit was
+    // also its quietest. A live `(guard) AND (mine OR published)` read replaced by a
+    // `published`-only one is not silence; it is a replacement that READS as equivalent.
+    //
+    // Narrower vs. wider is not decidable here without a predicate lattice, so this takes the
+    // most severe reading, exactly as the destructive-statement partition does: an access change
+    // we cannot prove is identical is reported as a reduction, and BOTH predicates are carried
+    // so the operator reads the rule rather than the label.
+    const sameRoleReplacements = replacements.filter((r) => r.roles.some((role) => live.roles.includes(role)));
+    if (sameRoleReplacements.length && !sameRoleReplacements.some((r) => sameRule(r, live))) {
+      const shared = [...new Set(sameRoleReplacements.flatMap((r) => r.roles.filter((role) => live.roles.includes(role))))];
+      out.push({
+        table,
+        subject: name,
+        cls: 'narrowing',
+        why:
+          `live applies to ${shared.join(', ')} USING ${pred(live)}; the declared replacement `
+          + `${sameRoleReplacements.map((r) => `"${r.name}"`).join(', ')} keeps the same role(s) but states `
+          + `${sameRoleReplacements.map((r) => pred(r)).join(' / ')} — a different rule, not a different spelling`,
+      });
+      for (const r of sameRoleReplacements) {
+        if (consumed.has(r.name)) continue;
+        consumed.add(r.name);
+        out.push({ table, subject: r.name, cls: 'narrowing', why: `the differently-predicated replacement for "${name}"` });
+      }
+      continue;
+    }
+
     out.push({ table, subject: name, cls: 'unclassified', why: `dropped with a replacement that is neither the same rule nor narrower` });
   }
 
@@ -241,7 +276,7 @@ export function classifyAdoption(
   for (const d of declared.tables) {
     const l = liveByTable.get(d.table);
     if (!l) continue; // a brand-new table adds; nothing here is an adoption decision
-    classifyPolicies(d, l, statements);
+    classifyPolicies(d, l, statements, governed);
     classifyGrants(d, l, governed, statements);
   }
 
@@ -250,8 +285,19 @@ export function classifyAdoption(
   return { statements, counts };
 }
 
-/** The report block for the plan surface. Terse: one line per class, then the offenders. */
-export function renderAdoptionReport(counts: AdoptionCounts): string[] {
+/**
+ * The report block for the plan surface. Terse: one line per class, then the offenders.
+ *
+ * `unclassified` is the one class whose count cannot be acted on by itself — its whole meaning
+ * is "read these before applying", and a bare number gives the reader nothing to read. The
+ * adopter who hit this said it best: a count with no way to act on it is the same shape as the
+ * problem the bucket was created to solve. So every unclassified statement is NAMED here, and
+ * the per-statement detail rides on the artifact too (`adoption` on the plan).
+ *
+ * Only `unclassified` is expanded. The others are counts on purpose — 19 narrowings listed
+ * inline is a wall nobody reads, and they are each described by their class.
+ */
+export function renderAdoptionReport(counts: AdoptionCounts, statements: readonly ClassifiedStatement[] = []): string[] {
   const lines = [
     `  convention   ${counts.convention}  — our spelling, not their schema (this must reach 0)`,
     `  capability   ${counts.capability}  — the model cannot express what is live`,
@@ -259,7 +305,10 @@ export function renderAdoptionReport(counts: AdoptionCounts): string[] {
     `  dead         ${counts.dead}  — policed but never granted`,
   ];
   if (counts.unclassified) {
-    lines.push(`  unclassified ${counts.unclassified}  — NOT described; read these before applying`);
+    lines.push(`  unclassified ${counts.unclassified}  — NOT described; read these before applying:`);
+    for (const s of statements.filter((s) => s.cls === 'unclassified')) {
+      lines.push(`    ${s.table} "${s.subject}" — ${s.why}`);
+    }
   }
   return lines;
 }

package/src/cli/authz-canonical.ts

@@ -32,7 +32,7 @@
  */
 
 import type { PolicyContract, TableContract } from './authz-contract.js';
-import { effectivePolicyCheck } from './authz-contract.js';
+import { effectivePolicyCheck, isPolicyDead, isPolicySubsumed } from './authz-contract.js';
 
 /** PostgreSQL's open role set, kept whole. */
 const PUBLIC_ROLE = 'public';
@@ -76,9 +76,28 @@ function multiset(entries: string[]): Array<[string, number]> {
   return [...counts.entries()].sort(([a], [b]) => (a < b ? -1 : 1));
 }
 
-/** The canonical policy form: every policy expanded across its roles, as a sorted multiset. */
-export function canonicalPolicies(policies: readonly PolicyContract[]): Array<[string, number]> {
-  return multiset(policies.flatMap(expandPolicy));
+/**
+ * The canonical policy form: every policy expanded across its roles, as a sorted multiset.
+ *
+ * When a governed set is supplied (hashing a LIVE contract), per-role entries for roles the
+ * models do not govern are dropped — the SAME choice the reconciler makes when it leaves an
+ * ungoverned role's policy alone (the `reconcilePolicies` ungoverned escape). Hashing them
+ * would keep MATCH unreachable on any brownfield database whose previous stack left a policy
+ * TO a migrator/resolver role: zero statements, mismatched hash, forever. PUBLIC is a
+ * governed sentinel and always kept.
+ */
+export function canonicalPolicies(
+  policies: readonly PolicyContract[],
+  governed?: ReadonlySet<string>,
+): Array<[string, number]> {
+  const entries = policies.flatMap(expandPolicy);
+  const kept = governed
+    ? entries.filter((e) => {
+        const role = e.slice(0, e.indexOf('|'));
+        return governed.has(role) || role === PUBLIC_ROLE || (role.toUpperCase() === 'PUBLIC' && governed.has('PUBLIC'));
+      })
+    : entries;
+  return multiset(kept);
 }
 
 /**
@@ -141,6 +160,19 @@ export function canonicalAuthz(
           ),
         }
       : {}),
-    policies: canonicalPolicies(contract.policies),
+    // A DEAD policy is not part of the state. It authorizes nothing (Postgres refuses at the
+    // GRANT before consulting it), and the reconciler now leaves it alone — so counting it
+    // here would keep MATCH unreachable on exactly the databases that have them: brownfield
+    // ones, where a previous stack left policies behind after its grants were revoked. Both
+    // surfaces make the same choice, from the same function. Deadness is recomputed against
+    // these grants every time, so the policy re-enters the state the moment a grant revives it.
+    // …and neither is a SUBSUMED one: a permissive policy whose rule an identical PUBLIC
+    // policy already applies to every role admits no session the other does not. Both
+    // exclusions are the same idea — a policy that changes no access is not part of the
+    // state — and both are made in lockstep with the reconciler, from the same functions.
+    policies: canonicalPolicies(
+      contract.policies.filter((p) => !isPolicyDead(contract, p) && !isPolicySubsumed(contract, p)),
+      governed,
+    ),
   };
 }

package/src/cli/authz-compile.ts

@@ -20,7 +20,7 @@
  * Input is a `@everystack/model` ModelDescriptor (type-only — no runtime dep).
  */
 
-import type { ModelDescriptor, Ability } from '@everystack/model';
+import { isColumnAbility, type ModelDescriptor, type Ability } from '@everystack/model';
 import type { PolicyContract, TableContract, PolicyCommand } from './authz-contract.js';
 import { parenthesizeOnce } from './authz-contract.js';
 
@@ -197,17 +197,6 @@ function softDeleteColumn(model: ModelDescriptor): string | null {
   return model.softDelete ? 'deleted_at' : null;
 }
 
-/**
- * A column-scoped self read — `can('read', { owner, columns })`. It compiles to a COLUMN
- * grant (`GRANT SELECT (cols)`) plus a `<table>_select_self` policy, NOT a table grant and
- * NOT a `_select_own` policy: the row is scoped by the owner predicate, the fields by the
- * column list (`auth.users` → id/email/role to the owner, never the password hash). It is
- * excluded from the table-grant and owner-read paths so the two never double-emit.
- */
-function isColumnRead(a: Ability): boolean {
-  return a.action === 'read' && Boolean(a.condition.owner) && Boolean(a.condition.columns?.length);
-}
-
 /**
  * `can(…, { role: 'public' })` names PostgreSQL's PUBLIC pseudo-role, and the two catalogs
  * that describe it spell it differently — both correctly:
@@ -234,21 +223,25 @@ const granteeKey = (role: string): string => (isPseudoPublic(role) ? 'PUBLIC' :
 const policyRole = (role: string): string => (isPseudoPublic(role) ? 'public' : role);
 
 /**
- * Column grants from the column-scoped read abilities: the read role (`authenticated`, since
- * the ability is owner-scoped, not role-gated) gets `SELECT (cols)`. Field keys are snake_cased
- * to SQL columns and sorted, matching the introspected contract. Returns undefined when no
- * ability declares columns — an introspected contract omits the key rather than carry an empty
- * object, so the compiled one must too (or the round-trip diff would false-fire).
+ * Column grants from column abilities. The action determines the PostgreSQL verb; the named role
+ * (or authenticated for an owner-only ability) is the grantee. Field keys are snake-cased and
+ * deduplicated, matching the introspected contract.
  */
 function compileColumnGrants(abilities: readonly Ability[]): Record<string, Record<string, string[]>> | undefined {
-  const out: Record<string, Record<string, string[]>> = {};
+  const out: Record<string, Record<string, Set<string>>> = {};
   for (const a of abilities) {
-    if (!isColumnRead(a)) continue;
+    if (!isColumnAbility(a)) continue;
     const role = granteeKey(a.condition.role ?? 'authenticated');
-    const cols = [...a.condition.columns!].map(toSnakeCase).sort();
-    (out[role] ??= {}).SELECT = cols;
+    const verb = a.action === 'read' ? 'SELECT' : 'UPDATE';
+    const cols = ((out[role] ??= {})[verb] ??= new Set<string>());
+    for (const column of a.condition.columns!) cols.add(toSnakeCase(column));
+  }
+  const grants: Record<string, Record<string, string[]>> = {};
+  for (const [role, verbs] of Object.entries(out)) {
+    grants[role] = {};
+    for (const [verb, columns] of Object.entries(verbs)) grants[role][verb] = [...columns].sort();
   }
-  return Object.keys(out).length ? out : undefined;
+  return Object.keys(grants).length ? grants : undefined;
 }
 
 /**
@@ -335,13 +328,13 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
    * every other role can see.
    */
   const isRoleRead = (a: Ability): boolean =>
-    a.action === 'read' && Boolean(a.condition.role) && !isColumnRead(a);
+    a.action === 'read' && Boolean(a.condition.role) && !isColumnAbility(a);
 
   // Author-supplied predicates, per action. `manage` carries no predicate of its own —
   // it is the admin bypass — so only the specific verbs are consulted.
   const predFor = (action: Ability['action']): string | null => {
     for (const a of model.abilities) {
-      if (a.action !== action || isRoleRead(a)) continue;
+      if (a.action !== action || isRoleRead(a) || isColumnAbility(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('${action}')`);
       if (p) return p;
     }
@@ -367,7 +360,7 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   /** The predicate the OWNER read narrows ITSELF by — `can('read', { owner, sql })`. */
   const ownerReadPred = (): string | null => {
     for (const a of model.abilities) {
-      if (a.action !== 'read' || !rowScoped(a) || isColumnRead(a)) continue;
+      if (a.action !== 'read' || !rowScoped(a) || isColumnAbility(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('read', { owner })`);
       if (p) return p;
     }
@@ -387,12 +380,18 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   const abilities = model.abilities;
   const hasAdminManage = abilities.some((a) => a.action === 'manage' && a.condition.role === 'admin');
   const hasPublicRead = abilities.some((a) => a.action === 'read' && !a.condition.role && !rowScoped(a));
+  // The audience is open when the public read says so. Read off the SAME abilities that make
+  // `hasPublicRead` true, so the two can never disagree about which read is being compiled.
+  const publicAudience = abilities.some(
+    (a) => a.action === 'read' && !a.condition.role && !rowScoped(a) && a.condition.policyRoles === 'public',
+  );
   // A column-scoped read is row-scoped but emits a self policy + column grant, not the
   // full-row owner read — so it is excluded here and handled by its own branch.
-  const hasOwnerRead = abilities.some((a) => a.action === 'read' && rowScoped(a) && !isColumnRead(a));
-  const hasColumnRead = abilities.some(isColumnRead);
+  const hasOwnerRead = abilities.some((a) => a.action === 'read' && rowScoped(a) && !isColumnAbility(a));
+  const hasColumnOwnerRead = abilities.some((a) => a.action === 'read' && isColumnAbility(a) && !a.condition.role && rowScoped(a));
   const canCreate = abilities.some((a) => a.action === 'create');
-  const hasUpdateOwner = abilities.some((a) => a.action === 'update' && rowScoped(a));
+  const hasUpdateOwner = abilities.some((a) => a.action === 'update' && rowScoped(a) && !isColumnAbility(a));
+  const hasColumnUpdateOwner = abilities.some((a) => a.action === 'update' && isColumnAbility(a) && !a.condition.role && rowScoped(a));
   const hasDeleteOwner = abilities.some((a) => a.action === 'delete' && rowScoped(a));
 
   const t = model.table;
@@ -412,7 +411,6 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     // also see their own (soft-deleted) rows, hence the OR'd owner check.
     const readPred = publicReadPred();
     const anonUsing = andPredicates(sdGuard, readPred) ?? 'true';
-    policy(`${t}_select_anon`, 'SELECT', ['anon'], anonUsing, null);
 
     let authedUsing: string;
     if (hasOwnerRead && rowPred && anonUsing !== 'true') {
@@ -441,12 +439,34 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
         ? andPredicates(`(${sdGuard} OR ${rowPred})`, readPred)!
         : anonUsing;
     }
-    policy(`${t}_select_authenticated`, 'SELECT', ['authenticated'], authedUsing, null);
+    // ONE policy TO PUBLIC, when the model says the audience is open (B1).
+    //
+    // The two spellings are NOT equivalent and the difference is the whole point: PUBLIC is
+    // an open set, `{anon, authenticated}` is closed. A brownfield schema that wrote the
+    // ordinary Postgres idiom — one policy TO PUBLIC — had no way to say so, so every plan
+    // proposed dropping it for the role-scoped pair. That is a real narrowing: any role
+    // outside the pair loses the read.
+    //
+    // Emitted under the model's own name; identity-by-meaning adopts the live policy whose
+    // rule matches, whatever it is called, so a schema already carrying `<t>_read_public`
+    // reaches ZERO statements rather than a rename's DROP + CREATE.
+    //
+    // GRANTS ARE UNTOUCHED — they stay exactly as derived for anon/authenticated. An open
+    // audience over a closed grant set widens nothing: Postgres checks the GRANT first, so a
+    // role holding no SELECT still reads no rows no matter who the policy names.
+    if (publicAudience) {
+      policy(`${t}_select_public`, 'SELECT', ['public'], anonUsing, null);
+    } else {
+      policy(`${t}_select_anon`, 'SELECT', ['anon'], anonUsing, null);
+      policy(`${t}_select_authenticated`, 'SELECT', ['authenticated'], authedUsing, null);
+    }
   } else if (hasOwnerRead && rowPred) {
     // owner-scoped read — no anon visibility; you see only the rows you own
     // (directly, or transitively through a `via:` parent).
     policy(`${t}_select_own`, 'SELECT', ['authenticated'], andPredicates(rowPred, predFor('read'))!, null);
-  } else if (hasColumnRead && rowPred) {
+  }
+
+  if (hasColumnOwnerRead && rowPred) {
     // column-scoped self read — `authenticated` reads only its OWN row, and only the
     // granted columns (the GRANT scopes fields; this policy scopes rows). Named
     // `_select_self`, distinct from the full-row `_select_own`.
@@ -460,7 +480,9 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   // the model read as though it could see its own. The declared predicate was computed and
   // discarded. That is the same failure `rawPredicate` throws over, one level up: a predicate
   // that evaporates is an authorization hole wearing the costume of a working rule.
-  for (const a of abilities.filter(isRoleRead)) {
+  for (const a of abilities.filter((ability) => isRoleRead(ability) || (
+    isColumnAbility(ability) && ability.action === 'read' && Boolean(ability.condition.role)
+  ))) {
     // The policy-side spelling, so `role: 'PUBLIC'` still matches what pg_policies reports.
     const role = policyRole(a.condition.role!);
     const name = `${t}_select_${role}`;
@@ -471,7 +493,16 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
         + `Declare one or the other: permissive policies OR together, so the role-scoped rule could only ever widen — never the narrowing it reads as.`,
       );
     }
-    policy(name, 'SELECT', [role], rawPredicate(a.condition.sql ?? a.condition.where, where) ?? 'true', null);
+    policy(
+      name,
+      'SELECT',
+      [role],
+      andPredicates(
+        rowScoped(a) ? rowPred : null,
+        rawPredicate(a.condition.sql ?? a.condition.where, where),
+      ) ?? 'true',
+      null,
+    );
   }
 
   // owner-gated writes. INSERT checks ownership (you can only create rows you own);
@@ -491,6 +522,27 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   if ((hasUpdateOwner || predFor('update')) && updatePred) {
     policy(`${t}_update_own`, 'UPDATE', ['authenticated'], updatePred, checkFor('update') ?? updatePred);
   }
+  else if (hasColumnUpdateOwner && updatePred) {
+    policy(`${t}_update_own`, 'UPDATE', ['authenticated'], updatePred, updatePred);
+  }
+  for (const a of abilities.filter((ability) =>
+    isColumnAbility(ability) && ability.action === 'update' && Boolean(ability.condition.role),
+  )) {
+    const role = policyRole(a.condition.role!);
+    const name = `${t}_update_${role}`;
+    const where = `${table}: can('update', { role: '${role}' })`;
+    if (policies.some((p) => p.name === name)) {
+      throw new Error(
+        `${where} collides with the ${name} policy already compiled from this model. `
+        + `Declare one update ability for that role: permissive policies OR together, so separate rules could only widen.`,
+      );
+    }
+    const using = andPredicates(
+      rowScoped(a) ? rowPred : null,
+      rawPredicate(a.condition.sql ?? a.condition.where, where),
+    ) ?? 'true';
+    policy(name, 'UPDATE', [role], using, rawPredicate(a.condition.check, `${where}, { check }`) ?? using);
+  }
   if ((hasDeleteOwner || predFor('delete')) && deletePred) {
     policy(`${t}_delete_own`, 'DELETE', ['authenticated'], deletePred, null);
   }
@@ -560,10 +612,8 @@ function compileGrants(
     for (const v of verbs) set.add(v);
   };
   for (const a of abilities) {
-    // A column-scoped read grants `SELECT (cols)` (a column grant), not a table-level
-    // privilege — emitted by compileColumnGrants, skipped here so it never leaks a
-    // whole-table grant that would defeat the column scoping.
-    if (isColumnRead(a)) continue;
+    // A column ability grants only its listed columns, never a table-level privilege.
+    if (isColumnAbility(a)) continue;
     const verbs = verbsFor(a.action);
     if (a.condition.role) {
       add(granteeKey(a.condition.role), verbs);