@everystack/cli 0.3.22 → 0.3.23

package/README.md

@@ -220,8 +220,9 @@ everystack db:reconcile                 # deploy the derived layer (functions/vi
 everystack db:fingerprint               # content-address the live base schema vs the Models — MATCH/MISMATCH
 everystack db:sync                      # make the database match your checkout — state + compute, one verb (dev DBs)
 everystack db:diff                      # the state edge between two declared states — no DB, CI-pure; reverse = computed rollback
-everystack db:plan | db:apply           # mint a reviewable plan against a target, apply it fingerprint-verified at both ends + the fast-forward rule (checkout must descend from the commit declaring the target's state)
+everystack db:plan | db:apply           # mint a reviewable plan against a target, apply it fingerprint-verified at both ends + the fast-forward rule (checkout must descend from the commit declaring the target's state); destructive plans: --confirm + snapshot + approver set when declared
 everystack db:check                     # the CI gate per PR: merged declared state composes + artifacts match regeneration (+ ephemeral from-scratch build w/ a scratch PG)
+everystack db:approvers                 # declare who can DESTROY: the stage's destructive-approver set (SSM, STS-verified at apply)
 
 # Security
 everystack db:doctor                    # is the DB least-privilege + RLS-subject?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.3.22",
+  "version": "0.3.23",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -78,7 +78,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.3.5"
+    "@everystack/model": "0.3.6"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.1.0",
@@ -93,7 +93,8 @@
     "expo-updates": "55.0.21",
     "postgres": "3.4.9",
     "react": "19.2.0",
-    "react-native": "0.83.6"
+    "react-native": "0.83.6",
+    "@aws-sdk/client-sts": "3.1053.0"
   },
   "peerDependenciesMeta": {
     "postgres": {
@@ -131,6 +132,9 @@
     },
     "@aws-sdk/s3-request-presigner": {
       "optional": true
+    },
+    "@aws-sdk/client-sts": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -148,7 +152,8 @@
     "drizzle-orm": "0.41.0",
     "jest": "29.7.0",
     "react": "19.2.0",
-    "ts-jest": "29.4.9"
+    "ts-jest": "29.4.9",
+    "@aws-sdk/client-sts": "3.1053.0"
   },
   "scripts": {
     "test": "jest",

package/src/cli/apply-authority.ts

@@ -0,0 +1,150 @@
+/**
+ * apply-authority — destructive applies are role-gated to a declared
+ * approver set, enforced against the caller's REAL identity (brick 9 of the
+ * migration-authority design, decisions 11 + 12).
+ *
+ * "CTO drops tables; everyone else creates functions and views." The
+ * approver set lives STAGE-SIDE — an SSM parameter in the stage's namespace,
+ * admin-writable only — never in the repo, where a checkout edit would
+ * defeat it (a repo-declared list is a convention wearing a gate's clothes).
+ * The chokepoint resolves the caller's real identity via STS — the same
+ * pattern as the `db:psql` break-glass, where the IAM read IS the gate.
+ *
+ * The gate engages on DECLARATION: a stage that never declared approvers
+ * keeps the ceremony (explicit confirmation + snapshot, always) but is not
+ * identity-gated — the migration-friendly posture, stated honestly. A
+ * declared-but-EMPTY set means "no one": destructive applies are disabled
+ * on that stage until the set says otherwise.
+ *
+ * The refusal is the two-person flow's handoff: it names who CAN approve,
+ * and `plan_ref` already pins the exact reviewed artifact — a dev mints the
+ * destructive plan, an approver applies that same file.
+ *
+ * The decision core is pure; the AWS edge (SSM + STS) is thin and injected
+ * by the command shell.
+ */
+
+/** The SSM parameter holding the approver set — a JSON array of entries. */
+export function approverParamName(appName: string, stage: string): string {
+  return `/everystack/${appName}/${stage}/db-approvers`;
+}
+
+/**
+ * Does an approver entry match a caller ARN? Exact ARN match, or a match on
+ * any path segment after the first slash — so the set can hold plain names:
+ * `ty` matches `arn:aws:iam::123:user/ty` and the session name in
+ * `arn:aws:sts::123:assumed-role/Admin/ty`. Segment (not suffix) matching:
+ * `ty` never matches `user/notty`.
+ */
+export function approverMatches(entry: string, identityArn: string): boolean {
+  if (entry === identityArn) return true;
+  const segments = identityArn.split('/').slice(1);
+  return segments.includes(entry);
+}
+
+export interface AuthorityInputs {
+  /** The declared approver set; null = the stage never declared one. */
+  approvers: string[] | null;
+  /** The caller's resolved identity (STS ARN); null = unresolvable. */
+  identity: string | null;
+}
+
+export type AuthorityVerdict =
+  | { ok: true; reason: 'approved' | 'undeclared' }
+  | { ok: false; reason: string };
+
+/** The pure decision core for a DESTRUCTIVE apply. Non-destructive plans never reach it. */
+export function checkDestructiveAuthority({ approvers, identity }: AuthorityInputs): AuthorityVerdict {
+  if (approvers === null) return { ok: true, reason: 'undeclared' };
+  if (approvers.length === 0) {
+    return {
+      ok: false,
+      reason:
+        'the declared approver set is EMPTY — destructive applies are disabled on this stage. ' +
+        'Declare approvers with `everystack db:approvers --set <arn-or-name,...>` (admin-writable parameter).',
+    };
+  }
+  if (identity === null) {
+    return {
+      ok: false,
+      reason:
+        'this stage declares a destructive-approver set, so the apply must be identity-verified — ' +
+        'and your AWS identity could not be resolved (credentials?). Fix the credentials or hand the plan to an approver.',
+    };
+  }
+  if (approvers.some((entry) => approverMatches(entry, identity))) {
+    return { ok: true, reason: 'approved' };
+  }
+  return {
+    ok: false,
+    reason:
+      `you are ${identity}, and the declared approvers are: ${approvers.join(', ')}. ` +
+      'Hand the plan file to an approver — they review and apply the exact same artifact (its plan_ref pins it).',
+  };
+}
+
+// ---------------------------------------------------------------------------
+// The thin AWS edge (lazy imports, injected by the command shell).
+// ---------------------------------------------------------------------------
+
+/** Read the approver set from SSM. Null when the parameter does not exist. */
+export async function readApproverParam(region: string, appName: string, stage: string): Promise<string[] | null> {
+  const { SSMClient, GetParameterCommand } = await import('@aws-sdk/client-ssm');
+  const client = new SSMClient({ region });
+  try {
+    const result = await client.send(new GetParameterCommand({ Name: approverParamName(appName, stage) }));
+    return parseApproverValue(result.Parameter?.Value ?? '');
+  } catch (err: any) {
+    if (err?.name === 'ParameterNotFound') return null;
+    throw err;
+  }
+}
+
+/** The stored form is a JSON array; a bare comma-separated string is accepted on read. */
+export function parseApproverValue(value: string): string[] {
+  const trimmed = value.trim();
+  if (trimmed === '') return [];
+  if (trimmed.startsWith('[')) {
+    const parsed = JSON.parse(trimmed);
+    if (!Array.isArray(parsed) || parsed.some((e) => typeof e !== 'string')) {
+      throw new Error('db-approvers parameter must be a JSON array of strings');
+    }
+    return parsed.map((e: string) => e.trim()).filter(Boolean);
+  }
+  return trimmed.split(',').map((e) => e.trim()).filter(Boolean);
+}
+
+/** Declare (or replace) the approver set. Stored as a JSON array. */
+export async function writeApproverParam(region: string, appName: string, stage: string, approvers: string[]): Promise<void> {
+  const { SSMClient, PutParameterCommand } = await import('@aws-sdk/client-ssm');
+  const client = new SSMClient({ region });
+  await client.send(new PutParameterCommand({
+    Name: approverParamName(appName, stage),
+    Value: JSON.stringify(approvers),
+    Type: 'String',
+    Overwrite: true,
+  }));
+}
+
+/** Remove the declaration entirely — the stage returns to the undeclared (ceremony-only) posture. */
+export async function removeApproverParam(region: string, appName: string, stage: string): Promise<void> {
+  const { SSMClient, DeleteParameterCommand } = await import('@aws-sdk/client-ssm');
+  const client = new SSMClient({ region });
+  try {
+    await client.send(new DeleteParameterCommand({ Name: approverParamName(appName, stage) }));
+  } catch (err: any) {
+    if (err?.name !== 'ParameterNotFound') throw err;
+  }
+}
+
+/** The caller's real identity — the STS ARN. Null when credentials can't answer. */
+export async function resolveCallerIdentity(region: string): Promise<string | null> {
+  const { STSClient, GetCallerIdentityCommand } = await import('@aws-sdk/client-sts');
+  const client = new STSClient({ region });
+  try {
+    const result = await client.send(new GetCallerIdentityCommand({}));
+    return result.Arn ?? null;
+  } catch {
+    return null;
+  }
+}

package/src/cli/commands/db-apply.ts

@@ -27,11 +27,14 @@ import { introspectSchema, type SchemaSnapshot } from '../schema-introspect.js';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
 import { fingerprintLive } from '../schema-fingerprint.js';
 import { applyGeneratedStatements, currentGitRef } from '../state-apply.js';
-import { renderSchemaLogFingerprintUpdate } from '../derived-apply.js';
+import { ENSURE_RECONCILER_SQL, renderSchemaLogInsert, renderSchemaLogFingerprintUpdate } from '../derived-apply.js';
 import { checkPlanPrecondition, planHash, PLAN_VERSION, type EdgePlan } from '../edge-plan.js';
 import { verifyDescent, type LiveState } from '../git-descent.js';
+import { checkDestructiveAuthority, readApproverParam, resolveCallerIdentity } from '../apply-authority.js';
 import { resolveModelsPath } from '../models-path.js';
 import { resolveDbSource, createUrlRunner, type DbSource } from '../db-source.js';
+import { resolveConfig, opsFunction } from '../config.js';
+import { invokeAction } from '../aws.js';
 import { step, success, fail, info, warn } from '../output.js';
 
 // ---------------------------------------------------------------------------
@@ -54,17 +57,63 @@ export interface ApplyPlanOptions {
     contract: AuthzContract;
     fingerprint: string;
   }) => Promise<{ ok: true } | { ok: false; reason: string }>;
+  /**
+   * Destructive authority (brick 9, decisions 11+12): called only when the
+   * plan is destructive, after the lock and descent checks pass. Return
+   * `ok: false` to refuse — the caller is not in the stage's declared
+   * approver set. Omitted = no authority gate (non-staged targets keep the
+   * ceremony the command shell enforces).
+   */
+  verifyAuthority?: () => Promise<{ ok: true } | { ok: false; reason: string }>;
+  /**
+   * Runs after every verification passes and BEFORE the edge executes, only
+   * for destructive plans — the auto-snapshot seam ("losing data should be
+   * hard": confirmed, approved, snapshotted, in that order). A throw here
+   * aborts the apply with nothing executed.
+   */
+  beforeDestructive?: () => Promise<void>;
   /** Injectable clock for tests. */
   now?: () => number;
 }
 
 export interface ApplyPlanResult {
-  status: 'applied' | 'already-applied' | 'refused' | 'descent-refused' | 'verify-failed';
+  status: 'applied' | 'already-applied' | 'refused' | 'descent-refused' | 'authority-refused' | 'verify-failed';
   liveFingerprint: string;
   reason?: string;
   logId?: number;
 }
 
+/**
+ * Decision 7, made whole: every database records every refusal, not just
+ * every apply. Best-effort by construction — a memoir INSERT that cannot be
+ * written must never mask the refusal itself (a target that rejects the
+ * bookkeeping write would have failed the apply's ENSURE identically).
+ */
+async function recordRefusal(
+  runner: QueryRunner,
+  plan: EdgePlan,
+  liveFingerprint: string,
+  gate: string,
+  reason: string,
+  options: ApplyPlanOptions,
+): Promise<void> {
+  try {
+    await runner(ENSURE_RECONCILER_SQL.join(';\n'));
+    await runner(renderSchemaLogInsert({
+      kind: 'state refusal',
+      outcome: 'refused',
+      actor: options.actor ?? null,
+      gitRef: options.gitRef ?? plan.gitRef,
+      planRef: planHash(plan),
+      fromFingerprint: liveFingerprint,
+      toFingerprint: plan.toFingerprint,
+      sql: `-- REFUSED (${gate}): ${reason}\n${plan.statements.join('\n;\n')}`,
+    }));
+  } catch {
+    // Swallowed deliberately — see the docblock.
+  }
+}
+
 /** Verify → apply → verify. Pure orchestration over an injected QueryRunner. */
 export async function executeApplyPlan(
   runner: QueryRunner,
@@ -80,16 +129,30 @@ export async function executeApplyPlan(
   }
   const pre = checkPlanPrecondition(plan, live);
   if (!pre.ok) {
+    await recordRefusal(runner, plan, live, 'concurrency lock', pre.reason, options);
     return { status: 'refused', liveFingerprint: live, reason: pre.reason };
   }
 
   if (options.verifyDescent) {
     const descent = await options.verifyDescent({ snapshot: before, contract: beforeAuthz, fingerprint: live });
     if (!descent.ok) {
+      await recordRefusal(runner, plan, live, 'fast-forward rule', descent.reason, options);
       return { status: 'descent-refused', liveFingerprint: live, reason: descent.reason };
     }
   }
 
+  if (plan.destructive > 0 && options.verifyAuthority) {
+    const authority = await options.verifyAuthority();
+    if (!authority.ok) {
+      await recordRefusal(runner, plan, live, 'destructive authority', authority.reason, options);
+      return { status: 'authority-refused', liveFingerprint: live, reason: authority.reason };
+    }
+  }
+
+  if (plan.destructive > 0 && options.beforeDestructive) {
+    await options.beforeDestructive();
+  }
+
   const result = await applyGeneratedStatements(runner, plan.statements, {
     actor: options.actor,
     gitRef: options.gitRef ?? plan.gitRef,
@@ -170,6 +233,52 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
     }
   }
 
+  // Losing data should be hard (decision 11): a destructive plan applies
+  // only confirmed (--confirm, always), snapshotted (automatic with --stage,
+  // named over a bare connection), and — when the stage declares an approver
+  // set — identity-approved (decision 12).
+  const isDestructive = plan.destructive > 0;
+  let verifyAuthority: (() => Promise<{ ok: true } | { ok: false; reason: string }>) | undefined;
+  let beforeDestructive: (() => Promise<void>) | undefined;
+  if (isDestructive) {
+    const shape = `${plan.classification.drops} drop(s), ${plan.classification.narrowings} narrowing type change(s)`;
+    if (flags.confirm !== 'true') {
+      fail(`This plan is DESTRUCTIVE — ${plan.destructive} statement(s) lose data (${shape}). Explicit confirmation is required, always: re-run with --confirm.`);
+      process.exit(1);
+    }
+    if (flags.stage) {
+      const config = await resolveConfig(flags.stage);
+      const { parseAppName } = await import('../discover.js');
+      const appName = await parseAppName();
+      verifyAuthority = async () => {
+        step(`Destructive authority: checking the approver set for stage ${flags.stage}...`);
+        const approvers = await readApproverParam(config.region, appName, flags.stage);
+        const identity = approvers === null ? null : await resolveCallerIdentity(config.region);
+        const verdict = checkDestructiveAuthority({ approvers, identity });
+        if (!verdict.ok) return verdict;
+        if (verdict.reason === 'approved') {
+          info(`authority: ${identity} is a declared approver.`);
+        } else {
+          warn('authority: no approver set declared for this stage — proceeding on ceremony alone. Declare one: everystack db:approvers --set <arn-or-name,...> --stage ' + flags.stage);
+        }
+        return { ok: true };
+      };
+      beforeDestructive = async () => {
+        step('Destructive apply — taking a snapshot first (db:backup)...');
+        const result: any = await invokeAction(config.region, opsFunction(config), 'db:backup', { stage: flags.stage });
+        if (result?.error) {
+          throw new Error(`auto-snapshot failed, so the destructive plan was NOT applied: ${result.error}`);
+        }
+        info(`snapshot on record: ${result?.id ?? 'backup complete'} — restore with db:restore --from ${result?.id ?? '<id>'} --confirm.`);
+      };
+    } else if (!flags['snapshot-ref']) {
+      fail(`This plan is DESTRUCTIVE (${shape}) and the target is a bare connection — the apply cannot take the snapshot itself. Take one (db:snapshot / db:backup / pg_dump) and name it: --snapshot-ref <ref>. Or pass --stage and the apply snapshots automatically, with the stage's approver set enforced.`);
+      process.exit(1);
+    } else {
+      warn(`DESTRUCTIVE apply over a bare connection — approver gating unavailable (no --stage), proceeding on ceremony: --confirm + snapshot ${flags['snapshot-ref']}.`);
+    }
+  }
+
   step(dbSource.from === 'flag' ? 'Connecting via --database-url...' : 'Connecting via DATABASE_URL...');
   const { runner, end } = await createUrlRunner(dbSource.url);
 
@@ -182,6 +291,8 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
     const result = await executeApplyPlan(runner, plan, {
       actor: process.env.USER ?? null,
       gitRef: currentGitRef() ?? plan.gitRef,
+      ...(verifyAuthority ? { verifyAuthority } : {}),
+      ...(beforeDestructive ? { beforeDestructive } : {}),
       ...(forceDescent === undefined ? {
         verifyDescent: async (live: LiveState & { fingerprint: string }) => {
           step('Descent: searching git for the commit that declares the target\'s state...');
@@ -216,6 +327,10 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
         fail(`REFUSED (fast-forward rule): ${result.reason}`);
         process.exit(1);
         break;
+      case 'authority-refused':
+        fail(`REFUSED (destructive authority): ${result.reason}`);
+        process.exit(1);
+        break;
       case 'verify-failed':
         fail(`Verify FAILED: ${result.reason}`);
         process.exit(1);

package/src/cli/commands/db-approvers.ts

@@ -0,0 +1,71 @@
+/**
+ * `everystack db:approvers` — declare who can destroy (brick 9, decision 12).
+ *
+ *   db:approvers --stage <name>                      # show the declared set
+ *   db:approvers --stage <name> --set "cto,arn:..."  # declare / replace
+ *   db:approvers --stage <name> --set ''             # declare EMPTY: destructive applies disabled
+ *   db:approvers --stage <name> --remove             # undeclare: back to ceremony-only
+ *
+ * The set lives stage-side (an SSM parameter in the stage's namespace) so a
+ * checkout edit can't reach it; lock it down further with IAM by denying
+ * `ssm:PutParameter` on `/everystack/<app>/<stage>/db-approvers` to
+ * non-admins — the same posture as the rest of the stage's parameters.
+ * Entries are exact ARNs or bare names matched against the caller's ARN
+ * path segments (`ty` matches `user/ty` and an assumed-role session `ty`).
+ */
+
+import { resolveConfig } from '../config.js';
+import {
+  approverParamName,
+  parseApproverValue,
+  readApproverParam,
+  writeApproverParam,
+  removeApproverParam,
+} from '../apply-authority.js';
+import { step, success, fail, info, warn } from '../output.js';
+
+export async function dbApproversCommand(flags: Record<string, string>): Promise<void> {
+  if (!flags.stage) {
+    fail('db:approvers needs --stage <name> — the approver set is per-stage configuration.');
+    process.exit(1);
+  }
+
+  step('Resolving deployed config...');
+  const config = await resolveConfig(flags.stage);
+  const { parseAppName } = await import('../discover.js');
+  const appName = await parseAppName();
+  const paramName = approverParamName(appName, flags.stage);
+
+  if (flags.remove === 'true') {
+    await removeApproverParam(config.region, appName, flags.stage);
+    success(`Removed ${paramName} — the stage is back to the undeclared posture (destructive applies gated by ceremony only).`);
+    return;
+  }
+
+  if (flags.set !== undefined) {
+    if (flags.set === 'true') {
+      fail("--set needs a value: a comma-separated list of ARNs or names (--set '' declares an EMPTY set, disabling destructive applies).");
+      process.exit(1);
+    }
+    const approvers = parseApproverValue(flags.set);
+    await writeApproverParam(config.region, appName, flags.stage, approvers);
+    if (approvers.length === 0) {
+      warn(`Declared an EMPTY approver set at ${paramName} — destructive applies are now DISABLED on ${flags.stage}.`);
+    } else {
+      success(`Declared ${approvers.length} approver(s) at ${paramName}: ${approvers.join(', ')}`);
+      info('Destructive db:apply runs against this stage now require one of these identities (STS-verified).');
+    }
+    return;
+  }
+
+  const approvers = await readApproverParam(config.region, appName, flags.stage);
+  if (approvers === null) {
+    info(`No approver set declared (${paramName} absent) — destructive applies are gated by ceremony only (--confirm + snapshot).`);
+    info("Declare one: everystack db:approvers --set 'cto,arn:aws:iam::…:user/…' --stage " + flags.stage);
+  } else if (approvers.length === 0) {
+    warn(`The approver set is declared EMPTY — destructive applies are DISABLED on ${flags.stage}.`);
+  } else {
+    info(`Destructive-approver set for ${flags.stage} (${approvers.length}):`);
+    for (const a of approvers) info(`  - ${a}`);
+  }
+}

package/src/cli/commands/db-sync.ts

@@ -37,6 +37,7 @@ import { generateMigrationSql, unmodeledTables } from '../migration-generate.js'
 import {
   applyStateAndVerify,
   classifyGeneratedStatements,
+  classifyDestructive,
   currentGitRef,
   type ClassifiedStatements,
   type StateSyncOutcome,
@@ -277,6 +278,10 @@ export async function dbSyncCommand(flags: Record<string, string>): Promise<void
         onStatePlan: (statements, classified) => {
           if (classified.executable.length > 0) {
             info(`state plan — ${classified.executable.length} statement(s):`);
+            const { drops, narrowings } = classifyDestructive(classified.executable);
+            if (drops.length + narrowings.length > 0) {
+              warn(`${drops.length + narrowings.length} DESTRUCTIVE — ${drops.length} drop(s), ${narrowings.length} narrowing type change(s). Dev sync runs them; protected stages gate them (db:plan → db:apply).`);
+            }
             console.log('');
             for (const s of statements) console.log(s.endsWith(';') ? s : `${s};`);
             console.log('');

package/src/cli/edge-plan.ts

@@ -29,12 +29,22 @@ import type { ModelDescriptor } from '@everystack/model';
 import type { SchemaSnapshot } from './schema-introspect.js';
 import type { AuthzContract } from './authz-contract.js';
 import { generateMigrationSql, unmodeledTables } from './migration-generate.js';
-import { classifyGeneratedStatements } from './state-apply.js';
+import { classifyGeneratedStatements, classifyDestructive } from './state-apply.js';
 import { fingerprintLive, fingerprintState, fingerprintModels, stableStringify } from './schema-fingerprint.js';
 import { compileDeclaredState } from './declared-diff.js';
 import { compileTableRenames } from './schema-compile.js';
 
-export const PLAN_VERSION = 1;
+export const PLAN_VERSION = 2;
+
+/** Classification counts (brick 9, decision 11): destructive = drops + narrowings. */
+export interface PlanClassification {
+  /** Executable statements that lose no data. */
+  additive: number;
+  /** `DROP TABLE/COLUMN/TYPE` — the data is gone. */
+  drops: number;
+  /** Lossy/risky `ALTER COLUMN … TYPE` — data loss wearing an ALTER. */
+  narrowings: number;
+}
 
 export interface EdgePlan {
   v: number;
@@ -47,8 +57,9 @@ export interface EdgePlan {
   /** The edge, in db:generate's statement grammar (no held drops — mint refuses them). */
   statements: string[];
   executable: number;
-  /** Executable statements that DROP something — shown red, explicit by construction. */
+  /** Executable statements that LOSE DATA (drops + narrowing type changes) — red, gated at apply. */
   destructive: number;
+  classification: PlanClassification;
   notices: number;
   /** Live tables no model declares — untouched by the edge, riding into `to` as-is. */
   unmodeled: string[];
@@ -135,6 +146,13 @@ export function mintEdgePlan(
     );
   }
 
+  // Data-destructive only: dropping a policy/grant is recoverable metadata
+  // (the authz phase is data-safe by construction); dropping a table,
+  // column, or type is not — and neither is a narrowing type change, which
+  // is data loss wearing an ALTER.
+  const breakdown = classifyDestructive(classified.executable);
+  const destructive = breakdown.drops.length + breakdown.narrowings.length;
+
   return {
     v: PLAN_VERSION,
     fromFingerprint: fingerprintLive(snapshot, contract).hash,
@@ -142,10 +160,12 @@ export function mintEdgePlan(
     declaredFingerprint: fingerprintModels(models, { schema: opts.schema }).hash,
     statements,
     executable: classified.executable.length,
-    // Data-destructive only: dropping a policy/grant is recoverable metadata
-    // (the authz phase is data-safe by construction); dropping a table,
-    // column, or type is not.
-    destructive: classified.executable.filter((s) => /\bDROP\s+(TABLE|COLUMN|TYPE)\b/.test(s)).length,
+    destructive,
+    classification: {
+      additive: classified.executable.length - destructive,
+      drops: breakdown.drops.length,
+      narrowings: breakdown.narrowings.length,
+    },
     notices: classified.notices.length,
     unmodeled: unmodeledTables(models, snapshot),
     gitRef: opts.gitRef ?? null,
@@ -183,7 +203,14 @@ export function buildPlanSummary(plan: EdgePlan): string[] {
   }
   lines.push(`${plan.executable} executable statement(s), ${plan.notices} notice(s)`);
   if (plan.destructive > 0) {
-    lines.push(`! ${plan.destructive} DESTRUCTIVE statement(s) — drops carried explicitly, review them`);
+    const { drops, narrowings } = classifyDestructive(classifyGeneratedStatements(plan.statements).executable);
+    lines.push(
+      `! ${plan.destructive} DESTRUCTIVE statement(s) — ${drops.length} drop(s), ${narrowings.length} narrowing type change(s). Data loss carried explicitly; the apply is gated (--confirm + snapshot, approver set when declared):`,
+    );
+    for (const statement of [...drops, ...narrowings]) {
+      const ddl = statement.split('\n').find((l) => l.trim() !== '' && !l.trim().startsWith('--')) ?? statement;
+      lines.push(`!   ${ddl.trim()}`);
+    }
   }
   if (plan.unmodeled.length > 0) {
     lines.push(`· ${plan.unmodeled.length} unmodeled table(s) ride through untouched: ${plan.unmodeled.join(', ')}`);

package/src/cli/index.ts

@@ -18,6 +18,7 @@ import { dbDiffCommand } from './commands/db-diff.js';
 import { dbPlanCommand } from './commands/db-plan.js';
 import { dbApplyCommand } from './commands/db-apply.js';
 import { dbCheckCommand } from './commands/db-check.js';
+import { dbApproversCommand } from './commands/db-approvers.js';
 import { dbSnapshotCommand, dbSnapshotsCommand } from './commands/db-snapshot.js';
 import { dbBackupProbeCommand, dbBackupCommand, dbBackupsCommand, dbRestoreCommand, dbBackupDownloadCommand } from './commands/db-backup.js';
 import { consoleCommand } from './commands/console.js';
@@ -200,6 +201,9 @@ async function main() {
     case 'db:check':
       await dbCheckCommand(flags);
       break;
+    case 'db:approvers':
+      await dbApproversCommand(flags);
+      break;
     case 'db:authz:pull':
       await dbAuthzPullCommand(flags);
       break;
@@ -327,8 +331,9 @@ Usage:
   everystack db:sync           [--database-url <url>] [--models <barrel>] [--sql-dir db/sql] [--schema-out <file.ts>] [--allow-drops] [--overwrite-drift] [--baseline] [--json]  Make the database match your checkout — one verb, both layers: apply the state diff (tables+authz, one transaction, verified by re-diff), reconcile the derived layer against db/sql, report the resulting fingerprint vs the models' declared one. Dev databases only (direct connection required); DROPs held back unless --allow-drops; derived drift refuses unless --overwrite-drift; exit 1 when not converged
   everystack db:diff           --from-models <barrel> [--to-models db/models/index.ts] [--allow-drops] [--check] [--json]  The state edge between two declared states, NO database: the SQL db:generate would produce, computed purely — CI plan previews (--check exits 1 on a non-empty edge) and computed rollbacks (swap the flags)
   everystack db:plan           [--stage <name> | --database-url <url>] [--models <barrel>] [--allow-drops] [--out db.plan.json | --out -]  Mint a verified edge against a target: asks the TARGET its fingerprint, diffs the models, writes ONE reviewable plan (edge + both endpoint fingerprints). Held drops refuse the mint (--allow-drops carries destruction explicitly). Read-only — works via the ops Lambda; plans are ephemeral, never committed
-  everystack db:apply          --plan <file.plan.json> [--database-url <url>] [--models <barrel>] [--force-descent <snapshot-ref> --confirm]  Run a reviewed plan: verify the target is EXACTLY where the plan started (live fingerprint == plan.from, else refuse — the concurrency lock), verify the checkout DESCENDS from the commit declaring the target's state (the fast-forward rule, else refuse — "rebase first"; force needs the snapshot you took + --confirm), apply as one transaction (schema_log w/ plan_ref), verify it landed exactly on plan.to. Idempotent when already at the target state; direct connection required
+  everystack db:apply          --plan <file.plan.json> [--database-url <url>] [--stage <name>] [--models <barrel>] [--confirm] [--snapshot-ref <ref>] [--force-descent <snapshot-ref> --confirm]  Run a reviewed plan: verify the target is EXACTLY where the plan started (live fingerprint == plan.from, else refuse — the concurrency lock), verify the checkout DESCENDS from the commit declaring the target's state (the fast-forward rule, else refuse — "rebase first"), and for DESTRUCTIVE plans require --confirm always + a snapshot (automatic via db:backup with --stage, else --snapshot-ref) + the stage's approver set when declared (STS identity-verified). Every refusal is recorded in schema_log. Apply as one transaction (plan_ref stamped), verify it landed exactly on plan.to; idempotent when already there; direct connection required
   everystack db:check          [--models <barrel>] [--sql-dir db/sql] [--schema-out <file.ts>] [--database-url <url>] [--json]  The CI gate, per PR: the merged declared state must COMPOSE (models load, no duplicate tables, db/sql parses) and generated artifacts must MATCH regeneration byte-for-byte; with a scratch PostgreSQL it builds the state from scratch on an ephemeral database (created + dropped) and requires fingerprint MATCH. Exit 1 on any failure; never touches a real target
+  everystack db:approvers      --stage <name> [--set "cto,arn:..."] [--remove]  Declare who can DESTROY: the stage's destructive-approver set (SSM parameter, admin-writable). Destructive db:apply runs are then identity-verified (STS) against it; --set '' disables destructive applies; --remove returns the stage to ceremony-only
   everystack db:authz:pull     [--stage <name>] [--dir authz]  Introspect live authz (rls/grants/policies/secdef) → reviewable contract files
   everystack db:authz:diff     [--stage <name>] [--dir authz]  Validate the live DB against the committed contract (non-zero exit on drift)
   everystack db:authz:test     [--stage <name>] [--dir authz]  Red-team enforcement: SET ROLE + attempt per role/table/command (non-zero exit on a hole)

package/src/cli/schema-source.ts

@@ -304,6 +304,11 @@ export function compileDrizzleSource(allModels: ModelDescriptor[], _opts: Compil
       const { call, builder: pgBuilder } = baseColumnSource(toSnakeCase(key), spec);
       pgCoreBuilders.add(pgBuilder);
       const mods = columnModifiers(spec, isComposite, modelsByDescriptor);
+      if (spec.isDeprecated) {
+        // The contract phase (decision 13): the column stays in the database and
+        // stays readable; the strikethrough warns new code away at author time.
+        colLines.push(`  /** @deprecated contract phase — readable, not writable; the physical drop is a later, gated act. */`);
+      }
       colLines.push(`  ${key}: ${call}${mods},`);
     }
 

package/src/cli/state-apply.ts

@@ -56,6 +56,36 @@ export function classifyGeneratedStatements(statements: string[]): ClassifiedSta
   return { executable, heldDrops, notices };
 }
 
+/**
+ * The destructive subset of an executable statement stream — destructive
+ * means DATA LOSS (brick 9's classification, design decision 11):
+ *
+ *   drops       — `DROP TABLE/COLUMN/TYPE`: the data is gone.
+ *   narrowings  — lossy/risky `ALTER COLUMN … SET DATA TYPE`: data loss
+ *                 wearing an ALTER. Detection rides the emitter's structural
+ *                 contract, not prose: a SAFE type change is a bare
+ *                 `SET DATA TYPE`; anything lossy or risky carries a `USING`
+ *                 cast (schema-diff's `classifyTypeChange`, conservative by
+ *                 default — the contract is pinned by test).
+ *
+ * Recoverable metadata is never destructive: policies, grants, constraints,
+ * defaults, nullability all re-declare from the models without touching a row.
+ */
+export interface DestructiveBreakdown {
+  drops: string[];
+  narrowings: string[];
+}
+
+export function classifyDestructive(executable: string[]): DestructiveBreakdown {
+  const drops: string[] = [];
+  const narrowings: string[] = [];
+  for (const statement of executable) {
+    if (/\bDROP\s+(TABLE|COLUMN|TYPE)\b/.test(statement)) drops.push(statement);
+    else if (/\bSET DATA TYPE\b/.test(statement) && /\bUSING\b/.test(statement)) narrowings.push(statement);
+  }
+  return { drops, narrowings };
+}
+
 /** The current git HEAD, for schema_log's intent pointer. Null outside a repo. */
 export function currentGitRef(): string | null {
   try {