@everystack/cli 0.4.48 → 0.4.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.48",
+  "version": "0.4.50",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -109,7 +109,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.12"
+    "@everystack/model": "0.4.13"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",

package/src/cli/authz-derive.ts

@@ -64,8 +64,10 @@ const DML: Record<string, 'read' | 'create' | 'update' | 'delete'> = {
   DELETE: 'delete',
 };
 
-/** The roles the compiler itself emits policies for; anything else is app-specific. */
-const KNOWN_ROLES = new Set(['anon', 'authenticated', 'admin']);
+/** The roles the compiler itself emits policies for; anything else is app-specific.
+ *  Exported so the DERIVED renderer applies the identical rule — the views path once had
+ *  its own idea of which grantees to render, and the two disagreed inside one pull. */
+export const KNOWN_ROLES = new Set(['anon', 'authenticated', 'admin']);
 
 /**
  * The grantees a rendered model GOVERNS — the three vocabulary roles plus PUBLIC, which is
@@ -75,7 +77,7 @@ const KNOWN_ROLES = new Set(['anon', 'authenticated', 'admin']);
  * an ungoverned grantee alone, so there is no REVOKE to prevent, and naming the role in a model
  * would GOVERN it — turning a rendering decision into an access decision for every table.
  */
-const GOVERNED_VOCABULARY = new Set([...KNOWN_ROLES, 'PUBLIC', 'public']);
+export const GOVERNED_VOCABULARY = new Set([...KNOWN_ROLES, 'PUBLIC', 'public']);
 
 /** The beyond-CRUD privileges a governed role holds live — what `can()` cannot say. */
 function deriveExtraPrivileges(contract: TableContract): Record<string, string[]> {
@@ -232,6 +234,32 @@ function policiesFor(contract: TableContract, role: string, command: string): Po
   );
 }
 
+/**
+ * Does this grant actually give the role rows?
+ *
+ * **The rule, in one line: an ability needs BOTH a grant and a covering permissive policy.**
+ *
+ * Postgres checks the grant and THEN the policy. Either half alone gives nothing, and the two
+ * failures look identical in a diff:
+ *
+ *   - policy, no grant  → dead code. Declaring it ADDs a grant.        (handled in deriveAbilities)
+ *   - grant, no policy  → dead rows. Declaring it ADDs a policy.       (this predicate)
+ *
+ * The second half was fixed for `admin` first, because that is where a consumer hit it. The
+ * round-trip gate (integration/authz-roundtrip) then found the SAME defect on the read branch —
+ * `authenticated` holding SELECT with no policy rendered `can('read')`, compiling to
+ * `CREATE POLICY … USING (true)` against a database that has no such policy. Hence one predicate,
+ * used at every site that turns a grant into an ability, rather than a fix per role.
+ *
+ * A restrictive-only policy does not count: RESTRICTIVE policies subtract, so with no permissive
+ * policy to pass first the role still sees nothing.
+ */
+function effective(contract: TableContract, role: string, priv: string): boolean {
+  if (!granted(contract, role, priv)) return false;
+  if (!contract.rls.enabled) return true;
+  return policiesFor(contract, role, priv).some((p) => p.permissive);
+}
+
 /** A sql`…` fragment literal, or null when the predicate is vacuous. */
 function sqlFragment(pred: string | null): string | null {
   if (!pred) return null;
@@ -303,10 +331,72 @@ export function deriveAbilities(contract: TableContract): DerivedAbilities {
   const abilities: string[] = [];
   const notes: string[] = [];
   const table = contract.table;
+  /** Live CRUD grants no policy covers — declared as grants so the plan neither invents a
+   *  policy (a widening) nor revokes a real privilege (a narrowing). */
+  const deadGrants: Record<string, string[]> = {};
 
   // --- the admin bypass: one role holding every privilege ------------------------------
-  const adminAll = ['SELECT', 'INSERT', 'UPDATE', 'DELETE'].every((p) => granted(contract, 'admin', p));
-  if (adminAll) abilities.push(`can('manage', { role: 'admin' })`);
+  //
+  // The grant is only HALF the question. Postgres checks the grant and THEN the policy, so a
+  // role holding all four privileges with no policy covering it reads zero rows. Rendering
+  // `can('manage')` there compiles to a GRANT **plus** `CREATE POLICY … TO admin USING (true)`,
+  // handing admin a table the database currently withholds — a WIDENING emitted by the adoption
+  // path itself. That is the same trap the policy-without-grant branch below prevents, reached
+  // from the other side, and it shipped: three tables at one adopter, one of the three
+  // statements in their plan, refused by them.
+  //
+  // The grants are still declared — via `privileges` below — so the plan neither invents a
+  // policy nor revokes a real grant. Do NOT "simplify" this to dropping the grants: a grantee
+  // with rolbypassrls holds them live (our introspection checks ownership, not rolbypassrls),
+  // and they re-arm the day anyone runs ALTER TABLE … DISABLE ROW LEVEL SECURITY.
+  //
+  // No owner ambiguity: GRANTS_SQL excludes the table owner, so a role present in `grants` is a
+  // non-owner, and RLS binds non-owners whenever `enabled` is true. `forced` is irrelevant here.
+  const CRUD = ['SELECT', 'INSERT', 'UPDATE', 'DELETE'];
+  const adminGrants = CRUD.filter((p) => granted(contract, 'admin', p));
+  const adminLive = adminGrants.filter((p) => effective(contract, 'admin', p));
+  const adminDead = adminGrants.filter((p) => !adminLive.includes(p));
+
+  if (adminLive.length === CRUD.length) {
+    abilities.push(`can('manage', { role: 'admin' })`);
+  } else {
+    // PARTIAL. `manage` means all four, so it would be a lie — but the privileges that ARE
+    // policied are live authorization, and rendering nothing for them makes the plan DROP the
+    // policy and REVOKE the grant. That narrowing is how the round-trip gate caught this case:
+    // an admin table policied for SELECT only lost both halves on the way through.
+    for (const priv of adminLive) {
+      const pol = policiesFor(contract, 'admin', priv).find((p) => p.permissive);
+      const frag = sqlFragment(pol?.using ?? null);
+      const verb = DML[priv];
+      abilities.push(
+        frag ? `can('${verb}', { role: 'admin', sql: ${frag} })` : `can('${verb}', { role: 'admin' })`,
+      );
+    }
+  }
+
+  if (adminDead.length) {
+    deadGrants.admin = adminDead;
+    notes.push(
+      `admin holds ${adminDead.join(', ')} but no policy covers admin —`,
+    );
+    notes.push(
+      `  dead while RLS is on, unrestricted if RLS is ever disabled. Declared as a grant, not`,
+    );
+    notes.push(
+      `  an ability: an ability would ADD the policy the database does not have.`,
+    );
+  }
+
+  // The same accounting for the app roles. A grant they hold with no policy behind it is
+  // declared (so the plan does not REVOKE a live privilege) and never rendered as an ability
+  // (so the plan does not CREATE the policy the database is missing).
+  for (const role of ['authenticated', 'anon']) {
+    const dead = CRUD.filter((p) => granted(contract, role, p) && !effective(contract, role, p));
+    if (!dead.length) continue;
+    deadGrants[role] = dead;
+    notes.push(`${role} holds ${dead.join(', ')} but no policy covers ${role} —`);
+    notes.push(`  the grant is live in the catalog and gives no rows; declared as a grant, not an ability.`);
+  }
 
   // --- policed but not granted at the table level ---------------------------------------
   //
@@ -340,8 +430,11 @@ export function deriveAbilities(contract: TableContract): DerivedAbilities {
   }
 
   // --- reads ---------------------------------------------------------------------------
-  const anonRead = granted(contract, 'anon', 'SELECT');
-  const authedRead = granted(contract, 'authenticated', 'SELECT');
+  // `effective`, not `granted`: a SELECT grant with no policy behind it renders can('read'),
+  // which compiles to CREATE POLICY … USING (true) — manufacturing a policy the database does
+  // not have. Same defect as the admin branch above; the round-trip gate found it here.
+  const anonRead = effective(contract, 'anon', 'SELECT');
+  const authedRead = effective(contract, 'authenticated', 'SELECT');
 
   if (anonRead) {
     // Public read. If the live policy narrows it (a soft-delete guard, a published flag),
@@ -465,7 +558,7 @@ export function deriveAbilities(contract: TableContract): DerivedAbilities {
   // --- writes --------------------------------------------------------------------------
   for (const [command, action] of Object.entries(DML)) {
     if (action === 'read') continue;
-    if (!granted(contract, 'authenticated', command)) continue;
+    if (!effective(contract, 'authenticated', command)) continue;
 
     const pol = policiesFor(contract, 'authenticated', command).find((p) => p.command !== 'ALL')
       ?? policiesFor(contract, 'authenticated', command)[0];
@@ -535,7 +628,15 @@ export function deriveAbilities(contract: TableContract): DerivedAbilities {
     notes.push(`no grants found — this table is internal (nothing reaches it through the data API).`);
   }
 
-  return { abilities, notes, unmappedRoles, privileges: deriveExtraPrivileges(contract) };
+  // The beyond-CRUD privileges plus any live CRUD grant no policy covers. Both are "grants
+  // can() cannot say", for the same reason: `can()` decides a grant AND a policy together, and
+  // these have no policy to decide.
+  const privileges = deriveExtraPrivileges(contract);
+  for (const [role, privs] of Object.entries(deadGrants)) {
+    privileges[role] = [...new Set([...(privileges[role] ?? []), ...privs])].sort();
+  }
+
+  return { abilities, notes, unmappedRoles, privileges };
 }
 
 /** An object key, quoted only when the role name is not a bare JS identifier. */

package/src/cli/authz-lint.ts

@@ -46,3 +46,64 @@ export function findReadAuthzGaps(models: readonly ModelDescriptor[]): ReadAuthz
   }
   return gaps;
 }
+
+// ---------------------------------------------------------------------------
+// Naked DML grants — the safety that used to live in the parser.
+// ---------------------------------------------------------------------------
+
+/**
+ * A CRUD grant declared without the policy that gates it.
+ *
+ * `privileges` used to REFUSE the DML four at model-definition time, so that a grant could never
+ * be declared without its policy. That throw was removed because the invariant was vacuous for
+ * adoption: a live table can hold `GRANT SELECT TO admin` with no policy covering admin, and a
+ * language that cannot spell it makes such a database a permanent MISMATCH against
+ * `db:fingerprint` — so adopting one required mutating it first. Expressibility is total over the
+ * fingerprint's domain; the opinion belongs here instead.
+ *
+ * Severity is a WARNING, never fatal, and that is a considered narrowing of the original ruling.
+ * The ruling asked for an ERROR on a table without RLS, where a naked grant is an unrestricted
+ * table-wide privilege. That case cannot arise from models: `compileTableContract` emits
+ * `rls: { enabled: true }` UNCONDITIONALLY for every modeled table (authz-compile.ts:558). So a
+ * declared naked grant is always dead-on-arrival and only becomes live if someone later disables
+ * RLS on that table — a real risk, but a future one, and failing CI over a faithful rendering of
+ * a database the adopter is trying to adopt would make `db:pull` unusable on exactly the schemas
+ * it exists for.
+ */
+export interface NakedGrant {
+  schema: string;
+  table: string;
+  role: string;
+  privileges: string[];
+  message: string;
+}
+
+const DML = new Set(['SELECT', 'INSERT', 'UPDATE', 'DELETE']);
+
+/**
+ * Grants declared in `privileges` that carry no policy — reported for hand-authored and pulled
+ * models alike, because the shape is equally wrong to author and equally true to find.
+ */
+export function findNakedGrants(models: readonly ModelDescriptor[]): NakedGrant[] {
+  const out: NakedGrant[] = [];
+  for (const m of models) {
+    for (const role of Object.keys(m.privileges ?? {}).sort()) {
+      const dml = (m.privileges[role] ?? []).filter((p) => DML.has(p)).sort();
+      if (!dml.length) continue;
+      out.push({
+        schema: m.schema,
+        table: m.table,
+        role,
+        privileges: dml,
+        message:
+          `${m.schema}.${m.table}: '${role}' holds ${dml.join(', ')} as a grant with no policy beside it. ` +
+          `It is dead while RLS is on — the role reads zero rows — and becomes an unrestricted ` +
+          `table-wide privilege the day RLS is disabled or a broad policy is added. If this came from ` +
+          `db:pull it is a faithful reading of the database; decide whether to give it a policy ` +
+          `(can(...)) or revoke it. If you wrote it by hand, you almost certainly want can() instead, ` +
+          `which decides the grant and the policy together.`,
+      });
+    }
+  }
+  return out;
+}

package/src/cli/commands/db-check.ts

@@ -41,9 +41,11 @@ import { loadModels } from './db-generate.js';
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
 import type { SequenceDescriptor } from '@everystack/model';
 import type { SourceObject } from '../derived-source.js';
-import { findReadAuthzGaps } from '../authz-lint.js';
+import { findReadAuthzGaps, findNakedGrants } from '../authz-lint.js';
 import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline.js';
-import { findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings } from '../derived-lint.js';
+import {
+  findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings, findPublicExecutableSecdef,
+} from '../derived-lint.js';
 import { step, success, fail, info, warn } from '../output.js';
 
 // The role derivation moved to the shared builder (db-build) with brick
@@ -160,6 +162,13 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     }
   }
 
+  // A CRUD grant declared with no policy beside it. WARN, never fatal: this is what a faithful
+  // db:pull of a brownfield database looks like, and failing CI over it would make the pull
+  // unusable on the schemas it exists for. See findNakedGrants for why it is not an error.
+  for (const naked of findNakedGrants(input.models)) {
+    findings.push({ level: 'warn', area: 'authz', message: naked.message });
+  }
+
   // The adoption baseline, ARTIFACT ONLY.
   //
   // This check cannot see the threat and must not pretend to. The foreign grantees it
@@ -209,7 +218,7 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     for (const gap of derivedGaps) {
       findings.push({ level: 'fail', area: 'authz', message: gap.message });
     }
-    for (const warning of findMatviewSnapshotWarnings(input.derived)) {
+    for (const warning of [...findMatviewSnapshotWarnings(input.derived), ...findPublicExecutableSecdef(input.derived)]) {
       findings.push({ level: 'warn', area: 'authz', message: warning.message });
     }
     if (derivedGaps.length === 0) {

package/src/cli/commands/db-pull.ts

@@ -2,7 +2,7 @@
  * `everystack db:pull` — generate `field()` Models from a live database (the brownfield on-ramp).
  *
  *   db:pull [--stage <name>] [--database-url <url>] [--schema public] [--out <dir | file.ts>]
- *           [--derived-out <file.ts>] [--abilities public-read]
+ *           [--derived-out <file.ts>] [--abilities live|public-read]
  *
  * `--stage` and `--database-url` COMPOSE: the URL picks the connection, the stage names the
  * baseline entry (`db/authz-baseline.json` is per-stage — a local adoption pulls with
@@ -358,7 +358,21 @@ export async function dbPullCommand(flags: Record<string, string>): Promise<void
   const flagged = (source.match(/\/\/ (FIXME|TODO|composite|CHECK|FK →|verbatim:)/g) ?? []).length;
   if (flagged) caution(`${flagged} inline comment(s) flag things to review (verbatim types, checks, cross-schema FKs).`);
   if (abilities === 'commented') {
-    note(`Each model scaffolds its authz decision as comments — author them (db:check fails until every model declares), or stamp the common case: db:pull --abilities public-read.`);
+    // `live` FIRST, and named. It is the mode brownfield adoption needs — derive the authz
+    // from grants and policies the database already has — and it was advertised nowhere:
+    // not in the usage line, not in --help, not here. The only place an operator met the
+    // word was the error text for an unknown preset, so the discovery path for the right
+    // flag was to guess a wrong one. A consumer and their agent both walked past it in one
+    // session, and it cost a misdiagnosis plus a needless overwrite of 30 model files.
+    //
+    // `public-read` is deliberately no longer the headline: on an existing database it
+    // stamps can('read') on EVERY table, which on a real schema means public read of
+    // credit_cards, transactions, emails and users.
+    note(
+      `Each model scaffolds its authz decision as comments — db:check fails until every model declares. `
+      + `For an EXISTING database, re-pull with --abilities live to derive them from the grants and policies `
+      + `already there. --abilities public-read stamps public-read/admin-write on every table — greenfield only.`,
+    );
   } else {
     note(`Stamped '${abilities}' abilities into every model — review the generated stanzas; they are code, not defaults.`);
   }

package/src/cli/derived-compile.ts

@@ -19,7 +19,7 @@
 
 import type {
   ModelDescriptor, DerivedDescriptor, ViewDescriptor, MaterializedViewDescriptor,
-  FunctionDescriptor, SqlDescriptor, TriggerSpec, Ability, SetofReturn, DependsOnRef,
+  FunctionDescriptor, SqlDescriptor, TriggerSpec, TriggerDescriptor, Ability, SetofReturn, DependsOnRef,
 } from '@everystack/model';
 import { hashSourceContent, parseQualified, DECLARED_SOURCE_FILE, type Attachment, type SourceObject } from './derived-source.js';
 import { isPlainGrantAttachment } from './derived-grants.js';
@@ -51,9 +51,21 @@ function refName(ref: SetofReturn['setof']): string {
 // Grants — the same audience semantics as tables
 // ---------------------------------------------------------------------------
 
-/** Relation read grants: bare read → anon + authenticated (the table precedent);
- *  `{ role }` narrows; `{ columns }` scopes the SELECT to a column list. */
-function relationGrants(target: string, abilities: readonly Ability[]): Attachment[] {
+/**
+ * Relation read grants: bare read → anon + authenticated (the table precedent);
+ * `{ role }` narrows; `{ columns }` scopes the SELECT to a column list.
+ *
+ * `privileges` is the second source — grants that EXIST, recorded by `db:pull` rather than
+ * chosen. It is what lets a brownfield view be rendered at all: the write grants a blanket
+ * `GRANT ALL ON ALL TABLES IN SCHEMA` left behind, and a `SELECT` to `PUBLIC`, are not
+ * expressible as read abilities, and emitting the object WITHOUT them would make the next
+ * generate plan a REVOKE of each one.
+ */
+function relationGrants(
+  target: string,
+  abilities: readonly Ability[],
+  privileges: Readonly<Record<string, string[]>> = {},
+): Attachment[] {
   const out: Attachment[] = [];
   for (const a of abilities) {
     const roles = a.condition.role ? a.condition.role : 'anon, authenticated';
@@ -62,17 +74,46 @@ function relationGrants(target: string, abilities: readonly Ability[]): Attachme
       : '';
     out.push({ kind: 'grant', sql: `GRANT SELECT${cols} ON ${target} TO ${roles}` });
   }
+  // Grantee-sorted, privileges in the declared order the model already normalized, so a
+  // re-render of an unchanged database is byte-stable.
+  for (const grantee of Object.keys(privileges).sort()) {
+    out.push({ kind: 'grant', sql: `GRANT ${privileges[grantee].join(', ')} ON ${target} TO ${grantee}` });
+  }
   return out;
 }
 
-/** Function authz: `REVOKE ALL … FROM PUBLIC` UNCONDITIONALLY (PostgreSQL grants EXECUTE
- *  to PUBLIC by default — the silent-open inverse of the RLS trap), then the declared
- *  `can('execute', { role })` grants. */
-function functionGrants(signature: string, abilities: readonly Ability[]): Attachment[] {
-  const out: Attachment[] = [{ kind: 'grant', sql: `REVOKE ALL ON FUNCTION ${signature} FROM PUBLIC` }];
+/**
+ * Function authz: `REVOKE ALL … FROM PUBLIC` (PostgreSQL grants EXECUTE to PUBLIC by
+ * default — the silent-open inverse of the RLS trap), then the declared grants.
+ *
+ * Two sources, and the distinction is the whole design: `abilities` are the INTENDED
+ * audience (`can('execute', { role })`), `privileges` are grants that EXIST, recorded by
+ * `db:pull` without claiming intent.
+ *
+ * **A declared `PUBLIC` privilege suppresses the revoke**, and that is not a loophole. The
+ * revoke is unconditional precisely because nobody could SAY "PUBLIC holds EXECUTE here";
+ * once a descriptor says it, revoking anyway would make a faithful pull of a live function
+ * plan a REVOKE the adopter never asked for — turning adoption into mutation. Declaring it
+ * is still a finding, raised where findings belong: db:check WARNs on a PUBLIC-executable
+ * SECURITY DEFINER function.
+ */
+function functionGrants(
+  signature: string,
+  abilities: readonly Ability[],
+  privileges: Readonly<Record<string, string[]>> = {},
+): Attachment[] {
+  const declaresPublic = Object.keys(privileges).some((g) => g.toUpperCase() === 'PUBLIC');
+  const out: Attachment[] = declaresPublic
+    ? []
+    : [{ kind: 'grant', sql: `REVOKE ALL ON FUNCTION ${signature} FROM PUBLIC` }];
   for (const a of abilities) {
     out.push({ kind: 'grant', sql: `GRANT EXECUTE ON FUNCTION ${signature} TO ${a.condition.role}` });
   }
+  // Sorted so a re-render of an unchanged database is byte-stable — object key order is
+  // insertion order, and the introspection's row order is not a contract.
+  for (const grantee of Object.keys(privileges).sort()) {
+    out.push({ kind: 'grant', sql: `GRANT EXECUTE ON FUNCTION ${signature} TO ${grantee}` });
+  }
   return out;
 }
 
@@ -98,7 +139,7 @@ function renderView(v: ViewDescriptor): { sql: string; attachments: Attachment[]
     sql: `CREATE VIEW ${target}${invoker} AS\n${v.as}`,
     attachments: [
       ...commentAttachment('VIEW', target, v.comment),
-      ...relationGrants(target, v.abilities),
+      ...relationGrants(target, v.abilities, v.privileges ?? {}),
     ],
   };
 }
@@ -128,7 +169,7 @@ function renderMaterializedView(mv: MaterializedViewDescriptor): { sql: string;
     attachments: [
       ...indexes,
       ...commentAttachment('MATERIALIZED VIEW', target, mv.comment),
-      ...relationGrants(target, mv.abilities),
+      ...relationGrants(target, mv.abilities, mv.privileges ?? {}),
     ],
   };
 }
@@ -166,7 +207,7 @@ function renderFunction(fn: FunctionDescriptor): { sql: string; attachments: Att
       `AS ${tag}\n${fn.body}\n${tag}`,
     attachments: [
       ...commentAttachment('FUNCTION', signature, fn.comment),
-      ...functionGrants(signature, fn.abilities),
+      ...functionGrants(signature, fn.abilities, fn.privileges ?? {}),
     ],
   };
 }
@@ -207,9 +248,22 @@ interface Node {
 function derivedIdentity(d: DerivedDescriptor): string {
   const { schema, name } = parseQualified(d.name);
   if (d.kind === 'function') return functionIdentity(schema, name, d.args.map((a) => a.type));
+  // A trigger's name is unique only WITHIN its table — two tables may both carry
+  // `touch_updated_at` — so its identity is the owner's, plus the name.
+  if (d.kind === 'trigger') {
+    const o = triggerOwnerOf(d);
+    return `${o.schema}.${o.name}.${d.name}`;
+  }
   return `${schema}.${name}`;
 }
 
+/** Where a standalone binding rides: a model is state (no derived identity), a view is not. */
+function triggerOwnerOf(d: TriggerDescriptor): { schema: string; name: string; ownerIdentity: string | null } {
+  if ('table' in d.on) return { schema: d.on.schema, name: d.on.table, ownerIdentity: null };
+  const q = parseQualified(d.on.name);
+  return { schema: q.schema, name: q.name, ownerIdentity: `${q.schema}.${q.name}` };
+}
+
 /** What a bad ref IS, for the gate's message — null if the value is a usable object. */
 function badRef(r: unknown): string | null {
   if (r === undefined) return 'undefined';
@@ -233,6 +287,13 @@ function rejectBadRefs(models: readonly ModelDescriptor[], derived: readonly Der
   hole('compileDerived', 'models', models);
   hole('compileDerived', 'derived', derived);
   for (const d of derived) {
+    // A trigger has no dependsOn — its two deps come free (the target, the execute
+    // function) — but its `on` is a ref like any other and a stale import must be loud.
+    if (d.kind === 'trigger') {
+      hole(`trigger '${d.name}'`, 'on', [d.on], false);
+      hole(`trigger '${d.name}'`, 'execute', [d.execute], false);
+      continue;
+    }
     hole(`${d.kind} '${d.name}'`, 'dependsOn', d.dependsOn ?? []);
     if (d.kind === 'function' && typeof d.returns !== 'string') {
       hole(`function '${d.name}'`, 'returns.setof', [d.returns.setof], false);
@@ -348,6 +409,14 @@ export function compileDerived(models: readonly ModelDescriptor[], derived: read
       const q = parseQualified(v.name);
       return { schema: q.schema, name: q.name, ownerIdentity: `${q.schema}.${q.name}`, triggers: v.triggers ?? [] };
     }),
+    // Standalone bindings (defineTrigger) — the same unit, reached from the descriptor
+    // rather than through its target. Both spellings compile to an identical node, which
+    // is the point: the deprecated attached form keeps working while `db:pull` renders the
+    // standalone one (a binding on a model would make the generated module import the
+    // compute layer, which is a fatal cycle rather than a style preference).
+    ...derived
+      .filter((d): d is TriggerDescriptor => d.kind === 'trigger')
+      .map((d) => ({ ...triggerOwnerOf(d), triggers: [d as TriggerSpec] })),
   ];
   for (const owner of triggerOwners) {
     for (const t of owner.triggers) {

package/src/cli/derived-grants.ts

@@ -38,7 +38,13 @@ export interface ParsedGrants {
 //   GRANT SELECT[ ("c1", "c2")] ON <target> TO r1[, r2…]
 //   GRANT EXECUTE ON FUNCTION <sig> TO r
 //   REVOKE ALL ON FUNCTION <sig> FROM PUBLIC
-const GRANT_RE = /^GRANT\s+([A-Z]+)\s*(\([^)]*\))?\s+ON\s+(.+?)\s+TO\s+(.+)$/i;
+// The privilege slot is a LIST — `GRANT SELECT, INSERT ON x TO y` is one statement, and
+// PostgreSQL's own grammar says so. It used to match a single word, so a multi-privilege
+// grant parsed as no grant at all: the declared contract came back empty and the very next
+// check planned a REVOKE of every privilege the object had just been given. That stayed
+// latent only because the compiler happened to emit one privilege per statement; recording
+// a relation's live ACL (which is naturally multi-privilege) walked straight into it.
+const GRANT_RE = /^GRANT\s+([A-Z]+(?:\s*,\s*[A-Z]+)*)\s*(\([^)]*\))?\s+ON\s+(.+?)\s+TO\s+(.+)$/i;
 const REVOKE_PUBLIC_RE = /^REVOKE\s+ALL\s+ON\s+(.+?)\s+FROM\s+PUBLIC$/i;
 
 /**
@@ -72,14 +78,15 @@ export function parseGrantAttachments(attachments: readonly Attachment[]): Parse
     }
     const grant = a.sql.match(GRANT_RE);
     if (!grant) continue;
-    const [, privilege, columns, onTarget, roleList] = grant;
+    const [, privilegeList, columns, onTarget, roleList] = grant;
     if (columns) {
       hasColumnGrants = true;
       continue; // attacl territory — declared, applied at create, not drift-checked yet
     }
     target ??= onTarget.trim();
+    const privileges = privilegeList.split(',').map((p) => p.trim().toUpperCase()).filter(Boolean);
     for (const role of roleList.split(',').map((r) => r.trim()).filter(Boolean)) {
-      (grants[role] ??= new Set()).add(privilege.toUpperCase());
+      for (const privilege of privileges) (grants[role] ??= new Set()).add(privilege);
     }
   }