@everystack/cli 0.4.81 → 0.4.82

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.82] - 2026-09-08
+
+### Fixed
+
+- four compiler-hardening throws close the A22/F-A10/F-A12 tail
+- column-path check disclosure parity closes the F1 gap
+
 ## [0.4.81] - 2026-09-08
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.81",
+  "version": "0.4.82",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/authz-derive.ts

@@ -364,15 +364,24 @@ function renderColumnAbility(
   grantee: string,
   columns: readonly string[],
   policy: PolicyContract,
+  notes: string[],
 ): string | null {
   const using = policy.using ?? null;
   const owner = parseOwnerPredicate(using);
   const parts: string[] = [];
   const role = policyRoleForGrantee(grantee);
 
-  // Owner-only uses the model's authenticated default. Every other grantee must be named so
-  // the compiler emits the policy TO the live role, rather than a role-less public ability.
-  if (!owner || role !== 'authenticated') parts.push(`role: '${role}'`);
+  // A distinct WITH CHECK on a column UPDATE must ride as `check:`, and the compiler REFUSES a
+  // role-less column ability that carries any row predicate (F-A12: a column ability has nowhere
+  // row-level to put one). So a differing check forces the NAMED-role spelling — `role:
+  // 'authenticated'` — which routes to the compiler's named-role column path: that path ANDs the
+  // owner back into BOTH halves and honors the check, where the role-less shape would throw.
+  const distinctCheck = action === 'update' && policy.check != null && policy.check !== using;
+
+  // Owner-only uses the model's authenticated default. Every other grantee must be named so the
+  // compiler emits the policy TO the live role, not a role-less public ability — and a differing
+  // check names it too, to escape the F-A12 refusal above.
+  if (!owner || role !== 'authenticated' || distinctCheck) parts.push(`role: '${role}'`);
   if (owner) {
     parts.push(`owner: '${modelFieldKey(owner.column)}'`);
     if (owner.claim !== 'sub') parts.push(`userField: '${owner.claim}'`);
@@ -382,10 +391,26 @@ function renderColumnAbility(
     if (fragment) parts.push(`sql: ${fragment}`);
   }
 
-  if (action === 'update' && policy.check && policy.check !== using) {
-    const fragment = sqlFragment(policy.check);
+  if (distinctCheck) {
+    // Emit only the guard BEYOND the owner gate. The live WITH CHECK restates the owner term
+    // (the compiler's named-role column path ANDs it back in), so carrying the whole predicate
+    // would double the owner on recompile and churn the plan. Strip it exactly as the row-level
+    // write path does; a check with no owner conjunct rides whole (guard === the check).
+    const split = owner ? splitOwnerPredicate(policy.check) : null;
+    const guard = split ? split.guard : policy.check;
+    const fragment = sqlFragment(guard);
     if (!fragment) return null;
     parts.push(`check: ${fragment}`);
+    // Disclosure parity with the row-level write path. When USING is a PURE owner predicate but
+    // the live WITH CHECK does NOT restate the owner, the compiler ANDs the owner back into the
+    // rendered check — TIGHTENING it (the F-A11 "wider write half" the model cannot express). Say
+    // so, rather than let an unexplained conjunct surface in the next db:plan, which an operator
+    // might "fix" back toward the wider live shape by hand — the exact spelling the compiler refuses.
+    if (split && split.owner == null) {
+      notes.push(`policy "${policy.name}" (UPDATE) has a WITH CHECK that does not restate the owner gate in its USING —`);
+      notes.push(`  it is wider than a column owner ability can express, so the rendered model TIGHTENS it to the owner. Live WITH CHECK:`);
+      notes.push(`    ${policy.check}`);
+    }
   }
   parts.push(`columns: [${columns.map((column) => `'${modelFieldKey(column)}'`).join(', ')}]`);
   return `can('${action}', { ${parts.join(', ')} })`;
@@ -739,7 +764,7 @@ export function deriveAbilities(
       if (!cols.length) continue;
       const action = priv === 'SELECT' ? 'read' : priv === 'UPDATE' ? 'update' : null;
       const policy = action ? columnPolicyFor(contract, grantee, priv) : null;
-      const ability = action && policy ? renderColumnAbility(action, grantee, cols, policy) : null;
+      const ability = action && policy ? renderColumnAbility(action, grantee, cols, policy, notes) : null;
       if (ability) {
         abilities.push(ability);
         renderedColumnRoles.add(grantee);