@everystack/cli 0.3.31 → 0.4.1

package/README.md

@@ -216,7 +216,7 @@ everystack db:psql --stage dev [-c SQL] # interactive psql / one-off query via L
 # Model-driven schema (@everystack/model)
 everystack db:generate                  # diff Models vs the live DB → next migration
 everystack db:pull                      # introspect a live DB → field() Models (brownfield on-ramp)
-everystack db:reconcile                 # deploy the derived layer (functions/views/matviews) from db/sql — no migrations
+everystack db:reconcile                 # deploy the derived layer (functions/views/matviews/triggers) from the declared descriptors in db/models — no migrations
 everystack db:fingerprint               # content-address the live base schema vs the Models — MATCH/MISMATCH
 everystack db:sync                      # make the database match your checkout — state + compute, one verb (dev DBs)
 everystack db:diff                      # the state edge between two declared states — no DB, CI-pure; reverse = computed rollback

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.3.31",
+  "version": "0.4.1",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -82,7 +82,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.3.6"
+    "@everystack/model": "0.4.1"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.1.0",

package/src/.pdr-tmp-20277-1783706384842.ts

@@ -0,0 +1,59 @@
+import { defineModel, field, can, index, defineModule, sql, arg, defineFunction, defineMaterializedView, defineSequence, defineView } from '@everystack/model';
+
+export const PdrPost = defineModel('pdr_posts', {
+  abilities: [can('read'), can('manage', { role: 'admin' })],
+  fields: {
+    id: field.integer().primaryKey(),
+    title: field.text().notNull(),
+    tags: field.text().array().notNull().default("{}"),
+  },
+});
+
+export const pdrTicketSeq = defineSequence('pdr_ticket_seq', { start: 500 });
+
+export const pdrsPdrArea = defineFunction('pdrs.pdr_area', {
+  args: [arg('w', 'integer'), arg('h', 'integer')],
+  returns: 'integer',
+  language: 'sql',
+  volatility: 'immutable',
+  abilities: [can('execute', { role: 'authenticated' })],
+  body: sql`SELECT w * h`,
+});
+
+export const pdrBoard = defineMaterializedView('pdr_board', {
+  abilities: [can('read')],
+  dependsOn: [PdrPost],
+  indexes: [index('tags').using('gin')],
+  as: sql`SELECT tags,
+    count(*) AS n
+   FROM pdr_posts
+  GROUP BY tags`,
+});
+
+export const pdrScore = defineFunction('pdr_score', {
+  args: [arg('points', 'integer', { default: sql`1` })],
+  returns: 'integer',
+  language: 'sql',
+  volatility: 'stable',
+  abilities: [can('execute', { role: 'authenticated' })],
+  body: sql`SELECT points * 2`,
+});
+
+export const pdrTitles = defineView('pdr_titles', {
+  securityInvoker: false,
+  abilities: [can('read')],
+  dependsOn: [PdrPost],
+  as: sql`SELECT id,
+    title
+   FROM pdr_posts`,
+});
+
+export const models = [PdrPost];
+
+export const sequences = [pdrTicketSeq];
+
+export const derived = [pdrsPdrArea, pdrBoard, pdrScore, pdrTitles];
+
+export const appModule = defineModule({ models, sequences, derived });
+
+export const modules = [appModule];

package/src/.roundtrip-tmp-20275-1783706385459.ts

@@ -0,0 +1,121 @@
+import { defineModel, field, unique, check, index, foreignKey, defineModule, sql } from '@everystack/model';
+import { z } from 'zod';
+
+export const RtAccount = defineModel('rt_accounts', {
+  // Declare the read model — db:check fails this model until its authz is authored:
+  // abilities: [can('read')],                          // public data
+  // abilities: [can('read', { owner: '<column>' })],   // rows owned by a user
+  // private: true,                                     // not part of the data API
+  fields: {
+    id: field.uuid().primaryKey().defaultRandom(),
+    email: field.text().notNull().unique(),
+    displayName: field.text().notNull(),
+    age: field.integer(),
+    balance: field.bigint().notNull().default(0),
+    creditLimit: field.numeric(12, 2),
+    score: field.numeric(8),
+    slug: field.varchar(255).notNull(),
+    region: field.varchar(),
+    bio: field.text().validate(z.string().max(160)),
+    active: field.boolean().notNull().default(true),
+    role: field.text().notNull().default("member"),
+    status: field.enum('account_status', ['active', 'suspended', 'closed']).notNull().default("active"),
+    metadata: field.jsonb(),
+    bornOn: field.date(),
+    createdAt: field.timestamptz().notNull().defaultNow(),
+    updatedAt: field.timestamp(),
+  },
+});
+
+export const RtMetricArchive = defineModel('rt_metric_archives', {
+  // Declare the read model — db:check fails this model until its authz is authored:
+  // abilities: [can('read')],                          // public data
+  // abilities: [can('read', { owner: '<column>' })],   // rows owned by a user
+  // private: true,                                     // not part of the data API
+  fields: {
+    id: field.integer().primaryKey().defaultSql(sql`nextval('rt_metrics_id_seq'::regclass)`),
+    note: field.text(),
+  },
+});
+
+export const RtMetric = defineModel('rt_metrics', {
+  // Declare the read model — db:check fails this model until its authz is authored:
+  // abilities: [can('read')],                          // public data
+  // abilities: [can('read', { owner: '<column>' })],   // rows owned by a user
+  // private: true,                                     // not part of the data API
+  fields: {
+    id: field.serial().primaryKey(),
+    noteId: field.uuid().notNull().references(() => RtNote),
+    coverRate: field.real(),
+    meanMiss: field.doublePrecision().notNull(),
+    counter: field.bigserial(),
+    yardline_100: field.integer(),
+    top_3Best: field.integer(),
+    tags: field.text().array(),
+  },
+});
+
+export const RtNoteTag = defineModel('rt_note_tags', {
+  // Declare the read model — db:check fails this model until its authz is authored:
+  // abilities: [can('read')],                          // public data
+  // abilities: [can('read', { owner: '<column>' })],   // rows owned by a user
+  // private: true,                                     // not part of the data API
+  fields: {
+    noteId: field.uuid().primaryKey().references(() => RtNote),
+    label: field.text().primaryKey(),
+  },
+});
+
+export const RtNote = defineModel('rt_notes', {
+  // Declare the read model — db:check fails this model until its authz is authored:
+  // abilities: [can('read')],                          // public data
+  // abilities: [can('read', { owner: '<column>' })],   // rows owned by a user
+  // private: true,                                     // not part of the data API
+  fields: {
+    id: field.uuid().primaryKey().defaultRandom(),
+    accountId: field.uuid().notNull().references(() => RtAccount, { onDelete: 'cascade' }),
+    parentId: field.uuid().references(() => RtNote, { onDelete: 'set null', onUpdate: 'cascade' }),
+    title: field.text().notNull(),
+    body: field.text(),
+    pinned: field.boolean().notNull().default(false),
+    createdAt: field.timestamptz().notNull().defaultNow(),
+  },
+  constraints: [
+    unique('accountId', 'title'),
+    check(sql`char_length(title) > 0`),
+    index('createdAt').where(sql`pinned = true`),
+    index('parentId'),
+  ],
+});
+
+export const RtTagLink = defineModel('rt_tag_links', {
+  // Declare the read model — db:check fails this model until its authz is authored:
+  // abilities: [can('read')],                          // public data
+  // abilities: [can('read', { owner: '<column>' })],   // rows owned by a user
+  // private: true,                                     // not part of the data API
+  fields: {
+    id: field.uuid().primaryKey().defaultRandom(),
+    noteId: field.uuid().notNull(),
+    label: field.text().notNull(),
+  },
+  constraints: [
+    foreignKey(['noteId', 'label'], () => RtNoteTag, ['noteId', 'label'], { onDelete: 'cascade' }),
+  ],
+});
+
+export const RtTicket = defineModel('rt_tickets', {
+  // Declare the read model — db:check fails this model until its authz is authored:
+  // abilities: [can('read')],                          // public data
+  // abilities: [can('read', { owner: '<column>' })],   // rows owned by a user
+  // private: true,                                     // not part of the data API
+  fields: {
+    id: field.uuid().primaryKey().defaultRandom(),
+    ticketNumber: field.bigint().notNull().defaultSql(sql`nextval('rt_ticket_counter'::regclass)`),
+  },
+});
+
+export const models = [RtAccount, RtMetricArchive, RtMetric, RtNoteTag, RtNote, RtTagLink, RtTicket];
+
+export const appModule = defineModule({ models });
+
+export const modules = [appModule];

package/src/cli/authz-compile.ts

@@ -308,8 +308,10 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
 /** The four DML privileges, sorted — the expansion of a `manage` ability. */
 const CRUD = ['DELETE', 'INSERT', 'SELECT', 'UPDATE'];
 
-/** The SQL privilege a single CRUD verb grants. `manage` expands to all of CRUD. */
-const VERB: Record<Exclude<Ability['action'], 'manage'>, string> = {
+/** The SQL privilege a single CRUD verb grants. `manage` expands to all of CRUD.
+ *  `execute` is a FUNCTION ability — defineModel rejects it on tables, so it never
+ *  reaches the table grant compiler (the throw below keeps that contract loud). */
+const VERB: Record<Exclude<Ability['action'], 'manage' | 'execute'>, string> = {
   read: 'SELECT',
   create: 'INSERT',
   update: 'UPDATE',
@@ -318,6 +320,7 @@ const VERB: Record<Exclude<Ability['action'], 'manage'>, string> = {
 
 /** The privileges an ability's action grants (a single verb, or all of CRUD for `manage`). */
 function verbsFor(action: Ability['action']): string[] {
+  if (action === 'execute') throw new Error(`can('execute') is a function ability — it has no table privilege (defineModel rejects it; this is unreachable).`);
   return action === 'manage' ? [...CRUD] : [VERB[action]];
 }
 

package/src/cli/aws.ts

@@ -6,6 +6,7 @@
  */
 
 import { isOpsHandlerCrash, extractCrashDiagnosis, formatOpsCrashReport } from './ops-diagnostics.js';
+import { tagInvokeTransport } from './ops-advice.js';
 
 let s3Client: InstanceType<typeof import('@aws-sdk/client-s3').S3Client> | null = null;
 let lambdaClient: InstanceType<typeof import('@aws-sdk/client-lambda').LambdaClient> | null = null;
@@ -262,6 +263,10 @@ export async function invokeAction(
   const invoke = (fnName: string) =>
     client.send(new InvokeCommand({ FunctionName: fnName, Payload: encoded }));
 
+  // A throw from the SDK means the Lambda NEVER RAN (credentials, permissions,
+  // network, missing function) — tagged as transport so the shells' IAM advice
+  // prints for THIS class only. A FunctionError below is the opposite: the
+  // handler ran and threw, and IAM advice would be a lie.
   let response;
   let invokedName = functionName;
   try {
@@ -272,7 +277,7 @@ export async function invokeAction(
     // then bust the stale cache so the next command discovers fresh.
     if (err && typeof err === 'object' && (err as { name?: string }).name === 'ResourceNotFoundException') {
       const live = await resolveFunctionName(region, functionName);
-      if (live === functionName) throw err;
+      if (live === functionName) throw tagInvokeTransport(err);
       try {
         const { invalidateCacheByFunctionName } = await import('./discover.js');
         await invalidateCacheByFunctionName(functionName);
@@ -280,9 +285,13 @@ export async function invokeAction(
         // Cache invalidation is best-effort
       }
       invokedName = live;
-      response = await invoke(live);
+      try {
+        response = await invoke(live);
+      } catch (err2: unknown) {
+        throw tagInvokeTransport(err2);
+      }
     } else {
-      throw err;
+      throw tagInvokeTransport(err);
     }
   }
 

package/src/cli/backfill.ts

@@ -8,7 +8,7 @@
  * unlike `schema_log`, which stays a write-only memoir. The distrust that
  * killed the migration tape doesn't transfer: nothing is numbered, nothing
  * is watermarked, and identity is the NORMALIZED CONTENT HASH (the same
- * comment-insensitive, dollar-quote-aware lexing as db/sql) — renaming a
+ * comment-insensitive, dollar-quote-aware lexing as the reconciler) — renaming a
  * file or editing a comment is a no-op, never a re-run.
  *
  * One-shot jobs are IMMUTABLE. A file whose name already ran on this

package/src/cli/commands/db-authz.ts

@@ -15,8 +15,6 @@
  */
 
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import type { ModelDescriptor } from '@everystack/model';
 import {
   introspectContract,
   diffContracts,
@@ -47,6 +45,8 @@ import { resolveConfig, opsFunction } from '../config.js';
 import { resolveModelsPath } from '../models-path.js';
 import { invokeAction } from '../aws.js';
 import { step, success, fail, info, warn } from '../output.js';
+import { opsAdviceLines, IAM_ADVICE } from '../ops-advice.js';
+import { loadModels } from './db-generate.js';
 
 const DEFAULT_DIR = 'authz';
 
@@ -75,7 +75,7 @@ export async function dbAuthzPullCommand(flags: Record<string, string>): Promise
     contract = await introspectStage(flags);
   } catch (err: any) {
     fail(err.message);
-    info('Ensure your IAM user/role has lambda:InvokeFunction permission.');
+    for (const line of opsAdviceLines(err, [IAM_ADVICE])) info(line);
     process.exit(1);
   }
 
@@ -207,20 +207,6 @@ export async function dbAuthzTestCommand(flags: Record<string, string>): Promise
   process.exit(1);
 }
 
-/** Import the app's Model barrel and return its `models` array (runs under tsx, so TS imports work). */
-async function loadModels(modelsPath: string): Promise<ModelDescriptor[]> {
-  const abs = path.resolve(modelsPath);
-  let mod: any;
-  try {
-    mod = await import(pathToFileURL(abs).href);
-  } catch (err: any) {
-    throw new Error(`Could not load models from ${modelsPath}: ${err.message}`);
-  }
-  const models = mod.models ?? mod.default;
-  if (!Array.isArray(models)) throw new Error(`${modelsPath} must export a \`models\` array (got ${typeof models}).`);
-  return models;
-}
-
 /**
  * `db:authz:owner` — the owner-aware red-team. Where `db:authz:test` proves grants (can a ROLE
  * do a command), this proves ISOLATION: can one user read or mutate another user's row? It is

package/src/cli/commands/db-branch.ts

@@ -4,7 +4,7 @@
  * decision 14).
  *
  *   db:template:refresh [--database-url <url>] [--models <barrel>]
- *                       [--sql-dir db/sql] [--seed "<cmd>"] [--no-seed]
+ *                       [--seed "<cmd>"] [--no-seed]
  *   db:branch                       # mint (or find) the current branch's DB
  *   db:branch --list                # every branch DB, mapped to its branch
  *   db:branch --drop --confirm      # drop the current branch's DB
@@ -39,7 +39,7 @@ import { currentGitRef } from '../state-apply.js';
 import { fingerprintModels } from '../schema-fingerprint.js';
 import { resolveDbSource, type DbSource } from '../db-source.js';
 import { resolveModelsPath } from '../models-path.js';
-import { readSqlDirIfPresent } from './db-sync.js';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
 import { loadModels } from './db-generate.js';
 import { step, success, fail, info, warn } from '../output.js';
 
@@ -92,7 +92,30 @@ export async function dbTemplateRefreshCommand(flags: Record<string, string>): P
     fail(err.message);
     process.exit(1);
   }
-  const sources = await readSqlDirIfPresent(flags['sql-dir'] || 'db/sql');
+  // B7 tombstone — db/sql is retired and no longer read.
+  try {
+    if (flags['sql-dir']) {
+      fail(await retiredSqlDirFlagRefusal(flags['sql-dir']));
+      process.exit(1);
+    }
+    const retired = await retiredSqlDirAnywhere(flags.models);
+    if (retired) {
+      fail(retired);
+      process.exit(1);
+    }
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+  // The declared derived layer + sequences — branch/template DBs carry the SAME stream
+  // every other verb deploys, or a minted branch is silently missing its compute.
+  let declaredDb: DeclaredDerived | null = null;
+  try {
+    declaredDb = await loadDeclaredDerived(flags.models);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
 
   let seedCommand: string | null = null;
   if (flags['no-seed'] === 'true') {
@@ -109,7 +132,8 @@ export async function dbTemplateRefreshCommand(flags: Record<string, string>): P
   step(`Rebuilding ${template} from the declared state (drop → create → sync both layers → seed)...`);
   try {
     const result = await executeTemplateRefresh(url, models, {
-      sources,
+      declared: declaredDb?.objects,
+      sequences: declaredDb?.sequences,
       actor: process.env.USER ?? null,
       gitRef: currentGitRef(),
       seed: seedCommand === null ? null : (templateUrl) => {

package/src/cli/commands/db-check.ts

@@ -3,7 +3,7 @@
  * invariant: the merged declared state must compose, and generated
  * artifacts must match regeneration).
  *
- *   db:check [--models <barrel>] [--sql-dir db/sql] [--schema-out <file.ts>]
+ *   db:check [--models <barrel>] [--schema-out <file.ts>]
  *            [--database-url <url>] [--json]
  *
  * Two rings, both from the checkout alone (no target database is ever
@@ -13,7 +13,8 @@
  *   git can't see, like two branches declaring the same table, fails
  *   here); the generated drizzle schema matches a byte-for-byte
  *   regeneration (hand-edited artifacts and forgotten `db:generate` runs
- *   fail loudly); the derived sources in db/sql parse.
+ *   fail loudly); a leftover db/sql directory fails with the migration
+ *   path (B7 — descriptors are the single home).
  *
  *   EPHEMERAL COMPOSE — with a scratch PostgreSQL (`--database-url` /
  *   DATABASE_URL), build the merged declared state FROM SCRATCH on an
@@ -28,24 +29,25 @@
  */
 
 import fs from 'node:fs/promises';
-import type { ModelDescriptor } from '@everystack/model';
+import type { ModelDescriptor, DerivedDescriptor } from '@everystack/model';
 import { compileDeclaredState } from '../declared-diff.js';
 import { compileMigration } from '../migration-compile.js';
 import { compileDrizzleSource } from '../schema-source.js';
-import { parseSqlSources, type SourceFile } from '../derived-source.js';
 import { currentGitRef } from '../state-apply.js';
 import { createDatabase, dropDatabase, buildIntoDatabase, withDatabase } from '../db-build.js';
 import { resolveModelsPath } from '../models-path.js';
-import { readSqlDirIfPresent } from './db-sync.js';
 import { loadModels } from './db-generate.js';
+import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, type DeclaredDerived } from '../declared-derived.js';
+import type { SequenceDescriptor } from '@everystack/model';
+import type { SourceObject } from '../derived-source.js';
 import { findReadAuthzGaps } from '../authz-lint.js';
+import { findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings } from '../derived-lint.js';
 import { step, success, fail, info, warn } from '../output.js';
 
 // The role derivation moved to the shared builder (db-build) with brick
 // 5-remainder; re-exported here because db:check is where it grew up.
 export { rolesFromContract } from '../db-build.js';
 
-const DEFAULT_SQL_DIR = 'db/sql';
 const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';
 
 // ---------------------------------------------------------------------------
@@ -53,7 +55,8 @@ const DEFAULT_SCHEMA_OUT = 'db/schema.generated.ts';
 // ---------------------------------------------------------------------------
 
 export interface CheckFinding {
-  level: 'ok' | 'note' | 'fail';
+  /** `warn` is visible-but-never-fatal — the matview snapshot gate's channel. */
+  level: 'ok' | 'note' | 'warn' | 'fail';
   area: 'models' | 'compose' | 'artifact' | 'compute' | 'authz';
   message: string;
 }
@@ -66,8 +69,15 @@ export interface StaticCheckInput {
   artifactPath: string;
   /** null = no generated schema artifact on disk. */
   artifactSource: string | null;
-  /** null = no db/sql directory. */
-  sources: SourceFile[] | null;
+  /** Set when a retired db/sql directory still carries .sql files — the tombstone
+   *  message (with the migration path); a hard fail, never a shrug. */
+  sqlDirRetired?: string | null;
+  /** Standalone sequences the modules declare (state — in the from-scratch compose). */
+  sequences?: SequenceDescriptor[];
+  /** The declared derived descriptors (raw — the B2 gates read abilities, not SQL). */
+  derived?: DerivedDescriptor[] | null;
+  /** Set when the derived layer failed to COMPILE (e.g. reachability) — a hard fail. */
+  derivedError?: string;
 }
 
 export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
@@ -98,7 +108,7 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
   }
   try {
     compileDeclaredState(input.models);
-    const statements = compileMigration(input.models);
+    const statements = compileMigration(input.models, { sequences: input.sequences });
     findings.push({ level: 'ok', area: 'compose', message: `declared state composes — ${statements.length} statement(s) from scratch` });
   } catch (err: any) {
     findings.push({ level: 'fail', area: 'compose', message: `the merged declared state does NOT compose: ${err.message}` });
@@ -116,13 +126,43 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     }
   }
 
+  // The derived layer failing to COMPILE (reachability, cycles, undeclared trigger
+  // functions) is a hard fail — CI cannot shrug at a compile error.
+  if (input.derivedError) {
+    findings.push({
+      level: 'fail',
+      area: 'compute',
+      message: `the declared derived layer does NOT compile: ${input.derivedError}`,
+    });
+  }
+
+  // The B2 gates over the declared derived layer: every relation makes its read decision
+  // (fail), every SECURITY DEFINER declares its callers (fail), and a matview over
+  // row-scoped sources is named for what it is — a snapshot with the refresher's eyes (warn).
+  if (input.derived?.length) {
+    const derivedGaps = [...findDerivedReadGaps(input.derived), ...findSecdefExecuteGaps(input.derived)];
+    for (const gap of derivedGaps) {
+      findings.push({ level: 'fail', area: 'authz', message: gap.message });
+    }
+    for (const warning of findMatviewSnapshotWarnings(input.derived)) {
+      findings.push({ level: 'warn', area: 'authz', message: warning.message });
+    }
+    if (derivedGaps.length === 0) {
+      findings.push({
+        level: 'ok',
+        area: 'authz',
+        message: `every derived relation declares its read surface and every SECURITY DEFINER its callers (${input.derived.length} descriptor(s))`,
+      });
+    }
+  }
+
   if (input.artifactSource === null) {
     findings.push({
       level: 'note',
       area: 'artifact',
       message: `no generated schema at ${input.artifactPath} — nothing to match (db:generate writes it)`,
     });
-  } else if (input.artifactSource === compileDrizzleSource(input.models)) {
+  } else if (input.artifactSource === compileDrizzleSource(input.models, { derived: input.derived ?? undefined })) {
     findings.push({ level: 'ok', area: 'artifact', message: `${input.artifactPath} matches regeneration byte-for-byte` });
   } else {
     findings.push({
@@ -132,20 +172,10 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     });
   }
 
-  if (input.sources === null) {
-    findings.push({ level: 'note', area: 'compute', message: 'no db/sql directory — derived layer not declared, nothing to parse' });
-  } else {
-    try {
-      const parsed = parseSqlSources(input.sources);
-      findings.push({
-        level: 'ok',
-        area: 'compute',
-        message: `${parsed.objects.length} derived object(s) parsed from ${input.sources.length} db/sql file(s)`,
-      });
-      for (const w of parsed.warnings) findings.push({ level: 'note', area: 'compute', message: w });
-    } catch (err: any) {
-      findings.push({ level: 'fail', area: 'compute', message: `db/sql does not parse: ${err.message}` });
-    }
+  // B7 — db/sql is retired. Files still present would be silently unmanaged: fail
+  // with the migration path. (Absence is the normal state; nothing to report.)
+  if (input.sqlDirRetired) {
+    findings.push({ level: 'fail', area: 'compute', message: input.sqlDirRetired });
   }
 
   return findings;
@@ -177,14 +207,14 @@ export interface EphemeralComposeResult {
 export async function executeEphemeralCompose(
   adminUrl: string,
   models: ModelDescriptor[],
-  sources: SourceFile[] | null,
-  opts: { actor?: string | null; gitRef?: string | null } = {},
+  opts: { actor?: string | null; gitRef?: string | null; declared?: SourceObject[]; sequences?: SequenceDescriptor[] } = {},
 ): Promise<EphemeralComposeResult> {
   const database = `escheck_${process.pid}_${Date.now()}`;
   await createDatabase(adminUrl, database);
   try {
     const built = await buildIntoDatabase(withDatabase(adminUrl, database), models, {
-      sources,
+      declared: opts.declared,
+      sequences: opts.sequences,
       actor: opts.actor ?? 'db:check',
       gitRef: opts.gitRef ?? null,
     });
@@ -198,7 +228,7 @@ export async function executeEphemeralCompose(
 // The CLI shell.
 // ---------------------------------------------------------------------------
 
-const MARK: Record<CheckFinding['level'], string> = { ok: '=', note: '·', fail: '!' };
+const MARK: Record<CheckFinding['level'], string> = { ok: '=', note: '·', warn: '~', fail: '!' };
 
 export async function dbCheckCommand(flags: Record<string, string>): Promise<void> {
   const modelsPath = resolveModelsPath(flags.models);
@@ -218,11 +248,30 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
   } catch {
     artifactSource = null;
   }
-  const sources = await readSqlDirIfPresent(flags['sql-dir'] || DEFAULT_SQL_DIR);
+  // B7 tombstone — a retired db/sql directory still carrying .sql files is a FAIL
+  // finding (the message carries the migration path), never a silent skip. The retired
+  // --sql-dir flag is itself a FAIL finding here (the sibling verbs refuse it outright);
+  // detector errors (an unreadable directory) surface as the finding, never disarm it.
+  const sqlDirRetired = flags['sql-dir']
+    ? await retiredSqlDirFlagRefusal(flags['sql-dir'])
+    : await retiredSqlDirAnywhere(flags.models).catch((err: any) => String(err?.message ?? err));
+
+  // The declared derived layer + sequences — the same stream every other verb consumes.
+  // A compile failure here (reachability, cycles) is a FAIL finding, not a shrug.
+  let declaredDb: DeclaredDerived | null = null;
+  let derivedError: string | undefined;
+  try {
+    declaredDb = await loadDeclaredDerived(flags.models);
+  } catch (err: any) {
+    derivedError = err.message;
+  }
 
-  const findings = runStaticChecks({ modelsPath, models, modelsError, artifactPath, artifactSource, sources });
+  const findings = runStaticChecks({
+    modelsPath, models, modelsError, artifactPath, artifactSource, sqlDirRetired,
+    sequences: declaredDb?.sequences, derived: declaredDb?.derived, derivedError,
+  });
   for (const f of findings) {
-    (f.level === 'fail' ? warn : info)(`${MARK[f.level]} ${f.area}: ${f.message}`);
+    (f.level === 'fail' || f.level === 'warn' ? warn : info)(`${MARK[f.level]} ${f.area}: ${f.message}`);
   }
 
   let ephemeral: EphemeralComposeResult | null = null;
@@ -236,9 +285,11 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
   } else {
     step('Composing the declared state from scratch on an ephemeral database...');
     try {
-      ephemeral = await executeEphemeralCompose(url, models!, sources, {
+      ephemeral = await executeEphemeralCompose(url, models!, {
         actor: process.env.USER ?? 'db:check',
         gitRef: currentGitRef(),
+        declared: declaredDb?.objects,
+        sequences: declaredDb?.sequences,
       });
       for (const line of ephemeral.report) info(`  ${line}`);
     } catch (err: any) {

package/src/cli/commands/db-fingerprint.ts

@@ -30,6 +30,8 @@ import { resolveConfig, opsFunction } from '../config.js';
 import { invokeAction } from '../aws.js';
 import { step, success, fail, info, warn } from '../output.js';
 import { loadModels } from './db-generate.js';
+import { loadDeclaredDerived } from '../declared-derived.js';
+import type { SequenceDescriptor } from '@everystack/model';
 
 export interface FingerprintStatus {
   live: string;
@@ -42,11 +44,12 @@ export interface FingerprintStatus {
 export async function computeFingerprintStatus(
   runner: QueryRunner,
   models: ModelDescriptor[] | null,
+  sequences?: SequenceDescriptor[],
 ): Promise<FingerprintStatus> {
   const snapshot = await introspectSchema(runner);
   const contract = await introspectContract(runner, contractFunctionRow, FUNCTIONS_SQL);
   const live = fingerprintLive(snapshot, contract).hash;
-  const declared = models ? fingerprintModels(models).hash : null;
+  const declared = models ? fingerprintModels(models, { sequences }).hash : null;
   const unfingerprinted = mapUnfingerprintedRows((await runner(UNFINGERPRINTED_SQL)) as any[]);
   return { live, declared, match: declared === null ? null : live === declared, unfingerprinted };
 }
@@ -71,8 +74,10 @@ export async function dbFingerprintCommand(flags: Record<string, string>): Promi
 
   const modelsPath = resolveModelsPath(flags.models);
   let models: ModelDescriptor[] | null = null;
+  let sequences: SequenceDescriptor[] | undefined;
   try {
     models = await loadModels(modelsPath);
+    sequences = (await loadDeclaredDerived(flags.models))?.sequences;
   } catch {
     // Live-only mode: no models barrel — still useful (what fingerprint is this DB at?).
   }
@@ -89,7 +94,7 @@ export async function dbFingerprintCommand(flags: Record<string, string>): Promi
   }
 
   try {
-    const status = await computeFingerprintStatus(runner, models);
+    const status = await computeFingerprintStatus(runner, models, sequences);
 
     if (flags.json === 'true') {
       console.log(JSON.stringify(status, null, 2));