@everystack/cli 0.4.66 → 0.4.68

package/CHANGELOG.md

@@ -0,0 +1,893 @@
+# Changelog
+
+All notable changes to `@everystack/cli` are documented here.
+
+Format based on [Keep a Changelog](https://keepachangelog.com/).
+
+## [Unreleased]
+
+### Fixed
+
+- secrets test expected .js extension stripped by Metro compat
+- async RSA key generation — unblocks the event loop in parallel test runs
+
+## [0.4.66] - 2026-08-15
+
+### Fixed
+
+- compile owner-scoped `manage` to write policies + add `internal` flag for functions
+
+## [0.4.65] - 2026-08-15
+
+### Fixed
+
+- route rotation DB ops through the ops Lambda (VPC)
+
+## [0.4.64] - 2026-08-15
+
+### Fixed
+
+- resolve all closing-gate findings (F1-F8) on Phase B
+- resolve re-review findings N1-N4
+
+## [0.4.63] - 2026-08-15
+
+### Changed
+
+- read credentials from SST secret store, not individual SSM params
+
+## [0.4.62] - 2026-08-15
+
+### Added
+
+- db:provision --rotate — live credential rotation
+
+## [0.4.61] - 2026-08-14
+
+### Added
+
+- add rollingRestart primitive — bump EVERYSTACK_GEN to retire warm containers
+- update calls rollingRestart after the pointer flip
+- update verifies origin serves the new release after restart
+- cache:purge refuses unless origin serves the expected release
+- deploy waits for CloudFront distribution to reach Deployed
+
+### Fixed
+
+- drop .js extensions from barrel re-exports so Metro resolves them
+- strip .js extensions from all internal imports for Metro compatibility
+- strip .js from dynamic imports too — Metro traces them the same way
+
+## [0.4.60] - 2026-08-14
+
+### Fixed
+
+- the task image no longer computes the fingerprint it is judged by
+- verify the task stamped the fingerprint the operator sent
+- close the closing-gate findings on the backup fingerprint path
+- bind the fixes to checks that fail, and correct the retraction order
+
+## [0.4.59] - 2026-08-13
+
+### Fixed
+
+- a failed post-apply re-read is its own phase, not bookkeeping
+- the phase messages tell the truth about the memoir and the COMMIT
+- --only scopes the provenance re-key too
+- a pending provenance re-key is visible; --only must not scope it
+- two guards against orphaning a provenance row
+- drop the plan-shape guard, keep the one at the delete site
+- escalate the guard's dollar tag instead of refusing the object
+- never drop provenance for an object that is still live
+- a function whose signature names a relation waits for it
+- the signature is an ordering edge, and quoted type names count
+- db:sync settles in one pass
+- report the two passes as one operation, honestly
+
+### Documentation
+
+- record why a legacy identity the source also claims still migrates
+- the re-key line says it is pending, and the docs decode it
+
+## [0.4.58] - 2026-08-12
+
+### Fixed
+
+- reconcile recorded provenance before it migrated it
+- the guard's test could not see an unguarded guard
+
+## [0.4.57] - 2026-08-12
+
+### Fixed
+
+- link workspace siblings instead of resolving them from the registry
+- a tree we could not read is not evidence about the database
+- pnpm test was green because it skipped, not because it passed
+- an explicit DATABASE_URL that does not answer is a failure, not a skip
+- the softDelete guard asked about visibility, not about DELETE
+- close the gate findings — the rule was still one grant short
+- db:pull invented a policy for every RLS-off table
+
+## [0.4.56] - 2026-08-10
+
+### Added
+
+- compile and apply a function's declared owner
+- the authz contract tells a scoped operator from a superuser
+- db:pull declares a chosen function owner, and the builder refuses one it cannot enact
+- the ownership mechanism is chosen from the builder, not assumed
+- a serial column's sequence inherits its table's grants
+- assert the schema posture, and detect who can plant a shadow object
+- keep the index name the database already has
+- keep the foreign key constraint name too
+- the round-trip oracle, and the three defects it immediately found
+- capture GENERATED ALWAYS AS IDENTITY through the round trip
+- a view's owner is a privilege boundary too — declare it, build it
+
+### Fixed
+
+- never mint a REVOKE that ownership explains
+- db:pull reads the search_path, it does not invent one
+- close the two defects the round-trip oracle found
+- a same-name index redefinition drops before it creates
+
+## [0.4.55] - 2026-08-10
+
+### Added
+
+- db:build — the models produce a database you keep
+
+### Fixed
+
+- the diff path emits declared extensions — fresh builds AND stage applies
+- the generated drizzle artifact typechecks under strict
+
+## [0.4.54] - 2026-08-10
+
+### Fixed
+
+- a database and its own restored clone are one state
+- fingerprint v10 — normalizing checks and index predicates MOVES the hash
+
+## [0.4.53] - 2026-08-10
+
+### Fixed
+
+- predicate identity survives a PostgreSQL major boundary
+- the schema-USAGE phase diffs against the live nspacl instead of emitting blind
+- a multi-schema checkout's models are never reported unmodeled; --stage labeling discoverable from --database-url pulls
+
+## [0.4.52] - 2026-08-08
+
+### Added
+
+- compile rls: false to a grants-only contract — and never downgrade on version skew
+- db:pull transcribes rls: false for the live grants-only shape
+- db:pull names the migration-tool tables it skipped, and what to do
+- db:pull --govern-roles — a foreign role's grants survive migration deletion
+
+### Fixed
+
+- the two lint gates learn the rls: false posture — live access named as live
+
+### Documentation
+
+- db:check stops overclaiming; db:pull's rls: false line documented
+
+## [0.4.51] - 2026-08-07
+
+### Added
+
+- db:check fails a model file the barrel never exported
+- db:pull renders extensions, so the declared state can bootstrap itself
+- db:pull adopts a multi-schema database in one pull
+
+### Fixed
+
+- db:plan's adoption class never reached the artifact it explains
+- declared functions exist before the policies that call them
+
+## [0.4.50] - 2026-08-07
+
+### Fixed
+
+- a recorded grant is reach, and a foreign grantee is never an ability
+
+## [0.4.49] - 2026-08-06
+
+### BREAKING CHANGES
+
+- a grant with no policy is spellable, and no longer renders as an ability
+- --key=value silently changed the TARGET, not just the flag
+
+### Added
+
+- db:check flags a CRUD grant declared with no policy
+- read a trigger's SHAPE from the catalog, not from its prose
+- a live EXECUTE grant is a fact, so let a function record one
+- db:pull renders trigger bindings, as standalone descriptors
+- record a relation's inexpressible grants instead of skipping the object
+
+### Fixed
+
+- an ability needs a grant AND a covering policy — on every branch
+- a UNION typed the function identity as `name`, truncating ACLs at 63 bytes
+- a trigger function has no caller to declare, so stop demanding one
+
+### Documentation
+
+- the trigger API is trigger(), not defineTrigger
+
+## [0.4.48] - 2026-08-04
+
+### Added
+
+- declare the SECURITY DEFINER functions, so db:reconcile can see them
+- writtenBy: 'functions' must have functions, checked at composition
+
+## [0.4.47] - 2026-08-04
+
+### Fixed
+
+- the direct lane for db:plan and db:refresh, and stop recommending --database-url against a deployed stage
+- db:exec's DML-only guard was blind to four things it advertised catching
+
+## [0.4.46] - 2026-08-04
+
+### Added
+
+- policyRoles — the policy's audience, not its grantees
+- field.pgType — a verbatim type is its own identity
+- make column grants first-class
+- db:session — N statements, one connection, one transaction
+
+### Fixed
+
+- a replacement is never read as equivalent
+- name what the plan could not classify, and stop crying wolf
+- a redundant default precision is not a type change
+- wire the governed filter into every declared-vs-live comparison
+- a column-scoped UPDATE is not SELECT reach
+- a dead policy leaves the identity, not the record
+- a subsumed policy is not part of the state
+- one definition of a public read, and writtenBy stops guessing
+- the stage lane reads twice, and never calls that a verification
+- route every introspection through one session, and delete the bare SET
+
+## [0.4.45] - 2026-08-02
+
+### BREAKING CHANGES
+
+- fingerprint v4 — one equivalence relation, three surfaces
+
+### Added
+
+- policy identity by rule — the shared matcher
+- classify every authz statement by why it exists
+- recognise the role split in the shared matcher
+- a fingerprint format change refuses, it does not report drift
+- the model can say REFERENCES, TRIGGER, TRUNCATE
+- the pull says what it did not capture, in the file you review
+- the owner is named, because the contract cannot carry it
+
+### Fixed
+
+- a migration tool's journal is not the app's model
+- PUBLIC is one grantee, not two spellings
+- db:pull renders a live TO PUBLIC read as PUBLIC
+- a value that looks like a flag is still a value
+
+## [0.4.44] - 2026-08-02
+
+### Fixed
+
+- db:pull --derived-out wrote a derived layer the barrel then excluded
+- a public read and an owner read are two branches, not a contest
+- db:pull dropped the owner branch of a `public OR mine` read
+
+## [0.4.43] - 2026-08-01
+
+### Fixed
+
+- a role-scoped read compiled to a grant with no policy, and an omitted WITH CHECK is not a change
+- soft-delete visibility is declared, never inferred from a column name
+- a predicate is parenthesized exactly once, so a pulled policy round-trips
+- a plan's `additive` count was a default, not a finding — and `→ text` was never free
+- db:plan says "do NOT commit" — now it checks whether git agrees
+
+## [0.4.42] - 2026-08-01
+
+### Added
+
+- a role the models cannot name keeps its grants, and is named on every run
+- the adoption baseline — a foreign role that was not there at adoption refuses the plan
+- stripping an undeclared grantee is destructive, and db:check verifies the baseline artifact (cli 0.4.41, model 0.4.7)
+
+### Fixed
+
+- array-literal quoting, an unvouchable role, a cold build, and a source file grep was skipping
+
+## [0.4.40] - 2026-07-31
+
+### Added
+
+- db:authz gets a local venue, and the published bin actually runs
+- the authz vocabulary compiles what it declares
+- db:pull --abilities live — the authz half of the brownfield on-ramp
+- state the operator role once, and two messages that cost an adopter time
+- a function is identified by its name AND its argument types
+
+### Fixed
+
+- the red team stops crying wolf — two causes of phantom holes
+- db:fingerprint refuses a barrel it cannot load
+- db:pull read an unnamed multi-word argument as an argument name
+- a killed test run no longer poisons the next one, and a numeric default survives the round trip
+
+### Documentation
+
+- scrub a consumer role name from the inheritance docblock
+
+## [0.4.37] - 2026-07-29
+
+### Fixed
+
+- db:swap stops fighting its own backup, and its snapshot is now a fact
+
+## [0.4.36] - 2026-07-29
+
+### Added
+
+- db:swap pairs the derived layer — zero downtime, no refresh
+- db:swap --dump-build — the instrument for an unreproducible field bug
+
+### Fixed
+
+- db:reconcile can rebuild a view backing a function's return type
+- db:swap re-grants schema USAGE — a successful swap dark-sited the app
+- db:swap refuses a PARTIAL derived layer instead of reporting success
+- the paired build sets a search_path — BARE refs could not resolve
+- a paired swap records provenance — the next reconcile was rebuilding everything
+- the schema rewrite must not touch string literals — it renamed JSON keys
+- the mutation-lease refusal names a holder in ANOTHER database
+- "provenance recorded" could print having recorded nothing
+- db:swap will not take its target from DATABASE_URL — --stage was silently overridden
+
+## [0.4.35] - 2026-07-28
+
+### Added
+
+- db:backup local upload venue — break-glass local→stage full replace (0.4.33)
+- db:reconcile applies an authz-only change as a regrant, not a matview rebuild (0.4.34)
+- db:swap --rebuild-derived — swap the schema, regenerate the derived layer
+- the restore heartbeat names WHO holds the lock
+
+### Fixed
+
+- schema-qualify every derived CREATE so public objects land in public (0.4.34)
+- db:provision writes CAPS secret names only (DATABASE_URL/ADMIN_DATABASE_URL)
+- instrument db:swap's restore leg with a lock-free liveness probe
+- TCP keepalives on every long-running pg binary
+- db:swap refuses instead of silently destroying cross-schema dependents
+- scope the restore heartbeat's COPY counter to our own load
+- walk the swap's dependency gate transitively, not just direct dependents
+- the dependent-drop notice is future tense — it announced drops that had not happened
+- a swap artifact carries base state, not the derived layer
+- the restore heartbeat counts schema growth as progress
+
+## [0.4.32] - 2026-07-23
+
+### Added
+
+- db schema-move primitive — movedFrom marker → ALTER TABLE SET SCHEMA
+
+## [0.4.31] - 2026-07-23
+
+### Added
+
+- the bring-your-own-database operator path — direct db:provision + optional migrations
+- db:provision keeps master off argv and bakes search_path into the URL — 0.4.21
+- credential-free db:reconcile — the derived-edge ops lane — server 0.4.8 + cli 0.4.22
+- credential-free operator lanes — db:refresh --stage + db:doctor direct venue — server 0.4.9 + cli 0.4.23
+- db:refresh --verify-nonempty — the credential-free dark-panel gate — server 0.4.11 + cli 0.4.25
+- mutation-lease core — the fixed-key advisory session lock
+- db:apply --direct — the credential-free unbounded-clock write lane
+- db:reconcile --direct — the unbounded-clock derived-rebuild lane
+- db:backfill --stage — the missing stage lane for data jobs
+- db:swap --stage --direct — the credential-free hot-swap capstone
+- search_path lives on the role, not the URL (the real fix)
+- db:exec spine — crash-truthful audit + single-transaction invariant
+- db:exec — DML-only by semantic catalog digest, no role or superuser
+- db data-movement Phase 2 — ephemeral Fargate Task lane for pg-binary work
+- db data-movement Phase 3a — db:backup/db:export run in the ephemeral Task lane
+- db data-movement Phase 3b foundation — snapshot-verify gate + shared live fingerprint
+- db data-movement Phase 3b — destructive apply gated on a verified backup
+- db data-movement — restore→Fargate + delete the pg-tools layer
+
+### Fixed
+
+- missing optional aws-sdk clients fail with the install remedy, not an IAM red herring
+- update resolves runtimeVersion policies — no more [object Object] release keys
+- db:provision echoes the target database; db:doctor names the no-Ops cause
+- db:reconcile --only <ids> — the recovery exit from a mistaken --rebaseline — server 0.4.10 + cli 0.4.24
+- db:provision preserves connection params (sslmode) when minting the URL — cli 0.4.26
+- --stage discovery carries backupsBucket — db:backup:download --stage works — cli 0.4.27
+- db:swap --direct connects via PG* env, not a search_path URL — libpq rejects it
+- db:swap re-applies authz idempotently — pg_dump carries RLS policies, so CREATE POLICY collided and rolled the swap back
+- db data-movement — Fable build-gate fixes (Task S3 grant + provable fp)
+
+## [0.4.18] - 2026-07-17
+
+### Fixed
+
+- db:swap integrity error reports the real failing statement, not an FK guess
+- derived apply creates the schemas its objects live in
+
+## [0.4.17] - 2026-07-17
+
+### Added
+
+- field.json() — the Postgres json type, distinct from jsonb
+
+## [0.4.16] - 2026-07-17
+
+### Fixed
+
+- --matviews-as-tables renders the MODEL naming idiom (bare name + schema prop)
+
+## [0.4.15] - 2026-07-17
+
+### Added
+
+- db:check split-brain gate + db:pull --suggest-keys + the flip doc
+
+## [0.4.14] - 2026-07-17
+
+### Added
+
+- db:pull --matviews-as-tables — render matviews as defineMaterializedTable
+
+## [0.4.13] - 2026-07-17
+
+### Added
+
+- db:export local venue (--database-url) — the build-locally on-ramp
+
+## [0.4.12] - 2026-07-16
+
+### Added
+
+- canonical-sync artifact verbs (gap B)
+
+## [0.4.11] - 2026-07-16
+
+### Fixed
+
+- introspect deparsed expressions under a canonical search_path
+
+## [0.4.10] - 2026-07-16
+
+### Fixed
+
+- db:pull renders array-column defaults as JS arrays
+
+## [0.4.9] - 2026-07-16
+
+### Fixed
+
+- multi-schema derived apply sets search_path so bare body refs resolve
+
+## [0.4.8] - 2026-07-16
+
+### Added
+
+- zero-config backup-layer guidance — probe/doctor/apply preflight
+
+## [0.4.7] - 2026-07-16
+
+### Added
+
+- db:provision announces what it touched and writes linkable keys — 0.4.5
+- the deploy probe reads a table THROUGH the api function — cli 0.4.6
+
+### Fixed
+
+- retire db:migrate from every advertisement; deploy env pinned + visible
+- db:snapshot --stage can finally see databaseInstanceId
+
+## [0.4.4] - 2026-07-14
+
+### Fixed
+
+- owner write abilities no longer narrow a public read
+- derived-compile tolerates descriptors without a triggers key
+
+## [0.4.3] - 2026-07-14
+
+### Added
+
+- post-deploy probe — deploy fails loudly when a function cannot boot
+
+### Fixed
+
+- the observability verbs can see a dead ops plane
+
+## [0.4.2] - 2026-07-10
+
+### Added
+
+- the loud undefined gate — a missing import is named at define time, never silently dropped
+- summary-first plans — the shape of the edge prints before the SQL wall
+- db:pull --derived-out <file> — the brownfield splice, first-class
+
+### Fixed
+
+- bimodal error advice — a model-compose error is never dressed as an IAM problem
+
+## [0.4.0] - 2026-07-10
+
+### Added
+
+- credential-free staged db:apply
+- ingest pipeline framework (Phase 3, Bricks 1-3)
+- surface pipeline last-run in db:sync/db:plan (Phase 3, Brick 4)
+- credential-free pipeline:run --stage (Phase 3, Brick 5)
+- db:pull scaffolds the read model — the explicit on-ramp (Brick A)
+- field.defaultSql() — the raw-default escape hatch (Brick C)
+- the declarative derived layer — descriptor API + rejection rules (Brick B1a)
+- descriptors compile to SourceObject — the reconciler front-end swap (Brick B1b)
+- reconciler edges for the descriptor kinds — triggers + gate-tight escape hatch (Brick B1c)
+- standalone sequences are state — declared, migrated, diffed, fingerprinted (Brick B1d)
+- descriptors go live in the verbs — the B3 wiring (read-model-everywhere)
+- the B2 gates — the read model is enforced, not just expressible (read-model-everywhere)
+- live drift + doctor — what the content hashes can't see (Brick B4, read-model-everywhere)
+- index identity sees everything CREATE INDEX can say (Brick E, read-model-everywhere)
+- db:pull renders the derived layer — the consumer's migration tool (Brick B5, read-model-everywhere)
+- typed reads — declared fields emit the derived layer into the generated schema (Brick B6a, read-model-everywhere)
+- retire db/sql — descriptors are the single home (Brick B7, read-model-everywhere)
+- db:generate --dry-run + the journal remembers schema-out (Brick D, read-model-everywhere)
+- db:reconcile --rebaseline — the defHash-verified migration for source re-renders (red-team blocker, read-model-everywhere)
+
+### Fixed
+
+- adoption-path fixes from the red team (read-model-everywhere)
+- reconcile apply hardening — session guard, real CONCURRENTLY fallback (red team, read-model-everywhere)
+- reachability gate mirrors the grant compiler — private models reach their granted roles (red team, read-model-everywhere)
+- the full workspace suite is green — five latent rots, all pre-existing, root-caused
+
+## [0.3.29] - 2026-07-05
+
+### Added
+
+- db:check gates force-RLS with no read authz
+- db:reconcile --rebuild for first-contact objects (gap 1b)
+
+### Fixed
+
+- deploy busts the stage cache; add --refresh
+- optional-peer AWS clients fail clean
+- db:backup pre-flights the pg_dump layer probe
+- surface the real cause of an ops-handler crash
+- reconcile + direct-connect operator gaps
+- reconcile --apply is atomic across DDL + provenance (gap 7)
+- db:reconcile/apply resolve ADMIN_DATABASE_URL, not the authenticator (gap 3)
+
+## [0.3.28] - 2026-07-04
+
+### Fixed
+
+- fingerprint hashes expressions as the diff does, so db:check can pass
+
+## [0.3.27] - 2026-07-04
+
+### Fixed
+
+- the gates and generators teach the migration-authority workflow
+
+## [0.3.26] - 2026-07-04
+
+### Added
+
+- db:fork — branch stages fork the database, not just the code (branch-stages brick 1+2)
+
+## [0.3.25] - 2026-07-04
+
+### Added
+
+- per-branch dev databases from a models-built template (brick 5 remainder)
+
+## [0.3.24] - 2026-07-04
+
+### Added
+
+- the backfill lane — one-shot data jobs, own record (brick 8)
+
+## [0.3.23] - 2026-07-04
+
+### Added
+
+- losing data should be hard — classification, deprecated(), role-gated destructive (brick 9)
+
+## [0.3.22] - 2026-07-04
+
+### Added
+
+- git-descent rule + db:check — the protected stage is a git ref (brick 7)
+
+## [0.3.21] - 2026-07-04
+
+### Added
+
+- table-level renamedFrom — rename intent through the diff (brick 6)
+
+## [0.3.20] - 2026-07-04
+
+### Added
+
+- db:plan + db:apply — verified edges, fingerprint-pinned at both ends (brick 4)
+
+## [0.3.19] - 2026-07-04
+
+### Added
+
+- db:diff — the state edge between two declared states, no database (brick 3)
+
+## [0.3.18] - 2026-07-03
+
+### Added
+
+- db:sync — make the database match your checkout (brick 5 core)
+
+## [0.3.17] - 2026-07-03
+
+### Added
+
+- derived-source — parse db/sql into derived objects (reconciler brick 1a)
+- derived introspection + reconcile planner (reconciler bricks 1b/1c)
+- db:reconcile — deploy the derived layer (reconciler bricks 1d/1e)
+- db/models is the models home — flagless resolution, legacy fallback
+- db:generate --apply — table changes with no tape (0.3.16)
+- schema fingerprint + db:fingerprint — the base state gets a content address (brick 2)
+
+### Fixed
+
+- WITH NO DATA matview creates get a REFRESH — rebuilds arrive populated (0.3.15)
+
+## [0.3.13] - 2026-07-02
+
+### Added
+
+- runbook detects instead of asserting — migration-mode tri-state, real scripts, model summary at scale
+
+## [0.3.12] - 2026-07-02
+
+### Added
+
+- db:pull and db:generate accept --database-url; cli 0.3.9
+- db:pull per-model files; serial and float round-trip; cli 0.3.10
+- runbook R0 — detectProjectReality, pure local project detection
+- runbook R1 — es:gen/es:slot markers, section templates, idempotent merge
+- runbook R2 — render the app's Models as the runbook data-model chapter
+- runbook R3 — everystack runbook command, --check/--diff/--force, /runbook API, capstone advisory
+
+### Fixed
+
+- guard npm publish on workspace-dep packages; cli 0.3.8
+- db:pull field keys are lossless; array columns map; cli 0.3.11
+
+## [0.3.7] - 2026-07-02
+
+### Fixed
+
+- honor EVERYSTACK_SURFACE as an explicit surface override
+- pin React to a single 19.2.0 across the monorepo
+- bound the S3 client and list() so a hung call can't drain the pool
+
+## [0.3.6] - 2026-06-30
+
+### Changed
+
+- keep @everystack/cli/audit typescript-free
+
+## [0.3.5] - 2026-06-30
+
+### Added
+
+- ui-bloat scanner — detect design bloat in a shipped bundle (Brick 5a-A)
+- component-model — the faithful TSX foundation (Brick 5a-B)
+- source-side UI-bloat checks — located, fixable, self-verifying (Brick 5a-C)
+- Check 3 — you rebuilt a ui primitive (Brick 5a-D)
+- Checks 4 & 5 — size/complexity + structural duplication (Brick 5a-E)
+- wire ui:audit + the bundle ui-bloat dimension (Brick 5a-F)
+- screen-aware audit + duplicate-component check (Brick 5b, first piece)
+
+## [0.3.4] - 2026-06-30
+
+### Added
+
+- B2 owner-aware red-team probe — catches the IDOR class
+- B2.2 db:authz:owner — Model-driven owner-isolation red-team
+- @everystack/cli/model public API + dogfood the example through it
+- everystack deploy — wrap sst deploy so the consumer never types sst
+- db:snapshot/restore S0 — pure core (key scheme + cross-stage guards)
+- db:snapshot — physical RDS snapshot (control-plane wrapper)
+- db:backup B1 — pg_dump layer + version-gate probe
+- db:backup B3 — backup/list/restore/download commands
+- via: transitive-owner RLS — own a child through its parent
+- compileDrizzleSource — emit the typed drizzle schema from models
+- precise authz grants — derive the tier from abilities, not a uniform constant
+- writtenBy + the FORCE axiom — RLS posture is a model property
+- per-model schema — a model declares the Postgres schema it lives in
+- greenfield generator emits non-public schemas
+- compose storage's dist.blobs into the example — package-owned authz proven
+- own the notification_* tables as Models + array vocabulary
+- column-scoped grants + cross-schema FK / index emission
+- compileModuleMigration + schema USAGE grants + db:generate --init
+- config-free perf/security/SEO audit commands for any deployed app
+- fold security:audit + lighthouse into the audit capstone
+- bundle:audit gains a weight/size dimension (the 180MB gate)
+- bundle:audit weighs the remote bundle and names what is bloating it
+
+### Fixed
+
+- db:snapshot error hints only mention IAM on access-denied
+- escape the NUL delimiters in schema-source (text-safe source)
+- db:authz:owner treats a public-read table's cross-owner read as expected
+
+### Changed
+
+- db backup/snapshot spec + pure cores (rename snapshot→backup)
+- compose v3 Modules → one clean generated migration
+
+### Documentation
+
+- v3 (0.3.0) documentation review — accurate READMEs + guides
+- complete the command reference — db:reset, branches, security:audit
+
+## [0.3.0] - 2026-06-27
+
+### Added
+
+- security:audit — the two-surface RLS gate
+- db:doctor — verify the DB is least-privilege + RLS-subject
+- db:provision — the role provisioner + db:doctor remediation
+- break-glass admin db:psql gated on AWS identity
+- authz-contract format + the two new introspection queries
+- db:authz:pull + db:authz:diff, end-to-end on the example app
+- exclude drizzle journal schema + guard the pull/diff workflow
+- the authz red-team — prove enforcement + capture column grants
+- db:authz:test + the db:authz:probe ops action — red-team a deployed stage
+- human-readable authorization review (the CTO can confirm intent)
+- humanize parent-ownership + boolean predicates in the review
+- capture SECDEF owner-bypasses-RLS — the max-blast-radius check
+- SECDEF grant-completeness check in db:authz:test
+- compile Model abilities to the authz contract (v3 Phase 1)
+- compile owner-read + text-owner tables; four app tables round-trip (v3 Phase 1)
+- emitReconcileSql — contract diff to authz SQL (v3 Phase 2)
+- field bridge DDL compiler — fields to CREATE TABLE (v3 data slice)
+- field bridge — CHECK constraints from .validate() Zod refinements
+- compileMigration — Models to one ordered migration (the generator skeleton)
+- whole-DB introspection — the data layer (columns, constraints, FKs)
+- compileTableSchema — data layer's second producer + round-trip
+- diffSchema — the structural schema diff (brownfield generate's missing half)
+- renamedFrom — the opt-in column rename, so the diff preserves data
+- ALTER COLUMN TYPE — real type-change DDL, classified safe/lossy/risky
+- db:generate — the brownfield migration generator, wired end to end
+- db:pull — render field() Models from a live database (the brownfield on-ramp)
+- P0 round-trip identity test against real Postgres
+- P1 — non-destructive by default in db:generate
+- P3 field vocabulary — numeric, varchar, date
+- P3 enum — CREATE TYPE, pg_enum introspection, round-trip
+- P4a FK referential actions + tougher constraint parser
+- P2.1 table-level constraints — composite unique, multi-col check
+- P2.2 indexes — index() builder, round-trip
+- P2.3 db:pull reverses a recognizable CHECK to .validate()
+- P5 apply-time warnings for SET NOT NULL and ADD COLUMN NOT NULL
+- P4b compile/emit/pull for composite foreign keys
+- P6 unify authz into db:generate (one ordered migration)
+
+### Fixed
+
+- dedup db:logs:tail so it stops reprinting the boundary batch
+- re-pin search_path on the four core SECDEF auth functions
+- render the authz review legend as a list, not one long line
+- P6 quote reserved table names in emitted authz SQL
+
+## [0.2.37] - 2026-06-17
+
+### Added
+
+- rename @everystack/updates → @everystack/cli, add db:migrate/db:seed, remove AdminSecret
+- add interactive console command with Lambda-relay REPL
+- add CloudFront KVS cache versioning with CLI purge and auto-invalidation
+- add StorageAdapter head(), ETag-based SSR reload, SigV4a for KVS
+- configurable per-origin cache headers + image EXIF fix
+- stage-aware resource discovery via AWS APIs
+- EAS-compatible OTA updates — branches, groups, channels, SSR
+- make S3 source of truth, database becomes optional mirror
+- add web publish versioning matching mobile pattern
+- export handleRegisterWeb and UpdatesHandlerOptions from ./handler
+- use X.509 code signing certificates instead of raw RSA keys
+- add db:reset action for dev schema rebuild
+- mobile publish via direct S3 upload + IAM Lambda invoke
+- move hydration fixes into framework, remove auth cache splitting
+- add `everystack diag` command for deployed page freshness diagnostics
+- add SSR hydration debugging tools
+- add browser-only API detection to SSR analyzer
+- add psql wrapper and logs commands for debugging
+- unified querying with S3 fallback for CLI log commands
+- add plugin architecture for composable Lambda handlers
+- extract generic actions into package plugins
+- add --origin flag to logs:tail for image and worker functions
+- add [updates] debug logging to OTA manifest, asset, and route handlers
+- dual-export OTA updates, SSR validation, eas.json env resolution
+- secrets management and auto-injection during update
+- re-add SST secret injection, delegate filtering to app layer
+- content-addressed asset deduplication, fix Metro resolution
+- add secrets import/export for bulk .env operations
+- add deny-by-default env filtering for client bundles
+- add createSecrets helper and transparent naming support
+- sync media assets to S3 during web publish
+- add multiline input and persistent history to console
+- add dot commands and schema introspection
+- add tab completion to console REPL
+- add auth context with login, asUser, and pgSettings
+- add sandbox mode for safe exploration
+- add .login with hidden password, current_user in scope, history redaction
+- add content-hash fingerprinting for media assets
+- log media asset paths and fingerprints during update
+- fail-closed env loader
+- split operator credential from the API connection
+- everystack status — platform health from the terminal
+- migration runner that cannot lie
+- DB-free alerting — artifact-backed evaluation over S3, no Postgres
+- IAM auth for web deploys, replace Sharp layer with SST bundling
+
+### Fixed
+
+- normalize cache:purge --path to strip query params and ensure leading slash
+- remove unused @everystack/jobs devDependency
+- include updateId in register-web payload
+- psql Lambda-only queries, composite key notify, logging defaults
+- add AWS KVS + SigV4a as direct dependencies
+- improve error messages and document setup requirements
+- resolve 5 deployment issues from first external testing
+- replace require() with ESM-compatible dynamic imports
+- pin all dependency versions to lockfile-resolved values
+- pgSettings on RPC, publicRpc client auth bypass, logs:tail log group resolution
+- route GET / to manifest handler for expo-updates client
+- propagate --stage to ENVIRONMENT and HOST_URL before config evaluation
+- redirect OTA assets via presigned S3 URL, set publish context
+- surface real error when app.config.js fails to load
+- decouple --stage from ENVIRONMENT, add --environment flag
+- revert @aws-sdk/signature-v4a to 3.1031.0, fix KVS SigV4a signing
+- bypass SigV4a singleton for KVS signing
+- drop GetFunctionConfiguration from log group resolution
+- detect export completion to prevent static pre-rendering hang
+- rewrite secrets for SST Ion, filter EXPO_PUBLIC_* only
+- remove secret auto-injection, skip SSR check for web-only updates
+- clear Metro transform cache on export
+- worker function discovery and log group resolution for SQS subscribers
+- replace infrastructure headers with single X-Server-Debug timestamp
+- version bumps and publish fixes for cli, server, jobs
+- invalidate stale config cache on schema change
+- fall back to outputs.json for custom-named media buckets
+- remove media asset pruning from update command
+- media-sync test uses same minimatch interop as source
+- discover the Router distribution by domain and SST tags
+- use minimatch's named export — the package ships types now
+- logs read S3 directly; invoke self-heals stale Lambda hash
+- harden S3 reader and lock the CLI-reader format contract
+
+### Changed
+
+- remove onMutation callback — events replaces it
+- migrate all package schemas to everyschema canonical tables
+- lazy-load AWS SDK imports for faster CLI startup
+- drop type module from all packages, switch Jest to CJS mode
+- consolidate Jest configs into shared base
+
+### Documentation
+
+- prepare documentation for open-source release
+- SECURITY DEFINER guidance; feat(cli): auto-export on stale dist/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.66",
+  "version": "0.4.68",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -19,7 +19,8 @@
   "files": [
     "bin",
     "src",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "exports": {
     ".": {
@@ -177,7 +178,7 @@
     "jest": "29.7.0",
     "react": "19.2.0",
     "ts-jest": "29.4.9",
-    "@everystack/server": "0.4.26"
+    "@everystack/server": "0.4.27"
   },
   "scripts": {
     "test": "jest",

package/src/cli/commands/certs.ts

@@ -1,8 +1,11 @@
+import { generateKeyPair as cryptoGenerateKeyPair } from 'node:crypto';
+import { promisify } from 'node:util';
 import fs from 'fs/promises';
 import path from 'path';
 import forge from 'node-forge';
 
 const { pki, md, random, util } = forge;
+const generateKeyPairAsync = promisify(cryptoGenerateKeyPair);
 
 export async function certsCommand(action: 'generate' | 'configure', flags: Record<string, string>): Promise<void> {
   if (action === 'generate') {
@@ -26,8 +29,16 @@ async function generateCerts(flags: Record<string, string>): Promise<void> {
   const validityYears = parseInt(flags.years || '10', 10);
   await fs.mkdir(outputDir, { recursive: true });
 
-  // Generate RSA key pair using node-forge
-  const keyPair = pki.rsa.generateKeyPair(2048);
+  // Generate RSA key pair with Node.js crypto (async, native — doesn't block the event loop)
+  const { publicKey: pubPem, privateKey: privPem } = await generateKeyPairAsync('rsa', {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+  const keyPair = {
+    publicKey: pki.publicKeyFromPem(pubPem),
+    privateKey: pki.privateKeyFromPem(privPem),
+  };
 
   // Create self-signed X.509 code signing certificate
   const cert = pki.createCertificate();

package/src/cli/commands/db.ts

@@ -215,27 +215,40 @@ export interface ProvisionSecretPlan {
  * provisioned by an older CLI is still detected. Pure — the contract is pinned by tests.
  */
 export function buildProvisionSecretPlan(args: {
-  result: { loginRole: string; adminRole?: string; adminVerified?: boolean | null };
-  authUrl: string;
+  result: {
+    loginRole: string;
+    adminRole?: string;
+    adminVerified?: boolean | null;
+    /** false = the role already existed as a live login and was NOT re-passworded (additive-only),
+     *  so its secret must be left untouched. Absent/true = the password was set, write the secret. */
+    passwordSet?: boolean;
+    adminPasswordSet?: boolean;
+  };
+  authUrl?: string;
   adminUrl?: string;
   existing: Record<string, string>;
 }): ProvisionSecretPlan {
   const { result, authUrl, adminUrl, existing } = args;
-  const updates: Record<string, string> = {
-    DATABASE_URL: authUrl,
-  };
+  const updates: Record<string, string> = {};
   const notes: string[] = [];
   const warnings: string[] = [];
 
-  const prevAuthRole = roleOfUrl(existing.DATABASE_URL ?? existing.DatabaseUrl);
-  notes.push(`DATABASE_URL: ${prevAuthRole ?? 'unset'} → ${result.loginRole}`);
-  if (prevAuthRole && prevAuthRole !== result.loginRole) {
-    warnings.push(
-      `DATABASE_URL was already set (role '${prevAuthRole}') — any function linked to it connects as '${result.loginRole}' after its next cold start. Ensure grants are in place: everystack db:reconcile && everystack db:doctor.`,
-    );
+  if (result.passwordSet !== false && authUrl) {
+    updates.DATABASE_URL = authUrl;
+    const prevAuthRole = roleOfUrl(existing.DATABASE_URL ?? existing.DatabaseUrl);
+    notes.push(`DATABASE_URL: ${prevAuthRole ?? 'unset'} → ${result.loginRole}`);
+    if (prevAuthRole && prevAuthRole !== result.loginRole) {
+      warnings.push(
+        `DATABASE_URL was already set (role '${prevAuthRole}') — any function linked to it connects as '${result.loginRole}' after its next cold start. Ensure grants are in place: everystack db:reconcile && everystack db:doctor.`,
+      );
+    }
+  } else {
+    // Additive-only: the authenticator already existed as a live login, so its password was
+    // preserved and DATABASE_URL is left as-is. Never rewrite a working credential on a re-provision.
+    notes.push(`DATABASE_URL: '${result.loginRole}' already provisioned — password + secret preserved (use --rotate to change it)`);
   }
 
-  if (result.adminRole && adminUrl) {
+  if (result.adminRole && adminUrl && result.adminPasswordSet !== false) {
     updates.ADMIN_DATABASE_URL = adminUrl;
     const prevAdminRole = roleOfUrl(existing.AdminDatabaseUrl ?? existing.ADMIN_DATABASE_URL);
     const verified = result.adminVerified === true ? 'login verified' : 'login NOT verified';
@@ -245,6 +258,8 @@ export function buildProvisionSecretPlan(args: {
         `The '${result.adminRole}' login could not be verified from the ops function — confirm operator connectivity before relying on it: everystack db:doctor.`,
       );
     }
+  } else if (result.adminRole) {
+    notes.push(`ADMIN_DATABASE_URL: '${result.adminRole}' already provisioned — password + secret preserved (use --rotate to change it)`);
   } else {
     warnings.push(
       'No operator login was created — this @everystack/server predates the both-sides split (<0.3.7). Operator tasks stay on the linked Postgres master; upgrade the server pin and re-run db:provision for the full credential split.',
@@ -254,6 +269,37 @@ export function buildProvisionSecretPlan(args: {
   return { updates, notes, warnings };
 }
 
+/**
+ * Both login passwords were preserved (an additive-only re-provision). Decide whether that is a
+ * true no-op — the secrets backing these roles already exist and name them — or a HALF-DONE stage
+ * the operator must recover with --rotate. A role can exist WITH LOGIN yet have no working secret:
+ * a prior provision set a fresh password and then failed to write it (the admin-probe abort, or a
+ * host it could not resolve). Reporting "already provisioned" there would send the operator away
+ * from the only fix, so refuse instead. Pure — pinned by tests.
+ */
+export function provisionPreservedIsRecoverable(args: {
+  loginRole: string;
+  adminRole?: string;
+  existing: Record<string, string>;
+}): { ok: true } | { ok: false; reason: string } {
+  const { loginRole, adminRole, existing } = args;
+  // A rotated stage's secret names the ACTIVE rotation-pair role (e.g. authenticator_a), not the
+  // bare role — so accept the base name OR either pair variant as a valid backing credential.
+  // Without this, a healthy rotated stage false-refuses on a plain (search_path) re-provision.
+  const backsRole = (secretRole: string | undefined | null, base: string): boolean =>
+    secretRole === base || secretRole === `${base}_a` || secretRole === `${base}_b`;
+  const authOk = backsRole(roleOfUrl(existing.DATABASE_URL ?? existing.DatabaseUrl), loginRole);
+  const adminOk = !adminRole || backsRole(roleOfUrl(existing.ADMIN_DATABASE_URL ?? existing.AdminDatabaseUrl), adminRole);
+  if (authOk && adminOk) return { ok: true };
+  return {
+    ok: false,
+    reason:
+      'Role(s) already exist but the stage secret does not match them — a prior provision set a '
+      + 'password that was never written to the secret store, so no working credential exists. '
+      + 'Run `everystack db:provision --rotate` to set a fresh password and write the secret together.',
+  };
+}
+
 /** The provisioning core's shape (mirrors @everystack/server/provision — no compile-time dep,
  *  same seam as pipeline-loader). */
 export interface ServerProvision {
@@ -263,6 +309,7 @@ export interface ServerProvision {
       execute: (sql: string) => Promise<unknown>;
       connection?: { host: string; port?: number | string; database: string } | null;
       connectProbe?: (url: string) => Promise<void>;
+      roleHasLogin?: (role: string) => Promise<boolean>;
     },
   ): Promise<any>;
 }
@@ -826,6 +873,12 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
       return await runProvision({ authPassword, adminPassword, searchPath, rotationPairs: !!flags['rotation-pairs'] }, {
         execute: async (statement) => runner(statement),
         connection: parseUrlConnection(url),
+        // Additive-only: an already-live login role keeps its password (never reset on re-provision).
+        roleHasLogin: async (role) => {
+          if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(role)) return false;
+          const rows = await runner(`SELECT 1 FROM pg_roles WHERE rolname = '${role}' AND rolcanlogin`);
+          return Array.isArray(rows) && rows.length > 0;
+        },
         // Same probe as the ops-Lambda venue: a real login as the new role, DDL-capable.
         connectProbe: async (probeUrl) => {
           const { default: postgres } = await import('postgres');
@@ -891,7 +944,32 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   }
   success(`Role chain ready: ${result.loginRole} (LOGIN, NOINHERIT, no BYPASSRLS) → can SET ROLE to ${result.appRoles.join(', ')}`);
   if (result.adminRole) {
-    success(`Operator login ready: ${result.adminRole} (LOGIN, INHERIT owner) — ${result.adminVerified === true ? 'connectivity verified' : 'connectivity NOT verified'}`);
+    const adminMsg = result.adminPasswordSet === false
+      ? 'existing login preserved (not re-verified — run db:doctor)'
+      : (result.adminVerified === true ? 'connectivity verified' : 'connectivity NOT verified');
+    success(`Operator login ready: ${result.adminRole} (LOGIN, INHERIT owner) — ${adminMsg}`);
+  }
+
+  // Additive-only: if the login roles already existed as live logins, provision changed no
+  // credential — so there is nothing to write and no host to resolve. Never touch the secret
+  // store on a no-op re-provision (the footgun that reset a live password then locked the stage out).
+  const wroteAuth = result.passwordSet !== false;
+  const wroteAdmin = !!result.adminRole && result.adminPasswordSet !== false;
+  if (!wroteAuth && !wroteAdmin) {
+    // Both roles preserved. Only a true no-op if the secrets backing them exist and name them;
+    // a role that exists WITH LOGIN but has no matching secret is a half-done prior provision that
+    // plain db:provision cannot recover — refuse with the --rotate remedy rather than report success.
+    const recoverable = provisionPreservedIsRecoverable({
+      loginRole: result.loginRole,
+      adminRole: result.adminRole,
+      existing: stageSecrets,
+    });
+    if (recoverable.ok) {
+      success(`Roles already provisioned — passwords and secrets left unchanged. Verify the live credential with \`everystack db:doctor --stage ${flags.stage}\`; run \`everystack db:provision --rotate\` to change credentials.`);
+      return;
+    }
+    fail(recoverable.reason);
+    process.exit(1);
   }
 
   // Resolve host/port/db (not secret) to build the connection strings in memory.
@@ -928,8 +1006,8 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   const mint = (role: string, password: string): string =>
     preserveConnParams(`postgresql://${role}:${password}@${conn.host}:${conn.port ?? 5432}/${conn.database}`, sourceUrl);
 
-  const authUrl = mint(result.loginRole, authPassword);
-  const adminUrl = result.adminRole ? mint(result.adminRole, adminPassword) : undefined;
+  const authUrl = wroteAuth ? mint(result.loginRole, authPassword) : undefined;
+  const adminUrl = wroteAdmin && result.adminRole ? mint(result.adminRole, adminPassword) : undefined;
 
   // Write the secrets directly to the SST secret store — never display them. One blob
   // write updates every key together, so there is no window where the API side is the

package/src/cli/deparse-normal.ts

@@ -24,13 +24,33 @@
  *   for n ≥ 1. PostgreSQL defines an array-to-array cast element-wise (parse_coerce), so
  *   the two expressions denote the same value for every input; wrapping an element in
  *   parentheses is parse-neutral. The empty array is EXCLUDED: `ARRAY[]` without a cast has
- *   no type, so its cast is load-bearing and stays.
+ *   no type, so its cast is load-bearing and stays. (The measured CROSS-VERSION case: two PG
+ *   majors const-fold the same DDL differently.)
+ *
+ *   LITERAL-TEXT-CAST STRIP: `'lit'::text  ==  'lit'`, but ONLY the bare `text` cast applied
+ *   directly to a single-quoted string literal. This is a CROSS-PRODUCER class, present on
+ *   every version: PostgreSQL coerces an unknown-type string literal compared to a text
+ *   column and RECORDS `'lit'::text` in the stored tree, while the author's model source
+ *   writes the un-cast `'lit'`. The two producers' texts never converge without this rule, so
+ *   a `text_col = 'lit'` partial index / CHECK / policy re-diffs DROP+CREATE forever and the
+ *   fingerprint gate cannot MATCH. Safe because `text` takes no typmod and its input function
+ *   is the identity on the literal's bytes — the cast cannot change the value. The rule is
+ *   `text`-ONLY for exactly that reason: `bpchar`/`character(n)` blank-pad or blank-trim,
+ *   `varchar(n)`/`"char"` truncate — those casts CHANGE the value, so stripping one would
+ *   collapse two opposite-truth predicates to equal text (a false match, the disaster). The
+ *   array-type cast `::text[]` is likewise excluded — it carries the element type. See the
+ *   `char(2)` false-match test for why the family is not widened.
  *
  * Anything the scanner does not positively recognize is left byte-for-byte unchanged — an
  * unrecognized spelling is a MISS (drop + create, the pre-existing behavior), never a guess.
- * Escalation is named, not implied: the SECOND cross-version variant found in the field is
+ * Escalation is named, not implied: the SECOND cross-VERSION variant found in the field is
  * the trigger to adopt libpg_query and move identity onto normalized ASTs (Ty, 2026-08-09) —
- * a growing rule table over raw text is where scanning stops being defensible.
+ * a growing rule table over raw text is where scanning stops being defensible. One correction
+ * to that trigger (2026-08-24): libpg_query closes cross-VERSION SYNTAX drift (whitespace,
+ * parens, keyword case), NOT cross-PRODUCER COERCION drift — a raw parse tree carries no type
+ * resolution, so `'lit'` and `'lit'::text` still differ structurally without a catalog, which
+ * the CI-pure `db:diff` lane does not have. That class earns a provable text rewrite here,
+ * verified end-to-end by `db:check`'s from-scratch build on a real database.
  *
  * Applied at the PRODUCERS (live introspection's `predicate()`, the compiler's policy
  * assembly), so every downstream comparison — the identity matcher, the canonical hash, the
@@ -121,6 +141,53 @@ function distributeOnce(s: string): string | null {
   return null;
 }
 
+/**
+ * A bare `text` cast token — `::text` or `::pg_catalog.text` — from just past a literal's
+ * closing quote. Whitespace around `::` is tolerated (pg emits none; an author might). The
+ * trailing `\b` rejects `::textfoo`; the caller additionally rejects a following `[` so the
+ * array-type cast `::text[]` is never stripped.
+ */
+const LITERAL_TEXT_CAST = /^\s*::\s*(?:pg_catalog\.)?text\b/;
+
+/**
+ * Strip a bare `text` cast applied directly to a single-quoted string literal, wherever one
+ * appears. One left-to-right pass is complete: removing a cast token cannot create a new
+ * `'literal'::text` pair to its left, and it never forms an `(ARRAY[…])::T[]` for the other
+ * rule. Quoted regions are skipped so a `::text` inside a literal is content, not structure.
+ */
+function stripLiteralTextCast(s: string): string {
+  let out = '';
+  let i = 0;
+  while (i < s.length) {
+    const c = s[i];
+    if (c === "'") {
+      const close = skipQuoted(s, i);
+      if (close < 0) return out + s.slice(i); // unterminated literal — leave the rest alone
+      out += s.slice(i, close + 1); // the literal itself, verbatim
+      i = close + 1;
+      // Drop a bare text cast on the literal, and any stacked `::text::text`, so the result
+      // is a true fixpoint. `::text[]` is the array-type cast (element type, load-bearing),
+      // not a scalar text cast — the look-ahead skips whitespace so `::text []` is kept too.
+      let m = LITERAL_TEXT_CAST.exec(s.slice(i));
+      while (m && !/^\s*\[/.test(s.slice(i + m[0].length))) {
+        i += m[0].length; // drop the cast token
+        m = LITERAL_TEXT_CAST.exec(s.slice(i));
+      }
+      continue;
+    }
+    if (c === '"') {
+      const close = skipQuoted(s, i);
+      if (close < 0) return out + s.slice(i);
+      out += s.slice(i, close + 1); // a quoted identifier — never a string literal, skip whole
+      i = close + 1;
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
+
 /**
  * Normalize one deparsed expression. Idempotent; unrecognized text returns unchanged.
  * Fixpoint-bounded: nesting deeper than the cap returns its progress, which is still
@@ -130,8 +197,8 @@ export function normalizeDeparsedExpr(text: string): string {
   let s = text;
   for (let n = 0; n < 64; n++) {
     const next = distributeOnce(s);
-    if (next === null) return s;
+    if (next === null) break;
     s = next;
   }
-  return s;
+  return stripLiteralTextCast(s);
 }