@everystack/cli 0.4.55 → 0.4.56

package/src/cli/derived-introspect.ts

@@ -37,6 +37,33 @@ export interface LiveObject {
   comment?: string;
   /** sha256 over normalized definition + indexes + comment. */
   defHash: string;
+  /**
+   * Functions, views and matviews: the owning role.
+   *
+   * Read because the grant differ CANNOT be correct without it. Owner-implicit privileges are
+   * excluded from the ACL read (`a.grantee <> p.proowner` / `<> c.relowner`), which is right —
+   * but it means the SET of non-owner grants shifts when the owner changes, so the same object
+   * under two owners yields two different privilege sets and the differ mints statements to
+   * reconcile a difference that is purely ownership.
+   *
+   * A15 — and for views it is a privilege boundary in its own right. A `security_invoker =
+   * false` view executes with its OWNER's rights, exactly as a SECURITY DEFINER function does.
+   * Undeclared, the owner is whoever ran the build: an `admin`-owned sealed-slice view rebuilds
+   * as builder-owned, `admin` can no longer read through it, and every gate stays green.
+   */
+  owner?: string;
+  /**
+   * Is `owner` a SUPERUSER (or an rds_superuser member — RDS has no true superuser)? Half of
+   * the discriminator db:pull uses to decide whether the observed owner is a CHOSEN principal
+   * or the ambient build credential. Absent means not measured.
+   */
+  ownerIsSuperuser?: boolean;
+  /**
+   * Is `owner` the role this introspection is CONNECTED AS? The other half of the
+   * discriminator. A normalized non-superuser migrator owns everything it creates by default,
+   * so "superuser" alone would miss it. Absent means not measured.
+   */
+  ownerIsConnectedRole?: boolean;
   /** Matview only: whether it holds data. */
   populated?: boolean;
   /** Matview only: pg_total_relation_size — the rebuild-cost signal. */
@@ -128,7 +155,22 @@ SELECT
   EXISTS (
     SELECT 1 FROM unnest(COALESCE(c.reloptions, '{}'::text[])) o
     WHERE o IN ('security_invoker=true', 'security_invoker=on')
-  ) AS security_invoker
+  ) AS security_invoker,
+  -- A15. The same three fields the function read carries, for the same reason: a
+  -- security_invoker = false view executes with its OWNER's rights, so its owner is a
+  -- privilege boundary exactly as a SECURITY DEFINER function's is. The two discriminators
+  -- let db:pull tell a CHOSEN owner from the ambient build credential.
+  pg_get_userbyid(c.relowner) AS owner,
+  COALESCE(
+    (SELECT r.rolsuper
+       OR EXISTS (
+         SELECT 1 FROM pg_auth_members m JOIN pg_roles g ON g.oid = m.roleid
+         WHERE m.member = c.relowner AND g.rolname = 'rds_superuser'
+       )
+     FROM pg_roles r WHERE r.oid = c.relowner),
+    false
+  ) AS owner_is_superuser,
+  (pg_get_userbyid(c.relowner) IN (CURRENT_USER, SESSION_USER)) AS owner_is_connected_role
 FROM pg_class c
 JOIN pg_namespace n ON n.oid = c.relnamespace
 WHERE c.relkind IN ('v', 'm')
@@ -171,6 +213,25 @@ SELECT
   l.lanname AS language,
   p.prosecdef AS secdef,
   p.provolatile AS volatility,
+  pg_get_userbyid(p.proowner) AS owner,
+  -- The AMBIENT-BUILD-CREDENTIAL discriminator, two clauses and no more. db:pull renders
+  -- the owner only when the observed owner is neither of these — rendering the ambient
+  -- credential would BLESS an accident, turning "whoever happened to run the migration" into
+  -- fingerprinted, reproducible design. When it IS ambient the renderer emits a FIXME instead:
+  -- the defect stays visible without being ratified.
+  --
+  -- Superuser, matching security-catalog's rule (RDS has no true superuser, so rds_superuser
+  -- membership counts).
+  (
+    SELECT r.rolsuper OR EXISTS (
+      SELECT 1 FROM pg_auth_members m JOIN pg_roles g ON g.oid = m.roleid
+      WHERE m.member = p.proowner AND g.rolname = 'rds_superuser'
+    )
+    FROM pg_roles r WHERE r.oid = p.proowner
+  ) AS owner_is_superuser,
+  -- ...or the role we are connected as. A normalized, deliberately non-superuser migrator owns
+  -- every object it creates, so the superuser clause alone would miss the commonest case.
+  (pg_get_userbyid(p.proowner) IN (CURRENT_USER, SESSION_USER)) AS owner_is_connected_role,
   (SELECT split_part(cfg, '=', 2) FROM unnest(COALESCE(p.proconfig, '{}'::text[])) cfg
     WHERE cfg LIKE 'search_path=%' LIMIT 1) AS search_path,
   p.prosrc AS src
@@ -458,6 +519,12 @@ export interface RelationRow {
   rows: unknown;
   /** security_invoker reloption (views). Optional — pre-B5 fixtures omit it. */
   security_invoker?: unknown;
+  /** `pg_get_userbyid(relowner)` — see LiveObject.owner. Optional: pre-A15 fixtures omit it. */
+  owner?: unknown;
+  /** See LiveObject.ownerIsSuperuser. Optional: absent means not measured. */
+  owner_is_superuser?: unknown;
+  /** See LiveObject.ownerIsConnectedRole. Optional: absent means not measured. */
+  owner_is_connected_role?: unknown;
 }
 
 export interface FunctionRow {
@@ -475,6 +542,12 @@ export interface FunctionRow {
   secdef?: unknown;
   volatility?: unknown;
   search_path?: unknown;
+  /** `pg_get_userbyid(proowner)` — see LiveObject.owner. Optional: pre-owner fixtures omit it. */
+  owner?: unknown;
+  /** See LiveObject.ownerIsSuperuser. Optional: absent means not measured. */
+  owner_is_superuser?: unknown;
+  /** See LiveObject.ownerIsConnectedRole. Optional: absent means not measured. */
+  owner_is_connected_role?: unknown;
   src?: unknown;
 }
 
@@ -544,6 +617,19 @@ export interface DerivedRows {
   grants?: GrantAclRow[];
 }
 
+/** Coerce a Postgres boolean as any driver spells it. `undefined` means NOT MEASURED —
+ *  never conflated with a measured `false`. NULL is not-measured too: the only way these
+ *  sub-selects go NULL is the role vanishing between reads, and guessing there would be
+ *  exactly the fabrication this feature exists to stop. */
+function pgBool(v: unknown): boolean | undefined {
+  if (v === undefined || v === null) return undefined;
+  if (typeof v === 'boolean') return v;
+  const s = String(v).toLowerCase();
+  if (s === 't' || s === 'true') return true;
+  if (s === 'f' || s === 'false') return false;
+  return undefined;
+}
+
 /** Coerce a Postgres text[] (a JS array, or the `{a,b}` text form some drivers return) to string[]. */
 function pgTextArray(v: unknown): string[] {
   if (Array.isArray(v)) return v.map(String);
@@ -597,6 +683,12 @@ export function assembleDerivedCatalog(rows: DerivedRows): DerivedCatalog {
       definition, indexes,
       ...(comment !== undefined ? { comment } : {}),
       defHash: computeDefHash(definition, indexes, comment),
+      // A15 — same three fields, same meaning, as the function branch below. Absent (not
+      // measured) and false (measured, not ambient) stay DIFFERENT, so a pre-A15 fixture
+      // keeps behaving exactly as it did.
+      ...(row.owner != null ? { owner: String(row.owner) } : {}),
+      ...(pgBool(row.owner_is_superuser) !== undefined ? { ownerIsSuperuser: pgBool(row.owner_is_superuser) } : {}),
+      ...(pgBool(row.owner_is_connected_role) !== undefined ? { ownerIsConnectedRole: pgBool(row.owner_is_connected_role) } : {}),
       ...grantsFor('r', identity),
     };
     if (kind === 'materialized view') {
@@ -625,6 +717,11 @@ export function assembleDerivedCatalog(rows: DerivedRows): DerivedCatalog {
       definition, indexes: [],
       ...(comment !== undefined ? { comment } : {}),
       defHash: computeDefHash(definition, [], comment),
+      ...(row.owner != null ? { owner: String(row.owner) } : {}),
+      // Absent (not measured) and false (measured, not ambient) are DIFFERENT — a pre-owner
+      // fixture must keep behaving exactly as it did, so undefined never becomes false here.
+      ...(pgBool(row.owner_is_superuser) !== undefined ? { ownerIsSuperuser: pgBool(row.owner_is_superuser) } : {}),
+      ...(pgBool(row.owner_is_connected_role) !== undefined ? { ownerIsConnectedRole: pgBool(row.owner_is_connected_role) } : {}),
       ...grantsFor('f', identity),
       ...(row.src !== undefined ? {
         fn: {

package/src/cli/derived-lint.ts

@@ -233,6 +233,62 @@ export function findPublicExecutableSecdef(derived: readonly DerivedDescriptor[]
   return warnings;
 }
 
+// ---------------------------------------------------------------------------
+// Advisory: SECURITY DEFINER with no pin (db:check warn) — A3's linter half
+// ---------------------------------------------------------------------------
+
+export interface UnpinnedDefinerFinding extends DerivedAuthzGap {
+  /** The schemas the DECLARATION can justify, `pg_catalog` first. A floor to review — never applied. */
+  suggested: string[];
+}
+
+/**
+ * Every SECURITY DEFINER function that declares `searchPath: 'unpinned'`, with a SUGGESTED pin.
+ *
+ * This is the half of A3 that keeps the honesty from becoming permission. `db:pull` no longer
+ * invents `['pg_catalog']` for a function whose live `proconfig` is empty — inventing it was an
+ * outage that passed every gate, and fabrication corrodes fingerprint, plan and apply, all of
+ * which rest on the model telling the truth. So the parser records what is there and the
+ * OPINION lives here: an unpinned definer function is a real latent vulnerability, and it gets
+ * named on every run until someone decides about it.
+ *
+ * SUGGEST, never apply. The suggestion is derived from the DECLARED structure — the function's
+ * own schema plus the schemas of its `dependsOn` — and not from reading the body. Body-derived
+ * pins are inventing with extra steps: dynamic SQL, operators and casts defeat the parse, and a
+ * pin that is wrong in the tool's favour is the same failure mode with better intentions. The
+ * suggestion is a floor. The author reviews it and lands it themselves.
+ *
+ * WARN, not fail. On an adopted database this is a faithful report of what is already true, and
+ * failing CI on a faithful pull would make `db:pull` unusable on exactly the schemas it exists
+ * for. Same call, and the same reasoning, as findPublicExecutableSecdef above.
+ */
+export function findUnpinnedDefiners(derived: readonly DerivedDescriptor[]): UnpinnedDefinerFinding[] {
+  const findings: UnpinnedDefinerFinding[] = [];
+  for (const d of derived) {
+    if (d.kind !== 'function' || d.security !== 'definer' || d.searchPath !== 'unpinned') continue;
+    const identity = identityOf(d);
+    const schemas = new Set<string>([parseQualified(d.name).schema]);
+    for (const ref of d.dependsOn ?? []) {
+      schemas.add(isModelRef(ref) ? (ref.schema ?? 'public') : parseQualified(ref.name).schema);
+    }
+    // pg_catalog FIRST and always: it is what stops a caller shadowing a built-in the body
+    // calls unqualified, which is the whole attack this pin defends against.
+    const suggested = ['pg_catalog', ...[...schemas].filter((s) => s !== 'pg_catalog').sort()];
+    findings.push({
+      identity,
+      suggested,
+      message:
+        `${identity} is SECURITY DEFINER with NO search_path — declared 'unpinned', which is the truth about the `
+        + `database, not an approval. It runs with its owner's rights, and a caller controls the search_path, so an `
+        + `unqualified name in the body can be resolved to an object the caller planted. SUGGESTED pin from what the `
+        + `declaration references: searchPath: [${suggested.map((s) => `'${s}'`).join(', ')}]. That is a FLOOR derived `
+        + `from dependsOn, not from reading the body — dynamic SQL, operators and casts are invisible to it, so review `
+        + `it, extend it, and land it yourself. Nothing here is ever applied for you.`,
+    });
+  }
+  return findings;
+}
+
 // ---------------------------------------------------------------------------
 // Gate: matview snapshot over row-scoped sources (db:check warn)
 // ---------------------------------------------------------------------------

package/src/cli/derived-plan.ts

@@ -233,6 +233,30 @@ export function planReconcile(
   const sqlDrops = new Map<string, { dropSql: string; reason: string }>();
   const extraWarnings: string[] = [];
 
+  /**
+   * B2 — the declared `SET search_path` compared against the LIVE one, structurally.
+   *
+   * Every other comparison in this table is a hash against a RECORDED hash, which is why the
+   * pin could differ in silence: `--baseline` records the declared source hash beside the live
+   * def hash without ever comparing the two, so a model claiming `search_path=pg_catalog` about
+   * a database with no pin reads as up to date forever. Measured — `db:reconcile --check`
+   * returned zero actions and zero drift on exactly that state.
+   *
+   * This is the one comparison that reads both sides at once. Null when they agree, or when
+   * either side was not measured (a parser-era object with no declared pin, a pre-B5 catalog
+   * read with no structured fields) — absent evidence is not evidence.
+   */
+  const pinMismatch = (src: SourceObject, liveObj: LiveObject): string | null => {
+    if (src.kind !== 'function' || src.searchPath === undefined || !liveObj.fn) return null;
+    const tokens = (v: string | undefined): string[] =>
+      (v ?? '').split(',').map((s) => s.trim().replace(/^"|"$/g, '')).filter(Boolean);
+    const declared = src.searchPath === 'unpinned' ? [] : src.searchPath.map((s) => s.trim());
+    const livePin = tokens(liveObj.fn.searchPath);
+    if (declared.length === livePin.length && declared.every((s, i) => s === livePin[i])) return null;
+    const say = (p: string[]): string => (p.length ? `search_path = ${p.join(', ')}` : 'no search_path');
+    return `declared ${say(declared)}, live has ${say(livePin)} — replaced from source`;
+  };
+
   for (const src of source.objects) {
     // --only restricts the primary decisions to the named identities; the rest are left
     // untouched (they are not skips — they were never in scope, so they get no plan entry).
@@ -271,9 +295,16 @@ export function planReconcile(
       // (live deparse), so the reconciler can't verify live == source. --baseline trusts it,
       // --rebuild guarantees it by rebuilding from source (relations through the dependency graph
       // below; functions replace in place), and the default flags it for a decision.
+      const pin = pinMismatch(src, liveObj);
       if (options.rebuild) {
         if (isRelation(src.kind)) rebuild.set(src.identity, 'rebuilt from source (first contact, --rebuild)');
         else fnReplace.set(src.identity, 'replaced from source (first contact, --rebuild)');
+      } else if (pin) {
+        // --baseline asserts "live IS the source, trust me". Here we can PROVE it is not, so
+        // recording the assertion would bless the difference permanently — nothing downstream
+        // ever compares these two again. Converge instead, on every path: an object whose pin
+        // is measurably wrong is not unverifiable, it is verifiably different.
+        fnReplace.set(src.identity, `search_path differs from live: ${pin}`);
       } else if (options.baseline) {
         baseline.push(src.identity);
       } else {
@@ -341,6 +372,15 @@ export function planReconcile(
       else fnReplace.set(src.identity, 'source changed');
       continue;
     }
+    // Self-consistent provenance is not proof. A --baseline taken before B2, or a mistaken
+    // --rebaseline, records the declared source hash beside the live def hash without ever
+    // comparing them — so a declared pin the database does not have reads as up to date on
+    // every run. The structural read is what breaks that loop; it self-heals in one apply.
+    const pin = pinMismatch(src, liveObj);
+    if (pin) {
+      fnReplace.set(src.identity, `search_path differs from live: ${pin}`);
+      continue;
+    }
     // Up-to-date (src + live both match provenance). If provenance predates body_hash, record it
     // once — a record-only backfill that ARMS the authz-only fast path for a future grant change.
     // Converges: after this run the row has body_hash, so it skips cleanly next time.
@@ -430,8 +470,15 @@ export function planReconcile(
         );
       } else {
         const target = parsed.target ?? (src.kind === 'function' ? `FUNCTION ${src.identity}` : src.identity);
-        const statements = diffObjectGrants(target, parsed.grants, liveObj.grants);
+        // Functions carry ownership context; relations do not (relacl's NULL means owner-only
+        // and aclexplode(NULL) is empty, so a relation's grant set does not shift with its owner).
+        const owners = src.kind === 'function'
+          ? { ...(src.owner !== undefined ? { declared: src.owner } : {}), ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}) }
+          : undefined;
+        const { statements, suppressed } = diffObjectGrants(target, parsed.grants, liveObj.grants, owners);
         if (statements.length > 0) regrants.push({ identity: src.identity, statements });
+        // Never silent: a withheld revoke is reported every run until the owner is declared.
+        for (const note of suppressed) extraWarnings.push(note);
       }
     }
 

package/src/cli/derived-render.ts

@@ -208,6 +208,110 @@ function parseArgs(args: string): ParsedArg[] | null {
   return out;
 }
 
+/**
+ * The role-name shape `defineFunction` accepts (packages/model derived.ts OWNER_ROLE_NAME).
+ * The owner is interpolated into `SET ROLE` / `ALTER … OWNER TO`, so anything else is refused
+ * at declaration — which means rendering it here would emit source that throws on import.
+ */
+const RENDERABLE_ROLE = /^[a-z_][a-z0-9_]*$/;
+
+/**
+ * An object that RUNS AS ITS OWNER, and the sentence that says so.
+ *
+ * Two shapes qualify, and they are the same hazard one object apart: a `SECURITY DEFINER`
+ * function, and a view with `security_invoker = false`. For both, an owner nobody chose is a
+ * live privilege surface, so the FIXME is loud and the warning reaches stderr.
+ */
+export interface ElevatedRights {
+  /** How the object declares it — `'SECURITY DEFINER'`, `'not securityInvoker'`. */
+  posture: string;
+  /** What runs as the owner — `'Every call'`, `'Every read through it'`. */
+  what: string;
+}
+
+export const SECURITY_DEFINER_RIGHTS: ElevatedRights = { posture: 'SECURITY DEFINER', what: 'Every call' };
+export const DEFINER_VIEW_RIGHTS: ElevatedRights = { posture: 'not securityInvoker', what: 'Every read through it' };
+export const MATVIEW_RIGHTS: ElevatedRights = { posture: 'a materialized view', what: 'Every REFRESH' };
+
+/**
+ * What db:pull says about an object's OBSERVED owner: render it, or flag it.
+ *
+ * Ownership is a privilege boundary, so a pulled model that stays silent about it reproduces
+ * the wrong database. But rendering EVERY observed owner is worse than saying nothing: on a
+ * brownfield database most objects are owned by whoever ran the migration, and writing
+ * `owner: 'postgres'` into the models would BLESS that accident — converting an unreviewed
+ * superuser-owned SECURITY DEFINER function into fingerprinted, reproducible design.
+ *
+ * So the discriminator is the AMBIENT BUILD CREDENTIAL, two clauses and no more: the owner is
+ * a superuser, or it is the role this pull connected as. Neither → a deliberately chosen
+ * principal → render it. Either → a FIXME naming the observed owner, loud when the object runs
+ * as its owner. The defect stays visible without being ratified.
+ *
+ * This also settles the portability objection: the roles whose names legitimately differ
+ * between a dev machine, a deployed master and a normalized operator ARE the operator tier —
+ * exactly the tier this declines to render.
+ *
+ * A15 — ONE discriminator for functions AND relations. The rule is identical and the reason is
+ * identical; two copies of it is how the view half ends up subtly different from the function
+ * half, which is the defect this whole plan keeps finding.
+ */
+export function renderedOwner(
+  o: Pick<LiveObject, 'identity' | 'owner' | 'ownerIsSuperuser' | 'ownerIsConnectedRole'>,
+  elevated: ElevatedRights | null,
+): { prop?: string; fixme?: string; warning?: string } {
+  const owner = o.owner;
+  // Not measured. A pre-owner catalog read carries no owner at all, and absent evidence is
+  // not evidence of a problem — say nothing, exactly as before.
+  if (owner === undefined) return {};
+
+  const superuser = o.ownerIsSuperuser;
+  const connected = o.ownerIsConnectedRole;
+  const ambient: string[] = [];
+  if (superuser === true) ambient.push('a superuser');
+  if (connected === true) ambient.push('the role db:pull connected as');
+
+  if (!ambient.length && superuser !== undefined && connected !== undefined) {
+    // A chosen principal. Render it — unless PostgreSQL's name is one defineFunction refuses,
+    // in which case rendering would emit source that throws on import.
+    if (!RENDERABLE_ROLE.test(owner)) {
+      const why = `${o.identity}: owner '${owner}' is not a bare lowercase role name, which is all the model's owner property accepts (it is interpolated into SET ROLE) — ownership NOT declared. Rename the role, or declare the owner by hand.`;
+      return { fixme: `// FIXME: ${why}`, warning: why };
+    }
+    return { prop: `owner: ${tsString(owner)},` };
+  }
+
+  if (!ambient.length) {
+    // Owner known, discriminator not measured. Refuse to classify rather than guess.
+    return {
+      fixme: `// FIXME: ${o.identity} is owned by '${owner}', but this pull could not tell whether that is a chosen principal or the build credential — owner is NOT declared. Add owner: '${owner}' if that role is the intended owner.`,
+    };
+  }
+
+  const because = ambient.join(' and ');
+  // The runs-as-owner case is the one that reaches stderr as well as the file: it is a live
+  // privilege-escalation surface, not a style note. The plain case stays an inline FIXME —
+  // on a brownfield database it is the common shape, and echoing all of it would bury the rest.
+  return elevated
+    ? {
+      fixme: `// FIXME SECURITY: ${o.identity} is ${elevated.posture} and owned by '${owner}' — ${because}. ${elevated.what} runs with that role's privileges. The observed owner is NOT declared, because declaring the build credential would make the accident reproducible; declare the intended owner with owner: '<role>'.`,
+      warning: `${o.identity}: ${elevated.posture}, owned by '${owner}' (${because}) — ${elevated.what.toLowerCase()} runs with that role's privileges. Ownership was NOT declared; declare the intended owner with owner: '<role>'.`,
+    }
+    : {
+      fixme: `// FIXME: ${o.identity} is owned by '${owner}' — ${because}, not a chosen principal, so ownership is NOT declared. Add owner: '<role>' if a specific role should own it.`,
+    };
+}
+
+/**
+ * The A4 spelling, kept so existing callers and tests read unchanged. `renderedOwner` is the
+ * implementation; this is the function-shaped door onto it.
+ */
+export function renderedFunctionOwner(
+  o: Pick<LiveObject, 'identity' | 'owner' | 'ownerIsSuperuser' | 'ownerIsConnectedRole'>,
+  secdef: boolean,
+): { prop?: string; fixme?: string; warning?: string } {
+  return renderedOwner(o, secdef ? SECURITY_DEFINER_RIGHTS : null);
+}
+
 /** One matview index attachment → the Brick E builder chain, or null (FIXME). */
 function renderIndexBuilder(indexdef: string): string | null {
   const parsed = parseIndexDefinition(indexdef);
@@ -469,6 +573,24 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
       const props: string[] = [];
       const hasPrivileges = Object.keys(privileges).length > 0;
       if (o.kind === 'view') props.push(`securityInvoker: ${o.securityInvoker === true},`);
+      // A15 — the owner, through the SAME discriminator functions use. Elevated exactly when
+      // the relation runs as its owner: a view that is not securityInvoker, and a matview
+      // always (its rows are computed at REFRESH time with the owner's rights, no exceptions).
+      const relationOwnership = renderedOwner(
+        o,
+        o.kind === 'materialized view' ? MATVIEW_RIGHTS
+          : o.securityInvoker === false ? DEFINER_VIEW_RIGHTS
+            : null,
+      );
+      if (relationOwnership.prop) props.push(relationOwnership.prop);
+      if (relationOwnership.fixme) fixmes.push(relationOwnership.fixme);
+      // The FIXME lands in the file, at the declaration, which is where the operator acts on
+      // it. The stderr WARNING is deliberately NOT raised for relations: `SECURITY DEFINER` is
+      // opt-in and rare, so echoing those is signal, but `security_invoker = false` is
+      // PostgreSQL's DEFAULT for views — on any real database nearly every view and every
+      // matview qualifies, and promoting all of them would bury the function findings the
+      // channel exists for. Same judgement the function branch already makes for its plain
+      // case, applied where the base rate is inverted.
       // `private: true` means "declared dark, no grants" — it contradicts a recorded
       // grant, and the model refuses the pair. A relation whose only reach is recorded
       // (PUBLIC SELECT, or a write grant) is not dark; it just has no CHOSEN audience.
@@ -516,6 +638,7 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
     const roleGrants = Object.keys(grants).filter((r) => r.toUpperCase() !== 'PUBLIC').sort();
     const publicExec = Object.keys(grants).some((r) => r.toUpperCase() === 'PUBLIC');
     const args = f && (f.language === 'sql' || f.language === 'plpgsql') ? parseArgs(f.args) : null;
+    const ownership = renderedFunctionOwner(o, f?.secdef === true);
 
     if (!f || args === null || (f.language !== 'sql' && f.language !== 'plpgsql')) {
       warnings.push(`${o.identity}: signature beyond the v1 vocabulary (${f ? `language ${f.language}, args '${f.args}'` : 'no structured fields'}) — rendered as defineSql.`);
@@ -523,6 +646,14 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
       // collapse to one provenance row here too — the declared name carries the signature
       // (the drop is explicit, so the name is a label, and a unique one is what it needs).
       const sqlName = declaredName(o) + (f?.identityArgs !== undefined ? `(${f.identityArgs})` : '');
+      // A defineSql object cannot carry an owner. Where the pull observed a CHOSEN owner that
+      // is real fidelity loss, so it is said out loud on both surfaces — never dropped. An
+      // ambient owner needs no note here: there is nothing to declare and nothing was lost.
+      if (ownership.prop) {
+        const why = `${o.identity}: owned by '${o.owner}', but defineSql cannot declare an owner — the build will create it as the connecting role. Move it into defineFunction's vocabulary, or set the owner by hand after the build.`;
+        warnings.push(why);
+        lines.push(`// FIXME: ${why}`);
+      }
       lines.push(
         `// FIXME: ${o.identity} — signature beyond defineFunction's v1 vocabulary; kept verbatim as defineSql.`,
         `export const ${varName} = defineSql(${tsString(sqlName)}, {`,
@@ -548,11 +679,30 @@ export function renderDerivedSource(catalog: DerivedCatalog, opts: DerivedRender
     props.push(`returns: ${tsString(f.returns)},`);
     props.push(`language: ${tsString(f.language)},`);
     if (VOLATILITY[f.volatility]) props.push(`volatility: ${tsString(VOLATILITY[f.volatility])},`);
-    if (f.secdef) {
-      props.push(`security: 'definer',`);
-      const path = (f.searchPath ?? 'pg_catalog').split(',').map((s) => s.trim().replace(/^"|"$/g, '')).filter(Boolean);
+    if (f.secdef) props.push(`security: 'definer',`);
+    // THE PIN IS READ, NEVER INVENTED.
+    //
+    // This used to render `searchPath: ['pg_catalog']` for any definer function whose live
+    // proconfig was empty. A build from those models then applied the invented pin for real, so
+    // functions that had always resolved `public` stopped resolving it — sign-up and password
+    // change died on a database built from the consumer's own models, with every gate green.
+    // 34 of their 34 pinned-in-the-model functions were unpinned in the database.
+    //
+    // A live pin renders as the array. No live pin on a definer function renders the explicit
+    // `'unpinned'` sentinel — an ANSWER, not silence, so `defineFunction` still throws for the
+    // author who simply forgot. No live pin on an invoker function renders nothing, which
+    // already means exactly that.
+    if (f.searchPath) {
+      const path = f.searchPath.split(',').map((s) => s.trim().replace(/^"|"$/g, '')).filter(Boolean);
       props.push(`searchPath: [${path.map(tsString).join(', ')}],`);
+    } else if (f.secdef) {
+      props.push(`searchPath: 'unpinned',`);
     }
+    // Ownership sits beside security because it IS the other half of it: `security: 'definer'`
+    // says the function runs as its owner, and this says who that is.
+    if (ownership.prop) props.push(ownership.prop);
+    if (ownership.fixme) fixmes.push(ownership.fixme);
+    if (ownership.warning) warnings.push(ownership.warning);
     if (roleGrants.length) {
       props.push(`abilities: [${roleGrants.map((r) => `can('execute', { role: ${tsString(r)} })`).join(', ')}],`);
       need('can');

package/src/cli/derived-source.ts

@@ -60,6 +60,30 @@ export interface SourceObject {
   file: string;
   /** Position in the concatenated source — a valid dependency order by convention. */
   seq: number;
+  /**
+   * kind 'function' only: the declared owning role.
+   *
+   * A SECURITY DEFINER function executes with its OWNER's rights, so this is a privilege
+   * boundary. The applier enacts it by running the CREATE under `SET ROLE <owner>` rather
+   * than following it with `ALTER … OWNER TO`: measured on PG16, once ownership has moved the
+   * builder gets "must be owner of function" on the next `CREATE OR REPLACE`, so the
+   * alter-after form works exactly once and breaks every re-run.
+   */
+  owner?: string;
+  /**
+   * kind 'function' only: the declared `SET search_path`, or the sentinel `'unpinned'`.
+   *
+   * It is already inside `sql`, so this is NOT in the hash and changes no fingerprint. It rides
+   * structurally so the differ can compare the declared pin against the LIVE catalog directly
+   * rather than only against a recorded hash. Without that, `--baseline` records a declared pin
+   * the database does not have and every later check reports zero actions, forever: measured,
+   * and it is how a model came to claim `search_path=pg_catalog` about a database with none
+   * while every gate stayed green.
+   *
+   * `undefined` means NOT DECLARED — a parser-era db/sql object, or an invoker function with no
+   * pin. The comparison is skipped there; absent evidence is not evidence.
+   */
+  searchPath?: string[] | 'unpinned';
   /** kind 'sql' only: the declared PostgreSQL object kind (`'aggregate'`, …). */
   objectKind?: string;
   /** kind 'sql' only: the explicit DROP for kinds whose drop isn't derivable from the name. */
@@ -82,9 +106,15 @@ export const DECLARED_SOURCE_FILE = 'db/models (declared)';
 /** The one content-hash formula. Unchanged since the db/sql era on purpose: provenance
  *  recorded from parser-era objects still matches the descriptor-compiled hash of the
  *  same SQL, so the db/sql → descriptor migration reconciles as a no-op. */
-export function hashSourceContent(createSql: string, attachments: Attachment[]): string {
+export function hashSourceContent(createSql: string, attachments: Attachment[], owner?: string): string {
   const content = [normalizeSql(createSql), ...attachments.map((a) => normalizeSql(a.sql))].join('\n');
-  return createHash('sha256').update(content).digest('hex');
+  // Ownership is part of the declared state — a SECURITY DEFINER function that changes owner
+  // changes who it executes as, which is a rebuild, not an authz delta. It is folded in as a
+  // PREFIX only when declared, so every object without an owner hashes byte-identically to
+  // before this existed. That is deliberate: a consumer mid-adoption must not be forced into a
+  // second fingerprint re-mint in a week by a field they do not use.
+  const body = owner ? `-- owner: ${owner}\n${content}` : content;
+  return createHash('sha256').update(body).digest('hex');
 }
 
 /** A raw file the generic dir readers return (db/backfills, seed lanes). */

package/src/cli/migration-generate.ts

@@ -76,6 +76,9 @@ export const HELD_DROP_PREFIX = '-- DROP held back';
  */
 function isRemoval(change: SchemaChange, replacedConstraints: Set<string>): boolean {
   if (change.kind === 'dropColumn' || change.kind === 'dropTable' || change.kind === 'dropType' || change.kind === 'dropIndex') return true;
+  // DROP IDENTITY destroys the backing sequence and its counter — a removal, not a change.
+  // ADD/SET GENERATED are not: they create or retune the auto-value and lose nothing.
+  if (change.kind === 'setIdentity' && change.identity == null) return true;
   if (change.kind === 'dropConstraint') return !replacedConstraints.has(`${change.table}::${change.name}`);
   return false;
 }

package/src/cli/model-render.ts

@@ -20,6 +20,7 @@ import type { DerivedRenderResult } from './derived-render.js';
 import type { TableContract } from './authz-contract.js';
 import { deriveAbilities, renderDerivedAbilities } from './authz-derive.js';
 import { normalizeDefault, normalizeCheck } from './schema-diff.js';
+import { generatedIndexName, generatedForeignKeyName } from './schema-compile.js';
 
 /**
  * Reverse a CHECK predicate back into the `.validate(z…)` that produced it — the inverse of
@@ -459,10 +460,17 @@ function renderField(table: TableSchema, col: ColumnSchema, known: Set<string>,
   let expr = call ?? verbatimFieldCall(col.type);
   let comment = call ? '' : ` // verbatim: no first-class field for '${col.type}' — carried as-is`;
 
+  // The auto-value the database actually holds. Rendered BEFORE .primaryKey()/.notNull() so a
+  // pulled surrogate key reads the way one is authored, and rendered at all because without it
+  // the rebuilt column has no auto-value and every INSERT that omits it fails NOT NULL.
+  if (col.identity) {
+    expr += col.identity === 'always' ? '.generatedAlwaysAsIdentity()' : '.generatedByDefaultAsIdentity()';
+  }
+
   const isPk = table.primaryKey.includes(col.name);
   if (isPk) expr += '.primaryKey()';
-  // A serial field is NOT NULL by construction, so the modifier would be redundant.
-  else if (col.notNull && !serial) expr += '.notNull()';
+  // A serial or identity field is NOT NULL by construction, so the modifier would be redundant.
+  else if (col.notNull && !serial && !col.identity) expr += '.notNull()';
 
   if (table.uniques.some((u) => u.columns.length === 1 && u.columns[0] === col.name)) expr += '.unique()';
 
@@ -473,7 +481,11 @@ function renderField(table: TableSchema, col: ColumnSchema, known: Set<string>,
         fk.onDelete ? `onDelete: ${tsLiteral(fk.onDelete)}` : null,
         fk.onUpdate ? `onUpdate: ${tsLiteral(fk.onUpdate)}` : null,
       ].filter(Boolean);
-      const opts = actions.length ? `, { ${actions.join(', ')} }` : '';
+      // A8 — the FK's own name, said only when it is not the one the compiler would generate.
+    if (fk.name && fk.name !== generatedForeignKeyName(bareName(table.table), fk.columns, bareName(fk.refTable), fk.refColumns)) {
+      actions.push(`name: ${tsLiteral(fk.name)}`);
+    }
+    const opts = actions.length ? `, { ${actions.join(', ')} }` : '';
       expr += `.references(() => ${modelVarName(fk.refTable)}${opts})`;
     } else comment += ` // FK → ${fk.refTable} (not in the pulled set)`;
   }
@@ -528,6 +540,15 @@ function renderConstraintsBlock(table: TableSchema, checks: CheckConstraint[], k
     if (ix.unique) s += '.unique()';
     if (ix.include?.length) s += `.include(${ix.include.map((c) => tsLiteral(toCamelCase(c))).join(', ')})`;
     if (ix.where) s += `.where(sql\`${normalizeCheck(ix.where)}\`)`;
+    // A7 — keep the name the database actually has, but only say it when it is not the one the
+    // compiler would generate anyway. A brownfield schema arrives with its previous tooling's
+    // names (`index_contents_on_destination_id`), and rebuilding under ours renamed ~200 of one
+    // consumer's indexes: counts and definitions matched, so every gate stayed green while a
+    // planner regression test, runbooks and pg_stat_user_indexes history all broke. Declaring
+    // only the divergent ones keeps a greenfield pull clean and an adopted one faithful.
+    if (ix.name && ix.name !== generatedIndexName(bareName(table.table), ix.columns)) {
+      s += `.name(${tsLiteral(ix.name)})`;
+    }
     items.push(s);
   }
   for (const fk of table.foreignKeys) {
@@ -542,6 +563,10 @@ function renderConstraintsBlock(table: TableSchema, checks: CheckConstraint[], k
       fk.onDelete ? `onDelete: ${tsLiteral(fk.onDelete)}` : null,
       fk.onUpdate ? `onUpdate: ${tsLiteral(fk.onUpdate)}` : null,
     ].filter(Boolean);
+    // A8 — the FK's own name, said only when it is not the one the compiler would generate.
+    if (fk.name && fk.name !== generatedForeignKeyName(bareName(table.table), fk.columns, bareName(fk.refTable), fk.refColumns)) {
+      actions.push(`name: ${tsLiteral(fk.name)}`);
+    }
     const opts = actions.length ? `, { ${actions.join(', ')} }` : '';
     items.push(`foreignKey(${cols}, () => ${modelVarName(fk.refTable)}, ${refCols}${opts})`);
   }