@everystack/cli 0.4.65 → 0.4.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.65",
+  "version": "0.4.66",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -126,7 +126,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.16"
+    "@everystack/model": "0.4.17"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",

package/src/cli/authz-compile.ts

@@ -331,54 +331,53 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   const isRoleRead = (a: Ability): boolean =>
     a.action === 'read' && Boolean(a.condition.role) && !isColumnAbility(a);
 
-  // Author-supplied predicates, per action. `manage` carries no predicate of its own —
-  // it is the admin bypass — so only the specific verbs are consulted.
+  // `manage` + owner/via desugars into four verb abilities for policy emission.
+  // Role-scoped `manage` (the admin bypass) passes through — it matches `hasAdminManage`
+  // directly. Grants handle `manage` natively via `verbsFor`, so this expansion is
+  // policy-compiler-local: `compileGrants` still reads `model.abilities`.
+  const abilities: readonly Ability[] = model.abilities.flatMap((a) => {
+    if (a.action !== 'manage' || !rowScoped(a)) return [a];
+    const c = a.condition;
+    return [
+      { action: 'read' as const, condition: c },
+      { action: 'create' as const, condition: c },
+      { action: 'update' as const, condition: c },
+      { action: 'delete' as const, condition: c },
+    ];
+  });
+
   const predFor = (action: Ability['action']): string | null => {
-    for (const a of model.abilities) {
+    for (const a of abilities) {
       if (a.action !== action || isRoleRead(a) || isColumnAbility(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('${action}')`);
       if (p) return p;
     }
     return null;
   };
-  /**
-   * The predicate on the PUBLIC read — a read ability with neither a role nor a row scope.
-   *
-   * Read separately from {@link ownerReadPred} because the two are different BRANCHES of
-   * the same authenticated policy. Taking both from one ordered lookup made the anon
-   * policy depend on the order the abilities happened to be declared in: put the owner
-   * read first and `anon` inherited the owner branch's guard as its whole public rule.
-   */
   const publicReadPred = (): string | null => {
-    for (const a of model.abilities) {
+    for (const a of abilities) {
       if (a.action !== 'read' || a.condition.role || rowScoped(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('read')`);
       if (p) return p;
     }
     return null;
   };
-
-  /** The predicate the OWNER read narrows ITSELF by — `can('read', { owner, sql })`. */
   const ownerReadPred = (): string | null => {
-    for (const a of model.abilities) {
+    for (const a of abilities) {
       if (a.action !== 'read' || !rowScoped(a) || isColumnAbility(a)) continue;
       const p = rawPredicate(a.condition.sql ?? a.condition.where, `${table}: can('read', { owner })`);
       if (p) return p;
     }
     return null;
   };
-
-  /** The WRITE half, when the author declared one distinct from the read half. */
   const checkFor = (action: Ability['action']): string | null => {
-    for (const a of model.abilities) {
+    for (const a of abilities) {
       if (a.action !== action) continue;
       const p = rawPredicate(a.condition.check, `${table}: can('${action}', { check })`);
       if (p) return p;
     }
     return null;
   };
-
-  const abilities = model.abilities;
   const hasAdminManage = abilities.some((a) => a.action === 'manage' && a.condition.role === 'admin');
   const hasPublicRead = abilities.some((a) => a.action === 'read' && !a.condition.role && !rowScoped(a));
   // The audience is open when the public read says so. Read off the SAME abilities that make
@@ -569,8 +568,8 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     // key, and undefined must mean ENABLED — the pre-flag behavior — never a silent
     // security downgrade via version skew.
     rls: { enabled: model.rls !== false, forced: model.rls !== false && model.writtenBy === 'app' },
-    grants: compileGrants(abilities, model.privileges),
-    ...(compileColumnGrants(abilities) ? { columnGrants: compileColumnGrants(abilities) } : {}),
+    grants: compileGrants(model.abilities, model.privileges),
+    ...(compileColumnGrants(model.abilities) ? { columnGrants: compileColumnGrants(model.abilities) } : {}),
     policies,
   };
 }

package/src/cli/derived-lint.ts

@@ -189,6 +189,7 @@ export function findSecdefExecuteGaps(derived: readonly DerivedDescriptor[]): De
   for (const d of derived) {
     if (d.kind !== 'function' || d.security !== 'definer' || d.abilities.length > 0) continue;
     if (d.returns === 'trigger') continue;
+    if (d.internal) continue;
     if (Object.keys(d.privileges ?? {}).length > 0) continue;
     const identity = identityOf(d);
     gaps.push({