@everystack/cli 0.4.96 → 0.4.97

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.97] - 2026-09-26
+
+### Fixed
+
+- revoke sessions when users are blocked
+- converge literal and owner policy predicates
+- precreate missing function overloads
+
+### Changed
+
+- reuse declared derived during apply
+
+## [0.4.96] - 2026-09-26
+
+### BREAKING CHANGES
+
+- defineModel refuses owner or via under a no-session audience
+
+### Fixed
+
+- a policy that calls a declared function builds in one run
+- refuse role: 'anon' combined with owner or via
+- db:pull never renders role: 'anon' with owner:
+
 ## [0.4.95] - 2026-09-26
 
 ### BREAKING CHANGES

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.96",
+  "version": "0.4.97",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/authz-compile.ts

@@ -77,6 +77,16 @@ function ownerPredicate(sqlColumn: string, type: string, claim: string, expr: st
   return `(${sqlColumn} = (${ce})::${castForType(type)})`;
 }
 
+// A hand-written predicate can spell the same inline JWT owner check as `owner:`.  Match only
+// that complete shape, then emit the one PostgreSQL form the structured shorthand uses.
+const HAND_WRITTEN_OWNER_RE =
+  /^\(?([a-z_][a-z0-9_]*)\s*=\s*\(\(current_setting\('request\.jwt\.claims'(?:::text)?,\s*true\)\)::jsonb\s*->>\s*'([a-z_]+)'(?:::text)?\)::([a-z]+)\)?$/i;
+
+function normalizeHandWrittenOwnerPredicate(text: string): string | null {
+  const match = HAND_WRITTEN_OWNER_RE.exec(text);
+  return match ? ownerPredicate(match[1], match[3], match[2]) : null;
+}
+
 /** The soft-delete guard, in deparser normal form: `(deleted_at IS NULL)`. */
 function softDeleteGuard(sqlColumn: string): string {
   return `(${sqlColumn} IS NULL)`;
@@ -315,7 +325,9 @@ function rawPredicate(value: unknown, where: string): string | null {
   // plan a DROP + CREATE that changed nothing. A bare call is the exception: the deparser
   // prints `has_permission()` with no outer parens, so wrapping it is that same churn.
   const t = text.trim();
-  return isBareCall(t) ? t : parenthesizeOnce(t);
+  const owner = normalizeHandWrittenOwnerPredicate(t);
+  if (owner) return owner;
+  return isBareCall(t) || t === 'true' || t === 'false' ? t : parenthesizeOnce(t);
 }
 
 /**

package/src/cli/commands/db-apply.ts

@@ -1056,6 +1056,11 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
 
   let landed: ApplyPlanResult | undefined;
   let catchUp: CatchUpReport = { ok: true, statements: [] };
+  // Both gates below need the declared derived bundle. Keep its existing lazy timing — the
+  // baseline gate is still the first reader — but never evaluate the models barrel twice.
+  let declaredDbPromise: ReturnType<typeof loadDeclaredDerived> | undefined;
+  const declaredDb = (): ReturnType<typeof loadDeclaredDerived> =>
+    declaredDbPromise ??= loadDeclaredDerived(flags.models);
   try {
     // The edge as hashes — internal bookkeeping, not what a reader came for. Verbose only.
   if (flags.verbose === 'true') info(`plan ${planHash(plan).slice(0, 12)}: ${plan.fromFingerprint.slice(0, 12)} → ${plan.toFingerprint.slice(0, 12)} (${plan.executable} statement(s)${plan.destructive ? `, ${plan.destructive} destructive` : ''})`);
@@ -1110,7 +1115,7 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
           verifyAuthzBaseline: async ({ contract }) => {
             const stageName = flags.stage || 'local';
             const models = await loadModels(resolveModelsPath(flags.models));
-            const governedRoles = (await loadDeclaredDerived(flags.models))?.governedRoles ?? [];
+            const governedRoles = (await declaredDb())?.governedRoles ?? [];
             const declaredAuthz = { tables: models.map((m) => compileTableContract(m, {})), functions: [] };
             const exemptions = ungovernedGrants(contract, governedRoleSet(declaredAuthz, governedRoles));
             const violations = checkAgainstBaseline(await readBaselineFile(), stageName, exemptions);
@@ -1125,8 +1130,8 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
           // missing ones; --state-only asked for no derived writes, so it is skipped there.
           ...(flags['state-only'] === 'true' ? {} : {
             beforeStateBatch: async (statements: readonly string[]) => {
-              const declaredDb = await loadDeclaredDerived(flags.models);
-              const created = await createStateReferencedFunctions(runner, session, statements, declaredDb?.objects ?? [], {
+              const declared = await declaredDb();
+              const created = await createStateReferencedFunctions(runner, session, statements, declared?.objects ?? [], {
                 actor: process.env.USER ?? null, gitRef: currentGitRef() ?? plan.gitRef,
               });
               if (created.length > 0) info(`created ${created.length} declared function(s) the plan's policies call, before the plan: ${created.join(', ')}`);

package/src/cli/state-function-deps.ts

@@ -25,6 +25,7 @@ import type { QueryRunner } from './authz-contract';
 import type { SessionRunner } from './session';
 import type { SourceObject } from './derived-source';
 import { executeReconcile } from './commands/db-reconcile';
+import { functionIdentity } from './pg-argtypes';
 
 const escapeRe = (s: string): string => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 
@@ -72,12 +73,17 @@ export async function createStateReferencedFunctions(
   if (referenced.length === 0) return [];
 
   const live = await runner(
-    `SELECT n.nspname AS schema, p.proname AS name FROM pg_proc p
+    `SELECT n.nspname AS schema, p.proname AS name,
+            (SELECT COALESCE(string_agg(pg_catalog.format_type(t.oid, NULL), ', ' ORDER BY t.ord), '')
+               FROM unnest(p.proargtypes::oid[]) WITH ORDINALITY AS t(oid, ord)) AS args
+       FROM pg_proc p
        JOIN pg_namespace n ON n.oid = p.pronamespace
       WHERE p.proname IN (${[...new Set(referenced.map((o) => o.name))].map(literal).join(', ')})`,
   );
-  const present = new Set(live.map((r: any) => `${r.schema}.${r.name}`));
-  const missing = referenced.filter((o) => !present.has(`${o.schema}.${o.name}`));
+  const present = new Set(live.map((r: any) => functionIdentity(
+    String(r.schema), String(r.name), String(r.args).trim() ? String(r.args).split(',').map((arg) => arg.trim()) : [],
+  )));
+  const missing = referenced.filter((o) => !present.has(o.identity));
   if (missing.length === 0) return [];
 
   const run = await executeReconcile(runner, session, {