@everystack/cli 0.4.95 → 0.4.97

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.97] - 2026-09-26
+
+### Fixed
+
+- revoke sessions when users are blocked
+- converge literal and owner policy predicates
+- precreate missing function overloads
+
+### Changed
+
+- reuse declared derived during apply
+
+## [0.4.96] - 2026-09-26
+
+### BREAKING CHANGES
+
+- defineModel refuses owner or via under a no-session audience
+
+### Fixed
+
+- a policy that calls a declared function builds in one run
+- refuse role: 'anon' combined with owner or via
+- db:pull never renders role: 'anon' with owner:
+
 ## [0.4.95] - 2026-09-26
 
 ### BREAKING CHANGES

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.95",
+  "version": "0.4.97",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -135,7 +135,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.19"
+    "@everystack/model": "0.4.20"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",

package/src/cli/apply-execute.ts

@@ -149,6 +149,15 @@ export interface ApplyPlanOptions {
    * (which runs before the write) — the getter reads it at write time.
    */
   descentNote?: () => string | undefined;
+  /**
+   * Called with the statements about to run, AFTER every gate above has passed and BEFORE the
+   * batch — so a refused apply writes nothing through it. db:apply's direct lane uses it to
+   * create the declared functions a policy in the plan calls (state-function-deps.ts), which on
+   * a fresh target do not exist until the derived catch-up. Functions are not in the base
+   * fingerprint, so this moves neither the lock nor the verify-after endpoint. Omitted, the
+   * apply is unchanged (the ops-Lambda lane does not pass it).
+   */
+  beforeStateBatch?: (statements: readonly string[]) => Promise<unknown>;
 }
 
 export interface ApplyPlanResult {
@@ -534,6 +543,8 @@ export async function executeApplyPlan(
   // keep naming the file the operator reviewed.
   const { statements: toRun, withheld } = withheldValidations(plan.statements, orphans);
 
+  if (options.beforeStateBatch) await options.beforeStateBatch(toRun);
+
   const result = await applyGeneratedStatements(runner, toRun, {
     ...(withheld.length > 0 ? { skippedValidations: withheld } : {}),
     actor: options.actor,

package/src/cli/authz-compile.ts

@@ -22,7 +22,7 @@
 
 import { isColumnAbility, type ModelDescriptor, type Ability } from '@everystack/model';
 import type { PolicyContract, TableContract, PolicyCommand } from './authz-contract';
-import { parenthesizeOnce } from './authz-contract';
+import { parenthesizeOnce, isBareCall } from './authz-contract';
 import { normalizeDeparsedExpr } from './deparse-normal';
 
 export interface CompileOptions {
@@ -77,6 +77,16 @@ function ownerPredicate(sqlColumn: string, type: string, claim: string, expr: st
   return `(${sqlColumn} = (${ce})::${castForType(type)})`;
 }
 
+// A hand-written predicate can spell the same inline JWT owner check as `owner:`.  Match only
+// that complete shape, then emit the one PostgreSQL form the structured shorthand uses.
+const HAND_WRITTEN_OWNER_RE =
+  /^\(?([a-z_][a-z0-9_]*)\s*=\s*\(\(current_setting\('request\.jwt\.claims'(?:::text)?,\s*true\)\)::jsonb\s*->>\s*'([a-z_]+)'(?:::text)?\)::([a-z]+)\)?$/i;
+
+function normalizeHandWrittenOwnerPredicate(text: string): string | null {
+  const match = HAND_WRITTEN_OWNER_RE.exec(text);
+  return match ? ownerPredicate(match[1], match[3], match[2]) : null;
+}
+
 /** The soft-delete guard, in deparser normal form: `(deleted_at IS NULL)`. */
 function softDeleteGuard(sqlColumn: string): string {
   return `(${sqlColumn} IS NULL)`;
@@ -312,8 +322,12 @@ function rawPredicate(value: unknown, where: string): string | null {
   // Parenthesized exactly once. A pulled predicate arrives already fully parenthesized
   // (that is how pg_get_expr deparses it), and wrapping it again made the compiled policy
   // differ from the live one by a single layer of parens — enough for the reconciler to
-  // plan a DROP + CREATE that changed nothing.
-  return parenthesizeOnce(text.trim());
+  // plan a DROP + CREATE that changed nothing. A bare call is the exception: the deparser
+  // prints `has_permission()` with no outer parens, so wrapping it is that same churn.
+  const t = text.trim();
+  const owner = normalizeHandWrittenOwnerPredicate(t);
+  if (owner) return owner;
+  return isBareCall(t) || t === 'true' || t === 'false' ? t : parenthesizeOnce(t);
 }
 
 /**

package/src/cli/authz-contract.ts

@@ -271,6 +271,40 @@ export function isWrappedExpression(s: string): boolean {
   return depth === 0;
 }
 
+const IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)`;
+const CALL_HEAD = new RegExp(String.raw`^(?:${IDENT}\s*\.\s*)?(${IDENT})\s*\(`);
+/** Keyword forms that look like `name(` but the deparser prints wrapped. */
+const WRAPPED_KEYWORDS = new Set(['exists', 'not']);
+
+/**
+ * True when `s` is ONE call — `name(…)` or `schema.name(…)` — spanning the whole text.
+ *
+ * `pg_get_expr` prints such a predicate with NO outer parens (measured, PG17: `g()`, `a.f()`,
+ * `COALESCE(g(), false)`), unlike an operator expression, which it wraps. A call is atomic, so
+ * leaving it bare can never re-associate when it is AND-ed into a larger predicate. The scan
+ * skips string literals and quoted identifiers, so `f(')') OR g()` is not mistaken for one call.
+ */
+export function isBareCall(s: string): boolean {
+  const head = CALL_HEAD.exec(s);
+  if (!head || WRAPPED_KEYWORDS.has(head[1].toLowerCase())) return false;
+  let depth = 0;
+  for (let i = head[0].length - 1; i < s.length; i++) {
+    const c = s[i];
+    if (c === "'" || c === '"') {
+      const close = s.indexOf(c, i + 1);
+      if (close < 0) return false;
+      i = close; // a doubled quote re-enters here and is skipped as an empty run
+      continue;
+    }
+    if (c === '(') depth++;
+    else if (c === ')') {
+      depth--;
+      if (depth === 0) return i === s.length - 1;
+    }
+  }
+  return false;
+}
+
 /**
  * A predicate parenthesized exactly once — the normal form both producers must agree on.
  *

package/src/cli/authz-derive.ts

@@ -25,7 +25,7 @@
  * comment: the comment costs a human five minutes, the ability costs them a privilege.
  */
 
-import { EXTRA_PRIVILEGES } from '@everystack/model';
+import { EXTRA_PRIVILEGES, sessionlessAudience } from '@everystack/model';
 import { holdsPrivilege, holdsTablePrivilege } from './authz-contract';
 import type { TableContract, PolicyContract } from './authz-contract';
 
@@ -367,9 +367,19 @@ function renderColumnAbility(
   notes: string[],
 ): string | null {
   const using = policy.using ?? null;
-  const owner = parseOwnerPredicate(using);
-  const parts: string[] = [];
   const role = policyRoleForGrantee(grantee);
+  // defineModel refuses a no-session audience with `owner:` (see sessionlessAudience). An anon
+  // owner-shaped predicate is therefore carried verbatim as `sql:` below, and disclosed.
+  const parsed = parseOwnerPredicate(using);
+  const sessionless = parsed ? sessionlessAudience({ role }) : null;
+  const owner = sessionless ? null : parsed;
+  if (sessionless) {
+    notes.push(`verbatim-sql: policy "${policy.name}" (${action === 'read' ? 'SELECT' : 'UPDATE'}) is an owner check TO ${role}.`);
+    notes.push(`  ${role} has no session, so it matches no row. ${sessionless} with owner: is not a`);
+    notes.push(`  model shape, so the predicate is transcribed VERBATIM above. Drop the policy or`);
+    notes.push(`  move the column grant to authenticated.`);
+  }
+  const parts: string[] = [];
 
   // A distinct WITH CHECK on a column UPDATE must ride as `check:`, and the compiler REFUSES a
   // role-less column ability that carries any row predicate (F-A12: a column ability has nowhere

package/src/cli/commands/db-apply.ts

@@ -62,6 +62,7 @@ import path from 'node:path';
 import { resolveModelsPath } from '../models-path';
 import { loadModels } from './db-generate';
 import { loadDeclaredDerived } from '../declared-derived';
+import { createStateReferencedFunctions } from '../state-function-deps';
 import { compileTableContract } from '../authz-compile';
 import { governedRoleSet, ungovernedGrants } from '../authz-reconcile';
 import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline';
@@ -1055,6 +1056,11 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
 
   let landed: ApplyPlanResult | undefined;
   let catchUp: CatchUpReport = { ok: true, statements: [] };
+  // Both gates below need the declared derived bundle. Keep its existing lazy timing — the
+  // baseline gate is still the first reader — but never evaluate the models barrel twice.
+  let declaredDbPromise: ReturnType<typeof loadDeclaredDerived> | undefined;
+  const declaredDb = (): ReturnType<typeof loadDeclaredDerived> =>
+    declaredDbPromise ??= loadDeclaredDerived(flags.models);
   try {
     // The edge as hashes — internal bookkeeping, not what a reader came for. Verbose only.
   if (flags.verbose === 'true') info(`plan ${planHash(plan).slice(0, 12)}: ${plan.fromFingerprint.slice(0, 12)} → ${plan.toFingerprint.slice(0, 12)} (${plan.executable} statement(s)${plan.destructive ? `, ${plan.destructive} destructive` : ''})`);
@@ -1109,7 +1115,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
           verifyAuthzBaseline: async ({ contract }) => {
             const stageName = flags.stage || 'local';
             const models = await loadModels(resolveModelsPath(flags.models));
-            const governedRoles = (await loadDeclaredDerived(flags.models))?.governedRoles ?? [];
+            const governedRoles = (await declaredDb())?.governedRoles ?? [];
             const declaredAuthz = { tables: models.map((m) => compileTableContract(m, {})), functions: [] };
             const exemptions = ungovernedGrants(contract, governedRoleSet(declaredAuthz, governedRoles));
             const violations = checkAgainstBaseline(await readBaselineFile(), stageName, exemptions);
@@ -1119,6 +1125,18 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
           },
           dirty: worktreeDirty(resolveModelsPath(flags.models)),
           descentNote: () => descentAttested,
+          // A declared function a policy in this plan calls must exist before the policy — on a
+          // fresh target it would otherwise arrive only with the catch-up below. Only the called,
+          // missing ones; --state-only asked for no derived writes, so it is skipped there.
+          ...(flags['state-only'] === 'true' ? {} : {
+            beforeStateBatch: async (statements: readonly string[]) => {
+              const declared = await declaredDb();
+              const created = await createStateReferencedFunctions(runner, session, statements, declared?.objects ?? [], {
+                actor: process.env.USER ?? null, gitRef: currentGitRef() ?? plan.gitRef,
+              });
+              if (created.length > 0) info(`created ${created.length} declared function(s) the plan's policies call, before the plan: ${created.join(', ')}`);
+            },
+          }),
           checkDescent: async (live: LiveState & { fingerprint: string; ledger: DescentLedgerRow[]; ledgerRead: LedgerRead }) => {
             step('Descent: proving the fast-forward rule against the schema_log ledger...');
             const result = await proveDescentForApply({

package/src/cli/commands/db-sync.ts

@@ -52,6 +52,7 @@ import { borrowedSessionRunner, type SessionRunner } from '../session';
 import { planBackfills, readBackfillLog } from '../backfill';
 import { resolveModelsPath } from '../models-path';
 import { executeReconcile, buildReconcileReport, type ReconcileRun } from './db-reconcile';
+import { createStateReferencedFunctions } from '../state-function-deps';
 import { loadModels } from './db-generate';
 import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived';
 import { reportPipelineLastRun } from './pipeline-run';
@@ -112,7 +113,8 @@ export interface SyncRun {
 
 /**
  * One sync: state first (derived objects may depend on new columns), then
- * compute, then the verdict. Pure orchestration over an injected QueryRunner;
+ * compute, then the verdict. The exception is the declared functions the
+ * state batch itself calls, which go just before it (state-function-deps.ts). Pure orchestration over an injected QueryRunner;
  * the CLI shell below owns flags, files, and exits.
  */
 async function syncOnce(
@@ -131,6 +133,14 @@ async function syncOnce(
   });
   hooks.onStatePlan?.(statements, classifyGeneratedStatements(statements), pass);
 
+  // The one derived → state edge: a declared function a pending policy (or default, or check)
+  // calls must exist before that statement is created. Only those functions, only when absent.
+  if (options.declared?.length) {
+    await createStateReferencedFunctions(runner, session, statements, options.declared, {
+      actor: options.actor, gitRef: options.gitRef, now: options.now,
+    });
+  }
+
   const state = await applyStateAndVerify(runner, session, models, statements, current, liveAuthz, {
     allowDrops: options.allowDrops, sequences: options.sequences, extensions: options.extensions,
     actor: options.actor, gitRef: options.gitRef, now: options.now,

package/src/cli/state-function-deps.ts

@@ -0,0 +1,101 @@
+/**
+ * state-function-deps — the declared functions a pending STATE batch calls, created first.
+ *
+ * Sync and apply run STATE (tables, RLS, policies, grants) before the DERIVED layer
+ * (functions, views, matviews, triggers). That order is right for views and triggers, which
+ * read tables state creates. It is wrong for one edge: an RLS policy's predicate is resolved
+ * when the policy is CREATED, so `can('read', { where: sql\`has_permission()\` })` over a
+ * declared `has_permission()` fails on a fresh database with `function has_permission() does
+ * not exist` — the function only arrives in the second half.
+ *
+ * So the edge is followed, not the layers swapped: a declared function whose name appears in
+ * a pending state statement, and which the target does not have yet, is created BEFORE the
+ * state batch. Everything else keeps the ordinary order.
+ *
+ * The reference test is TEXT, on purpose. Predicates are already compiled and diffed as text,
+ * and a false positive is harmless: creating a missing function early is exactly what the
+ * ordinary pass would do a moment later.
+ *
+ * A function whose SIGNATURE names a declared relation (`RETURNS SETOF some_view`) cannot go
+ * first — PostgreSQL resolves argument and return types at creation, and the relation may be
+ * created by state or by a view later in the derived pass. It stays behind, as in db:build.
+ */
+
+import type { QueryRunner } from './authz-contract';
+import type { SessionRunner } from './session';
+import type { SourceObject } from './derived-source';
+import { executeReconcile } from './commands/db-reconcile';
+import { functionIdentity } from './pg-argtypes';
+
+const escapeRe = (s: string): string => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/** A call to `schema.name(` or `name(`, quoted or not, not preceded by another qualifier. */
+function callPattern(schema: string, name: string): RegExp {
+  const q = (id: string) => `"?${escapeRe(id)}"?`;
+  return new RegExp(`(?:^|[^\\w$."])(?:${q(schema)}\\s*\\.\\s*)?${q(name)}\\s*\\(`, 'i');
+}
+
+/**
+ * The declared functions a state batch names by call — the pure half, no database.
+ * Only functions that CAN go first: no signature dependency on a declared relation.
+ */
+export function stateReferencedFunctions(statements: readonly string[], declared: readonly SourceObject[]): SourceObject[] {
+  if (statements.length === 0) return [];
+  const text = statements.join('\n');
+  return declared.filter((o) =>
+    o.kind === 'function'
+    && !o.signatureDeps?.length
+    && callPattern(o.schema, o.name).test(text));
+}
+
+const literal = (s: string): string => `'${s.replace(/'/g, "''")}'`;
+
+/**
+ * Create, before the state batch, the declared functions it calls that the target lacks.
+ * Returns the identities created (empty when nothing needed to move).
+ *
+ * The reconcile runs with the FULL declared set and `only` scoped to these identities, never a
+ * subset: a subset would read every other managed object as "removed from source" and drop it.
+ * A function that already exists is left to the ordinary after-state pass, so an existing
+ * database's replace/drift handling is unchanged by this.
+ *
+ * A SQL-language body that reads a table this same state batch creates is a forward reference,
+ * not an error: the reconcile runs its batch under `SET LOCAL check_function_bodies = off`.
+ */
+export async function createStateReferencedFunctions(
+  runner: QueryRunner,
+  session: SessionRunner,
+  statements: readonly string[],
+  declared: readonly SourceObject[],
+  options: { actor?: string | null; gitRef?: string | null; now?: () => number } = {},
+): Promise<string[]> {
+  const referenced = stateReferencedFunctions(statements, declared);
+  if (referenced.length === 0) return [];
+
+  const live = await runner(
+    `SELECT n.nspname AS schema, p.proname AS name,
+            (SELECT COALESCE(string_agg(pg_catalog.format_type(t.oid, NULL), ', ' ORDER BY t.ord), '')
+               FROM unnest(p.proargtypes::oid[]) WITH ORDINALITY AS t(oid, ord)) AS args
+       FROM pg_proc p
+       JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE p.proname IN (${[...new Set(referenced.map((o) => o.name))].map(literal).join(', ')})`,
+  );
+  const present = new Set(live.map((r: any) => functionIdentity(
+    String(r.schema), String(r.name), String(r.args).trim() ? String(r.args).split(',').map((arg) => arg.trim()) : [],
+  )));
+  const missing = referenced.filter((o) => !present.has(o.identity));
+  if (missing.length === 0) return [];
+
+  const run = await executeReconcile(runner, session, {
+    declared: [...declared],
+    only: missing.map((o) => o.identity),
+    apply: true,
+    actor: options.actor ?? null,
+    gitRef: options.gitRef ?? null,
+    now: options.now,
+  });
+  if (run.refusal) {
+    throw new Error(`could not create the functions the state batch calls (${missing.map((o) => o.identity).join(', ')}) before it: ${run.refusal}`);
+  }
+  return missing.map((o) => o.identity);
+}