@everystack/cli 0.4.47 → 0.4.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.47",
+  "version": "0.4.49",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -109,7 +109,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.11"
+    "@everystack/model": "0.4.13"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",

package/src/cli/authz-derive.ts

@@ -232,6 +232,32 @@ function policiesFor(contract: TableContract, role: string, command: string): Po
   );
 }
 
+/**
+ * Does this grant actually give the role rows?
+ *
+ * **The rule, in one line: an ability needs BOTH a grant and a covering permissive policy.**
+ *
+ * Postgres checks the grant and THEN the policy. Either half alone gives nothing, and the two
+ * failures look identical in a diff:
+ *
+ *   - policy, no grant  → dead code. Declaring it ADDs a grant.        (handled in deriveAbilities)
+ *   - grant, no policy  → dead rows. Declaring it ADDs a policy.       (this predicate)
+ *
+ * The second half was fixed for `admin` first, because that is where a consumer hit it. The
+ * round-trip gate (integration/authz-roundtrip) then found the SAME defect on the read branch —
+ * `authenticated` holding SELECT with no policy rendered `can('read')`, compiling to
+ * `CREATE POLICY … USING (true)` against a database that has no such policy. Hence one predicate,
+ * used at every site that turns a grant into an ability, rather than a fix per role.
+ *
+ * A restrictive-only policy does not count: RESTRICTIVE policies subtract, so with no permissive
+ * policy to pass first the role still sees nothing.
+ */
+function effective(contract: TableContract, role: string, priv: string): boolean {
+  if (!granted(contract, role, priv)) return false;
+  if (!contract.rls.enabled) return true;
+  return policiesFor(contract, role, priv).some((p) => p.permissive);
+}
+
 /** A sql`…` fragment literal, or null when the predicate is vacuous. */
 function sqlFragment(pred: string | null): string | null {
   if (!pred) return null;
@@ -303,10 +329,72 @@ export function deriveAbilities(contract: TableContract): DerivedAbilities {
   const abilities: string[] = [];
   const notes: string[] = [];
   const table = contract.table;
+  /** Live CRUD grants no policy covers — declared as grants so the plan neither invents a
+   *  policy (a widening) nor revokes a real privilege (a narrowing). */
+  const deadGrants: Record<string, string[]> = {};
 
   // --- the admin bypass: one role holding every privilege ------------------------------
-  const adminAll = ['SELECT', 'INSERT', 'UPDATE', 'DELETE'].every((p) => granted(contract, 'admin', p));
-  if (adminAll) abilities.push(`can('manage', { role: 'admin' })`);
+  //
+  // The grant is only HALF the question. Postgres checks the grant and THEN the policy, so a
+  // role holding all four privileges with no policy covering it reads zero rows. Rendering
+  // `can('manage')` there compiles to a GRANT **plus** `CREATE POLICY … TO admin USING (true)`,
+  // handing admin a table the database currently withholds — a WIDENING emitted by the adoption
+  // path itself. That is the same trap the policy-without-grant branch below prevents, reached
+  // from the other side, and it shipped: three tables at one adopter, one of the three
+  // statements in their plan, refused by them.
+  //
+  // The grants are still declared — via `privileges` below — so the plan neither invents a
+  // policy nor revokes a real grant. Do NOT "simplify" this to dropping the grants: a grantee
+  // with rolbypassrls holds them live (our introspection checks ownership, not rolbypassrls),
+  // and they re-arm the day anyone runs ALTER TABLE … DISABLE ROW LEVEL SECURITY.
+  //
+  // No owner ambiguity: GRANTS_SQL excludes the table owner, so a role present in `grants` is a
+  // non-owner, and RLS binds non-owners whenever `enabled` is true. `forced` is irrelevant here.
+  const CRUD = ['SELECT', 'INSERT', 'UPDATE', 'DELETE'];
+  const adminGrants = CRUD.filter((p) => granted(contract, 'admin', p));
+  const adminLive = adminGrants.filter((p) => effective(contract, 'admin', p));
+  const adminDead = adminGrants.filter((p) => !adminLive.includes(p));
+
+  if (adminLive.length === CRUD.length) {
+    abilities.push(`can('manage', { role: 'admin' })`);
+  } else {
+    // PARTIAL. `manage` means all four, so it would be a lie — but the privileges that ARE
+    // policied are live authorization, and rendering nothing for them makes the plan DROP the
+    // policy and REVOKE the grant. That narrowing is how the round-trip gate caught this case:
+    // an admin table policied for SELECT only lost both halves on the way through.
+    for (const priv of adminLive) {
+      const pol = policiesFor(contract, 'admin', priv).find((p) => p.permissive);
+      const frag = sqlFragment(pol?.using ?? null);
+      const verb = DML[priv];
+      abilities.push(
+        frag ? `can('${verb}', { role: 'admin', sql: ${frag} })` : `can('${verb}', { role: 'admin' })`,
+      );
+    }
+  }
+
+  if (adminDead.length) {
+    deadGrants.admin = adminDead;
+    notes.push(
+      `admin holds ${adminDead.join(', ')} but no policy covers admin —`,
+    );
+    notes.push(
+      `  dead while RLS is on, unrestricted if RLS is ever disabled. Declared as a grant, not`,
+    );
+    notes.push(
+      `  an ability: an ability would ADD the policy the database does not have.`,
+    );
+  }
+
+  // The same accounting for the app roles. A grant they hold with no policy behind it is
+  // declared (so the plan does not REVOKE a live privilege) and never rendered as an ability
+  // (so the plan does not CREATE the policy the database is missing).
+  for (const role of ['authenticated', 'anon']) {
+    const dead = CRUD.filter((p) => granted(contract, role, p) && !effective(contract, role, p));
+    if (!dead.length) continue;
+    deadGrants[role] = dead;
+    notes.push(`${role} holds ${dead.join(', ')} but no policy covers ${role} —`);
+    notes.push(`  the grant is live in the catalog and gives no rows; declared as a grant, not an ability.`);
+  }
 
   // --- policed but not granted at the table level ---------------------------------------
   //
@@ -340,8 +428,11 @@ export function deriveAbilities(contract: TableContract): DerivedAbilities {
   }
 
   // --- reads ---------------------------------------------------------------------------
-  const anonRead = granted(contract, 'anon', 'SELECT');
-  const authedRead = granted(contract, 'authenticated', 'SELECT');
+  // `effective`, not `granted`: a SELECT grant with no policy behind it renders can('read'),
+  // which compiles to CREATE POLICY … USING (true) — manufacturing a policy the database does
+  // not have. Same defect as the admin branch above; the round-trip gate found it here.
+  const anonRead = effective(contract, 'anon', 'SELECT');
+  const authedRead = effective(contract, 'authenticated', 'SELECT');
 
   if (anonRead) {
     // Public read. If the live policy narrows it (a soft-delete guard, a published flag),
@@ -465,7 +556,7 @@ export function deriveAbilities(contract: TableContract): DerivedAbilities {
   // --- writes --------------------------------------------------------------------------
   for (const [command, action] of Object.entries(DML)) {
     if (action === 'read') continue;
-    if (!granted(contract, 'authenticated', command)) continue;
+    if (!effective(contract, 'authenticated', command)) continue;
 
     const pol = policiesFor(contract, 'authenticated', command).find((p) => p.command !== 'ALL')
       ?? policiesFor(contract, 'authenticated', command)[0];
@@ -535,7 +626,15 @@ export function deriveAbilities(contract: TableContract): DerivedAbilities {
     notes.push(`no grants found — this table is internal (nothing reaches it through the data API).`);
   }
 
-  return { abilities, notes, unmappedRoles, privileges: deriveExtraPrivileges(contract) };
+  // The beyond-CRUD privileges plus any live CRUD grant no policy covers. Both are "grants
+  // can() cannot say", for the same reason: `can()` decides a grant AND a policy together, and
+  // these have no policy to decide.
+  const privileges = deriveExtraPrivileges(contract);
+  for (const [role, privs] of Object.entries(deadGrants)) {
+    privileges[role] = [...new Set([...(privileges[role] ?? []), ...privs])].sort();
+  }
+
+  return { abilities, notes, unmappedRoles, privileges };
 }
 
 /** An object key, quoted only when the role name is not a bare JS identifier. */

package/src/cli/authz-lint.ts

@@ -46,3 +46,64 @@ export function findReadAuthzGaps(models: readonly ModelDescriptor[]): ReadAuthz
   }
   return gaps;
 }
+
+// ---------------------------------------------------------------------------
+// Naked DML grants — the safety that used to live in the parser.
+// ---------------------------------------------------------------------------
+
+/**
+ * A CRUD grant declared without the policy that gates it.
+ *
+ * `privileges` used to REFUSE the DML four at model-definition time, so that a grant could never
+ * be declared without its policy. That throw was removed because the invariant was vacuous for
+ * adoption: a live table can hold `GRANT SELECT TO admin` with no policy covering admin, and a
+ * language that cannot spell it makes such a database a permanent MISMATCH against
+ * `db:fingerprint` — so adopting one required mutating it first. Expressibility is total over the
+ * fingerprint's domain; the opinion belongs here instead.
+ *
+ * Severity is a WARNING, never fatal, and that is a considered narrowing of the original ruling.
+ * The ruling asked for an ERROR on a table without RLS, where a naked grant is an unrestricted
+ * table-wide privilege. That case cannot arise from models: `compileTableContract` emits
+ * `rls: { enabled: true }` UNCONDITIONALLY for every modeled table (authz-compile.ts:558). So a
+ * declared naked grant is always dead-on-arrival and only becomes live if someone later disables
+ * RLS on that table — a real risk, but a future one, and failing CI over a faithful rendering of
+ * a database the adopter is trying to adopt would make `db:pull` unusable on exactly the schemas
+ * it exists for.
+ */
+export interface NakedGrant {
+  schema: string;
+  table: string;
+  role: string;
+  privileges: string[];
+  message: string;
+}
+
+const DML = new Set(['SELECT', 'INSERT', 'UPDATE', 'DELETE']);
+
+/**
+ * Grants declared in `privileges` that carry no policy — reported for hand-authored and pulled
+ * models alike, because the shape is equally wrong to author and equally true to find.
+ */
+export function findNakedGrants(models: readonly ModelDescriptor[]): NakedGrant[] {
+  const out: NakedGrant[] = [];
+  for (const m of models) {
+    for (const role of Object.keys(m.privileges ?? {}).sort()) {
+      const dml = (m.privileges[role] ?? []).filter((p) => DML.has(p)).sort();
+      if (!dml.length) continue;
+      out.push({
+        schema: m.schema,
+        table: m.table,
+        role,
+        privileges: dml,
+        message:
+          `${m.schema}.${m.table}: '${role}' holds ${dml.join(', ')} as a grant with no policy beside it. ` +
+          `It is dead while RLS is on — the role reads zero rows — and becomes an unrestricted ` +
+          `table-wide privilege the day RLS is disabled or a broad policy is added. If this came from ` +
+          `db:pull it is a faithful reading of the database; decide whether to give it a policy ` +
+          `(can(...)) or revoke it. If you wrote it by hand, you almost certainly want can() instead, ` +
+          `which decides the grant and the policy together.`,
+      });
+    }
+  }
+  return out;
+}

package/src/cli/commands/db-check.ts

@@ -41,9 +41,11 @@ import { loadModels } from './db-generate.js';
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
 import type { SequenceDescriptor } from '@everystack/model';
 import type { SourceObject } from '../derived-source.js';
-import { findReadAuthzGaps } from '../authz-lint.js';
+import { findReadAuthzGaps, findNakedGrants } from '../authz-lint.js';
 import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline.js';
-import { findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings } from '../derived-lint.js';
+import {
+  findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings, findPublicExecutableSecdef,
+} from '../derived-lint.js';
 import { step, success, fail, info, warn } from '../output.js';
 
 // The role derivation moved to the shared builder (db-build) with brick
@@ -160,6 +162,13 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     }
   }
 
+  // A CRUD grant declared with no policy beside it. WARN, never fatal: this is what a faithful
+  // db:pull of a brownfield database looks like, and failing CI over it would make the pull
+  // unusable on the schemas it exists for. See findNakedGrants for why it is not an error.
+  for (const naked of findNakedGrants(input.models)) {
+    findings.push({ level: 'warn', area: 'authz', message: naked.message });
+  }
+
   // The adoption baseline, ARTIFACT ONLY.
   //
   // This check cannot see the threat and must not pretend to. The foreign grantees it
@@ -209,7 +218,7 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     for (const gap of derivedGaps) {
       findings.push({ level: 'fail', area: 'authz', message: gap.message });
     }
-    for (const warning of findMatviewSnapshotWarnings(input.derived)) {
+    for (const warning of [...findMatviewSnapshotWarnings(input.derived), ...findPublicExecutableSecdef(input.derived)]) {
       findings.push({ level: 'warn', area: 'authz', message: warning.message });
     }
     if (derivedGaps.length === 0) {

package/src/cli/derived-compile.ts

@@ -19,7 +19,7 @@
 
 import type {
   ModelDescriptor, DerivedDescriptor, ViewDescriptor, MaterializedViewDescriptor,
-  FunctionDescriptor, SqlDescriptor, TriggerSpec, Ability, SetofReturn, DependsOnRef,
+  FunctionDescriptor, SqlDescriptor, TriggerSpec, TriggerDescriptor, Ability, SetofReturn, DependsOnRef,
 } from '@everystack/model';
 import { hashSourceContent, parseQualified, DECLARED_SOURCE_FILE, type Attachment, type SourceObject } from './derived-source.js';
 import { isPlainGrantAttachment } from './derived-grants.js';
@@ -51,9 +51,21 @@ function refName(ref: SetofReturn['setof']): string {
 // Grants — the same audience semantics as tables
 // ---------------------------------------------------------------------------
 
-/** Relation read grants: bare read → anon + authenticated (the table precedent);
- *  `{ role }` narrows; `{ columns }` scopes the SELECT to a column list. */
-function relationGrants(target: string, abilities: readonly Ability[]): Attachment[] {
+/**
+ * Relation read grants: bare read → anon + authenticated (the table precedent);
+ * `{ role }` narrows; `{ columns }` scopes the SELECT to a column list.
+ *
+ * `privileges` is the second source — grants that EXIST, recorded by `db:pull` rather than
+ * chosen. It is what lets a brownfield view be rendered at all: the write grants a blanket
+ * `GRANT ALL ON ALL TABLES IN SCHEMA` left behind, and a `SELECT` to `PUBLIC`, are not
+ * expressible as read abilities, and emitting the object WITHOUT them would make the next
+ * generate plan a REVOKE of each one.
+ */
+function relationGrants(
+  target: string,
+  abilities: readonly Ability[],
+  privileges: Readonly<Record<string, string[]>> = {},
+): Attachment[] {
   const out: Attachment[] = [];
   for (const a of abilities) {
     const roles = a.condition.role ? a.condition.role : 'anon, authenticated';
@@ -62,17 +74,46 @@ function relationGrants(target: string, abilities: readonly Ability[]): Attachme
       : '';
     out.push({ kind: 'grant', sql: `GRANT SELECT${cols} ON ${target} TO ${roles}` });
   }
+  // Grantee-sorted, privileges in the declared order the model already normalized, so a
+  // re-render of an unchanged database is byte-stable.
+  for (const grantee of Object.keys(privileges).sort()) {
+    out.push({ kind: 'grant', sql: `GRANT ${privileges[grantee].join(', ')} ON ${target} TO ${grantee}` });
+  }
   return out;
 }
 
-/** Function authz: `REVOKE ALL … FROM PUBLIC` UNCONDITIONALLY (PostgreSQL grants EXECUTE
- *  to PUBLIC by default — the silent-open inverse of the RLS trap), then the declared
- *  `can('execute', { role })` grants. */
-function functionGrants(signature: string, abilities: readonly Ability[]): Attachment[] {
-  const out: Attachment[] = [{ kind: 'grant', sql: `REVOKE ALL ON FUNCTION ${signature} FROM PUBLIC` }];
+/**
+ * Function authz: `REVOKE ALL … FROM PUBLIC` (PostgreSQL grants EXECUTE to PUBLIC by
+ * default — the silent-open inverse of the RLS trap), then the declared grants.
+ *
+ * Two sources, and the distinction is the whole design: `abilities` are the INTENDED
+ * audience (`can('execute', { role })`), `privileges` are grants that EXIST, recorded by
+ * `db:pull` without claiming intent.
+ *
+ * **A declared `PUBLIC` privilege suppresses the revoke**, and that is not a loophole. The
+ * revoke is unconditional precisely because nobody could SAY "PUBLIC holds EXECUTE here";
+ * once a descriptor says it, revoking anyway would make a faithful pull of a live function
+ * plan a REVOKE the adopter never asked for — turning adoption into mutation. Declaring it
+ * is still a finding, raised where findings belong: db:check WARNs on a PUBLIC-executable
+ * SECURITY DEFINER function.
+ */
+function functionGrants(
+  signature: string,
+  abilities: readonly Ability[],
+  privileges: Readonly<Record<string, string[]>> = {},
+): Attachment[] {
+  const declaresPublic = Object.keys(privileges).some((g) => g.toUpperCase() === 'PUBLIC');
+  const out: Attachment[] = declaresPublic
+    ? []
+    : [{ kind: 'grant', sql: `REVOKE ALL ON FUNCTION ${signature} FROM PUBLIC` }];
   for (const a of abilities) {
     out.push({ kind: 'grant', sql: `GRANT EXECUTE ON FUNCTION ${signature} TO ${a.condition.role}` });
   }
+  // Sorted so a re-render of an unchanged database is byte-stable — object key order is
+  // insertion order, and the introspection's row order is not a contract.
+  for (const grantee of Object.keys(privileges).sort()) {
+    out.push({ kind: 'grant', sql: `GRANT EXECUTE ON FUNCTION ${signature} TO ${grantee}` });
+  }
   return out;
 }
 
@@ -98,7 +139,7 @@ function renderView(v: ViewDescriptor): { sql: string; attachments: Attachment[]
     sql: `CREATE VIEW ${target}${invoker} AS\n${v.as}`,
     attachments: [
       ...commentAttachment('VIEW', target, v.comment),
-      ...relationGrants(target, v.abilities),
+      ...relationGrants(target, v.abilities, v.privileges ?? {}),
     ],
   };
 }
@@ -128,7 +169,7 @@ function renderMaterializedView(mv: MaterializedViewDescriptor): { sql: string;
     attachments: [
       ...indexes,
       ...commentAttachment('MATERIALIZED VIEW', target, mv.comment),
-      ...relationGrants(target, mv.abilities),
+      ...relationGrants(target, mv.abilities, mv.privileges ?? {}),
     ],
   };
 }
@@ -166,7 +207,7 @@ function renderFunction(fn: FunctionDescriptor): { sql: string; attachments: Att
       `AS ${tag}\n${fn.body}\n${tag}`,
     attachments: [
       ...commentAttachment('FUNCTION', signature, fn.comment),
-      ...functionGrants(signature, fn.abilities),
+      ...functionGrants(signature, fn.abilities, fn.privileges ?? {}),
     ],
   };
 }
@@ -207,9 +248,22 @@ interface Node {
 function derivedIdentity(d: DerivedDescriptor): string {
   const { schema, name } = parseQualified(d.name);
   if (d.kind === 'function') return functionIdentity(schema, name, d.args.map((a) => a.type));
+  // A trigger's name is unique only WITHIN its table — two tables may both carry
+  // `touch_updated_at` — so its identity is the owner's, plus the name.
+  if (d.kind === 'trigger') {
+    const o = triggerOwnerOf(d);
+    return `${o.schema}.${o.name}.${d.name}`;
+  }
   return `${schema}.${name}`;
 }
 
+/** Where a standalone binding rides: a model is state (no derived identity), a view is not. */
+function triggerOwnerOf(d: TriggerDescriptor): { schema: string; name: string; ownerIdentity: string | null } {
+  if ('table' in d.on) return { schema: d.on.schema, name: d.on.table, ownerIdentity: null };
+  const q = parseQualified(d.on.name);
+  return { schema: q.schema, name: q.name, ownerIdentity: `${q.schema}.${q.name}` };
+}
+
 /** What a bad ref IS, for the gate's message — null if the value is a usable object. */
 function badRef(r: unknown): string | null {
   if (r === undefined) return 'undefined';
@@ -233,6 +287,13 @@ function rejectBadRefs(models: readonly ModelDescriptor[], derived: readonly Der
   hole('compileDerived', 'models', models);
   hole('compileDerived', 'derived', derived);
   for (const d of derived) {
+    // A trigger has no dependsOn — its two deps come free (the target, the execute
+    // function) — but its `on` is a ref like any other and a stale import must be loud.
+    if (d.kind === 'trigger') {
+      hole(`trigger '${d.name}'`, 'on', [d.on], false);
+      hole(`trigger '${d.name}'`, 'execute', [d.execute], false);
+      continue;
+    }
     hole(`${d.kind} '${d.name}'`, 'dependsOn', d.dependsOn ?? []);
     if (d.kind === 'function' && typeof d.returns !== 'string') {
       hole(`function '${d.name}'`, 'returns.setof', [d.returns.setof], false);
@@ -348,6 +409,14 @@ export function compileDerived(models: readonly ModelDescriptor[], derived: read
       const q = parseQualified(v.name);
       return { schema: q.schema, name: q.name, ownerIdentity: `${q.schema}.${q.name}`, triggers: v.triggers ?? [] };
     }),
+    // Standalone bindings (defineTrigger) — the same unit, reached from the descriptor
+    // rather than through its target. Both spellings compile to an identical node, which
+    // is the point: the deprecated attached form keeps working while `db:pull` renders the
+    // standalone one (a binding on a model would make the generated module import the
+    // compute layer, which is a fatal cycle rather than a style preference).
+    ...derived
+      .filter((d): d is TriggerDescriptor => d.kind === 'trigger')
+      .map((d) => ({ ...triggerOwnerOf(d), triggers: [d as TriggerSpec] })),
   ];
   for (const owner of triggerOwners) {
     for (const t of owner.triggers) {

package/src/cli/derived-grants.ts

@@ -38,7 +38,13 @@ export interface ParsedGrants {
 //   GRANT SELECT[ ("c1", "c2")] ON <target> TO r1[, r2…]
 //   GRANT EXECUTE ON FUNCTION <sig> TO r
 //   REVOKE ALL ON FUNCTION <sig> FROM PUBLIC
-const GRANT_RE = /^GRANT\s+([A-Z]+)\s*(\([^)]*\))?\s+ON\s+(.+?)\s+TO\s+(.+)$/i;
+// The privilege slot is a LIST — `GRANT SELECT, INSERT ON x TO y` is one statement, and
+// PostgreSQL's own grammar says so. It used to match a single word, so a multi-privilege
+// grant parsed as no grant at all: the declared contract came back empty and the very next
+// check planned a REVOKE of every privilege the object had just been given. That stayed
+// latent only because the compiler happened to emit one privilege per statement; recording
+// a relation's live ACL (which is naturally multi-privilege) walked straight into it.
+const GRANT_RE = /^GRANT\s+([A-Z]+(?:\s*,\s*[A-Z]+)*)\s*(\([^)]*\))?\s+ON\s+(.+?)\s+TO\s+(.+)$/i;
 const REVOKE_PUBLIC_RE = /^REVOKE\s+ALL\s+ON\s+(.+?)\s+FROM\s+PUBLIC$/i;
 
 /**
@@ -72,14 +78,15 @@ export function parseGrantAttachments(attachments: readonly Attachment[]): Parse
     }
     const grant = a.sql.match(GRANT_RE);
     if (!grant) continue;
-    const [, privilege, columns, onTarget, roleList] = grant;
+    const [, privilegeList, columns, onTarget, roleList] = grant;
     if (columns) {
       hasColumnGrants = true;
       continue; // attacl territory — declared, applied at create, not drift-checked yet
     }
     target ??= onTarget.trim();
+    const privileges = privilegeList.split(',').map((p) => p.trim().toUpperCase()).filter(Boolean);
     for (const role of roleList.split(',').map((r) => r.trim()).filter(Boolean)) {
-      (grants[role] ??= new Set()).add(privilege.toUpperCase());
+      for (const privilege of privileges) (grants[role] ??= new Set()).add(privilege);
     }
   }
 

package/src/cli/derived-introspect.ts

@@ -45,6 +45,19 @@ export interface LiveObject {
   rows?: number;
   /** Trigger only: the (bare or schema-qualified) relation it rides — `DROP TRIGGER … ON` needs it. */
   table?: string;
+  /** Trigger only: the owner's full `schema.table`, for joining to a model or a derived view. */
+  ownerIdentity?: string;
+  /** Trigger only (R2 pull rendering): the structured binding `defineTrigger` is rendered from.
+   *  Absent when the introspection predates R2 — absent means "not measured", never "no WHEN". */
+  trg?: {
+    shape: TriggerShape;
+    /** `schema.name` of the trigger function. Trigger functions take no arguments. */
+    functionIdentity: string;
+    /** `UPDATE OF (cols)` in declaration order. */
+    updateOf?: string[];
+    /** The WHEN predicate as the catalog deparses it. */
+    when?: string;
+  };
   /** Live ACLs (grantee → sorted privileges), owner excluded, function defaults expanded.
    *  Absent on triggers (they take no grants) and when the introspection predates B4. */
   grants?: Record<string, string[]>;
@@ -198,13 +211,20 @@ ORDER BY n.nspname, t.relname, idx.indexrelid;
  * lookups by MANAGED derived identities, so table-referenced edges never join it.
  * System-schema referenced sides are excluded on both branches: a view reading
  * pg_catalog is not an edge anyone declares.
+ *
+ * `::text` on the first branch's name columns is the same load-bearing cast as
+ * DERIVED_GRANTS_SQL: later branches put `proname(argtypes)` on both the dependent and
+ * the referenced side, and a UNION types each column from the FIRST branch, so a bare
+ * `relname` (`name`, 63 bytes) would truncate a long function signature. The edge would
+ * then name an identity that joins nothing, and the edge is silently dropped — a wrong
+ * rebuild order, and a `dependsOn` the pull never writes.
  */
 export const DERIVED_DEPENDS_SQL = `
 SELECT DISTINCT
-  dn.nspname AS dependent_schema,
-  dc.relname AS dependent_name,
-  rn.nspname AS referenced_schema,
-  rc.relname AS referenced_name
+  dn.nspname::text AS dependent_schema,
+  dc.relname::text AS dependent_name,
+  rn.nspname::text AS referenced_schema,
+  rc.relname::text AS referenced_name
 FROM pg_depend d
 JOIN pg_rewrite rw ON rw.oid = d.objid
 JOIN pg_class dc ON dc.oid = rw.ev_class
@@ -282,13 +302,22 @@ WHERE d.classid = 'pg_proc'::regclass
  * `LEFT JOIN pg_roles` + COALESCE('PUBLIC') keeps a dropped-role ACL from failing the
  * read (the table path's offline-safety). `kind` disambiguates a relation and a
  * function sharing a name.
+ *
+ * `::text` on the name-typed columns is load-bearing, not tidiness. `relname` is
+ * PostgreSQL's `name` type (63 bytes) and a UNION takes each column's type from the
+ * FIRST branch, so without the cast the function branch's `proname(argtypes)` text is
+ * coerced DOWN to `name` and silently truncated at 63. Every consumer keys on that
+ * identity, so a function with ~5 ordinary parameters lost its ACL outright: db:pull
+ * rendered no `can('execute')`, and diffObjectGrants — which unions the DECLARED and LIVE
+ * grantees — never saw the live grantee, so no REVOKE was planned and reconcile reported
+ * converged while the grant was still live.
  */
 export const DERIVED_GRANTS_SQL = `
 SELECT
-  n.nspname AS schema,
-  c.relname AS name,
-  'r' AS kind,
-  COALESCE(r.rolname, 'PUBLIC') AS grantee,
+  n.nspname::text AS schema,
+  c.relname::text AS name,
+  'r'::text AS kind,
+  COALESCE(r.rolname, 'PUBLIC')::text AS grantee,
   array_agg(DISTINCT a.privilege_type ORDER BY a.privilege_type) AS privileges
 FROM pg_class c
 JOIN pg_namespace n ON n.oid = c.relnamespace
@@ -331,17 +360,83 @@ export const PROVENANCE_SQL = `
 SELECT identity, src_hash, def_hash, to_jsonb(p) AS extra FROM everystack.derived_provenance p;
 `.trim();
 
-/** User triggers (never internal/constraint machinery) with their canonical definition —
- *  the live side of the trigger reconcile. Compound identity: schema.table.name. */
+/**
+ * The bits PostgreSQL packs into `pg_trigger.tgtype`
+ * (src/include/catalog/pg_trigger.h). Timing, event set and level all share one mask.
+ */
+export const TRIGGER_TYPE_BITS = {
+  row: 1, before: 2, insert: 4, delete: 8, update: 16, truncate: 32, instead: 64,
+} as const;
+
+/** The canonical event order — the model's own (`EVENT_ORDER` in model/src/derived.ts).
+ *  Ordering by the MASK instead would render `update, insert` for one trigger and
+ *  `insert, update` for another, and the two would hash differently while being equal. */
+const TRIGGER_EVENT_ORDER = ['insert', 'update', 'delete', 'truncate'] as const;
+
+export interface TriggerShape {
+  timing: 'before' | 'after' | 'insteadOf';
+  events: ('insert' | 'update' | 'delete' | 'truncate')[];
+  forEach: 'row' | 'statement';
+}
+
+/**
+ * `tgtype` → the shape `trigger()` declares. The bitmask is the ONLY structured source
+ * for a trigger's timing/events/level; `pg_get_triggerdef` is prose, and parsing prose
+ * back into structure is how a renderer starts disagreeing with the catalog.
+ *
+ * `instead` is checked before `before` because they are different fields sharing a mask:
+ * an INSTEAD OF trigger is never BEFORE, and reading the bits in the other order would
+ * silently render a view's INSTEAD OF trigger as a table-shaped BEFORE one.
+ */
+export function parseTriggerType(tgtype: number): TriggerShape {
+  const has = (bit: number): boolean => (tgtype & bit) !== 0;
+  const events = TRIGGER_EVENT_ORDER.filter((e) => has(TRIGGER_TYPE_BITS[e]));
+  if (events.length === 0) {
+    throw new Error(`trigger tgtype ${tgtype} has no event bits — PostgreSQL never writes that, so the read is wrong, not the database.`);
+  }
+  return {
+    timing: has(TRIGGER_TYPE_BITS.instead) ? 'insteadOf' : has(TRIGGER_TYPE_BITS.before) ? 'before' : 'after',
+    events: [...events],
+    forEach: has(TRIGGER_TYPE_BITS.row) ? 'row' : 'statement',
+  };
+}
+
+/**
+ * User triggers (never internal/constraint machinery) with their canonical definition —
+ * the live side of the trigger reconcile. Compound identity: schema.table.name.
+ *
+ * The STRUCTURED half (`tgtype`, `update_of`, `when_expr`, the function identity) is what
+ * a `trigger()` binding is rendered from; the `definition` text stays for the def hash.
+ *
+ * **`when_expr` is scraped out of `pg_get_triggerdef`, and that is not laziness.**
+ * `pg_get_expr(t.tgqual, t.tgrelid)` — the obvious call — FAILS OUTRIGHT on any trigger
+ * carrying a WHEN clause that mentions both OLD and NEW:
+ *
+ *     ERROR:  expression contains variables of more than one relation
+ *
+ * A WHEN over two pseudo-relations is the common case (`WHEN (OLD.* IS DISTINCT FROM
+ * NEW.*)`), so the direct read is not merely lossy — it errors, and it errors on the
+ * whole query, taking every other trigger's row with it. `pg_get_triggerdef` renders the
+ * same expression correctly because it knows the OLD/NEW aliases. Verified against a live
+ * brownfield database, 2026-08-06.
+ */
 export const DERIVED_TRIGGERS_SQL = `
 SELECT
   n.nspname AS schema,
   c.relname AS "table",
   t.tgname AS name,
-  pg_get_triggerdef(t.oid) AS definition
+  pg_get_triggerdef(t.oid) AS definition,
+  t.tgtype::int AS tgtype,
+  fn.nspname::text || '.' || p.proname::text AS function_identity,
+  (SELECT array_agg(a.attname::text ORDER BY x.ord)
+     FROM unnest(t.tgattr::int2[]) WITH ORDINALITY AS x(attnum, ord)
+     JOIN pg_attribute a ON a.attrelid = t.tgrelid AND a.attnum = x.attnum) AS update_of,
+  substring(pg_get_triggerdef(t.oid) from ' WHEN [(](.*)[)] EXECUTE ') AS when_expr
 FROM pg_trigger t
 JOIN pg_class c ON c.oid = t.tgrelid
 JOIN pg_namespace n ON n.oid = c.relnamespace
+JOIN pg_proc p ON p.oid = t.tgfoid
+JOIN pg_namespace fn ON fn.oid = p.pronamespace
 WHERE NOT t.tgisinternal
   AND n.nspname NOT IN ('pg_catalog', 'information_schema')
   AND n.nspname NOT LIKE 'pg_%'
@@ -409,6 +504,16 @@ export interface TriggerRow {
   table: string;
   name: string;
   definition: unknown;
+  /** The structured half — all optional, because a pre-R2 introspection has none of it
+   *  and an absent field must read as "not measured", never as "no WHEN clause". */
+  tgtype?: unknown;
+  /** `schema.name` of the trigger function. Trigger functions take no arguments, so the
+   *  bare name identifies one — no signature needed, unlike every other function read. */
+  function_identity?: unknown;
+  /** `UPDATE OF (cols)`, column names in declaration order. NULL when unqualified. */
+  update_of?: unknown;
+  /** The WHEN predicate, scraped from pg_get_triggerdef — see DERIVED_TRIGGERS_SQL. */
+  when_expr?: unknown;
 }
 
 export interface GrantAclRow {
@@ -547,11 +652,21 @@ export function assembleDerivedCatalog(rows: DerivedRows): DerivedCatalog {
     const ownerIdentity = `${row.schema}.${row.table}`;
     const identity = `${ownerIdentity}.${row.name}`;
     const definition = String(row.definition ?? '');
+    const updateOf = pgTextArray(row.update_of);
     objects.push({
       kind: 'trigger', schema: row.schema, name: row.name, identity,
       definition, indexes: [],
       defHash: computeDefHash(definition, []),
       table: row.schema === 'public' ? row.table : ownerIdentity,
+      ownerIdentity,
+      ...(row.tgtype != null && row.function_identity != null ? {
+        trg: {
+          shape: parseTriggerType(Number(row.tgtype)),
+          functionIdentity: String(row.function_identity),
+          ...(updateOf.length ? { updateOf } : {}),
+          ...(row.when_expr != null ? { when: String(row.when_expr) } : {}),
+        },
+      } : {}),
     });
     if (relationIdentities.has(ownerIdentity)) {
       triggerEdges.push({ dependent: identity, referenced: ownerIdentity });

package/src/cli/derived-lint.ts

@@ -132,11 +132,32 @@ export function findDerivedReadGaps(derived: readonly DerivedDescriptor[]): Deri
  * is privileged code with an undeclared audience — callable by nobody today (PUBLIC is
  * revoked unconditionally) and by whoever gets a grant tomorrow, with no declaration to
  * review. Invoker functions may stay dark: unprivileged, owner-callable, honest.
+ *
+ * TRIGGER FUNCTIONS ARE EXEMPT, and the exemption is structural rather than a courtesy.
+ * A trigger function has no caller role to declare: PostgreSQL performs no EXECUTE check
+ * on the invoking role when a trigger fires, so its audience is the table event, not a
+ * grantee. Live ones therefore carry no EXECUTE grant, and the gate could only be
+ * satisfied by declaring one — which compiles to a GRANT the database never had. That is
+ * the same widening this module's read/manage siblings exist to prevent, arriving on the
+ * function branch, and it made a faithful pull of a SECDEF trigger function unshippable:
+ * the adopter's only way past db:check was to widen their own database.
+ *
+ * The discriminator is `returns === 'trigger'` — the return type, never the name. It is
+ * the same fact `trigger()` already relies on (model/src/derived.ts, which refuses an
+ * `execute:` whose function does not return `trigger`), so the two agree by construction.
+ *
+ * A RECORDED grant counts as a declared caller too. `privileges: { PUBLIC: ['EXECUTE'] }`
+ * is `db:pull` saying "the database grants this" — the audience IS declared and reviewable,
+ * it simply was not chosen by the author. The gap gate is about undeclared audience, so it
+ * stops firing; the objection moves to `findPublicExecutableSecdef` below, which is a
+ * warning. Abilities are opinion, privileges are fact, and the linter holds the opinions.
  */
 export function findSecdefExecuteGaps(derived: readonly DerivedDescriptor[]): DerivedAuthzGap[] {
   const gaps: DerivedAuthzGap[] = [];
   for (const d of derived) {
     if (d.kind !== 'function' || d.security !== 'definer' || d.abilities.length > 0) continue;
+    if (d.returns === 'trigger') continue;
+    if (Object.keys(d.privileges ?? {}).length > 0) continue;
     const identity = identityOf(d);
     gaps.push({
       identity,
@@ -148,6 +169,38 @@ export function findSecdefExecuteGaps(derived: readonly DerivedDescriptor[]): De
   return gaps;
 }
 
+// ---------------------------------------------------------------------------
+// Gate: SECURITY DEFINER executable by PUBLIC (db:check warn)
+// ---------------------------------------------------------------------------
+
+/**
+ * Privileged code any role can call. This is where the objection to a PUBLIC EXECUTE grant
+ * lives now that the grant is spellable — a WARN, not a failure, because on an adopted
+ * database it is a faithful report of what is already true, and failing CI on a faithful
+ * pull would make `db:pull` unusable on exactly the schemas it exists for. (Same call, and
+ * the same reasoning, as `findNakedGrants` on the table side.)
+ *
+ * Only DEFINER functions: an invoker function executes with the caller's own rights, so
+ * PUBLIC EXECUTE on one grants no authority the caller did not already have.
+ */
+export function findPublicExecutableSecdef(derived: readonly DerivedDescriptor[]): DerivedAuthzGap[] {
+  const warnings: DerivedAuthzGap[] = [];
+  for (const d of derived) {
+    if (d.kind !== 'function' || d.security !== 'definer') continue;
+    if (d.returns === 'trigger') continue;
+    if (!Object.keys(d.privileges ?? {}).some((g) => g.toUpperCase() === 'PUBLIC')) continue;
+    const identity = identityOf(d);
+    warnings.push({
+      identity,
+      message:
+        `${identity} is SECURITY DEFINER and executable by PUBLIC — it runs with its owner's rights and every ` +
+        `role can call it, including anon. This is recorded as live fact, not a choice: confirm the body is safe ` +
+        `for an untrusted caller, then narrow it to can('execute', { role: '…' }) and drop the PUBLIC privilege.`,
+    });
+  }
+  return warnings;
+}
+
 // ---------------------------------------------------------------------------
 // Gate: matview snapshot over row-scoped sources (db:check warn)
 // ---------------------------------------------------------------------------

package/src/cli/derived-render.ts

@@ -77,26 +77,45 @@ function tsTemplate(body: string): string {
   return body.replace(/\\/g, '\\\\').replace(/`/g, '\\`').replace(/\$\{/g, '\\${');
 }
 
+/** An object key, bare when it is a valid identifier and quoted when it is not — a role
+ *  name is a PostgreSQL identifier and may hold characters JavaScript will not take bare. */
+function tsKey(s: string): string {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(s) ? s : tsString(s);
+}
+
 function tsString(s: string): string {
   return `'${s.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
 }
 
-/** The relation grant shapes `abilities` can say. Null = inexpressible (caller FIXMEs). */
-function relationAbilities(grants: Record<string, string[]>): string[] | null {
-  const roles = Object.keys(grants);
-  for (const role of roles) {
-    if (role.toUpperCase() === 'PUBLIC') return null;
-    if (grants[role].some((p) => p !== 'SELECT')) return null;
+/**
+ * Split a relation's live ACL into what `abilities` can SAY and what must be RECORDED.
+ *
+ * A grantee whose privileges are exactly `SELECT`, and which is a named app role, is an
+ * intended read audience — `can('read')`. Everything else is fact without intent:
+ * `PUBLIC` (not a role the ability vocabulary addresses) and any privilege beyond SELECT
+ * (write grants, REFERENCES/TRIGGER/TRUNCATE). Those become `privileges`.
+ *
+ * Splitting rather than rejecting is the whole of R1: previously ANY inexpressible grant
+ * discarded the entire object, body included.
+ */
+function splitRelationGrants(
+  grants: Record<string, string[]>,
+): { abilities: string[]; privileges: Record<string, string[]> } {
+  const readRoles = new Set<string>();
+  const privileges: Record<string, string[]> = {};
+  for (const [grantee, privs] of Object.entries(grants)) {
+    const selectOnly = privs.length === 1 && privs[0] === 'SELECT';
+    if (selectOnly && grantee.toUpperCase() !== 'PUBLIC') readRoles.add(grantee);
+    else privileges[grantee] = [...privs].sort();
   }
-  const set = new Set(roles);
-  const out: string[] = [];
-  if (set.has('anon') && set.has('authenticated')) {
-    out.push(`can('read')`);
-    set.delete('anon');
-    set.delete('authenticated');
+  const abilities: string[] = [];
+  if (readRoles.has('anon') && readRoles.has('authenticated')) {
+    abilities.push(`can('read')`);
+    readRoles.delete('anon');
+    readRoles.delete('authenticated');
   }
-  for (const role of [...set].sort()) out.push(`can('read', { role: ${tsString(role)} })`);
-  return out;
+  for (const role of [...readRoles].sort()) abilities.push(`can('read', { role: ${tsString(role)} })`);
+  return { abilities, privileges };
 }
 
 /**
@@ -202,6 +221,32 @@ function renderTableIndexBuilder(indexdef: string): string | null {
   return s;
 }
 
+/**
+ * A collision-free variable for a trigger binding, chosen deterministically so a re-pull of
+ * an unchanged database is byte-stable. In order: the bare name, then `<name>Trigger`, then
+ * owner-qualified, then owner-qualified + `Trigger`. The last step cannot collide —
+ * a trigger name is unique within its table, so table + name is unique in the schema.
+ */
+function uniqueVar(base: string, o: LiveObject, used: Set<string>): string {
+  const ownerName = (o.table ?? '').split('.').pop() ?? '';
+  for (const candidate of [
+    base,
+    `${base}Trigger`,
+    toCamelCase(`${ownerName}_${o.name}`),
+    toCamelCase(`${ownerName}_${o.name}_trigger`),
+  ]) {
+    if (!used.has(candidate)) {
+      used.add(candidate);
+      return candidate;
+    }
+  }
+  // Unreachable on a real catalog; a counter beats throwing on a name.
+  let i = 2;
+  while (used.has(`${base}Trigger${i}`)) i += 1;
+  used.add(`${base}Trigger${i}`);
+  return `${base}Trigger${i}`;
+}
+
 export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRenderOptions): DerivedRenderResult {
   const warnings: string[] = [];
   const lines: string[] = [];
@@ -227,10 +272,12 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
 
   // -- emission order: dependencies first (Kahn over derived→derived edges) ---
 
+  // Triggers are held out of the topological pass and emitted LAST (see the trigger block
+  // at the end). A binding needs BOTH its target and its execute function to already
+  // exist, and the catalog records no trigger→function edge, so file order — not the
+  // dependency sort — is what guarantees it.
   const renderable = catalog.objects.filter((o) => o.kind !== 'trigger');
-  for (const t of catalog.objects.filter((o) => o.kind === 'trigger')) {
-    warnings.push(`${t.identity}: live trigger not rendered — declare it on its model with trigger() (v1 renders relations, functions, and sequences).`);
-  }
+  const triggers = catalog.objects.filter((o) => o.kind === 'trigger');
   const byIdentity = new Map(renderable.map((o) => [o.identity, o]));
   // Var names carry the schema for non-public objects — two schemas can share a bare name.
   // OVERLOADS share everything but their argument types, so a bare name would emit two
@@ -302,22 +349,34 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
     const { refs, fixmes } = depsFor(o.identity);
 
     if (o.kind === 'view' || o.kind === 'materialized view') {
-      const abilities = relationAbilities(o.grants ?? {});
-      if (abilities === null) {
-        const grantText = Object.entries(o.grants ?? {}).map(([r, p]) => `${r}: ${p.join('/')}`).join(', ');
+      // The live ACL splits in two: the part `can('read')` can SAY (plain SELECT to named
+      // app roles) becomes abilities, and everything else is RECORDED as `privileges`.
+      //
+      // This used to skip the object outright — definition and all — whenever any grant
+      // was inexpressible, which on a real brownfield schema is every relation it has:
+      // three roles hold the blanket DELETE/INSERT/REFERENCES/SELECT/TRIGGER/TRUNCATE/
+      // UPDATE that `GRANT ALL ON ALL TABLES IN SCHEMA` leaves behind, and PUBLIC holds
+      // SELECT on a few. The adopter got a FIXME instead of their view.
+      //
+      // Recording is also what makes rendering SAFE, and it is why the silent-REVOKE
+      // question that blocked this no longer needs an answer: emitting the view with only
+      // the abilities we can express would leave the write grants undeclared, so the next
+      // generate would plan a REVOKE for each — a silent skip traded for a silent revoke.
+      // Declared == live means nothing is planned at all.
+      const { abilities, privileges } = splitRelationGrants(o.grants ?? {});
+      const writeGrants = Object.values(privileges).some((ps) =>
+        ps.some((p) => p === 'INSERT' || p === 'UPDATE' || p === 'DELETE'),
+      );
+      if (writeGrants) {
         // A view carrying INSERT/UPDATE/DELETE almost never means someone intended a
         // writable view — it usually traces to a blanket `GRANT ALL ON ALL TABLES IN
         // SCHEMA public` in an old migration, which sweeps views up with the tables.
         // Naming that here saves the diagnosis; an adopter paid for it once already.
-        const writeGrants = Object.values(o.grants ?? {}).some((ps) =>
-          ps.some((p) => p === 'INSERT' || p === 'UPDATE' || p === 'DELETE'),
+        const grantText = Object.entries(privileges).map(([r, p]) => `${r}: ${p.join('/')}`).join(', ');
+        warnings.push(
+          `${o.identity}: write privileges (${grantText}) recorded as \`privileges\` — the object is declared and nothing will be revoked. ` +
+          'Write privileges on a view usually come from a blanket `GRANT ALL ON ALL TABLES IN SCHEMA …` rather than a deliberate writable view — check that first, then revoke and re-pull.',
         );
-        const hint = writeGrants
-          ? ' Write privileges on a view usually come from a blanket `GRANT ALL ON ALL TABLES IN SCHEMA …` rather than a deliberate writable view — check that first.'
-          : '';
-        warnings.push(`${o.identity}: live grants (${grantText}) are not expressible as relation abilities (read-only, role-shaped) — object skipped; migrate it by hand.${hint}`);
-        lines.push(`// FIXME: ${o.identity} skipped — live grants (${grantText}) are not expressible as abilities (views are read surfaces).`, '');
-        continue;
       }
 
       // --matviews-as-tables (the gap-B consumer flip): the matview renders as a
@@ -359,7 +418,13 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
           lines.push(
             ...fixmes,
             `export const ${varName} = defineMaterializedTable(${tsString(o.name)}, {`,
-            `  ${abilities.length ? `abilities: [${abilities.join(', ')}],` : 'private: true,'}`,
+            // Same split as the relation path: a model carries `privileges` too, so the
+            // inexpressible grants are recorded rather than dropped on this branch either.
+            ...(abilities.length ? [`  abilities: [${abilities.join(', ')}],`]
+              : Object.keys(privileges).length ? [] : ['  private: true,']),
+            ...(Object.keys(privileges).length
+              ? [`  privileges: { ${Object.keys(privileges).sort().map((g) => `${tsKey(g)}: [${privileges[g].map(tsString).join(', ')}]`).join(', ')} },`]
+              : []),
             ...(o.schema !== 'public' ? [`  schema: ${tsString(o.schema)},`] : []),
             '  fields: {',
             ...fieldLines,
@@ -377,12 +442,21 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
       }
 
       const props: string[] = [];
+      const hasPrivileges = Object.keys(privileges).length > 0;
       if (o.kind === 'view') props.push(`securityInvoker: ${o.securityInvoker === true},`);
-      if (abilities.length === 0) props.push('private: true,');
-      else {
+      // `private: true` means "declared dark, no grants" — it contradicts a recorded
+      // grant, and the model refuses the pair. A relation whose only reach is recorded
+      // (PUBLIC SELECT, or a write grant) is not dark; it just has no CHOSEN audience.
+      if (abilities.length === 0 && !hasPrivileges) props.push('private: true,');
+      else if (abilities.length) {
         props.push(`abilities: [${abilities.join(', ')}],`);
         need('can');
       }
+      if (hasPrivileges) {
+        const entries = Object.keys(privileges).sort()
+          .map((g) => `${tsKey(g)}: [${privileges[g].map(tsString).join(', ')}]`);
+        props.push(`privileges: { ${entries.join(', ')} },`);
+      }
       if (refs.length) props.push(`dependsOn: [${refs.join(', ')}],`);
       if (o.kind === 'materialized view') {
         const builders = o.indexes.map((def) => {
@@ -458,6 +532,11 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
       props.push(`abilities: [${roleGrants.map((r) => `can('execute', { role: ${tsString(r)} })`).join(', ')}],`);
       need('can');
     }
+    // A live PUBLIC EXECUTE is RECORDED, not converted into an ability. Rendering it as
+    // can('execute', { role: … }) would invent an audience the database never named, and
+    // dropping it silently would make the descriptor plan a REVOKE on adoption. Both are
+    // the adopter's database being changed to suit our vocabulary.
+    if (publicExec) props.push(`privileges: { PUBLIC: ['EXECUTE'] },`);
     if (refs.length) props.push(`dependsOn: [${refs.join(', ')}],`);
     if (o.comment) props.push(`comment: ${tsString(o.comment)},`);
     props.push(`body: sql\`${tsTemplate(f.src.trim())}\`,`);
@@ -465,8 +544,11 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
     need('sql');
     lines.push(
       ...fixmes,
-      ...(publicExec
-        ? [`// FIXME: ${o.identity} — live grants EXECUTE to PUBLIC; descriptors ALWAYS revoke PUBLIC. Declare the intended callers (adopting this descriptor applies the revoke).`]
+      // Not a FIXME any more — `privileges: { PUBLIC: ['EXECUTE'] }` above says it, and
+      // adopting the descriptor no longer applies a revoke. It is still worth a look on a
+      // SECURITY DEFINER function, which is what db:check now WARNs about.
+      ...(publicExec && f.secdef
+        ? [`// NOTE: ${o.identity} is SECURITY DEFINER and live-granted EXECUTE to PUBLIC — recorded, not chosen. Narrow it to can('execute', { role }) once you know the intended callers.`]
         : []),
       `export const ${varName} = defineFunction(${tsString(declaredName(o))}, {`,
       ...props.map((p) => `  ${p}`),
@@ -476,6 +558,69 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
     names.push(varName);
   }
 
+  // -- trigger bindings, last -------------------------------------------------
+  //
+  // Every identifier the file has already exported. A trigger's variable must dodge all of
+  // them, not just other triggers.
+  const usedVars = new Set<string>([...names, ...sequenceNames, ...materializedTableNames]);
+  //
+  // One descriptor per BINDING, never per function. The two are many-to-one — on the
+  // reference schema 18 bindings share 11 functions, `_touch_updated_at()` alone serving
+  // five tables — so a renderer keyed on the function would silently emit 11 and lose the
+  // rest. The target may be a MODEL (imported) or a derived VIEW (declared above).
+  for (const o of [...triggers].sort((a, b) => a.identity.localeCompare(b.identity))) {
+    const owner = o.ownerIdentity ?? (o.table?.includes('.') ? o.table : `${o.schema}.${o.table ?? ''}`);
+    const modelVar = opts.knownTables.get(owner);
+    const targetVar = modelVar ?? varOf.get(owner);
+    if (!o.trg || !targetVar) {
+      warnings.push(
+        `${o.identity}: trigger not rendered — ${!o.trg
+          ? 'the introspection carried no structured binding (pre-R2 catalog read)'
+          : `its target '${owner}' is neither a known model nor a rendered view`}.`,
+      );
+      continue;
+    }
+    // The function is matched by identity. Trigger functions take no arguments, so the
+    // catalog's signature is always `()` — no overload can exist to disambiguate.
+    const fnVar = varOf.get(`${o.trg.functionIdentity}()`);
+    if (!fnVar) {
+      warnings.push(`${o.identity}: trigger not rendered — its function '${o.trg.functionIdentity}' is not in the rendered set.`);
+      continue;
+    }
+    // Registered only once the binding actually renders — an import emitted for a skipped
+    // trigger would be an unused name in generated code.
+    if (modelVar) modelRefs.add(owner);
+    // A trigger's name collides freely: with its OWN function (`update_users_tsvector` is
+    // both, on the reference schema) and with a same-named trigger on another table
+    // (trigger names are unique per table, not per schema). Either collision emits two
+    // `export const X` — the file does not compile, and `execute: X` would bind the
+    // trigger to itself. Suffix only on collision, so an uncontended schema renders
+    // byte-identically to a name-per-object scheme.
+    const varName = uniqueVar(
+      toCamelCase(o.schema === 'public' ? o.name : `${o.schema}_${o.name}`),
+      o,
+      usedVars,
+    );
+    const props = [
+      `on: ${targetVar},`,
+      `timing: ${tsString(o.trg.shape.timing)},`,
+      `events: [${o.trg.shape.events.map(tsString).join(', ')}],`,
+      `forEach: ${tsString(o.trg.shape.forEach)},`,
+      ...(o.trg.updateOf?.length ? [`of: [${o.trg.updateOf.map(tsString).join(', ')}],`] : []),
+      ...(o.trg.when ? [`condition: sql\`${tsTemplate(o.trg.when)}\`,`] : []),
+      `execute: ${fnVar},`,
+    ];
+    if (o.trg.when) need('sql');
+    need('defineTrigger');
+    lines.push(
+      `export const ${varName} = defineTrigger(${tsString(o.name)}, {`,
+      ...props.map((p) => `  ${p}`),
+      '});',
+      '',
+    );
+    names.push(varName);
+  }
+
   return {
     block: lines.join('\n').trimEnd(),
     names,

package/src/cli/derived-source.ts

@@ -285,25 +285,12 @@ export function normalizeSql(sql: string): string {
 // Classification.
 // ---------------------------------------------------------------------------
 
-/** Strip quotes from an identifier and split an optionally schema-qualified name. */
-export function parseQualified(raw: string): { schema: string; name: string } {
-  const parts: string[] = [];
-  let current = '';
-  let quoted = false;
-  for (let i = 0; i < raw.length; i++) {
-    const ch = raw[i];
-    if (ch === '"') {
-      if (quoted && raw[i + 1] === '"') { current += '"'; i++; continue; }
-      quoted = !quoted;
-      continue;
-    }
-    if (ch === '.' && !quoted) { parts.push(current); current = ''; continue; }
-    current += ch;
-  }
-  parts.push(current);
-  if (parts.length >= 2) return { schema: parts[0], name: parts.slice(1).join('.') };
-  return { schema: 'public', name: parts[0] };
-}
+// `parseQualified` moved to `@everystack/model` (src/qualified.ts) when the composition
+// guard needed it: `defineModule` has to line a model's `schema` up against the schema
+// inside a descriptor's declared name, and model cannot import cli. Re-exported here so
+// every existing caller keeps its `./derived-source.js` import and there stays exactly one
+// definition — two copies of this splitter is how the emitters and the guard drift apart.
+export { parseQualified } from '@everystack/model';
 
 // (The db/sql statement classifier and parseSqlSources lived here until B7 —
 // descriptors are the single home; declared-derived.ts's retiredSqlDir() is the

package/src/cli/parse-flags.ts

@@ -25,12 +25,32 @@ function isFlag(arg: string): boolean {
   return arg.startsWith('-') && arg.length > 1;
 }
 
-/** Parse `--key value` / `-k value` pairs; a flag with no value becomes `'true'`. */
+/** Parse `--key value`, `--key=value`, `-k value`; a flag with no value becomes `'true'`. */
 export function parseFlags(args: string[]): Record<string, string> {
   const flags: Record<string, string> = {};
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (!isFlag(arg)) continue;
+
+    // `--key=value`. Split on the FIRST `=` only: the value is routinely a connection string
+    // whose own query carries more (`postgresql://h/db?sslmode=require`), and splitting on
+    // every `=` would truncate it to the host.
+    //
+    // This form used to be dropped ENTIRELY — the whole `--database-url=…` token parsed as a
+    // key with no value, so the flag was simply absent. For a venue flag that is not a parse
+    // error, it is a silent CHANGE OF TARGET: `db:plan --database-url=postgres://localhost/x`
+    // found no url source, fell through to the stage lane, and went to AWS. A consumer lost an
+    // afternoon to it against a local database with no AWS at all. On a destructive verb the
+    // same slip aims at the deployed stage instead of the local database.
+    const eq = arg.indexOf('=');
+    if (eq > 1) {
+      const rawKey = arg.slice(0, eq);
+      const key = rawKey.startsWith('--') ? rawKey.slice(2) : rawKey.slice(1);
+      // The empty string is a VALUE, not an absent one — same rule as `--set ''` below.
+      flags[key] = arg.slice(eq + 1);
+      continue;
+    }
+
     const key = arg.startsWith('--') ? arg.slice(2) : arg.slice(1);
     const next = args[i + 1];
     flags[key] = next !== undefined && !isFlag(next) ? args[++i] : 'true';